In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) curriculum, monitoring modern APIs often requires handling complex authentication flows, such as OAuth 2.0 with specific client credential parameters. The provided exhibit illustrates the HTTP Authentication options available within a standard HTTP Server test: None, Basic, NTLM, Kerberos, and OAuth.
According to the ENNA implementation standards, while the HTTP Server test type supports OAuth (Option C), its native implementation is limited. Specifically, it is designed to use a pre-existing token or a simple token refresh flow; it does not support the injection of custom parameters in the initial POST request required to obtain a token in many enterprise client-credential scenarios. Basic and NTLM (Options A and B) are legacy protocols that rely on simple username/password headers and cannot facilitate the multi-step token exchange process described.
To fulfill the requirement of a two-step flow (POST for token, followed by GET for resource), engineers must use more flexible test types:
Transaction scripts (Option D): These allow the engineer to write custom JavaScript using the ThousandEyes transaction library to programmatically handle the POST request, parse the resulting JSON token, and then pass that token into the subsequent GET request ' s header.
API tests (Option E): These are purpose-built for API monitoring and natively support the definition of variables and multi-step requests where the output of one call (the token) serves as the input for the next.
By utilizing these advanced test types, the engineer can successfully navigate complex authentication requirements that the standard HTTP Server test cannot accommodate.
