In this talk, I will be covering the story of my team's adoption of Postman—from QA to development to customer-facing documentation. I will cover how PingIdentity's use of convenience methods in tests make working with our REST API more convenient. I will also cover advanced use of imported Node modules to manually step through the OAuth/OIDC process and how Postman Environment usage helps us manage credentials and tokens and standardize service collections to build out automated tests.

2. Using Postman to
Test OAuth/OIDC
Gideon McKee
Software Quality Engineer
Ping Identity

3. <Self/Ping description and
motivation>
● Identity Security Company
● Let us roll your own authentication
● PingOne for Customers
● IDaaS
● RESTful API calls
● API calls made over HTTP

4. OAuth/OIDC Review

5. OAuth 2.0
● Open standard for access delegation
● A framework
● Multiple “grant types”
● Other protocols (including OIDC) are built on top of
OAuth 2.0
● Gets you (or your app) a token

6. The Auth(orization) Code flow, a.k.a. “3-legged OAuth”

8. Auth Code - take two
Resource Server
Beer Tent
Authorization Server
ID Tent
User Authentication
ID Card
Access Token
Wrist Band
Auth Code
????
Web App
Backend
Token Endpoint
Access Token

9. So how do we test
this?

11. Stepping through a login
● Make an /authorize request
● Do the authentication part (this is not covered by
protocol)
● Return to the “app” with a code
● Exchange that code for a token

13. OIDC
● Authentication layer on top of OAuth 2.0
● If someone has a key to your mailbox, they are not
necessarily you
● ID Token
● /userinfo endpoint

15. Recap
What did we learn?
● Don’t roll your own authentication
● OAuth + OIDC handles authorization +
authentication
● Good Postman collections enable QA,
Dev, Docs, and more
● Testing APIs that use HTTP is all about
Requests and Responses

16. Questions?