Explicitly configure SecurityWebFilterChain bean for reactive oauth2 client

This will ensure that ReactiveManagementWebSecurityAutoConfiguration backs
off and that the actuator endpoints are also secured via OAuth2.

Fixes gh-17949
This commit is contained in:
Madhura Bhave
2019-09-24 09:50:45 -07:00
parent c613418451
commit 342a0535d7
5 changed files with 180 additions and 53 deletions

View File

@@ -51,4 +51,10 @@ public class SampleReactiveOAuth2ClientApplicationTests {
assertThat(bodyString).contains("/oauth2/authorization/github-client-2");
}
@Test
public void actuatorShouldBeSecuredByOAuth() {
this.webTestClient.get().uri("/actuator/health").exchange().expectStatus().isFound().expectHeader()
.valueEquals("Location", "/login");
}
}