spring security测试相关

##测试

• 基本引用,读取测试上下文

@Runwith(springJUnit4ClassRunner.class) @ContextConfiguration

• 去掉异常

@Test(expected=AuthenticationCredentialsNotFoundException.class)

• 使用模拟用户

@Test @WithMockUser

• 给模拟用户添加用户名 @Test @WithMockUser("customUsername")

• 给模拟用户添加角色 @Test @WithMockUser(username="admin",roles={"USER","ADMIN"})

• 给模拟用户添加受权 @Test @WithMockUser(username="admin",authorities={"ADMIN","USER"})

• 添加一个匿名对象.

@WithAnonymousUser 在方法上使用,使之得到一个匿名对象.

###使用@WithUserDetails

@WithMockUser适合初始学习,可是不会适合全部应用.它不适合那种指定了Authentication特定类型的主体.这样就能够指定任意的主体,并减小与spring security的耦合.

自定义当事人常常返回一个自定义的UserDetailsService,并返回实现了UserDetails和自定义类型的对象.这种状况下,它对于检测自定义的userDetailsService就很是有用.这个就是@WithUserDetails的工做.

假设UserDetailsService做为一个bean暴露.在下面的测试中UserDetailsService将暴露一个名为"user"的 UsernamepasswordAuthenticationToken类型的Authentication及其主体.

@Test @WithUserDetails public void getMessageWithUserDetails() { String message = messageService.getMessage(); ... }

咱们也能够经过设置username来查找相应的principal.

@Test @WithUserDetails("customUsername")

另外,咱们能够指定bean的名称 @Test @WithUserDetails(value="customUsername",userDetailsServiceBeanName="myUserDetailsService")

注: 这个注解要求其对应的用户必须存在

###@WithSecurityContext 咱们能够经过@WithSecurityContext来建立咱们须要的Security.例如,以下建立一个@WithMockCustomer

@Retention(RetentionPolicy.RUNTIME)
@WithSecurityContext(factory=WithMockCustomUserSecurityContextFactory.class)

public @interface WithMockCustomUser{
	String username() default "rob";
	String name() default "Rob Winch";
}

@WithMockCustomUser须要一个WithSecurityContextFacotry的实现类,是实现类代码以下:

public class withMockCustomerSecurityContextFactory implements WithSecurityContextFacotry<WithMockCustomUser>{
@Override
public SecurityContext createSecurityContext(WithMockCustomUser customUser){
	SecurityContext context = SecurityContextHolder.createEmptyContext();

		CustomUserDetails principal =
			new CustomUserDetails(customUser.name(), customUser.username());
		Authentication auth =
			new UsernamePasswordAuthenticationToken(principal, "password", principal.getAuthorities());
		context.setAuthentication(auth);
		return context;
}

}

spring security的WithSecurityContextTestExecutionListener能够保证咱们的操做正确运行.

在建立WithSecurityContextFactory 实现时,咱们能够使用spring的标准注解.

###经过元注解来生成新的注解

咱们能够利用@WithMockUser来生成新注解.

@Retention(RetentionPolicy.RUNTIME)
@WithMockUser(value="rob",roles="ADMIN")
public @interface WithMockAdmin{}