#WithUserDetails does not seem to work - unit-testing

Question

I have an application in which I use Spring Social Security for authentication and authorization. Unfortunately I am having some problems with mocking Spring Security. It seems that it does not work at all.
I have a REST controller that returns 404 Not Found if the identifier of the entity it should return is not available. If the user is not logged in then any page redirects to the social login page of my app.
I have read here that the #WithUserDetails annotation would suit me the best.
So my test method looks like this
#Test
#SqlGroup({
#Sql(executionPhase = ExecutionPhase.BEFORE_TEST_METHOD, statements = "INSERT INTO UserAccount(id, creationtime, modificationtime, version, email, firstname, lastname, role, signinprovider) VALUES (1, '2008-08-08 20:08:08', '2008-08-08 20:08:08', 1, 'user', 'John', 'Doe', 'ROLE_USER', 'FACEBOOK')"), })
#Rollback
#WithUserDetails
public void ifNoTeamsInTheDatabaseThenTheRestControllerShouldReturnNotFoundHttpStatus() {
ResponseEntity<String> response = restTemplate.getForEntity("/getTeamHistory/{team}", String.class, "Team");
Assert.assertEquals(HttpStatus.NOT_FOUND, response.getStatusCode());
}
But this does not seem to work at all. It looks like the test method is executed with anonymous user, because the status I get is 200 OK.
My test class is annotated like this
#RunWith(SpringRunner.class)
#ActiveProfiles("dev")
#SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT)
#Transactional
public class TeamRestControllerTest {
//...
}
Has anyone ever experienced such an issue with mocking Spring Security that is delivered by Spring Social?

Answer 1

I'm unable to test it at the moment, but here's a possible solution.
Looking at #WithUserDetails implementation:
#WithSecurityContext(factory = WithUserDetailsSecurityContextFactory.class)
public #interface WithUserDetails {
...
}
final class WithUserDetailsSecurityContextFactory implements
WithSecurityContextFactory<WithUserDetails> {
private BeanFactory beans;
#Autowired
public WithUserDetailsSecurityContextFactory(BeanFactory beans) {
this.beans = beans;
}
public SecurityContext createSecurityContext(WithUserDetails withUser) {
String beanName = withUser.userDetailsServiceBeanName();
UserDetailsService userDetailsService = StringUtils.hasLength(beanName)
? this.beans.getBean(beanName, UserDetailsService.class)
: this.beans.getBean(UserDetailsService.class);
String username = withUser.value();
Assert.hasLength(username, "value() must be non empty String");
UserDetails principal = userDetailsService.loadUserByUsername(username);
Authentication authentication = new UsernamePasswordAuthenticationToken(
principal, principal.getPassword(), principal.getAuthorities());
SecurityContext context = SecurityContextHolder.createEmptyContext();
context.setAuthentication(authentication);
return context;
}
}
You could create the Security Context of your choice following the same pattern:
#Target({ElementType.METHOD, ElementType.TYPE})
#Retention(RetentionPolicy.RUNTIME)
#Inherited
#Documented
#WithSecurityContext(factory = WithoutUserFactory.class)
public #interface WithoutUser {
}
public class WithoutUserFactory implements WithSecurityContextFactory<WithoutUser> {
public SecurityContext createSecurityContext(WithoutUser withoutUser) {
return SecurityContextHolder.createEmptyContext();
}
}
The other available annotations: WithAnonymousUser, WithMockUser, WithSecurityContext (and WithUserDetails)

Answer 2

Adding my workaround, probably it can be helpful for someone else.
I think I met the same problem:
A #Testcontainers (for PostgreSQL DB emulation) + #SpringBootTest test.
Mocked the SecurityContext via annotation with #WithSecurityContext with mocking factory.
I need this mocking for an Envers RevisionListener, where I get the userName and userId from the SecurityContext created normally by Keycloak.
When calling the Spring beans in the test, mocking works ok.
But when calling the API via TestRestTemplate, SecurityContext is not mocked and is returning a null for all fields (principal, etc).
The original class looks like this:
#SpringBootTest(
classes = SpringBootInitializer.class,
webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
properties = {"keycloak.enabled=false"}
)
#ContextConfiguration(
classes = PersistenceConfiguration.class,
initializers = MyTest.Initializer.class
)
// !!! the SecurityContext mocking will NOT work when calling the controller via REST
#MockKeycloakUser() // do not fail on getting Keycloak data in UserDataRevisionListener
#EnableAutoConfiguration(exclude = { SecurityAutoConfiguration.class, ManagementWebSecurityAutoConfiguration.class }) // turn off Spring Security to avoid 401 and 302 responses
#Testcontainers // required to fill #Container fields with containers
#Log4j2
#ActiveProfiles("integration-test")
class MyTest {
#Autowired
private TestRestTemplate restTemplate;
// ...
// call via restTemplate looks like this
private List<MyDTO> executeSearchQuery(String query) {
String searchUrl = getSearchUrl(port, query, filter);
MyDTO[] results = this.restTemplate.getForObject(searchUrl, MyDTO[].class);
return List.of(results);
}
// ...
}
What I used to make the SecurityContext work is:
Add the MockMvc field to the test class.
Add #AutoConfigureMockMvc on the test class.
!!! Execute the API via MockMvc instead of TestRestTemplate
Looks like this:
// all other annotations on the test class stay the same
#AutoConfigureMockMvc // make MockMvc work
// ...
class MyTest {
#Autowired
private MockMvc mockMvc; // trick to make the mock SecurityContext work, which does not work when calling via TestRestTemplate
// Execute the API via mockMvc looks like this:
private String getApiResponse(MyRequest request, int expectedHttpStatus) {
final String url = getRequestUrl();
final String requestBody = JacksonUtils.serializeToString(request);
try {
final MockHttpServletRequestBuilder builder = MockMvcRequestBuilders
.post(url)
.contentType(MediaType.APPLICATION_JSON)
.content(requestBody)
;
// use MockMvc instead of TestRestTemplate to successfully use the mock user emulation
return mockMvc
.perform(builder)
.andExpect(status().is(expectedHttpStatus))
.andReturn()
.getResponse()
.getContentAsString(StandardCharsets.UTF_8);
}
catch (Exception e) {
throw new RuntimeException(e);
}
}
// ...
}