java - Spring Boot 2 安全性 - 预验证 token - 允许健康检查

Question

由于缺少(预验证的) token ，我的 Spring Boot Actuator healthCheck 被阻止。

有很多答案，但这个问题会干扰预先验证的安全性。据我搜索，这不重复。

如何在预先验证的安全环境中允许运行状况检查？

我的问题是，我是否需要更多设置(例如 application.properties)？

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    private static final Logger logger = LoggerFactory.getLogger(SecurityConfig.class);

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) {
        PreAuthenticatedAuthenticationProvider provider = new PreAuthenticatedAuthenticationProvider();
        provider.setPreAuthenticatedUserDetailsService(new XyzPreAuthenticatedGrantedAuthoritiesUserDetailsService());
        auth.authenticationProvider(provider);
    }

    // Try-1, see below
    @Override
    protected void configure(HttpSecurity http) throws Exception {
      http.addFilterBefore(xyzTokenRequestHeaderAuthenticationFilter(), RequestHeaderAuthenticationFilter.class)
        .csrf().disable()
        .authorizeRequests()
        .antMatchers("/actuator/**").permitAll()
        .anyRequest().authenticated();
    }

    @Bean
    public XyzTokenRequestHeaderAuthenticationFilter xyzTokenRequestHeaderAuthenticationFilter() throws Exception {
        XyzTokenRequestHeaderAuthenticationFilter filter = new XyzTokenRequestHeaderAuthenticationFilter();
        filter.setAuthenticationManager(authenticationManager());
        return filter;
    }
}

我的第二次尝试是:

@Override
protected void configure(HttpSecurity http) throws Exception {
  http.addFilterBefore(xyzTokenRequestHeaderAuthenticationFilter(), RequestHeaderAuthenticationFilter.class)
    .csrf().disable()
    .authorizeRequests()
    .antMatchers("/actuator/**").permitAll();
}

Answer 1

看起来 xyz 过滤器没有以“完美”的方式实现。

这种方式将帮助您让事情顺利进行:

1 - 使用管理端口:

management.server.port=8081
management.security.enabled=false
management.server.address=127.0.0.1
management.server.ssl.enabled=false
management.endpoints.health.sensitive=false
management.endpoint.health.show-details=always

2 - 配置 web 和 api 两种方式。在标准部件之外使用它:

@Override
protected void configure(HttpSecurity http) throws Exception {
  http.sessionManagement().sessionCreationPolicy(STATELESS);
  http.csrf().disable();
  http.authorizeRequests()
    .antMatchers("/actuator/**").permitAll()
    .antMatchers("/**").authenticated();
  http.addFilterBefore(xyzTokenRequestHeaderAuthenticationFilter(), AbstractPreAuthenticatedProcessingFilter.class);
}

@Override
public void configure(WebSecurity web) throws Exception {
  web.ignoring().antMatchers("/actuator/**");
}

3 - 在 Docker 容器内，使用 8081 端口进行 healthCheck。