如何在ASP.NET Core集成测试中向HandleAuthenticateAsync传入自定义Claim

下面提供两种可行的实现方案，直接解决将测试用例中的Claim集合传递给TestAuthHandler的问题：

方法一：通过自定义Options传递Claim集合 #

这种方式贴合ASP.NET Core身份验证的扩展设计模式，通过Scheme的配置选项传递测试Claim。

1. 定义自定义身份验证选项
   创建继承自AuthenticationSchemeOptions的选项类，添加存储Claim的属性：

public class TestAuthOptions : AuthenticationSchemeOptions
{
    public IEnumerable<Claim> TestClaims { get; set; } = Enumerable.Empty<Claim>();
}

2. 修改TestAuthHandler使用自定义选项
   让Handler继承自AuthenticationHandler<TestAuthOptions>，并在验证逻辑中使用选项里的Claim集合：

public class TestAuthHandler : AuthenticationHandler<TestAuthOptions>
{
    public TestAuthHandler(IOptionsMonitor<TestAuthOptions> options, 
        ILoggerFactory logger, UrlEncoder encoder, ISystemClock clock) 
        : base(options, logger, encoder, clock)
    {
    }

    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        // 使用Options中传入的测试Claim，替换原固定值
        var identity = new ClaimsIdentity(Options.TestClaims, Scheme.Name);
        var principal = new ClaimsPrincipal(identity);
        var ticket = new AuthenticationTicket(principal, Scheme.Name);

        return Task.FromResult(AuthenticateResult.Success(ticket));
    }
}

3. 编写[Theory]测试方法
   用[InlineData]传递Claim的类型和值对，在测试方法中转换为Claim集合后配置到Scheme选项：

[Theory]
// 测试Admin角色+用户ID场景
[InlineData("role", "Admin", "userId", "1")]
// 测试普通User角色场景
[InlineData("role", "User", "userId", "2")]
// 测试仅权限Claim场景
[InlineData("permission", "Read")]
public async Task ProtectedEndpoint_WithDifferentClaims_ReturnsExpectedResult(params string[] claimPairs)
{
    // 将参数转换为Claim集合（每两个元素为一组Type/Value）
    var testClaims = new List<Claim>();
    for (int i = 0; i < claimPairs.Length; i += 2)
    {
        if (i + 1 < claimPairs.Length)
        {
            testClaims.Add(new Claim(claimPairs[i], claimPairs[i + 1]));
        }
    }

    // 创建测试用WebApplicationFactory并配置身份验证
    var factory = new WebApplicationFactory<Program>()
        .WithWebHostBuilder(builder =>
        {
            builder.ConfigureServices(services =>
            {
                services.AddAuthentication("TestScheme")
                    .AddScheme<TestAuthOptions, TestAuthHandler>("TestScheme", options =>
                    {
                        options.TestClaims = testClaims;
                    });
            });
        });

    var client = factory.CreateClient();
    // 设置请求头使用测试Scheme
    client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("TestScheme");

    // 调用受保护的API端点
    var response = await client.GetAsync("/api/protected");

    // 根据不同Claim场景做针对性断言
    if (testClaims.Any(c => c.Type == "role" && c.Value == "Admin"))
    {
        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        var content = await response.Content.ReadAsStringAsync();
        Assert.Contains("Admin access granted", content);
    }
    else if (testClaims.Any(c => c.Type == "role" && c.Value == "User"))
    {
        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        Assert.Contains("User access granted", content);
    }
    else
    {
        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        Assert.Contains("Read permission granted", content);
    }
}

方法二：通过依赖注入传递Claim集合 #

如果不想自定义Options，也可以直接通过DI将Claim集合注入到TestAuthHandler中。

1. 修改TestAuthHandler添加构造参数
   在Handler的构造函数中接收IEnumerable<Claim>并存储为私有变量：

public class TestAuthHandler : AuthenticationHandler<AuthenticationSchemeOptions>
{
    private readonly IEnumerable<Claim> _testClaims;

    public TestAuthHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, 
        ILoggerFactory logger, UrlEncoder encoder, ISystemClock clock,
        IEnumerable<Claim> testClaims) 
        : base(options, logger, encoder, clock)
    {
        _testClaims = testClaims;
    }

    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        var identity = new ClaimsIdentity(_testClaims, Scheme.Name);
        var principal = new ClaimsPrincipal(identity);
        var ticket = new AuthenticationTicket(principal, Scheme.Name);

        return Task.FromResult(AuthenticateResult.Success(ticket));
    }
}

2. 编写[Theory]测试方法
   在测试的服务配置中，将当前测试的Claim集合注册为单例服务，供Handler注入：

[Theory]
[InlineData("role", "Admin", "userId", "1")]
[InlineData("role", "User", "userId", "2")]
[InlineData("permission", "Read")]
public async Task ProtectedEndpoint_WithDifferentClaims_ReturnsExpectedResult(params string[] claimPairs)
{
    var testClaims = new List<Claim>();
    for (int i = 0; i < claimPairs.Length; i += 2)
    {
        if (i + 1 < claimPairs.Length)
        {
            testClaims.Add(new Claim(claimPairs[i], claimPairs[i + 1]));
        }
    }

    var factory = new WebApplicationFactory<Program>()
        .WithWebHostBuilder(builder =>
        {
            builder.ConfigureServices(services =>
            {
                // 将测试用Claim集合注册到DI容器
                services.AddSingleton<IEnumerable<Claim>>(testClaims);

                // 添加身份验证Scheme，使用TestAuthHandler
                services.AddAuthentication("TestScheme")
                    .AddScheme<AuthenticationSchemeOptions, TestAuthHandler>("TestScheme", options => { });
            });
        });

    var client = factory.CreateClient();
    client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("TestScheme");

    var response = await client.GetAsync("/api/protected");

    // 同方法一的断言逻辑
    // ...
}

关键说明 #

• 每个[InlineData]都会创建全新的WebApplicationFactory实例，DI容器和配置完全隔离，确保各组测试用例的Claim不会互相干扰。
• 由于xUnit的[InlineData]仅支持常量类型，所以用字符串参数对间接创建Claim对象，这是符合框架限制的常规做法。

内容的提问来源于stack exchange，提问作者cmetr