Load testing OAuth2 Authorization Code Grant (with JMeter)

Question

We have implemented an OAuth2 Authorization Server (and Identity Provider). Now we want to perform load tests to gage system performance.

The concrete problem I have now, is that I want to load test an Authorization Code Flow. I have been using JMeter so far. But I have no clue how to provide an endpoint for the required redirect_uri, to complete the flow. Is there any way to do this at all, or am I out of luck? Google was no help. If JMeter can't do it, is there a tool that can?

Answer 1

Provide whatever redirect_uri parameter you want, i.e. http://localhost:8081/oauth/login and fetch the required parameters from the response Location header using Regular Expression Extractor

Of course the sampler will fail as most probably you don't have anything running on your machine which could serve as a redirect target so either use HTTP Mirror Server to provide a stub or just mark the sampler as successful by adding Response Assertion to it and ticking Main sample and sub-samples and Ignore Status boxes