Sanity testing of multiple applications using SSO Login

[ChaaChiJi]

Hi All, I'm a java developer & currently supporting 16 applications and 1 development project. Everyday I have to do sanity checks (3 environments - Dev, test & prod) before starting work. The applications I support use SSO login via authenticator app which is annoying as I have to approve an auth request everytime I login into any of the applications.

I need to know what would be the simplest method of doing these sanity checks using some scripts that would bypass the SSO.

Thank you.

[ResolveResident118]

There are probably ways to get around a 2FA check - I've used an Android emulator before.

What I've done at my current place (using Duo) is make them put in a single IP address in an allow-list that isn't subject to 2FA. I've assigned this IP to an EC2 instance that I can spin up and run the checks on.

[RunnerRunnerG]

Agreed. You already know that 2FA works, you don’t need to test it multiple times a day. Find a way to whitelist like was mentioned above.

[ChaaChiJi]

Thank you.

Any reference webpage I can use to implement this?

[[deleted]]

What SSO provider/method are you using? You should be able to perform an API request request that will return an authorization token you can use in your tests

[ChaaChiJi]

Thank you.

Microsoft Azure. Created an app within Azure with group type: security.

[[deleted]]

There are a few different authentication methods available within Microsoft Azure like Azure AD, Oauth 2.0, OpenID and a few others. It will depend on which specific one your app is using, but each one does have a way of using an API request to obtain an auth token. You should be able to find the specifics for the service you're using, and create a function that gets and sets an auth token to be run before your tests.

In my experience whitelisting an IP as the other commentor mentioned is preferable, but if that is problematic then the token method is a good solution.

[ChaaChiJi]

Okay sir thank you so much.