@Test
public void testCreateSecurityContextForSession() {

    LOG.info("testCreateSecurityContextForSession");
    Mockito.when(httpServletRequest.getSession(false)).thenReturn(httpSession);
    @Nonnull final SessionManager.SessionData sessionData = Mockito.mock(SessionManager.SessionData.class);
    Mockito.doReturn(REFERENCE_PERSON_ID).when(sessionData).getUserId();
    Mockito.doReturn(SessionManager.AUTHENTICATION_SCHEME_USERNAME).when(sessionData).getAuthenticationScheme();
    Mockito.when(httpSession.getAttribute(SESSION_DATA_KEY)).thenReturn(sessionData);
    // Create security context and validate it.
    final SecurityContext securityContext = SessionManager.createSecurityContextForSession(httpServletRequest);
    assertThat(securityContext, is(notNullValue()));
    assertThat(securityContext, is(instanceOf(SecurityContextImpl.class)));
    // Get authentication scheme from security context and ensure that it matches the intended session type.
    assert securityContext != null;
    final String authenticationScheme = securityContext.getAuthenticationScheme();
    assertThat(authenticationScheme, is(notNullValue()));
    assertThat(securityContext.getAuthenticationScheme(), is(SessionManager.AUTHENTICATION_SCHEME_USERNAME));
    // Get the principal for the authenticated user and ensure that it matches the Identity for which the session
    // was established.
    final Principal userPrincipal = securityContext.getUserPrincipal();
    assertThat(userPrincipal, is(notNullValue()));
    assertThat(userPrincipal.getName(), is(REFERENCE_PERSON_ID));
    verify(httpServletRequest).getSession(false);
    verify(httpSession).getAttribute(SESSION_DATA_KEY);
}