Docs: Login Test Cases

Mon, 01 Jan 0001 00:00:00 +0000

Scope

Covers login, login security policies, logout, and session management of the OneCloud Web console. See the following product features:

Environment and account

Item	Value
Address	https://test.yunion.io
Account	cloudadmin
Password	cloudadmin@test
Domain	Default

Login page elements (the actual UI prevails): the Account login / Mobile number login tabs, username input box, password input box, login button, image captcha (shown according to policy), Specify login domain entry, Forgot password, and third-party/CAS login entry.

Case overview

Number	Case name	Priority	Type
TC-LOGIN-001	Log in with the correct username and password	P0	Positive
TC-LOGIN-002	Log in with a wrong password	P0	Negative
TC-LOGIN-003	Log in with a non-existent username	P1	Negative
TC-LOGIN-004	Submit with an empty username or password	P1	Validation
TC-LOGIN-005	Log in with a specified login domain	P1	Positive
TC-LOGIN-006	Login fails when the domain and user do not match	P2	Negative
TC-LOGIN-007	An image captcha appears after repeated wrong passwords	P1	Security
TC-LOGIN-008	Exceeding the wrong-password limit locks the account and generates a security alert	P1	Security
TC-LOGIN-009	A user with “Console login” disabled cannot log in	P1	Negative
TC-LOGIN-010	A disabled user cannot log in	P1	Negative
TC-LOGIN-011	Log in as a user with MFA enabled	P1	Positive
TC-LOGIN-012	A user with an expired password cannot log in	P2	Negative
TC-LOGIN-013	The landing view after login is correct	P0	Positive
TC-LOGIN-014	The session becomes invalid after logout	P0	Positive
TC-LOGIN-015	Accessing an inner page without logging in redirects to the login page	P1	Security
TC-LOGIN-016	Switch the language of the login page	P2	Positive
TC-LOGIN-017	Log in as an identity provider (LDAP) user	P2	Positive
TC-LOGIN-018	Login session validity period	P2	Security

Priority: P0

Prerequisites: The cloudadmin account is enabled and allowed to log in to the console.

Steps:

Open https://test.yunion.io in a browser.
On the “Account login” tab, enter the username cloudadmin.
Enter the password cloudadmin@test.
Click the “Login” button.

Expected results:

After submission, the UI shows a transitional state such as “Logging in, please wait”.
Login succeeds and jumps to the dashboard page, with the current user shown in the upper right corner.
The top area shows the view switch entry, and the current view is the Admin Console view.
A login credential (yunionauth) and the scope, domain, tenant, and other cookies are generated in the browser.
Entering the address again to access the console does not require logging in again.

Actual result: Pass (verified at the API layer; see Appendix B).

Priority: P0

Prerequisites: Same as TC-LOGIN-001.

Steps:

Open the login page.
Enter the username cloudadmin.
Enter the wrong password wrongpass123.
Click the “Login” button.

Expected results:

Login fails and stays on the login page.
The page prompts “Incorrect username or password” (the API returns incorrect username or password).
The password input box is cleared or kept as masked text; no plaintext is echoed.
No valid login credential is generated and the console cannot be entered.

Actual result: Pass. The API returns HTTP 401 with the response body {"class":"IncorrectUsernameOrPassword","code":401,"details":"incorrect username or password"}.

Priority: P1

Steps:

Open the login page.
Enter the username no_such_user_9999.
Enter any password.
Click the “Login” button.

Expected results:

Login fails.
The message is identical to TC-LOGIN-002 and does not distinguish “username does not exist” from “wrong password”, so that whether an account exists is not leaked.

Priority: P1

Steps:

Open the login page, leave both the username and password empty, and click the “Login” button.
Fill in only the username, leave the password empty, and click the “Login” button.
Fill in only the password, leave the username empty, and click the “Login” button.

Expected results:

In all three cases no login request is sent and the page stays where it is.
A validation message “Please enter the username” / “Please enter the password” appears below the corresponding input box.
The input box is highlighted in red or clearly shows an error state.

Priority: P1

Prerequisites: A user that is enabled and allowed to log in to the console exists in the Default domain.

