@WithUserDetails and @WithMockUser when using springSecurity() in MockMVC with production authentication logic

Question

After debugging for some time, I found that @WithUserDetails and @WithMockUser dummy the SecurityContext but don't add any fake Authentication Provider, so in case this is used with production code,

• SecurityContextHolder is populated with fake SecurityContext containing our dummy Authentication object

• Filters take place and all the prod authentication system fail because there is no extra AbstractUserDetailsAuthenticationProvider in ProviderManager, and upon final error, SecurityContext is cleared, so I loose the test mock authentication setting...

So.. is there any built-in way to use test convenient @With.. annotations over production auth code? Is it a bug? Can I change the order of previous bullet points so at least the testing preparation happens later?

Answer 1

Correct, the @WithUserDetails and @WithMockUser are intended when you wish to mock a request that is already authenticated.

So all the filters that do authentication, should not trigger at this point. If you're filters are triggering, then you can rewrite the filters to account for the use case when the authentication already has taken place.

Another option is to rewrite the test to do authentication the way your application expects it.