Sping Boot DefaultSecurityFilterChain configuration is different in test than in production - spring-boot

Question

We'd like to secure the HTTP endpoint metrics that is a built-in endpoint of Spring Boot. Therefore, we write own WebSecurityConfigurerAdapter, see below
#Configuration
#Order(95)
public class MetricsWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
#Value("${metrics.username}")
private String metricsUsername;
#Value("${metrics.password}")
private String metricsPassword;
#Autowired
private MyAuthenticationEntryPoint authenticationEntryPoint;
#Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication()
.withUser(metricsUsername).password("{noop}" + metricsPassword)
.roles("METRICS");
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable(); // disable csrf for our requests.
http
.antMatcher("/metrics") //
.httpBasic() //
.authenticationEntryPoint(authenticationEntryPoint) //
.and() //
.authorizeRequests() //
.antMatchers("/metrics").authenticated(); //
}
}
My Spring Boot test for testing the authentication is
#ExtendWith(SpringExtension.class)
#SpringBootTest
#TestPropertySource(locations = "classpath:test.properties")
#AutoConfigureMockMvc
public class MetricsEndpointTest {
#Autowired
private MockMvc mockMvc;
#Test
public void testGetMetricsForbidden() throws Exception {
mockMvc.perform(get("/metrics"))
.andExpect(status().isForbidden());
}
#Test
public void testGetMetrics() throws Exception {
mockMvc.perform(get("/metrics")
.header("Authorization", "Basic " + getBasicAuthentication("testmetricsuser", "testmetricspass")))
.andExpect(status().isOk());
}
private static String getBasicAuthentication(String user, String password) {
String token = user + ":" + password;
try {
return DatatypeConverter.printBase64Binary(token.getBytes("UTF-8"));
} catch (UnsupportedEncodingException ex) {
throw new IllegalStateException("Cannot encode with UTF-8", ex);
}
}
}
The test testGetMetricsForbidden fails.
When I debugged the class WebSecurity during the test run and in production, I can find following difference in the variable securityFilterChains :
In production:
In test:
The difference is that in production we have five security filter chains and in test six security filter chains. The sixth filter chain is responsible that the test fails because it matches at first. I think the #Order is the reason for the order in the test. My question is how can I disabled that sixth filter in my test.