Question

我想用嵌入式tomcat配置 Spring Security for Hawt.io 。使用（用户和密码）自定义登录后，Hawt.io登录要求进行身份验证。但是在代码和配置中禁用了Hawt.io身份验证。如果我使用MvcConfig删除WebSecurityConfig和security.basic.enable= false，则无需任何有效的身份验证。但

我想使用自定义用户名和密码进行身份验证在那之后工作Hawt.io也在询问凭据部分被禁用。

请帮我解决这个问题。

application.properties

hawtio.authenticationEnabled = false
management.security.enabled=false
security.basic.enable= true
security.ignored= /**

的login.html

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
    <head>
        <title>Spring Security Example </title>
    </head>
    <body>
        <div th:if="${param.error}">
            Invalid username and password.
        </div>
        <div th:if="${param.logout}">
            You have been logged out.
        </div>
        <form th:action="@{/login}" method="post">
            <div><label> User Name : <input type="text" name="username"/> </label></div>
            <div><label> Password: <input type="password" name="password"/> </label></div>
            <div><input type="submit" value="Sign In"/></div>
        </form>
    </body>
</html>

MvcConfig.java

@Configuration
public class MvcConfig extends WebMvcConfigurerAdapter {
    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/login").setViewName("login");
    }
}

WebSecurityConfig.java

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/","/hawtio").permitAll().anyRequest().authenticated().and()
                .formLogin().loginPage("/login")
                .permitAll().and().logout().permitAll();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
    }
}

Application.java

@SpringBootApplication
@EnableHawtio
public class Application {
    public static void main(String[] args) {
        System.setProperty(AuthenticationFilter.HAWTIO_AUTHENTICATION_ENABLED, "false");
        SpringApplication.run(Application.class, args);
    }
}

的pom.xml

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>1.5.8.RELEASE</version>
    </parent>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>
        <dependency>
            <groupId>io.hawt</groupId>
            <artifactId>hawtio-springboot</artifactId>
            <version>1.5.6</version>
        </dependency>
        <dependency>
            <groupId>io.hawt</groupId>
            <artifactId>hawtio-core</artifactId>
            <version>1.5.6</version>
        </dependency>
    </dependencies>

更新连接到虚拟骆驼应用程序，如下面的登录再次来提供凭据进入404错误页面。

Answer 1

要使 hawtio 与Spring Security和Spring Boot一起使用，需要进行以下更改。你可以找到一个有效的例子here。 但是，我无法更新hawtio菜单栏中的用户名。

配置Spring Security

以标准方式为应用程序配置Spring安全性，除了对hawtio有一些特别的改变：

禁用hawtio身份验证，

@SpringBootApplication
@EnableHawtio
@ComponentScan(basePackages = {"com.basaki"})
public class Application {

    public static void main(String[] args) { 
        System.setProperty(AuthenticationFilter.
            HAWTIO_AUTHENTICATION_ENABLED,"false");
        SpringApplication.run(Application.class, args);
    }
}

在您的应用程序中禁用跨站点请求伪造（CSRF）。

确保退出请求网址与/hawtio/auth/logout/*匹配。这是hawtio用来使会话无效的URL。

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    ...

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/").permitAll()
        .anyRequest().authenticated()
        .and().formLogin().loginPage("/login")
        .failureUrl("/login?error")
        .permitAll()
        .and().logout().logoutRequestMatcher(
        new AntPathRequestMatcher(
                "/hawtio/auth/logout/*"))
        .logoutSuccessUrl("/login?logout")
        .and().csrf().disable();
    }
    ...
}

登录页面

由于您使用的是表单登录，因此您需要一个自定义登录页面。在此示例中，使用了login.html。

配置/login请求以匹配视图login.html

@Configuration
public class SpringMvcConfiguration extends WebMvcConfigurerAdapter {

    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/login").setViewName("login");
    }

    ...
}

更新hawtio的login.html

从hawtio页面注销后，它会将您带到自己的登录页面。由于它是使用AngularJS的单页面应用程序，因此您需要将此部分页面替换为您自己的基于AngularJS的自定义登录页面。

在此示例中，使用了login-hawtio.html页面。

<div ng-controller="LoginPlugin.LoginController">
    <h1 style="color: #78ab46;">Sign in</h1>

    <form action="/login" method="post">
        <div>
            <label style="font-weight: 700; padding-right: 15px;
                padding-left: 15px;">Username:
                <input id="username" type="text" name="username"
                     placeholder="Username"/>
            </label>
        </div>
        <div>
            <label style="font-weight: 700; padding-right: 15px;
                padding-left: 15px;">Password:
                <input id="password" type="password" 
                    name="password" required
                    placeholder="Password"/>
            </label>
        </div>
        <div>
            <button type="submit" class="btn btn-default">Sign In</button>
        </div>
    </form>
</div>

用于替换现有hawtio登录页面的控制器。

@Controller
public class HawtioController {

    private ResourceLoader loader;

    @Autowired
    public HawtioController(ResourceLoader loader) {
        this.loader = loader;
    }

    @RequestMapping(value = "/hawtio/app/core/html/login.html", method = RequestMethod.GET,
        produces = "text/html;charset=UTF-8")
    public void getHawtioLoginHtml(HttpServletResponse response) {
        String location = "classpath:/templates/login-hawtio.html";
        try {
            String body = getResource(location);
            response.setStatus(HttpStatus.OK.value());
            response.getWriter().write(body);
            response.getWriter().flush();
            response.getWriter().close();
        } catch (IOException e) {
            response.setStatus(HttpStatus.NOT_FOUND.value());
        }
    }
    ...
}

hawtio登录插件

需要自定义hawtio插件才能拥有自己的AngularJS登录控制器LoginPlugin.LoginController。从hawto的登录页面登录后，它用于重定向到hawtio的主页。

@Configuration
public class HawtioConfiguration {

    @Bean
    public HawtPlugin samplePlugin() {
        return new HawtPlugin("login-plugin",
            "/hawtio/plugins",
            "",
            new String[]{"plugin/js/login-plugin.js"});
    }
}

login-plugin.js位于resources/app/webapp/plugin/js文件夹下。

var LoginPlugin = (function(LoginPlugin) {

    LoginPlugin.pluginName = 'login-plugin';
    LoginPlugin.log = Logger.get('LoginPlugin');

    LoginPlugin.module = angular.module('login-plugin', ['hawtioCore'])
        .config(function($routeProvider) {
            $routeProvider.
            when('/home', {
                templateUrl: '/hawtio/index.html'
            });
         });

    LoginPlugin.module.run(function(workspace, viewRegistry, layoutFull) {

        LoginPlugin.log.info(LoginPlugin.pluginName, " loaded");
        viewRegistry["login-plugin"] = layoutFull;
        workspace.topLevelTabs.push({
            id: "LoginPlugin",
            content: "Login Plugin",
            title: "Login plugin loaded dynamically",
            isValid: function(workspace) { return true; },
            href: function() { return "#/login-plugin"; },
            isActive: function(workspace) {
                return workspace.isLinkActive("login-plugin"); }

        });
    });

    LoginPlugin.LoginController = function($scope, $rootScope, $http) {
        var fullUrl = "/hawtio/index.html";
        $http({method: 'GET', url: fullUrl});
    };

    return LoginPlugin;

})(LoginPlugin || {});

hawtioPluginLoader.addModule(LoginPlugin.pluginName);

Hawt.io的Spring Security

1 个答案:

配置Spring Security

登录页面

更新hawtio的login.html

hawtio登录插件