How to load test OAuth-secured APIs

$ curl --location --request POST 'https://login.microsoftonline.com/<tenantId>/oauth2/token' \
    --header 'Content-Type: application/x-www-form-urlencoded' \
    --data-urlencode 'grant_type=client_credentials' \
    --data-urlencode 'client_id=<clientId>' \
    --data-urlencode 'client_secret=<clientSecret>' \
    --data-urlencode 'resource=<resource>' \
    --data-urlencode 'scope=email openid profile https://graph.microsoft.com/User.Read https://graph.microsoft.com/User.ReadBasic.All'

$ curl --location --request POST 'https://login.microsoftonline.com/<tenantId>/oauth2/v2.0/token' \
    --header 'Content-Type: application/x-www-form-urlencoded' \
    --data-urlencode 'grant_type=password' \
    --data-urlencode 'client_id=<clientId>' \
    --data-urlencode 'client_secret=<clientSecret>' \
    --data-urlencode 'username=<username>' \
    --data-urlencode 'password=<password>' \
    --data-urlencode 'scope=email openid profile https://graph.microsoft.com/User.Read https://graph.microsoft.com/User.ReadBasic.All'

import http from 'k6/http';

/**
 * Authenticate using OAuth against Azure Active Directory
 * @function
 * @param  {string} tenantId - Directory ID in Azure
 * @param  {string} clientId - Application ID in Azure
 * @param  {string} clientSecret - Can be obtained from https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-app#create-a-client-secret
 * @param  {string} scope - Space-separated list of scopes (permissions) that are already given consent to by admin
 * @param  {string} resource - Either a resource ID (as string) or an object containing username and password
 */
export function authenticateUsingAzure(tenantId, clientId, clientSecret, scope, resource) {
  let url;
  const requestBody = {
    client_id: clientId,
    client_secret: clientSecret,
    scope: scope,
  };

  if (typeof resource == 'string') {
    url = `https://login.microsoftonline.com/${tenantId}/oauth2/token`;
    requestBody['grant_type'] = 'client_credentials';
    requestBody['resource'] = resource;
  } else if (
    typeof resource == 'object' &&
    resource.hasOwnProperty('username') &&
    resource.hasOwnProperty('password')
  ) {
    url = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;
    requestBody['grant_type'] = 'password';
    requestBody['username'] = resource.username;
    requestBody['password'] = resource.password;
  } else {
    throw 'resource should be either a string or an object containing username and password';
  }

  const response = http.post(url, requestBody);

  return response.json();
}

import http from 'k6/http';
import encoding from 'k6/encoding';

/**
 * Authenticate using OAuth against Okta
 * @function
 * @param  {string} oktaDomain - Okta domain to authenticate against (e.g. 'k6.okta.com')
 * @param  {string} authServerId - Authentication server identifier (default is 'default')
 * @param  {string} clientId - Generated by Okta automatically
 * @param  {string} clientSecret - Generated by Okta automatically
 * @param  {string} scope - Space-separated list of scopes
 * @param  {string|object} resource - Either a resource ID (as string) or an object containing username and password
 */
export function authenticateUsingOkta(
  oktaDomain,
  authServerId,
  clientId,
  clientSecret,
  scope,
  resource
) {
  if (authServerId === 'undefined' || authServerId == '') {
    authServerId = 'default';
  }
  const url = `https://${oktaDomain}/oauth2/${authServerId}/v1/token`;
  const requestBody = { scope: scope };
  let response;

  if (typeof resource == 'string') {
    requestBody['grant_type'] = 'client_credentials';

    const encodedCredentials = encoding.b64encode(`${clientId}:${clientSecret}`);
    const params = {
      auth: 'basic',
      headers: {
        Authorization: `Basic ${encodedCredentials}`,
      },
    };

    response = http.post(url, requestBody, params);
  } else if (
    typeof resource == 'object' &&
    resource.hasOwnProperty('username') &&
    resource.hasOwnProperty('password')
  ) {
    requestBody['grant_type'] = 'password';
    requestBody['username'] = resource.username;
    requestBody['password'] = resource.password;
    requestBody['client_id'] = clientId;
    requestBody['client_secret'] = clientSecret;

    response = http.post(url, requestBody);
  } else {
    throw 'resource should be either a string or an object containing username and password';
  }

  return response.json();
}

import http from 'k6/http';
import { authenticateUsingAzure } from './oauth/azure.js';
import { authenticateUsingOkta } from './oauth/okta.js';

const AZURE_TENANT_ID = 'AZURE_APP_DIRECTORY_ID';
const AZURE_CLIENT_ID = 'AZURE_APP_APPLICATION_ID';
const AZURE_CLIENT_SECRET = 'AZURE_APP_CLIENT_SECRET';
const USERNAME = 'USERNAME';
const PASSWORD = 'PASSWORD';
const RESOURCE = 'RESOURCE_ID_URI';
const AZURE_SCOPES =
  'email openid profile https://graph.microsoft.com/User.Read https://graph.microsoft.com/User.ReadBasic.All';

const OKTA_CLIENT_ID = 'OKTA_CLIENT_ID';
const OKTA_CLIENT_SECRET = 'OKTA_CLIENT_SECRET';
const OKTA_DOMAIN = 'youcompanyaccount.okta.com';
const OKTA_SCOPES = 'profile email openid';

export function setup() {
  // Use either password authentication flow
  const passwordAuthResp = authenticateUsingAzure(
    AZURE_TENANT_ID,
    AZURE_CLIENT_ID,
    AZURE_CLIENT_SECRET,
    AZURE_SCOPES,
    {
      username: USERNAME,
      password: PASSWORD,
    }
  );

  return passwordAuthResp;

  // Or client credentials authentication flow
  // let clientAuthResp = authenticateUsingAzure(
  //     AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SCOPES, RESOURCE
  // );
  // return clientAuthResp;

  // // Example of Okta OAuth password authentication flow
  // let oktaPassAuth = authenticateUsingOkta(OKTA_DOMAIN, 'default', OKTA_CLIENT_ID, OKTA_CLIENT_SECRET, OKTA_SCOPES,
  // {
  //     username: USERNAME,
  //     password: PASSWORD
  // });
  // // This should print the authentication tokens
  // console.log(JSON.stringify(oktaPassAuth));
  // return oktaPassAuth;
}

export default function (data) {
  // Then, use the access_token to access a protected resource (user profile)
  // NOTE: access_token from client credentials flow cannot be used to access the user profile
  const params = {
    headers: {
      'Content-Type': 'application/json',
      'Authorization': `Bearer ${data.access_token}`, // or `Bearer ${clientAuthResp.access_token}`
    },
  };
  const userProfileUrl = 'https://graph.microsoft.com/v1.0/me';
  const res = http.get(userProfileUrl, params);

  // Do something with the response
  // For example, this should print the user profile
  console.log(JSON.stringify(res.json()));
}