TSK-1207: finished implementation of JaasExtension and its tests

* TSK-1207: finished implementation of JaasExtension and its tests

* TSK-1207: renamed some variable names

lib/taskana-core/src/main/java/pro/taskana/common/internal/security/CurrentUserContext.java

@@ -8,8 +8,11 @@ import java.security.AccessController;
 import java.security.Principal;
 import java.security.acl.Group;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
+import java.util.Objects;
 import java.util.Set;
+import java.util.stream.Collectors;
 import javax.security.auth.Subject;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -48,33 +51,22 @@ public final class CurrentUserContext {
   public static List<String> getGroupIds() {
     Subject subject = Subject.getSubject(AccessController.getContext());
     LOGGER.trace("Subject of caller: {}", subject);
-    List<String> groupIds = new ArrayList<>();
     if (subject != null) {
       Set<Group> groups = subject.getPrincipals(Group.class);
       LOGGER.trace("Public groups of caller: {}", groups);
-      for (Principal group : groups) {
+      return groups.stream()
-        String groupNameFound = group.getName();
+          .map(Principal::getName)
-        String groupNameReturned = groupNameFound;
+          .filter(Objects::nonNull)
-        if (shouldUseLowerCaseForAccessIds() && groupNameFound != null) {
+          .map(CurrentUserContext::convertAccessId)
-          groupNameReturned = groupNameFound.toLowerCase();
+          .collect(Collectors.toList());
-        }
-        LOGGER.trace(
-            "Found group id {}. Returning group Id: {}", groupNameFound, groupNameReturned);
-        groupIds.add(groupNameReturned);
-      }
-      return groupIds;
     }
-    LOGGER.trace("No groupids found in subject!");
+    LOGGER.trace("No groupIds found in subject!");
-    return groupIds;
+    return Collections.emptyList();
   }
 
   public static List<String> getAccessIds() {
-    List<String> accessIds = new ArrayList<>();
+    List<String> accessIds = new ArrayList<>(getGroupIds());
-    List<String> groupIds = getGroupIds();
     accessIds.add(getUserid());
-    if (!groupIds.isEmpty()) {
-      accessIds.addAll(groupIds);
-    }
     return accessIds;
   }
 
@@ -130,10 +122,10 @@ public final class CurrentUserContext {
       try {
         Class.forName(WSSUBJECT_CLASSNAME);
         LOGGER.debug("WSSubject detected. Assuming that Taskana runs on IBM WebSphere.");
-        runningOnWebSphere = Boolean.TRUE;
+        runningOnWebSphere = true;
       } catch (ClassNotFoundException e) {
         LOGGER.debug("No WSSubject detected. Using JAAS subject further on.");
-        runningOnWebSphere = Boolean.FALSE;
+        runningOnWebSphere = false;
       }
     }
     return runningOnWebSphere;
@@ -145,19 +137,24 @@ public final class CurrentUserContext {
     if (subject != null) {
       Set<Principal> principals = subject.getPrincipals();
       LOGGER.trace("Public principals of caller: {}", principals);
-      for (Principal principal : principals) {
+      return principals.stream()
-        if (!(principal instanceof Group)) {
+          .filter(principal -> !(principal instanceof Group))
-          String userIdFound = principal.getName();
+          .map(Principal::getName)
-          String userIdUsed = userIdFound;
+          .filter(Objects::nonNull)
-          if (shouldUseLowerCaseForAccessIds() && userIdFound != null) {
+          .map(CurrentUserContext::convertAccessId)
-            userIdUsed = userIdFound.toLowerCase();
+          .findFirst()
-          }
+          .orElse(null);
-          LOGGER.trace("Found User id {}. Returning User id {} ", userIdFound, userIdUsed);
-          return userIdUsed;
-        }
-      }
     }
-    LOGGER.trace("No userid found in subject!");
+    LOGGER.trace("No userId found in subject!");
     return null;
   }
+
+  private static String convertAccessId(String accessId) {
+    String toReturn = accessId;
+    if (shouldUseLowerCaseForAccessIds()) {
+      toReturn = accessId.toLowerCase();
+    }
+    LOGGER.trace("Found AccessId '{}'. Returning AccessId '{}' ", accessId, toReturn);
+    return toReturn;
+  }
 }

lib/taskana-core/src/main/java/pro/taskana/common/internal/security/GroupPrincipal.java

@@ -12,12 +12,12 @@ import pro.taskana.common.api.LoggerUtils;
 /** Represents a group with a name and a set of members. */
 public class GroupPrincipal implements Group {
 
-  private String name;
+  private final String name;
-  private Set<Principal> members;
+  private final Set<Principal> members;
 
   public GroupPrincipal(String name) {
     this.name = name;
-    this.members = new HashSet<Principal>();
+    this.members = new HashSet<>();
   }
 
   @Override

lib/taskana-core/src/main/java/pro/taskana/common/internal/security/UserPrincipal.java

@@ -5,7 +5,7 @@ import java.security.Principal;
 /** Represents a user principal with a name. */
 public class UserPrincipal implements Principal {
 
-  private String name;
+  private final String name;
 
   public UserPrincipal(String name) {
     this.name = name;

lib/taskana-core/src/main/java/pro/taskana/common/internal/util/Pair.java

@@ -4,33 +4,23 @@ import java.util.Objects;
 
 public final class Pair<L, R> {
 
-  private L left;
+  private final L left;
 
-  private R right;
+  private final R right;
 
   public Pair(L left, R right) {
     this.left = left;
     this.right = right;
   }
 
-  public Pair() {}
-
   public L getLeft() {
     return left;
   }
 
-  public void setLeft(L left) {
-    this.left = left;
-  }
-
   public R getRight() {
     return right;
   }
 
