Test Automation and EasyRepro: 01 – Overview and Getting Started

by Scott Muniz | Aug 28, 2020 | Uncategorized

This article is contributed. See the original author and article here.

The following is the first on a series of articles by @Ali Youssefi that we will be cross-posting into this Test Community Blog. These articles were first published by Ali in the Dynamics community but since the topic is very related with Testing it makes sense to publish here as well.

We will be interrelating cross-posting content with original articles and when it’s a series. Stay tuned!

—————————————————————————————————————–

Summary

EasyRepro is a framework that allow automated UI tests to be performed on a specific Dynamics 365 organization. You can use it to automate testing such as Smoke, Regression, Load, etc. The framework is built from the Open Source Selenium web drivers used by the industry across a wide range of projects and applications. The entire EasyRepro framework is Open Source and available on GitHub. The purpose of this article is to walk through the setup of the EasyRepro framework. It assumes you are familiar with concepts such as working with Unit Tests in Visual Studio, downloading NuGet packages and cloning repositories from GitHub.

Getting Started

Now that you have a basic understanding of what EasyRepro is useful for you probably would like to start working with it. Getting EasyRepro up and running is very simple as the framework is designed with flexibility and agility in mind. However, like any other utility there is some initial learning and few hurdles to get over to begin working with EasyRepro. Let’s start with dependencies!

Dependencies

The first dependency involves the EasyRepro assemblies and the Selenium framework. The second involve .NET, specifically the .NET framework (.NET core can be used and is included as a feature branch!). Finally depending on how you are working with the framework you will want to include a testing framework to design, build and run your unit tests.

Choosing How to Consume the EasyRepro Framework

There are two ways of consuming the EasyRepro framework, one is using the NuGet packages directly while the other is to clone or download from the GitHub repository. The decision to use one over the other primarily depends on your need to explore or extend the framework and how you go about doing so. Working directly with the source code allows exploration into how EasyRepro interacts with Dynamics 365. However for extending the framework the approach of using the NuGet packages and building on top allows for increased flexibility.

Downloading using NuGet Package Manager

The quickest way to get started with the EasyRepro framework is to simply add a NuGet package reference to your unit test project. You can do by running this command in the NuGet Package Manager command line:

Create your unit test project and navigate to the NuGet Package Manager CLI. Use the Install-Package command to get the PowerApps.UIAutomation.Api package as show in the command below (v9.0.2 is the latest as of this writing please refer to this link for any updates:

Install-Package PowerApps.UIAutomation.Api -Version 9.0.2

This will get you the references needed to begin working with the framework immediately. Once installed you should the following packages begin to download into your unit test project:

When complete the required assemblies are available and you can begin working with the EasyRepro framework. There are some settings needed for the framework to connect to your Dynamics 365 organization which if you’re new to the framework maybe unknown. If so I would suggest reviewing the next section which initiates a clone of the EasyRepro framework which happens to include a robust amount of sample unit tests that show how to interact with the framework.

Cloning from GitHub

If you’re new to the framework in my opinion this is the best way to begin familiarizing yourself how it works and how to build a wide range of unit tests. This is also the way to go if you want to understand how EasyRepro is built upon the Selenium framework and how to extend.

To begin go to the official EasyRepro project located at https://github.com/Microsoft/EasyRepro. Once you’re there take a moment to review the branches available. The branches are structured in a GitFlow approach so if you’re wanting to work with the latest in market release of Dynamics 365 review the releases/* branches. For the latest on going development I would suggest the develop branch.

Start by cloning the project locally to review the contents and see how the interaction between the frameworks occurs.

The gif below shows cloning to Azure DevOps but cloning locally directly from GitHub is also supported.

Cloning locally from Azure DevOps

Another alternative which I highly recommend is to clone to an Azure DevOps project which can then be cloned locally. This will allow us to automate with CI/CD which we will cover in another article. If you decided to clone to Azure DevOps from GitHub the next step is to clone locally.

The gif below shows cloning locally from an Azure DevOps repository.

Reviewing the EasyRepro Source Code Projects

The EasyRepro source code includes a Visual Studio solution with three class library projects and one for sample unit tests.

The projects used by the Unified Interface are Microsoft.Dynamics365.UIAutomation.Api.UCI and Microsoft.Dynamics365.UIAutomation.Api.Browser. Most of the usage between EasyRepro and unit tests will happen with objects and commands within the Microsoft.Dynamics365.UIAutomation.Api.UCI project. This project contains objects to interact with Dynamics Unified Interface modules and forms.

