Skip to content

Commit 113cb33

Browse files
v-ccolinv-ccolin
authored
Merge pull request #212496 from ntrogh/alt-authenticated-endpoints
[Azure Load Testing] How to test secured endpoints
2 parents 35cc9f4 + c8394d0 commit 113cb33

9 files changed

+218
-3
lines changed

‎articles/load-testing/how-to-test-secured-endpoints.md

Lines changed: 203 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
---
2+
title: Load test secured endpoints
3+
description: Learn how to load test secured endpoints with Azure Load Testing. Use shared secrets, credentials, or client certificates for load testing applications that require authentication.
4+
author: ntrogh
5+
ms.author: nicktrog
6+
services: load-testing
7+
ms.service: load-testing
8+
ms.topic: how-to
9+
ms.date: 09/28/2022
10+
ms.custom: template-how-to
11+
---
12+
13+
# Load test secured endpoints with Azure Load Testing Preview
14+
15+
In this article, you learn how to load test applications with Azure Load Testing Preview that require authentication. Azure Load Testing enables you to [authenticate with endpoints by using shared secrets or credentials](#authenticate-with-a-shared-secret-or-credentials), or to [authenticate with client certificates](#authenticate-with-client-certificates).
16+
17+
> [!IMPORTANT]
18+
> Azure Load Testing is currently in preview. For legal terms that apply to Azure features that are in beta, in preview, or otherwise not yet released into general availability, see the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
19+
20+
## Prerequisites
21+
22+
## Authenticate with a shared secret or credentials
23+
24+
In this scenario, the application endpoint requires that you use a shared secret, such as an access token, an API key, or user credentials to authenticate. In the JMeter script, you have to provide this security information with each application request. For example, to load test a web endpoint that uses OAuth 2.0, you add an `Authorization` header, which contains the access token, to the HTTP request.
25+
26+
To avoid storing, and disclosing, security information in the JMeter script, Azure Load Testing enables you to securely store secrets in Azure Key Vault or in the CI/CD secrets store. By using a custom JMeter function `GetSecret`, you can retrieve the secret value and pass it to the application endpoint.
27+
28+
The following diagram shows how to use shared secrets or credentials to authenticate with an application endpoint in your load test.
29+
30+
:::image type="content" source="./media/how-to-test-secured-endpoints/load-test-authentication-with-shared-secret.png" alt-text="Diagram that shows how to use shared-secret authentication with Azure Load Testing.":::
31+
32+
1. Add the security information in a secrets store in either of two ways:
33+
34+
* Add the secret information in Azure Key Vault. Follow the steps in [Parameterize load tests with secrets](./how-to-parameterize-load-tests.md) to store a secret and authorize your load testing resource to read its value.
35+
36+
* Add the secret information as a secret in CI/CD ([GitHub Actions secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets) or [Azure Pipelines secret variables](/azure/devops/pipelines/process/set-secret-variables)).
37+
38+
1. Add the secret to the load test configuration:
39+
40+
# [Azure portal](#tab/portal)
41+
42+
To add a secret to your load test in the Azure portal:
43+
44+
1. Navigate to your load testing resource in the Azure portal. If you don't have a load test yet, [create a new load test using a JMeter script](./how-to-create-and-run-load-test-with-jmeter-script.md).
45+
1. On the left pane, select **Tests** to view the list of load tests.
46+
1. Select your test from the list, and then select **Edit**, to edit the load test configuration.
47+
48+
:::image type="content" source="./media/how-to-test-secured-endpoints/edit-load-test.png" alt-text="Screenshot that shows how to edit a load test in the Azure portal.":::
49+
50+
1. On the **Parameters** tab, enter the details of the secret.
51+
52+
| Field | Value |
53+
| ----- | ----- |
54+
| **Name** | Name of the secret. You'll provide this name to the `GetSecret` function to retrieve the secret value in the JMeter script. |
55+
| **Value** | Matches the Azure Key Vault **Secret identifier**. |
56+
57+
:::image type="content" source="media/how-to-test-secured-endpoints/load-test-secrets.png" alt-text="Screenshot that shows how to add secrets to a load test in the Azure portal.":::
58+
59+
1. Select **Apply**, to save the load test configuration changes.
60+
61+
# [GitHub Actions](#tab/github)
62+
63+
To add a secret to your load test in GitHub Actions, update the GitHub Actions workflow YAML file. In the workflow, add a `secrets` parameter to the `azure/load-testing` action.
64+
65+
| Field | Value |
66+
| ----- | ----- |
67+
| **name** | Name of the secret. You'll provide this name to the `GetSecret` function to retrieve the secret value in the JMeter script. |
68+
| **value** | References the GitHub Actions secret name. |
69+
70+
The following code snippet gives an example of how to configure a load test secret in GitHub Actions.
71+
72+
```yaml
73+
- name: 'Azure Load Testing'
74+
uses: azure/load-testing@v1
75+
with:
76+
loadtestConfigFile: 'SampleApp.yaml'
77+
loadtestResource: 'MyTest'
78+
resourceGroup: 'loadtests-rg'
79+
secrets: |
80+
[
81+
{
82+
"name": "appToken",
83+
"value": "${{ secrets.APP_TOKEN }}"
84+
}
85+
]
86+
```
87+
88+
# [Azure Pipelines](#tab/pipelines)
89+
90+
To add a secret to your load test in Azure Pipelines, update the Azure Pipelines definition file. In the pipeline, add a `secrets` parameter to the `AzureLoadTest` task.
91+
92+
