为什么我的所有Spring boot执行器endpoint都公开可用？

Question

我在我的类路径上有Spring Security性（并验证为我自己的REST控制器工作），但默认情况下，我的执行器endpoint都是公共可用的（除了关闭）。

我可以随心所欲地禁用endpoint（阅读完这个问题后），但启用的endpoint始终可用，无需验证，也无需管理所需的角色。安全我的属性中的角色。

即使我显式设置了endpoint。豆。sensitive=true例如，无需身份验证即可访问。

我的安全配置使用LDAP进行身份验证：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private LdapContextSource contextSource;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .ldapAuthentication()
                .contextSource(contextSource)
                .groupRoleAttribute("<hidden>")
                .groupSearchBase("<hidden>")
                .groupSearchFilter("<hidden>")
                .userDnPatterns("<hidden>");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.httpBasic();
    }
}

我的申请。测试期间的属性：

# Log4J properties
logging.file=${user.home}/nubis-log.log
logging.level.org.springframework.web=INFO
logging.level.org.hibernate=INFO
logging.register-shutdown-hook=true

# SSL configuration
server.ssl.key-store=<hidden>
server.ssl.key-store-password=<hidden>
server.ssl.keyStoreType=<hidden>
server.ssl.key-password=<hidden>

# Spring actuator
endpoints.enabled=false
endpoints.info.enabled=true
endpoints.health.enabled=true
endpoints.beans.enabled=true
endpoints.beans.sensitive=true
management.security.role=ADMIN

我的控制台输出：

[2016-04-15 12:30:05.742] boot - 2754  INFO [localhost-startStop-1] --- DelegatingFilterProxyRegistrationBean: Mapping filter: 'springSecurityFilterChain' to: [/*]
[2016-04-15 12:30:05.742] boot - 2754  INFO [localhost-startStop-1] --- FilterRegistrationBean: Mapping filter: 'webRequestLoggingFilter' to: [/*]
[2016-04-15 12:30:05.743] boot - 2754  INFO [localhost-startStop-1] --- FilterRegistrationBean: Mapping filter: 'CORSFilter' to: [/*]
[2016-04-15 12:30:05.743] boot - 2754  INFO [localhost-startStop-1] --- FilterRegistrationBean: Mapping filter: 'applicationContextIdFilter' to: [/*]
[2016-04-15 12:30:05.743] boot - 2754  INFO [localhost-startStop-1] --- ServletRegistrationBean: Mapping servlet: 'dispatcherServlet' to [/]
[2016-04-15 12:30:05.800] boot - 2754 DEBUG [localhost-startStop-1] --- DelegatingFilterProxy: Initializing filter 'springSecurityFilterChain'
[2016-04-15 12:30:07.059] boot - 2754  INFO [localhost-startStop-1] --- EndpointHandlerMapping: Mapped "{[/info || /info.json],methods=[GET],produces=[application/json]}" onto public java.lang.Object org.springframework.boot.actuate.endpoint.mvc.EndpointMvcAdapter.invoke()
[2016-04-15 12:30:07.061] boot - 2754  INFO [localhost-startStop-1] --- EndpointHandlerMapping: Mapped "{[/beans || /beans.json],methods=[GET],produces=[application/json]}" onto public java.lang.Object org.springframework.boot.actuate.endpoint.mvc.EndpointMvcAdapter.invoke()
[2016-04-15 12:30:07.063] boot - 2754  INFO [localhost-startStop-1] --- EndpointHandlerMapping: Mapped "{[/health || /health.json],produces=[application/json]}" onto public java.lang.Object org.springframework.boot.actuate.endpoint.mvc.HealthMvcEndpoint.invoke(java.security.Principal)

是否有配置/属性阻止了Spring Security？我是否需要配置一些额外的东西以使其与LDAP一起工作？

Answer 1

所有endpoint都有一个敏感属性，需要将其设置为true

看看Apedenix Ahttps://docs.spring.io/spring-boot/docs/current/reference/html/common-application-properties.html

在该页面上搜索执行器属性。