Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Require ACTUATOR role rather than ADMIN

Browse Source 
Update management security to require an `ACTUATOR` role rather than
`ADMIN` by default. This should reduce the risk of users accidentally
exposing actuator endpoints because they happen to use a role named
`ADMIN`.

Fixes gh-7569
This commit is contained in:
Madhura Bhave
2016-12-05 13:59:31 -08:00
parent 95be208f0f
commit 1be5812cf0
8 changed files with 14 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/CrshAutoConfigurationTests.java
View File

@@ -347,7 +347,7 @@ public class CrshAutoConfigurationTests {
authentication = new UsernamePasswordAuthenticationToken(
authentication.getPrincipal(),
authentication.getCredentials(), Collections
.singleton(new SimpleGrantedAuthority("ADMIN")));
.singleton(new SimpleGrantedAuthority("ACTUATOR")));
}
else {
throw new BadCredentialsException(

2
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/ManagementWebSecurityAutoConfigurationTests.java
View File

@@ -120,7 +120,7 @@ public class ManagementWebSecurityAutoConfigurationTests {
ArrayList<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>(
user.getAuthorities());
assertThat(authorities).containsAll(AuthorityUtils
.commaSeparatedStringToAuthorityList("ROLE_USER,ROLE_ADMIN"));
.commaSeparatedStringToAuthorityList("ROLE_USER,ROLE_ACTUATOR"));
}
private UserDetails getUser() {

12
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/mvc/MvcEndpointIntegrationTests.java
View File

@@ -68,7 +68,7 @@ public class MvcEndpointIntegrationTests {
@Test
public void defaultJsonResponseIsNotIndented() throws Exception {
TestSecurityContextHolder.getContext().setAuthentication(
new TestingAuthenticationToken("user", "N/A", "ROLE_ADMIN"));
new TestingAuthenticationToken("user", "N/A", "ROLE_ACTUATOR"));
this.context = new AnnotationConfigWebApplicationContext();
this.context.register(SecureConfiguration.class);
MockMvc mockMvc = createSecureMockMvc();
@@ -103,7 +103,7 @@ public class MvcEndpointIntegrationTests {
@Test
public void jsonExtensionProvided() throws Exception {
TestSecurityContextHolder.getContext().setAuthentication(
new TestingAuthenticationToken("user", "N/A", "ROLE_ADMIN"));
new TestingAuthenticationToken("user", "N/A", "ROLE_ACTUATOR"));
this.context = new AnnotationConfigWebApplicationContext();
this.context.register(SecureConfiguration.class);
MockMvc mockMvc = createSecureMockMvc();
@@ -151,7 +151,7 @@ public class MvcEndpointIntegrationTests {
}
@Test
public void sensitiveEndpointsAreSecureWithNonAdminRoleWithCustomContextPath()
public void sensitiveEndpointsAreSecureWithNonActuatorRoleWithCustomContextPath()
throws Exception {
TestSecurityContextHolder.getContext().setAuthentication(
new TestingAuthenticationToken("user", "N/A", "ROLE_USER"));
@@ -164,10 +164,10 @@ public class MvcEndpointIntegrationTests {
}
@Test
public void sensitiveEndpointsAreSecureWithAdminRoleWithCustomContextPath()
public void sensitiveEndpointsAreSecureWithActuatorRoleWithCustomContextPath()
throws Exception {
TestSecurityContextHolder.getContext().setAuthentication(
new TestingAuthenticationToken("user", "N/A", "ROLE_ADMIN"));
new TestingAuthenticationToken("user", "N/A", "ROLE_ACTUATOR"));
this.context = new AnnotationConfigWebApplicationContext();
this.context.register(SecureConfiguration.class);
EnvironmentTestUtils.addEnvironment(this.context,
@@ -199,7 +199,7 @@ public class MvcEndpointIntegrationTests {
private void assertIndentedJsonResponse(Class<?> configuration) throws Exception {
TestSecurityContextHolder.getContext().setAuthentication(
new TestingAuthenticationToken("user", "N/A", "ROLE_ADMIN"));
new TestingAuthenticationToken("user", "N/A", "ROLE_ACTUATOR"));
this.context = new AnnotationConfigWebApplicationContext();
this.context.register(configuration);
EnvironmentTestUtils.addEnvironment(this.context,