具有 Spring 安全性的 Spring Cloud Eureka

Question

我有一个使用 eureka 服务器和客户端的项目。 Eureka 服务器使用 Spring Security，访问任何 URL 的用户都应该进行身份验证。这也适用于 Eureka 客户端。

当前配置如下：

尤里卡服务器：

Java：

@SpringBootApplication
@EnableEurekaServer
@EnableZuulProxy
@Controller
public class UiApplication {

    @GetMapping("/user")
    @ResponseBody
    public Principal user(Principal user) {
        return user;
    }

    @GetMapping(value = "/{path:[^\\.]*}")
    public String redirect() {
        return "forward:/";
    }

    public static void main(String[] args) {
        SpringApplication.run(UiApplication.class, args);
    }

    @Configuration
    @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
    protected static class SecurityConfiguration extends WebSecurityConfigurerAdapter {
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            // @formatter:off
            http
                .httpBasic().and()
                .logout().and()
                .authorizeRequests()
                .antMatchers("/index.html", "/", "/home", "/login").permitAll()
                    .anyRequest().authenticated()
                    .and()
                .csrf()
                    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
            // @formatter:on
        }
    }

}

配置：

security:
  basic:
    enabled: true
  user:
    password: password
spring:
  application:
    name: main
  session:
    store-type: redis
zuul:
  routes:
    resource:
      path: /resource/**
      #url: http://localhost:9000
      sensitive-headers:

eureka:
  instance:
    hostname: localhost
  client:
    registerWithEureka: true
    fetchRegistry: true
    serviceUrl:
      defaultZone: http://user:password@localhost:8080/eureka/

在启动服务器时我已经收到异常，因为为服务器启用了 eureka 客户端并尝试连接，但由于身份验证问题而无法连接。 例外情况如下：

com.netflix.discovery.shared.transport.TransportException: Cannot execute request on any known server

如果我在服务器属性中禁用弹簧安全，一切正常。如果激活了spring security，如何验证eureka客户端？

Answer 1

您需要明确禁用 CSRF 保护 在 Sprint 类中声明以下定义：

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.cloud.netflix.eureka.server.EnableEurekaServer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@SpringBootApplication
@EnableEurekaServer
public class EurekaClientApplication {

    @EnableWebSecurity
    static class WebSecurityConfig extends WebSecurityConfigurerAdapter {

        /**
         * disable CSRF
         * @param http
         * @throws Exception
         */
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf().disable();
        }
    }

    public static void main(String[] args) {
        SpringApplication.run(EurekaClientApplication.class, args);
    }
}

Answer 2

使用下面的安全配置。同样在您的 ZUUL 服务器中将其更改为 @EnableEurekaClient 来自@EnableEurekaServer

package com.debopam.discovery;


import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;

/**
 * @author Debopam
 *
 */
@Configuration
@EnableWebSecurity
@Order(1)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
        .withUser("discUser").password("discPassword").roles("SYSTEM")
        .and()
        .withUser("admin").password("admin").roles("ADMIN")
        .and()
        .withUser("actuator").password("actuator").roles("ACTUATOR");
        ;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.sessionManagement()
                        .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED).and()
                        .httpBasic().and()/*disable().*/
                        .authorizeRequests()
                            .antMatchers(HttpMethod.GET, "/") .hasRole("ADMIN")
                            .antMatchers("/manage/health**").permitAll()
                            .antMatchers("/manage/**").hasRole("ACTUATOR")
                            .antMatchers("/eureka/css/**","/eureka/images/**","/eureka/fonts/**", "/eureka/js/**").permitAll()
                            .antMatchers("/eureka/**").hasRole("SYSTEM")
                        .anyRequest().denyAll()
                .and().csrf().disable();
    }
}