The Microsoft.Dynamics365.UIAutomation.Api.Browser project is limited to interacts with the browser driver and other under the hood components.

Reviewing Sample Unit Tests

Looking into the Open Account Sample Unit Test

The unit test project Microsoft.Dynamics365.UIAutomation.Sample contains hundreds of unit tests which can serve as a great learning tool to better understand how to work with the EasyRepro framework. I highly suggest exploring these tests when you begin to utilize the framework within your test strategy. Many general and specific tasks are essentially laid out and can be transformed to your needs. Examples include opening forms (OpenRecord), navigating (OpenSubArea) and searching for records (Search), creating and updating records (Save).

For this exercise we will open up the UCITestOpenActiveAccount unit test, you can find this using Find within Visual Studio (Ctrl+F). Once found you should see something like the following:

Following the steps within the unit test you can see its designed to perform basic user actions to read an account. We start by logging into an organization (Login). Then we proceed to open the UCI application titled “Sales” (OpenApp). Once in the organization we open the Accounts sub area (OpenSubArea) and search for “Adventure” in the Quick Find View (Search). Finally we open the first record (OpenRecord(0)) in the quick find view results.

Exploring Test Settings

In the current sample Unit Test project the test settings are set in two places: the app.config file located in the root of the project and in the TestSettings.cs file, a class object used across all of the tests.

Application Configuration file

The app.config file includes string configurations that tell the tests what organization to login to, who to login as and other under the hood settings like which browser to run and how to run the tests.

Application Configuration File Settings

For this article we will focus on simply running locally with the Google Chrome browser by setting the BrowserType to “Chrome”. Also inside of the app.config file are three settings we need to modify called OnlineUsername, OnlinePassword and OnlineCrmUrl. In my case I am using a trial and as you can see below I am using a “user@tenant.onmicrosoft.com” username and a “https://<orgname>.crm.dynamics.com/main.aspx” URL.

Before:

 After:

Test Settings and the BrowserOptions object

Another key object is the TestSettings class and the various properties inside. This class tells the unit tests how to render the browser, where the browser driver can be located as well as other properties. The TestSettings class will need to be included in the Unit Test project and instantiate the BrowserOptions object as shown below:

In the next post we will explore how these settings can change your experience working with unit tests and what options are available.

Next Steps

Conclusion

From this article you should be able to begin using EasyRepro with your Dynamics 365 organization immediately. The next articles will go into designing and debugging unit tests, extending the EasyRepro code, implementing with Azure DevOps and other topics.

Friday Five: Virtual Desktop, Teams Tips, And More!

by Scott Muniz | Aug 28, 2020 | Uncategorized

This article is contributed. See the original author and article here.

Office 365 Distilled EP 36: Cortana on the islands of Cuba and Orkney

Marijn Somers is an MVP for Office Apps and Services who has been active in various roles to help clients deliver successful collaboration and content management solutions for more than 14 years. These roles include project manager, presales engineer, evangelist, SPOC (Single-Point-Of-Contact), trainer, analyst and administrator. Marjin is the founder and owner of Balestra, an outfit which focuses on Microsoft Office 365 and specializes in governance and user adoption for collaboration and document management. Follow him on Twitter @MarjinSomers

SQL Server Triggers Tips & Tricks: Working on multiple rows

Sergio Govoni is a graduate of Computer Science from “Università degli Studi” in Ferrara, Italy. Following almost two decades at Centro Software, a software house that produces the best ERP for manufacturing companies that are export-oriented, Sergio now manages the Development Product Team and is constantly involved on several team projects. For the provided help to technical communities and for sharing his own experience, since 2010 he has received the Microsoft Data Platform MVP award. During 2011 he contributed to writing the book: SQL Server MVP Deep Dives Volume 2. Follow him on Twitter or read his blogs in Italian and English.

ASP.NET MVC – LOAD PAGE ON BOOTSTRAP MODAL

Asma Khalid is an Entrepreneur, ISV, Product Manager, Full Stack .Net Expert, Community Speaker, Contributor, and Aspiring YouTuber. Asma counts more than 7 years of hands-on experience in Leading, Developing & Managing IT-related projects and products as an IT industry professional. Asma is the first woman from Pakistan to receive the MVP award three times, and the first to receive C-sharp corner online developer community MVP award four times. See her blog here.

