Spring Boot2中针对执行器和自定义APIendpoint的独立身份验证提供程序

Question

我们有一个spring boot应用程序（spring boot 2.1.4版），它公开了一个用Oauth2保护的Rest API。
我们还需要将spring boot提供的健康检查（致动器）endpoint公开给一个只支持基本身份验证的遗留监控工具。
但是，由于spring boot 2与常规应用程序安全规则共享安全配置，所以到目前为止我能看到的唯一选项是用Oauth2保护它或者不保护它(.PermitAll())。

我尝试使用单独的WebSecurityConfigurerAdapter为执行器endpoint设置httpBasic身份验证提供程序，为APIendpoint设置oauth2，同时使用execution@order，但这两个身份验证提供程序似乎是互斥的。

下面是两个WebSecurityConfigurerAdapter实现：

1. 执行器:

@Configuration
@Order(1)
public class ActuatorConfigurationAdapter extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("admin").password("password")
                .roles("ADMIN", "USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
//                requestMatchers(EndpointRequest.to(MetricsEndpoint.class))
        .antMatchers("/actuator/**")
                .hasAnyRole("ADMIN","USER").and().authorizeRequests().and().httpBasic();
    }
}

@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
@Order(10)
public class SecurityConfiguration2 extends WebSecurityConfigurerAdapter {
    @Autowired
    private CorsFilter corsFilter;

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .cors()
        .and()
            .addFilterBefore(corsFilter, CsrfFilter.class)
            .exceptionHandling()
            .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
        .and()
            .headers()
        .and()
            .authorizeRequests()
            .antMatchers("/v2/api-docs").permitAll()
            .antMatchers("/authenticate").permitAll()
            .antMatchers("/customer/**").hasAuthority("MARKETING")
            .anyRequest().authenticated()
        .and()
            .oauth2Login() // generates the /login page
            .successHandler(successHandler())
            ...
    }

Answer 1

我有相同的用途，这对我来说是有效的：

@EnableWebSecurity()
@EnableGlobalMethodSecurity(
    securedEnabled = true,
    prePostEnabled = true
)
public class WebSecurityConfig {


   @Configuration
   @Order(3)
   public static class ActuatorSecurityAdapter extends WebSecurityConfigurerAdapter {

   @Autowired
   private AppProperties prop;

   @Override
   protected void configure(HttpSecurity http) throws Exception {
    http
        .requestMatcher(EndpointRequest.toAnyEndpoint())
        .authorizeRequests()
        .requestMatchers(EndpointRequest.to("info","env")).authenticated()
        .requestMatchers(EndpointRequest.to("health")).permitAll()
        .anyRequest().hasRole("ADMIN") // Any other endpoint
        .and()
        .httpBasic();
  }

  @Bean
  public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
  }

  @Bean
  @Override
  public UserDetailsService userDetailsService() {
    InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
    manager.createUser(User.withUsername(prop.getManagement().getUsername())
     .password(prop.getManagement().getPassword()).roles("ACTUATOR").build());
    return manager;
    }
  }


  [....]

  @Configuration
  @Order(1)
  public class OAuthSecurityConfig extends WebSecurityConfigurerAdapter {

  [...]
}

（也许有帮助：）