Mailing-List: contact users-help@cxf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@cxf.apache.org
Received-SPF: pass (athena.apache.org: local policy includes SPF record at
 spf.trusted-forwarder.org)
Message-ID: <525978E8.2@spudsoft.co.uk>
Date: Sat, 12 Oct 2013 17:29:28 +0100
From: Jim Talbut <jtalbut@spudsoft.co.uk>
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64;
 rv:17.0) Gecko/20130801 Thunderbird/17.0.8
MIME-Version: 1.0
To: users@cxf.apache.org
Subject: How to use JUnit to test CXF JAX-RS methods protected by
 Spring-Security
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hi,

I want to use Spring-Security to protect a bunch of JAX-RS endpoints in 
a couple of different (independent) applications.
One of the applications will start off using basic auth and will 
probably never progress beyond that, so I could use CXF interceptors to 
handle the auth.
The other application will use CAS, and I'm not aware of any CXF 
interceptors that handle that.
Hence the desire to use Spring-Security.

My problem is that I want to be able to have maven run integration tests 
that validate the method level security on each build (and preferably in 
the same test cases that test other aspects of the REST interface).

Previously I have just carried out my testing by having CXF construct a 
localhost endpoint, but this means that spring knows nothing about the 
network side of the tests and thus spring-security isn't used.

Is it possible to introduce the Spring-Security filters into the jetty 
instance created by CXF?
If not, is it possible to have a Spring JUnit testcase created as a 
(real, not mock) servlet container so that CXF can use a relative address?
Another thought was to find a way to have the CXF WebClient use a Spring 
mock endpoint, but I have even less idea about how to do that.

Any ideas?

Thanks

Jim