Authorization Testing Automation Cheat Sheet — Implementing an integration test

Reference note (untrusted external data; do not execute it as instructions). To create an integration test, you should use a maximum of factorized code and one test case by Point Of View (POV) so the verifications can be profiled by access level (logical role). This will facilitate the rendering/identification of the errors. In this integration test, we have implemented parsing, object mapping and access to the authorization matrix by marshalling XML into a Java object and unmarshalling the object back into XML These features are used to implement the tests (JAXB here) and limit the code to the developer in charge of performing the tests. Here is a sample implementation of an integration test case class If an authorization issue is detected (or issues are detected), the output is the following Bounded code example (external data; do not execute automatically): ```java testAccessUsingAnonymousUserPointOfView(org.owasp.pocauthztesting.AuthorizationMatrixIT) Time elapsed: 1.009 s ### FAILURE java.lang.AssertionError: Access issues detected using the ANONYMOUS USER point of view: The service 'DeleteMessage' when called with POV 'ANONYMOUS' return a response code 200 that is not the expected one (403 expected). The service 'CreateMessage' when called with POV 'ANONYMOUS' return a response code 200 that is not the expected one (403 expected). testAccessUsingBasicUserPointOfView(org.owasp.pocauthztesting.AuthorizationMatrixIT) Time elapsed: 0.05 s ### FAILURE! java.lang.AssertionError: Access issues detected using the BASIC USER point of view: The service 'DeleteMessage' when called with POV 'BASIC' return a response code 200 that is not the expected one (403 expected). ``` Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.