Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add constants to SecurityProperties and ManagementServerProperties

Browse Source 
For the convenience of users who want to selectively override the
access rules in an application without taking complete control of the
security configuration we now have some constants:

* SecurityProperties.ACCESS_OVERRIDE_ORDER for overriding just the
application endpoint access rules

* ManagementServerProperties.ACCESS_OVERRIDE_ORDER for overriding the
application endpoint and management endpoint access rules

Fixes gh-803
This commit is contained in:
Dave Syer
2014-05-07 14:41:35 -07:00
parent f04f265515
commit 14d3b46809
8 changed files with 82 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc
View File

@@ -1124,7 +1124,9 @@ The basic features you get out of the box in a web application are:
on by default.
All of the above can be switched on and off or modified using external properties
(`security.*`).
(`security.*`). To override the access rules without changing any other autoconfigured
features add a `@Bean` of type `WebConfigurerAdapter` with
`@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)`.
If the Actuator is also in use, you will find:
@@ -1133,7 +1135,12 @@ If the Actuator is also in use, you will find:
* The default user will have the "ADMIN" role as well as the "USER" role.
The Actuator security features can be modified using external properties
(`management.security.*`).
(`management.security.*`). To override the application access rules
add a `@Bean` of type `WebConfigurerAdapter` and use
`@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)` if you _don't_ want to override
the actuator access rules, or `@Order(ManagementServerProperties.ACCESS_OVERRIDE_ORDER)`
if you _do_ want to override the actuator access rules.