SpringBoot 2 Actuator with Spring Security

Question

How do I make use of Spring Security for securing the actuator endpoints but not interfere with any of the other application URLs? The security mechanism in our application is handled by a different framework so I would like to disable Spring Security by default and only enabled for /actuator/ endpoints.

To achieve this, I've added the following to the initialization class.

@SpringBootApplication(exclude = { SecurityAutoConfiguration.class })

With that, the Spring Security default configuration is disabled. After this, what changes do I need to make configure security for actuator endpoints?

Answer 1

You can use below code and configurations

application.properties

spring.security.user.name=user
spring.security.user.password=password
spring.security.user.roles=ENDPOINT_ADMIN

Securing Actuator endpoints

import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

/**
 * @author dpoddar
 *
 */
@Configuration
@EnableWebSecurity
public class ActuatorSecurity extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .csrf().disable()
        .authorizeRequests()
        .requestMatchers(EndpointRequest.to("health", "flyway","info")).permitAll()
        .requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ENDPOINT_ADMIN")
        .and()
        .httpBasic()
            ;
    }

}

Answer 2

There isn't a separate context for the actuator anymore.

Assumption is that as long as the non-actuator endpoints just need no security restrictions the following configuration would work.

@Configuration
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).authenticated().anyRequest().permitAll()
                .and().formLogin();
    }
}

The EndpointRequest handles matching any Actuator endpoint, giving a form login for the sake of testing. Note that even /info and /health are secured. The EndpointRequest has more options for granularity; additionally in Spring Boot 2 only info, and health are enabled by default.

Or you could just secure the paths behind whatever security mechanism you are using for your other APIs

I pushed an example app here,

https://github.com/DarrenForsythe/secure-spring-actuator-only