-  public void setRight(R right) {
-    this.right = right;
-  }
-
   public static <L, R> Pair<L, R> of(L left, R right) {
     return new Pair<>(left, right);
   }

lib/taskana-core/src/test/java/pro/taskana/security/JaasExtension.java

@@ -3,30 +3,37 @@ package pro.taskana.security;
 import static org.junit.platform.commons.support.AnnotationSupport.isAnnotated;
 import static pro.taskana.common.internal.util.CheckedFunction.wrap;
 
+import java.lang.reflect.AnnotatedElement;
 import java.lang.reflect.Constructor;
-import java.lang.reflect.Executable;
 import java.lang.reflect.Method;
 import java.security.Principal;
 import java.security.PrivilegedAction;
 import java.util.Arrays;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.Iterator;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
+import java.util.stream.StreamSupport;
 import javax.security.auth.Subject;
 import org.junit.jupiter.api.DynamicContainer;
 import org.junit.jupiter.api.DynamicNode;
+import org.junit.jupiter.api.extension.Extension;
 import org.junit.jupiter.api.extension.ExtensionContext;
 import org.junit.jupiter.api.extension.ExtensionContext.Namespace;
 import org.junit.jupiter.api.extension.ExtensionContext.Store;
 import org.junit.jupiter.api.extension.InvocationInterceptor;
+import org.junit.jupiter.api.extension.ParameterContext;
+import org.junit.jupiter.api.extension.ParameterResolver;
 import org.junit.jupiter.api.extension.ReflectiveInvocationContext;
 import org.junit.jupiter.api.extension.TestTemplateInvocationContext;
 import org.junit.jupiter.api.extension.TestTemplateInvocationContextProvider;
 import org.junit.platform.commons.JUnitException;
+import org.junit.platform.commons.support.AnnotationSupport;
 
 import pro.taskana.common.api.exceptions.SystemException;
 import pro.taskana.common.internal.security.GroupPrincipal;
@@ -68,9 +75,8 @@ public class JaasExtension implements InvocationInterceptor, TestTemplateInvocat
       Invocation<Void> invocation,
       ReflectiveInvocationContext<Method> invocationContext,
       ExtensionContext extensionContext) {
-    boolean annotated = isAnnotated(invocationContext.getExecutable(), WithAccessIds.class);
+    if (isAnnotated(invocationContext.getExecutable(), WithAccessIds.class)) {
-    if (annotated) {
+      throw new JUnitException("Please use @TestTemplate instead of @Test for multiple accessIds");
-      throw new JUnitException("Please use @TestTemplate instead of @Test for multiple access Ids");
     }
     extractAccessIdAndPerformInvocation(invocation, invocationContext.getExecutable());
   }
@@ -83,40 +89,59 @@ public class JaasExtension implements InvocationInterceptor, TestTemplateInvocat
       ExtensionContext extensionContext) {
     WithAccessIds annotation = invocationContext.getExecutable().getAnnotation(WithAccessIds.class);
     if (annotation != null) {
-      // we are using the first annotation to run the factory method with.
+      // our goal is to run each test returned from the test factory X times. X is the amount of
-      T t = performInvocationWithAccessId(invocation, annotation.value()[0]);
+      // WithAccessId annotations. In order to achieve this we are wrapping the result from the
-
+      // factory (the returning tests) in a dynamicContainer for each accessId. Since we don't know
-      Iterable<DynamicNode> iterable;
+      // what the factory will return we have to check for every possible return type. All possible
-      // TestFactory must have one of the following return types. See link below for further details
+      // return types can be found here:
       // https://junit.org/junit5/docs/current/user-guide/#writing-tests-dynamic-tests
-      if (t instanceof DynamicNode) {
+      // After checking each return type we abuse the return type of T and hardly change it to
-        iterable = Collections.singleton((DynamicNode) t);
+      // Stream<DynamicContainer> no matter what the factory returns. This return type is allowed
-      } else if (t instanceof Stream) {
+      // per definition (See link above), but is not the type T. Hence we have an unchecked cast at
-        Stream<DynamicNode> tt = (Stream<DynamicNode>) t;
+      // the end to keep the compiler happy...
-        iterable = tt.collect(Collectors.toList());
+
-      } else if (t instanceof Iterable) {
+      // we are using the first annotation to run the factory method with.
-        iterable = (Iterable<DynamicNode>) t;
+      T factoryResult = performInvocationWithAccessId(invocation, annotation.value()[0]);
-      } else if (t instanceof Iterator) {
+
-        iterable = () -> (Iterator<DynamicNode>) t;
+      Iterable<DynamicNode> newChildrenForDynamicContainer;
-        // TODO: add instanceof DynamicNode[]
+      // TestFactory must have one of the following return types. See link above for further details
+      if (factoryResult instanceof DynamicNode) {
+        newChildrenForDynamicContainer = Collections.singleton((DynamicNode) factoryResult);
+      } else if (factoryResult instanceof Stream) {
+        Stream<DynamicNode> nodes = (Stream<DynamicNode>) factoryResult;
+        newChildrenForDynamicContainer = nodes.collect(Collectors.toList());
+      } else if (factoryResult instanceof Iterable) {
+        newChildrenForDynamicContainer = (Iterable<DynamicNode>) factoryResult;
+      } else if (factoryResult instanceof Iterator) {
+        newChildrenForDynamicContainer = () -> (Iterator<DynamicNode>) factoryResult;
+      } else if (factoryResult instanceof DynamicNode[]) {
+        newChildrenForDynamicContainer = Arrays.asList((DynamicNode[]) factoryResult);
       } else {
         throw new SystemException(
             String.format(
                 "Testfactory '%s' did not return a proper type",
                 invocationContext.getExecutable().getName()));
       }
-      //      StreamSupport.stream(iterable.spliterator(), false).map(node -> {
+
-      //        if (node instanceof DynamicContainer) {
+      // Currently a DynamicContainer has children from this type: Stream<DynamicNode>
-      //          return DynamicContainer.dynamicContainer(node.getDisplayName(),
+      // Because of this the children can only be extracted once (Streams can only be operated
-      // ((DynamicContainer) node).getChildren());
+      // once). This is obviously not ok since we want to execute each node X times. So we have to
-      //        } return node;
+      // manually persist all children recursively to extract them X times...
-      //      }).forEach(System.out::println);
+      Map<String, List<DynamicNode>> childrenMap = new HashMap<>();
+      persistDynamicContainerChildren(newChildrenForDynamicContainer, childrenMap);
+
+      Function<WithAccessId, DynamicContainer> wrapTestsInDynamicContainer =
+          accessId ->
+              DynamicContainer.dynamicContainer(
+                  getDisplayNameForAccessId(accessId),
+                  StreamSupport.stream(newChildrenForDynamicContainer.spliterator(), false)
+                      .map(x -> duplicateDynamicNode(x, childrenMap)));
 
