Testing OBO integration in CI/CD pipelines

[quails4Eva]

Hi

We have an app that uses OBO authentication which we'd like to test automatically in our ci/cd pipelines. I'm not clear if this is a supported scenario, or if it is what the intended way would be.

It looks like the ROPC flow is deprecated which would seem the most obvious way to do this. Though it is still used in OnBehalfOfTests.cs in this repo.

The migration docs suggest using a confidential client (https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth-ropc#how-to-migrate-away-from-ropc) and this is done in OnBehalfOfServicePrincipalTests.cs , though the documentation seems to suggest that this isn't correct usage as far as I can tell https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-on-behalf-of-flow#client-limitations .

I'm not sure if this is a question or a feature request. Is there a supported way to do this type of automated testing? If not could there be?

[bgavrilMS]

You can still use ROPC for testing purposes. ROPC is not compatible with MFA (multi-factor auth). And MFA cannot be automated, which is "by design".

If your tenant administrator mandates MFA (they should!), you'd have to ensure that only the test user, which has no other permissions, and which is excluded from MFA.

But a safer way to test is to use a test tenant. Tenant isolation - i.e. having a tenant for testing only - is the safest path to avoid a situation where a test user has lots of permissions and no MFA, leading to compromises if the test password leaks.

[quails4Eva]

Thanks for the response and the advice.

So I shouldn't worry about the functionality being removed in a future release? Obsolete often implies that.

If it's not being removed despite the Obsolete tag it might be good to document that in the obsolete message and documentation. I can't remember what the obsolete message says, but I don't remember it saying that there's no plans to remove the functionality.