Roles vs authorities in @WithMockKeycloackAuth

Hello, I have started using your utils and I am very happy with it. Thank you for sharing your code. I experience the following difficulty:

• In @WithMockKeycloackAuth all roles get prefixed with ROLE_. For my purpose this is unwanted behavior, since I would like pass authorities like true authorities w/o the ROLE_ part. The ROLE_ prefix is added in roles() method of KeycloakAuthenticationTokenTestingBuilder and I do not see away to suppress this behavior. The docs at the top of the WithMockKeycloackAuth class suggest that the ROLE_ prefix should be added manually (which is not the case). Also, the default OIDC fields "offline_access", "uma_authorization" seem incompatible with this approach.

 * Sample usage:
 *
 * <pre>
 * &#64;Test
 * &#64;WithMockKeycloackAuth({"ROLE_USER", "ROLE_ADMIN"})
 * public void test() {
 *     ...
 * }
 * </pre>

I see two solutions to this problem:

1. Remove automatic addition of the ROLE_ prefix. Roles passed are interpreted as-is.
2. The @WithMockKeycloackAuth handles an additional authorities parameter. Names passed in via this prop are added to the Auth object w/o the ROLE_ prefix.

I base the distinction between roles and authorizations on the Spring Security naming convention (see https://www.baeldung.com/spring-security-granted-authority-vs-role)

If needed I can do a proposal in a PR. Just let me know whether you have time to work on this.

[pvannierop]

That means that authorities should be like ‘offline_access’ in the JWT claims and ‘ROLE_offline_access’ in KeycloakAuthenticationToken granted-authorities.

Yeah, the behavior is correct. It was me that was not understanding it correctly. I am rather new to Spring Security so please excuse my ignorance. The renaming of roles to authorities helps to understand.

I propose to update the doc at the top of the @WithMockKeycloakUser class and remove the ROLE_ prefixes:

 * @WithMockKeycloakAuth({"ROLE_USER", "ROLE_ADMIN"})

becomes

 * @WithMockKeycloakAuth({"USER", "ADMIN"})

[pvannierop]

@ch4mpy Sure!