how to test authentication system ?

Question

EDIT: After a complaint about assigning myself the answer, I want to update that the answers provided were not satisfactory. No one came out and explicitly said this is your problem, do this and you will have a resolution. Mere suggestions are not sufficient to merit a bounty award. Lastly, the problem was with server settings and after doing some research on server sessions and looking at Stackoverflow/Serverfault I was able to determine how to best resolve this problem. Therefore, I did not feel it was unjust to mark my own answer as the correct one.

I have a php based authentication system which relies on LDAP to verify identity and uses sessions to maintain users authenticated status.

Lately I noticed that it appears to be pushing me back to the login page like my session expired. The problem is that it does not appear to be for any specific reason that I have noticed and I am not sure how to debug/test something like this.

Here is my authentication function which starts the session:

function authenticateUser($user, $password){
    //assuming ldap connection and verification of user login/pass
    //this is what will happen with authenticate user which is called 
    //when user submits login/pass on authentication form. 
    $_SESSION['id'] = $uID;
    $time = time(); 
    $_SESSION['time'] = $time;                                  
    $_SESSION['lastActivity'] = $time; 
    $_SESSION['expiration'] = $time+$cookieExpiration; 
    $_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];  
    $_SESSION['secret'] = md5(rand());                          
    $_SESSION['userHash'] = getSessionHash();  
    $_SESSION['firstLogin'] = isFirstLogin($user); 
    //assign cookie to user and log authentication 
    giveCookie("userHash", $_SESSION['userHash'],0);
    logAuthenticationAttempt($user, $_SERVER['REMOTE_ADDR'], 1);
    return true;
}//end authenticateUser 

Give cookie function:

function giveCookie($name, $value, $expiration=0){
    global $path, $site; 
    setcookie("userHash", $_SESSION['userHash'], $expiration, $path, $site, true, true);    
}//end giveCookie 

Here is my function which is called on each page to verify the user is authenticated before allowing them to proceed with action requiring authenticated status:

function isValidUser(){
    global $links; global $userName; global $userID; global $cookieExpiration; 
    if(isset($_COOKIE['userHash']) and isset($_SESSION['userHash'])){
        if($_COOKIE['userHash'] == $_SESSION['userHash']){

         $userName = $_SESSION['nameN'];
         $userID = $_SESSION['id'];
         //update userHash cookie for additinoal expiration time this way session
         $time = time(); 
         $expiration = $time+$cookieExpiration; 
         $_SESSION['lastActivity'] = $time; 
         giveCookie("userHash", $_SESSION['userHash'],0);
         $_SESSION['expiration'] = $expiration; 
         return true;
         }
    }
    return false;
}//end isvalidUser() 

Any advice or feedback on how to test this would be appreciated. I am looking to figure out why occasionally after performing some action I get pushed back to the login page.

On a page which request authentication what I do at the top is the following:

if(!isValidUser()){changePage($links['login']."?refer=".$links['requestHelp']);}
//note: changePage is just a function for header("location: somepage.php"); 

Answer 1

You seem to be confusing authentication, authorization and session management. If you want to test all 3 then you'll need some sort of automated test tool capable of scriptable, stateful HTTP session replay (e.g. http::recorder / www::mechaninze with Perl).

OTOH if you want to investigate the session management using your deployed application, then I'd recommend instrumenting the login page to capture information about the current session and how the user got routed there. You should also consider logging the session cookie on the webserver.

Answer 2

The server is probably overwriting their session cookie, which will change the session hash and then it won't equal the cookie they have clientside. You appear to be overthinking this. You don't need to set a cookie on their system to verify them. The $_SESSION var will handle it all for you.

If they pass the challenge, then they have a $_SESSION var that is set that gives them auth levels.

Don't pass $_SESSION off to other vars like you are. Don't go $username = $_SESSION['username'] because now you have a var that is nonsecure ($username) that could have secured data in it. But it might not.

Whenever you are displaying session info, make sure it came from the horse's mouth.

Answer 3

Take a deep look at session.configuration

i would (if your not willing to think over your concept) change the isValidUser to log what ever you can get before return false

function isValidUser(){
    global $cookieExpiration; // since $links isn't used and $userName and $userId come from $_SESSION no need for global there
    if( (isset($_COOKIE['userHash']) and isset($_SESSION['userHash'])) 
        and ($_COOKIE['userHash'] == $_SESSION['userHash']) ){

         $userName = $_SESSION['nameN']; // why these lines?
         $userID = $_SESSION['id']; // see above
         //update userHash cookie for additinoal expiration time this way session
         $time = time(); 
         $expiration = $time+$cookieExpiration; 
         $_SESSION['lastActivity'] = $time; 
         giveCookie("userHash", $_SESSION['userHash'],0);
         $_SESSION['expiration'] = $expiration; 
         return true;
    }
    // $logger ist just an example an could be a p.e Zend_Logger Object
    $logger->debug($_SESSION); // serialize if needed
    $logger->debug($_COOKIE); // serialize if needed
    $logger->err(error_get_last());
    return false;
}//end isvalidUser()

And are you sure you called session_start() before isValidUser()

Answer 4

Write a functional test. You can use SimpleTest's WebTestCase for stuff like this. See the documentation at: http://www.simpletest.org/en/web_tester_documentation.html

Of course, you could also try to break the code down into smaller bits that can easier be tested individually. Right now, your authentication system is tightly coupled to the server state (eg. the session management). You could decouple the two and thus be able to test the authentication system in a unit test, rather than a functional test.

Answer 5

Not sure what testing software you use at the moment, but I'd strongly recommend Selenium. It allows you to run scripted tests through the browser, effectively simulating what an end user would do and see.

Answer 6

It appears that this was a simple misconfiguration of the server itself. Being that this server environment is a shared environment for hundreds of sites, I do not have ability to modify server wide settings in php.ini and the like.

What I was able to do though is...

session_set_cookie_params(time()+$expiration, $path, $domain, true, true); 

This has resolved the issue, it appears before the session expiration was not set properly and this will set it accordingly for this specific application.