spring - 模拟Keycloak token 以测试Spring Controller

我想为我的弹簧控制器编写单元测试。我正在使用keycloak的openid流保护我的端点。

在测试中，我使用@WithMockUser注释模拟经过身份验证的用户。我的问题是我正在从主体的令牌中读取userId。我的单元测试现在失败了，因为我从令牌读取的userId为空；

        if (principal instanceof KeycloakAuthenticationToken) {
            KeycloakAuthenticationToken authenticationToken = (KeycloakAuthenticationToken) principal;
            SimpleKeycloakAccount account = (SimpleKeycloakAccount) authenticationToken.getDetails();
            RefreshableKeycloakSecurityContext keycloakSecurityContext = account.getKeycloakSecurityContext();
            AccessToken token = keycloakSecurityContext.getToken();
            Map<String, Object> otherClaims = token.getOtherClaims();
            userId = otherClaims.get("userId").toString();
        }

有什么可以轻松模拟KeycloakAuthenticationToken的吗？

最佳答案

@WithmockUser用UsernamePasswordAuthenticationToken配置安全上下文。对于大多数用例来说，这可能很好，但是当您的应用程序依赖于另一个Authentication实现（如您的代码一样）时，您必须构建或模拟正确类型的实例并将其放入测试安全性上下文中：
当然，您很快就会希望自动化它，构建自己的注释或SecurityContextHolder.getContext().setAuthentication(authentication);
... 要么 ...
像下面的lib of mine中那样“下架”，可以从maven-central获得：

<dependency>
    <groupId>com.c4-soft.springaddons</groupId>
    <artifactId>spring-security-oauth2-test-webmvc-addons</artifactId>
    <version>2.2.0</version>
    <scope>test</scope>
</dependency>

您可以将其与RequestPostProcessor批注一起使用：

@RunWith(SpringRunner.class)
@WebMvcTest(GreetingController.class)
@ContextConfiguration(classes = GreetingApp.class)
@ComponentScan(basePackageClasses = { KeycloakSecurityComponents.class, KeycloakSpringBootConfigResolver.class })
public class GreetingControllerTests extends ServletUnitTestingSupport {
    @MockBean
    MessageService messageService;

    @Test
    @WithMockKeycloackAuth("TESTER")
    public void whenUserIsNotGrantedWithAuthorizedPersonelThenSecretRouteIsNotAccessible() throws Exception {
        mockMvc().get("/secured-route").andExpect(status().isForbidden());
    }

    @Test
    @WithMockKeycloackAuth("AUTHORIZED_PERSONNEL")
    public void whenUserIsGrantedWithAuthorizedPersonelThenSecretRouteIsAccessible() throws Exception {
        mockMvc().get("/secured-route").andExpect(content().string(is("secret route")));
    }

    @Test
    @WithMockKeycloakAuth(
            authorities = { "USER", "AUTHORIZED_PERSONNEL" },
            accessToken = @WithAccessToken(
                    idToken = @WithKeycloakIDToken(
                            subject = "42",
                            preferredUsername = "ch4mpy",
                            nickName = "Tonton-Pirate",
                            otherClaims = @ClaimSet(stringClaims = @StringClaim(name = "foo", value = "bar"))),
                    scope = "openid foo bar"),
            idToken = @WithKeycloakIDToken(
                    subject = "42",
                    preferredUsername = "ch4mpy",
                    email = "[e-mail]",
                    emailVerified = true,
                    nickName = "Tonton-Pirate",
                    otherClaims = @ClaimSet(stringClaims = @StringClaim(name = "foo", value = "bar"))))
    public void whenAuthenticatedWithKeycloakAuthenticationTokenThenCanGreet() throws Exception {
        ...
    }}

或“流程” API（MockMvc RequestPostProcessor）：

@RunWith(SpringRunner.class)
@WebMvcTest(GreetingController.class)
@ContextConfiguration(classes = GreetingApp.class)
@ComponentScan(basePackageClasses = { KeycloakSecurityComponents.class, KeycloakSpringBootConfigResolver.class })
public class GreetingControllerTest extends ServletKeycloakAuthUnitTestingSupport {
    @MockBean
    MessageService messageService;

    @Test
    public void whenUserIsNotGrantedWithAuthorizedPersonelThenSecretMethodIsNotAccessible() throws Exception {
        mockMvc().with(authentication().roles("TESTER")).get("/secured-method").andExpect(status().isForbidden());
    }

    @Test
    public void whenUserIsGrantedWithAuthorizedPersonelThenSecretMethodIsAccessible() throws Exception {
        mockMvc().with(authentication().roles("AUTHORIZED_PERSONNEL")).get("/secured-method")
                .andExpect(content().string(is("secret method")));
    }

}