| Field | Value |
93+
| ----- | ----- |
94+
| **name** | Name of the secret. You'll provide this name to the `GetSecret` function to retrieve the secret value in the JMeter script. |
95+
| **value** | References the Azure Pipelines secret variable name. |
96+
97+
The following code snippet gives an example of how to configure a load test secret in Azure Pipelines.
98+
99+
```yaml
100+
- task: AzureLoadTest@1
101+
inputs:
102+
azureSubscription: 'MyAzureLoadTestingRG'
103+
loadTestConfigFile: 'SampleApp.yaml'
104+
loadTestResource: 'MyTest'
105+
resourceGroup: 'loadtests-rg'
106+
secrets: |
107+
[
108+
{
109+
"name": "appToken",
110+
"value": "$(appToken)"
111+
}
112+
]
113+
```
114+
---
115+
116+
1. Update the JMeter script to retrieve the secret value:
117+
118+
1. Create a user-defined variable that retrieves the secret value with the `GetSecret` custom function:
119+
<!-- Add screenshot -->
120+
121+
1. Update the JMeter sampler component to pass the secret in the request. For example, to provide an OAuth2 access token, you configure the `Authentication` HTTP header:
122+
<!-- Add screenshot -->
123+
124+
When you now run your load test, the JMeter script can retrieve the secret information from the secrets store and authenticate with the application endpoint.
125+
126+
## Authenticate with client certificates
127+
128+
In this scenario, the application endpoint requires that you use a client certificate to authenticate. Azure Load Testing supports Public Key Certificate Standard #12 (PKCS12) type of certificates. You can use only one client certificate in a load test.
129+
130+
To avoid storing, and disclosing, the client certificate alongside the JMeter script, Azure Load Testing uses Azure Key Vault to store the certificate. When you run the load test, Azure Load Testing passes the certificate to JMeter, which uses it to authenticate with the application endpoint. You don't have to update the JMeter script to use the client certificate.
131+
132+
The following diagram shows how to use a client certificate to authenticate with an application endpoint in your load test.
133+
134+
:::image type="content" source="./media/how-to-test-secured-endpoints/load-test-authentication-with-client-certificate.png" alt-text="Diagram that shows how to use client-certificate authentication with Azure Load Testing.":::
135+
136+
1. Follow the steps in [Import a certificate](/azure/key-vault/certificates/tutorial-import-certificate) to store your certificate in Azure Key Vault.
137+
138+
> [!IMPORTANT]
139+
> Azure Load Testing only supports PKCS12 certificates. Upload the client certificate in PFX file format.
140+
141+
1. Verify that your load testing resource has permissions to retrieve the certificate from your key vault.
142+
143+
Azure Load Testing retrieves the certificate as a secret to ensure that the private key for the certificate is available. [Assign the Get secret permission to your load testing resource](./how-to-use-a-managed-identity.md#grant-access-to-your-azure-key-vault) in Azure Key Vault.
144+
145+
1. Add the certificate to the load test configuration:
146+
147+
# [Azure portal](#tab/portal)
148+
149+
To add a client certificate to your load test in the Azure portal:
150+
151+
1. Navigate to your load testing resource in the Azure portal. If you don't have a load test yet, [create a new load test using a JMeter script](./how-to-create-and-run-load-test-with-jmeter-script.md).
152+
1. On the left pane, select **Tests** to view the list of load tests.
153+
1. Select your test from the list, and then select **Edit**, to edit the load test configuration.
154+
155+
:::image type="content" source="./media/how-to-test-secured-endpoints/edit-load-test.png" alt-text="Screenshot that shows how to edit a load test in the Azure portal.":::
156+
157+
1. On the **Parameters** tab, enter the details of the certificate.
158+
159+
| Field | Value |
160+
| ----- | ----- |
161+
| **Name** | Name of the certificate. |
162+
| **Value** | Matches the Azure Key Vault **Secret identifier** of the certificate. |
163+
164+
:::image type="content" source="media/how-to-test-secured-endpoints/load-test-certificates.png" alt-text="Screenshot that shows how to add a certificate to a load test in the Azure portal.":::
165+
166+
1. Select **Apply**, to save the load test configuration changes.
167+
168+
# [GitHub Actions](#tab/github)
169+
170+
To add a client certificate for your load test, update the `certificates` property in the [load test YAML configuration file](./reference-test-config-yaml.md).
171+
172+
| Field | Value |
173+
| ----- | ----- |
174+
| **name** | Name of the client certificate. |
175+
| **value** | Matches the Azure Key Vault **Secret identifier** of the certificate. |
176+
177+
```yml
178+
certificates:
179+
- name: <my-certificate-name>
180+
value: <my-keyvault-secret-ID>
181+
```
182+
183+
# [Azure Pipelines](#tab/pipelines)
184+
185+
To add a client certificate for your load test, update the `certificates` property in the [load test YAML configuration file](./reference-test-config-yaml.md).
186+
187+
| Field | Value |
188+
| ----- | ----- |
189+
| **name** | Name of the client certificate. |
190+
| **value** | Matches the Azure Key Vault **Secret identifier** of the certificate. |
191+
192+
```yml
193+
certificates:
194+
- name: <my-certificate-name>
195+
value: <my-keyvault-secret-ID>
196+
```
197+
---
198+
199+
When you now run your load test, Azure Load Testing retrieves the client certificate from Azure Key Vault, and injects it in the JMeter web requests.
200+
201+
## Next steps
202+
203+
* Learn more about [how to parameterize a load test](./how-to-parameterize-load-tests.md).

