From c9010345b9cdc32bdf1d9c82bae9bbd2693a8898 Mon Sep 17 00:00:00 2001
From: Rob Winch <362503+rwinch@users.noreply.github.com>
Date: Tue, 30 Sep 2025 13:53:22 -0500
Subject: [PATCH] Add
 TestingAuthenticationToken(principal,credential,grantedAuthorities...)

Closes gh-17980
---
 .../TestingAuthenticationToken.java           |  5 +++++
 .../core/authority/AuthorityUtils.java        |  1 +
 .../TestingAuthenticationTokenTests.java      | 19 +++++++++++++++++++
 3 files changed, 25 insertions(+)

diff --git a/core/src/main/java/org/springframework/security/authentication/TestingAuthenticationToken.java b/core/src/main/java/org/springframework/security/authentication/TestingAuthenticationToken.java
index 70778db2a4..e17e8d842c 100644
--- a/core/src/main/java/org/springframework/security/authentication/TestingAuthenticationToken.java
+++ b/core/src/main/java/org/springframework/security/authentication/TestingAuthenticationToken.java
@@ -16,6 +16,7 @@
 
 package org.springframework.security.authentication;
 
+import java.util.Arrays;
 import java.util.Collection;
 import java.util.List;
 
@@ -51,6 +52,10 @@ public class TestingAuthenticationToken extends AbstractAuthenticationToken {
 		this(principal, credentials, AuthorityUtils.createAuthorityList(authorities));
 	}
 
+	public TestingAuthenticationToken(Object principal, Object credentials, GrantedAuthority... authorities) {
+		this(principal, credentials, Arrays.asList(authorities));
+	}
+
 	public TestingAuthenticationToken(Object principal, Object credentials,
 			List<? extends GrantedAuthority> authorities) {
 		this(principal, credentials, (Collection<? extends GrantedAuthority>) authorities);
diff --git a/core/src/main/java/org/springframework/security/core/authority/AuthorityUtils.java b/core/src/main/java/org/springframework/security/core/authority/AuthorityUtils.java
index 98dbbe0e52..6bb65ed0e8 100644
--- a/core/src/main/java/org/springframework/security/core/authority/AuthorityUtils.java
+++ b/core/src/main/java/org/springframework/security/core/authority/AuthorityUtils.java
@@ -72,6 +72,7 @@ public final class AuthorityUtils {
 	 * @return a List of GrantedAuthority objects
 	 */
 	public static List<GrantedAuthority> createAuthorityList(String... authorities) {
+		Assert.notNull(authorities, "authorities cannot be null");
 		List<GrantedAuthority> grantedAuthorities = new ArrayList<>(authorities.length);
 		for (String authority : authorities) {
 			grantedAuthorities.add(new SimpleGrantedAuthority(authority));
diff --git a/core/src/test/java/org/springframework/security/authentication/TestingAuthenticationTokenTests.java b/core/src/test/java/org/springframework/security/authentication/TestingAuthenticationTokenTests.java
index 6490f2bc3d..8bb9dff328 100644
--- a/core/src/test/java/org/springframework/security/authentication/TestingAuthenticationTokenTests.java
+++ b/core/src/test/java/org/springframework/security/authentication/TestingAuthenticationTokenTests.java
@@ -21,10 +21,13 @@ import java.util.Set;
 
 import org.junit.jupiter.api.Test;
 
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
 
 /**
  * @author Josh Cummings
@@ -68,4 +71,20 @@ public class TestingAuthenticationTokenTests {
 		assertThat(authorities).containsExactlyInAnyOrder("FACTOR_ONE", "FACTOR_TWO");
 	}
 
+	@Test
+	void constructorObjectObjectStringVargsWhenNullAuthorities() {
+		String[] authorities = null;
+		assertThatIllegalArgumentException()
+			.isThrownBy(() -> new TestingAuthenticationToken("user", "password", authorities));
+	}
+
+	@Test
+	void constructorObjectObjectStringVargsWhenValid() {
+		Authentication auth = new TestingAuthenticationToken("user", "password", "ROLE_USER");
+		assertThat(auth.isAuthenticated()).isTrue();
+		assertThat(auth.getPrincipal()).isEqualTo("user");
+		assertThat(auth.getCredentials()).isEqualTo("password");
+		assertThat(auth.getAuthorities()).extracting(GrantedAuthority::getAuthority).containsOnly("ROLE_USER");
+	}
+
 }