在 Spring Boot 1.4.1 中，我想對使用 @PreAuthorize 訪問受限的服務(wù)方法進(jìn)行單元測試（而不是集成測試）。問題是從 Eclipse 啟動測試獨(dú)奏時(shí)似乎沒有檢查 @PreAuthorize （尚未嘗試使用 mvn test）。然后，如果我奇跡般地設(shè)法正確運(yùn)行測試，我將嘗試使用 StudyService 接口，而不是 impl。這是我的測試課：@RunWith(MockitoJUnitRunner.class)public class TestMethodSecurity { private static final Long STUDY_ID = 1L; @Mock private StudyRepository studyRepository; @InjectMocks private StudyServiceImpl studyService; @Before public void setup() { given(studyRepository.findOne(STUDY_ID)).willReturn(ModelsUtil.createStudy()); } @Test public void findByIdWithoutAccessRightTest() { Study study = studyService.findById(STUDY_ID); }}這是服務(wù)：@Servicepublic class StudyServiceImpl implements StudyService { @Autowired private StudyRepository studyRepository; @Override @PreAuthorize("hasAnyRole('DOES NOT EVENT CHECK SYNTAX") public Study findById(final Long id) { return studyRepository.findOne(id); }}測試成功，這是失敗。
3 回答
拉丁的傳說
TA貢獻(xiàn)1789條經(jīng)驗(yàn) 獲得超8個(gè)贊
用注釋你的測試類
@RunWith(SpringRunner.class)
@ContextConfiguration
你的方法應(yīng)該是這樣的
@Test(expected = AccessDeniedException.class)
@WithAnonymousUser
@Test
public void findByIdWithoutAccessRightTest() {
Study study = studyService.findById(STUDY_ID);
}
如果不至少加載安全上下文，您將無法測試安全性。
你可能想看看這個(gè)例子：
public ApplicationUser getApplicationUser() {
ApplicationUser applicationUser = (ApplicationUser) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
return applicationUser;
}
import org.junit.Before;
import org.junit.Rule;
import org.junit.Test;
import static org.mockito.Mockito.when;
import static org.mockito.Mockito.mock;
import org.mockito.MockitoAnnotations;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import com.arpit.security.user.ApplicationUser;
public class BaseTest {
@Before
public void setupMock() {
MockitoAnnotations.initMocks(this);
}
@Test
public void mockApplicationUser() {
ApplicationUser applicationUser = mock(ApplicationUser.class);
Authentication authentication = mock(Authentication.class);
SecurityContext securityContext = mock(SecurityContext.class);
when(securityContext.getAuthentication()).thenReturn(authentication);
SecurityContextHolder.setContext(securityContext);
when(SecurityContextHolder.getContext().getAuthentication().getPrincipal()).thenReturn(applicationUser);
}
}
取自：https ://www.javacodegeeks.com/2017/05/mocking-spring-security-context-unit-testing.html
而且我想您的服務(wù)方法故意有語法錯(cuò)誤？（缺少括號和錯(cuò)誤的引號？）
忽然笑
TA貢獻(xiàn)1806條經(jīng)驗(yàn) 獲得超5個(gè)贊
這就是我讓它工作的方式：
@RunWith(SpringRunner.class)
@SpringBootTest
@EnableGlobalMethodSecurity(prePostEnabled = true)
@ActiveProfiles("test")
public class StudySecurityTest {
@Autowired
private StudyService service;
@MockBean
private StudyRepository repository;
@Test
@WithAnonymousUser
public void testAsAnonymous() {
...
}
@Test
@WithMockKeycloakUser(id = LOGGED_USER_ID, username = LOGGED_USER_USERNAME, authorities = { "ROLE_USER" })
public void testAsUser() {
...
}
}
如果你有興趣@WithMockKeycloakUser，問我。
慕碼人8056858
TA貢獻(xiàn)1803條經(jīng)驗(yàn) 獲得超6個(gè)贊
如果要測試 Spring Security 注釋，則需要使用SpringRunner它將創(chuàng)建 Spring Context 并將 Spring Security 代碼注入代理類。
如何測試 Spring Security 你可以在這里找到。
添加回答
舉報(bào)
0/150
提交
取消