AspNetCore.Testing.Authentication.ClaimInjector

Excercising claim based logic using Microsoft.AspNetCore.Mvc.Testing is now as simple as:

    [Fact]
    public async Task RoleCustomizationWorksTest()
    {
        this._factory.RoleConfig.Roles = new[] {"Reader"};

        var client = _factory.CreateClient();

        var response = await client.GetAsync("api/Values/RequireRoleReader");

        response.EnsureSuccessStatusCode();
    }

    [Fact]
    public async Task NoAuthorizationHeaderReturnsUnauthorizedTest()
    {
        this._factory.RoleConfig.AnonymousRequest = true;

        var client = _factory.CreateClient();

        var response = await client.GetAsync("api/Values/AllowAuthorized");

        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }


    private readonly CustomRoleWebApplicationFactory<Startup> _factory;

    public UnitTests(CustomRoleWebApplicationFactory<Startup> factory)
    {
        this._factory = factory;
        this._factory.RoleConfig.Reset();
    }

For more examples see the unit tests here.

After learning about this great new library Microsoft.AspNetCore.Mvc.Testing I was excited to try it. Then I found out it has little to little to no built in support for testing controllers with Role based Authorization.

• How to create authenticated request?
• add Integration Testing chapter for the Contoso University example code
• Create sample for Integration testing with user claims.
• Document how to replace the Authentication/Identity related middlewares in the integration tests
• How to test Web API with Jwt Bearer Authentication

But there are workarounds (they all stink):

• make controllers anonymous for integration testing
• using integrated windows auth
• host a separate identity server

None of these are both simple and allow for exercising the role based logic without a ton of complexity. This solution solves that.