Mocking IPrincipal in ASP.NET Core

In previous versions you could have set User directly on the controller, which made for some very easy unit tests.

If you look at the source code for ControllerBase you will notice that the User is extracted from HttpContext.

/// <summary> /// Gets the <see cref="ClaimsPrincipal"/> for user associated with the executing action. /// </summary> public ClaimsPrincipal User => HttpContext?.User; 

and the controller accesses the HttpContext via ControllerContext

/// <summary> /// Gets the <see cref="Http.HttpContext"/> for the executing action. /// </summary> public HttpContext HttpContext => ControllerContext.HttpContext; 

You will notice that these two are read only properties. The good news is that ControllerContext property allows for setting it's value so that will be your way in.

So the target is to get at that object. In Core HttpContext is abstract so it is a lot easier to mock.

Assuming a controller like

public class MyController : Controller { IMyContext _context; public MyController(IMyContext context) { _context = context; } public IActionResult Index() { SettingsViewModel svm = _context.MySettings(User.Identity.Name); return View(svm); } //...other code removed for brevity } 

Using Moq, a test could look like this

public void Given_User_Index_Should_Return_ViewResult_With_Model() { //Arrange var username = "FakeUserName"; var identity = new GenericIdentity(username, ""); var mockPrincipal = new Mock<ClaimsPrincipal>(); mockPrincipal.Setup(x => x.Identity).Returns(identity); mockPrincipal.Setup(x => x.IsInRole(It.IsAny<string>())).Returns(true); var mockHttpContext = new Mock<HttpContext>(); mockHttpContext.Setup(m => m.User).Returns(mockPrincipal.Object); var model = new SettingsViewModel() { //...other code removed for brevity }; var mockContext = new Mock<IMyContext>(); mockContext.Setup(m => m.MySettings(username)).Returns(model); var controller = new MyController(mockContext.Object) { ControllerContext = new ControllerContext { HttpContext = mockHttpContext.Object } }; //Act var viewResult = controller.Index() as ViewResult; //Assert Assert.IsNotNull(viewResult); Assert.IsNotNull(viewResult.Model); Assert.AreEqual(model, viewResult.Model); } 

There is also the possibility to use the existing classes, and mock only when needed.

var user = new Mock<ClaimsPrincipal>(); _controller.ControllerContext = new ControllerContext { HttpContext = new DefaultHttpContext { User = user.Object } }; 

In my case, I needed to make use of Request.HttpContext.User.Identity.IsAuthenticated, Request.HttpContext.User.Identity.Name and some business logic sitting outside of the controller. I was able to use a combination of Nkosi's, Calin's and Poke's answer for this:

var identity = new Mock<IIdentity>(); identity.SetupGet(i => i.IsAuthenticated).Returns(true); identity.SetupGet(i => i.Name).Returns("FakeUserName"); var mockPrincipal = new Mock<ClaimsPrincipal>(); mockPrincipal.Setup(x => x.Identity).Returns(identity.Object); var mockAuthHandler = new Mock<ICustomAuthorizationHandler>(); mockAuthHandler.Setup(x => x.CustomAuth(It.IsAny<ClaimsPrincipal>(), ...)).Returns(true).Verifiable(); var controller = new MyController(...); var mockHttpContext = new Mock<HttpContext>(); mockHttpContext.Setup(m => m.User).Returns(mockPrincipal.Object); controller.ControllerContext = new ControllerContext(); controller.ControllerContext.HttpContext = new DefaultHttpContext() { User = mockPrincipal.Object }; var result = controller.Get() as OkObjectResult; //Assert results mockAuthHandler.Verify(); 

I want to hit my Controllers directly and just use DI like AutoFac. To do this I first registering ContextController.

var identity = new GenericIdentity("Test User"); var httpContext = new DefaultHttpContext() { User = new GenericPrincipal(identity, null) }; var context = new ControllerContext { HttpContext = httpContext}; builder.RegisterInstance(context); 

Next I enable property injection when I register the Controllers.

 builder.RegisterAssemblyTypes(assembly) .Where(t => t.Name.EndsWith("Controller")).PropertiesAutowired(); 

Then User.Identity.Name is populated, and I do not need to do anything special when calling a method on my Controller.

public async Task<ActionResult<IEnumerable<Employee>>> Get() { var requestedBy = User.Identity?.Name; .................. 

