Documentation forWeb Performance Monitor

Add authentication to steps in WPM recordings

Starting in WPM 2020.2, you can create recordings that capture credentials for the following types of authentication:

  • Basic Authentication
  • NT LAN Manager (NTLM) authentication
  • Digest authentication

When recording a sequence that navigates to a page that uses authentication, the Web Transaction Recorder prompts you to enter credentials, as shown here:

After you apply credentials to a recording, a Key icon appears at the top of the Recorded Steps pane. Click that icon to display a list of applied authentications, and then click Options () to see details about any particular one.

If authentication fails during playback, the step is highlighted in red, as shown here.

A single step can include multiple types of authentication, as shown in the following figure of a recorded step with domain, proxy server, and certificate authentication. Click the Options () icon to display available commands for that row, such as Edit or Delete.

To edit credentials (for example, if a password expires), click the Key icon, and then click Options ().

To configure domain credentials to support dynamic URLs (for example, if an application generates a different URL for each SSO login attempt), use an asterisk (*) character. Example:*

Note the following details about recordings that include authentication:

  • To support recordings with authentication in FIPS-enabled environments, upgrade to WPM 2020.2.2. Otherwise, "401 Unauthorized" messages will appear during playback.

    NTLM is a challenge-response protocol that uses multiple exchanges. If FIPS mode is enabled, make sure the intervening proxy has a persistent connection, also known as a "keep alive connection."

  • NTLM authentication is not supported in WPM recordings that are saved to Pingdom.
  • Bindings for Basic, NTLM, and Digest authentication include the URL of a secured page (or portion of a page) and credentials. Playback of transactions with authentication fail if the secured page URL doesn't match the binding URL. If that occurs, remove the binding from the original recording on which the transaction was based, and then recreate the binding. You may need to recreate the entire recording plus related transactions, if WPM still cannot match the URL properties.

Removing a step with authentication may render later steps and actions inaccessible, blocking playback. It may be easier to start over with a new recording.

Additional topics related to authentication include: