diff --git a/pkg/cli/client_test.go b/pkg/cli/client_test.go
new file mode 100644
index 000000000..ab3550835
--- /dev/null
+++ b/pkg/cli/client_test.go
@@ -0,0 +1,77 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cli
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"os"
+	"testing"
+
+	"github.com/vmware/govmomi/vim25/mo"
+)
+
+func TestNewClient(t *testing.T) {
+	o := ClientOption{}
+	username := os.Getenv("VC_TEST_USERNAME")
+	password := os.Getenv("VC_TEST_PASSWORD")
+	host := os.Getenv("VC_TEST_URL")
+	if host == "" || username == "" || password == "" {
+		t.SkipNow()
+	}
+	o.LoadCredential(username, password, "", "", true)
+	c, err := o.NewClient(context.Background(), host)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f := func() error {
+		var x mo.Folder
+		err = mo.RetrieveProperties(context.Background(), c, c.ServiceContent.PropertyCollector, c.ServiceContent.RootFolder, &x)
+		if err != nil {
+			return err
+		}
+		if len(x.Name) == 0 {
+			return errors.New("empty response")
+		}
+		return nil
+	}
+
+	// check cookie is valid with an sdk request
+	if err := f(); err != nil {
+		t.Fatal(err)
+	}
+
+	// check cookie is valid with a non-sdk request
+	o.url.User = nil // turn off Basic auth
+	o.url.Path = "/folder"
+	r, err := c.Client.Get(o.url.String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if r.StatusCode != http.StatusOK {
+		t.Fatal(r)
+	}
+
+	// sdk request should fail w/o a valid cookie
+	c.Client.Jar = nil
+	if err := f(); err == nil {
+		t.Fatal("should fail")
+	}
+
+}
diff --git a/pkg/cli/user_test.go b/pkg/cli/user_test.go
new file mode 100644
index 000000000..93cc24e7e
--- /dev/null
+++ b/pkg/cli/user_test.go
@@ -0,0 +1,83 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cli
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/vmware/govmomi/ssoadmin"
+	"github.com/vmware/govmomi/ssoadmin/types"
+)
+
+var (
+	username = os.Getenv("VC_TEST_USERNAME")
+	password = os.Getenv("VC_TEST_PASSWORD")
+	host     = os.Getenv("VC_TEST_URL")
+	o        = ClientOption{}
+	u        = User{}
+)
+
+func TestGetRolePermission(t *testing.T) {
+	buildClient(t)
+	r, err := GetRolePermission(context.Background(), &o)
+	if err != nil {
+		t.Fatalf("GetRolePermission error : %s", err)
+	}
+	if r == nil {
+		t.Fatalf("RolePermission error : %v", r)
+	}
+	u.password = password
+
+}
+
+func buildClient(t *testing.T) error {
+	if host == "" || username == "" || password == "" {
+		t.SkipNow()
+	}
+	o.LoadCredential(username, password, "", "", true)
+	c, err := o.NewClient(context.Background(), host)
+	if err != nil {
+		return fmt.Errorf("create client error : %s", err)
+	}
+	o.Client = c
+	return nil
+}
+
+func TestRunUserFunc(t *testing.T) {
+	buildClient(t)
+	expected := types.AdminUser{}
+	expected.Id = types.PrincipalId{
+		Name:   "Administrator",
+		Domain: "vsphere.local",
+	}
+
+	ctx := context.Background()
+	fn := func(c *ssoadmin.Client) error {
+		u, err := c.FindUser(ctx, "Administrator")
+		if u.Id.Name != expected.Id.Name && u.Id.Domain != expected.Id.Domain {
+			return fmt.Errorf("find AdminUser return error, expected (%v), but find (%v)", expected, u)
+		}
+		return err
+	}
+	err := u.Run(ctx, &o, fn)
+	if err != nil {
+		t.Fatalf("Run User Func error : %s", err)
+	}
+}