Identity and access management service testing checklist

Download the checklistMarkdownCSVBrief (Markdown)

1. 1.release smoke testsDone when: On every build, a test user signs in through SAML and OIDC to a sample app, a wrong password is refused, and sign-out ends the session in the sample app.Risks: fraud-abuse, data-breach. Tool class: browser automation. Usually run by: QA engineer.
2. 2.regression suiteDone when: On every release, a wrong password through the directory connector is refused, a session revoked in the admin console no longer opens the sample relying app, recovery still asks for the user's enrolled MFA factor, and any failure blocks the release.Risks: fraud-abuse, data-breach. Tool class: test management. Usually run by: QA engineer.
3. 3.penetration testingDone when: A tester holding a HAR file or copied session cookie from a support ticket cannot reuse it to reach the admin console, and replay from a new device and IP is refused.Risks: data-breach, fraud-abuse. Tool class: proxy. Usually run by: security specialist.
4. 4.unit testsDone when: Credential and cache-key checks refuse a wrong password for usernames of every length in the fixed sample set, including the longest the directory allows.Risks: fraud-abuse. Tool class: unit framework. Usually run by: developer.
5. 5.integration testsDone when: With a directory connector enabled and MFA off for a test app, a sign-in with the right username and a wrong password is refused straight after that user's successful sign-in.Risks: fraud-abuse. Tool class: API client. Usually run by: developer.
6. 6.end-to-end functional testsDone when: Enrolment, step-up MFA, password reset and account recovery each end in the expected state, and recovery never skips the user's enrolled factor.Risks: fraud-abuse. Tool class: browser automation. Usually run by: QA engineer.
7. 7.compliance checksDone when: MFA phone numbers and recovery emails are tagged security-only, no marketing or analytics export includes them, and support uploads are scrubbed of tokens on receipt.Risks: regulatory-penalty, data-breach. Tool class: test management. Usually run by: product manager.
8. 8.accessibility testingDone when: A screen-reader user and a keyboard-only user complete sign-in, MFA enrolment and recovery with a password manager or passkey and without solving a puzzle.Risks: accessibility-liability. Tool class: accessibility checker. Usually run by: accessibility specialist.
9. 9.security scanningDone when: The scan of the admin console, token endpoints and support upload flow has no open high findings.Risks: data-breach. Tool class: DAST scanner. Usually run by: security specialist.
10. 10.resilience and failure testingDone when: With the session store or quota service behind token validation cut in staging, existing sessions stay valid until expiry, new sign-ins show a clear error, and service returns without a manual restart.Risks: dependency-failure. Tool class: chaos tool. Usually run by: developer.