       Store store = getStore(extensionContext);
       return (T)
           Stream.of(annotation.value())
               .peek(a -> store.put(ACCESS_IDS_STORE_KEY, a))
-              .map(a -> DynamicContainer.dynamicContainer(getDisplayNameForAccessId(a), iterable));
+              .map(wrapTestsInDynamicContainer);
     }
 
     return extractAccessIdAndPerformInvocation(invocation, invocationContext.getExecutable());
@@ -159,27 +184,57 @@ public class JaasExtension implements InvocationInterceptor, TestTemplateInvocat
       ExtensionContext extensionContext) {
     extractAccessIdAndPerformInvocation(invocation, invocationContext.getExecutable());
   }
+
   // endregion
 
   // region TestTemplateInvocationContextProvider
+
   @Override
   public boolean supportsTestTemplate(ExtensionContext context) {
-    return isAnnotated(context.getRequiredTestMethod(), WithAccessIds.class);
+    return isAnnotated(context.getElement(), WithAccessIds.class)
+        || isAnnotated(context.getElement(), WithAccessId.class);
   }
 
   @Override
   public Stream<TestTemplateInvocationContext> provideTestTemplateInvocationContexts(
       ExtensionContext context) {
-    WithAccessIds annotation = context.getRequiredTestMethod().getAnnotation(WithAccessIds.class);
+    List<WithAccessId> accessIds =
+        AnnotationSupport.findRepeatableAnnotations(context.getElement(), WithAccessId.class);
     Store store = getStore(context);
-    return Stream.of(annotation.value())
+    return accessIds.stream()
         .peek(a -> store.put(ACCESS_IDS_STORE_KEY, a))
         .map(JaasExtensionInvocationContext::new);
   }
+
   // endregion
 
+  private static void persistDynamicContainerChildren(
+      Iterable<DynamicNode> nodes, Map<String, List<DynamicNode>> childrenMap) {
+    nodes.forEach(
+        node -> {
+          if (node instanceof DynamicContainer) {
+            DynamicContainer container = (DynamicContainer) node;
+            List<DynamicNode> children = container.getChildren().collect(Collectors.toList());
+            childrenMap.put(container.hashCode() + container.getDisplayName(), children);
+            persistDynamicContainerChildren(children, childrenMap);
+          }
+        });
+  }
+
+  private static DynamicNode duplicateDynamicNode(
+      DynamicNode node, Map<String, List<DynamicNode>> lookupMap) {
+    if (node instanceof DynamicContainer) {
+      DynamicContainer container = (DynamicContainer) node;
+      Stream<DynamicNode> children =
+          lookupMap.get(node.hashCode() + node.getDisplayName()).stream()
+              .map(x -> duplicateDynamicNode(x, lookupMap));
+      return DynamicContainer.dynamicContainer(container.getDisplayName(), children);
+    }
+    return node;
+  }
+
   private static <T> T extractAccessIdAndPerformInvocation(
-      Invocation<T> invocation, Executable executable) {
+      Invocation<T> invocation, AnnotatedElement executable) {
     return performInvocationWithAccessId(invocation, executable.getAnnotation(WithAccessId.class));
   }
 
@@ -205,8 +260,8 @@ public class JaasExtension implements InvocationInterceptor, TestTemplateInvocat
 
   private ExtensionContext getParentMethodExtensionContent(ExtensionContext extensionContext) {
     Optional<ExtensionContext> parent = extensionContext.getParent();
-    // the class MethodExtensionContext is part of junit-jupiter-engine.
+    // the class MethodExtensionContext is part of junit-jupiter-engine and has only a
-    // This is a workaround so that the engine dependency doesn't have to be included.
+    // package-private visibility thus this workaround is needed.
     while (!parent
         .map(Object::getClass)
         .map(Class::getName)
@@ -246,5 +301,24 @@ public class JaasExtension implements InvocationInterceptor, TestTemplateInvocat
     public String getDisplayName(int invocationIndex) {
       return getDisplayNameForAccessId(withAccessId);
     }
+
+    @Override
+    public List<Extension> getAdditionalExtensions() {
+      return Collections.singletonList(new WithAccessIdParameterResolver());
+    }
+
+    private class WithAccessIdParameterResolver implements ParameterResolver {
+      @Override
+      public boolean supportsParameter(
+          ParameterContext parameterContext, ExtensionContext extensionContext) {
+        return parameterContext.getParameter().getType().equals(WithAccessId.class);
+      }
+
+      @Override
+      public Object resolveParameter(
+          ParameterContext parameterContext, ExtensionContext extensionContext) {
+        return withAccessId;
+      }
+    }
   }
 }

lib/taskana-core/src/test/java/pro/taskana/security/JaasExtensionTest.java

@@ -1,12 +1,25 @@
 package pro.taskana.security;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.DynamicContainer.dynamicContainer;
+import static org.junit.jupiter.api.DynamicTest.dynamicTest;
 
