Testing Security Utilities

At some point in the development process, developers add security to their applications. Because this added security can present additional hurdles during focused testing, developers sometimes wait until relatively late in the development process to add the security. Other times, developers toggle between commented and uncommented security code. Either way, testing with security in place can be awkward or annoying.

EDennis.AspNetCore.Base provides two middleware classes that are designed to improve the testing experience when security is in place. AutoLoginMiddleware is provided to automatically build a user principal from a set of predefined users with configured claims. MockClientAuthorizationMiddleware is provided to automatically retrieve an access token (for an API) from an Identity Server instance, using a client from a set of predefined clients with configured claims. These middleware classes can be configured to work with different launch profiles for test users or clients with different claims.

AutoLoginMiddleware

AutoLoginMiddleware is ASP.NET Core middleware that builds a user principal with one or more claims. Each mock user is configured in appsettings.Development.json. Optionally, the developer can setup separate launch profiles for each mock user.

IConfiguration

The appsettings.Development.json file must contain an "AutoLogin" section in which one or more mock users are defined. Each user must have a "Claims" property, which holds an array of MockClaim objects (properties = Type, Value). If more than one mock user is defined and no AutoLogin launch settings are active, then the mock user having the property "Default" equal to true is selected.

Example

{
  "AutoLogin": {
    "alice": {
      "Default": true,
      "Claims": [
        {
          "Type": "role",
          "Value": "admin"
        }
      ]
    },
    "bob": {
      "Claims": [
        {
          "Type": "role",
          "Value": "readonly"
        }
      ]
    }
  },
  "Logging": {
    "LogLevel": {
      "Default": "Debug",
      "System": "Information",
      "Microsoft": "Information"
    }
  }
}

Startup.Configure

The current library has an IApplicationBuilder extension method named UseAutoLogin that registers the AutoLoginMiddleware in the application pipeline. The call to this method must be placed before the call to UseAuthentication in the Configure method of the application's Startup class.

Example

       public void Configure(IApplicationBuilder app, IHostingEnvironment env) {

            //...
            //some code omitted

            app.UseCookiePolicy();

            if (env.IsDevelopment()) {
                app.UseAutoLogin();
            }

            app.UseAuthentication();

            app.UseMvc();
        }

Optional Launch Profile Configuration

Often, an application will have multiple user roles. To facilitate testing of these roles, the current library supports configuration of AutoLogin users as separate launch profiles in launchSettings.json. The launch profile configuration requires the inclusion of a commandLineArgs property, where the argument AutoLogin is set to the name of one of the mock users defined in appsettings.Development.json.

Example

  "profiles": {
    "AutoLogin=bob": {
      "commandName": "Project",
      "launchBrowser": true,
      "commandLineArgs": "AutoLogin=bob",
      "applicationUrl": "http://localhost:5000",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      }
    },
    "AutoLogin=alice": {
      "commandName": "Project",
      "launchBrowser": true,
      "commandLineArgs": "AutoLogin=alice",
      "applicationUrl": "http://localhost:5000",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      }
    },
    "IIS Express": {
      "commandName": "IISExpress",
      "launchBrowser": true,
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      }
    }
  }
}

MockClientAuthorizationMiddleware

MockClientAuthorizationMiddleware is ASP.NET Core middleware that requests an access token from an Identity Server for a particular client and a specific scope (or set of scopes). Each mock client is configured in appsettings.Development.json. Optionally, the developer can setup separate launch profiles for each mock client.

IConfiguration (appsettings.Development.json)

(to be continued)

Startup.Configure

(to be continued)

Optional Launch Profile Configuration (launchSettings.json)

(to be continued)