Joiner
The account is created in One Identity and in the target system, with the right attributes, OU, groups and roles.
IAM test automation with Robot Framework
I build automated tests for One Identity Manager. After every change, you know whether provisioning, entitlements and connectors still do what they should.
One Identity Manager
What I test
One Identity Manager decides who gets which accounts and entitlements. A mistake in a role model or connector immediately affects many users. That is why you want to check these processes again with every release, and not by hand.
I have tested One Identity from version 6.x up to 10.x. My test suites are built in Robot Framework with custom Python libraries, and work through the API and directly against the MSSQL database.
- Joiner, mover and leaver: from HR data to an account in the target system
- Provisioning and deprovisioning to Active Directory and other target systems
- Role models, group memberships and access rights
- Access governance and attestations
- Privileged access management
- Checks at API and database level
Test scenarios
What I test for joiner, mover and leaver
An identity goes through a fixed lifecycle. At every step I check the One Identity Manager side and the target system itself, as well as what should not happen.
Mover
New entitlements are added and old ones are removed, including those granted through dynamic roles or IT Shop requests.
Leaver
The account is disabled and entitlements are revoked, within the period the policy requires.
Negative tests
What must not happen: duplicate accounts, entitlements that linger, or changes that never reach the target system.
What a test looks like
A simplified excerpt from a joiner test. The scenario at the top is readable for administrators and functional management; below it you can see how one step is checked in the One Identity Manager database.
*** Settings ***
Library DatabaseLibrary
Library ../libraries/ActiveDirectory.py
Resource ../resources/one_identity.resource
*** Test Cases ***
Joiner gets an enabled AD account
[Tags] joiner active-directory
Given a new employee in department "Finance"
When the DBQueue has been processed
Then an enabled AD account exists for the employee
And the account is a member of "GG-Finance-Users"
*** Keywords ***
An enabled AD account exists for the employee
# First the One Identity side: exactly one account, not disabled
${sql}= Catenate SELECT SAMAccountName, AccountDisabled FROM ADSAccount
... WHERE UID_Person = '${PERSON_UID}'
${rows}= Query ${sql}
Length Should Be ${rows} 1
Should Be Equal As Integers ${rows}[0][1] 0
# Then the target system itself
AD Account Should Be Enabled ${rows}[0][0]Test environments
Complex test environments
An IAM test touches several systems at once: One Identity Manager, the database, Active Directory and other target systems. Test results only mean something when that chain resembles production.
I build and manage these environments on-premises, in the cloud or locally, depending on the project. Usually on VMware or Hyper-V.
- Setting up environments with all required components and dependencies
- Connecting Robot Framework to databases, APIs and IAM systems
- Managing test data, so test runs are repeatable
- Running tests automatically in the CI/CD pipeline
Robot Framework
Why Robot Framework
Robot Framework is an open-source framework for acceptance testing and test automation. It is the tool I build my test suites with.
Readable tests
Keyword-driven, with Given/When/Then-style scenarios. Business, testers and developers read the same test.
Extensible with Python
Whatever is not built in, I write as a custom Python library, tailored to the system under test.
Web, API and database
With libraries for web, API and database testing, one suite covers the whole chain.
Clear reporting
HTML reports and logs for every test run. For an overview across runs, I use RobotDashboard.
Want to test your One Identity processes automatically?
Tell me briefly what your environment looks like. You will get a reply within two working days.