+import java.util.Collections;
+import java.util.Iterator;
+import java.util.List;
+import java.util.function.Supplier;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.DynamicContainer;
+import org.junit.jupiter.api.DynamicTest;
 import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestFactory;
 import org.junit.jupiter.api.TestTemplate;
 import org.junit.jupiter.api.extension.ExtendWith;
 
@@ -15,12 +28,22 @@ import pro.taskana.common.internal.security.CurrentUserContext;
 @ExtendWith(JaasExtension.class)
 public class JaasExtensionTest {
 
-  // region JaasExtension#interceptTestClassConstructor
+  private static final String INSIDE_DYNAMIC_TEST_USER = "insidedynamictest";
-  @WithAccessId(user = "constructor")
+  private static final DynamicTest NOT_NULL_DYNAMIC_TEST =
-  public JaasExtensionTest() {
+      dynamicTest("dynamic test", () -> assertThat(CurrentUserContext.getUserid()).isNotNull());
-    assertThat(CurrentUserContext.getUserid()).isEqualTo("constructor");
+  private static final DynamicTest NULL_DYNAMIC_TEST =
+      dynamicTest("dynamic test", () -> assertThat(CurrentUserContext.getUserid()).isEqualTo(null));
+  private static final DynamicTest DYNAMIC_TEST_USER_DYNAMIC_TEST =
+      dynamicTest(
+          "dynamic test",
+          () -> assertThat(CurrentUserContext.getUserid()).isEqualTo(INSIDE_DYNAMIC_TEST_USER));
+
+  // region JaasExtension#interceptBeforeAllMethod
+
+  @BeforeAll
+  static void should_NotSetJaasSubject_When_AnnotationIsMissing_On_BeforeAll() {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo(null);
   }
-  // endregion
 
   @WithAccessId(user = "beforeall")
   @BeforeAll
@@ -35,13 +58,12 @@ public class JaasExtensionTest {
     assertThat(CurrentUserContext.getUserid()).isEqualTo(null);
   }
 
-  @BeforeAll
+  // endregion
-  static void should_NotSetJaasSubject_When_AnnotationIsMissing_On_BeforeAll() {
+
-    assertThat(CurrentUserContext.getUserid()).isEqualTo(null);
+  // region JaasExtension#interceptBeforeEachMethod
-  }
 
   @BeforeEach
-  void should_NotJaasSubject_When_AnnotationIsMissing_On_BeforeEach() {
+  void should_NotSetJaasSubject_When_AnnotationIsMissing_On_BeforeEach() {
     assertThat(CurrentUserContext.getUserid()).isEqualTo(null);
   }
 
@@ -58,33 +80,649 @@ public class JaasExtensionTest {
     assertThat(CurrentUserContext.getUserid()).isEqualTo(null);
   }
 
-  @WithAccessId(user = "user")
+  // endregion
-  @Test
-  void should_SetJaasSubject_When_AnnotationExists_On_Test() {
-    assertThat(CurrentUserContext.getUserid()).isEqualTo("user");
-  }
 
-  @WithAccessId(user = "user")
+  // region JaasExtension#interceptAfterEachMethod
-  @WithAccessId(user = "user2")
+
-  @Test
+  @AfterEach
-  @Disabled("can we make this work somehow?")
+  void should_NotSetJaasSubject_When_AnnotationIsMissing_On_AfterEach() {
-  void should_NotSetJaasSubject_When_MultipleAnnotationsExist_On_Test() {
     assertThat(CurrentUserContext.getUserid()).isEqualTo(null);
   }
 
+  @WithAccessId(user = "aftereach")
+  @AfterEach
+  void should_SetJaasSubject_When_AnnotationExists_On_AfterEach() {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo("aftereach");
+  }
+
+  @WithAccessId(user = "aftereach")
+  @WithAccessId(user = "afterach2")
+  @AfterEach
+  void should_NotSetJaasSubject_When_MultipleAnnotationsExist_On_AfterEach() {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo(null);
+  }
+
+  // endregion
+
+  // region JaasExtension#interceptAfterAllMethod
+
+  @AfterAll
+  static void should_NotSetJaasSubject_When_AnnotationIsMissing_On_AfterAll() {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo(null);
+  }
+
+  @WithAccessId(user = "afterall")
+  @AfterAll
+  static void should_SetJaasSubject_When_AnnotationExists_On_AfterAll() {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo("afterall");
+  }
+
+  @WithAccessId(user = "afterall")
+  @WithAccessId(user = "afterall2")
+  @AfterAll
+  static void should_NotSetJaasSubject_When_MultipleAnnotationsExist_On_AfterAll() {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo(null);
+  }
+
+  // endregion
+
+  // region JaasExtension#interceptTestMethod
+
   @Test
   void should_NotSetJaasSubject_When_AnnotationIsMissing_On_Test() {
     assertThat(CurrentUserContext.getUserid()).isEqualTo(null);
   }
 
