How to access Dynatrace platform API from a synthetic browser test

[gilgi]

Hi, 

We're trying to build asynthetic browser test against a site that requires OTP.
As there is no direct API to get the OTP data from the provider we need to bypass it so we've created a "back door" workflow to extract it and generate a business event that will store the result. we now in the stage that we need to query it using DQL from the script but facing CORS error as the Dynatrace domain is different than the tested site.

we already know the great article from @HannahM however the current issue is how to avoid the CORS error when accessing the platform without signing in to the platform itself (as accessing the domain itself directly goes to the login page).

Any ideas? 
Gil.

[HannahM]

Does it matter that you only go to the login page? You could ignore the 401 error, if that's causing a failure, or is it that the login page is another domain so doesn't help?

[gilgi]

Hi @HannahM 

It seemed like it was not enough but found out there was another issue. we're testing it right now. will update.

Gil.

[gilgi]

Hi @HannahM ,

So I have the following browser test js node:

api.startAsyncSyntheticEvent();

const url = 'https://TENANTURL.apps.dynatrace.com/platform/storage/query/v1/query:execute';
const payload = {
    "query": "fetch logs, from:now()-10m",
    "requestTimeoutMilliseconds": 10000
};

fetch(url, {
        method: 'POST',
        headers: {
            'accept': 'application/json',
            'Content-Type': 'application/json',
            'Authorization': 'Bearer TOKEN'
        },
        body: JSON.stringify(payload)
    })
    .then(response => {
        if (!response.ok) {
            throw new Error(`HTTP ${response.status}`);
        }
        return response.json();
    })
    .then(data => {
        if (data.state && data.state !== 'SUCCEEDED') {
            api.fail("Query not complete inline, state: " + data.state);
            return;
        }
        api.info("GIL: records = " + (data.result ? data.result.records.length : 0));
        api.finish();
    })
    .catch(error => {
        api.fail("GIL: fetch failed: " + error.message);
    });

It runs after I navigate to my tenant url and being redirected to the sso page.
The fetch itself fails at the end and the message is plain "fetch failed". we've even changed the original website to another one. any thoughts? (I think this discussion is important to many use cases hence this is not directly also managed in a ticket - let me know if only a summary should be done here)

[dannemca · Accepted solution]

if I understood correctly, you have a Workflow that retrieve the OTP and stores as business events. And now, you are using the synthetic step to query this value to use it as authentication... right?

Why not store the OTP in a credential vault instead, that can be used natively by synthetics?

[gilgi]

I  should have thought of it myself!! thanks @dannemca 

[dannemca]

That's what community is for!!!

[gilgi]

@dannemca had to remove teh solution as it seems that the credentials vault is loaded when the test is initiated and is not being refreshed/online accessed for the latest data. This means that updating the vault in the background will only be effective for the next run.

We're back at square one of how to pass the OTP value to the test. API calls to the grail events (using the apps host) are getting the CORS errors. we're looking into classic API's which are currently working but this is not a long term solution.
@HannahM any ideas as well?

Gil.

[PacoPorro]

While it may seem like a roundabout path , I suugest a workflow
- get the credential
- update the vault
-  On demand monitor executions API to run the synthetic test.

[dannemca]

Yep, let the workflow orchestrate the execution.

[gilgi]

Hi @PacoPorro ,

The thing is that the synthetic test that needs to test the whole screen is now in the middle of its run. starting a new one will generate a new OTP.

[dannemca]

I got it now, you need to start the Browser to navigate till the 2FA page, to get the OTP screen...

How are you retrieving the OTP code, since not thru API? What are the steps you need to execute to retrieve?