Methods, systems, and computer readable media for zero trust network access (ZTNA) testing using application-independent authentication profiles
A method for ZTNA testing using application-independent authentication profiles includes providing, at a network traffic emulation platform, user-selectable application flows for generating emulated application traffic to send to an application and providing application-independent authentication profiles for emulating authentication messaging of different ZTNA systems. The method further includes selecting one of the application flows and receiving, at the network traffic emulation platform, user selection of one of the application-independent authentication profiles. The method further includes generating and transmitting emulated authentication traffic to a ZTNA system according to the selected authentication profile, and, in response to successful completion of exchanges required by the authentication profile, generating and transmitting emulated application traffic to a network application according to the user-selected application flow.
1. A method for zero trust network access (ZTNA) testing using application-independent authentication profiles, the method comprising: providing, at a network traffic emulation platform, a user interface that enables a user to configure a mix of emulated application flows by selecting a plurality of different emulated network applications by name and specifying a weight value for each of the emulated network applications; providing, at the network traffic emulation platform, a plurality of user- selectable application-independent authentication profiles for emulating authentication messaging of different ZTNA systems, wherein providing the application-independent authentication profiles includes providing a profile for emulating a policy enforcement point (PEP) and providing a profile for emulating an identity provider (IdP); receiving, at the network traffic emulation platform, user configuration of the mix of the application flows; and receiving, at the network traffic emulation platform, an instruction from a user to execute a test of a device under test and executing the test by: selecting, at the network traffic emulation platform, one of the application-independent authentication profiles; generating and transmitting emulated authentication traffic to the ZTNA system according to the selected authentication profile; and in response to successful completion of exchanges required by the authentication profile, generating and transmitting, to a device under test, emulated application traffic according to the user- selected application flow configured mix of application flows.
2. The method of claim 1 wherein the emulated network applications include emulated applications for communicating with applications on one or more web servers.
3. The method of claim 1 wherein generating and transmitting emulated authentication traffic to the ZTNA system includes generating and transmitting emulated PEP traffic to a PEP according to the PEP profile and generating and transmitting emulated IdP traffic to an IdP according to the IdP profile.
4. The method of claim 1 wherein generating the emulated authentication traffic includes providing the authentication profile to a traffic generation engine.
5. The method of claim 4 wherein the authentication profile causes the traffic generation engine to listen for responses to the emulated authentication traffic and to proceed with generation of the emulated application traffic when the responses conform to expected exchanges of the authentication profile.
6. The method of claim 1 wherein generating the emulated application traffic includes generating the configured mix of emulated application flows using a traffic generation engine.
7. The method of claim 1 wherein providing the user-selectable application flows and the application-independent authentication profiles includes providing a user interface allowing the user to create different combinations of the application flows and the authentication profiles by separately selecting the application flows and the authentication profiles.
8. The method of claim 7 wherein the user interface allows the user to select more than one of authentication profiles and wherein selecting one of the application- independent authentication profiles includes transmitting an initial application message to the network application according to the user-selected application flow, receiving a response, and selecting the application-independent authentication profile dynamically at run time based on the response and from the application-independent authentication profiles selected by the user.
9. A system for zero trust network access (ZTNA) testing using application-independent authentication profiles, the system comprising: a network traffic emulation platform including at least one processor and a memory; a plurality of user-selectable application-independent authentication profiles stored in the memory and for emulating authentication messaging of different ZTNA systems, wherein at least one of the user-selectable application-independent authentication profiles includes a policy enforcement point (PEP) profile and at least another of the user-selectable application-independent authentication profiles includes an identity provider (IdP) profile; a user interface for enabling a user to configure a mix of emulated application flows by selecting a plurality of different emulated network applications by name and specifying a weight value for each of the emulated network applications and for receiving an instruction from a user to execute a test of a device under test; and a traffic generation engine for executing the test by: selecting one of the application-independent authentication profiles; generating and transmitting emulated authentication traffic to a ZTNA system according to the selected authentication profile, and, in response to successful completion of exchanges required by the authentication profile; and
generating and transmitting, to the device under test, emulated application traffic according to the configured mix of application flows.
10. The system of claim 9 wherein the emulated network applications include applications for communicating with applications on one or more web servers.
11. The system of claim 9 wherein the traffic generation engine is configured to generate and transmit emulated PEP traffic to a PEP according to the PEP profile and generate and transmit emulated IdP traffic to an IdP according to the IdP profile.
12. The system of claim 9 wherein the network traffic generation platform is configured to generate the emulated authentication by providing the authentication profile to the traffic generation engine.
13. The system of claim 12 wherein the authentication profile causes the traffic generation engine to listen for responses to the emulated authentication traffic and to proceed with generation of the emulated application traffic when the responses conform to expected exchanges of the authentication profile.
14. The system of claim 9 wherein the user interface allows the user to select more than one of authentication profiles and wherein, in selecting one of the application-independent authentication profiles, the traffic generation engine is configured to transmit an initial application message to the network application according to the user-selected application flow, receive a response, and select the application-independent authentication profile dynamically at run time based on the response and from the application-independent authentication profiles selected by the user.
15. The system of claim 9 wherein the user interface is configured to allow the user to create different combinations of application flows and authentication profiles by separately selecting the application flows and the authentication profiles.
16. A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising: providing, at a network traffic emulation platform, a user interface that enables a user to configure a mix of emulated application flows by selecting a plurality of different emulated network applications by name and specifying a weight value for each of the emulated network applications;
providing, at the network traffic emulation platform, a plurality of application-independent authentication profiles for emulating authentication messaging of different zero trust network access (ZTNA) systems, wherein providing the application-independent authentication profiles includes providing a profile for emulating a policy enforcement point (PEP) and providing a profile for emulating an identity provider (IdP); receiving, at the network traffic emulation platform, user configuration of the mix of the application flows; and receiving, at the network traffic emulation platform, an instruction from a user to execute a test of a device under test and executing the test by: selecting, at the network traffic emulation platform, one of the application-independent authentication profiles; generating and transmitting emulated authentication traffic to the ZTNA system according to the selected authentication profile; and in response to successful completion of exchanges required by the authentication profile, generating and transmitting, to a device under test, emulated application traffic according to the configured mix of application flows.