How to disable security on management port in Spring Boot 2

问题

I have the /actuator/ Endpoints (in my case manage) on Port 6565. Is it possible to disable Security in Spring Boot 2 only for a specific port? At the moment I can only exclude certain paths from security. That would be insecure if I now run Enpoints under the main application port 1337 under /manage/. In the past we used management.security.enabled: false or was that path related too?

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers("/manage/**").permitAll()
                .anyRequest().authenticated().and().httpBasic().realmName("Hay, the Config Server is here");

    }
}

application.yml

spring:
  cloud:
    config:
      server:
        git:
          uri: https://bitbucket.xxx.net/scm/gpi/springconfiguration.git
          username: xxx
          password: xxx
          searchPaths: application-*
          force-pull: true
  security:
    user:
      name: xxxUser
      password: xxx
server:
  port: 1337
  address: 0.0.0.0
management:
    server:
      port: 6565
    metrics:
      export:
        prometheus:
          enabled: true
    endpoints:
      web:
        exposure:
          include: '*'
        base-path: /manage
    endpoint:
      prometheus:
        enabled: true

回答1:

I ended up with this as a working solution found here How can I tell spring security to apply authorizeRequests just for a specific port?

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${management.server.port}")
    private int managementPort;

    @Value("${server.port}")
    private int apiPort;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .requestMatchers(forPortAndPath(managementPort, "/manage/**")).permitAll()
                .anyRequest().authenticated().and().httpBasic().realmName("Hay, the Config Server is here");

    }

    private RequestMatcher forPortAndPath(final int port, final String pathPattern) {
        return new AndRequestMatcher(forPort(port), new AntPathRequestMatcher(pathPattern));
    }

    private RequestMatcher forPortAndPath(final int port, final HttpMethod method,
                                          final String pathPattern) {
        return new AndRequestMatcher(forPort(port), new AntPathRequestMatcher(pathPattern, method.name()));
    }

    private RequestMatcher forPort(final int port) {
        return (HttpServletRequest request) -> port == request.getLocalPort();
    }

Another Solution is to add the paths to the WebSecurity

@Value("${management.server.port:6565}")
private int managementPort;

@Value("${management.endpoints.web.base-path:/manage}")
private String managementPath;


@Override
public void configure(WebSecurity web) {
    if (securityConfiguration.getAuthenticationScenario()
            .equals(HwlPortalAuthenticationScenario.DISABLE_SECURITY)) {
        web.ignoring().antMatchers("/**");
    } else {
        web.ignoring().antMatchers(securityConfiguration.securityDisabledPaths().toArray(new String[]{}))
                .requestMatchers(forPortAndPath(managementPort,managementPath + "/**"));
    }
}

来源：https://stackoverflow.com/questions/51044189/how-to-disable-security-on-management-port-in-spring-boot-2

标签

Spring

spring-boot

spring-security