+  @WithAccessId(user = "user")
+  @Test
+  void should_SetJaasSubject_When_AnnotationExists_On_Test() {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo("user");
+    assertThat(CurrentUserContext.getGroupIds()).isEmpty();
+  }
+
+  @WithAccessId(
+      user = "user",
+      groups = {"hans", "peter"})
+  @Test
+  void should_SetJaasSubjectWithGroups_When_AnnotationExistsWithGroups_On_Test() {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo("user");
+    assertThat(CurrentUserContext.getGroupIds()).containsOnly("hans", "peter");
+  }
+
+  @WithAccessId(user = "user")
+  @Test
+  @Disabled("this can be tested with a org.junit.platform.launcher.TestExecutionListener")
+  void should_NotInjectParameter_When_ParameterIsPresent_On_Test(WithAccessId accessId) {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo("user");
+  }
+
+  @WithAccessId(user = "user")
+  @WithAccessId(user = "user2")
+  @Test
+  @Disabled("this can be tested with a org.junit.platform.launcher.TestExecutionListener")
+  void should_ThrowException_When_MultipleAnnotationsExist_On_Test() {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo(null);
+  }
+
+  // endregion
+
+  // region JaasExtension#interceptTestFactory
+
+  @TestFactory
+  List<DynamicTest> should_NotSetJaasSubject_When_AnnotationIsMissing_On_TestFactory() {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo(null);
+    return Collections.emptyList();
+  }
+
+  @WithAccessId(user = "testfactory")
+  @TestFactory
+  List<DynamicTest> should_SetJaasSubject_When_AnnotationExists_On_TestFactory() {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo("testfactory");
+    return Collections.emptyList();
+  }
+
+  @WithAccessId(user = "testfactory1")
+  @WithAccessId(user = "testfactory2")
+  @TestFactory
+  List<DynamicTest>
+      should_SetJaasSubjectFromFirstAnnotation_When_MultipleAnnotationsExists_On_TestFactory() {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo("testfactory1");
+    return Collections.emptyList();
+  }
+
+  // endregion
+
+  // region JaasExtension#interceptTestTemplateMethod
+
+  @TestTemplate
+  @Disabled("this can be tested with a org.junit.platform.launcher.TestExecutionListener")
+  void should_NotFindContextProvider_When_AnnotationIsMissing_On_TestTemplate() {
+    assertThat(CurrentUserContext.getUserid()).isNotNull();
+  }
+
+  @WithAccessId(user = "testtemplate")
+  @TestTemplate
+  void should_SetJaasSubject_When_AnnotationExists_On_TestTemplate() {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo("testtemplate");
+  }
+
   @WithAccessId(user = "testtemplate1")
   @WithAccessId(user = "testtemplate2")
   @WithAccessId(user = "testtemplate3")
   @TestTemplate
-  void should_SetMultipleJaasSubjects_When_MultipleAnnotationsExist_On_TestTemplate() {
+  void should_SetMultipleJaasSubjects_When_MultipleAnnotationsExist_On_TestTemplate(
-    assertThat(CurrentUserContext.getUserid()).isNotNull();
+      WithAccessId accessId) {
+    assertThat(CurrentUserContext.getUserid()).isEqualTo(accessId.user());
   }
 
