Question

我有一个带有spring-security和dropwizard指标的spring-boot应用程序。它使用Angularjs作为前端。身份验证是使用单独的login.html页面完成的，其中angularjs控制器将凭据发布到'/ login'，并在成功响应路由到index.html（单独的angularjs应用程序）之后完成。在我尝试访问dropwizard指标之前，这一切都很有效。在这种情况下，我得到一个spring-security异常，说用户是匿名的（所有其他url工作正常）。

我的spring-security配置：

@Configuration
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
@EnableWebSecurity
public class FormLoginSecurityConfigurer extends WebSecurityConfigurerAdapter {

    private class AuthSuccessHandler implements AuthenticationSuccessHandler {
        @Override
        public void onAuthenticationSuccess(HttpServletRequest request,
                HttpServletResponse response, Authentication authentication)
                throws IOException, ServletException {
            response.setStatus(HttpServletResponse.SC_OK);
        }
    }

    private class AuthFailureHandler implements AuthenticationFailureHandler {
        @Override
        public void onAuthenticationFailure(HttpServletRequest request,
                HttpServletResponse response, AuthenticationException exception)
                throws IOException, ServletException {
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        }
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/login.html", "/scripts/login/**", "/libs/**", "/styles/**", "/images/**").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin().loginPage("/login.html").loginProcessingUrl("/login")
                    .usernameParameter("username").passwordParameter("password")
                    .successHandler(new AuthSuccessHandler())
                    .failureHandler(new AuthFailureHandler())
                .and().logout().logoutUrl("/logout").logoutSuccessUrl("/login.html")
                .and().addFilterAfter(new CsrfHeaderFilter(), CsrfFilter.class)
                .csrf().csrfTokenRepository(CsrfHeaderFilter.csrfTokenRepository());
    }

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
    }
}

指标servlet在ServletContextInitilizer中注册：

/**
 * Configuration of web application with Servlet 3.0 APIs.
 */
@Configuration
public class WebConfigurer implements ServletContextInitializer {

    @Override
    public void onStartup(ServletContext servletContext) throws ServletException {
        initMetrics(servletContext,
                EnumSet.of(DispatcherType.REQUEST, DispatcherType.FORWARD, DispatcherType.ASYNC));
    }

    /**
     * Initializes Metrics.
     */
    private void initMetrics(ServletContext servletContext, EnumSet<DispatcherType> disps) {
        log.debug("Initializing Metrics registries");
        servletContext.setAttribute(InstrumentedFilter.REGISTRY_ATTRIBUTE,
                metricRegistry);
        servletContext.setAttribute(MetricsServlet.METRICS_REGISTRY,
                metricRegistry);

        log.debug("Registering Metrics Filter");
        FilterRegistration.Dynamic metricsFilter = servletContext.addFilter("webappMetricsFilter",
                new InstrumentedFilter());

        metricsFilter.addMappingForUrlPatterns(disps, true, "/*");
        metricsFilter.setAsyncSupported(true);

        log.debug("Registering Metrics Servlet");
        ServletRegistration.Dynamic metricsAdminServlet =
                servletContext.addServlet("metricsServlet", new MetricsServlet());

        metricsAdminServlet.addMapping("/metrics/metrics/*");
        metricsAdminServlet.setAsyncSupported(true);
        metricsAdminServlet.setLoadOnStartup(2);
    }
}

但是当我访问/ metrics / metrics下的任何内容时，浏览器会提示进行基本身份验证。响应具有以下标头WWW-Authenticate:"Basic realm="Spring""。其他资源下载得很好。

我是这类应用程序的新手并且有点沮丧:)感谢任何帮助。

Answer 1

如果知道要查找的内容，请在文档中显示所有内容 - link

可以使用外部属性（management.security。*）修改Actuator安全功能。要覆盖应用程序访问规则，请添加类型为WebSecurityConfigurerAdapter的@Bean，如果您不想覆盖执行器访问规则，请使用@Order（SecurityProperties.ACCESS_OVERRIDE_ORDER）;如果您想要覆盖，请使用@Order（ManagementServerProperties.ACCESS_OVERRIDE_ORDER）执行器访问规则。

将订单更改为ManagementServerProperties.ACCESS_OVERRIDE_ORDER，现在可以正常工作。

spring-boot，spring-security和dropwizard指标

1 个答案: