Trying to disable Keycloak and Spring Security with WebMvc test - spring

Question

I have a springboot application using spring security and keycloak. when executing the application, securing with jwt tokens works as expected.
then i have a seperate test application.yml where i try to disable keycloak, as found in tutorials in the web.
for webmvc tests, this does not work as expected. although i try to disable everything security and keycloak related, still KeycloakWebSecurityConfigurerAdapter tries to use the KeycloakConfigResolver class, not finding it.
it then falls back to load the keycloak.json file and fails.
what do i have to make MockMvc tests work? i just want to have every request permitted as implemented in the configure HttpSecurity method. keycloak basically shouldnt be used for mockmvc tests.
pom:
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.7.4-SNAPSHOT</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
[...]
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.keycloak</groupId>
<artifactId>keycloak-spring-boot-starter</artifactId>
<version>19.0.2</version>
</dependency>
Config:
keycloak:
enabled: false
realm: mock
resource: mock
auth-server-url: http://mock
bearer-only: true
credentials:
secret: mock
spring:
autoconfigure:
exclude: org.keycloak.adapters.springboot.KeycloakAutoConfiguration
Keycloak Bean Configuration:
#Configuration
#EnableWebSecurity
#ConditionalOnProperty(name = ["keycloak.enabled"], havingValue = "false", matchIfMissing = false)
class KeycloakDisabledConfig: KeycloakWebSecurityConfigurerAdapter(){
override fun configure(http: HttpSecurity) {
http.csrf()
.disable()
.authorizeRequests()
.anyRequest()
.permitAll()
}
override fun configure(web: WebSecurity) {
web.ignoring().antMatchers("/**")
}
override fun sessionAuthenticationStrategy(): SessionAuthenticationStrategy = RegisterSessionAuthenticationStrategy(
SessionRegistryImpl()
)
Test:
#WebMvcTest(value = [OrganizationController::class], excludeAutoConfiguration = [SecurityAutoConfiguration::class])
#AutoConfigureMockMvc(addFilters = false)
#Import(value = [
OrganizationMapper::class
])
internal class OrganizationControllerTest{
#Autowired
lateinit var mockmvc: MockMvc
loaded context:
Positive matches:
-----------------
ErrorMvcAutoConfiguration matched:
- #ConditionalOnClass found required classes 'javax.servlet.Servlet', 'org.springframework.web.servlet.DispatcherServlet' (OnClassCondition)
- found 'session' scope (OnWebApplicationCondition)
ErrorMvcAutoConfiguration#basicErrorController matched:
- #ConditionalOnMissingBean (types: org.springframework.boot.web.servlet.error.ErrorController; SearchStrategy: current) did not find any beans (OnBeanCondition)
ErrorMvcAutoConfiguration#errorAttributes matched:
- #ConditionalOnMissingBean (types: org.springframework.boot.web.servlet.error.ErrorAttributes; SearchStrategy: current) did not find any beans (OnBeanCondition)
ErrorMvcAutoConfiguration.WhitelabelErrorViewConfiguration matched:
- #ConditionalOnProperty (server.error.whitelabel.enabled) matched (OnPropertyCondition)
- ErrorTemplate Missing did not find error template view (ErrorMvcAutoConfiguration.ErrorTemplateMissingCondition)
ErrorMvcAutoConfiguration.WhitelabelErrorViewConfiguration#beanNameViewResolver matched:
- #ConditionalOnMissingBean (types: org.springframework.web.servlet.view.BeanNameViewResolver; SearchStrategy: all) did not find any beans (OnBeanCondition)
ErrorMvcAutoConfiguration.WhitelabelErrorViewConfiguration#defaultErrorView matched:
- #ConditionalOnMissingBean (names: error; SearchStrategy: all) did not find any beans (OnBeanCondition)
GsonAutoConfiguration matched:
- #ConditionalOnClass found required class 'com.google.gson.Gson' (OnClassCondition)
GsonAutoConfiguration#gson matched:
- #ConditionalOnMissingBean (types: com.google.gson.Gson; SearchStrategy: all) did not find any beans (OnBeanCondition)
GsonAutoConfiguration#gsonBuilder matched:
- #ConditionalOnMissingBean (types: com.google.gson.GsonBuilder; SearchStrategy: all) did not find any beans (OnBeanCondition)
GsonHttpMessageConvertersConfiguration matched:
- #ConditionalOnClass found required class 'com.google.gson.Gson' (OnClassCondition)
HttpEncodingAutoConfiguration matched:
- #ConditionalOnClass found required class 'org.springframework.web.filter.CharacterEncodingFilter' (OnClassCondition)
- found 'session' scope (OnWebApplicationCondition)
- #ConditionalOnProperty (server.servlet.encoding.enabled) matched (OnPropertyCondition)
