如何在Spring Boot应用程序中关闭Spring Security [英] How to turn off Spring Security in Spring Boot Application

问题描述

我已经在带有Spring Security的Spring Boot应用程序中实现了身份验证.

I have implemented authentication in my Spring Boot Application with Spring Security.

控制身份验证的主要类应为websecurityconfig:

The main class controlling authentication should be websecurityconfig:

@Configuration
@EnableWebSecurity
@PropertySource(value = { "classpath:/config/application.properties" })
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {


    @Autowired
    private RestAuthenticationSuccessHandler authenticationSuccessHandler;
    @Autowired
    private RestAuthenticationEntryPoint restAuthenticationEntryPoint;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
          .httpBasic()
            .and()
            .csrf().disable()
            .sessionManagement().sessionCreationPolicy(
                    SessionCreationPolicy.STATELESS)
            .and()
            .exceptionHandling()
            .authenticationEntryPoint(restAuthenticationEntryPoint)
            .and()
            .authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/login").permitAll()
                .antMatchers("/logout").permitAll()
                .antMatchers("/ristore/**").authenticated()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .successHandler(authenticationSuccessHandler)
                .failureHandler(new SimpleUrlAuthenticationFailureHandler());
    }

由于我正在执行OAuth，因此我也有AuthServerConfig和ResourceServerConfig.我的主要应用程序类如下:

Since I am doing OAuth, I have AuthServerConfig and ResourceServerConfig as well. My main application class looks like this:

@SpringBootApplication
@EnableSpringDataWebSupport
@EntityScan({"org.mdacc.ristore.fm.models"}) 
public class RistoreWebApplication extends SpringBootServletInitializer
{
   @Bean
    public WebMvcConfigurer corsConfigurer() {
        return new WebMvcConfigurerAdapter() {
            @Override
            public void addCorsMappings(CorsRegistry registry) {
                registry.addMapping("/**").allowedOrigins("*");
            }
        };
    }
    public static void main( String[] args )
    {
        SpringApplication.run(RistoreWebApplication.class, args);
    }

    protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
         return application.sources(RistoreWebApplication.class);
     }
}

由于我们正在进行代码合并，因此我们需要暂时关闭身份验证.但是，我尝试了以下方法，但似乎没有任何效果.当我点击这些其余的api URL时，我仍然得到401.

Since we are doing code consolidation, we need to turn off authentication temporarily. However, I tried the following methods and nothing seems to work. I am still getting 401 when I hit these rest api urls.

1. 注释掉与安全相关的类中的所有注释，包括@Configuration，@EnableWebSecurity.在 Spring boot Security Disable security 中，建议在底部添加@EnableWebSecurity禁用身份验证，我认为这没有任何意义.无论如何都尝试过，没有用.

1. Comment out all the annotations in classes related to security including @Configuration, @EnableWebSecurity. In Spring boot Security Disable security, it was suggested at the bottom adding @EnableWebSecurity will DISABLE auth which I don't think make any sense. Tried it anyway, did not work.

通过删除所有安全性内容来修改websecurityconfig，并且只能执行 http .authorizeRequests() .anyRequest().permitAll();

Modify websecurityconfig by removing all the security stuff and only do http .authorizeRequests() .anyRequest().permitAll();

在使用Spring Security Java配置时禁用基本身份验证.也无济于事.

1. 删除安全性自动配置

1. Remove security auto config

@EnableAutoConfiguration(排除= { org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration.class， org.springframework.boot.actuate.autoconfigure.ManagementSecurityAutoConfiguration.class})

@EnableAutoConfiguration(exclude = { org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration.class, org.springframework.boot.actuate.autoconfigure.ManagementSecurityAutoConfiguration.class})

就像他们在在Spring Boot应用程序中禁用Spring Security一样.但是我认为此功能仅适用于我没有的spring-boot-actuator.所以不要尝试这个.

like what they did in disabling spring security in spring boot app. However I think this feature only works with spring-boot-actuator which I don't have. So didn't try this.

禁用Spring安全性的正确方法是什么?

What is the correct way disable spring security?

推荐答案

正如@Maciej Walkowiak所述，您应该在您的主类中这样做:

As @Maciej Walkowiak mentioned, you should do this for your main class:

@SpringBootApplication(exclude = org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration.class)
public class MainClass {

这篇关于如何在Spring Boot应用程序中关闭Spring Security的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！