Checkpoint Lab — Web Services, SOAP, Authentication, Tokens, and Session Workflows

1. Exact assumptions and hard ceilings

2. Setup and preflight

python fixtures/auth_soap_fixture.py --host 127.0.0.1 --port 8000 --log results/auth-events.jsonl
curl --fail --silent http://127.0.0.1:8000/health
curl --fail --silent http://127.0.0.1:8000/stats

Require zero active sessions before starting.

3. Fake credential source

username,password
user01,fake-pass-01
user02,fake-pass-02

CSV Data Set Config: All threads, Recycle=false, Stop Thread=true. Two rows exactly match two users × one login.

4. Checkpoint tree

Test Plan
├── HTTP Request Defaults -> 127.0.0.1:8000
├── CSV Data Set Config -> fake credentials
└── Thread Group — 2 threads × 1 journey
    Action after Sampler error: Continue
    ├── HTTP Cookie Manager
    ├── SOAP Ping -> XML + XPath2 checks
    ├── Login -> extract ACCESS_TOKEN / REFRESH_TOKEN / SESSION_ID
    ├── Profile Before Expiry       # use 1
    ├── SOAP Account Before Expiry  # use 2
    ├── Expired Token Probe         # expected failed 401
    ├── Refresh Token               # rotate tokens
    ├── Profile After Refresh       # verify recovery
    └── Logout                      # invalidate session

5. Predictions before execution

A — isolation: two login events create two different Session IDs; each maps to one username and its own token fingerprints.

B — expiry: Profile + SOAP consume both token uses; the next Profile is one 401/token_expired per thread.

C — refresh: one refresh per thread changes token fingerprints but keeps Session ID/username; post-refresh Profile succeeds.

D — cleanup/security: two logouts leave active_sessions=0; retained JTL/log/events contain no raw token/password/unredacted Authorization value.

6. SOAP/XML contract

SOAP Ping must be well-formed and return Pong=Hello JMeter. Account Summary must be well-formed and XPath2 must verify User=${username}, SessionId=${SESSION_ID}, and AuthState=valid.

7. Preserve expected 401 evidence

Expired Token Probe remains a failed HTTP 401 sample and JSON assertion confirms status=token_expired. Exactly two such failures are expected in this checkpoint; any additional 401 is unexpected.

8. CLI execution with leak-resistant settings

jmeter.bat -n `
  -t plans\checkpoint-auth-soap.jmx `
  -l results\checkpoint\results.jtl `
  -j results\checkpoint\jmeter.log `
  -Jjmeter.save.saveservice.requestHeaders=false `
  -Jjmeter.save.saveservice.responseHeaders=false `
  -Jjmeter.save.saveservice.samplerData=false `
  -Jjmeter.save.saveservice.response_data=false `
  -Jjmeter.save.saveservice.response_data.on_error=false `
  -Jjmeter.save.saveservice.url=false `
  -Jjmeter.save.saveservice.assertion_results_failure_message=true

Record generator CPU/memory. This tiny run must have headroom before target latency is interpreted.

9. Verify session/token evidence

python tools/analyze_auth_events.py results/auth-events.jsonl
curl --fail --silent http://127.0.0.1:8000/stats

Require two session IDs, one username per session, empty cross_user_sessions, two token-expired events, two refreshes, two logouts, zero raw Authorization values, and zero active sessions.

10. Scan retained artifacts

python tools/scan_auth_artifacts.py   results/checkpoint/results.jtl   results/checkpoint/jmeter.log   results/auth-events.jsonl

PASS is mandatory. Do not weaken the scanner to make the checkpoint green.

11. Expected measured operation counts

12. Performance interpretation

Report login, protected JSON, SOAP, refresh, and logout labels separately. SOAP XML parsing/assertions add injector work; login/refresh are identity operations; protected calls are business operations. Aggregate p95 across unlike labels is not an endpoint metric.

State configured load (2×1), achieved valid operation counts, exactly two expected auth failures, generator utilization, and target service timing. Do not extrapolate the tiny loopback result to production capacity.

13. Required evidence packet

14. Verification checklist

• Target exactly 127.0.0.1:8000.
• Two fake rows consumed without recycle.
• No token stored in JMeter properties.
• Cookie Manager owns per-thread LABSESSION.
• SOAP checks stay scoped to SOAP samples.
• Authorization header uses ${ACCESS_TOKEN}, never literal token.
• Exactly two expected 401s, then refresh succeeds.
• Each session maps to one fake username.
• Artifact scan passes; active_sessions=0.

15. Validity statement

16. Cleanup / rollback

1. Verify active_sessions=0.
2. Stop the local fixture.
3. Retain redacted JTL/log/event evidence until review completes.
4. Delete disposable fake credential/result files according to policy.
5. No real credential/token, public IdP/SOAP service, recorder CA, truststore, RMI engine, database, container, paid service, or system-wide JVM/OS configuration was changed.

17. What Chapter 15 adds to the operating model

The performance-testing operating model now has an identity/session contract: credential source/authorization, per-user session ownership, Cookie Manager scope, access/refresh token stores, auth-header scope, expiry/refresh policy, login frequency, SOAP/XML namespace/assertion contract, TLS/trust boundary, result redaction, auth-failure taxonomy, and logout/session cleanup are reviewed before results become release evidence.

Chapter 16 moves to JDBC Database Load Testing and Connection-Pool Considerations, adding drivers, connection configuration, query/update workloads, transaction/pool contention, database credentials, and datastore telemetry while retaining the same bounded/synthetic/causal-evidence discipline.

Knowledge check

Official references and version notes

• Component Reference — HTTP Request, HTTP Cookie Manager, HTTP Authorization Manager, Header Manager, JSON JMESPath Extractor/Assertion, XML Assertion, XPath2 Extractor/Assertion, and result-scope semantics.
• Elements of a Test Plan — execution/scope and thread-local variable behavior.
• Getting Started — Java requirements, TLS/runtime basics, and GUI-versus-CLI guidance.
• Properties Reference — CSV result defaults, request/response header/body retention, TLS defaults, and HTTP client settings.
• Generating Dashboard Report — required result fields and dashboard interpretation.
• Best Practices — non-GUI load execution, listener restraint, and injector validity.
• Apache JMeter downloads — current stable release and Java requirement.