1. Overview

1.概述

When we’re performance testing with JMeter, we may encounter web services that are secured by the HTTP Basic Authentication protocol.

当我们用JMeter进行性能测试时，我们可能会遇到由HTTP Basic Authentication协议保障的Web服务。

In this tutorial, we’ll see how to configure Apache JMeter to provide the necessary credentials during a test.

在本教程中，我们将看到如何配置Apache JMeter以在测试期间提供必要的凭证。

2. What Is Basic Authentication?

2.什么是基本认证？

Basic Authentication is the simplest access-control method we can use to secure a web resource. It consists of an HTTP header sent by the client:

基本认证是最简单的访问控制方法，我们可以用它来保护网络资源。它由客户端发送的一个HTTP头组成。

Authorization: Basic <credentials>

Here, the credentials are encoded as a Base64 string of the username and password, delimited by a single colon “:”.

这里，凭证被编码为用户名和密码的Base64字符串，以一个冒号”: “为界。

We can see that Basic Authentication is used when credentials are asked in a browser’s window instead of an HTML form. We may get a prompt in our browser:

我们可以看到，基本认证是在浏览器窗口而不是在HTML表单中询问凭证时使用的。我们可能会在浏览器中得到一个提示。

Therefore, if we try to launch a JMeter test on a secured web resource, the response code will be HTTP 401, which means “Unauthorized”. We’ll also receive a “WWW-Authenticate” response header that will describe the authentication type required by the server. In this case, it will be “Basic”:

因此，如果我们试图在一个安全的网络资源上启动一个JMeter测试，响应代码将是HTTP 401，这意味着 “未授权”。我们还将收到一个 “WWW-Authenticate “响应头，它将描述服务器要求的认证类型。在这种情况下，它将是 “基本”。

3. Simple Ways to Implement Basic Authentication in JMeter

3.在JMeter中实现基本认证的简单方法

3.1. Adding an Authorization Header

3.1.添加一个授权标头

The simplest way to send credentials is to add them directly to the request header. We can do this easily with the HTTP Header Manager component, which allows us to add headers to requests sent by an HTTP Request component. The Header Manager must be a child of the HTTP Request component:

发送凭证的最简单方法是直接将其添加到请求头中。我们可以通过HTTP Header Manager组件轻松做到这一点，它允许我们向HTTP请求组件发送的请求添加头信息。头部管理器必须是HTTP请求组件的一个子组件。

In the HTTP Header Manager‘s configuration tab, we just have to add a key/value entry with our authentication details and Authorization as the name:

在HTTP头管理器的配置选项卡中，我们只需添加一个键/值条目，其中包含我们的认证细节和Authorization作为名称。

We can use online tools to encode our string and paste it into the Header Manager. We should take care to add “basic” before our encoded credentials.

我们可以使用在线工具来对我们的字符串进行编码，并将其粘贴到头管理器中。我们应该注意在我们的编码凭证前添加“basic”。

If everything goes well, we should receive a 200 response code from the server.

如果一切顺利，我们应该从服务器上收到一个200的响应代码。

3.2. Encoding the Credentials with the JSR223 PreProcessor

3.2.用JSR223预处理程序对证书进行编码

If we want JMeter to encode our credentials for us, we can use the JSR223 PreProcessor component. We’ll need to use this if we want to vary the credentials used by our test plan.

如果我们想让JMeter为我们编码凭证，我们可以使用JSR223 PreProcessor组件。如果我们想改变我们的测试计划所使用的凭证，我们就需要使用它。

All we have to do is to add a JSR223 PreProcessor before our HTTP Header Manager component:

我们所要做的就是在我们的HTTP头管理器组件之前添加一个JSR223预处理器。

With this component, we can execute a script at runtime. We’ll need to provide a script that retrieves the credentials and encodes them. Let’s use Java:

有了这个组件，我们可以在运行时执行一个脚本。我们需要提供一个脚本来检索凭证并对其进行编码。让我们使用Java。

import org.apache.commons.codec.binary.Base64;

String username = vars.get("username");
String password = vars.get("password");
String credentials = username + ":" + password;
byte[] encodedUsernamePassword = Base64.encodeBase64(credentials.getBytes());
vars.put("base64Credentials", new String(encodedUsernamePassword));

We should now define the username and password variables in the User Defined Variables component:

我们现在应该在用户名和密码组件中定义用户定义的变量。

And finally, in the HTTP Header Manager component, we must set the Authorization header to use the encoded credentials:

最后，在HTTP头管理器组件中，我们必须设置Authorization头，以使用编码的凭证。

And we’re done! Everything should work fine, and we’re able to change the credentials easily in our user-defined variables.

