ZAP Authentication with SSO using Authentication Script

[Phùng Quang Trường]

Our company use many API that must be authenticated via SSO. The authentication flow should be:
1. User Login to SSO page of WEB app
2. User got cookies stored

3. Inside WEB app there are some API that use Cookies for authentication.

We want to scan the API separately from the Web App, there we found that we can use Selenium to guide browser each steps to login and get cookies. But we are not sure that we can write Selenium script inside Authentication Script. Do you guys have any guideline for this part? 

[Ruxun Wagn]

I hava the same question

[Simon Bennetts]

Your best option would be to use Browser Based Authentication and auto-detection, if it works.

And if it doesnt then we want to know the details :)

See https://www.zaproxy.org/docs/authentication/auto-detection/ and https://youtu.be/RCi9W77bGpI

Cheers,

Simon

[Phùng Quang Trường]

We used Automation Framework to automate API scanning. For other normal API, we create folder for each API (auth.js for login normal POST, sender.js to set API-Key, request.har to import history request, and template.yaml) to automate scanning process. For those login with SSO request, if we use  Browser Based Authentication and auto-detection, does it work on automation framework ?

[Simon Bennetts]

Yes: https://www.zaproxy.org/blog/2023-05-02-authentication-auto-detection/#when-can-you-use-authentication-auto-detection