spring boot 1.5.10.RELEASE ，spring boot admin 1.5.7 添加 security

生产环境的客户端actuator最好是加上security校验，不然配置信息不登录就能直接获取到

server端配置，参考官方文档，https://codecentric.github.io/spring-boot-admin/1.5.7/#getting-started

代码参见，码云，https://gitee.com/xiongjinpeng/spring-boot-admin

pom.xml

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <groupId>com.xx</groupId>

    <artifactId>spring-boot-admin</artifactId>

    <version>0.0.1</version>

    <packaging>jar</packaging>

    <name>spring-boot-admin</name>

    <parent>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-parent</artifactId>

        <version>1.5.10.RELEASE</version>

        <relativePath/> <!-- lookup parent from repository -->

    </parent>

    <properties>

        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>

        <java.version>1.8</java.version>

        <spring-boot-admin.version>1.5.7</spring-boot-admin.version>

    </properties>

    <dependencies>

        <dependency>

            <groupId>de.codecentric</groupId>

            <artifactId>spring-boot-admin-starter-server</artifactId>

            <version>1.5.7</version>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-web</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-security</artifactId>

        </dependency>

        <dependency>

            <groupId>de.codecentric</groupId>

            <artifactId>spring-boot-admin-server-ui-login</artifactId>

            <version>${spring-boot-admin.version}</version>

        </dependency>

    </dependencies>

    <build>

        <plugins>

            <plugin>

                <groupId>org.springframework.boot</groupId>

                <artifactId>spring-boot-maven-plugin</artifactId>

                <configuration>

                    <executable>true</executable>

                    <finalName>${project.name}</finalName>

                </configuration>

            </plugin>

        </plugins>

    </build>

</project>

SecurityConfig.java，官方的配置

import org.springframework.context.annotation.Configuration;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

/**

 * 基于安全认证的spring boot admin

 *

 * @author niugang

 *

 */

@Configuration

@EnableWebSecurity

public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override

    protected void configure(HttpSecurity http) throws Exception {

        // Page with login form is served as /login.html and does a POST on /login

        http.formLogin().loginPage("/login.html").loginProcessingUrl("/login").permitAll();

        // The UI does a POST on /logout on logout

        http.logout().logoutUrl("/logout");

        // The ui currently doesn't support csrf

        http.csrf().disable();

        // Requests for the login page and the static assets are allowed

        //允许登录页面和静态资源的请求

        http.authorizeRequests()

                .antMatchers("/login.html", "/**/*.css", "/img/**", "/third-party/**")

                .permitAll();

        // ... and any other request needs to be authorized

        //这点重要：所有请求都需要认证

        http.authorizeRequests().antMatchers("/**").authenticated();

        // Enable so that the clients can authenticate via HTTP basic for registering

        http.httpBasic();

    }

}

application.properties

server.port=8011

#关闭原始的spring security 认证,不关闭的话，浏览器打开就会跳出弹出框

security.basic.enabled=false

#spring boot actuator某些端点的访问时需要权限的

management.security.enabled=false

#spring boot default user.name='user'

security.user.name=admin

#spring boot dafault user.password 在项目启动时打印在控制台中

security.user.password=123456

client端，客户端代码，

maven添加

<dependency>

            <groupId>de.codecentric</groupId>

            <artifactId>spring-boot-admin-starter-client</artifactId>

            <version>1.5.7</version>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-security</artifactId>

        </dependency>

<parent>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-parent</artifactId>

        <version>1.5.10.RELEASE</version>

        <relativePath/> <!-- lookup parent from repository -->

    </parent>

SecuritySecureConfig.java

import org.springframework.context.annotation.Configuration;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration

public class SecuritySecureConfig extends WebSecurityConfigurerAdapter {

    @Override

    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable().authorizeRequests()

                //拦截所有endpoint，拥有ACTUATOR_ADMIN角色可访问，否则需登录

//静态文件允许访问

                .antMatchers("/css/**", "/images/**","/js/**","/webjars/**","/**/favicon.ico").permitAll()

                //根路径允许访问

                .antMatchers("/").permitAll()

                //所有请求路径可以访问

                .antMatchers("/**").permitAll()

                .and().httpBasic();

    }

}

application.properties

spring.application.name=client

#要注册的Spring Boot Admin Server的URL

spring.boot.admin.url=http://localhost:8011

#从Spring Boot 1.5.x开始，默认情况下所有端点都是安全的。 为简洁起见，我们暂时禁用了安全性。 查看有关如何处理安全端点的安全性部分。

#management.security.enabled=false
#注册到server端用

spring.boot.admin.client.metadata.user.name=admin

spring.boot.admin.client.metadata.user.password=123456

#如果保护/api/applications端点，请不要忘记使用spring.boot.admin.username和spring.boot.admin.password在SBA客户端上配置用户名和密码【否则你的client端信息注册不到server端上】
#注册到server端用

spring.boot.admin.username=admin

spring.boot.admin.password=123456


#配置很重要，server端主动获取信息会用到

security.user.name=admin

security.user.password=123456

最新测试，还可以精简一下去掉代码

.antMatchers(

                        "/info",

                        "/info.json",

                        "/health",

                        "/health.json",

                        "/metrics",

                        "/metrics.json",

                        "/dump",

                        "/dump.json",

                        "/metrics/*",

                        "/beans",

                        "/beans.json",

                        "/configprops",

                        "/configprops.json",

                        "/auditevents",

                        "/auditevents.json",

                        "/heapdump",

                        "/heapdump.json",

                        "/trace",

                        "/trace.json",

                        "/env/*",

                        "/env",

                        "/env.json",

                        "/loggers/*",

                        "/loggers",

                        "/loggers.json",

                        "/mappings",

                        "/mappings.json",

                        "/jolokia/**"

                        ).hasRole("ACTUATOR_ADMIN")

和

management.security.roles=ACTUATOR_ADMIN

去掉这2个，也可以达到效果。

巴特西

spring boot 1.5.10.RELEASE ，spring boot admin 1.5.7 添加 security

最新文章

热门文章