如果我禁用了authorizarion,如何在测试中模拟安全上下文
作者:互联网
我有这样的测试:
@RunWith(SpringRunner.class)
@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
@DirtiesContext(classMode = DirtiesContext.ClassMode.BEFORE_CLASS)
@ActiveProfiles("test")
public class MyTests {
@Autowired
private TestRestTemplate restTemplate;
....
在测试中,我禁用了身份验证/授权
但在代码中我使用以下内容:
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
但这是测试失败的原因.
我怎么能模拟我的测试?
附:
这个不起作用:
@Test
public void testUpdateWithoutNameAndEmail() {
Authentication authentication = Mockito.mock(Authentication.class);
SecurityContext securityContext = Mockito.mock(SecurityContext.class);
Mockito.when(securityContext.getAuthentication()).thenReturn(authentication);
SecurityContextHolder.setContext(securityContext);
Mockito.when(authentication.getName()).thenReturn("aName");
restTemplate.exchange(..
SecurityContextHolder.getContext().getAuthentication()在代码中返回null
而且这个也是:
@Autowired
private TestRestTemplate restTemplate;
@Test
@WithMockUser(username = "aUser", roles = { "ADMIN" })
public void testUpdateWithoutNameAndEmail() {
...
解决方法:
你可以模拟Spring的身份验证:
Authentication authentication = Mockito.mock(Authentication.class);
并告诉Spring的SecurityContextHolder存储此身份验证实例:
SecurityContext securityContext = Mockito.mock(SecurityContext.class);
Mockito.when(securityContext.getAuthentication()).thenReturn(auth);
SecurityContextHolder.setContext(securityContext);
现在,如果您的代码需要Authentication来返回某些内容(可能是用户名),您只需按常规方式对模拟的Authentication实例设置一些期望,例如:
Mockito.when(authentication.getName()).thenReturn("aName");
还有一个Spring测试注释(org.springframework.security.test.context.support.WithMockUser)为你做这个…
@Test
@WithMockUser(username = "aUser", roles = { "anAuthority" })
public void aTest(){
// any usage of `Authentication` in this test will get an instance withe the user name "aUser" and a granted authority "anAuthority"
// ...
}
标签:java,spring,spring-security,integration-testing,security-context 来源: https://codeday.me/bug/20190828/1750469.html