General Information

The following tests usually assume a fresh login between pages. The test pages themselves usually have a logout link that you can use once you have verified that page works.

It's best to test without SPNEGO on once, and then go back to the first general test afterwards with SPNEGO on to test that.

General WebAuth Tests

  1. basic WebAuth test
    This test will simply check to make sure you can successfully log in via WebAuth.
  2. test extra redirect
    Sets WebAuthReturnURL with WebAuthExtraRedirect and verify we end up at the right page with no token cookies visible.
  3. test environment variable prefix
    This sets WebAuthVarPrefix, which should apply a prefix to all environmental variables set by WebLogin.
  4. test cancel login
    Sets WebAuthLoginCanceledURL. Log out fully before this test, then on this test hit cancel when you get to the login page. You should be sent to a page that tells you the test succeeded.
  5. test return url
    Set WebAuthReturnURL, which will make the user go to a different page than the original requesting page after they've logged in.
  6. test query params on initial redirect
    Test that a WebAuthReturnURL only removes the tokens and not other query parameters.
  7. test 5 second app-token lifetime
    Tests WebAuthAppTokenLifetime set to five seconds. You'll go to the page and follow instructions there in waiting and then reloading the page. Since login isn't forced, you'll pass back through the WebKDC transparently getting a new app token. The only thing you'll notice is if you see the URL updating in your browser as this happens.
  8. test 5 second app-token lifetime and force login
    This adds to the previous tests also setting WebAuthForceLogin on for the site. That means that after the app token has expired, you will be forced to log in once more, making this an easier test to understand.
  9. test last-used update
    Test that the WebAuthLastUseUpdateInterval is properly working. You will be prompted to visit the page again after a few seconds and be shown visit times for both the first and second visit, in order to verify that the value is updated.
  10. test inactive-expire
    Adds WebAuthInactiveExpire of 20s to the prior test. If you revisit the page in under 20s, nothing happens. If you revisit the page after 20s of no activity, you will be forced to log in again.
  11. test for no query params on initial redirect
    Test that WebAuthReturnURL suppresses the token query parameters.
  12. test POST with expired cookie
    Tests WebAuthPostReturnURL to see if it will properly redirect after a POST with an expired cookie. Normally this will break logging back in until you go to the original URL without POST.
  13. test optional authentication
    Set WebAuthOptional on, where the page doesn't require the user to authenticate, but picks up authentication information if the user has already authenticated.
  14. test cookie path restrictions (be sure you are logged out when running this test)
    Set WebAuthCookiePath to a limited directory during your login, then go to another directory not under that path to make sure that your credentials don't leak. This test requires you to log out beforehand.
  15. test StanfordAuth
    StanfordAuth is an older alias for WebAuth in setting up the Apache AuthType. This test simply makes sure we can log in correctly for a site using that declaration.
  16. test PHP (only works if PHP installed)
    Test that all WebAuth environmental variables are set on PHP scripts behind WebAuth.

Multifactor Tests

  1. any multifactor required
    User should be prompted for multifactor login so long as they have not already logged in with multifactor.
  2. OTP multifactor required
    User should only be allowed to log in with a multifactor method using a one-time password. If they are already logged in with multifactor, they will be prompted for multifactor again if they did not use an OTP during that login.
  3. OTP multifactor plus password required
    User should be required to provide a password (even if they normally use SPNEGO, along with a one-time password for multifactor.
  4. random multifactor required
    Tests random multifactor. This has only a chance of succeeding, 10% by default on the userinfo service, and so this should be rerun multiple times.
  5. o50 multifactor method required
    Requires a strong OTP password, such as one given by an authenticator app or hardware token rather than SMS or a list.
  6. LoA required at a level any user should meet
    A user should be allowed access to the site without multifactor.
  7. LoA required at a level any OTP user should meet
    A user should be allowed access to the site with any OTP.
  8. LoA required at a level an OTP user with strong authentication should meet
    User with a list OTP should be denied, while a user with an authenticator or hardware token should be allowed.
  9. LoA required at a level no user should meet (access denied)
    User should be denied access to the site with a warning.
  10. LoA required at a level any OTP users should meet plus o50 multifactor required plus force login for multifactor
    LoA of 2 with an authenticator app should login, and be forced through login.
  11. force session with password
  12. force session with multifactor
  13. force session with negotiate-auth
  14. force session with random multifactor