Web Services, SOAP, Authentication, Tokens, and Session Workflows: Diagnostics, Failure Modes, and Production Practices

1. Preserve safe first-failure evidence

2. Diagnostic sequence

flowchart TD
E[Preserve redacted JTL/log/target evidence] --> V[Confirm JMeter/Java/plugin/tool versions]
V --> C[Confirm JMX/data/properties/CLI + authorized target]
C --> S[Inspect Cookie/Header/Auth manager scope]
S --> I[Map username -> session ID -> token fingerprint]
I --> P[Inspect status + JSON/SOAP fault + expiry reason]
P --> G[Inspect generator CPU/GC/save-service]
G --> T[Inspect SUT/IdP metrics/rate limits]
T --> X[Distributed/CI/container state]
X --> F[Least destructive correction]
F --> R[Small bounded rerun + leak scan]

3. Failure mode: real password/token embedded in JMX or CLI

Command-line password properties can appear in shell history/process listings; literal bearer headers are stored in JMX. Authorization Manager also stores directly configured passwords unencrypted.

In a real authorized environment, use approved runtime secret injection. The Academy uses fake CSV credentials so no external secret manager is required.

4. Intentionally broken example: one token shared globally

Setup thread logs in as user01
Global property stores one access token
Every workload thread sends that same token
Each thread has a different/no Cookie Manager session

Symptoms: invalid_session/invalid_token, all requests map to one token fingerprint, or every user appears as user01. Repair: per-thread fake credential login, thread-local token variables, and per-thread Cookie Manager state.

5. Failure mode: disabling TLS verification

A TLS handshake failure occurs before application authentication. Do not weaken JVM certificate algorithms, disable verification, or route around HTTPS. Repair the truststore/certificate/protocol in the authorized environment.

6. Failure mode: login on every request

If Login sits inside a 100-count protected-operation loop, IdP requests multiply 100× per session. Identity latency/rate limits dominate the workload and generator repeatedly parses tokens.

Move Login outside the inner business loop and refresh only when required.

7. Failure mode: hammering the identity provider

An enterprise IdP can lock test accounts or protect itself with stricter rate limits. Use only a dedicated authorized performance tenant, a local mock, or pre-established credentials/tokens for business-service testing.

8. Failure mode: Authorization headers retained

Enabling requestHeaders/samplerData or logging request objects can put bearer tokens/cookies into JTL/jmeter.log. Keep those fields disabled for load and use token fingerprints plus redacted header markers.

9. Failure mode: ignoring expiry

Long tests may start valid and then accumulate 401s when tokens expire. Configured threads remain constant while achieved valid business load collapses. Add production-like refresh or constrain the run to the intended token-valid window.

10. Failure mode: unbounded refresh loop

If Refresh fails and immediately retries forever, the test hammers identity infrastructure and never resumes business work. Model at most the intended bounded refresh attempt; then mark/stop that virtual user if recovery fails.

11. Failure mode: XPath2 assertion scoped to JSON samples

A Thread Group-level SOAP XPath2 assertion applies to Login/Profile JSON too and fails because they are not XML. Attach XML/XPath2 checks to SOAP samplers or XML-only controller scope.

12. SOAP Fault versus transport status

SOAP Fault is application/protocol semantics inside XML. Some services use HTTP 500; others may return Faults with different status behavior. Check both HTTP status and SOAP Body/Fault/business nodes.

13. Causal performance separation

14. Shortcuts to reject

• Do not embed real credentials in JMX, CLI, or repository CSV.
• Do not turn one user's token into a global property.
• Do not disable TLS verification or weaken JVM certificate algorithms.
• Do not blanket-retry login/refresh or add arbitrary long sleeps.
• Do not increase thread count while session ownership/expiry is unresolved.
• Do not enable broad sensitive result retention without explicit need.
• Do not delete first-failure JTL/jmeter.log/redacted target evidence.

Knowledge check

Official references and version notes

• Component Reference — HTTP Request, HTTP Cookie Manager, HTTP Authorization Manager, Header Manager, JSON JMESPath Extractor/Assertion, XML Assertion, XPath2 Extractor/Assertion, and result-scope semantics.
• Elements of a Test Plan — execution/scope and thread-local variable behavior.
• Getting Started — Java requirements, TLS/runtime basics, and GUI-versus-CLI guidance.
• Properties Reference — CSV result defaults, request/response header/body retention, TLS defaults, and HTTP client settings.
• Generating Dashboard Report — required result fields and dashboard interpretation.
• Best Practices — non-GUI load execution, listener restraint, and injector validity.
• Apache JMeter downloads — current stable release and Java requirement.