在@WithMockUser方法中，WithMockUserSecurityContextFactory的createSecurityContext方法用于创建具有模拟用户的安全上下文。但是，身份验证对象始终以已验证状态创建。这意味着，如果身份验证对象始终经过身份验证，则无法测试密码验证。因此，无法对错误密码情况进行测试。
WithMockUserSecurityContextFactory#createSecurityContext(WithMockUser withUser)
以下是来源：安全配置

@Bean
    public InMemoryUserDetailsManager userDetailsService(PasswordEncoder passwordEncoder) {

        String encPW = passwordEncoder.encode("123456");
        log.debug(encPW);
        UserDetails user = User.withUsername("user")
                .password(encPW)
                //.password("123456")
                .roles("USER")
                .build();

        UserDetails admin = User.withUsername("admin")
                .password(passwordEncoder.encode("123456"))
                .roles("USER", "ADMIN")
                .build();

        return new InMemoryUserDetailsManager(user, admin);
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .csrf((csrf)
                        -> csrf.ignoringRequestMatchers("/demo/**"))
                .authorizeHttpRequests((ah)
                        -> ah
                        .requestMatchers("/demo/authenticate").authenticated()
                        .anyRequest().permitAll()
                )
                .httpBasic(Customizer.withDefaults())
                ;
        return http.build();
    }

测试

//@WithMockUser(username = "no_exist_user", password = "123456777") //TEST NG
@Test
    void testHelloByWrongPw() throws Exception {

        mvc.perform(
                        post("/demo/authenticate")
                                .with(httpBasic("no_exist_user", "123456777"))
                                .content("{\"a1\":\"123\"}")
                                .contentType(MediaType.APPLICATION_JSON)
                                .accept(MediaType.APPLICATION_JSON)
                                .queryParam("a1","123")
                )
                .andExpect(status().isUnauthorized());
    }