+  @WithAccessId(user = "testtemplate1", groups = "abc")
+  @TestTemplate
+  void should_InjectCorrectAccessId_When_AnnotationExists_On_TestTemplate(WithAccessId accessId) {
+    assertThat(accessId.user()).isEqualTo("testtemplate1");
+    assertThat(accessId.groups()).containsOnly("abc");
+  }
+
+  // endregion
+
+  // region JaasExtension#interceptDynamicTest
+
+  // region RETURNING DynamicNode
+
+  // WITH DynamicTest
+
+  @TestFactory
+  DynamicTest should_NotSetAccessIdForDynamicTest_When_AnnotationIsMissing() {
+    return NULL_DYNAMIC_TEST;
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  DynamicTest should_SetAccessIdForDynamicTest_When_AnnotationExists() {
+    return DYNAMIC_TEST_USER_DYNAMIC_TEST;
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  DynamicTest should_SetMultipleAccessIdForDynamicTest_When_AnnotationsExist() {
+    return NOT_NULL_DYNAMIC_TEST;
+  }
+
+  // WITH DynamicContainer
+
+  @TestFactory
+  DynamicContainer
+      should_NotSetAccessIdForDynamicContainer_When_AnnotationIsMissing() {
+    return dynamicContainer("dynamic container", Stream.of(NULL_DYNAMIC_TEST, NULL_DYNAMIC_TEST));
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  DynamicContainer should_SetAccessIdForDynamicContainer_When_AnnotationExists() {
+    return dynamicContainer(
+        "dynamic container",
+        Stream.of(DYNAMIC_TEST_USER_DYNAMIC_TEST, DYNAMIC_TEST_USER_DYNAMIC_TEST));
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  DynamicContainer
+      should_SetMultipleAccessIdForDynamicContainer_When_AnnotationsExist() {
+    return dynamicContainer(
+        "dynamic container", Stream.of(NOT_NULL_DYNAMIC_TEST, NOT_NULL_DYNAMIC_TEST));
+  }
+
+  // WITH nested DynamicContainer
+
+  @TestFactory
+  DynamicContainer
+      should_NotSetAccessIdForNestedDynamicContainer_When_AnnotationIsMissing() {
+    DynamicContainer container =
+        dynamicContainer("inside container", Stream.of(NULL_DYNAMIC_TEST, NULL_DYNAMIC_TEST));
+    return dynamicContainer("outside container", Stream.of(container, NULL_DYNAMIC_TEST));
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  DynamicContainer
+      should_SetAccessIdForNestedDynamicContainer_When_AnnotationExists() {
+    DynamicContainer container =
+        dynamicContainer(
+            "nested container",
+            Stream.of(DYNAMIC_TEST_USER_DYNAMIC_TEST, DYNAMIC_TEST_USER_DYNAMIC_TEST));
+    return dynamicContainer(
+        "outside container", Stream.of(container, DYNAMIC_TEST_USER_DYNAMIC_TEST));
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  DynamicContainer
+      should_SetMultipleAccessIdForNestedDynamicContainer_When_AnnotationsExist() {
+    DynamicContainer container =
+        dynamicContainer(
+            "inside container", Stream.of(NOT_NULL_DYNAMIC_TEST, NOT_NULL_DYNAMIC_TEST));
+    return dynamicContainer("outside container", Stream.of(container, NOT_NULL_DYNAMIC_TEST));
+  }
+
+  // endregion
+
+  // region RETURNING Stream<DynamicNode>
+
+  @TestFactory
+  Stream<DynamicTest>
+      should_NotSetAccessIdForDynamicTestInStream_When_AnnotationIsMissing() {
+    return Stream.of(NULL_DYNAMIC_TEST, NULL_DYNAMIC_TEST);
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Stream<DynamicTest>
+      should_SetAccessIdForDynamicTestInStream_When_AnnotationExists() {
+    return Stream.of(DYNAMIC_TEST_USER_DYNAMIC_TEST, DYNAMIC_TEST_USER_DYNAMIC_TEST);
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Stream<DynamicTest>
+      should_SetMultipleAccessIdForDynamicTestInStream_When_AnnotationsExist() {
+    return Stream.of(NOT_NULL_DYNAMIC_TEST, NOT_NULL_DYNAMIC_TEST);
+  }
+
+  // WITH DynamicContainer
+
+  @TestFactory
+  Stream<DynamicContainer>
+      should_NotSetAccessIdForDynamicContainerInStream_When_AnnotationIsMissing() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer("dynamic container", Stream.of(NULL_DYNAMIC_TEST, NULL_DYNAMIC_TEST));
+    return Stream.generate(supplier).limit(2);
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Stream<DynamicContainer>
+      should_SetAccessIdForDynamicContainerInStream_When_AnnotationExists() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "dynamic container",
+                Stream.of(DYNAMIC_TEST_USER_DYNAMIC_TEST, DYNAMIC_TEST_USER_DYNAMIC_TEST));
+    return Stream.generate(supplier).limit(2);
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Stream<DynamicContainer>
+      should_SetMultipleAccessIdForDynamicContainerInStream_When_AnnotationsExist() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "dynamic container", Stream.of(NOT_NULL_DYNAMIC_TEST, NOT_NULL_DYNAMIC_TEST));
+    return Stream.generate(supplier).limit(2);
+  }
+
+  // WITH nested DynamicContainer
+
+  @TestFactory
+  Stream<DynamicContainer>
+      should_NotSetAccessIdForNestedDynamicContainerInStream_When_AnnotationIsMissing() {
+    Supplier<DynamicContainer> supplier =
+        () -> dynamicContainer("inside container", Stream.of(NULL_DYNAMIC_TEST, NULL_DYNAMIC_TEST));
+    Supplier<DynamicContainer> outsideSupplier =
+        () -> dynamicContainer("outside container", Stream.of(supplier.get(), NULL_DYNAMIC_TEST));
+    return Stream.generate(outsideSupplier).limit(2);
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Stream<DynamicContainer>
+      should_SetAccessIdForNestedDynamicContainerInStream_When_AnnotationExists() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "inside container",
+                Stream.of(DYNAMIC_TEST_USER_DYNAMIC_TEST, DYNAMIC_TEST_USER_DYNAMIC_TEST));
+    Supplier<DynamicContainer> outsideSupplier =
+        () ->
+            dynamicContainer(
+                "outside container", Stream.of(supplier.get(), DYNAMIC_TEST_USER_DYNAMIC_TEST));
+    return Stream.generate(outsideSupplier).limit(2);
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Stream<DynamicContainer>
