How to automate two-factor authentication with Google Authenticator using Selenium?

Hello Everyone, in this post will learn about how to automate two-factor authentication with Google authenticator using selenium.

What is two-factor authentication?

In security domain, there are generally three recognized types of authentication factors.

• Type 1 : Something you know (such as passwords, PIN)
• Type 2 : Something you have (such as tokens, keys, smart phones)
• Type 3 : Something you are (such as fingerprints, face ID)

In simple terms, Two-factor authentication, also commonly referred to as 2FA, means using any two of the above mentioned options together in the authentication process of an application.

Most commonly used 2FA methods are Type 1 and Type 2. For instance, using passwords and verification codes.

Two-factor authentication (2FA) is used to add an extra security layer to the system so that they are less prone to vulnerabilities.

What is Google Authenticator?

Google authenticator is a security application by Google used to generate Time-based One-time passwords (TOTP) to authenticate users to access the application.

Google Authenticator generates 2-Step verification codes on your phone.

What is two-step verification in Gmail?

2-Step verification (also known as two-factor authentication) provides stronger security for your Google Account.

After you set it up, you’ll sign in to your account in two steps using,

• Something you know
• Something you have

In our case, two-factor authentication (2FA) will be based on password and Google authenticator’s TOTP verification codes on your phone to authenticate your Google Account.

Pre-requisite : 

• Valid Google Account (If you don’t have, please create one to proceed further)

This article is divided into three sections.

• Enable two-step verification in Gmail
• Google Authenticator App Setup
• Automate two-factor authentication (2FA) using Selenium

Enable two-step verification in Gmail Account

Step 1: Navigate to your google security settings https://myaccount.google.com/security

Step 2 : Click Security Tab

Step 3 : Click on 2-step Verification

Step 4 : Click Get Started

Step 5 : Enter your password and click Next

Step 6 : In the next screen, enter the following

1. Select Country
2. Enter Phone Number
3. Select Radio button of your choice to get code
4. Click Next

Step 7 : Enter the security code sent to your phone number and click Next

Step 8 : Device has been verified. Click Turn On to complete the 2-step verification setup process.

Two- Step verification method has been turned on and the phone number has been verified!!

Google Authenticator App Setup

Step 9 : Scroll down and Click Google Authenticator – Set Up

Step 10 : Choose your platform and click Next

Step 11 : Click Can’t scan it option to grab your security Key and Click Next

Step 12 : Copy the Security Key (Save this key we need it in later steps)

Note: Before clicking Next, Install Google Authenticator App on your device and enter the copied security key to connect with your gmail account.

Step 13 : Click Next

Step 14 : Enter the TOTP verification code generated in Authenticator App and Click Verify

So going forward, Gmail sign in will prompt for password and verification code.

Google Authenticator App has been setup successfully!!

Automate Two-factor authentication (2FA) using Selenium

If your test application is enabled with google’s two-factor authentication, you should get the time-based verification code (TOTP) from authenticator mobile app and sign in to your account every single time.

But, in an end-to-end testing, how can the test script grab the verification code without accessing the mobile application?

Answer is simple!!

You can implement the program that computes the Authenticator code inside your test script easily.

Step 1 : Navigate to https://mvnrepository.com/artifact/org.jboss.aerogear/aerogear-otp-java/1.0.0

Note: Example used in this article is written in JAVA-Gradle project!

Step 2 : Copy the external library code based on your project and paste it in your build file.

 // https://mvnrepository.com/artifact/org.jboss.aerogear/aerogear-otp-java
    compile group: 'org.jboss.aerogear', name: 'aerogear-otp-java', version: '1.0.0'

Step 2 : Create TOTPGenerator.java class and paste the below code

import org.jboss.aerogear.security.otp.Totp;

public class TOTPGenerator {
    /**
     * Method is used to get the TOTP based on the security token
     * @return
     */
    public static String getTwoFactorCode(){
//Replace with your security key copied from step 12
        Totp totp = new Totp("nlyyriaxspwdomi7buvo32cuas6tz7aa"); // 2FA secret key
        String twoFactorCode = totp.now(); //Generated 2FA code here
        return twoFactorCode;
    }
}

Sample Selenium Code that uses the generated 2FA code in test script,

import org.junit.Test;
import org.openqa.selenium.By;
import org.openqa.selenium.WebDriver;
import org.openqa.selenium.chrome.ChromeDriver;

public class TwoFactorGmail {

public static void gmailSignIn(){

 System.setProperty("webdriver.chrome.driver", "path of the exe file\\chromedriver.exe");
        
 WebDriver driver = new ChromeDriver();
        
 driver.manage().window().maximize();

 driver.get("your application url which embeds gmail sign-in");

driver.findElement(By.id("identifierId")).sendKeys("letzdotesting@gmail.com");

 driver.findElement(By.id("identifierNext")).click();
      
 driver.findElement(By.name("password")).sendKeys("password");
      
 driver.findElement(By.id("passwordNext")).click();
  
// OTP value is returned from getTwoFactor method
 driver.findElement(By.id("totpPin")).sendKeys(TOTPGenerator.getTwoFactorCode());
        
 driver.findElement(By.id("totpNext")).click();
    }
}

Two-factor authentication with Google Authenticator using Selenium is done successfully!!

Please comment below if you have any questions or concerns.

Suggested Readings : 

Top 40 Selenium Webdriver Interview Questions & Answers

2FA Authentication using Playwright

Know anyone who is learning Selenium?  Help your friends by sharing this article on Facebook, Twitter, or Google Plus.