Consider Adding Testing Support for Building Authentications

SecurityMockMvcRequestPostProcessors is a class that simplifies creating RequestPostProcessors for the purposes of testing. In large part, each RequestPostProcessor is responsible for creating an Authentication and populating the SecurityContextHolder.

The builders that SecurityMockMvcRequestPostProcessors exposes are actually quite convenient to use since they provide reasonable testing defaults. For example, oidcLogin() simplifies creating an OAuth2AuthenticationToken by defaulting certain claims and authorities:

RequestPostProcessor requestPostProcessor = oidcLogin().idToken(id -> id
        .subject("test-subject"));
this.mvc.perform(get("/").with(requestPostProcessor));

As noted in a related ticket, these builders are designed to support MockMvc testing; however, since many of them are largely responsible for creating an Authentication, such behavior could reasonably be extracted out into a separate class:

public final class TestAuthentications {
    public static OidcLoginAuthenticationBuilder oidcLogin() {
        return new OidcLoginAuthenticationBuilder();
    }

    // ...

    public static class OidcLoginAuthenticationBuilder {
        // ... similar support as OidcLoginRequestPostProcessor

        public Authentication build() {
            return new OAuth2AuthenticationToken(...);
        }
    }
}

By doing so, testers could easily build the appropriate Authentication for service-level testing, where MockMvc is not being used:

@Test 
public void testMyService() {
    Authentication authentication = oidcLogin().idToken(id -> id
            .subject("test-subject")).build();
    SecurityContextHolder.getContext().setAuthentication(authentication);

    // ... rest of test
}

The nice thing about this is that exposing a builder is a great deal more powerful than Spring Security's annotation support that's used in simpler authentication scenarios.

Start by reading SecurityMockMvcRequestPostProcessors and the related ticket #8459 comment. Compare the existing authentication-building behavior with the proposed TestAuthentications API and determine which builders need service-level support. Done means the scope and API for building Authentication independently of MockMvc are defined and covered by appropriate tests.