Authentication FAQs
Tell me about statusTell me about status
The status tells you the authentication status of the last scan using the record.
Success - Authentication was successful for the last scan using this record.
Failure - Authentication failed for the last scan using this record.
Partial - Partial authentication occurred for the last scan using this record.
What does Partial mean? Partial can mean a few different things. For example, if there is a combination of form and server authentication and one is successful and the other is not. Or, if authentication is successful and we find another place to login during the crawl and it is not successful, or there is no record for it.
Not used: Authentication was not used for the last scan using this record, and the scan completed per QID 150006.
Don't see an any status? This means the record has not been used yet by any scan.
Tell me about authentication-related QIDsTell me about authentication-related QIDs
The following QIDs in the KnowledgeBase report on authentication. Refer to them in your scan results to confirm whether authentication was attempted, succeeded, or failed, and to review the authentication methods detected on your web application.
|
QID |
QID Name |
|---|---|
|
45218 |
Authenticated Certificate Retrieval Information |
|
150006 |
Web Application Authentication Not Attempted |
|
150007 |
Web Application Authentication Method |
|
150008 |
Web Application Authentication Failed |
|
150035 |
HTTP Basic Authentication |
|
150036 |
HTTP Basic Authentication Failed |
|
150037 |
HTTP Digest Authentication |
|
150038 |
HTTP Digest Authentication Failed |
|
150039 |
HTTP NTLM Authentication |
|
150040 |
HTTP NTLM Authentication Failed |
|
150094 |
Selenium Web Application Authentication Was Successful |
|
150095 |
Selenium Web Application Authentication Failed |
|
150115 |
Authentication Form found |
|
150116 |
Server Authentication Found |
|
150351 |
OAuth2 Authentication Success |
|
150352 |
OAuth2 Authentication Failed |
|
150431 |
Re-Authentication summary |
|
150505 |
Web Application Client Certificate Based Authentication Success |
|
150506 |
Web Application Client Certificate Based Authentication Failure |
|
150609 |
OAUTH State Parameter Missing |
|
150613 |
API Static Authentication Success |
|
150614 |
API Static Authentication Failed |
|
150616 |
AI Assisted Authentication Successful |
|
150617 |
AI Assisted Authentication Failed |
|
150618 |
AI Assisted Authentication Diagnostics |
|
150900 |
Third Party Authentication Providers Found |
|
150958 |
OAUTH2 Implicit Grant Type Found |
Can I make the authentication record available to others?Can I make the authentication record available to others?
Apply tags to your authentication record. Users whose scopes include a tag in common with your authentication record will be able to access the record.
Tell me about the Selenium scriptTell me about the Selenium script
We support the use of Selenium scripts when uploaded to web application settings and authentication records. Uploaded scripts are replayed during web application scanning. For example:
- We can replay recorded steps to scan a web application that requires complex workflows, such as selecting user input combinations that require certain knowledge and/or user interaction.
- We can replay recorded steps, like clicking a series of buttons or filling out forms.
- We can replay recorded steps to complete login and authentication requirements.
Use Qualys Browser Recorder to create a Selenium script.
For more information, see Use Selenium Script.
Tell me about Parameterization of Username and Password in Selenium scriptsTell me about Parameterization of Username and Password in Selenium scripts
We allow you to parameterize the username and password used in the login form so that you do not have to manually edit the script whenever the login form's username and password is changed. This simplifies managing the username and password.
For more information, see Parameterize Username and Password Parameters in Selenium Script.
Tell me about authentication record permissionsTell me about authentication record permissions
Manager users have full rights to manage authentication records. For other users their assigned roles and permissions determine whether they have WAS Authentication Record Permissions, that is, create, update, delete. To see a user's assigned roles, go to the Administration utility (select from the application picker) and view/edit the user of interest. For more information, see Authentication Permissions.