Spring Boot 身份验证 - 管理控制台 403 响应客户端

Question

我正在使用 jdk 1.8 和 Spring boot 2.1.2。我想在 Spring Boot 的管理控制台及其客户端中启用身份验证。我在Administration application.properties中设置：spring.security.user.name=adminspring.security.user.password=secretspring.boot.admin.discovery.enabled=truemanagement.endpoints.web.exposure.include=*management.endpoints.web.cors.allowed-methods=GET,POST在管理项目中，我添加了这个类：@EnableWebSecurity@Configurationpublic class SecuritySecureConfig extends WebSecurityConfigurerAdapter {    private static final Logger logger = (Logger) LoggerFactory.getLogger(SecuritySecureConfig.class);    private final String adminContextPath;    public SecuritySecureConfig(AdminServerProperties adminServerProperties) {        this.adminContextPath = adminServerProperties.getContextPath();    }    @Overrideprotected void configure(HttpSecurity http) throws Exception {    SavedRequestAwareAuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();    successHandler.setTargetUrlParameter("redirectTo");    successHandler.setDefaultTargetUrl(adminContextPath + "/");    http.authorizeRequests()            .antMatchers(adminContextPath + "/assets/**").permitAll()            .antMatchers(adminContextPath + "/login").permitAll()            .anyRequest().authenticated()            .and()            .formLogin().loginPage(adminContextPath + "/login").successHandler(successHandler).and()            .logout().logoutUrl(adminContextPath + "/logout").and()            .httpBasic().and()            .csrf()                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())            .ignoringAntMatchers(                    adminContextPath + "/instances",                    adminContextPath + "/actuator/**"            );    }}

Answer 1

我有同样的问题，所以使用

@EnableWebFluxSecurity

并不是

@EnableWebSecurity

像这样

@Configuration

@EnableWebFluxSecurity

public class AppSecurityConfig   {

    private final AdminServerProperties adminServer;

    public AppSecurityConfig (AdminServerProperties adminServer) {

        this.adminServer = adminServer;

    }

    @Bean

    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {

        http

            .securityMatcher(new NegatedServerWebExchangeMatcher(

                ServerWebExchangeMatchers.pathMatchers("/instances")))

            .securityMatcher(new NegatedServerWebExchangeMatcher(

                ServerWebExchangeMatchers.pathMatchers("/actuator/**")))

            .authorizeExchange()

            .anyExchange().authenticated()

            .and()

            .formLogin()

            .loginPage(this.adminServer.getContextPath() + "/login")

            .and()

            .logout()

            .logoutUrl(this.adminServer.getContextPath() + "/logout")

            .and()

            .httpBasic()

            .and()

            .csrf().disable();

        return http.build();

    } }

在你的 application.yml

spring:

  security:

    user:

      password: ${ADMIN_PASSWORD}

      name: ${ADMIN_USER}

  application:

    name: Admin Server 

  boot:

    admin:

      client:

        username: ${ADMIN_USER}

        password: ${ADMIN_PASSWORD}

        url: ${ADMIN_SERVER_URL}

        enabled: true

      ui:

        cache:

          no-cache: true

        title: App Monitoring

        instance:

          name: ${spring.application.name}

  main:

    allow-bean-definition-overriding: true

management:

  endpoints:

    web:

      exposure:

        include: "*"

      cors:

        allowed-origins: "*"

        allowed-methods: GET,POST

  endpoint:

    health:

      show-details: always

如果您愿意，它可以自行监控

在客户端应用程序中

spring:

  boot:

    admin:

      client:

        url: ${ADMIN_SERVER_URL}

        username: ${ADMIN_USER}

        password: ${ADMIN_PASSWORD}

        instance:

          name: ${spring.application.name}

        auto-registration: true

  application:

    name: Client App