Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-05 17:57:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Make Observations Selectable

Browse Source 
Closes gh-15678
This commit is contained in:
Josh Cummings
2024-09-23 13:00:00 -06:00
parent 69e3c248fa
commit d6b620b9f7
25 changed files with 927 additions and 268 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/modules/ROOT/pages/reactive/integrations/observability.adoc
+66 -7
View File
@@ -187,7 +187,7 @@ Xml::
If you don't want any Spring Security observations, in a Spring Boot application you can publish a `ObservationRegistry.NOOP` `@Bean`.
However, this may turn off observations for more than just Spring Security.
Instead, you can alter the provided `ObservationRegistry` with an `ObservationPredicate` like the following:
Instead, you can publish a `SecurityObservationSettings` like the following:
[tabs]
======
@@ -196,9 +196,8 @@ Java::
[source,java,role="primary"]
----
@Bean
ObservationRegistryCustomizer<ObservationRegistry> noSpringSecurityObservations() {
ObservationPredicate predicate = (name, context) -> !name.startsWith("spring.security.");
return (registry) -> registry.observationConfig().observationPredicate(predicate);
SecurityObservationSettings noSpringSecurityObservations() {
return SecurityObservationSettings.noObservations();
}
----
@@ -207,17 +206,77 @@ Kotlin::
[source,kotlin,role="secondary"]
----
@Bean
fun noSpringSecurityObservations(): ObservationRegistryCustomizer<ObservationRegistry> {
ObservationPredicate predicate = (name: String, context: Observation.Context) -> !name.startsWith("spring.security.")
(registry: ObservationRegistry) -> registry.observationConfig().observationPredicate(predicate)
fun noSpringSecurityObservations(): SecurityObservationSettings {
return SecurityObservationSettings.noObservations()
}
----
======
and then Spring Security will not wrap any filter chains, authentications, or authorizations in their `ObservationXXX` counterparts.
[TIP]
There is no facility for disabling observations with XML support.
Instead, simply do not set the `observation-registry-ref` attribute.
You can also disable security for only a subset of Security's observations.
For example, the `SecurityObservationSettings` bean excludes the filter chain observations by default.
So, you can also do:
[tabs]
======
Java::
+
[source,java,role="primary"]
----
@Bean
SecurityObservationSettings defaultSpringSecurityObservations() {
return SecurityObservationSettings.withDefaults().build();
}
----
Kotlin::
+
[source,kotlin,role="secondary"]
----
@Bean
fun defaultSpringSecurityObservations(): SecurityObservationSettings {
return SecurityObservationSettings.withDefaults().build()
}
----
======
Or you can turn on and off observations individually, based on the defaults:
[tabs]
======
Java::
+
[source,java,role="primary"]
----
@Bean
SecurityObservationSettings allSpringSecurityObservations() {
return SecurityObservationSettings.withDefaults()
.shouldObserveFilterChains(true).build();
}
----
Kotlin::
+
[source,kotlin,role="secondary"]
----
@Bean
fun allSpringSecurityObservations(): SecurityObservationSettings {
return SecurityObservabilityDefaults.builder()
.shouldObserveFilterChains(true).build()
}
----
======
[NOTE]
=====
For backward compatibility, all Spring Security observations are made unless a `SecurityObservationSettings` is published.
=====
[[webflux-observability-tracing-listing]]
=== Trace Listing
docs/modules/ROOT/pages/servlet/integrations/observability.adoc
+66 -11
View File
@@ -192,7 +192,7 @@ Xml::
If you don't want any Spring Security observations, in a Spring Boot application you can publish a `ObservationRegistry.NOOP` `@Bean`.
However, this may turn off observations for more than just Spring Security.
Instead, you can alter the provided `ObservationRegistry` with an `ObservationPredicate` like the following:
Instead, you can publish a `SecurityObservationSettings` like the following:
[tabs]
======
@@ -201,9 +201,8 @@ Java::
[source,java,role="primary"]
----
@Bean
ObservationRegistryCustomizer<ObservationRegistry> noSpringSecurityObservations() {
ObservationPredicate predicate = (name, context) -> !name.startsWith("spring.security.");
return (registry) -> registry.observationConfig().observationPredicate(predicate);
SecurityObservationSettings noSpringSecurityObservations() {
return SecurityObservationSettings.noObservations();
}
----
@@ -212,21 +211,77 @@ Kotlin::
[source,kotlin,role="secondary"]
----
@Bean
fun noSpringSecurityObservations(): ObservationRegistryCustomizer<ObservationRegistry> {
val predicate = ObservationPredicate { name: String, _: Observation.Context? ->
!name.startsWith("spring.security.")
}
return ObservationRegistryCustomizer { registry: ObservationRegistry ->
registry.observationConfig().observationPredicate(predicate)
}
fun noSpringSecurityObservations(): SecurityObservationSettings {
return SecurityObservationSettings.noObservations()
}
----
======
and then Spring Security will not wrap any filter chains, authentications, or authorizations in their `ObservationXXX` counterparts.
[TIP]
There is no facility for disabling observations with XML support.
Instead, simply do not set the `observation-registry-ref` attribute.
You can also disable security for only a subset of Security's observations.
For example, the `SecurityObservationSettings` bean excludes the filter chain observations by default.
So, you can also do:
[tabs]
======
Java::
+
[source,java,role="primary"]
----
@Bean
SecurityObservationSettings defaultSpringSecurityObservations() {
return SecurityObservationSettings.withDefaults().build();
}
----
Kotlin::
+
[source,kotlin,role="secondary"]
----
@Bean
fun defaultSpringSecurityObservations(): SecurityObservationSettings {
return SecurityObservationSettings.withDefaults().build()
}
----
======
Or you can turn on and off observations individually, based on the defaults:
[tabs]
======
Java::
+
[source,java,role="primary"]
----
@Bean
SecurityObservationSettings allSpringSecurityObservations() {
return SecurityObservationSettings.withDefaults()
.shouldObserveFilterChains(true).build();
}
----
Kotlin::
+
[source,kotlin,role="secondary"]
----
@Bean
fun allSpringSecurityObservations(): SecurityObservationSettings {
return SecurityObservationSettings.builder()
.shouldObserveFilterChains(true).build()
}
----
======
[NOTE]
=====
For backward compatibility, the all Spring Security observations are made unless a `SecurityObservationSettings` is published.
=====
[[observability-tracing-listing]]
=== Trace Listing