diff --git a/pkg/cli/client_test.go b/pkg/cli/client_test.go
new file mode 100644
index 000000000..9082378d8
--- /dev/null
+++ b/pkg/cli/client_test.go
@@ -0,0 +1,78 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cli
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"testing"
+
+	"github.com/vmware/govmomi/vim25/mo"
+	"k8s.io/cloud-provider-vsphere/pkg/cli/test"
+)
+
+func TestNewClient(t *testing.T) {
+	o := ClientOption{}
+	m, s, err := test.NewServiceInstance()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		s.Close()
+		m.Remove()
+	}()
+	c, err := o.NewClient(context.Background(), s.URL.String())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f := func() error {
+		var x mo.Folder
+		err = mo.RetrieveProperties(context.Background(), c, c.ServiceContent.PropertyCollector, c.ServiceContent.RootFolder, &x)
+		if err != nil {
+			return err
+		}
+		if len(x.Name) == 0 {
+			return errors.New("empty response")
+		}
+		return nil
+	}
+
+	// check cookie is valid with an sdk request
+	if err := f(); err != nil {
+		t.Fatal(err)
+	}
+
+	// check cookie is valid with a non-sdk request
+	o.url.User = nil // turn off Basic auth
+	o.url.Path = "/folder"
+	r, err := c.Client.Get(o.url.String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if r.StatusCode != http.StatusOK {
+		t.Fatal(r)
+	}
+
+	// sdk request should fail w/o a valid cookie
+	c.Client.Jar = nil
+	if err := f(); err == nil {
+		t.Fatal("should fail")
+	}
+
+}
diff --git a/pkg/cli/test/vcsim.go b/pkg/cli/test/vcsim.go
new file mode 100644
index 000000000..9137bcf4d
--- /dev/null
+++ b/pkg/cli/test/vcsim.go
@@ -0,0 +1,32 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"log"
+
+	"github.com/vmware/govmomi/simulator"
+)
+
+func NewServiceInstance() (*simulator.Model, *simulator.Server, error) {
+	model := simulator.VPX()
+	err := model.Create()
+	if err != nil {
+		log.Fatal(err)
+	}
+	return model, model.Service.NewServer(), nil
+}
diff --git a/pkg/cli/user_test.go b/pkg/cli/user_test.go
new file mode 100644
index 000000000..d51ca6a2b
--- /dev/null
+++ b/pkg/cli/user_test.go
@@ -0,0 +1,96 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cli
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/vmware/govmomi/ssoadmin"
+	"github.com/vmware/govmomi/ssoadmin/types"
+	"k8s.io/cloud-provider-vsphere/pkg/cli/test"
+)
+
+var (
+	o = ClientOption{}
+	u = User{}
+)
+
+func TestGetRolePermission(t *testing.T) {
+	ctx := context.Background()
+	f, err := buildClient(ctx)
+	if err != nil {
+		t.Fatalf("Test build ServiceInstance error : %s", err)
+	}
+	defer f()
+	r, err := GetRolePermission(ctx, &o)
+	if err != nil {
+		t.Fatalf("GetRolePermission error : %s", err)
+	}
+	if r == nil {
+		t.Fatalf("RolePermission error : %v", r)
+	}
+
+}
+
+func TestRunUserFunc(t *testing.T) {
+	ctx := context.Background()
+	f, err := buildClient(ctx)
+	if err != nil {
+		t.Fatalf("Test build ServiceInstance error : %s", err)
+	}
+	defer f()
+
+	// vcsim does not support sso-adminserver, so error is returned
+	// if applying with a working sso-adminserver, FindUser should return expected administrator user
+	expected := types.AdminUser{}
+	expected.Id = types.PrincipalId{
+		Name:   "Administrator",
+		Domain: "vsphere.local",
+	}
+	fn := func(c *ssoadmin.Client) error {
+		u, err := c.FindUser(ctx, "Administrator")
+		if u.Id.Name != expected.Id.Name && u.Id.Domain != expected.Id.Domain {
+			return fmt.Errorf("find AdminUser return error, expected (%v), but find (%v)", expected, u)
+		}
+		return err
+	}
+	err = u.Run(ctx, &o, fn)
+	if err == nil {
+		t.Fatalf("Run User Func should return error")
+	}
+}
+
+func buildClient(ctx context.Context) (func(), error) {
+	m, s, err := test.NewServiceInstance()
+	if err != nil {
+		return nil, err
+	}
+	fn := func() {
+		s.Close()
+		m.Remove()
+	}
+	c, err := o.NewClient(ctx, s.URL.String())
+	if err != nil || c == nil {
+		return fn, fmt.Errorf("create client error : %s", err)
+	}
+	o.Client = c
+	o.url = s.URL
+	o.insecure = true
+	return fn, err
+}