Spring引导执行器：使用JWT访问敏感管理endpoint

Question

我已经通过浏览器中的令牌读取访问敏感的Spring引导执行器endpoint，因为它接近我需要的，但我不一定需要浏览器，这个问题没有答案。

与教程相反，我在pom.xml中包含了spring-boot-starter-actuator作为依赖项。

我的application.properties如下所示：

logging.level=DEBUG
server.port=9191
endpoints.health.enabled=true
endpoints.health.sensitive=false
endpoints.shutdown.enabled=true
endpoints.shutdown.sensitive=true
management.contextPath: /manage
management.security.enabled=true

我的AccountUserDetailsService如下所示：

package com.divstar.particle.authservice.rest;
import java.text.MessageFormat;

import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

@Service
public class AccountUserDetailsService implements UserDetailsService {

    private final IAccountRepository accountRepository;

    public AccountUserDetailsService(final IAccountRepository accountRepository) {
        this.accountRepository = accountRepository;
    }

    @Override
    public UserDetails loadUserByUsername(final String username) {
        return accountRepository.findByUsername(username)
                                .map(account -> new User(account.getUsername(), account.getPassword(), account.isEnabled(),
                                        account.isNonExpired(), account.isCredentialsNonExpired(), account.isNonLocked(),
                                        AuthorityUtils.createAuthorityList("ROLE_ADMIN", "ROLE_USER", "ROLE_ACTUATOR")))
                                .orElseThrow(() -> new UsernameNotFoundException(
                                        MessageFormat.format("Could not find the user {0}!", username)));
    }
}

我包含了角色“role_actuator”，因为这似乎是actuator访问管理服务endpoint所需要的。

主应用程序类看起来相当简单：

package com.divstar.particle.authservice;

import java.util.stream.Stream;

import org.springframework.boot.CommandLineRunner;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;

import com.divstar.particle.authservice.rest.Account;
import com.divstar.particle.authservice.rest.IAccountRepository;

@SpringBootApplication
public class Application {
    @Bean
    CommandLineRunner initUsers(final IAccountRepository userRepository) {
        return args -> Stream.of("test,long", "blame,short", "pass,secure")
                             .map(tpl -> tpl.split(","))
                             .forEach(tpl -> userRepository.save(new Account(tpl[0], tpl[1], "[e-mail]", true, true, true, true)));
    }

    public static void main(final String[] args) {
        SpringApplication.run(Application.class, args);
    }
}

IAccountRepository扩展了JpaRepository并定义了“FindByUserName”，它返回可选的。

我的AuthorizationServerConfigurationAdapter如下所示：

package com.divstar.particle.authservice;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;

@Configuration
@EnableAuthorizationServer
public class AuthServiceConfiguration extends AuthorizationServerConfigurerAdapter {
    private final AuthenticationManager authenticationManager;

    public AuthServiceConfiguration(final AuthenticationManager authenticationManager) {
        super();
        this.authenticationManager = authenticationManager;
    }

    @Override
    public void configure(final ClientDetailsServiceConfigurer clients) throws Exception {
        clients
               .inMemory()
               .withClient("html5")
               .secret("clientsecret")
               .authorizedGrantTypes("password")
               .scopes("openid");
    }

    @Override
    public void configure(final AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.authenticationManager(authenticationManager);
    }
}

启动身份验证服务器后，我使用以下cURL-command获取令牌：

 curl html5:clientsecret@localhost:9191/oauth/token -d grant_type=password -d username=test -d password=long

它在JSON应答中返回access_token以及进一步的信息。

但是，如果我尝试访问敏感endpoint（例如/manage/shutdown)，如下所示：

curl -X POST -H"Authorization: bearer b8412762-af80-4b7d-9eb9-3fa472dd37c9" localhost:9191/manage/shutdown

我收到以下错误消息：

{“时间戳”：1508029184236,“状态”：401,“错误”：“未经授权”,“消息”：“访问此资源需要完全身份验证”,“路径”：“/manage/shutdown”}

我漏掉了什么/做错了什么？如果令牌有效（给定适当的权限/角色），我如何让spring-boot actuator识别JWTs并执行给定的敏感endpoint？

Answer 1

根据您共享的信息，看起来您实际上并没有告诉Spring使用您自定义的UserDetailsService。为此，必须有一个扩展WebSecurityConfigurerAdapter的类，然后重写configure(AuthenticationManagerBuilder auth)方法，如下所示：

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  auth.userDetailsService(customUserDetailsService);
}

有关OAuth2和自定义UserDetailsService的更多信息，请参见此处:https://stackoverflow.com/a/43245998/1320627

确保正确配置用户详细信息服务的最简单方法是添加一个RESTendpoint，使用身份验证进行保护，然后尝试使用它。