CODEWITHSUNDEEP
testingprotractorautomated-testsazure-active-directorymulti-factor-authentication
Emilia
Emilia

Reputation: 51

How to skip MFA in e2e tests?

I have some difficulties with automating log in process in the web application. It's an angular app, I'm writing tests in protractor. The app uses Azure AD, so I need to pass e-mail, password and the verification code from mobile app. I know there're some very useful libraries to generate the code. The problem is I don't have the access to Azure admin panel so I'm not able to get the secret key that is necessary to use those libraries. Is it possible to somehow skip or mock the MFA? I'd be grateful for any advices how to solve this.

Upvotes: 4

Views: 1998

Answers (2)

JBernales
JBernales

Reputation: 149

I would actually recommend NOT skipping MFA on E2E tests in your CI.

By setting up a bypass in your code related to your environments you are taking the risk of having this "test account" in the production environment and being it found by someone. And believe me, it will happen sooner or later ;).

Today multiple third-party tools exist allowing you to parse SMS-based MFA or TOTP codes (like the Azure app). For example, the GetMyMFA platform provides you with an API allowing you to receive and inject in your CI your MFA codes.

If you have the time and resources, I would recommend looking for a tool that allows you to get MFA codes from an API and have your automated E2E tests inject that code in your CI.

Cheers

Upvotes: 2

Sankalan Parajuli
Sankalan Parajuli

Reputation: 690

Assuming you want to run these tests on the CI, you could hard code a test user credential in your web application that returns true when used in a specific environment. Lets say you want user [email protected] to login and then perform other tasks, add code in your web application so that when [email protected] sends a request with dummy secret key, log the user in. Then you'd have to mock all the rest of the APIs that your application uses.

You can also remove the auth when you are testing it in a test CI environment. This would be a good solution but tricky. You would have to remove auth entirely for all APIs and that would require design pattern change etc.

But get the access and do it the right way.

Upvotes: -1

Related Questions