Problem with @WebMvcTest upgrading to Spring Boot 3.2

[wimdeblauwe]

I have a working Spring Boot 3.1 project that uses spring-addons-starter-oidc-test version 7.1.16 for my @WebMvcTest tests (Only using spring-addons for the testing part in this project). I use @AutoConfigureAddonsWebmvcResourceServerSecurity and @Import my own security configuration class. All this works, but if I change to Spring Boot 3.2 my test no longer starts. It fails with:

No qualifying bean of type 'org.springframework.core.convert.converter.Converter<org.springframework.security.oauth2.jwt.Jwt, org.springframework.security.authentication.AbstractAuthenticationToken>' available: expected single matching bean but found 2: defaultJwtAuthenticationConverter,jwtAuthenticationConverter

My security config class looks similar to this:

@Configuration
@EnableMethodSecurity
public class WebSecurityConfiguration {

@Bean
SecurityFilterChain apiFilterChain(@Qualifier("defaultJwtAuthenticationConverter") JwtAuthenticationConverter jwtAuthenticationConverter) { ...}

@Bean
  @Qualifier("defaultJwtAuthenticationConverter")
  public JwtAuthenticationConverter defaultJwtAuthenticationConverter() {
    JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
    converter.setJwtGrantedAuthoritiesConverter(jwt -> {
      Map<String, Object> realmAccess = jwt.getClaimAsMap("realm_access");
      if (realmAccess != null) {
        @SuppressWarnings("unchecked")
        List<String> roles = (List<String>) realmAccess.get("roles");
        if (roles != null) {
          return roles.stream()
              .map(rn -> new SimpleGrantedAuthority("ROLE_" + rn))
              .collect(Collectors.toList());
        }
      }
      return Collections.emptyList();
    });
    return converter;
  }

Things I tried:

• Updated to spring-addons-starter-oidc-test version 7.3.6: No difference, using Spring Boot 3.1 works, 3.2 fails.
• I tried removing the @Qualifier so my converter is also named jwtAuthenticationConverter. This fails both with 3.1 and 3.2 with this exception:

The bean 'jwtAuthenticationConverter', defined in class path resource [com/c4_soft/springaddons/security/oidc/starter/synchronised/SpringAddonsOidcBeans.class], could not be registered. A bean with that name has already been defined in class path resource [com/company/core/infrastructure/security/WebSecurityConfiguration.class] and overriding is disabled.

Are there any other things I can try?

[ch4mpy]

First, good job! you are exposing the authentication converter as a bean, which is now a requirement to use @WithJwt and @WithMockJwtAuth.

Do you really intend to use several JWT authentication converters?

If not, you have several options. But if yes, then you are in a case I did not anticipate (and for which I have to think of a solution).

Hopefully, there is a very high probability that you are using only one authentication converter and what you can do depends on your dependencies.

If using spring-addons-starter-oidc

• remove the @Qualifier("defaultJwtAuthenticationConverter"). spring-addons will back-off and your bean will be the only one in the application context
• change @Qualifier("defaultJwtAuthenticationConverter") for @Qualifier("jwtAuthenticationConverter"), same as above, spring-addons default jwtAuthenticationConverter bean won't be registered
• completely remove your defaultJwtAuthenticationConverter. From what I can see in your implementation, you are doing the same as the default authentication converter with the following conf:

com:
  c4-soft:
    springaddons:
      oidc:
        ops:
        - iss: ${issuer}
          authorities:
          - path: $.realm_access.roles
            prefix: ROLE_

If not using spring-addons-starter-oidc

You should depend on spring-addons-oauth2-test, not of spring-addons-starter-oidc-test.

Also, you should not use @AutoConfigureAddons* which, as per its name, brings spring-addons auto-configuration in the test context. Importing your security conf should be enough.

For more details, you may refer to this Baeldung article and to the samples in its Github companion Repo.

[wimdeblauwe]

I indeed only want to use a single authentication converter. I have now changed to depend on spring-addons-oauth2-test and removed the use of @AutoConfigureAddonsWebmvcResourceServerSecurity (it is not even on the classpath anymore now). But when I run my test, I get this now:

Method apiFilterChain in com.company.core.infrastructure.security.WebSecurityConfiguration required a bean of type 'org.springframework.security.oauth2.jwt.JwtDecoder' that could not be found.

I don't have any JwtDecoder parameter in my WebSecurityConfiguration.

[ch4mpy]

You actually have a JwtDecoder bean auto-configured by spring-boot-starter-oauth2-resource-server when you put oauth2ResourceServer(resourceServer -> resourceServer.jwt(...)) in your security filter-chain .

Just @MockBean JwtDecoder jwtDecoder; in your tests.

[wimdeblauwe]

Thanks for confirming mocking the JwtDecoder is the way to go here. I also had to mock ClientRegistrationRepository:

Adding this:

@MockBean({JwtDecoder.class, ClientRegistrationRepository.class})

Makes my tests now ok again.