HttpEncodingAutoConfiguration#characterEncodingFilter matched:
- #ConditionalOnMissingBean (types: org.springframework.web.filter.CharacterEncodingFilter; SearchStrategy: all) did not find any beans (OnBeanCondition)
HttpMessageConvertersAutoConfiguration matched:
- #ConditionalOnClass found required class 'org.springframework.http.converter.HttpMessageConverter' (OnClassCondition)
- NoneNestedConditions 0 matched 1 did not; NestedCondition on HttpMessageConvertersAutoConfiguration.NotReactiveWebApplicationCondition.ReactiveWebApplication did not find reactive web application classes (HttpMessageConvertersAutoConfiguration.NotReactiveWebApplicationCondition)
HttpMessageConvertersAutoConfiguration#messageConverters matched:
- #ConditionalOnMissingBean (types: org.springframework.boot.autoconfigure.http.HttpMessageConverters; SearchStrategy: all) did not find any beans (OnBeanCondition)
HttpMessageConvertersAutoConfiguration.StringHttpMessageConverterConfiguration matched:
- #ConditionalOnClass found required class 'org.springframework.http.converter.StringHttpMessageConverter' (OnClassCondition)
HttpMessageConvertersAutoConfiguration.StringHttpMessageConverterConfiguration#stringHttpMessageConverter matched:
- #ConditionalOnMissingBean (types: org.springframework.http.converter.StringHttpMessageConverter; SearchStrategy: all) did not find any beans (OnBeanCondition)
JacksonAutoConfiguration matched:
- #ConditionalOnClass found required class 'com.fasterxml.jackson.databind.ObjectMapper' (OnClassCondition)
JacksonAutoConfiguration.Jackson2ObjectMapperBuilderCustomizerConfiguration matched:
- #ConditionalOnClass found required class 'org.springframework.http.converter.json.Jackson2ObjectMapperBuilder' (OnClassCondition)
JacksonAutoConfiguration.JacksonObjectMapperBuilderConfiguration matched:
- #ConditionalOnClass found required class 'org.springframework.http.converter.json.Jackson2ObjectMapperBuilder' (OnClassCondition)
JacksonAutoConfiguration.JacksonObjectMapperBuilderConfiguration#jacksonObjectMapperBuilder matched:
- #ConditionalOnMissingBean (types: org.springframework.http.converter.json.Jackson2ObjectMapperBuilder; SearchStrategy: all) did not find any beans (OnBeanCondition)
JacksonAutoConfiguration.JacksonObjectMapperConfiguration matched:
- #ConditionalOnClass found required class 'org.springframework.http.converter.json.Jackson2ObjectMapperBuilder' (OnClassCondition)
JacksonAutoConfiguration.JacksonObjectMapperConfiguration#jacksonObjectMapper matched:
- #ConditionalOnMissingBean (types: com.fasterxml.jackson.databind.ObjectMapper; SearchStrategy: all) did not find any beans (OnBeanCondition)
JacksonAutoConfiguration.ParameterNamesModuleConfiguration matched:
- #ConditionalOnClass found required class 'com.fasterxml.jackson.module.paramnames.ParameterNamesModule' (OnClassCondition)
JacksonAutoConfiguration.ParameterNamesModuleConfiguration#parameterNamesModule matched:
- #ConditionalOnMissingBean (types: com.fasterxml.jackson.module.paramnames.ParameterNamesModule; SearchStrategy: all) did not find any beans (OnBeanCondition)
JacksonHttpMessageConvertersConfiguration.MappingJackson2HttpMessageConverterConfiguration matched:
- #ConditionalOnClass found required class 'com.fasterxml.jackson.databind.ObjectMapper' (OnClassCondition)
- #ConditionalOnProperty (spring.mvc.converters.preferred-json-mapper=jackson) matched (OnPropertyCondition)
- #ConditionalOnBean (types: com.fasterxml.jackson.databind.ObjectMapper; SearchStrategy: all) found bean 'jacksonObjectMapper' (OnBeanCondition)
JacksonHttpMessageConvertersConfiguration.MappingJackson2HttpMessageConverterConfiguration#mappingJackson2HttpMessageConverter matched:
- #ConditionalOnMissingBean (types: org.springframework.http.converter.json.MappingJackson2HttpMessageConverter ignored: org.springframework.hateoas.server.mvc.TypeConstrainedMappingJackson2HttpMessageConverter,org.springframework.data.rest.webmvc.alps.AlpsJsonHttpMessageConverter; SearchStrategy: all) did not find any beans (OnBeanCondition)
KeycloakDisabledConfig matched:
- #ConditionalOnProperty (keycloak.enabled=false) matched (OnPropertyCondition)
MockMvcAutoConfiguration matched:
- found 'session' scope (OnWebApplicationCondition)
MockMvcAutoConfiguration#dispatcherServlet matched:
- #ConditionalOnMissingBean (types: org.springframework.web.servlet.DispatcherServlet; SearchStrategy: all) did not find any beans (OnBeanCondition)
