Spring boot 2启用非安全/健康endpoint

Question

我最初的WebSecurityConfigurerAdapter是：

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
...
    private void configureWithSsl(@NotNull HttpSecurity http) throws Exception {
        LOG.info("configuring access with ssl");
        http
                .csrf().disable()
                .authorizeRequests()
                .anyRequest().authenticated()
                .and().x509()
                .and().userDetailsService(userDetailsService());
    }
...
}

和application.yaml

server:
  port: 8443
  ssl:
    enabled: true
    key-store: 'paht/to/kestore/keystore.jks'
    key-store-password: 123456
    key-store-type: JKS
    client-auth: need
    trust-store: 'paht/to/truststore/truststore.jks'
    trust-store-type: JKS
    trust-store-password: 123456
    protocol: TLS
    enabled-protocols: TLSv1.2

我试过了：1。将“通道”配置为endpoint不安全

    private void configureWithSsl(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .requiresChannel().requestMatchers(EndpointRequest.to("health")).requiresInsecure()
                .and()
                .authorizeRequests()
                .anyRequest().authenticated()
                .and().x509()
                .and().userDetailsService(userDetailsService());
    }

null

    private void configureWithSsl(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .authorizeRequests()
                .requestMatchers(EndpointRequest.to("health")).permitAll()
                .anyRequest().authenticated()
                .and().x509()
                .and().userDetailsService(userDetailsService());
    }

null

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().requestMatchers(EndpointRequest.to("health"));
}

curl -k  https://localhost:8443/actuator/health
curl: (35) error:1401E412:SSL routines:CONNECT_CR_FINISHED:sslv3 alert bad certificate

curl http://localhost:8443/actuator/health
Bad Request
This combination of host and port requires TLS.

根据@Aritra Paul的回答，我也试过：

http
        .csrf().disable()
        .authorizeRequests()
        .antMatchers( "/actuator/health/**").permitAll()
        .antMatchers( "/**").authenticated()
        .and().x509()
        .and().userDetailsService(userDetailsService());

但我还是得到同样的结果。

Answer 1

我有一个非常类似的例子，我们在endpoint中添加了X.509身份验证，但希望保持Spring actuatorendpoint没有身份验证。

使用Spring 2.2.3可以像您所做的那样使用ssl配置服务器，但是在管理配置（用于配置执行器endpoint）中禁用ssl，如下所示：

management:
  server:
    port: 8080
    ssl:
      enabled: false

这个简单的组合允许我们在端口8080上使用无auth访问执行器endpoint，而在端口8443上使用ssl访问其他endpoint。