### Question:
X509AuthenticationFilter extends AbstractAuthenticationProcessingFilter { @Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) { X509Certificate[] certs = (X509Certificate[]) request.getAttribute("client.auth.X509Certificate"); if (certs != null && certs.length > 0) { return this.authenticationProvider.authenticate(new X509AuthenticationToken(certs)); } return null; } X509AuthenticationFilter(String endpoint,
                                    AuthenticationSuccessHandler successHandler,
                                    AuthenticationProvider authenticationProvider); @Override void doFilter(ServletRequest req, ServletResponse res, FilterChain chain); @Override Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response);  }### Answer:
@Test void shouldCallAuthProviderWithCertificate() { httpServletRequest = new MockHttpServletRequest(); httpServletRequest.setMethod(HttpMethod.POST.name()); httpServletRequest.setAttribute("client.auth.X509Certificate", x509Certificate); httpServletResponse = new MockHttpServletResponse(); x509AuthenticationFilter.attemptAuthentication(httpServletRequest, httpServletResponse); verify(authenticationProvider).authenticate(new X509AuthenticationToken(x509Certificate)); }
@Test void shouldNotAuthenticate() { httpServletRequest = new MockHttpServletRequest(); httpServletRequest.setMethod(HttpMethod.POST.name()); httpServletResponse = new MockHttpServletResponse(); x509AuthenticationFilter.attemptAuthentication(httpServletRequest, httpServletResponse); verify(authenticationProvider, times(0)).authenticate(new X509AuthenticationToken(x509Certificate)); }