⚡ AuthMatrix IAM Masterclass
Lab 5

API Testing with Postman

Duration ~30 minutes
Prerequisites Lab 1 complete, Postman installed
Test every AuthMatrix API endpoint across all four roles using three authentication strategies: Local mock tokens, Okta OAuth 2.0, and Microsoft Entra OAuth 2.0.

Import the Collection

  1. Open Postman
  2. Click Import (top left)
  3. Drag and drop this file: labs/lab-05-postman-api-testing/AuthMatrix.postman_collection.json
  4. Click Import

You will see the AuthMatrix API Testing collection in the left sidebar with all folders and requests pre-built.

Strategy 1 — Local Mock Tokens (No IdP Required)

This is the fastest way to test all four roles. The API server issues signed JWTs on demand for any role.

Step 1: Start the API server

npm run dev --workspace=apps/api-server

Step 2: Run the mock token requests

Open the folder "🔑 Step 0 — Get Mock Tokens" in the collection.

Run each of the four requests in order:

Request Role What it does
Get Admin Token Admin Saves JWT to token_admin collection variable
Get Manager Token Manager Saves JWT to token_manager
Get Developer Token Developer Saves JWT to token_developer
Get Auditor Token Auditor Saves JWT to token_auditor

Each request automatically runs a test script that saves the token:

// Auto-runs after each mock-token response:
pm.collectionVariables.set('token_admin', data.token);

Step 3: Switch the active token by role

The collection uses {{active_token}} as the active bearer token in all protected requests.

To test as a specific role, set active_token to the role's token in Collection Variables or directly in the Authorization tab.

Step 4: Run requests and observe 200 vs 403

Work through the folders:

📊 Reports

Request Admin Manager Developer Auditor
GET /reports ✅ 200 ✅ 200 ✅ 200 ✅ 200
POST /reports ✅ 200 ✅ 200 ❌ 403 ❌ 403

👥 Users

Request Admin Manager Developer Auditor
GET /users ✅ 200 ✅ 200 ✅ 200 ❌ 403
POST /users ✅ 200 ❌ 403 ❌ 403 ❌ 403
DELETE /users/:id ✅ 200 ❌ 403 ❌ 403 ❌ 403

⚙️ Jobs

Request Admin Manager Developer Auditor
GET /jobs ✅ 200 ❌ 403 ✅ 200 ❌ 403
💡 Zero Trust observation: Manager ranks above Developer for reports (Manager can write, Developer cannot), but Developer can execute jobs while Manager cannot. Roles are not hierarchical — they grant specific, least-privilege permissions.

🔍 Audit

Request Admin Manager Developer Auditor
GET /audit ✅ 200 ❌ 403 ❌ 403 ✅ 200
DELETE /audit ✅ 200 ❌ 403 ❌ 403 ❌ 403
👱 Key Security Principle: The Auditor can read audit logs but cannot delete them. If Auditors could delete logs, they could cover up their own activity. This is enforced at the API level regardless of the page-level role check.

Step 5: Run the Attack Simulation folder

Open "🚫 Attack Simulation" and send each request. All should return 401 or 403.

Strategy 2 — Okta OAuth 2.0 (Requires Lab 2 Complete)

Step 1: Open any protected request in Postman

For example, open "GET /api/protected/me" from the collection.

Step 2: Click the Authorization tab

In the request panel, click Authorization.

Step 3: Configure OAuth 2.0

Set Auth Type to OAuth 2.0. Then click Get New Access Token and fill in the details with your Okta configuration.

⚠️ Important: You must add Postman's callback URL (https://oauth.pstmn.io/v1/callback) to Okta first.

Step 4: Get the token

Click Get New Access Token. A browser popup opens to Okta's login page. Log in with your Okta credentials. Postman captures the callback and exchanges the code automatically.

Step 5: Send the request

Click Send. The request goes to the API server with Authorization: Bearer <okta_access_token>.

ℹ️ Note: The Okta access token is an RS256 JWT. The API server's current auth.ts validates HS256 (local) tokens. For full Okta token validation directly by the API (without APIM in the middle), the auth.ts middleware needs JWKS mode — this is covered in Lab 4.

Step 6: Verify the token in Postman

In the "Tests" tab for any request, add:

var token = pm.request.headers.get('Authorization').replace('Bearer ', '');
var payload = JSON.parse(atob(token.split('.')[1]));
console.log('Okta claims:', JSON.stringify(payload, null, 2));
console.log('Groups:', payload.groups);

Run the request. In the Postman Console, you will see the Okta token's raw claims including groups: ["Admin", "Everyone"].

Strategy 3 — Microsoft Entra ID OAuth 2.0 (Requires Lab 3 Complete)

Step 1: Add Postman callback URL to Entra

Add https://oauth.pstmn.io/v1/callback to your App Registration's Web Redirect URIs.

Step 2: Configure OAuth 2.0 in Postman

Open any protected request → Authorization → Auth Type: OAuth 2.0 → Get New Access Token using your Entra configuration.

Step 3: Get the token

Click Get New Access Token and sign in.

Step 4: Inspect the Entra token claims

In Postman Console:

var token = pm.request.headers.get('Authorization').replace('Bearer ', '');
var payload = JSON.parse(atob(token.split('.')[1]));
console.log('Entra claims:', JSON.stringify(payload, null, 2));
console.log('Roles:', payload.roles);

You will see roles: ["Admin"] — the Entra App Role claim. Notice the difference from Okta: roles (Entra) vs groups (Okta).

Switching Roles in Postman

Local tokens: edit the active_token collection variable

Quick role switching without re-running mock-token requests: change the value of active_token.

Okta: different Okta users per role

Each Okta user must be in the correct Okta Group (Lab 2).

Entra: change App Role assignment

Each Entra user must be assigned the correct App Role (Lab 3).

Reading API Responses

Success (200/201):

{
  "message": "✅ Access granted to Reports (read:reports)",
  "reports": [...],
  "requestedBy": "Admin User"
}

Forbidden (403):

{
  "error": "Forbidden",
  "message": "Insufficient permissions. Required: write:reports. Your permissions: read:users, read:reports, execute:jobs"
}

Unauthorized (401):

{
  "error": "Unauthorized",
  "message": "No token provided"
}

✅ Lab 5 Checklist

  • Postman collection imported
  • API server running on port 4000
  • Ran all 4 mock-token requests — collection variables populated
  • Tested GET /reports as each of the 4 roles
  • Confirmed Developer gets 403 on POST /reports
  • Confirmed Auditor gets 403 on DELETE /audit
  • Confirmed Manager gets 403 on GET /jobs (even though Manager > Developer on reports)
  • Ran all Attack Simulation requests — all returned 401 or 403
  • (Optional) Configured Okta OAuth 2.0 in Postman and got real RS256 token
  • (Optional) Compared Okta groups claim vs Entra roles claim in Postman Console