DefaultSecurityManager implements SecurityManager { @Override public void login(HttpServletRequest request, String username, String password) throws ServletException { if (logins.containsKey(username) && password != null && password.equals(logins.get(username))) { DefaultWebApplicationRequest abstractRequest; while (request instanceof HttpServletRequestWrapper) { HttpServletRequestWrapper wrapper = (HttpServletRequestWrapper) request; request = (HttpServletRequest) wrapper.getRequest(); } abstractRequest = (DefaultWebApplicationRequest) request; abstractRequest.setUserPrincipal(new DefaultSecurityPrincipal(username)); } else { throw new ServletException("Unable to login using the given username and password"); } }  void addUser(String username, String password, String... roles); void addUserRole(String username, String... roles); @Override boolean authenticate(
            HttpServletRequest request, HttpServletResponse response); @Override void declareRoles(String[] roles); @Override Set<String> getRoles(); @Override boolean getDenyUncoveredHttpMethods(); @Override WebApplication getWebApplication(); @Override boolean isUserInRole(HttpServletRequest request, String role); @Override void login(HttpServletRequest request, String username, String password); @Override void logout(HttpServletRequest request, HttpServletResponse response); void removeUser(String username); @Override void setDenyUncoveredHttpMethods(boolean denyUncoveredHttpMethods); @Override void setWebApplication(WebApplication webApplication);  }
@Test void testLogin() throws ServletException { TestWebApplicationRequest request = new TestWebApplicationRequest(); TestWebApplicationResponse response = new TestWebApplicationResponse(); DefaultWebApplication webApp = new DefaultWebApplication(); DefaultSecurityManager securityManager = new DefaultSecurityManager(); webApp.linkRequestAndResponse(request, response); securityManager.setWebApplication(webApp); securityManager.addUser("username", "password", new String[]{"role1", "role2"}); securityManager.login(request, "username", "password"); }