Mock Custom User in Spring Security Test

Question

We are using Spring 4.3.9.RELEASE and Spring Security 4.2.3.RELEASE, so these are some of the latest versions we have seen. We have a RESTful (spring-mvc) backend where we are using Spring Web Security for roles-based access to the API's.

We have a controller that looks like this:

@RequestMapping(value = "/create", method = RequestMethod.POST, produces = "application/json", headers = "content-type=application/json")
public @ResponseBody MyObjectEntity createMyObject(@RequestBody MyObjectEntity myObj) throws MyObjectException
{
    UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
    CustomUser user = null;
    if (userDetails instanceof CustomUser)
    {
        user = ((CustomUser) userDetails);
    }
    String email = user.getEmail();
    MyObjectEntity myObj = MyObjectService.createMyObject(myObj, email);
    if (SecurityContextHolder.getContext().getAuthentication() != null)
    {
        SecurityContextHolder.getContext().setAuthentication(null);
    }
    return myObj;
}

We know a user has logged in from the web-site with a username and password. We know the UI has a token, and they pass it along in the header. Our security uses the SiteMinder example, which means we have a UserDetailsService that goes to a third-party, passes along the token, and we now have the username, password, and the roles the user has. This is normally working well. We did create a CustomUserDetailsService as follows:

public class CustomUserDetailsService implements UserDetailsService
{
     @Override
     public UserDetails loadUserByUsername(String accessToken) throws 
       UsernameNotFoundException, 
       PreAuthenticatedCredentialsNotFoundException
       {
            // goto to third-party service to verify token
            // get the Custom User and the user roles
            // also get some extra data, so a custom user
       }
}

So, once we established the token is valid, and we have gotten additional user information from that third-party, and we have the valid role that is authorized for this API ... then we can execute the controller itself. And we see this code is traditional for getting an existing user out of the Spring Security Context.

 UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
    CustomUser user = null;
    if (userDetails instanceof CustomUser)
    {
        user = ((CustomUser) userDetails);
    }

Actually, from what we have read, this is the way to do it when you have a custom user and CustomUserDetails. With this code, we want to get the email of this user. And this all works when we actually test the API with Advanced REST Client. Our QA has to authenticate against the web-site, and they get tokens passed back to the UI, they get those access tokens, and put those in the headers of the Advanced REST Client (or Postman) and this all works.

We even have code to invalidate the security context when the API is over.

if (SecurityContextHolder.getContext().getAuthentication() != null)
{
     SecurityContextHolder.getContext().setAuthentication(null);
}

Against, the real API, with the real progress, this works great. Now, when it comes to testing, some of the tests work against our secured controllers and some do not. So, here we have a controller to test:

@RequestMapping(value = "/{productId}", method = RequestMethod.GET, headers = "Accept=application/json")
public @ResponseBody ProductEntity getProductById(@PathVariable("productId") long productId)
{
    logger.debug("ProductController: getProductById: productId=" + productId);
    CustomUser user = authenticate();
    ProductEntity productEntity = service.getById(productId);
    logger.debug("ProductController: getProductById: productEntity=" + productEntity);
    invalidateUser();
    return productEntity;
}

And here is the test:

@Test
public void testMockGetProductByProductId() throws Exception
{
    MockHttpServletRequestBuilder requestBuilder = MockMvcRequestBuilders.get(BASE_URL + "/1").with(user("testuser").roles("REGULAR_USER"));
    this.mockMvc.perform(requestBuilder).andDo(print()).andExpect(status().isOk());
}

This works because even when we get to the controller, we don't need the CustomerUser set, so it works. If the role is the correct role ("REGULAR_USER"), then it works, if the role is not correct, we get a 403 error which are expecting.

But if you look at the Controller I first posted at the top, we NEED the CustomUser to be set, and if it isn't set, then when we try to get that email, we fail. So, we have been looking at multiple ways of setting up a mock user in authentication, so when we get to the Controller we can get that CustomUser already in security context.

I've actually done this before, but that was when we were using the standard spring security user, and not a custom user.

We can definitely establish a CustomUser in the security context, but when it gets to the controller, and this code is run ....

// THIS WORKS
UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
    CustomUser user = null;

    // This IF fails because;
    // userDetails is of instance User (Spring Security User)
    // and not CustomUser.
    if (userDetails instanceof CustomUser)
    {
        user = ((CustomUser) userDetails);
    }

Let me add the code we have for our CustomUser:

public class CustomUser implements UserDetails
{

private static final long serialVersionUID = -6650061185298405641L;
private String userName;
private ArrayList<GrantedAuthority> authorities;

private String firstName;
private String middleName;
private String lastName;
private String email;
private String phone;
private String externalUserId;

  // getters/setters
  // toString

}

I hope I put enough information here that someone can answer my question. I have spent a day or two scouring the internet for someone who can answer this question to no avail. Some of the answers were a little older from Spring 3 and older Spring Security 3.x. if any more information is needed, please let me know. Thanks!

I wonder ... if I need a CustomUserDetails which implments UserDetails?

Thanks again!

Answer 1

This is probably much easier than what you think.

CustomUser userDetails = new CustomUser();
/* TODO: set username, authorities etc */
MockHttpServletRequestBuilder requestBuilder = MockMvcRequestBuilders.get(BASE_URL + "/1").with(user(userDetails));

This is allowed as long as your CustomUser implements UserDetails interface.