Spring Boot Admin客户端POST到管理员/实例配置用户和密码引发403禁止所有客户端

Question

我已将 SBA 集成到项目中。没有任何身份验证，所有客户端都注册 SBA 服务器，我可以看到我打开的所有执行器端点。 我希望在 SBA 管理页面上有登录页面，并希望只为具有适当权限的 SBA 客户开放注册。根据 SBA 文档，我在两边都添加了用户/密码属性。 如果我只是在 SBA 服务器上添加用户和密码，并且我还为所有 SBA 客户端配置了相同的用户和密码，所有客户端都会收到响应 403 FORBIDDEN Failed to register application as Application() SBA服务器部分： 应用程序.properties

    spring.security.user.name=admin
    spring.security.user.password=admin

    spring.boot.admin.client.instance.metadata.user.name=admin
    spring.boot.admin.client.instance.metadata.user.password=admin
    server.port=8090

    management.endpoints.web.exposure.include=
    management.endpoints.web.base-path=/_manage
    management.endpoints.jmx.exposure.include=
    management.endpoint.shutdown.enabled=true
    management.server.port=8090

对 /instances 开放权限的安全配置

    @Configuration
    @ConditionalOnProperty(value = "spring.security.enabled", havingValue = "true")
    @EnableWebSecurity
    public class WebSecurityConfig  extends WebSecurityConfigurerAdapter {

      @Override
      protected void configure(HttpSecurity http) throws Exception {
        http
            .formLogin()
            .loginPage("/login.html")
            .loginProcessingUrl("/login")
            .permitAll();
        http
            .logout().logoutUrl("/logout");
        http
            .csrf().disable();
        http
            .authorizeRequests()
            .antMatchers("/login.html", "/** ** /** .css", "/img/** ** ", "/third-party/** ** ")
            .permitAll();
        http
            .authorizeRequests()
            .antMatchers("/instances")
            .permitAll();
            //.authenticated();
        http.httpBasic();
      }
    }

SBA 客户端具有相同的用户名和密码，才能在 SBA 服务器上注册： 应用程序.properties

    instance.name=clientdemo
    feed.generation.type=CLIENTDEMO

    spring.boot.admin.url=http://localhost:8090
    spring.boot.admin.client.url=http://localhost:8090  

    spring.boot.admin.client.username=admin
    spring.boot.admin.client.password=admin
    spring.security.user.name=admin
    spring.security.user.password=admin

    server.port=8091
    # ACTUATOR
    management.endpoints.web.exposure.include=*
    #management.endpoints.web.base-path=/_manage
    management.endpoint.shutdown.enabled=true
    management.server.port=8091

作为 SBA 客户端的结果，我从日志中看到一个错误：

    : Writing [Application(name=demo-worker, managementUrl=http://http://localhost:8091/actuator, healthUrl=http://localhost:8091/actuator/health, serviceUrl=http://localhost:8091/)] as "application/json"
    : sun.net.www.MessageHeader@4089d6fd8 pairs: {POST /instances HTTP/1.1: null}{Accept: application/json}{Content-Type: application/json}{Authorization: Basic YWRtaW46YWRtaW4=}{User-Agent: Java/1.8.0_211}{Host: localhost:8090}{Connection: keep-alive}{Content-Length: 267}
    : sun.net.www.MessageHeader@50cf05ff11 pairs: {null: HTTP/1.1 403}{Content-Type: text/plain}{Cache-Control: no-cache, no-store, max-age=0, must-revalidate}{Pragma: no-cache}{Expires: 0}{X-Content-Type-Options: nosniff}{X-Frame-Options: DENY}{X-XSS-Protection: 1 ; mode=block}{Referrer-Policy: no-referrer}{Transfer-Encoding: chunked}{Date: Wed, 13 Nov 2019 12:48:32 GMT}
    : Response 403 FORBIDDEN
    : Failed to register application as Application(name=demo-worker, managementUrl=http://localhost:8091/actuator, healthUrl=http://localhost:8091/actuator/health, serviceUrl=http://localhost:8091/) at spring-boot-admin ([http://localhost:8090/instances]): 403 null
    : HTTP POST http://localhost:8090/instances
    : Accept=[application/json, application/*+json]

从 SBA 服务器端，我在日志中看到：

    {"name":"demo-worker","managementUrl":"http://localhost:8091/actuator","healthUrl":"http://localhost:8091/actuator/health","serviceUrl":"http://localhost:8091/","metadata":o.a.c.a.AuthenticatorBase: Security checking request POST /instances

我的 SBA 服务器注册在 8090 端口，SBA 客户端注册在 8091 端口。

Answer 1

你应该添加这个： .antMatchers(HttpMethod.POST, "/actuator/**") .permitAll()