General Information
The following tests usually assume a fresh login between pages. The
test pages themselves usually have a logout link that you can use once
you have verified that page works.
It's best to test without SPNEGO on once, and then go back to the first
general test afterwards with SPNEGO on to test that.
General WebAuth Tests
- basic WebAuth test
This test will simply check to make sure you can successfully log
in via WebAuth.
- test extra redirect
Sets WebAuthReturnURL with WebAuthExtraRedirect and verify we end up at
the right page with no token cookies visible.
- test environment variable prefix
This sets WebAuthVarPrefix, which should apply a prefix to all
environmental variables set by WebLogin.
- test cancel login
Sets WebAuthLoginCanceledURL. Log out fully before this test, then on
this test hit cancel when you get to the login page. You should be sent
to a page that tells you the test succeeded.
- test return url
Set WebAuthReturnURL, which will make the user go to a different page
than the original requesting page after they've logged in.
- test query params on initial
redirect
Test that a WebAuthReturnURL only removes the tokens and not other query
parameters.
- test 5 second app-token
lifetime
Tests WebAuthAppTokenLifetime set to five seconds. You'll go to the page
and follow instructions there in waiting and then reloading the page.
Since login isn't forced, you'll pass back through the WebKDC
transparently getting a new app token. The only thing you'll notice is
if you see the URL updating in your browser as this happens.
- test 5 second app-token lifetime and force
login
This adds to the previous tests also setting WebAuthForceLogin on for the
site. That means that after the app token has expired, you will be
forced to log in once more, making this an easier test to understand.
- test last-used update
Test that the WebAuthLastUseUpdateInterval is properly working. You
will be prompted to visit the page again after a few seconds and be shown
visit times for both the first and second visit, in order to verify that
the value is updated.
- test inactive-expire
Adds WebAuthInactiveExpire of 20s to the prior test. If you revisit the
page in under 20s, nothing happens. If you revisit the page after 20s
of no activity, you will be forced to log in again.
- test for no query params on initial
redirect
Test that WebAuthReturnURL suppresses the token query parameters.
- test POST with expired
cookie
Tests WebAuthPostReturnURL to see if it will properly redirect after
a POST with an expired cookie. Normally this will break logging back in
until you go to the original URL without POST.
- test optional
authentication
Set WebAuthOptional on, where the page doesn't require the user to
authenticate, but picks up authentication information if the user has
already authenticated.
- test cookie path restrictions (be sure
you are logged out when running this test)
Set WebAuthCookiePath to a limited directory during your login, then go
to another directory not under that path to make sure that your
credentials don't leak. This test requires you to log out beforehand.
- test StanfordAuth
StanfordAuth is an older alias for WebAuth in setting up the Apache
AuthType. This test simply makes sure we can log in correctly for a
site using that declaration.
- test PHP (only works if PHP
installed)
Test that all WebAuth environmental variables are set on PHP scripts
behind WebAuth.
Multifactor Tests
- any multifactor required
User should be prompted for multifactor login so long as they have not
already logged in with multifactor.
- OTP multifactor required
User should only be allowed to log in with a multifactor method using
a one-time password. If they are already logged in with multifactor,
they will be prompted for multifactor again if they did not use an OTP
during that login.
- OTP multifactor plus password required
User should be required to provide a password (even if they normally
use SPNEGO, along with a one-time password for multifactor.
- random multifactor required
Tests random multifactor. This has only a chance of succeeding, 10%
by default on the userinfo service, and so this should be rerun multiple
times.
- o50 multifactor method required
Requires a strong OTP password, such as one given by an authenticator
app or hardware token rather than SMS or a list.
- LoA required at a level any user
should meet
A user should be allowed access to the site without multifactor.
- LoA required at a level any OTP user
should meet
A user should be allowed access to the site with any OTP.
- LoA required at a level an OTP user
with strong authentication should meet
User with a list OTP should be denied, while a user with an authenticator
or hardware token should be allowed.
- LoA required at a level no user
should meet (access denied)
User should be denied access to the site with a warning.
- LoA required at a level any OTP
users should meet plus o50 multifactor required plus force login for
multifactor
LoA of 2 with an authenticator app should login, and be forced through
login.
- force session with password
- force session with multifactor
- force session with negotiate-auth
- force session with random
multifactor