MockMvcAutoConfiguration#dispatcherServletPath matched:
- #ConditionalOnMissingBean (types: org.springframework.boot.autoconfigure.web.servlet.DispatcherServletPath; SearchStrategy: all) did not find any beans (OnBeanCondition)
MockMvcAutoConfiguration#mockMvc matched:
- #ConditionalOnMissingBean (types: org.springframework.test.web.servlet.MockMvc; SearchStrategy: all) did not find any beans (OnBeanCondition)
MockMvcAutoConfiguration#mockMvcBuilder matched:
- #ConditionalOnMissingBean (types: org.springframework.test.web.servlet.MockMvcBuilder; SearchStrategy: all) did not find any beans (OnBeanCondition)
NoOpCacheConfiguration matched:
- Cache org.springframework.boot.autoconfigure.cache.NoOpCacheConfiguration NONE cache type (CacheCondition)
SecurityFilterAutoConfiguration matched:
- #ConditionalOnClass found required classes 'org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer', 'org.springframework.security.config.http.SessionCreationPolicy' (OnClassCondition)
- found 'session' scope (OnWebApplicationCondition)
SecurityFilterAutoConfiguration#securityFilterChainRegistration matched:
- #ConditionalOnBean (names: springSecurityFilterChain; SearchStrategy: all) found bean 'springSecurityFilterChain' (OnBeanCondition)
SpringDataWebAutoConfiguration matched:
- #ConditionalOnClass found required classes 'org.springframework.data.web.PageableHandlerMethodArgumentResolver', 'org.springframework.web.servlet.config.annotation.WebMvcConfigurer' (OnClassCondition)
- found 'session' scope (OnWebApplicationCondition)
- #ConditionalOnMissingBean (types: org.springframework.data.web.PageableHandlerMethodArgumentResolver; SearchStrategy: all) did not find any beans (OnBeanCondition)
SpringDataWebAutoConfiguration#pageableCustomizer matched:
- #ConditionalOnMissingBean (types: org.springframework.data.web.config.PageableHandlerMethodArgumentResolverCustomizer; SearchStrategy: all) did not find any beans (OnBeanCondition)
SpringDataWebAutoConfiguration#sortCustomizer matched:
- #ConditionalOnMissingBean (types: org.springframework.data.web.config.SortHandlerMethodArgumentResolverCustomizer; SearchStrategy: all) did not find any beans (OnBeanCondition)
TaskExecutionAutoConfiguration matched:
- #ConditionalOnClass found required class 'org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor' (OnClassCondition)
TaskExecutionAutoConfiguration#applicationTaskExecutor matched:
- #ConditionalOnMissingBean (types: java.util.concurrent.Executor; SearchStrategy: all) did not find any beans (OnBeanCondition)
TaskExecutionAutoConfiguration#taskExecutorBuilder matched:
- #ConditionalOnMissingBean (types: org.springframework.boot.task.TaskExecutorBuilder; SearchStrategy: all) did not find any beans (OnBeanCondition)
UserDetailsServiceAutoConfiguration matched:
- #ConditionalOnClass found required class 'org.springframework.security.authentication.AuthenticationManager' (OnClassCondition)
- #ConditionalOnBean (types: org.springframework.security.config.annotation.ObjectPostProcessor; SearchStrategy: all) found bean 'objectPostProcessor'; #ConditionalOnMissingBean (types: org.springframework.security.authentication.AuthenticationManager,org.springframework.security.authentication.AuthenticationProvider,org.springframework.security.core.userdetails.UserDetailsService,org.springframework.security.authentication.AuthenticationManagerResolver,org.springframework.security.oauth2.jwt.JwtDecoder,org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector,org.springframework.security.oauth2.client.registration.ClientRegistrationRepository,org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository; SearchStrategy: all) did not find any beans (OnBeanCondition)
ValidationAutoConfiguration matched:
- #ConditionalOnClass found required class 'javax.validation.executable.ExecutableValidator' (OnClassCondition)
- #ConditionalOnResource found location classpath:META-INF/services/javax.validation.spi.ValidationProvider (OnResourceCondition)
ValidationAutoConfiguration#defaultValidator matched:
- #ConditionalOnMissingBean (types: javax.validation.Validator; SearchStrategy: all) did not find any beans (OnBeanCondition)
ValidationAutoConfiguration#methodValidationPostProcessor matched:
- #ConditionalOnMissingBean (types: org.springframework.validation.beanvalidation.MethodValidationPostProcessor; SearchStrategy: current) did not find any beans (OnBeanCondition)
WebMvcAutoConfiguration matched:
