spring-projects/spring-security

@reneschroeder0000

hi, what is the best way to mock an oauth2-openid connect server for my client? i would like to have something like a local test repository that doesnt need to query other services.

my current implementation is as follows:

@TestConfiguration
class OAuth2TestConfiguration {

    @Bean
    fun getInMemoryReactiveClientRegistrationRepository(
            @Value("\${spring.security.oauth2.client.registration.foo.client-id}") clientId: String,
            @Value("\${spring.security.oauth2.client.registration.foo.client-secret}") clientSecret: String,
            @Value("\${foobar.token-uri}") tokenUri: String
    ): ReactiveClientRegistrationRepository {
        return InMemoryReactiveClientRegistrationRepository(
                ClientRegistration.withRegistrationId("foo")
                        .tokenUri(tokenUri)
                        .clientId(clientId)
                        .clientSecret(clientSecret)
                        .scope("doesnt matter here")
                        .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
                        .build()
        )
    }

    @Bean
    fun getServerOAuth2AuthorizedClientRepository(
            @Autowired authorizedClientService: ReactiveOAuth2AuthorizedClientService
    ): AuthenticatedPrincipalServerOAuth2AuthorizedClientRepository {
        val repo = AuthenticatedPrincipalServerOAuth2AuthorizedClientRepository(authorizedClientService)
        repo.setAnonymousAuthorizedClientRepository(UnAuthenticatedServerOAuth2AuthorizedClientRepository())
        return repo
    }

    @Bean
    fun getInMemoryReactiveOAuth2AuthorizedClientService(
            @Autowired repository: ReactiveClientRegistrationRepository
    ): ReactiveOAuth2AuthorizedClientService = InMemoryReactiveOAuth2AuthorizedClientService(repository)

    @MockBean
    lateinit var jwtDecoder: ReactiveJwtDecoder
}

and wiremock for the tokenUri:

{
  "request": {
    "method": "POST",
    "url": "/token"
  },
  "response": {
    "status": 200,
    "headers": {
      "Content-Type": "application/json"
    },
    "jsonBody": {
      "access_token": "some token",
      "token_type": "Bearer"
    }
  }
}

Have you guys found a way to do Unit Testing on either @OAuth2Client or @ResourceServer mode when using WebFlux? spring-security-test examples (https://docs.spring.io/spring-security/site/docs/current/reference/html/test.html#test-method) only demonstrate how to mock Basic Auth.
If there's a RTFM link, I would appreciate it as well.