Authentication

Configure your browser test with basic authentication through an HTML login form.

1. Create global variables for this test target’s username and password.

   Best practice is to conceal the global variable you create for the password. For more information, see Global variables.

2. On the browser test’s configuration page, select the Simple toggle.
3. Select Edit steps or synthetic transactions.
4. Add a step of type Fill in field, and set it up as follows:
   1. In Selector, enter the ID, name, XPath, CSS, link, or JS path of the target page’s username field.

      For more information on element selectors on Chrome, see Chrome DevTools .

   2. In Value, enter the name of the global variable you stored the username in, prefixed with env. and enclosed in double curly braces.

      For example, {{env.test1_username}}.

5. Add a step of type Fill in field, and set it up as follows:
   1. In Selector, enter the ID of the target page’s password field.
   2. In Value, enter the name of the global variable you stored the password in, prefixed with env. and enclosed in double curly braces.

      For example, {{env.test1_password}}.

6. Add a step of type Click, and set it up as follows:
   1. In Selector, enter the ID of the target page’s login button.
   2. (Optional) Set Wait for navigation to the number of milliseconds to wait.
7. To verify that the login succeeded, add a step of type Assert text present, and set it up as follows:
   1. In Text, enter a string that should be visible on the test target page only when login is successful.
   2. (Optional) Set Wait for up to to a large enough value, in milliseconds, to ensure that the page loads.
8. Select Submit.

Configure your browser test with basic authentication through an HTTP header.

1. Create global variables for this test target’s username and password.

   Best practice is to conceal the global variable you create for the password. For more information, see Global variables.

2. On the browser test’s configuration page, select the Advanced toggle.
3. Scroll down to the Security section.
4. On the row for Authentication, set values as follows:
   1. In the left field (with hint text Username), enter the username for the target page.
   2. In the right field, enter the name of the global variable in which you stored the password for this target page, prefixed with env. and enclosed in double curly braces.

      For example, {{env.test1_password}}. To see the list of available global variables, expand the pane on the right.

5. On the browser test’s configuration page, select the Simple toggle.
6. Select Edit steps or synthetic transactions.
7. Add a step of type Go to url, and in URL, enter the URL of the target’s authentication page.
8. To verify that the login succeeded, add a step of type Assert text present, and set it up as follows:
   1. In Text, enter a string that should be visible on the test target page only when login is successful.
   2. (Optional) Set Wait for up to to a large enough value, in milliseconds, to ensure that the page loads.
9. Select Submit.

Configure your API test with basic authentication through an API request header.

1. Get the base64-encoded string of the username and password combination for your test target.

   There are several ways to get a base64-encoded string. For example:

   • Run the JavaScript function btoa from your browser’s console: btoa("myusername:mypassword")

   • Run this command in a Linux terminal: echo -n 'myusername:mypassword' | base64

2. Store the base64 value in a concealed global variable.

   For more information, see Global variables.

3. On the API test’s configuration page, select an existing request in the test or select Add requests.
4. Expand the Request section, and enter the following information:
   1. In URL, enter the test target’s URL.
   2. Select Add request header.
   3. Select the Authorization header, and for its value, enter the word Basic followed by a space and then the name of the global variable containing your base64-encoded combined username and password.

      The variable must be prefixed with env. and enclosed in double curly braces. For example, {{env.est1_base64_auth}}. To see the list of available global variables, expand the pane on the right.

5. Select Submit.

Configure your browser test with multifactor authentication through SMS.

1. On the browser test’s configuration page, select the Simple toggle.
2. Select Edit steps or synthetic transactions.
3. Add a step of type Go to url, and in URL, enter the URL of the target’s authentication page.
4. Add a step of type Save return value from JavaScript, and in the code field, paste the following JavaScript.

   This script retrieves data from a specified URL using XMLHttpRequest and extracts the OTP from that data. You configure your test to save this OTP in a global variable named otp.

   Note: In the script, set the variable url to the URL of your own virtual phone number’s SMS service.

