Disable @PreAuthorize annotation when running a profile

I have written API functional test cases for Spring boot Application using cucumber test framework. The tests are executed after starting the spring boot application in a profile with dedicated configurations for test cases, using the following command:

mvn spring-boot:start -Dspring-boot.run.profiles=test -Dspring-boot.run.arguments="--spring.config.name=application-test --spring.config.location=./src/test/resources/application-test.yaml" test spring-boot:stop -DskipTests=false

The API call is made from test cases once the spring application is started and the responses are validated in the tests.

I have disabled the security in test cases using the custom WebSecurityConfigurerAdapter given below:

@TestConfiguration
@Order(1)
@Profile("test")
public class TestSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                .authorizeRequests()
                .anyRequest()
                .permitAll();
    }

}

The security is disabled. But there are some controllers where the role is checked with @PreAuthorize annotation. The calls made to the controller with @PreAuthorize annotation is failed with the following error:

{
    "timestamp": 1689838624242,
    "errorType": "UNKNOWN",
    "errors": [
        "Access is denied"
    ]
}

Tried several options to disabled to PreAuthorize field to specific profile but none of them worked. Appreciate any idea on how to disable the @PreAuthorize check for a selected profile or in test cases with Cucumber.

The options already tried:

1. set @EnableGlobalMethodSecurity(prePostEnabled = true) in test. It didn't work
2. Referred to this SO answer. My spring boot application is secured with Oauth2, which I disabled in tests. so sending basic auth credentials will not work.

Setup test security context in a @Given step instead of disabling security.

Sample taken from this README I wrote (at a time Keycloak adapters for Spring where not deprecated):

Gherkin feature:

Feature: Testing a secured REST API
Users should be able to GET greetings only if authenticated
Scenario: Authorized users should be greeted
Given the following user roles:
| ROLE_user   |
| ROLE_TESTER |
When a get request is sent to greeting endpoint
Then a greeting is returned
Scenario: Unauthorized users should not be able to access greetings
Given user is not authenticated
When a get request is sent to greeting endpoint
Then 401 is returned

The following uses some code from com.c4-soft.springaddons:spring-addons-oauth2-test, a lib of mine published on maven-central, to ease defining OpenID claims. You can skip this dependency if you are not interested in claims details (if authorities and user name are enough):

public class JwtTestingBuilder {
	protected final OpenidClaimSetBuilder claimsBuilder;
	private final Set<String> authorities;
	private String bearerString = "machin.truc.chose";
	private Map<String, Object> headers = new HashMap<>(Map.of("machin", "truc"));

	public JwtTestingBuilder() {
		this.claimsBuilder = new OpenidClaimSetBuilder().subject(Defaults.SUBJECT).name(Defaults.AUTH_NAME);
		this.authorities = new HashSet<>(Defaults.AUTHORITIES);
	}

	public JwtAuthenticationToken build() {
		final var claims = claimsBuilder.build();
		final var iat = Instant.now();
		final var exp = iat.plusMillis(60000);
		final var jwt = new Jwt(bearerString, iat, exp, headers, claims);
		return new JwtAuthenticationToken(jwt, authorities.stream().map(SimpleGrantedAuthority::new).collect(Collectors.toSet()), claims.getName());
	}

	public JwtTestingBuilder authorities(String... authorities) {
		return authorities(Stream.of(authorities));
	}

	public JwtTestingBuilder authorities(Stream<String> authorities) {
		this.authorities.clear();
		this.authorities.addAll(authorities.toList());
		return this;
	}

	public JwtTestingBuilder claims(Consumer<OpenidClaimSetBuilder> tokenBuilderConsumer) {
		tokenBuilderConsumer.accept(claimsBuilder);
		return this;
	}

	public JwtTestingBuilder bearerString(String bearerString) {
		this.bearerString = bearerString;
		return this;
	}
}

Steps:

public class GreetingControllerSuite {

	@Autowired
	MockMvc mockMvc;

	MvcResult result;

	@Given("user is not authenticated")
	public void unauthenticatedUser() {
		TestSecurityContextHolder.clearContext();
	}

	@Given("the following user roles:")
	public void authenticateAsUser(List<String> rolesTable) {
		TestSecurityContextHolder.clearContext();
		final Stream<String> roles = rolesTable.stream().map(String::trim);
		TestSecurityContextHolder.setAuthentication(new JwtTestingBuilder().authorities(roles).build());
	}

	@When("a get request is sent to greeting endpoint")
	public void getGreet() throws Exception {
		result = mockMvc.perform(get("/greet")).andReturn();
	}

	@Then("401 is returned")
	public void unauthorizedStatus() throws Exception {
		assertEquals(401, result.getResponse().getStatus());
	}

	@Then("a greeting is returned")
	public void greetingIsReturned() throws Exception {
		assertEquals(200, result.getResponse().getStatus());
		final var body = result.getResponse().getContentAsString();
		assertThat(body.contains("Hello user! You are granted with "));
		assertThat(body.contains("ROLE_user"));
		assertThat(body.contains("ROLE_TESTER"));
	}
}

Cucumber JUnit 4 adapter:

import org.junit.runner.RunWith;

import io.cucumber.junit.Cucumber;
import io.cucumber.junit.CucumberOptions;

@RunWith(Cucumber.class)
@CucumberOptions(features = "classpath:cucumber-features", plugin = {
		"pretty",
		"html:target/cucumber" }, extraGlue = "com.c4_soft.springaddons.samples.webmvc.cucumber.extraglue")
public class CucumberIntegrationTest {
}

Spring "extraglue":

package com.c4_soft.springaddons.samples.webmvc.cucumber.extraglue;

...

@CucumberContextConfiguration
@SpringBootTest(webEnvironment = WebEnvironment.MOCK)
@ContextConfiguration(classes = { SpringBootSampleApp.class })
@AutoConfigureMockMvc
public static class CucumberSpringConfiguration {
}

One of the solution is to use an Mock impl, the following annotation at the class level or method level:

@WithMockUser(username="admin",roles={"USER","ADMIN"})

For more details read it