如何在 Spring Boot 2 中禁用管理端口的安全性 [英] How to disable security on management port in Spring Boot 2

问题描述

我在端口 6565 上有 /actuator/ 端点(在我的情况下为 ma​​nage).是否可以仅对特定端口禁用 Spring Boot 2 中的安全性?目前我只能从安全中排除某些路径.如果我现在在/manage/下的主应用程序端口 1337 下运行 Enpoints，那将是不安全的.过去我们使用了 ma​​nagement.security.enabled: false 还是该路径也相关?

I have the /actuator/ Endpoints (in my case manage) on Port 6565. Is it possible to disable Security in Spring Boot 2 only for a specific port? At the moment I can only exclude certain paths from security. That would be insecure if I now run Enpoints under the main application port 1337 under /manage/. In the past we used management.security.enabled: false or was that path related too?

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers("/manage/**").permitAll()
                .anyRequest().authenticated().and().httpBasic().realmName("Hay, the Config Server is here");

    }
}

应用程序.yml

spring:
  cloud:
    config:
      server:
        git:
          uri: https://bitbucket.xxx.net/scm/gpi/springconfiguration.git
          username: xxx
          password: xxx
          searchPaths: application-*
          force-pull: true
  security:
    user:
      name: xxxUser
      password: xxx
server:
  port: 1337
  address: 0.0.0.0
management:
    server:
      port: 6565
    metrics:
      export:
        prometheus:
          enabled: true
    endpoints:
      web:
        exposure:
          include: '*'
        base-path: /manage
    endpoint:
      prometheus:
        enabled: true

推荐答案

我最终将其作为在这里找到的有效解决方案 如何告诉 spring security 只为特定端口应用授权请求?

I ended up with this as a working solution found here How can I tell spring security to apply authorizeRequests just for a specific port?

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${management.server.port}")
    private int managementPort;

    @Value("${server.port}")
    private int apiPort;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .requestMatchers(forPortAndPath(managementPort, "/manage/**")).permitAll()
                .anyRequest().authenticated().and().httpBasic().realmName("Hay, the Config Server is here");

    }

    private RequestMatcher forPortAndPath(final int port, final String pathPattern) {
        return new AndRequestMatcher(forPort(port), new AntPathRequestMatcher(pathPattern));
    }

    private RequestMatcher forPortAndPath(final int port, final HttpMethod method,
                                          final String pathPattern) {
        return new AndRequestMatcher(forPort(port), new AntPathRequestMatcher(pathPattern, method.name()));
    }

    private RequestMatcher forPort(final int port) {
        return (HttpServletRequest request) -> port == request.getLocalPort();
    }

另一种解决方案是添加到 WebSecurity 的路径

Another Solution is to add the paths to the WebSecurity

@Value("${management.server.port:6565}")
private int managementPort;

@Value("${management.endpoints.web.base-path:/manage}")
private String managementPath;


@Override
public void configure(WebSecurity web) {
    if (securityConfiguration.getAuthenticationScenario()
            .equals(HwlPortalAuthenticationScenario.DISABLE_SECURITY)) {
        web.ignoring().antMatchers("/**");
    } else {
        web.ignoring().antMatchers(securityConfiguration.securityDisabledPaths().toArray(new String[]{}))
                .requestMatchers(forPortAndPath(managementPort,managementPath + "/**"));
    }
}

这篇关于如何在 Spring Boot 2 中禁用管理端口的安全性的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！