Mock user in spring secutity reactive application - spring-security

Question

I have a spring application that uses the following dependencies:
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.2.3.RELEASE</version>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-oauth2-jose</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-webflux</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
<exclusions>
<exclusion>
<groupId>org.junit.vintage</groupId>
<artifactId>junit-vintage-engine</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>io.projectreactor</groupId>
<artifactId>reactor-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>io.projectreactor</groupId>
<artifactId>reactor-tools</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
The security application is configured as following:
#Configuration
public class SecurityConfiguration {
#Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
http.csrf().disable()
.authorizeExchange()
.pathMatchers("/**").hasAuthority("myAuthority")
.anyExchange().authenticated()
.and()
.oauth2ResourceServer()
.jwt()
.jwtAuthenticationConverter(converter());
return http.build();
}
#Bean
public Converter<Jwt, Mono<AbstractAuthenticationToken>> converter() {
JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(new GrantedAuthoritiesExtractor());
return new ReactiveJwtAuthenticationConverterAdapter(jwtAuthenticationConverter);
}
static class GrantedAuthoritiesExtractor implements Converter<Jwt, Collection<GrantedAuthority>> {
public Collection<GrantedAuthority> convert(Jwt jwt) {
Collection<String> authorities = (Collection<String>) jwt.getClaims().get("roles");
if(authorities == null) {
authorities = List.of();
}
return authorities.stream()
.map(SimpleGrantedAuthority::new)
.collect(Collectors.toList());
}
}
}
so I need authenticated user to request the api and the authority myAuthority.
I would like to write some tests for this to be sure a test fails if someone changes the security configuration.
I use this:
protected WebTestClient webTestClient(Object controller) {
return WebTestClient.bindToController(controller)
.apply(springSecurity())
.configureClient()
.build()
.mutateWith(mockJwt().authorities(new SecurityConfiguration.GrantedAuthoritiesExtractor()));
}
but all tests pass and no authenticated user is needed nor authority.
I would like to use #MockUser to test roles.
EDIT for further info on tests
here is the test class
#ExtendWith(SpringExtension.class)
#WebFluxTest(controllers = MyController.class)
#Import({MyRepository.class, ValidationConfiguration.class})
public class MyControllerTest extends BaseControllerTest {
#Autowired
MyController controller;
#Test
public void test() {}
}