Spring Boot 2安全性-预验证令牌-允许healthcheck

Question

我的Spring Boot执行器healthCheck被阻止，因为丢失了一个(pre_authenticated)令牌。

有很多答案可用，但这是一个问题有干扰预认证的安全性。据我查，这不是复制品。

如何允许在预先验证的安全环境中进行健康检查？

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    private static final Logger logger = LoggerFactory.getLogger(SecurityConfig.class);

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) {
        PreAuthenticatedAuthenticationProvider provider = new PreAuthenticatedAuthenticationProvider();
        provider.setPreAuthenticatedUserDetailsService(new XyzPreAuthenticatedGrantedAuthoritiesUserDetailsService());
        auth.authenticationProvider(provider);
    }

    // Try-1, see below
    @Override
    protected void configure(HttpSecurity http) throws Exception {
      http.addFilterBefore(xyzTokenRequestHeaderAuthenticationFilter(), RequestHeaderAuthenticationFilter.class)
        .csrf().disable()
        .authorizeRequests()
        .antMatchers("/actuator/**").permitAll()
        .anyRequest().authenticated();
    }

    @Bean
    public XyzTokenRequestHeaderAuthenticationFilter xyzTokenRequestHeaderAuthenticationFilter() throws Exception {
        XyzTokenRequestHeaderAuthenticationFilter filter = new XyzTokenRequestHeaderAuthenticationFilter();
        filter.setAuthenticationManager(authenticationManager());
        return filter;
    }
}

@Override
protected void configure(HttpSecurity http) throws Exception {
  http.addFilterBefore(xyzTokenRequestHeaderAuthenticationFilter(), RequestHeaderAuthenticationFilter.class)
    .csrf().disable()
    .authorizeRequests()
    .antMatchers("/actuator/**").permitAll();
}

Answer 1

看起来xyz过滤器没有以“完美”的方式实现。

这种方法将帮助你使事情正常运转：

1-使用管理端口：

management.server.port=8081
management.security.enabled=false
management.server.address=127.0.0.1
management.server.ssl.enabled=false
management.endpoints.health.sensitive=false
management.endpoint.health.show-details=always

@Override
protected void configure(HttpSecurity http) throws Exception {
  http.sessionManagement().sessionCreationPolicy(STATELESS);
  http.csrf().disable();
  http.authorizeRequests()
    .antMatchers("/actuator/**").permitAll()
    .antMatchers("/**").authenticated();
  http.addFilterBefore(xyzTokenRequestHeaderAuthenticationFilter(), AbstractPreAuthenticatedProcessingFilter.class);
}

@Override
public void configure(WebSecurity web) throws Exception {
  web.ignoring().antMatchers("/actuator/**");
}