Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[bs-138] Make it easy to secure only the management endpoints

Browse Source 
Example: web UI with publicly available static assets

    # application.properties:
    security.ignored: /css/**,/script/**

Example: web UI with publicly available everything, but secure
management endpoints.

    # application.properties:
    # Empty path for basic security (default is /**)
    security.basic.path=

[Fixes #50721675]
This commit is contained in:
Dave Syer
2013-05-30 15:37:49 +01:00
parent 7b0ec252dd
commit e011312c68
12 changed files with 244 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
spring-bootstrap-samples/spring-bootstrap-actuator-ui-sample/src/main/java/org/springframework/bootstrap/sample/ui/ActuatorUiBootstrapApplication.java
View File

@@ -4,19 +4,14 @@ import java.util.Date;
import java.util.Map;
import org.springframework.bootstrap.SpringApplication;
import org.springframework.bootstrap.actuate.autoconfigure.ConditionalOnManagementContext;
import org.springframework.bootstrap.actuate.autoconfigure.ManagementAutoConfiguration;
import org.springframework.bootstrap.actuate.autoconfigure.SecurityAutoConfiguration;
import org.springframework.bootstrap.context.annotation.ConditionalOnExpression;
import org.springframework.bootstrap.actuate.properties.SecurityProperties;
import org.springframework.bootstrap.context.annotation.EnableAutoConfiguration;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Import;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
@EnableAutoConfiguration(exclude = { SecurityAutoConfiguration.class,
ManagementAutoConfiguration.class })
@EnableAutoConfiguration
@ComponentScan
@Controller
public class ActuatorUiBootstrapApplication {
@@ -33,19 +28,11 @@ public class ActuatorUiBootstrapApplication {
SpringApplication.run(ActuatorUiBootstrapApplication.class, args);
}
@Configuration
@ConditionalOnExpression("${server.port:8080} != ${management.port:${server.port:8080}}")
@Import(ManagementAutoConfiguration.class)
protected static class ManagementConfiguration {
}
@Configuration
@ConditionalOnExpression("${server.port:8080} != ${management.port:${server.port:8080}}")
@ConditionalOnManagementContext
@Import(SecurityAutoConfiguration.class)
protected static class ManagementSecurityConfiguration {
@Bean
public SecurityProperties securityProperties() {
SecurityProperties security = new SecurityProperties();
security.getBasic().setPath(""); // empty
return security;
}
}

9
spring-bootstrap-samples/spring-bootstrap-actuator-ui-sample/src/test/java/org/springframework/bootstrap/sample/ui/ActuatorUiBootstrapApplicationTests.java
View File

@@ -1,6 +1,7 @@
package org.springframework.bootstrap.sample.ui;
import java.io.IOException;
import java.util.Map;
import java.util.concurrent.Callable;
import java.util.concurrent.Executors;
import java.util.concurrent.Future;
@@ -68,6 +69,14 @@ public class ActuatorUiBootstrapApplicationTests {
assertTrue("Wrong body:\n" + entity.getBody(), entity.getBody().contains("body"));
}
@Test
public void testMetrics() throws Exception {
@SuppressWarnings("rawtypes")
ResponseEntity<Map> entity = getRestTemplate().getForEntity(
"http://localhost:8080/metrics", Map.class);
assertEquals(HttpStatus.UNAUTHORIZED, entity.getStatusCode());
}
private RestTemplate getRestTemplate() {
RestTemplate restTemplate = new RestTemplate();
restTemplate.setErrorHandler(new DefaultResponseErrorHandler() {