spring boot management end points basic security

Question

How do I use basic security for management end points such as /env, /health, /metrics? I want to use different user credentials for the above end points compared to the other application controller end points security. In my application.properties file, I specified below for the application controller security

security.user.name=user
security.user.password=password

But I want different username/password for management end points. Could not find management.security.user.name property.

Answer 1

To implement end points basic security you need to use below code

security.user.name=user
security.user.password=password

and in configuration file should be like below one

@Configuration
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests().anyRequest().authenticated().and().httpBasic();
    }
}

still not working then hope this will work

Basic Authentication

Answer 2

Spring security has a "global" AuthenticationManager configured in @Bean instances of type GlobalAuthenticationConfigurerAdapter. This AuthenticationManager is the one that is configured by the security.user.* properties, unless you set security.basic.enabled=false. The global AM is also attached to the management endpoints by default, and it is the parent of any "Local" AuthenticationManagers defined in WebSecurityConfigurationAdapters (they are all ProviderManagers).

Thus, if you want different user accounts for management endpoints and application endpoints, you have (at least) two choices:

• Define a local AM for your application endpoints in a WebSecurityConfigurationAdapter and ensure that the management endpoints are not covered by that filter. This is easy, since it's what you get without thinking very much and just adding an AuthenticationManagerBuilder to your WebSecurityConfigurationAdapter (as long as it is ordered carefully in relation to the filter that secures the management endpoints).

• Use the global AM (or indeed another local one) for application endpoints and reconfigure the security for the management endpoints (e.g. set security.basic.enabled=false and add your own WebSecurityConfigurerAdapter covering the management endpoints). This might be more work, and duplicates some of the Boot defaults, but at least you will know what you are getting.