‎articles/load-testing/index.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,8 @@ landingContent:
6262
links:
6363
- text: Create a load test with a JMeter script
6464
url: how-to-create-and-run-load-test-with-jmeter-script.md
65+
- text: Test applications with authentication
66+
url: how-to-test-secured-endpoints.md
6567
- text: Test a private endpoint with VNET injection
6668
url: how-to-test-private-endpoint.md
6769
- text: Read data from a CSV file

‎articles/load-testing/media/how-to-test-secured-endpoints/edit-load-test.png

43.4 KB
Loading

‎articles/load-testing/media/how-to-test-secured-endpoints/load-test-authentication-with-client-certificate.png

32.9 KB
Loading

‎articles/load-testing/media/how-to-test-secured-endpoints/load-test-authentication-with-shared-secret.png

55.2 KB
Loading

‎articles/load-testing/media/how-to-test-secured-endpoints/load-test-certificates.png

47.8 KB
Loading

‎articles/load-testing/media/how-to-test-secured-endpoints/load-test-secrets.png

173 KB
Loading

‎articles/load-testing/reference-test-config-yaml.md

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,13 @@ A test configuration uses the following keys:
3737
| `splitAllCSVs` | boolean | False | Split the input CSV files evenly across all test engine instances. For more information, see [Read a CSV file in load tests](./how-to-read-csv-data.md#split-csv-input-data-across-test-engines). |
3838
| `secrets` | object | | List of secrets that the Apache JMeter script references. |
3939
| `secrets.name` | string | | Name of the secret. This name should match the secret name that you use in the Apache JMeter script. |
40-
| `secrets.value` | string | | URI for the Azure Key Vault secret. |
40+
| `secrets.value` | string | | URI (secret identifier) for the Azure Key Vault secret. |
4141
| `env` | object | | List of environment variables that the Apache JMeter script references. |
4242
| `env.name` | string | | Name of the environment variable. This name should match the secret name that you use in the Apache JMeter script. |
4343
| `env.value` | string | | Value of the environment variable. |
44+
| `certificates` | object | | List of client certificates for authenticating with application endpoints in the JMeter script. |
45+
| `certificates.name` | string | | Name of the certificate. |
46+
| `certificates.value` | string | | URI (secret identifier) for the certificate in Azure Key Vault. |
4447
| `keyVaultReferenceIdentity` | string | | Resource ID of the user-assigned managed identity for accessing the secrets from your Azure Key Vault. If you use a system-managed identity, this information isn't needed. Make sure to grant this user-assigned identity access to your Azure key vault. |
4548

4649
The following YAML snippet contains an example load test configuration:
@@ -66,10 +69,15 @@ env:
6669
value: my-value
6770
secrets:
6871
- name: my-secret
69-
value: https://akv-contoso.vault.azure.net/secrets/MySecret
72+
value: https://akv-contoso.vault.azure.net/secrets/MySecret/abc1234567890def12345
73+
certificates:
74+
- name: my-certificate
75+
value: https://akv-contoso.vault.azure.net/certificates/MyCertificate/abc1234567890def12345
7076
keyVaultReferenceIdentity: /subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/sample-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/sample-identity
7177
```
7278
7379
## Next steps
7480
75-
Learn how to build [automated regression testing in your CI/CD workflow](tutorial-cicd-azure-pipelines.md).
81+
- Learn how to build [automated regression testing in your CI/CD workflow](tutorial-cicd-azure-pipelines.md).
82+
- Learn how to [parameterize load tests with secrets and environment variables](./how-to-parameterize-load-tests.md).
83+
- Learn how to [load test secured endpoints](./how-to-test-secured-endpoints.md).

‎articles/load-testing/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,8 @@ items:
4444
href: how-to-create-and-run-load-test-with-JMeter-script.md
4545
- name: Read data from a CSV file
4646
href: how-to-read-csv-data.md
47+
- name: Test applications with authentication
48+
href: how-to-test-secured-endpoints.md
4749
- name: Test a private endpoint
4850
href: how-to-test-private-endpoint.md
4951
- name: Analyze test results

0 commit comments

Comments
 (0)