How to get Sharepoint rTFA cookie from selenium browser - selenium

The scenario is the following: I'm trying to authenticate extern tenant Sharepoint so I can make HTTP requests and download files from a shared folder. The tenant has MFA enabled. Using selenium I'm able to automate the log-in process. Now I want to get the FedAuth cookie and rTFA cookie from the selenium session since these two cookies are required for authentication according to Sharepoint Authentication Doc.
I can get the FedAuth cookie from the selenium webborwser using Cookie FedAuth = driver.manage().getCookieNamed("FedAuth");
But how do I get the rTFA cookie?

Related

How to set AppServiceAuthSession cookie for azure app service manually/programmatically?

tl;dr
I am trying to add cypress test for SPA but login does not work. Need help to set "AppServiceAuthSession" cookie.
Details
My single page application(SPA) is secured with Azure AD provider and uses authentication feature of Azure app service. When I login with credentials, app service responds with certain set-cookie headers which includes "AppServiceAuthSession". Once this cookie is added, application does not requires login on refresh.
As EasyAuth enabled, there is no custom code required and Azure app service handles authentication.
Cypress does not supports/recommends auto redirects. Logging in user prior to accessing SPA avoids redirects. As application does not have any custom code for login, MSAL and ADAL are not added to app which leverage browser localstorage to set tokens. There are two solutions I can think of:
Change authentication approach and use custom MSAL setup
Set "AppServiceAuthSession" cookie
Option 1 requires production code changes for cypress test which I believe is not recommended.
So need help to set "AppServiceAuthSession" cookie via cypress test.
I do not find any documentation around "AppServiceAuthSession" cookie, how to get it.
I tried this solution but its not working, probably it requires ADAL setup in application.
The AppServiceAuthSession is cookie which differs to token, so modify the configuration of Azure app to fetch from the access_token.
Locate the configuration->authsettings(resource is the clientId of Azure app which used to protect your apps)
"additionalLoginParams": [
"response_type=code id_token",
"resource=9hj2797f-29xf-4405-96x4-29g11hk4ce94"
],
And config the redirect_uri for Azure app like "AzureUrl + /login/aad/callback"
And you can fetch the access_token from the endpoint url.
*For more information on authentication and token check this link1 and link2

Sharepoint Authentication using REST API - Postman

I'm trying to use the Sharepoint REST API and am stuck at the Authentication Step.
My tenant will not allow the registration of an App because they do not have support for site-specific permissions yet, so I want to request a FedAuth Cookie at runtime.
I am stuck finding the correct parameters for what request to make, in order to generate this cookie.
When following through Developer Tools via the browser, there are about 8 requests passed back & forwards.
Is there an endpoint / series of endpoints where I can pass my username/password, and generate a FedAuth Cookie, using the Sharepoint REST API?
Thanks

How to do a Login woth a google account in JMeter

I try to login into an application that uses a login with Google Accounts. I try with the script recorder but it doesn't work.
Most probably login via Google Account is implemented using OAuth protocol and this is not something you can record and replay. Actually you don't need to load test the logging in process itself as it mostly being performed on Google side.
In order to be authenticated you need to supply correct Authorization Bearer token via JMeter's HTTP Header Manager. The token can be obtained using one of the following ways:
By recording (look for Authentication: Bearer token in the HTTP Header Manager
Using real browser from the WebDriver Sampler and once you're logged in - copy session information from browser into JMeter
From the Google Console if you have permissions
By performing full authentication process using i.e. OAuth Client Library for Java from JSR223 Sampler
See How to Run Performance Tests on OAuth Secured Apps with JMeter article for more detailed explanation on each of the approaches.

Forms Authentication and SSO

Created a web based application which needs to integrate forms authentication and SSO. Currently forms authentication will validate all the registered users.
What I need is to integrate SSO as well in to the application. ie, If the user not authenticated then redirect to identity server (Okta) configured with WS-Fed and added the application, validate and response to landing page. Please can you help on this. Please let me know if any more information is required.
Can you please explain this statement " If the user not authenticated then redirect to identity server (Okta) configured with WS-Fed and added the application"?
Please see this link https://github.com/okta/okta-music-store. Under section "Adding Single-sign on to your Music Store" you can see how C# sdk can be used to implement single sign on.
Essentially what you need is a cookieToken from Okta. Using cookieToken as one time token and a redirect url (Can be your app url) you can use /login/sessionCookieRedirect?token=&redirectUrl=. This will create active session with Okta and redirect your user to your app or redirect uri.
Cookie token is obtained via series of two calls. Authentication that gives you session token in response. Session token is exchanged for cookie token via create session call.

Forms Authentication and HttpWebRequest

I need to be able to login to a site via Forms Authentication using a HttpWebRequest.
Currently, when I provide NetworkCreditials to the request, it just redirects me to the Login page, which makes sense...but how do I go about ensuring that the request correctly authenticates without redirecting?
Thanks
If the site uses cookies to tracks users you need to use a cookie container in order to store the authentication cookie emitted by the server and reuse this cookie in later requests to access authenticated parts of the site.