java - Spring Boot testing with Spring Security. How does one launch an alternative security config? -

my spring boot application has application class. when run (as application), launches within embedded servlet container (tomcat, in case). somehow (through application's @annotations, suppose), websecurityconfig (extending websecurityconfigureradapter) in same package loaded.

websecurityconfig contains 2 important blocks of configuration information:

@configuration @order(securityproperties.access_override_order) @enableglobalmethodsecurity(prepostenabled = true) // enables method-level role-checking public class websecurityconfig extends websecurityconfigureradapter {      @autowired     public void configureglobal(authenticationmanagerbuilder auth) throws exception {       auth          .ldapauthentication()          .usersearchbase("cn=users,dc=some,dc=domain,dc=com")             .usersearchfilter("(samaccountname={0})")          .groupsearchbase("ou=groups,dc=some,dc=domain,dc=com")                           .groupsearchfilter("(member={0})")          .contextsource()             .managerdn("cn=ad-bind,cn=users,dc=some,dc=domain,dc=com")             .managerpassword("apassword!")              .url("ldaps://some.domain.com:636");     }      @override     protected void configure(httpsecurity http) throws exception {          system.out.println("***************** websecurityconfig.configure *************************");          http.csrf().disable();           http             .headers()                 .frameoptions()                     .disable();           http                 .authorizerequests()                     .antmatchers("/resources/images/*", "/me", "/products", "/product/**", "/offerings", "/offering/**", "/client/**")                             .permitall()                     .anyrequest().authenticated()                     .and()                     .formlogin()                     .loginpage("/login").defaultsuccessurl("/me")                     .permitall()                     .and()                     .logout()                     .permitall();           http.logout().logoutsuccessurl("/me");     } } 

configureglobal() contains configuration our internal ldap system , works fine.

configure() specifies urls public, shown logged-in users , relative urls send users log in.

now i'm integration testing , have written methods test controllers not require authentication. tests work expected. application class fires , tests execute against it.

but want test controller methods require authentication. way think accomplished telling test class fire alternative application class (testapplication, in case) , websecurityconfig creates dummy users:

@runwith(springjunit4classrunner.class) @springapplicationconfiguration(classes = testapplication.class) // fires testapplication.class instead of application.class @webappconfiguration public class productcontrollertests {     // test methods here, time username/password included }  @configuration @enableautoconfiguration public class testapplication extends springbootservletinitializer {      public static void main(string[] args) {         springapplication.run(applicationclass, args);     }      @override     protected springapplicationbuilder configure(springapplicationbuilder application) {         return application.sources(applicationclass);     }      private static class<testapplication> applicationclass = testapplication.class;  }  @configuration @order(securityproperties.access_override_order) @enableglobalmethodsecurity(prepostenabled = true) public class websecurityconfig extends websecurityconfigureradapter {      @autowired     public void configureglobal(authenticationmanagerbuilder auth) throws exception {       auth.inmemoryauthentication().withuser("testuser").password("userpass").roles("user");       auth.inmemoryauthentication().withuser("testadmin").password("adminpass").roles("admin");     }      @override     protected void configure(httpsecurity http) throws exception {          system.out.println("***************** websecurityconfig.configure *************************");          http.csrf().disable();           http             .headers()                 .frameoptions()                     .disable();           http                 .authorizerequests()                     .antmatchers("/resources/images/*", "/me", "/products", "/product/**", "/offerings", "/offering/**", "/client/**")                             .permitall()                     .anyrequest().authenticated()                     .and()                     .formlogin()                     .loginpage("/login").defaultsuccessurl("/me")                     .permitall()                     .and()                     .logout()                     .permitall();           http.logout().logoutsuccessurl("/me");     } } 

so question is: when execute unit test class, believe testapplication firing. however, not picking alternative websecurityconfig class , auth.inmemoryauthentication() test users. how force application use 1 websecurityconfig when running application normally, different websecurityconfig when running unit tests?

you can configure testapplication include beans test. in other words, make sure websecurityconfig not part of test configuration. if read javadoc of @springbootapplication notice composite annotation consists of (among others) @componentscan annotation. consequently application , testapplication perform recursive scan package in class located. spring reference docs has specific chapter using filters customize scanning.

alternatively, if using spring security version 4 or greater may find additions of @withmockuser , @withuserdetails interesting.