   JAVASCRIPTCopy

   function getOtp() { const url = "https://your-page.example.com/sms"; var request = new XMLHttpRequest(); request.open("GET", url, false); request.send(); if (request.status == 200) { return parseOtp(JSON.parse(request.responseText)); } return; } function parseOtp(jsonResponse) { const firstInbound = jsonResponse.inbounds[0]; if (firstInbound && firstInbound.body) { // Extract the number using a regular expression const match = firstInbound.body.match(/\\b\\d{6}\\b/); if (match) { return match[0]; // Return the first matched number } } return; } return getOtp();

   function getOtp() {
     const url = "https://your-page.example.com/sms";
     var request = new XMLHttpRequest();
     request.open("GET", url, false);
     request.send();
     if (request.status == 200) {
       return parseOtp(JSON.parse(request.responseText));
     }
   return;
   }
   
   function parseOtp(jsonResponse) {
     const firstInbound = jsonResponse.inbounds[0];
     if (firstInbound && firstInbound.body) {
       // Extract the number using a regular expression
       const match = firstInbound.body.match(/\\b\\d{6}\\b/);
       if (match) {
         return match[0]; // Return the first matched number
       }
      }
      return;
   }
   return getOtp();

5. Add a step of type Wait, and specify a wait time in milliseconds.

   This time needs to be long enough for the target to send the OTP code to your virtual phone number, and for your JavaScript to process the OTP.

6. Add a step of type Fill in field, and set it up as follows:
   1. In Selector, enter the ID of the element on the target page where the user must enter the OTP.
   2. In Value, enter the name of the custom variable your JavaScript stored the OTP in, prefixed with custom. and enclosed in double curly braces. For example, {{custom.otp}}.
   
7. To verify that the login succeeded, add a step of type Assert text present, and set it up as follows:
   1. In Text, enter a string that should be visible on the test target page only when login is successful.
   2. (Optional) Set Wait for up to to a large enough value, in milliseconds, to ensure that the page loads.
8. Select Submit.

Configure your browser test with multifactor authentication through email.

1. On the browser test’s configuration page, select the Simple toggle.
2. Select Edit steps or synthetic transactions.
3. Add a step of type Go to url, and in URL, enter the URL of the target’s authentication page.
4. Add a step of type Save return value from JavaScript, and in the code field, paste the following JavaScript.

   This script retrieves data from a specified URL using XMLHttpRequest and extracts the OTP from that data. You configure your test to save this OTP in a custom variable named otp.

   Note: In the script, set the variable url to the URL of your own email inbox API endpoint.

   Note: If you are utilizing the Nylas service, you can locate unread emails by searching for specific text in the subject line or other parameters. For more information, please refer to the Nylas API documentation for messages .

   JAVASCRIPTCopy

   function getOtp() { const grantId = "NYLAS_GRANT_ID"; const jwToken = "NYLAS_API_KEY"; const from = "noreply@github.com"; const subject = "Your GitHub launch code"; const unread = "true"; const url = "https://api.us.nylas.com/v3/grants/" + grantId + "/messages?limit=1&unread=" + unread + "from=" + from + "&subject=" + subject; var request = new XMLHttpRequest(); request.open("GET", url, false); request.setRequestHeader('Authorization', 'Bearer ' + jwToken) request.send(); if (request.status == 200) { return parseOtp(JSON.parse(request.responseText)); } return "ERR"; } function parseOtp(jsonResponse) { const firstInbound = jsonResponse. data[0]; if (firstInbound && firstInbound.snippet) { // Extract the number using a regular expression const match = firstInbound.snippet.match(/\\b\\d{8}\\b/); if (match) { return match[0]; // Return the first matched number } } return "NO-OTP"; } return getOtp();

   function getOtp() {
     const grantId = "NYLAS_GRANT_ID";
     const jwToken = "NYLAS_API_KEY";
     const from = "noreply@github.com";
     const subject = "Your GitHub launch code";
     const unread = "true";
     const url = "https://api.us.nylas.com/v3/grants/" + grantId + "/messages?limit=1&unread=" + unread + "from=" + from + "&subject=" + subject;
     var request = new XMLHttpRequest();
     request.open("GET", url, false);
     request.setRequestHeader('Authorization', 'Bearer ' + jwToken)
     request.send();
     if (request.status == 200) {
       return parseOtp(JSON.parse(request.responseText));
     }
     return "ERR";
   }
   
