@TestSecurity not working for QuarkusUnitTest in extension

[HerrDerb]

I tried to make a QuarkusUnitTest in a extensions deployment module that uses @TestSecurity
This seems not to work. When setting the security identity manually, it works.

   @Test
    @ActivateRequestContext
    @TestSecurity(user = "testUser", roles = "testRole")
    @Order(1)
    void whenWithTestSecurityAnnotation_shouldHaveSecurityIdentity() {
        assertEquals(securityIdentity.getPrincipal().getName(),"testUser");   <--- fails here already
        assertTrue( securityIdentity.hasRole("testRole"));
    }

    @Test
    @ActivateRequestContext
    @Order(2)
    void whenProgrammatically_shouldHaveSecurityIdentity() { <--- works
        withUserRole(Set.of("testRole"));

        assertEquals(securityIdentity.getPrincipal().getName(),"testUser"); 
        assertTrue( securityIdentity.hasRole("testRole"));
    }

What may be the issue?
I made a reproducer: https://github.com/HerrDerb/extension-issues/tree/test-security-issue

[quarkus-bot[bot]]

/cc @sberyozkin (security)

[sberyozkin]

@HerrDerb I'm not sure about a test pattern like

@Inject
    SecurityIdentity securityIdentity;

    @Test
    @ActivateRequestContext
    @TestSecurity(user = "testUser", roles = "testRole")
    @Order(1)
    void whenWithTestSecurityAnnotation_shouldHaveSecurityIdentity() {
        assertEquals(securityIdentity.getPrincipal().getName(),"testUser");
        assertTrue( securityIdentity.hasRole("testRole"));
    }

It should work if you have the identity injected in the secured endpoint, I'm not sure @ActivateRequestContext makes sense at the unit test level.
CC @manovotn @mkouba

[HerrDerb]

Without the @ActivateRequestContext, you'll get an ContextNotActiveException when running the tests regarding the SecurityIdentityProxy

[mkouba]

Yes, that's expected - AFAIK we don't activate the request context for a test method automatically.

[sberyozkin]

My understanding that there should be something that triggers the request scoped injection, adding @TestSecurity makes sure such trigger will work but something has to trigger it, like a request to the secured endpoint

[HerrDerb]

You suggest that, to test this properly, I would additionally need to create a test endpoint and make a call?

[sberyozkin]

@HerrDerb

This is how I've been doing it: https://github.com/quarkusio/quarkus/blob/main/integration-tests/oidc-code-flow/src/test/java/io/quarkus/it/keycloak/TestSecurityLazyAuthTest.java