然后我们就完成了!一切都应该工作正常，我们能够在我们的用户定义的变量中轻松地改变凭证。

4. Using HTTP Authorization Manager

4.使用HTTP授权管理器

JMeter provides the HTTP Authorization Manager component to ease the use of credentials for authentication. With this component, we can give credentials for several domains and authentication protocols. This component must be a child of the Thread Group and defined before the HTTP Request component:

JMeter提供了HTTP Authorization Manager组件，以方便使用凭证进行认证。通过这个组件，我们可以为几个域和认证协议提供凭证。这个组件必须是Thread Group的一个子节点，并在HTTP Request组件之前定义。

In the configuration tab of the component, we must define a username and a password to use for authentication:

在该组件的配置选项卡中，我们必须定义一个用户名和密码，以用于认证。

We can use variables in this tab if we defined username and password in a User Defined Variables component. It works for the password, too. Although it’s still masked, we can type “${password}” in the password field.

如果我们在User Defined Variables组件中定义了username和password，我们可以在这个标签中使用变量。这对密码也有效。尽管它仍然被屏蔽，我们可以在password字段中输入“${password}”。

We must take care to select the correct Mechanism for authentication. Here, we’ll choose “BASIC”.

我们必须注意选择正确的Mechanism进行认证。这里，我们将选择“BASIC”。

And that’s it! The HTTP Request component will automatically add an Authorization header in the request, and we should get an HTTP 200 OK response code.

这就是了!HTTP Request组件将自动在请求中添加Authorization头，我们应该得到一个HTTP 200 OK响应代码。

5. Using Multiple Credentials in the HTTP Authorization Manager

5.在HTTP授权管理器中使用多个凭证

Sometimes, we may want to use multiple credentials during our tests. This may be helpful, for example, to validate access restrictions based on roles.

有时，我们可能希望在测试中使用多个凭证。这可能是有帮助的，例如，验证基于角色的访问限制。

To configure this test case, we should create a CSV file in which we’ll store credentials and other information useful for our test plan. This file is read by a CSV Data Set Config component in JMeter. This component should be a child of the Thread Group and will iterate on the CSV lines on each Thread Group loop:

为了配置这个测试用例，我们应该创建一个CSV文件，在其中存储证书和其他对我们测试计划有用的信息。这个文件由JMeter中的CSV数据集配置组件读取。这个组件应该是Thread Group的一个子组件，并将在每个Thread Group循环上迭代CSV行。

Then, in this component, we must define:

那么，在这个部分，我们必须定义。

The location of the file as a path in a User Defined Variables component
The Variable Names that are set by the CSV Data Set component after its execution
Whether the component should ignore the first line – helpful in case we have column names in the CSV file
Which Delimiter is used in the CSV file

When defining several credentials in a CSV File, we should take care to configure our Thread Group to execute several loops.

当在CSV文件中定义多个凭证时，我们应该注意配置我们的线程组以执行多个循环。

With these settings, we should be able to see that different credentials are used in our requests headers.

有了这些设置，我们应该能够看到在我们的请求头中使用了不同的凭证。

6. Conclusion

6.结语

In this article, we looked at how Basic Authentication works for HTTP resources.

在这篇文章中，我们看了基本认证是如何为HTTP资源工作的。

We also learned how to set up a test plan in Apache JMeter to authenticate using this protocol. We covered hard-coded credentials, using the JSR223 PreProcessor, and then supplying multiple credentials from a CSV file.

我们还学习了如何在Apache JMeter中设置一个测试计划，以使用该协议进行认证。我们涵盖了硬编码的凭证，使用JSR223预处理器，然后从CSV文件中提供多个凭证。

As always, the code for these examples is available over on GitHub.

一如既往，这些示例的代码可在GitHub上获得。