将Swagger UI限制为特定角色

Question

我试图将对Swagger用户界面(UI)的访问限制为特定角色（例如，Swagger API用户、系统管理员用户等）

我在这个SO问题中尝试了答案--限制对Swagger UI的访问

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    /**
     * XLogger.
     */
    private static final XLogger LOG = XLoggerFactory.getXLogger(WebSecurityConfig.class);

    @Value("${my.property.allowedOrigins}")
    private String[] corsAllowedOrigins;

    @Value("${my.property.excludeUrlPattern}")
    private String[] excludeUrlPattern;

    @Autowired
    ApplicationContext applicationContext;

    /**
     * The AuthenticationSuccessHandler.
     */
    @Autowired
    HSSAuthenticationSuccessHandler authenticationSuccessHandler;

    /**
     * The runtime properties
     */
    @Autowired
    RuntimeProperties runtimeProperties;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        LOG.entry(http);

        String[] noAuthPermitAllPatterns = runtimeProperties.getApplicationProperties().getNoAuthPermitAllPatterns();

        http.authorizeRequests()
                .antMatchers("/swagger-ui/**", "/**/swagger-ui/**", "/v3/api-docs/**", "/**/v3/api-docs/**")
                .hasRole("ADMIN").antMatchers(noAuthPermitAllPatterns).permitAll().anyRequest().authenticated().and()
                .formLogin().failureHandler(authenticationFailureHandler()).successHandler(authenticationSuccessHandler)
                .loginPage("/saml/login").permitAll().and().logout().logoutSuccessUrl("/logoutSuccess").permitAll()
                .invalidateHttpSession(true).and().csrf().disable().cors()
                .configurationSource(corsConfigurationSource());
        http.addFilterBefore((MetadataGeneratorFilter) applicationContext.getBean("metadataGeneratorFilter"),
                ChannelProcessingFilter.class).addFilterAfter(
                        (FilterChainProxy) applicationContext.getBean("samlFilter"), BasicAuthenticationFilter.class);

        LOG.exit();
    }

    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        LOG.entry();

        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList(corsAllowedOrigins));
        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT"));
        configuration.setAllowCredentials(true);
        // the below three lines will add the relevant CORS response headers
        configuration.addAllowedOrigin("*");
        configuration.addAllowedHeader("*");
        configuration.addAllowedMethod("*");
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);

        return LOG.exit(source);
    }

    @Override
    @Bean(name = "webAuthenticationManagerBean")
    public AuthenticationManager authenticationManagerBean() throws Exception {
        LOG.entry();
        return LOG.exit(super.authenticationManagerBean());
    }

    /**
     * Authentication Failure Handler
     *
     * @return The Authentication Failure Handler
     */
    @Bean(name = "authenticationFailureHandler")
    protected AuthenticationFailureHandler authenticationFailureHandler() {
        LOG.entry();

        String defaultFailureUrl = runtimeProperties.getApplicationProperties().getDefaultFailureURL();
        ExceptionMappingAuthenticationFailureHandler authFailureHandler = new ExceptionMappingAuthenticationFailureHandler();
        authFailureHandler.setDefaultFailureUrl(defaultFailureUrl);
        Map<String, String> mappings = new HashMap<>();
        mappings.put("org.springframework.security.authentication.InternalAuthenticationServiceException",
                defaultFailureUrl);
        mappings.put("org.springframework.security.saml.SAMLAuthenticationToken", defaultFailureUrl);
        mappings.put("org.springframework.security.authentication.AuthenticationServiceException", defaultFailureUrl);
        authFailureHandler.setExceptionMappings(mappings);

        return LOG.exit(authFailureHandler);
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        LOG.entry(web);
        web.ignoring().antMatchers(excludeUrlPattern);
        LOG.exit();
    }
}

我想我在等401的未经授权的回复。我对昂首阔步是完全陌生的，所以任何建议都很感激！

Answer 1

与其他endpoint相同。这仍然允许其他人下载swagger配置，如果您真的需要控制级别，您也可以阻止/api-docs/**。

...
  .antMatchers("/swagger-ui/**") // For URI starting with swagger-ui
  .hasRole("USER")
  .antMatchers("/**/swagger-ui/**") // For URI that contains swagger-ui
  .hasRole("USER")
...