Mind App Automation Testing with Postman or Newman possibility?
Is there a mechanism to login to a MindSphere Tenant in Postman??
Exposing access token via API in a mind app in the same tenant and using it in subsequent Rest API calls is another option which I am not looking for.
https://developer.mindsphere.io/howto/howto-local-development.html says two options. But,
1) Access tokens generated using service credentials have admin scope, which means it is not suitable for testing applications with different user types.
2) Session cookies are only valid for up to 12 hours and expire after 30 minutes of inactivity. However, by assigning your user specific application roles it is possible to test your application's behavior for users other than admin. Is there a way to avoid this copy paste sessions for complete automation??
At this moment, there is no known solution for this. But you can try this:
Use selenium to login in a headless chrome and get session cookies and XSRF Token and store them in environment. Then attach them in API calls.
This is what I am doing at this moment. Let me know if you come to know any other solutions/suggestions.
Related
I am developing web platform which has to have 3 type of users (user, admin, partner companies). For the authentication I am considering to use google Identity platform with multitenancy (probably users in one tenant and admins are in different tenant).
As I understand from documentation, how do we integrate identity platform to our application is to create identity platform provider from console and integrate it into frontend with UI. From front-end, without contacting backend service we can sign up, login and logout by calling firebase SDK and it will give us authentication token. From backend I can check that token with middleware and decide if I agree the user as authenticated or not. Correct me if I am wrong.
Then I can get some metadata of authenticated user from the token, maybe email or name etc. But I want to store user related information on noSQL database as well. For example, if user wants to change his email I need to handle it in backend server, also, I'd like to store users log (access and audit log on somewhere else). In case of, I am using frontend UI and SDK how do log the access and audit information on my backend? also, when changing user's information, do I just write handler function in backend end update user's data with REST API or Admin SDK? what is the best practice over here? Or should I better write my own login and logout function on my backend then call REST API or Admin SDK? is there preferred way? Google is showing me only integration way of authentication from frontend?
BTW, I am deploying backend application on google cloud run, and frontend would be developed in react and should be deployed maybe in firebase or in cloud run as well.
Thanks
As per the Documentation,Yes your understanding is correct to integrate identity platform to the application.
You can store the user related information on a noSQL database like Firestore or Firebase Realtime Database. You can write the Rest API to change or update the user's information in the database.
If you want to write your own login and logout function, I don’t think it is necessary because Firebase Admin SDK provides these features. But if you want to manage user authentication in the backend for specific requirements, you can write your own login and logout function on the backend and use the Firebase Admin SDK.
For access and audit log information you can use Firebase Analytics, Firebase Analytics helps you understand what your users are doing in your app. It has all of the metrics that you’d expect in an app analytics tool combined with user properties like device type, app version, and OS version to give you insight into how users interact with your app.
But finally, the best way would depend on your requirements and use case.
I'm trying to build a plugin for a WordPress App, that uploads file to the users Google Drive space. I don't want the end user to create the Cloud Console Project. but rather just have him give consent so the plugin can access the needed data from his Google Drive account.
When I create OAuth 2.0 Client IDs in the Google Cloud Console (Web Application), Google asks for Authorized JavaScript origins and Authorized redirect URIs. Since the plugin will be portable and can be installed on different websites I can't define this.
How can this be solved that an OAuth2 Authentication by the user can be done, without knowing the URL where the app is running?
Thanks
You cant. Redirect uri must be configured properly, to point webserver the code authorization is running on.
You will need to instruct your users in how to create their own client.
Also as this is a WordPress application, you would need to share your client id and secret with the users. This is also against googles TOS.
possible workaround.
If you put up an authorization server on your own server. The users of your app could then login though that. A refresh token will be returned to their website running your app and stored locally. Your code could then run using the refresh token to access their data.
However you are then going to be responsible for verifying an app with google drive scopes.
i have a django webapp running at work. we have some REST APIs available which get accessed by our flow in unix. currently to avoid asking the users to enter their credentials, we store a service account name and credentials in a "secret" location on disk. my python code reads credentials from there to login and access the REST API running on our django app.
i am sure there is a better way to do this. is there a way to leverage that the user is logged into unix somehow to get authentication to work with the REST API? i heard kerberos might be useful here?
thanks for the help!
Once user is logged-in to any app he should not be asked for credentials for any other app. Sharing a single access-token stored in local storage seems a default but somehow bad idea. In case of Google apps on Android/web it surely does not use this solution, how do they do session sharing across apps implicitly?.
I am using AWS Cognito, it provides a User Pool in which I can have multiple apps registered to use the pool. Is there a way to get access token for a user request (without credentials like password) coming from a different app since the user is already logged in to pool via previous app login-request?
We‘re also trying to create a SSO experience for our customers across all our apps so that they only have to login once and get access to all apps.
AWS has a repo for that and it also might be interesting for you:
https://github.com/awslabs/aws-amplify-identity-broker
Currently, we‘re making a POC if it works out, but basically you need to proxify the cognito API‘s with your custom OIDC compliant endpoints.
I want to upload a file to a website via a desktop app and then take the user to the website. The website has a web service, but requires authentication as does the web site. Is there a way to do this without forcing the user to authenticate twice (once in the desktop app and once in the web browser)?
Unfortunately, you can't prefill an input of type file for security reasons, which makes sense since the user won't want you uploading arbitrary files from his/her computer. But if they have a desktop app, is there some way around this?
Or maybe make the user log into the web app first and then the authentication cookie can be reused?
Any other ideas?
Thanks,
Ben
I would use the dekstop app as a client to the website app via an api.
So, login via the desktop app. The api returns a authentication token (as Carlos suggested) which might be a md5 hash stored in your database for a certain period of time, possibly matched to the clients ip address.
The desktop app can then make calls on the api (like uploading a file) as a authenticated user (by using the auth token).
When loading the website, perhaps the url is http://website/login/{auth_token} where the auth token is added to the url. The api can check to see if its a valid auth token and consider the user logged in.
You could generate an authentication token that could later be used on the website.
It all depends on the type of authentication of the service and the site. Is it integrated Kerberos, WS-Auth, is it Basic/Digest HTTP, is it forms/cookie ?
This answer will most likely not work in the very general users-on-the-wide-open-web scenario, but in intranet contexts, using Windows Authentication (on an ASP .Net solution), would provide this.