+      should_SetMultipleAccessIdForNestedDynamicContainerInStream_When_AnnotationsExist() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "inside container", Stream.of(NOT_NULL_DYNAMIC_TEST, NOT_NULL_DYNAMIC_TEST));
+    Supplier<DynamicContainer> outsideSupplier =
+        () ->
+            dynamicContainer("outside container", Stream.of(supplier.get(), NOT_NULL_DYNAMIC_TEST));
+    return Stream.generate(outsideSupplier).limit(2);
+  }
+
+  // endregion
+
+  // region RETURNING Iterable<DynamicNode>
+
+  @TestFactory
+  Iterable<DynamicTest>
+      should_NotSetAccessIdForDynamicTestInIterable_When_AnnotationIsMissing() {
+    return Stream.of(NULL_DYNAMIC_TEST, NULL_DYNAMIC_TEST).collect(Collectors.toList());
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Iterable<DynamicTest>
+      should_SetAccessIdForDynamicTestInIterable_When_AnnotationExists() {
+    return Stream.of(DYNAMIC_TEST_USER_DYNAMIC_TEST, DYNAMIC_TEST_USER_DYNAMIC_TEST)
+        .collect(Collectors.toList());
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Iterable<DynamicTest>
+      should_SetMultipleAccessIdForDynamicTestInIterable_When_AnnotationsExist() {
+    return Stream.of(NOT_NULL_DYNAMIC_TEST, NOT_NULL_DYNAMIC_TEST).collect(Collectors.toList());
+  }
+
+  // WITH DynamicContainer
+
+  @TestFactory
+  Iterable<DynamicContainer>
+      should_NotSetAccessIdForDynamicContainerInIterable_When_AnnotationIsMissing() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer("dynamic container", Stream.of(NULL_DYNAMIC_TEST, NULL_DYNAMIC_TEST));
+    return Stream.generate(supplier).limit(2).collect(Collectors.toList());
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Iterable<DynamicContainer>
+      should_SetAccessIdForDynamicContainerInIterable_When_AnnotationExists() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "dynamic container",
+                Stream.of(DYNAMIC_TEST_USER_DYNAMIC_TEST, DYNAMIC_TEST_USER_DYNAMIC_TEST));
+    return Stream.generate(supplier).limit(2).collect(Collectors.toList());
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Iterable<DynamicContainer>
+      should_SetMultipleAccessIdForDynamicContainerInIterable_When_AnnotationsExist() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "dynamic container", Stream.of(NOT_NULL_DYNAMIC_TEST, NOT_NULL_DYNAMIC_TEST));
+    return Stream.generate(supplier).limit(2).collect(Collectors.toList());
+  }
+
+  // WITH nested DynamicContainer
+
+  @TestFactory
+  Iterable<DynamicContainer>
+      should_NotSetAccessIdForNestedDynamicContainerInIterable_When_AnnotationIsMissing() {
+    Supplier<DynamicContainer> supplier =
+        () -> dynamicContainer("inside container", Stream.of(NULL_DYNAMIC_TEST, NULL_DYNAMIC_TEST));
+    Supplier<DynamicContainer> outsideSupplier =
+        () -> dynamicContainer("outside container", Stream.of(supplier.get(), NULL_DYNAMIC_TEST));
+    return Stream.generate(outsideSupplier).limit(2).collect(Collectors.toList());
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Iterable<DynamicContainer>
+      should_SetAccessIdForNestedDynamicContainerInIterable_When_AnnotationExists() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "inside container",
+                Stream.of(DYNAMIC_TEST_USER_DYNAMIC_TEST, DYNAMIC_TEST_USER_DYNAMIC_TEST));
+    Supplier<DynamicContainer> outsideSupplier =
+        () ->
+            dynamicContainer(
+                "outside container", Stream.of(supplier.get(), DYNAMIC_TEST_USER_DYNAMIC_TEST));
+    return Stream.generate(outsideSupplier).limit(2).collect(Collectors.toList());
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Iterable<DynamicContainer>
+      should_SetMultipleAccessIdForNestedDynamicContainerInIterable_When_AnnotationsExist() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "inside container", Stream.of(NOT_NULL_DYNAMIC_TEST, NOT_NULL_DYNAMIC_TEST));
+    Supplier<DynamicContainer> outsideSupplier =
+        () ->
+            dynamicContainer("outside container", Stream.of(supplier.get(), NOT_NULL_DYNAMIC_TEST));
+    return Stream.generate(outsideSupplier).limit(2).collect(Collectors.toList());
+  }
+
+  // endregion
+
+  // region RETURNING Iterator<DynamicNode>
+
+  @TestFactory
+  Iterator<DynamicTest>
+      should_NotSetAccessIdForDynamicTestInIterator_When_AnnotationIsMissing() {
+    return Stream.of(NULL_DYNAMIC_TEST, NULL_DYNAMIC_TEST).iterator();
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Iterator<DynamicTest>
+      should_SetAccessIdForDynamicTestInIterator_When_AnnotationExists() {
+    return Stream.of(DYNAMIC_TEST_USER_DYNAMIC_TEST, DYNAMIC_TEST_USER_DYNAMIC_TEST).iterator();
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Iterator<DynamicTest>
+      should_SetMultipleAccessIdForDynamicTestInIterator_When_AnnotationsExist() {
+    return Stream.of(NOT_NULL_DYNAMIC_TEST, NOT_NULL_DYNAMIC_TEST).iterator();
+  }
+
+  // WITH DynamicContainer
+
+  @TestFactory
+  Iterator<DynamicContainer>
+      should_NotSetAccessIdForDynamicContainerInIterator_When_AnnotationIsMissing() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer("dynamic container", Stream.of(NULL_DYNAMIC_TEST, NULL_DYNAMIC_TEST));
+    return Stream.generate(supplier).limit(2).iterator();
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Iterator<DynamicContainer>
+      should_SetAccessIdForDynamicContainerInIterator_When_AnnotationExists() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "dynamic container",
+                Stream.of(DYNAMIC_TEST_USER_DYNAMIC_TEST, DYNAMIC_TEST_USER_DYNAMIC_TEST));
+    return Stream.generate(supplier).limit(2).iterator();
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Iterator<DynamicContainer>
+      should_SetMultipleAccessIdForDynamicContainerInIterator_When_AnnotationsExist() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "dynamic container", Stream.of(NOT_NULL_DYNAMIC_TEST, NOT_NULL_DYNAMIC_TEST));
