testing Spring-Security - spring-security

Question

I have several Controllers in my Spring-Boot (1.1.4.RELEASE)/ Spring-Security application that I would like to run some integration tests on. However, I don't know how to make the request so that the authentication is handled.
Here is my test:
#ContextConfiguration(classes = OFAC, loader = SpringApplicationContextLoader)
#Transactional
#WebAppConfiguration
#IntegrationTest
class AdminControllerIntegrationTest extends Specification {
def adminUrl = "http://localhost:9001/admin"
#Autowired
private AdminController adminController;
def "test retrieving users from db table"() {
def model = Mock(Model)
RestTemplate restTemplate = new TestRestTemplate()
when:
def result = restTemplate.getForEntity(adminUrl, String.class, model)
then:
result != null
}
Here is my security configuration:
#Configuration
#EnableWebMvcSecurity
public class ApplicationSecurity extends WebSecurityConfigurerAdapter {
#Autowired
private CustomUserDetailsService customUserDetailsService;
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers( "/" ).permitAll()
.antMatchers( "/resources/**" ).permitAll()
.antMatchers( "/css/**" ).permitAll()
.antMatchers( "/libs/**" ).permitAll();
http
.formLogin().failureUrl( "/login?error" )
.defaultSuccessUrl( "/" )
.loginPage( "/login" )
.permitAll()
.and()
.logout().logoutRequestMatcher( new AntPathRequestMatcher( "/logout" ) ).logoutSuccessUrl( "/" )
.permitAll();
http
.sessionManagement()
.maximumSessions( 1 )
.expiredUrl( "/login?expired" )
.maxSessionsPreventsLogin( true )
.and()
.sessionCreationPolicy( SessionCreationPolicy.IF_REQUIRED )
.invalidSessionUrl( "/" );
http
.authorizeRequests().anyRequest().authenticated();
}
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
PasswordEncoder encoder = new BCryptPasswordEncoder();
auth.userDetailsService( customUserDetailsService ).passwordEncoder( encoder );
}
When I debug that code,the result I get is the login html. I believe this means the authentication failed (and since I haven't defined the user /password anywhere) and my request is being redirected to the login page.
I looked for a good way to run Integration Tests against like this but haven't found a good solution. If anyone has any examples on how to handle this, I hope you would help

Answer 1

I think to do that kind of test you have no choice but to POST to the login form and extract the session cookie, so you can send it with the request you actually need to test. Something like this:
private String loginAndGrabCookie() {
ResponseEntity<String> page = serverRunning.getForString("/sparklr2/login.jsp");
String cookie = page.getHeaders().getFirst("Set-Cookie");
Matcher matcher = Pattern.compile("(?s).*name=\"_csrf\".*?value=\"([^\"]+).*").matcher(page.getBody());
MultiValueMap<String, String> formData;
formData = new LinkedMultiValueMap<String, String>();
formData.add("j_username", "marissa");
formData.add("j_password", "koala");
if (matcher.matches()) {
formData.add("_csrf", matcher.group(1));
}
String location = "/sparklr2/login.do";
HttpHeaders headers = new HttpHeaders();
headers.set("Cookie", cookie);
headers.setAccept(Arrays.asList(MediaType.TEXT_HTML));
ResponseEntity<Void> result = serverRunning.postForStatus(location, headers , formData);
assertEquals(HttpStatus.FOUND, result.getStatusCode());
cookie = result.getHeaders().getFirst("Set-Cookie");
assertNotNull("Expected cookie in " + result.getHeaders(), cookie);
return cookie;
}
(Taken from https://github.com/spring-projects/spring-security-oauth/blob/master/samples/oauth2/sparklr/src/test/java/org/springframework/security/oauth2/provider/AuthorizationCodeProviderTests.java#L381.)