I would look to implement an Abstract Factory Pattern.

Create an interface for a factory specifically for providing user names.

Then provide concrete classes, one which provides User.Identity.Name, and one that provides some other hard coded value that works for your tests.

You can then use the appropriate concrete class depending on production versus test code. Perhaps looking to pass the factory in as a parameter, or switching to the correct factory based on some configuration value.

interface IUserNameFactory { string BuildUserName(); } class ProductionFactory : IUserNameFactory { public BuildUserName() { return User.Identity.Name; } } class MockFactory : IUserNameFactory { public BuildUserName() { return "James"; } } IUserNameFactory factory; if(inProductionMode) { factory = new ProductionFactory(); } else { factory = new MockFactory(); } SettingsViewModel svm = _context.MySettings(factory.BuildUserName()); 

I got a brownfield .net 4.8 project that I needed to convert to .net 5.0 and I wanted to keep as much of the original code as possible, including the unit-/integration tests. The test for Controllers relied on the Context a lot so I created this Extension method to enable setting tokens, claims and headers:

public static void AddContextMock( this ControllerBase controller, IEnumerable<(string key, string value)> claims = null, IEnumerable<(string key, string value)> tokens = null, IEnumerable<(string key, string value)> headers = null) { HttpContext mockContext = new DefaultHttpContext(); if(claims != null) { mockContext.User = SetupClaims(claims); } if(tokens != null) { mockContext.RequestServices = SetupTokens(tokens); } if(headers != null) { SetupHeaders(mockContext, headers); } controller.ControllerContext = new ControllerContext() { HttpContext = mockContext }; } private static void SetupHeaders(HttpContext mockContext, IEnumerable<(string key, string value)> headers) { foreach(var header in headers) { mockContext.Request.Headers.Add(header.key, header.value); } } private static ClaimsPrincipal SetupClaims(IEnumerable<(string key, string value)> claimValues) { var claims = claimValues.Select(c => new Claim(c.key, c.value)); return new ClaimsPrincipal(new ClaimsIdentity(claims, "mock")); } private static IServiceProvider SetupTokens(IEnumerable<(string key, string value)> tokenValues) { var mockServiceProvider = new Mock<IServiceProvider>(); var authenticationServiceMock = new Mock<IAuthenticationService>(); var authResult = AuthenticateResult.Success( new AuthenticationTicket(new ClaimsPrincipal(), null)); var tokens = tokenValues.Select(t => new AuthenticationToken { Name = t.key, Value = t.value }); authResult.Properties.StoreTokens(tokens); authenticationServiceMock .Setup(x => x.AuthenticateAsync(It.IsAny<HttpContext>(), null)) .ReturnsAsync(authResult); mockServiceProvider.Setup(_ => _.GetService(typeof(IAuthenticationService))).Returns(authenticationServiceMock.Object); return mockServiceProvider.Object; } 

This uses Moq but can be adapted to other mocking frameworks. The authentication type is hardcoded to "mock" since I rely on default authentication but this could be supplied as well.

It is used as such:

_controllerUnderTest.AddContextMock( claims: new[] { (ClaimTypes.Name, "UserName"), (ClaimTypes.MobilePhone, "1234"), }, tokens: new[] { ("access_token", "accessTokenValue") }, headers: new[] { ("header", "headerValue") }); 

If you're using Razor pages and want to override the claims:

[SetUp] public void Setup() { var user = new ClaimsPrincipal(new ClaimsIdentity( new Claim[] { new("dateofbirth", "2000-10-10"), new("surname", "Smith") }, "mock")); _razorModel = new RazorModel() { PageContext = new PageContext { HttpContext = new DefaultHttpContext() { User = user } } }; }