+    return Stream.generate(supplier).limit(2).iterator();
+  }
+
+  // WITH nested DynamicContainer
+
+  @TestFactory
+  Iterator<DynamicContainer>
+      should_NotSetAccessIdForNestedDynamicContainerInIterator_When_AnnotationIsMissing() {
+    Supplier<DynamicContainer> supplier =
+        () -> dynamicContainer("inside container", Stream.of(NULL_DYNAMIC_TEST, NULL_DYNAMIC_TEST));
+    Supplier<DynamicContainer> outsideSupplier =
+        () -> dynamicContainer("outside container", Stream.of(supplier.get(), NULL_DYNAMIC_TEST));
+    return Stream.generate(outsideSupplier).limit(2).iterator();
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Iterator<DynamicContainer>
+      should_SetAccessIdForNestedDynamicContainerInIterator_When_AnnotationExists() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "inside container",
+                Stream.of(DYNAMIC_TEST_USER_DYNAMIC_TEST, DYNAMIC_TEST_USER_DYNAMIC_TEST));
+    Supplier<DynamicContainer> outsideSupplier =
+        () ->
+            dynamicContainer(
+                "outside container", Stream.of(supplier.get(), DYNAMIC_TEST_USER_DYNAMIC_TEST));
+    return Stream.generate(outsideSupplier).limit(2).iterator();
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  Iterator<DynamicContainer>
+      should_SetMultipleAccessIdForNestedDynamicContainerInIterator_When_AnnotationsExist() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "inside container", Stream.of(NOT_NULL_DYNAMIC_TEST, NOT_NULL_DYNAMIC_TEST));
+    Supplier<DynamicContainer> outsideSupplier =
+        () ->
+            dynamicContainer("outside container", Stream.of(supplier.get(), NOT_NULL_DYNAMIC_TEST));
+    return Stream.generate(outsideSupplier).limit(2).iterator();
+  }
+
+  // endregion
+
+  // region RETURNING DynamicNode[]
+
+  @TestFactory
+  DynamicTest[]
+      should_NotSetAccessIdForDynamicTestInArray_When_AnnotationIsMissing() {
+    return Stream.of(NULL_DYNAMIC_TEST, NULL_DYNAMIC_TEST).toArray(DynamicTest[]::new);
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  DynamicTest[] should_SetAccessIdForDynamicTestInArray_When_AnnotationExists() {
+    return Stream.of(DYNAMIC_TEST_USER_DYNAMIC_TEST, DYNAMIC_TEST_USER_DYNAMIC_TEST)
+        .toArray(DynamicTest[]::new);
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  DynamicTest[]
+      should_SetMultipleAccessIdForDynamicTestInArray_When_AnnotationsExist() {
+    return Stream.of(NOT_NULL_DYNAMIC_TEST, NOT_NULL_DYNAMIC_TEST).toArray(DynamicTest[]::new);
+  }
+
+  // WITH DynamicContainer
+
+  @TestFactory
+  DynamicContainer[]
+      should_NotSetAccessIdForDynamicContainerInArray_When_AnnotationIsMissing() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer("dynamic container", Stream.of(NULL_DYNAMIC_TEST, NULL_DYNAMIC_TEST));
+    return Stream.generate(supplier).limit(2).toArray(DynamicContainer[]::new);
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  DynamicContainer[]
+      should_SetAccessIdForDynamicContainerInArray_When_AnnotationExists() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "dynamic container",
+                Stream.of(DYNAMIC_TEST_USER_DYNAMIC_TEST, DYNAMIC_TEST_USER_DYNAMIC_TEST));
+    return Stream.generate(supplier).limit(2).toArray(DynamicContainer[]::new);
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  DynamicContainer[]
+      should_SetMultipleAccessIdForDynamicContainerInArray_When_AnnotationsExist() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "dynamic container", Stream.of(NOT_NULL_DYNAMIC_TEST, NOT_NULL_DYNAMIC_TEST));
+    return Stream.generate(supplier).limit(2).toArray(DynamicContainer[]::new);
+  }
+
+  // WITH nested DynamicContainer
+
+  @TestFactory
+  DynamicContainer[]
+      should_NotSetAccessIdForNestedDynamicContainerInArray_When_AnnotationIsMissing() {
+    Supplier<DynamicContainer> supplier =
+        () -> dynamicContainer("inside container", Stream.of(NULL_DYNAMIC_TEST, NULL_DYNAMIC_TEST));
+    Supplier<DynamicContainer> outsideSupplier =
+        () -> dynamicContainer("outside container", Stream.of(supplier.get(), NULL_DYNAMIC_TEST));
+    return Stream.generate(outsideSupplier).limit(2).toArray(DynamicContainer[]::new);
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  DynamicContainer[]
+      should_SetAccessIdForNestedDynamicContainerInArray_When_AnnotationExists() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "inside container",
+                Stream.of(DYNAMIC_TEST_USER_DYNAMIC_TEST, DYNAMIC_TEST_USER_DYNAMIC_TEST));
+    Supplier<DynamicContainer> outsideSupplier =
+        () ->
+            dynamicContainer(
+                "outside container", Stream.of(supplier.get(), DYNAMIC_TEST_USER_DYNAMIC_TEST));
+    return Stream.generate(outsideSupplier).limit(2).toArray(DynamicContainer[]::new);
+  }
+
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @WithAccessId(user = INSIDE_DYNAMIC_TEST_USER)
+  @TestFactory
+  DynamicContainer[]
+      should_SetMultipleAccessIdForNestedDynamicContainerInArray_When_AnnotationsExist() {
+    Supplier<DynamicContainer> supplier =
+        () ->
+            dynamicContainer(
+                "inside container", Stream.of(NOT_NULL_DYNAMIC_TEST, NOT_NULL_DYNAMIC_TEST));
+    Supplier<DynamicContainer> outsideSupplier =
+        () ->
+            dynamicContainer("outside container", Stream.of(supplier.get(), NOT_NULL_DYNAMIC_TEST));
+    return Stream.generate(outsideSupplier).limit(2).toArray(DynamicContainer[]::new);
+  }
+
+  // endregion
+
+  // region JaasExtension#interceptTestClassConstructor
+
   @Nested
   class ConstructorWithoutAccessId {
     ConstructorWithoutAccessId() {
@@ -109,4 +747,8 @@ public class JaasExtensionTest {
       assertThat(CurrentUserContext.getUserid()).isNull();
     }
   }
+
+  // endregion
+
+  // endregion
 }