How to get a Bearer token from Auth0 to impersonate a test user in an integration test?

Question

Context

I am trying to write some integration tests that verify correctness of my RESTful Web API service (.NET Core-based). To make requests that mimic the user's browser requests I'd need to configure an HttpClient 's headers to include Authorization: Bearer {test-user-1-bearer-token} .

Problem

My issue is that I can not find a way to programmatically retrieve the bearer token(s) for the test user(s) I created by hand.

What I tried

According to my research of the Auth0 Architecture Scenarios the only one that could work for me is called Server Application + API . That scenario relies on retrieving an access token for the testing Application (not a bearer token for a user the code is trying to impersonate). As far as I understand, this prevents me from having multiple test accounts, which I need to have to be able to test complex, multi-user interaction scenarios around my Web API.

Alternative approach

Instead of using a real production-ready Authentication middleware, I could use a custom middleware when running the service instance for testing. An environment variable, for example, could drive the decision about which AuthN middleware to enable. That custom middleware could rely on a non-JWT token source (eg custom HTTP Header) to bypass the Auth0 authentication.

It would be nice to be able to test with Auth0 playing its role, however.

Ugh

I suspect that my question is off-topic because I'm not providing code. Hopefully, I at least get some answers or comments that give me a clue.

Answer 1

For integration tests you could check if your auth service supports Resource Owner Password Validation flow or Client Credentials flow - it would be easier to obtain access token.

If you still going to do it with Implicit flow - there's a similar question answered - https://devforum.okta.com/t/unit-testing-and-implicit-flow/1210/3 . You would need to change from Okta auth service to yours.

Ps

That scenario relies on retrieving an access token for the testing Application (not a bearer token for a user the code is trying to impersonate)

Bearer token is an access tokens. No matter who bears it, testing app or end user.