From 5ceb12e85922ce860d2c9edee6439b8a78560640 Mon Sep 17 00:00:00 2001 From: Dave Syer Date: Wed, 14 Jan 2015 16:14:35 +0000 Subject: [PATCH] Sync docs from master to gh-pages --- spring-cloud.html | 54 ++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 44 insertions(+), 10 deletions(-) diff --git a/spring-cloud.html b/spring-cloud.html index 8e1bf2f..910de1e 100644 --- a/spring-cloud.html +++ b/spring-cloud.html @@ -2792,6 +2792,40 @@ Spring Boot access control (Basic authentication, or whatever custom filters you put in place).

+
+

Integrating with the Actuator Endpoints

+
+

The Spring Boot Actuator endpoints ("/env", "/metrics", etc.) if +present will, by default, be protected by the standard Spring Boot +basic authentication. The SSO authentication filter is added in a +position directly behind the filter that intercepts requests to the +Actuator endpoints by default (i.e. +ManagementProperties.BASIC_AUTH_ORDER + 1 which is +Ordered.LOWEST_PRECEDENCE-9 or 2147483636). If you want to change +the order you can set spring.oauth2.sso.filterOrder. If you do that +and the value is less than the default, then you will need to consider +setting the access rules for the Actuator, since they will become +accessible to all authenticated users who sign on with the external +provider. One way to do that would be to set +management.contextPath=/admin (for instance) and use an +OAuth2SsoConfigurer to set the access rules, e.g.

+
+
+
+
	@Configuration
+	@EnableOAuth2Sso
+	@EnableAutoConfiguration
+	protected static class TestConfiguration extends OAuth2SsoConfigurerAdapter {
+		@Override
+		public void configure(HttpSecurity http) {
+	         http.authorizeRequests()
+                 .antMatchers("/admin/**").role("ADMIN")
+                 .anyRequest().authenticated();
+		}
+	}
+
+
+

Resource Server

@@ -2997,11 +3031,11 @@ instance).

OAuth2 Single Sign On

Spring Cloud Security provides the @EnableOAuth2Sso annotation and -binds the app to environment properties in oauth2.*. Spring Cloud +binds the app to environment properties in spring.oauth2.*. Spring Cloud for Cloud Foundry just sets up default environment properties so that it all just works if you bind to a Cloud Foundry service instance called "sso". The service credentials are mapped to the SSO -properties, i.e. (from oauth2.client.*) clientId, clientSecret, +properties, i.e. (from spring.oauth2.client.*) clientId, clientSecret, tokenUri, authorizationUri, (and from oauth2.resource.*) userInfoUri, tokenInfoUri, keyValue, keyUri. Refer to the Spring Cloud Security documentation for details of which combinations @@ -3009,8 +3043,8 @@ will work together. The main thing is that in Cloud Foundry you only need one service to cover all the necessary credentials.

-

To use a different sercice instance name (i.e. not "sso") just set -oauth2.sso.serviceId to your custom name.

+

To use a different service instance name (i.e. not "sso") just set +spring.oauth2.sso.serviceId to your custom name.

@@ -3018,7 +3052,7 @@ need one service to cover all the necessary credentials.

Spring Cloud Security already has support for decoding JWT tokens if you just provide the verification key (as an environment property). In -Cloud Foundry you can pick that property up from a servcice binding +Cloud Foundry you can pick that property up from a service binding (keyValue or keyUri).

@@ -3056,7 +3090,7 @@ service or the "resource" service if you have one).

To use a different sercice instance name (i.e. not "resource" or -"sso") just set oauth2.resource.serviceId to your custom name.

+"sso") just set spring.oauth2.resource.serviceId to your custom name.

@@ -3067,13 +3101,13 @@ service or the "resource" service if you have one).

  • -

    oauth2.sso.* to vcap.services.${oauth2.sso.serviceId:sso}.credentials.*

    +

    spring.oauth2.sso.* to vcap.services.${spring.oauth2.sso.serviceId:sso}.credentials.*

  • -

    oauth2.client.* to vcap.services.${oauth2.sso.serviceId:sso}.credentials.tokenUri:${vcap.services.${oauth2.resource.serviceId:resource}.credentials.*

    +

    spring.oauth2.client.* to vcap.services.${spring.oauth2.sso.serviceId:sso}.credentials.tokenUri:${vcap.services.${spring.oauth2.resource.serviceId:resource}.credentials.*

  • -

    oauth2.resource.(jwt).* to vcap.services.${oauth2.resource.serviceId:resource}.credentials.tokenUri:${vcap.services.${oauth2.sso.serviceId:sso}.credentials.*

    +

    spring.oauth2.resource.(jwt).* to vcap.services.${spring.oauth2.resource.serviceId:resource}.credentials.tokenUri:${vcap.services.${spring.oauth2.sso.serviceId:sso}.credentials.*

@@ -3083,7 +3117,7 @@ service or the "resource" service if you have one).