Actuator "sensitive" endpoints secure since 1.5.x version, is it possible to specify user in properties or yml file and access these endpoints without adding spring security into project?
I know that there's property management.security.enabled can be set to false to expose endpoints, but want to keep them secure:)
Yes you can do it.
Just add the below lines in src/main/resources/application.properties file.
management.security.enabled=true
security.user.name=admin
security.user.password=admin1
management.security.roles=SUPERUSER
After this, add below dependency in your application pom.xml file.
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
Restart your application and try to access any sensetive actuator. You will be prompted to enter username and password. Enter the username and password that you configured in application.priperties.
After entering you will be able to access the sentive actuators.
Hope this helps.
Happy coding
Related
I have updated the Spring boot from 2.0.9.RELEASE to 2.4.3, and I am using the package to get the AWS Secrets version 2.2.5.RELEASE. When I deploy the code, it looks like it didn't find the credentials, and the database connection can't be closed.
bootstrap.properties
spring.application.name=myapp
aws.secretsmanager.region=eu-central-1
With Spring Boot 2.4.0 Bootstrap phase was deprecated, that is why nothing is happening.
Because of deprecation and giving users more control over specifying which secrets they want, a new way of loading secrets was introduced in 2.3.0.
More about the new way and prefered way of loading secrets with spring.config.import can be found on here.
However, if you would still like to use old way of loading secrets with bootstrap phase, please add following dependency:
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-bootstrap</artifactId>
<version>{spring-cloud-version}</version>
</dependency>
I am working with Spring Boot and I am using spring-data-rest-hal-browser, everything seems to be fine, except when i try to hit the URL: localhost:8080 I get redirected to http://localhost:8080/login to use the HAL browser to navigate my endpoint, then I get a screen requesting for a user and a password that I don't have.
What are the default credentials to login to spring security and how can I change them or disable the login option?
This is the dependency i am using:
<dependency>
<groupId>org.springframework.data</groupId>
<artifactId>spring-data-rest-hal-browser</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
And this is the login screen:
Take a look at the console output after running your application. If you have no run-time exceptions, then you should easily find the credentials. By default the username is "user" and the password is always different and therefore generated from the system.
For more clarity, the login page comes with this dependency:
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
Also, if you want to set some values for the credentials, then go to application.properties file and add those two lines:
spring.security.user.name= your_username
spring.security.user.password= your_password
Default username is user
password can be found in the console when you run your application.
example:
Using generated security password: 18ea5687-bc63-4663-9377-e2817c9d2568
If you want to set them yourself you can do so by overriding the defaults in application.properties:
spring.security.user.name=stack
spring.security.user.password=overflow
I'm trying to in corporate Spring Actuator to my application. I have added the dependency in my pom.xml:
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
<version>1.4.2.RELEASE</version>
</dependency>
But I get a 404 when trying to access the /health endpoint. After looking online, I've read that I need to also have the spring-boot-starter-web dependency in my POM. I was under the assumption that I only need the actuator dependency in order to get it working
Yes web is needed if you want to access via HTTP (otherwise only JMX is available).
The documentation for actuator states
"Click Dependencies and select Spring Web and Spring Boot Actuator."
I'm using spring-boot-security for basic authentication on my #RestController endpoints, as follows:
pom.xml:
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
application.properties:
security.user.name=user
security.user.password=pass
Question: how can I disable the basic auth in development, and only enable it if a specific profile is active using startup parameter -Dspring.profiles.active=production.
I would like to move the properties above into application-production.properties. And in dev there should not be any auth on the endpoints.
From a security perspective you probably want to do the opposite. Enable security by default and disable when running with a dev profile. Which is actually pretty easy to do add an application-dev.properties (assuming your profile is named dev.
Add the following to the file
security.basic.enabled=false
And for dev start with the profile enabled.
I am currently working with Spring Boot with a number of starter packs, such as the web MVC framework, Thymeleaf templates and security.
Each of these packages have a lot of different configuration options. I have mainly been using the source from the Auto-configuration package to figure out which beans need to be wired up and how to do that.
However, Is there any easy way to find a list of expected beans/classes that are needed by a given Spring package?
To view the beans you can you spring boot actuator
To Enable actuator, you can simply add the actuator starter dependency to your project.
For Gradle
compile("'org.springframework.boot:spring-boot-starter-actuator:1.3.1.RELEASE'
")
For Maven
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
<version>1.3.1.RELEASE</version>
</dependency>
You can skip the version if you are using spring boot parent pom
Now you can rebuild your application make get request to http://server:port/beans if local and port is 8080 then
http://localhost:8080/beans
If you want to access using CURL command line tool you can
curl http://localhost:8080/beans
For more information visit
http://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-endpoints.html