Rework security autoconfiguration

This commit combines security autoconfigurations for
management endpoints and the rest of the application. By default,
if Spring Security is on the classpath, it turns on @EnableWebSecurity.
In the presence of another WebSecurityConfigurerAdapter this backs off
completely. A default AuthenticationManager is also provided with a user
and generated password. This can be turned off by specifying a bean of
type AuthenticationManager, AuthenticationProvider or UserDetailsService.

Closes gh-7958

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/main/java/sample/actuator/customsecurity/ExampleController.java

@@ -0,0 +1,26 @@
+package sample.actuator.customsecurity;
+
+import java.util.Date;
+import java.util.Map;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+@Controller
+public class ExampleController {
+
+	@GetMapping("/")
+	public String home(Map<String, Object> model) {
+		model.put("message", "Hello World");
+		model.put("title", "Hello Home");
+		model.put("date", new Date());
+		return "home";
+	}
+
+	@RequestMapping("/foo")
+	public String foo() {
+		throw new RuntimeException("Expected exception in controller");
+	}
+
+}

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/main/java/sample/actuator/customsecurity/SampleActuatorCustomSecurityApplication.java

@@ -0,0 +1,29 @@
+/*
+ * Copyright 2012-2017 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package sample.actuator.customsecurity;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class SampleActuatorCustomSecurityApplication {
+
+	public static void main(String[] args) throws Exception {
+		SpringApplication.run(SampleActuatorCustomSecurityApplication.class, args);
+	}
+
+}

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/main/java/sample/actuator/customsecurity/SecurityConfiguration.java

@@ -0,0 +1,40 @@
+package sample.actuator.customsecurity;
+
+import org.springframework.boot.autoconfigure.security.SpringBootSecurity;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+
+@Configuration
+public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
+
+	private SpringBootSecurity bootSecurity;
+
+	public SecurityConfiguration(SpringBootSecurity bootSecurity) {
+		this.bootSecurity = bootSecurity;
+	}
+
+	@Override
+	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+		auth.inMemoryAuthentication()
+				.withUser("user").password("password").authorities("ROLE_USER").and()
+				.withUser("admin").password("admin").authorities("ROLE_ACTUATOR", "ROLE_USER");
+	}
+
+	@Override
+	protected void configure(HttpSecurity http) throws Exception {
+		http.authorizeRequests()
+				.requestMatchers(this.bootSecurity.endpointIds("status", "info")).permitAll()
+				.requestMatchers(this.bootSecurity.endpointIds(SpringBootSecurity.ALL_ENDPOINTS)).hasRole("ACTUATOR")
+				.requestMatchers(this.bootSecurity.staticResources()).permitAll()
+				.antMatchers("/foo").permitAll()
+				.antMatchers("/**").hasRole("USER")
+				.and()
+			.cors()
+				.and()
+			.httpBasic();
+	}
+
+}

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/main/resources/application.properties

@@ -0,0 +1 @@
+endpoints.all.web.enabled=true

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/main/resources/templates/error.ftl

@@ -0,0 +1,32 @@
+<#import "/spring.ftl" as spring />
+<!DOCTYPE html>
+<html>
+<head>
+<title>Error</title>
+<#assign home><@spring.url relativeUrl="/"/></#assign>
+<#assign bootstrap><@spring.url relativeUrl="/css/bootstrap.min.css"/></#assign>
+<link rel="stylesheet" href="${bootstrap}" />
+</head>
+<body>
+	<div class="container">
+		<div class="navbar">
+			<div class="navbar-inner">
+				<a class="brand" href="http://freemarker.org/"> FreeMarker -
+					Plain </a>
+				<ul class="nav">
+					<li><a href="${home}"> Home </a></li>
+				</ul>
+			</div>
+		</div>
+		<h1>Error Page</h1>
+		<div id="created">${timestamp?datetime}</div>
+		<div>
+			There was an unexpected error (type=${error}, status=${status}).
+		</div>
+		<div>${message}</div>
+		<div>
+			Please contact the operator with the above information.
+		</div>
+	</div>
+</body>
+</html>

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/main/resources/templates/home.ftl

@@ -0,0 +1,26 @@
+<#import "/spring.ftl" as spring />
+<!DOCTYPE html>
+<html>
+<head>
+<title>${title}</title>
+<#assign home><@spring.url relativeUrl="/"/></#assign>
+<#assign bootstrap><@spring.url relativeUrl="/css/bootstrap.min.css"/></#assign>
+<link rel="stylesheet" href="${bootstrap}" />
+</head>
+<body>
+	<div class="container">
+		<div class="navbar">
+			<div class="navbar-inner">
+				<a class="brand" href="http://freemarker.org/"> FreeMarker -
+					Plain </a>
+				<ul class="nav">
+					<li><a href="${home}"> Home </a></li>
+				</ul>
+			</div>
+		</div>
+		<h1>${title}</h1>
+		<div>${message}</div>
+		<div id="created">${date?datetime}</div>
+	</div>
+</body>
+</html>

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/test/java/sample/actuator/customsecurity/CorsSampleActuatorApplicationTests.java

@@ -0,0 +1,85 @@
+package sample.actuator.customsecurity;
+
+import java.net.URI;
+import java.util.Map;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.web.client.LocalHostUriTemplateHandler;
+import org.springframework.boot.test.web.client.TestRestTemplate;
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.RequestEntity;
+import org.springframework.http.ResponseEntity;
+import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.test.annotation.DirtiesContext;
+import org.springframework.test.context.ActiveProfiles;
+import org.springframework.test.context.junit4.SpringRunner;
+import org.springframework.web.client.RestTemplate;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Integration test for cors preflight requests to management endpoints.
+ *
+ * @author Madhura Bhave
+ */
+@RunWith(SpringRunner.class)
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+@DirtiesContext
+@ActiveProfiles("cors")
+public class CorsSampleActuatorApplicationTests {
+
+	private TestRestTemplate testRestTemplate;
+
+	@Autowired
+	ApplicationContext applicationContext;
+
+	@Before
+	public void setUp() throws Exception {
+		RestTemplate restTemplate = new RestTemplate();
+		LocalHostUriTemplateHandler handler = new LocalHostUriTemplateHandler(
+				this.applicationContext.getEnvironment(), "http");
+		restTemplate.setUriTemplateHandler(handler);
+		restTemplate.setRequestFactory(new HttpComponentsClientHttpRequestFactory());
+		this.testRestTemplate = new TestRestTemplate(restTemplate);
+	}
+
+	@Test
+	public void endpointShouldReturnUnauthorized() throws Exception {
+		ResponseEntity<?> entity = this.testRestTemplate.getForEntity("/application/env",
+				Map.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
+	}
+
+	@Test
+	public void preflightRequestToEndpointShouldReturnOk() throws Exception {
+		RequestEntity<?> healthRequest = RequestEntity
+				.options(new URI("/application/env"))
+				.header("Origin", "http://localhost:8080")
+				.header("Access-Control-Request-Method", "GET").build();
+		ResponseEntity<?> exchange = this.testRestTemplate.exchange(healthRequest,
+				Map.class);
+		assertThat(exchange.getStatusCode()).isEqualTo(HttpStatus.OK);
+	}
+
+	@Test
+	public void preflightRequestWhenCorsConfigInvalidShouldReturnForbidden()
+			throws Exception {
+		RequestEntity<?> entity = RequestEntity.options(new URI("/application/env"))
+				.header("Origin", "http://localhost:9095")
+				.header("Access-Control-Request-Method", "GET").build();
+		ResponseEntity<byte[]> exchange = this.testRestTemplate.exchange(entity,
+				byte[].class);
+		assertThat(exchange.getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
+	}
+
+}

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/test/java/sample/actuator/customsecurity/InsecureManagementPortAndPathSampleActuatorApplicationTests.java

