Spring boot oauth2管理httpbasic身份验证

Question

management.context-path=/admin/actuators
management.security.enabled=true
management.security.role=ADMIN

security.user.name=admin
security.user.password=password

<oauth>
<error_description>
Full authentication is required to access this resource
</error_description>
<error>unauthorized</error>
</oauth>

让OAUTH2和管理endpoint工作的正确方法是什么？

Answer 1

问题是@enableResourceServer导入的ResourceServerConfiguration的阶数为3，远高于ManagementServerProperties.access_override_order。
有关执行器安全性和排序配置类的Spring Boot文档:http://docs.Spring.io/spring-boot/docs/1.4.3.release/reference/htmlsingle/#boot-features-security-actactor

默认的执行器安全配置比只允许访问/healtendpoint并阻止其馀endpoint要聪明得多，它实际上会根据management.port和management.contextpath进行更改，而且要找到正确的管理endpointURL，而不给您的安全性留下漏洞或扰乱您自己的资源可能会非常困难。

如果要保持自动配置的管理安全性的优点,请选择两个选项：

@Component
@Slf4j
public class ResourceServerConfigurationPostProcessor implements BeanPostProcessor {

    @Override
    public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
        if (bean instanceof ResourceServerConfiguration) {
            LOGGER.debug("Lowering order of ResourceServerConfiguration bean : {}", beanName);
            ResourceServerConfiguration config = (ResourceServerConfiguration) bean;
            config.setOrder(SecurityProperties.ACCESS_OVERRIDE_ORDER);
        }
        return bean;
    }

    @Override
    public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
        return bean;
    }

}

/** 
 * Extend the default resource server config class, and downgrade its order
 */
public class ResourceServerLowPrecedenceConfiguration extends ResourceServerConfiguration {

     /**
     * This is enough to override Spring Boot's default resource security,
     * but it does not takes over the management.
     */
    @Override
    public int getOrder() {
        return SecurityProperties.ACCESS_OVERRIDE_ORDER;
    }
}

和您自己的配置类：

/** @EnableResourceServer is replaced by @Import using the low precedence config */
@Configuration
@Import(ResourceServerLowPrecedenceConfiguration.class)
public class YourOwnOAuth2Config extends ResourceServerConfigurerAdapter {
    @Override
    public void configure(final HttpSecurity http) throws Exception {
        // Secure your resources using OAuth 2.0 here
    }
}

编辑：您还可以重写自己的@enableResourceServer批注，以快捷方式执行@import:

@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
@Documented
@Import(ResourceServerLowPrecedenceConfiguration.class)
public @interface EnableResourceServer {
}

IMHO当spring-security-oauth位于类路径上时，这应该是默认行为。
请参阅关于GitHub问题的讨论：https://GitHub.com/spring-projects/spring-boot/issues/5072