- #ConditionalOnClass found required classes 'javax.servlet.Servlet', 'org.springframework.web.servlet.DispatcherServlet', 'org.springframework.web.servlet.config.annotation.WebMvcConfigurer' (OnClassCondition)
- found 'session' scope (OnWebApplicationCondition)
- #ConditionalOnMissingBean (types: org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport; SearchStrategy: all) did not find any beans (OnBeanCondition)
WebMvcAutoConfiguration#formContentFilter matched:
- #ConditionalOnProperty (spring.mvc.formcontent.filter.enabled) matched (OnPropertyCondition)
- #ConditionalOnMissingBean (types: org.springframework.web.filter.FormContentFilter; SearchStrategy: all) did not find any beans (OnBeanCondition)
WebMvcAutoConfiguration.EnableWebMvcConfiguration#flashMapManager matched:
- #ConditionalOnMissingBean (names: flashMapManager; SearchStrategy: all) did not find any beans (OnBeanCondition)
WebMvcAutoConfiguration.EnableWebMvcConfiguration#localeResolver matched:
- #ConditionalOnMissingBean (names: localeResolver; SearchStrategy: all) did not find any beans (OnBeanCondition)
WebMvcAutoConfiguration.EnableWebMvcConfiguration#themeResolver matched:
- #ConditionalOnMissingBean (names: themeResolver; SearchStrategy: all) did not find any beans (OnBeanCondition)
WebMvcAutoConfiguration.WebMvcAutoConfigurationAdapter#defaultViewResolver matched:
- #ConditionalOnMissingBean (types: org.springframework.web.servlet.view.InternalResourceViewResolver; SearchStrategy: all) did not find any beans (OnBeanCondition)
WebMvcAutoConfiguration.WebMvcAutoConfigurationAdapter#requestContextFilter matched:
- #ConditionalOnMissingBean (types: org.springframework.web.context.request.RequestContextListener,org.springframework.web.filter.RequestContextFilter; SearchStrategy: all) did not find any beans (OnBeanCondition)
WebMvcAutoConfiguration.WebMvcAutoConfigurationAdapter#viewResolver matched:
- #ConditionalOnBean (types: org.springframework.web.servlet.ViewResolver; SearchStrategy: all) found beans 'defaultViewResolver', 'beanNameViewResolver', 'mvcViewResolver'; #ConditionalOnMissingBean (names: viewResolver types: org.springframework.web.servlet.view.ContentNegotiatingViewResolver; SearchStrategy: all) did not find any beans (OnBeanCondition)
Stacktrace:
Caused by: java.io.FileNotFoundException: Unable to locate Keycloak configuration file: keycloak.json
at org.keycloak.adapters.springsecurity.AdapterDeploymentContextFactoryBean.loadKeycloakDeployment(AdapterDeploymentContextFactoryBean.java:83) ~[keycloak-spring-security-adapter-19.0.1.jar:19.0.1]
at org.keycloak.adapters.springsecurity.AdapterDeploymentContextFactoryBean.afterPropertiesSet(AdapterDeploymentContextFactoryBean.java:76) ~[keycloak-spring-security-adapter-19.0.1.jar:19.0.1]
at org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter.adapterDeploymentContext(KeycloakWebSecurityConfigurerAdapter.java:72) ~[keycloak-spring-security-adapter-19.0.1.jar:19.0.1]
at com.jschausberger.demo.keycloak.KeycloakDisabledConfig$$EnhancerBySpringCGLIB$$ef3c2204.CGLIB$adapterDeploymentContext$13(<generated>) ~[classes/:na]
at com.jschausberger.demo.keycloak.KeycloakDisabledConfig$$EnhancerBySpringCGLIB$$ef3c2204$$FastClassBySpringCGLIB$$3c55188.invoke(<generated>) ~[classes/:na]
at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:244) ~[spring-core-5.3.23.jar:5.3.23]
at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:331) ~[spring-context-5.3.23.jar:5.3.23]
at com.jschausberger.demo.keycloak.KeycloakDisabledConfig$$EnhancerBySpringCGLIB$$ef3c2204.adapterDeploymentContext(<generated>) ~[classes/:na]
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:na]
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[na:na]
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:na]
at java.base/java.lang.reflect.Method.invoke(Method.java:568) ~[na:na]
at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:154) ~[spring-beans-5.3.23.jar:5.3.23]
... 91 common frames omitted

Answer 1

First, do not use Keycloak adapter for Spring (keycloak-spring-boot-starter). It is very deprecated and not compatible with spring-boot 3 (RC1 this week, release in November). Use spring-boot-starter-oauth2-resource-server instead. Article here, more tutorials there.
Second, do not disable security in your unit-test. Use mocked authentication and use it to unit-test your security rules. You might refer to article and tutorials linked above to figure out how.