Steps:

Open the login page and click the “Specify login domain” entry.
Select Default in the domain list.
Enter the username cloudadmin and the password cloudadmin@test.
Click the “Login” button.
In the user menu in the upper right corner of the console, reopen the login domain setting and click “Reset login domain”.

Expected results:

After specifying the login domain, the UI shows “Current login domain: Default”.
Login succeeds and the console opens.
After resetting the login domain, the login page returns to platform-level login and does not preselect any domain.

Priority: P2

Prerequisites: A domain that cloudadmin has not joined exists (for example a new domain testdomain).

Steps:

Open the login page, click “Specify login domain”, and select a domain that cloudadmin has not joined.
Enter the username cloudadmin and the password cloudadmin@test.
Click the “Login” button.

Expected results:

Login fails and prompts that the username or password is incorrect.
No cross-domain privilege escalation login occurs.

Priority: P1

Prerequisites: Confirm that a wrong-password threshold is configured on the platform (keystone service parameter password_error_lock_count; the default 0 means no locking). This case consumes cloudadmin’s error count; confirm the threshold with the administrator before executing it to avoid locking the account.

Steps:

Log in repeatedly with cloudadmin and a wrong password until the captcha input box appears in the UI.
Record the number of failures required to trigger the captcha.
Enter a wrong captcha in the captcha input box and click “Login”.
Enter the correct captcha and submit.

Expected results:

After the threshold is reached, an image captcha input box appears on the login page and the captcha image can be refreshed.
When the captcha is wrong, it prompts “Please enter a valid captcha” / “Incorrect captcha” and the login is rejected.
When the captcha is correct and the password is correct, login succeeds.

Remarks: If the captcha policy is not enabled on the platform, mark this case as “Not applicable” and record the platform configuration value.

Priority: P1

Prerequisites: password_error_lock_count is configured to a value greater than 0.

Steps:

Log in repeatedly with cloudadmin and a wrong password, exceeding the configured threshold.
Try to log in with the correct password.
Log in with an administrator account and view the security alert list.

Expected results:

After the threshold is exceeded, the account is locked; even the correct password cannot log in and a message says the account is locked.
A “Login anomaly” alert record is generated on the security alert page.
The alert is also sent to the locked user, the domain administrator of the user’s domain, and the system administrator.
After the lock is released, the correct password can log in normally.

Remarks: This case locks the cloudadmin account. Do not execute it in a production or shared environment; confirm that it can be unlocked before executing.

Priority: P1

Prerequisites: Prepare a local user that is enabled but has “Login to console” turned off.

Steps:

As an administrator, create a user in user management and turn off “Login to console”.
Log out of the current session and log in to the console with that user.

Expected results:

Login is rejected, prompting that there is no console login permission or that the username or password is incorrect.
The user can still access via the API and other means (if the platform allows it) but cannot log in to the console.

Priority: P1

Prerequisites: Prepare a user in the disabled state that is currently online.

Steps:

Log in to the console with that user and keep the session online.
As an administrator, disable the user in user management.
The user keeps operating on console pages.
The user logs out and logs in again.

Expected results:

The disable operation does not force an online user to log out immediately.
After the user logs out, logging in again fails and prompts that the user is disabled.
Logging in with the correct password of the disabled user also fails.

Priority: P1

Prerequisites: Two-factor authentication is enabled in the global configuration, and the target user has MFA enabled and has completed credential binding.

Steps:

Log in as a user with MFA enabled and enter the correct username and password.
Enter the 6-digit security code on the login protection page that appears.
Submit once with a wrong security code.
Submit with the correct security code.

Expected results:

After the password is verified, the console is not entered directly; instead a 6-digit security code is required.
A wrong security code prompts “Incorrect security code, please re-enter” and the console cannot be entered.
Submitting the correct security code enters the console successfully.

Remarks: On test.yunion.io, MFA is currently not enabled for cloudadmin (totp_on=false in the login credential). Executing this case requires preparing a user with MFA enabled first; if global two-factor authentication is not enabled, the user-side MFA switch does not take effect.

Priority: P2

Prerequisites: A user with an expired password exists.

Steps:

Expected results:

A user whose password has expired cannot log in to the system.
A user whose password expires in 7 days can log in normally, and after login is prompted that the password is about to expire and is advised to change it as soon as possible.

Priority: P0

Prerequisites: cloudadmin has the admin role of the system project in the Default domain.

Steps:

Log in as cloudadmin.
Check the view switch entry in the top area.
Switch to the Domain Admin Console view and the Project view in turn, then switch back to the Admin Console view.

Expected results:

The Admin Console view is the default landing view, where system-level resources can be seen.
The view switch entry is displayed normally, and the left navigation menu changes with the view after switching.
The Domain Admin Console view requires three-level permissions to be enabled on the platform; when not enabled, that view does not appear.

Priority: P0

Steps:

Log in to the console and record the current address.
Click the user icon in the upper right corner and select “Sign out”.
Use the browser back button to return to the page from before the logout.
Paste the inner page address from before the logout and access it directly.

Expected results:

After logout, the page jumps to the login page.
Going back or directly accessing the inner page is redirected to the login page and no business data is shown.
The login credential in the browser is invalid.

After a third-party identity provider (such as CAS) user logs out, if the session on the authentication server side is not destroyed, the user may be logged in again automatically. This is the behavior of the identity provider and needs to be confirmed separately.

Priority: P1

Steps:

Clear the browser cookies or use an incognito window.
Access an inner page address directly, such as a resource list address like /vminstance.

Expected results:

The request is intercepted and redirects to the login page.
After a successful login, the user is redirected back to the inner page address originally accessed (if the platform supports redirecting back).

Priority: P2

Steps:

Open the login page and switch the UI language to English.
Switch back to Simplified Chinese.

Expected results:

The login page text switches with the language; the login button, input box placeholders, and error messages are all in the target language.
Switching the language does not affect the username and password already entered.

Priority: P2

Prerequisites: An LDAP identity provider is configured and enabled on the platform, and users have been synced.

Steps:

On the login page, select the corresponding identity provider (for example, select the domain corresponding to the identity provider in “Specify login domain”).
Enter the username and password of the LDAP user and log in.

Expected results:

Identity provider users can log in to the console normally.
Users marked as from an LDAP identity provider in user management do not support resetting the password on the platform side.

Priority: P2

Steps:

Log in to the console and check the expiration time of the login credential cookie.
After the page stays idle beyond the credential validity period, operate on the page or access an inner page again.

Expected results:

The login credential validity period is 24 hours by default (Max-Age=86399).
After the credential expires, operating on the page or accessing an inner page redirects to the login page and requires logging in again.

Actual result: Pass. In the measured login response, the Max-Age of the four cookies yunionauth, scope, domain, and tenant is 86399 seconds.

Appendix A: API-layer verification script

Login-related UI behavior can be quickly regression tested with the login API. The following script performs API-level verification against https://test.yunion.io and can be copied and run directly (curl and python3 are required).

#!/bin/bash
# verify_login.sh — login API regression verification
BASE="https://test.yunion.io"
USER="cloudadmin"
PASS="cloudadmin@test"
DOMAIN="Default"

echo "== TC-LOGIN-001 Login with correct credentials =="
code=$(curl -s -o /tmp/login_ok.txt -w "%{http_code}" \
 -c /tmp/login_cookie.txt \
 -X POST -H 'Content-Type: application/json' \
 -d "{\"username\":\"$USER\",\"password\":\"$PASS\",\"domain\":\"$DOMAIN\"}" \
 "$BASE/api/v1/auth/login")
echo "HTTP $code"
if [ "$code" = "200" ]; then
 echo "PASS: login succeeded"
 grep -q yunionauth /tmp/login_cookie.txt && echo "PASS: yunionauth credential issued"
else
 echo "FAIL: expected 200, got $code"
fi

echo
echo "== TC-LOGIN-002 Login with wrong password =="
resp=$(curl -s -w "\n%{http_code}" \
 -X POST -H 'Content-Type: application/json' \
 -d "{\"username\":\"$USER\",\"password\":\"wrongpass123\",\"domain\":\"$DOMAIN\"}" \
 "$BASE/api/v1/auth/login")
body=$(echo "$resp" | head -n -1)
code=$(echo "$resp" | tail -n 1)
echo "HTTP $code"
echo "$body" | grep -q IncorrectUsernameOrPassword \
 && echo "PASS: returned IncorrectUsernameOrPassword" \
 || echo "FAIL: expected error class not returned"

echo
echo "== TC-LOGIN-003 Login with non-existent user (message should match wrong password) =="
resp=$(curl -s -w "\n%{http_code}" \
 -X POST -H 'Content-Type: application/json' \
 -d "{\"username\":\"no_such_user_9999\",\"password\":\"whatever\",\"domain\":\"$DOMAIN\"}" \
 "$BASE/api/v1/auth/login")
body=$(echo "$resp" | head -n -1)
code=$(echo "$resp" | tail -n 1)
echo "HTTP $code"
echo "$body" | grep -q IncorrectUsernameOrPassword \
 && echo "PASS: same response as wrong password; account existence not leaked" \
 || echo "FAIL: error class differs from wrong password"

echo
echo "== TC-LOGIN-018 Session validity period =="
exp=$(curl -s -D - -o /dev/null \
 -X POST -H 'Content-Type: application/json' \
 -d "{\"username\":\"$USER\",\"password\":\"$PASS\",\"domain\":\"$DOMAIN\"}" \
 "$BASE/api/v1/auth/login" | grep -i '^set-cookie: yunionauth' | grep -o 'Max-Age=[0-9]*')
echo "yunionauth $exp"
[ "$exp" = "Max-Age=86399" ] && echo "PASS: validity period is 24 hours" || echo "WARN: validity period differs from expected 86399"

After a successful login, you can use the credential in /tmp/login_cookie.txt to call other service APIs, for example:

curl -s -b /tmp/login_cookie.txt "$BASE/api/v1/servers?limit=5"

Appendix B: Measured records for this environment

The following API behavior was confirmed by measurement on https://test.yunion.io (2026-09-15) and can serve as the baseline for the expected results of the cases.

Check item	Measured result
Console reachability	HTTP 200, HTTP/2, nginx
Login API	`POST /api/v1/auth/login`, request body `{"username","password","domain"}`
Correct credentials	HTTP 200, empty response body, issues `yunionauth`/`scope`/`domain`/`tenant` cookies
Wrong password	HTTP 401, `{"class":"IncorrectUsernameOrPassword","details":"incorrect username or password"}`
cloudadmin default scope	`system` (Admin Console view)
cloudadmin default domain	`Default`
cloudadmin MFA status	Not enabled (`totp_on=false`, `totp_verified=false` in the credential)
Login credential validity period	86399 seconds (24 hours)
Image captcha API	`GET /api/v1/auth/captcha`, returns `image/png` and issues a `captcha` cookie

Note: The above are API-layer measurement conclusions; cases that depend on UI interaction (such as when the captcha appears, MFA interaction, and password expiration prompts) still need to be executed step by step in a browser to confirm.

Cloudpods – Authentication

Docs: Login Test Cases

Scope

Environment and account

Case overview

TC-LOGIN-001 Log in with the correct username and password

TC-LOGIN-002 Log in with a wrong password

TC-LOGIN-003 Log in with a non-existent username

TC-LOGIN-004 Submit with an empty username or password

TC-LOGIN-005 Log in with a specified login domain

TC-LOGIN-006 Login fails when the domain and user do not match

TC-LOGIN-007 An image captcha appears after repeated wrong passwords

TC-LOGIN-008 Exceeding the wrong-password limit locks the account and generates a security alert

TC-LOGIN-009 A user with “Console login” disabled cannot log in

TC-LOGIN-010 A disabled user cannot log in

TC-LOGIN-011 Log in as a user with MFA enabled

TC-LOGIN-012 A user with an expired password cannot log in

TC-LOGIN-013 The landing view after login is correct

TC-LOGIN-014 The session becomes invalid after logout

TC-LOGIN-015 Accessing an inner page without logging in redirects to the login page

TC-LOGIN-016 Switch the language of the login page

TC-LOGIN-017 Log in as an identity provider (LDAP) user

TC-LOGIN-018 Login session validity period

Appendix A: API-layer verification script

Appendix B: Measured records for this environment