Pre-Production Testing

Before you deploy your application to production, you MUST confirm that it meets the application requirements and that you have completed the integration requirements. To confirm, follow the verification steps below in your STG environment and DoITT's NYC.ID NON-PRD environment.


  Requirements Verification Steps
Application Header

Verify that your Application Header:

  1. appears at the very top—above all content and navigation elements—of all pages within your application, and
  2. includes the correct elements—the official NYC logo, application name, Log In link, Profile link, Log Out link, and divider.
Brand Banner, if implemented

Verify that your Brand Banner:

  1. appears on the Login page,
  2. appears on the Create Account page after the Create Account link is clicked on the Login page,
  3. appears on the Forgot Password page after the Forgot Password link is clicked on the Login page, and
  4. appears on the Create Account page when linked to from your application.
  5. appears on the Account Profile: Email Address page when linked to from your application.
Email Validation Web Service

If your application does not authorize users with usernames, follow these steps:

  1. log in to your application with a username, and
  2. verify that you are prompted to change your username to an email address.

If your application only authorizes users with validated email addresses, follow these steps:

  1. log in to your application with an un-validated email address, and
  2. verify that you are prompted to validate your email address.
NOTE: After validating your email address, your application should detect that you have a validated email address without asking you to log out and log in.
Enrollment

To verify this step:

  1. log in to your application,
  2. log in to your Account Profile,
  3. verify that your application appears in the list of enrolled applications,
  4. click the link with your application name, and
  5. verify that the link takes you to your application.
NOTE: If the link does not take you to your application, refer to the Frequently Asked Questions page to learn what to do.
Login, and, if implemented, login via federated identity providers

Verify that you can log in to your application using:

  1. a NYC.ID account, and
  2. a NYC Employees account, and
  3. a Facebook account, with and without providing your email address, and
  4. a Google account, and
  5. a LinkedIn account, and
  6. a Microsoft account, and
  7. a Yahoo account.
Logout

To verify this step:

  1. log in to your application,
  2. log out of your application,
  3. click the login link within your application, and
  4. verify that you are prompted to log in, then
  5. visit the Login page, and
  6. verify that you are not logged in.
SAML 2.0 Single Logout

Verify that logging out of your application destroys the user's active session with all applications he or she is logged into via these steps:

Part 1: Logging out of your application via Account Profile:

  1. log in to your application,
  2. visit your Account Profile,
  3. log out of your Account Profile by clicking the Logout link,
  4. verify that the Logout Success page displays,
  5. visit your application, and
  6. verify that you are no longer logged in.

Part 2: Logging out of Account Profile via your application:

  1. log in to your Account Profile,
  2. log in to your application,
  3. log out of your application,
  4. visit your Account Profile, and
  5. verify that you are not logged in.
Session Timeout Warning Verify that your application displays a Session Timeout Warning Dialog on all pages where the user is authenticated, even if he or she has not yet been authorized to use your application.