@@ -0,0 +1,87 @@
+/*
+ * Copyright 2012-2017 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package sample.actuator.customsecurity;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import org.springframework.boot.actuate.web.server.LocalManagementPort;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.context.SpringBootTest.WebEnvironment;
+import org.springframework.boot.test.web.client.TestRestTemplate;
+import org.springframework.boot.web.server.LocalServerPort;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.test.annotation.DirtiesContext;
+import org.springframework.test.context.junit4.SpringRunner;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Integration tests for separate management and main service ports.
+ *
+ * @author Dave Syer
+ * @author Madhura Bhave
+ */
+@RunWith(SpringRunner.class)
+@SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT, properties = {
+		"management.port=0", "management.context-path=/admin"})
+@DirtiesContext
+public class InsecureManagementPortAndPathSampleActuatorApplicationTests {
+
+	@LocalServerPort
+	private int port = 9010;
+
+	@LocalManagementPort
+	private int managementPort = 9011;
+
+	@Test
+	public void testHome() throws Exception {
+		@SuppressWarnings("rawtypes")
+		ResponseEntity<String> entity = new TestRestTemplate("user", "password")
+				.getForEntity("http://localhost:" + this.port, String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
+		assertThat(entity.getBody()).contains("Hello World");
+	}
+
+	@Test
+	public void testSecureActuator() throws Exception {
+		ResponseEntity<String> entity = new TestRestTemplate().getForEntity(
+				"http://localhost:" + this.managementPort + "/admin/health",
+				String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
+	}
+
+	@Test
+	public void testInsecureActuator() throws Exception {
+		ResponseEntity<String> entity = new TestRestTemplate().getForEntity(
+				"http://localhost:" + this.managementPort + "/admin/status",
+				String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
+		assertThat(entity.getBody()).contains("\"status\":\"UP\"");
+	}
+
+	@Test
+	public void testMissing() throws Exception {
+		ResponseEntity<String> entity = new TestRestTemplate("admin", "admin").getForEntity(
+				"http://localhost:" + this.managementPort + "/admin/missing",
+				String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
+		assertThat(entity.getBody()).contains("\"status\":404");
+	}
+
+}

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/test/java/sample/actuator/customsecurity/SampleActuatorCustomSecurityApplicationTests.java

@@ -0,0 +1,75 @@
+package sample.actuator.customsecurity;
+
+import java.util.Map;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.web.client.TestRestTemplate;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.test.annotation.DirtiesContext;
+import org.springframework.test.context.junit4.SpringRunner;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * @author Madhura Bhave
+ */
+@RunWith(SpringRunner.class)
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+@DirtiesContext
+public class SampleActuatorCustomSecurityApplicationTests {
+
+	@Autowired
+	private TestRestTemplate restTemplate;
+
+	@Test
+	public void homeIsSecure() throws Exception {
+		@SuppressWarnings("rawtypes")
+		ResponseEntity<Map> entity = this.restTemplate.getForEntity("/", Map.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
+		@SuppressWarnings("unchecked")
+		Map<String, Object> body = entity.getBody();
+		assertThat(body.get("error")).isEqualTo("Unauthorized");
+		assertThat(entity.getHeaders()).doesNotContainKey("Set-Cookie");
+	}
+
+	@Test
+	public void testInsecureApplicationPath() throws Exception {
+		@SuppressWarnings("rawtypes")
+		ResponseEntity<Map> entity = this.restTemplate.getForEntity("/foo", Map.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.INTERNAL_SERVER_ERROR);
+		@SuppressWarnings("unchecked")
+		Map<String, Object> body = entity.getBody();
+		assertThat((String)body.get("message")).contains("Expected exception in controller");
+	}
+
+	@Test
+	public void testInsecureStaticResources() throws Exception {
+		@SuppressWarnings("rawtypes")
+		ResponseEntity<String> entity = this.restTemplate.getForEntity("/css/bootstrap.min.css", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
+		assertThat(entity.getBody()).contains("body");
+	}
+
+	@Test
+	public void insecureActuator() throws Exception {
+		@SuppressWarnings("rawtypes")
+		ResponseEntity<String> entity = this.restTemplate.getForEntity("/application/status",
+				String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
+		assertThat(entity.getBody()).contains("\"status\":\"UP\"");
+	}
+
+	@Test
+	public void secureActuator() throws Exception {
+		@SuppressWarnings("rawtypes")
+		ResponseEntity<Map> entity = this.restTemplate.getForEntity("/application/env",
+				Map.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
+	}
+
+}

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/test/resources/application-cors.properties

@@ -0,0 +1,2 @@
+management.endpoints.cors.allowed-origins=http://localhost:8080
+management.endpoints.cors.allowed-methods=GET