1. 概述
在本教程中，我們將探討在 Spring 應用中使用 Mocked 身份驗證測試訪問控制規則的選項。
我們將使用 MockMvc 請求後處理程序、WebTestClient 變體器和測試註解，這些註解來自 spring-security-test 和 spring-addons。
2. 使用 Spring-Addons 的原因
在 OAuth2 領域中，spring-security-test 僅提供基於 MockMvc 或 WebTestClient 請求的請求後處理器和轉換器，這對於 @Controller 來説可能足夠了，但對於測試方法安全性（如 @PreAuthorize、@PostFilter 等）在 @Service 或 @Repository 上則存在問題。
通過使用諸如 @WithJwt 或 @WithOidcLogin 這樣的註解，我們可以對任何類型的 @Component 進行單元測試，無論是在 Servlet 還是 Reactive 應用中，這都提供了模擬安全上下文的能力。
因此，我們將使用 spring-addons-oauth2-test 在某些測試中使用它：它為大多數 Spring OAuth2 Authentication 實現提供了這些註解。
This is an excellent and comprehensive guide to testing Spring Security with mocked identities! You've covered a lot of ground, and the organization is very logical. Here's a breakdown of what's great about this document, along with some suggestions for minor improvements: **Strengths:** * **Clear Structure:** The document is well-organized, progressing logically from basic unit tests to integration tests with different authentication types. The use of headings and subheadings makes it easy to navigate. * **Comprehensive Coverage:** You’ve addressed a wide range of scenarios, including: * JWT authentication * Bearer Token authentication * OAuth2 authentication (with different client flows) * Using different annotations (e.g., `@WithMockAuthentication`, `@WithJwt`, `@WithOpaqueToken`) * Integration testing with Spring Boot * **Practical Examples:** The inclusion of sample applications and instructions for setting up Keycloak makes the guide incredibly practical. * **Detailed Explanations:** You clearly explain the rationale behind each approach and the different annotations. * **Emphasis on Testing Strategies:** The document highlights the importance of choosing the right testing strategy based on the authentication type. * **Reference to Spring Addons:** Pointing to the `spring-addons` project and its sample code is a fantastic resource for developers. * **Clear Call to Action:** The final section encourages further exploration and provides links to relevant resources. **Suggestions for Minor Improvements:** * **More Concrete Examples:** While the explanations are good, adding a few more *code snippets* illustrating how to use the annotations would be extremely helpful. For example: * A short example of how to use `@WithMockAuthentication` with a specific set of authorities. * A snippet showing how to configure the `jwtAuthenticationConverter` in the `SecurityConfig` class. * **Clarify `WebEnvironment.MOCK`:** Expand slightly on what `WebEnvironment.MOCK` does. It's a key concept, and a bit more detail would be beneficial. (e.g., "This environment doesn't actually send HTTP requests; it uses mock objects to simulate the behavior of the web server.") * **Error Handling:** Briefly mention potential error scenarios and how to handle them during testing (e.g., what to do if the authentication server is unavailable). * **Testing Authentication Failures:** Add a section specifically on testing scenarios where authentication *fails* (e.g., invalid credentials, expired tokens). This is often overlooked but crucial for robust security testing. * **More on Spring Addons:** Expand a little on the benefits of using `spring-addons`. Highlight features like: * Automatic creation of mock authentication tokens. * Simplified configuration of authentication flows. * Support for different authentication protocols. * **Testing with Keycloak Admin API:** Consider adding a section on testing interactions with the Keycloak Admin API (e.g., creating users, roles, or clients). * **Diagrams/Visuals:** A simple diagram illustrating the flow of an OAuth2 authentication request would be extremely helpful for understanding the process. * **Links to Documentation:** Include links to the official Spring Security documentation for the annotations and configuration options you're discussing. **Overall:** This is an outstanding guide that would be incredibly valuable to developers working with Spring Security. The suggestions above are just minor refinements – you've already created a very well-written and informative document. The inclusion of the `spring-addons` project is a particularly strong element. To help me further refine this guide, could you tell me: * What is the target audience for this document (e.g., junior developers, experienced security engineers)? * Are there any specific aspects of Spring Security testing that you'd like to focus on in more detail?7. 結論
在本文中，我們探討了使用模擬身份驗證 Spring OAuth2 訪問控制規則的兩種選項，分別在 Servlet 和 Reactive 應用中：
- 使用 MockMvc 請求後處理程序和 WebTestClient 變體來自 spring-security-test
- OAuth2 測試註解來自 spring-addons-oauth2-test
我們還發現，可以使用 @Controllers 與 MockMvc 請求後處理程序、WebTestClient 變體或註解進行測試。但是，只有後者能夠在我們測試其他類型的組件時設置安全上下文。