How to: add a task to To-Do from a selected Teams message

Vesku Nopanen is a Principal Consultant in Office 365 and Modern Work and passionate about Microsoft Teams. He helps and coaches customers to find benefits and value when adopting new tools, methods, ways or working and practices into daily work-life equation. He focuses especially on Microsoft Teams and how it can change organizations’ work. He lives in Turku, Finland. Follow him on Twitter: @Vesanopanen

Windows Virtual Desktop spotted in the strangest place ever!

Freek Berson is an Infrastructure specialist at Wortell, a system integrator company based in the Netherlands. Here he focuses on End User Computing and related technologies, mostly on the Microsoft platform. He is also a managing consultant at rdsgurus.com . He maintains his personal blog at themicrosoftplatform.net where he writes articles related to Remote Desktop Services, Azure and other Microsoft technologies. An MVP since 2011, Freek is also an active moderator on TechNet Forum and contributor to Microsoft TechNet Wiki. He speaks at conferences including BriForum, E2EVC and ExpertsLive. Join his RDS Group on Linked-In here . Follow him on Twitter @fberson

Remediate Vulnerable Secure Channel Connections with the Insecure Protocols Workbook

by Scott Muniz | Aug 27, 2020 | Uncategorized

This article is contributed. See the original author and article here.

This article is written by Jon Shectman and Brian Delaney, Microsoft.

Have you read about the elevation of privilege vulnerability that exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller? An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. If you haven’t, you can read about the vulnerability here a and learn how to manage the changes here. Those articles give an excellent overview of the issue, so I won’t repeat it in detail here. In short, we are addressing this vulnerability in a two-part rollout by modifying how Netlogon handles the usage of Netlogon secure channels.

Phase one, deployment, began on Aug 11. In this phase, secure Remote ProtoCol (RPC) is enforced for machine, trust and domain controller accounts. This phase also includes a new group policy object (GPO) and a registry key to manage configuration, and five new Event IDs.

These Event IDs are important for auditing and understanding of the issue. They are as follows:

Machine Events

5827 – Connection denied

5829 – Non-compliant (allowed during Deployment phase)

5830 – Allowed by policy

Trust Events

5828 – Connection denied

5831 – Allowed by policy

Phase two, enforcement, is slated to begin Feb 9, 2021. In phase two, non-compliant machine connections will be denied by default and an Event ID 5827 will be logged. It’s entirely possible to set the new GPO “Domain controller: Allow vulnerable Netlogon secure channel connections” and to simply allow the vulnerable connections. However, that is not recommended. Rather, you should use the new tab in the Insecure Protocols Workbook to detect and understand the five new Event IDs and take appropriate action to address the vulnerable Netlogon sessions prior to the enforcement phase. If you’re new to the Insecure Protocols Workbook, we recommend checking out the getting started guide and then come back here.

To populate the Workbook, take two steps:

1. On your domain controllers, apply the relevant update from CVE-2020-1472.

2. In Azure Sentinel, go to Settings, Workspace Settings, Advanced Settings, Data, Windows Event Logs, and add (or make sure you already have added) Errors and Warnings from the System Log.

Once you have data flowing, it’s time to start using the Insecure Protocols Workbook. The first addition you’ll notice is a new tab, Vulnerable Secure Channel.

The most efficient way to describe how to use this tab is to simply show it – as in the GIF below.

At the top of the tab is a counter (tile) for each of the five new Event IDs. In our lab, for example, we have eight instances of Event ID 5830. That’s the tile I clicked on to filter to that event ID. Next, I “painted” a timebrush slice to filter the queries below to a particular time; then I simply clicked on a Machine Account to show the Machine Account Connections. The result is a highly actionable data set, showing us exactly where we need to research vulnerable secure channel connections.

Once you know where to look, you’ll need to upgrade all Netlogon clients. However, there’s an additional point to consider. Though we expect it to be a rare finding, vulnerable secure channel connections can come from not only machines, but also from trusts (most likely Realm trusts). This configuration may result in significantly increased exposure (Event ID 5828) and may require more planning to remediate.

In this article, we briefly discussed the exposure in vulnerable secure channel connections, how they are logged during the first phase of CVE-2020-1472, and how to audit them with the Insecure Protocols Workbook.

A brief sidenote: If you ever feel your perspectives don’t matter or that your opinions aren’t good enough, we urge you to think again. This workbook enhancement came directly from a conversation on Twitter where multiple folks made the case for it. If you have concepts to add, functionality you’d like to see added, or ideas for improvement, please reach out on Twitter (@shectonsecurity), find us on LinkedIn, or use the comments section. We are all ears.

Thanks for reading and, as always, happy auditing.  :)