Ndtyjky

How do I make use of Spring Security for securing the actuator endpoints but not interfere with any of the other application URLs? The security mechanism in our application is handled by a different framework so I would like to disable Spring Security by default and only enabled for /actuator/ endpoints.

To achieve this, I've added the following to the initialization class.

@SpringBootApplication(exclude = { SecurityAutoConfiguration.class })

With that, the Spring Security default configuration is disabled. After this, what changes do I need to make configure security for actuator endpoints?

There isn't a separate context for the actuator anymore.

Assumption is that as long as the non-actuator endpoints just need no security restrictions the following configuration would work.

@Configuration

public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override

    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).authenticated().anyRequest().permitAll()

                .and().formLogin();

    }

}

The EndpointRequest handles matching any Actuator endpoint, giving a form login for the sake of testing. Note that even /info and /health are secured. The EndpointRequest has more options for granularity; additionally in Spring Boot 2 only info, and health are enabled by default.

Or you could just secure the paths behind whatever security mechanism you are using for your other APIs

I pushed an example app here,

https://github.com/DarrenForsythe/secure-spring-actuator-only

You can use below code and configurations

application.properties

spring.security.user.name=user

spring.security.user.password=password

spring.security.user.roles=ENDPOINT_ADMIN

Securing Actuator endpoints

import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;



/**

 * @author dpoddar

 *

 */

@Configuration

@EnableWebSecurity

public class ActuatorSecurity extends WebSecurityConfigurerAdapter {



    @Override

    protected void configure(HttpSecurity http) throws Exception {

        http

        .csrf().disable()

        .authorizeRequests()

        .requestMatchers(EndpointRequest.to("health", "flyway","info")).permitAll()

        .requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ENDPOINT_ADMIN")

        .and()

        .httpBasic()

            ;

    }



}