   function parseOtp(jsonResponse) {
     const firstInbound = jsonResponse. data[0];
     if (firstInbound && firstInbound.snippet) {
       // Extract the number using a regular expression
       const match = firstInbound.snippet.match(/\\b\\d{8}\\b/);
       if (match) {
         return match[0]; // Return the first matched number
       }
     }
     return "NO-OTP";
   }
   return getOtp();

5. Add a step of type Wait, and specify a wait time in milliseconds.

   This time needs to be long enough for the target to send the OTP code to your email service, and for your JavaScript to process the OTP.

6. Add a step of type Fill in field, and set it up as follows:
   1. In Selector, enter the ID of the element on the target page where the user must enter the OTP.
   2. In Value, enter the name of the custom variable your JavaScript stored the OTP in, prefixed with custom. and enclosed in double curly braces. For example, {{custom.otp}}.
   
7. To verify that the login succeeded, add a step of type Assert text present, and set it up as follows:
   1. In Text, enter a string that should be visible on the test target page only when login is successful.
   2. (Optional) Set Wait for up to to a large enough value, in milliseconds, to ensure that the page loads.
8. Select Submit.

Configure your test with multifactor authentication through SSO and Active Directory.

1. Add a step for selecting the webpage.
2. Add a step for selecting the SSO authentication link.
3. Enter the required information for SSO authentication.
4. Add steps to confirm that all of the components of each webpage have fully loaded before proceeding.

Configure your browser test with multifactor authentication through TOTP.

1. Step 1: Get the secret key for generating a TOTP

   The secret key is a shared value which both your test target and your test’s authenticator app (such as Okta) will use to generate the same unique TOTP. You can get this secret key from:

   • The test target’s QR code (an image).

   • The plain-text secret key, which is visible as an embedded string in the test target’s QR code when you view the QR code as a URL string. For example, if the QR code is otpauth://totp/Slack:username@somedomain?secret=long-string&issuer=app-name&algorithm=SHA1&digits=6&period=30, the secret key is long-string.

2. Step 2: Save the secret key in a global variable of type TOTP

   There are two ways to create a global variable:

   • From the Splunk Synthetic Monitoring landing page:

     1. From the Splunk Synthetic Monitoring landing page, select the settings icon, and then select Global variables.

     2. Select Create variable.

   • From an existing test’s page:

     1. Select Edit test.

     2. Expand the Variables panel on the right, scroll to Global variables and select Add.

   In the Add variable dialog box, enter the following:

   
   1. In the Variable type pull-down menu, select TOTP.
   2. In the Variable name field, enter the name of the variable. You will use this name to access your variable within a test.
   3. Save the secret key either by:

      • Selecting the QR code tab and dragging the QR code image to it.

      • Selecting the Manual input tab and pasting the long-string you retrieved from the QR code.

   4. (Optional) In the Description field, enter a description to explain the purpose of the variable for future reference. A description is particularly helpful when you conceal the variable and cannot reveal its value.
   5. (Optional) Expand Advanced Settings and specify optional settings:

      • (Optional) Set digits to the number of digits in the generated TOTP. Valid values: 4-8. Default: 6.

      • (Optional) Set TOTP expiration to the the duration of the validity of the TOTP, in seconds. Valid values: 10s-90s. Default: 30s.

   6. (Optional) To validate the secret key you entered, select Generate TOTP.
   7. Select Add.
      Note: Splunk Synthetic Monitoring automatically conceals the value of variables of type TOTP.
3. Step 3: Configure a browser test with TOTP
   1. On the browser test’s configuration page, select the Simple toggle.
   2. Select Edit steps or synthetic transactions.
   3. Add a step of type Fill in field, and in Value, scroll down to the TOTP section (or type totp into the search field) and select the name of the TOTP variable you created. You can also enter this variable name directly as {{totp.variable-name}}.

      

   4. To verify that the login succeeded, add a step of type Assert text present, and set it up as follows:

      1. In Text, enter a string that should be visible on the test target page only when login is successful.

      2. (Optional) Set Wait for up to to a large enough value, in milliseconds, to ensure that the page loads.

   5. Select Submit.
   6. To verify that the login is working, select Try now. Results may take a while. The Try now result pane should display each screen that your test navigated to on the target page, plus the message Success.

      

Configure your browser test with NTLM authentication.

1. Create or edit a browser test.
2. In the Advanced section, find the Authentication configuration.
3. Enter your username in the format DOMAIN\username or username@domain.com
4. Enter your password.
5. Use concealed global variables for both username and password to keep credentials secure.

Configure your browser test with Kerberos authentication.

1. Create a custom runner image.

   Create a Dockerfile based on the official Splunk Synthetics private runner image:

   CODECopy

   FROM quay.io/signalfx/splunk-synthetics-runner:latest USER root # Install Kerberos client libraries RUN apt-get update && apt-get install -y \ krb5-user \ libkrb5-dev \ && rm -rf /var/lib/apt/lists/* # Copy your Kerberos configuration COPY krb5.conf /etc/krb5.conf # Copy your keytab file COPY your-service.keytab /etc/krb5.keytab RUN chmod 600 /etc/krb5.keytab USER synthetics

   FROM quay.io/signalfx/splunk-synthetics-runner:latest
   
   USER root
   
   # Install Kerberos client libraries
   RUN apt-get update && apt-get install -y \
       krb5-user \
       libkrb5-dev \
       && rm -rf /var/lib/apt/lists/*
   
   # Copy your Kerberos configuration
   COPY krb5.conf /etc/krb5.conf
   
   # Copy your keytab file
   COPY your-service.keytab /etc/krb5.keytab
   RUN chmod 600 /etc/krb5.keytab
   
   USER synthetics

2. Create a krb5.conf file for your environment:
   CODECopy

   [libdefaults] default_realm = YOUR-REALM.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true [realms] YOUR-REALM.COM = { kdc = your-kdc-hostname.your-realm.com admin_server = your-kdc-hostname.your-realm.com } [domain_realm] .your-realm.com = YOUR-REALM.COM your-realm.com = YOUR-REALM.COM

   [libdefaults]
       default_realm = YOUR-REALM.COM
       dns_lookup_realm = false
       dns_lookup_kdc = false
       ticket_lifetime = 24h
       renew_lifetime = 7d
       forwardable = true
   
   [realms]
       YOUR-REALM.COM = {
           kdc = your-kdc-hostname.your-realm.com
           admin_server = your-kdc-hostname.your-realm.com
       }
   
   [domain_realm]
       .your-realm.com = YOUR-REALM.COM
       your-realm.com = YOUR-REALM.COM

   Replace:

   • YOUR-REALM.COM with your Kerberos realm (typically your AD domain in uppercase)

   • your-kdc-hostname.your-realm.com with your KDC's hostname

3. Obtain Kerberos tickets

   Before tests run, the runner must have a valid Kerberos ticket.

   1. Use a startup script that runs kinit:

      Use a keytab (recommended)

      BASHCopy

      kinit -kt /etc/krb5.keytab serviceaccount@YOUR-REALM.COM

      kinit -kt /etc/krb5.keytab serviceaccount@YOUR-REALM.COM

      Use a password

      BASHCopy

      echo "your-password" | kinit serviceaccount@YOUR-REALM.COM

      echo "your-password" | kinit serviceaccount@YOUR-REALM.COM

   2. Verify the ticket:
      BASHCopy

      klist

      klist

4. Run the custom runner
   BASHCopy

   docker run \ --name synthetics-runner \ -e RUNNER_TOKEN=your-runner-token \ your-custom-runner-image:latest

   docker run \
     --name synthetics-runner \
     -e RUNNER_TOKEN=your-runner-token \
     your-custom-runner-image:latest

   Ensure the container can reach:

   • Your KDC (port 88)

   • Your DNS servers

   • An NTP server for time synchronization