jeudi 5 mars 2015

Spring boot actuator secure services does not work fine

I an Trying to secure spring actuator services /manage context path when calling for example:


http://localhost:9091/manage/metrics


with this config in my yalm.properties


management: port: 9091 address: 127.0.0.1 context-path: /manage security: enabled: true role: ADMIN.


Git branch with security actuator service layer


but access to every service is still free.


Spring security config:


'@Override protected void configure(HttpSecurity http) throws Exception {



http.authorizeRequests().antMatchers("/pizzas","/info","/addPizza").hasAnyRole("USER","ADMIN").and().authorizeRequests().antMatchers("/users","/addUser").hasRole("ADMIN").and().authorizeRequests().antMatchers("/static/**","/logout","/login").permitAll();

http.formLogin().loginPage("/login").failureUrl("/login?error").permitAll();

http.logout().logoutSuccessUrl("/?logout").deleteCookies("remember-me").permitAll();


http.sessionManagement().maximumSessions(1).
expiredUrl("/?expired").maxSessionsPreventsLogin(true).and()
.sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
}

/**
* Configure global security with Bccyptenoncder and custom userDetailService with Spring Security
* @param auth
* @throws Exception
*/
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

auth.userDetailsService(userDetailsServiceImpl).passwordEncoder(passwordEncoder());
}


/**
* Bcrypt password encoding configuration, more info at http://ift.tt/1B8VFxQ
* @return
*/
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
'

Aucun commentaire:

Enregistrer un commentaire