title: Spring @WithMockUser and request.IsUserInRole()
body: <p>I am using:</p>
  
  <pre><code>request.IsUserInRole("ADMIN")
  </code></pre>
  
  <p>in one of my controllers to determine the response to the request. I tried to mock the request in my test like:</p>
  
  <pre><code>@Mock
  private HttpServletRequest httpRequest;
  </code></pre>
  
  <p>and to use Springs annotation <code>@WithMockUser</code>:</p>
  
  <pre><code>@Test
  @WithMockUser(roles={"USER, ADMIN"})
  public void getAccountsTest() throws Exception {...}
  </code></pre>
  
  <p>Both didn't work.</p>
  
  <p>Question 1: How can I mock <code>request.IsUserInRole("ADMIN")</code> in a JUnit test?</p>
  
  <p>Question 2: What influence does <code>@WithMockUser</code> have on the request and <code>request.IsUserInRole("ADMIN")</code>?</p>
  
  <p>Thanks and best regards</p>
  
  <p>---- edit ----</p>
  
  <p>"Didn't work" means I have a test method:</p>
  
  <pre><code>@Test
  @WithMockUser(username = "user", roles={"USER"})
  public void getAccountsReturnForbiddenTest() throws Exception {
      mockMvc.perform(get("/accounts/"))
          .andExpect(status().isForbidden());
  }
  </code></pre>
  
  <p>which should return 403, not allowed because of the controller:</p>
  
  <pre><code>@RequestMapping(method=RequestMethod.GET)
  @PreAuthorize("hasRole('ADMIN')")
  public ResponseEntity&lt;PagedResources&lt;AccountResource&gt;&gt; getAccounts(...){...}
  </code></pre>
  
  <p>But the request returns 200, OK.</p>
  
  <p>And I am using Spring Boot 1.4.1.</p>
  
  <p>---- edit 2 ----</p>
  
  <p>My JUnit Test-class:</p>
  
  <pre><code>@Transactional
  @ContextConfiguration
  public class AccountControllerTestDoc extends AbstractControllerTest {
  
      @InjectMocks
      private AccountController accountController;
  
      @Mock
      private AccountService accountService;
  
      private String uriBase = ""; 
  
      @Before
      public void setup() {
          // Initialize Mockito annotated components
          MockitoAnnotations.initMocks(this);
          // Prepare the Spring MVC Mock components for standalone testing
          setup(accountController);
      }
  
      @Test
      @WithMockUser(username = "user", roles={"USER"})
      public void getAccountsReturnForbiddenTest() throws Exception {
          String uri = uriBase + "/accounts";
          mockMvc.perform(get(uri))
              .andExpect(status().isForbidden());
      }
  
  }
  </code></pre>
  
  <p>with AbstractControllerTest:</p>
  
  <pre><code>@WebAppConfiguration
  public abstract class AbstractControllerTest extends AbstractTest  {
  
      protected MockMvc mockMvc;
  
      @Autowired
      protected WebApplicationContext wac;
  
      protected void setup() {
          mockMvc = MockMvcBuilders.webAppContextSetup(wac).build();
      }
  
      protected void setup(BaseController controller) {
          mockMvc = MockMvcBuilders.standaloneSetup(controller))
                  .build();
      }
  }
  </code></pre>
  
  <p>and AbstractTest:</p>
  
  <pre><code>@RunWith(SpringJUnit4ClassRunner.class)
  @SpringBootTest
  public abstract class AbstractTest {
  
      protected Logger LOG = LoggerFactory.getLogger(this.getClass());
  
  }
  </code></pre>
  
  <p>---- solution ----</p>
  
  <p><code>MockMvc</code> <code>standaloneSetup</code> isn't aware of the web application context and therefore not aware of the security filter chain. One has to setup <code>MockMvc</code> with the web application context and the security filter chain to be able to test security aspects.</p>
  
  <p>Here is my now working solution, I edited the AbstractControllerTest:</p>
  
  <pre><code>@WebAppConfiguration
  public abstract class AbstractControllerTest extends AbstractTest  {
  
      protected MockMvc mockMvc;
  
      @Autowired
      protected WebApplicationContext wac;
  
      @Autowired
      FilterChainProxy springSecurityFilterChain;
  
      protected void setup() {
          mockMvc = MockMvcBuilders
              .webAppContextSetup(wac)
              .addFilters(springSecurityFilterChain)
              .build();
      }
  
      protected void setup(BaseController controller) {
          mockMvc = MockMvcBuilders.standaloneSetup(controller))
                  .build();
      }
  }
  </code></pre>