I want to test authenticated endpoints, the securi...

# ktor

[Rohde Fischer]

I want to test authenticated endpoints, the security is done using Keycloak configured through a JWK-endpoint. When testing, I prefer to use as few test-specific configurations my subject under test (i.e. the server) as possible. Thus I'd much rather fake the JWK-service than I'd replace the authentication (i.e. with a secret key based one). But is there any working samples of doing this using ktor? I'm imagining something like this:

val jwkService = FakeJwk.withGeneratedCertificates(JWTAlgorith.RS256)

testApplication {
    externalServices {
        hosts("<https://my-auth-service>") {
            install(io.ktor.server.plugins.test.fakeJwk) {
                service = jwkService
            }
        }
    }

    val client = createClient {
        install(Auth) {
            bearer {
                jwtService.authentication {
                    // Configuration such as ID, expiry etc. here
                }
            }
        }
    }

    // perform test with client here
}

does something along these lines already exist, what is the current practice, is that actually not testing things with JWK(-ish) systems, or?

[Aleksei Tirman [JB]]

You may find this sample project helpful

[Rohde Fischer]

will take a look, thanks 🙂