title: Testing authentication on REST endpoints
body: <p>I could use some help testing the authentication (using spring authentication) of my spring REST endpoints.
  I have defined some endpoints requiring authentication using the following annotation @PreAuthorize("isAuthenticated()").
  This seems to be working, because when I start a webserver and go to the URL I'm asked to authenticate, after which I get the proper results.</p>
  
  <p>I run into trouble with my tests.</p>
  
  <pre><code>@RunWith(SpringJUnit4ClassRunner.class)
  @ContextConfiguration(classes = TestContext.class)
  @WebAppConfiguration
  public class ControllerTest {
  
      @Autowired
      private WebApplicationContext context;
  
      private MockMvc mvc;
  
      @Before
      public void setup() {
          mvc = MockMvcBuilders
                  .webAppContextSetup(context)
                  .apply(springSecurity())
                  .build();
      }
  
      @Test
      public void testGetMethod() throws Exception {
          mvc
              .perform(get("/a-valid-url")
                          .accept(MediaType.APPLICATION_JSON))
              .andDo(print())
              .andExpect(status().isUnauthorized());
      }
  
  }
  </code></pre>
  
  <p>The TestContext class contains some autowired classes in the controller which are mocked, like this:</p>
  
  <pre><code>@Configuration
  public class TestContext {
  
      @Bean
      public ClassToMock autowiredClass() {
          return Mockito.mock(ClassToMock.class);
      }
  
  }
  </code></pre>
  
  <p>When run like this I get the following error:
  java.lang.IllegalStateException: springSecurityFilterChain cannot be null. Ensure a Bean with the name springSecurityFilterChain implementing Filter is present or inject the Filter to be used.</p>
  
  <p>The only solution I have found thus far to get everything running is by adding a springSecurityFilterChain bean in the TestContext class, like this:</p>
  
  <pre><code>@Bean
  public Filter springSecurityFilterChain() {
      return Mockito.mock(Filter.class);
  }
  </code></pre>
  
  <p>However then I always get a Status = 200, even when I use an URL that is not defined in the controller.</p>
  
  <p>If anyone could point me in the right direction it would be much appreciated!</p>
  
  <p><strong>Edit:</strong> Some of the configuration of the project.</p>
  
  <p>web.xml</p>
  
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>The project has another project as a dependency which contains the TokenContext and AuthenticationStatelessContext configuration XML files.</p>
  
  <p>TokenContext.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8" ?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
          xmlns:security="http://www.springframework.org/schema/security"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xmlns:context="http://www.springframework.org/schema/context"
          xsi:schemaLocation="http://www.springframework.org/schema/beans 
                              http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
                              http://www.springframework.org/schema/security 
                              http://www.springframework.org/schema/security/spring-security-4.0.xsd 
                              http://www.springframework.org/schema/context 
                              http://www.springframework.org/schema/context/spring-context-4.1.xsd" &gt;
  
      &lt;context:component-scan base-package="com.example.auth.service" resource-pattern="TokenServiceImpl.class"/&gt;
      &lt;context:component-scan base-package="com.example.auth.service" resource-pattern="ActorRolServiceImpl.class"/&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p>The AuthenticationStatelessContext.xml defines the following spring beans: DefaultMethodSecurityExpressionHandler, PreAuthenticatedAuthenticationProvider and UserDetailsByNameServiceWrapper.</p>
  
  <p><strong>Update:</strong>
  Created a class named TestContext2:</p>
  
  <pre><code>@Configuration
  @ImportResource({
      "classpath:**/AuthenticationStatelessContext.xml",
      "classpath:**/TokenContext.xml"})
  public class TestContext2 {
  
  }
  </code></pre>
  
  <p>And added that class to the test</p>
  
  <pre><code>@ContextConfiguration(classes = {TestContext.class, TestContext2.class})
  </code></pre>
  
  <p>This because spring doesn't allow loading of classes and xml files at the same time in the @ContextConfiguration annotation.</p>
  
  <p>When I try to run the test I still get the following error:
  java.lang.IllegalStateException: springSecurityFilterChain cannot be null.</p>
  
  <p>PS: The used springframework version is 4.1.3 and the spring-security version is 4.0.4.</p>