From d3979102f879b60792238426a3f59a259a6875f2 Mon Sep 17 00:00:00 2001 From: Tim Schimandle Date: Mon, 3 Oct 2016 13:01:01 -0600 Subject: [PATCH 1/6] BAEL-315 adding configuration for security on the config and discovery servers. --- .../application-config/discovery.properties | 2 +- .../application-config/gateway.properties | 2 +- .../application-config/resource.properties | 2 +- .../spring-cloud-bootstrap/config/pom.xml | 4 +++ .../integration/config/SecurityConfig.java | 25 +++++++++++++++++ .../src/main/resources/application.properties | 2 +- .../spring-cloud-bootstrap/discovery/pom.xml | 4 +++ .../integration/discovery/SecurityConfig.java | 28 +++++++++++++++++++ .../src/main/resources/bootstrap.properties | 4 ++- .../src/main/resources/bootstrap.properties | 2 ++ .../src/main/resources/bootstrap.properties | 2 ++ 11 files changed, 72 insertions(+), 5 deletions(-) create mode 100644 spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/integration/config/SecurityConfig.java create mode 100644 spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/integration/discovery/SecurityConfig.java diff --git a/spring-cloud/spring-cloud-bootstrap/application-config/discovery.properties b/spring-cloud/spring-cloud-bootstrap/application-config/discovery.properties index 7f3df86c7e..0df7988f69 100644 --- a/spring-cloud/spring-cloud-bootstrap/application-config/discovery.properties +++ b/spring-cloud/spring-cloud-bootstrap/application-config/discovery.properties @@ -3,6 +3,6 @@ server.port=8082 eureka.instance.hostname=localhost -eureka.client.serviceUrl.defaultZone=http://localhost:8082/eureka/ +eureka.client.serviceUrl.defaultZone=http://disc_discUser:discPassword@localhost:8082/eureka/ eureka.client.register-with-eureka=false eureka.client.fetch-registry=false diff --git a/spring-cloud/spring-cloud-bootstrap/application-config/gateway.properties b/spring-cloud/spring-cloud-bootstrap/application-config/gateway.properties index 77faec8421..fc04c5fc23 100644 --- a/spring-cloud/spring-cloud-bootstrap/application-config/gateway.properties +++ b/spring-cloud/spring-cloud-bootstrap/application-config/gateway.properties @@ -3,7 +3,7 @@ server.port=8080 eureka.client.region = default eureka.client.registryFetchIntervalSeconds = 5 -eureka.client.serviceUrl.defaultZone=http://localhost:8082/eureka/ +eureka.client.serviceUrl.defaultZone=http://disc_gatewayUser:gatewayPassword@localhost:8082/eureka/ zuul.routes.resource.path=/resource/** hystrix.command.resource.execution.isolation.thread.timeoutInMilliseconds: 5000 diff --git a/spring-cloud/spring-cloud-bootstrap/application-config/resource.properties b/spring-cloud/spring-cloud-bootstrap/application-config/resource.properties index 4e6cf3817c..8df874a104 100644 --- a/spring-cloud/spring-cloud-bootstrap/application-config/resource.properties +++ b/spring-cloud/spring-cloud-bootstrap/application-config/resource.properties @@ -5,4 +5,4 @@ resource.returnString=hello cloud eureka.client.region = default eureka.client.registryFetchIntervalSeconds = 5 -eureka.client.serviceUrl.defaultZone=http://localhost:8082/eureka/ +eureka.client.serviceUrl.defaultZone=http://disc_resourceUser:resourcePassword@localhost:8082/eureka/ diff --git a/spring-cloud/spring-cloud-bootstrap/config/pom.xml b/spring-cloud/spring-cloud-bootstrap/config/pom.xml index 0cb217acfb..9ba018733a 100644 --- a/spring-cloud/spring-cloud-bootstrap/config/pom.xml +++ b/spring-cloud/spring-cloud-bootstrap/config/pom.xml @@ -28,6 +28,10 @@ spring-boot-starter-test test + + org.springframework.boot + spring-boot-starter-security + diff --git a/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/integration/config/SecurityConfig.java b/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/integration/config/SecurityConfig.java new file mode 100644 index 0000000000..5392709fc8 --- /dev/null +++ b/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/integration/config/SecurityConfig.java @@ -0,0 +1,25 @@ +package com.baeldung.spring.cloud.integration.config; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; + +@Configuration +@EnableWebSecurity +public class SecurityConfig extends WebSecurityConfigurerAdapter { + + @Autowired + public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception{ + auth.inMemoryAuthentication() + .withUser("config_discUser") + .password("discPassword") + .and() + .withUser("config_gatewayUser") + .password("gatewayPassword") + .and() + .withUser("config_resourceUser") + .password("resourcePassword"); + } +} diff --git a/spring-cloud/spring-cloud-bootstrap/config/src/main/resources/application.properties b/spring-cloud/spring-cloud-bootstrap/config/src/main/resources/application.properties index 6f614d0690..ddbe33a3f4 100644 --- a/spring-cloud/spring-cloud-bootstrap/config/src/main/resources/application.properties +++ b/spring-cloud/spring-cloud-bootstrap/config/src/main/resources/application.properties @@ -5,4 +5,4 @@ spring.cloud.config.server.git.uri=file:///${user.home}/application-config eureka.client.region = default eureka.client.registryFetchIntervalSeconds = 5 -eureka.client.serviceUrl.defaultZone=http://localhost:8082/eureka \ No newline at end of file +eureka.client.serviceUrl.defaultZone=disc_configUser:configPassword@http://localhost:8082/eureka/ \ No newline at end of file diff --git a/spring-cloud/spring-cloud-bootstrap/discovery/pom.xml b/spring-cloud/spring-cloud-bootstrap/discovery/pom.xml index ee7c589549..3b23adbf54 100644 --- a/spring-cloud/spring-cloud-bootstrap/discovery/pom.xml +++ b/spring-cloud/spring-cloud-bootstrap/discovery/pom.xml @@ -28,6 +28,10 @@ spring-boot-starter-test test + + org.springframework.boot + spring-boot-starter-security + diff --git a/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/integration/discovery/SecurityConfig.java b/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/integration/discovery/SecurityConfig.java new file mode 100644 index 0000000000..7c245d3ad3 --- /dev/null +++ b/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/integration/discovery/SecurityConfig.java @@ -0,0 +1,28 @@ +package com.baeldung.spring.cloud.integration.discovery; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; + +@Configuration +@EnableWebSecurity +public class SecurityConfig extends WebSecurityConfigurerAdapter { + + @Autowired + public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception{ + auth.inMemoryAuthentication() + .withUser("disc_configUser") + .password("configPassword") + .and() + .withUser("disc_discUser") + .password("discPassword") + .and() + .withUser("disc_gatewayUser") + .password("gatewayPassword") + .and() + .withUser("disc_resourceUser") + .password("resourcePassword"); + } +} diff --git a/spring-cloud/spring-cloud-bootstrap/discovery/src/main/resources/bootstrap.properties b/spring-cloud/spring-cloud-bootstrap/discovery/src/main/resources/bootstrap.properties index ca9d59c9ed..2a8381a58d 100644 --- a/spring-cloud/spring-cloud-bootstrap/discovery/src/main/resources/bootstrap.properties +++ b/spring-cloud/spring-cloud-bootstrap/discovery/src/main/resources/bootstrap.properties @@ -1,2 +1,4 @@ spring.cloud.config.name=discovery -spring.cloud.config.uri=http://localhost:8081 \ No newline at end of file +spring.cloud.config.uri=http://localhost:8081 +spring.cloud.config.username=config_discUser +spring.cloud.config.password=discPassword \ No newline at end of file diff --git a/spring-cloud/spring-cloud-bootstrap/gateway/src/main/resources/bootstrap.properties b/spring-cloud/spring-cloud-bootstrap/gateway/src/main/resources/bootstrap.properties index 9610d72675..6c866f51f2 100644 --- a/spring-cloud/spring-cloud-bootstrap/gateway/src/main/resources/bootstrap.properties +++ b/spring-cloud/spring-cloud-bootstrap/gateway/src/main/resources/bootstrap.properties @@ -1,5 +1,7 @@ spring.cloud.config.name=gateway spring.cloud.config.discovery.service-id=config spring.cloud.config.discovery.enabled=true +spring.cloud.config.username=config_gatewayUser +spring.cloud.config.password=gatewayPassword eureka.client.serviceUrl.defaultZone=http://localhost:8082/eureka/ \ No newline at end of file diff --git a/spring-cloud/spring-cloud-bootstrap/resource/src/main/resources/bootstrap.properties b/spring-cloud/spring-cloud-bootstrap/resource/src/main/resources/bootstrap.properties index 3c88a0b520..b023855432 100644 --- a/spring-cloud/spring-cloud-bootstrap/resource/src/main/resources/bootstrap.properties +++ b/spring-cloud/spring-cloud-bootstrap/resource/src/main/resources/bootstrap.properties @@ -1,5 +1,7 @@ spring.cloud.config.name=resource spring.cloud.config.discovery.service-id=config spring.cloud.config.discovery.enabled=true +spring.cloud.config.username=config_resourceUser +spring.cloud.config.password=resourcePassword eureka.client.serviceUrl.defaultZone=http://localhost:8082/eureka/ \ No newline at end of file From d226ad2999e7f8ec87894630113929ab3c049e39 Mon Sep 17 00:00:00 2001 From: Tim Schimandle Date: Mon, 3 Oct 2016 14:24:58 -0600 Subject: [PATCH 2/6] BAEL-315 added security to config and dsicovery servers. --- .../config/ConfigApplication.java | 2 +- .../config/SecurityConfig.java | 18 +++++++++++-- .../src/main/resources/application.properties | 2 +- .../discovery/DiscoveryApplication.java | 2 +- .../discovery/SecurityConfig.java | 26 +++++++++++++++++-- .../gateway}/GatewayApplication.java | 2 +- .../src/main/resources/bootstrap.properties | 2 +- .../resource/ResourceApplication.java | 2 +- .../src/main/resources/bootstrap.properties | 2 +- 9 files changed, 47 insertions(+), 11 deletions(-) rename spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/{integration => bootstrap}/config/ConfigApplication.java (89%) rename spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/{integration => bootstrap}/config/SecurityConfig.java (62%) rename spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/{integration => bootstrap}/discovery/DiscoveryApplication.java (87%) rename spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/{integration => bootstrap}/discovery/SecurityConfig.java (54%) rename spring-cloud/spring-cloud-bootstrap/gateway/src/main/java/com/baeldung/spring/cloud/{integration/resource => bootstrap/gateway}/GatewayApplication.java (89%) rename spring-cloud/spring-cloud-bootstrap/resource/src/main/java/com/baeldung/spring/cloud/{integration => bootstrap}/resource/ResourceApplication.java (93%) diff --git a/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/integration/config/ConfigApplication.java b/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/ConfigApplication.java similarity index 89% rename from spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/integration/config/ConfigApplication.java rename to spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/ConfigApplication.java index ff6c093b8b..847c86f881 100644 --- a/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/integration/config/ConfigApplication.java +++ b/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/ConfigApplication.java @@ -1,4 +1,4 @@ -package com.baeldung.spring.cloud.integration.config; +package com.baeldung.spring.cloud.bootstrap.config; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; diff --git a/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/integration/config/SecurityConfig.java b/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java similarity index 62% rename from spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/integration/config/SecurityConfig.java rename to spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java index 5392709fc8..122079c763 100644 --- a/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/integration/config/SecurityConfig.java +++ b/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java @@ -1,8 +1,9 @@ -package com.baeldung.spring.cloud.integration.config; +package com.baeldung.spring.cloud.bootstrap.config; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; @@ -15,11 +16,24 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter { auth.inMemoryAuthentication() .withUser("config_discUser") .password("discPassword") + .roles("SYSTEM") .and() .withUser("config_gatewayUser") .password("gatewayPassword") + .roles("SYSTEM") .and() .withUser("config_resourceUser") - .password("resourcePassword"); + .password("resourcePassword") + .roles("SYSTEM"); + } + + @Override + protected void configure(HttpSecurity http) throws Exception { + http + .authorizeRequests() + .anyRequest().authenticated() + .and() + .httpBasic().and() + .csrf().disable(); } } diff --git a/spring-cloud/spring-cloud-bootstrap/config/src/main/resources/application.properties b/spring-cloud/spring-cloud-bootstrap/config/src/main/resources/application.properties index ddbe33a3f4..dda7552960 100644 --- a/spring-cloud/spring-cloud-bootstrap/config/src/main/resources/application.properties +++ b/spring-cloud/spring-cloud-bootstrap/config/src/main/resources/application.properties @@ -5,4 +5,4 @@ spring.cloud.config.server.git.uri=file:///${user.home}/application-config eureka.client.region = default eureka.client.registryFetchIntervalSeconds = 5 -eureka.client.serviceUrl.defaultZone=disc_configUser:configPassword@http://localhost:8082/eureka/ \ No newline at end of file +eureka.client.serviceUrl.defaultZone=http://disc_configUser:configPassword@localhost:8082/eureka/ \ No newline at end of file diff --git a/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/integration/discovery/DiscoveryApplication.java b/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/bootstrap/discovery/DiscoveryApplication.java similarity index 87% rename from spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/integration/discovery/DiscoveryApplication.java rename to spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/bootstrap/discovery/DiscoveryApplication.java index a21c65312f..32bcdc90b6 100644 --- a/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/integration/discovery/DiscoveryApplication.java +++ b/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/bootstrap/discovery/DiscoveryApplication.java @@ -1,4 +1,4 @@ -package com.baeldung.spring.cloud.integration.discovery; +package com.baeldung.spring.cloud.bootstrap.discovery; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; diff --git a/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/integration/discovery/SecurityConfig.java b/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/bootstrap/discovery/SecurityConfig.java similarity index 54% rename from spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/integration/discovery/SecurityConfig.java rename to spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/bootstrap/discovery/SecurityConfig.java index 7c245d3ad3..f6bd0ca167 100644 --- a/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/integration/discovery/SecurityConfig.java +++ b/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/bootstrap/discovery/SecurityConfig.java @@ -1,8 +1,10 @@ -package com.baeldung.spring.cloud.integration.discovery; +package com.baeldung.spring.cloud.bootstrap.discovery; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Configuration; +import org.springframework.http.HttpMethod; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; @@ -15,14 +17,34 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter { auth.inMemoryAuthentication() .withUser("disc_configUser") .password("configPassword") + .roles("SYSTEM") .and() .withUser("disc_discUser") .password("discPassword") + .roles("SYSTEM") .and() .withUser("disc_gatewayUser") .password("gatewayPassword") + .roles("SYSTEM") .and() .withUser("disc_resourceUser") - .password("resourcePassword"); + .password("resourcePassword") + .roles("SYSTEM") + .and() + .withUser("admin") + .password("password") + .roles("ADMIN"); + } + + @Override + protected void configure(HttpSecurity http) throws Exception { + http + .authorizeRequests() + .antMatchers(HttpMethod.GET, "/").hasRole("ADMIN") + .anyRequest().authenticated() + .and() + .httpBasic() + .and() + .csrf().disable(); } } diff --git a/spring-cloud/spring-cloud-bootstrap/gateway/src/main/java/com/baeldung/spring/cloud/integration/resource/GatewayApplication.java b/spring-cloud/spring-cloud-bootstrap/gateway/src/main/java/com/baeldung/spring/cloud/bootstrap/gateway/GatewayApplication.java similarity index 89% rename from spring-cloud/spring-cloud-bootstrap/gateway/src/main/java/com/baeldung/spring/cloud/integration/resource/GatewayApplication.java rename to spring-cloud/spring-cloud-bootstrap/gateway/src/main/java/com/baeldung/spring/cloud/bootstrap/gateway/GatewayApplication.java index 66e7c36f2a..ecdd5e066f 100644 --- a/spring-cloud/spring-cloud-bootstrap/gateway/src/main/java/com/baeldung/spring/cloud/integration/resource/GatewayApplication.java +++ b/spring-cloud/spring-cloud-bootstrap/gateway/src/main/java/com/baeldung/spring/cloud/bootstrap/gateway/GatewayApplication.java @@ -1,4 +1,4 @@ -package com.baeldung.spring.cloud.integration.resource; +package com.baeldung.spring.cloud.bootstrap.gateway; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; diff --git a/spring-cloud/spring-cloud-bootstrap/gateway/src/main/resources/bootstrap.properties b/spring-cloud/spring-cloud-bootstrap/gateway/src/main/resources/bootstrap.properties index 6c866f51f2..69d9155ce9 100644 --- a/spring-cloud/spring-cloud-bootstrap/gateway/src/main/resources/bootstrap.properties +++ b/spring-cloud/spring-cloud-bootstrap/gateway/src/main/resources/bootstrap.properties @@ -4,4 +4,4 @@ spring.cloud.config.discovery.enabled=true spring.cloud.config.username=config_gatewayUser spring.cloud.config.password=gatewayPassword -eureka.client.serviceUrl.defaultZone=http://localhost:8082/eureka/ \ No newline at end of file +eureka.client.serviceUrl.defaultZone=http://disc_gatewayUser:gatewayPassword@localhost:8082/eureka/ \ No newline at end of file diff --git a/spring-cloud/spring-cloud-bootstrap/resource/src/main/java/com/baeldung/spring/cloud/integration/resource/ResourceApplication.java b/spring-cloud/spring-cloud-bootstrap/resource/src/main/java/com/baeldung/spring/cloud/bootstrap/resource/ResourceApplication.java similarity index 93% rename from spring-cloud/spring-cloud-bootstrap/resource/src/main/java/com/baeldung/spring/cloud/integration/resource/ResourceApplication.java rename to spring-cloud/spring-cloud-bootstrap/resource/src/main/java/com/baeldung/spring/cloud/bootstrap/resource/ResourceApplication.java index 107a9d199f..c567f67444 100644 --- a/spring-cloud/spring-cloud-bootstrap/resource/src/main/java/com/baeldung/spring/cloud/integration/resource/ResourceApplication.java +++ b/spring-cloud/spring-cloud-bootstrap/resource/src/main/java/com/baeldung/spring/cloud/bootstrap/resource/ResourceApplication.java @@ -1,4 +1,4 @@ -package com.baeldung.spring.cloud.integration.resource; +package com.baeldung.spring.cloud.bootstrap.resource; import org.springframework.beans.factory.annotation.Value; import org.springframework.boot.SpringApplication; diff --git a/spring-cloud/spring-cloud-bootstrap/resource/src/main/resources/bootstrap.properties b/spring-cloud/spring-cloud-bootstrap/resource/src/main/resources/bootstrap.properties index b023855432..2917cd570d 100644 --- a/spring-cloud/spring-cloud-bootstrap/resource/src/main/resources/bootstrap.properties +++ b/spring-cloud/spring-cloud-bootstrap/resource/src/main/resources/bootstrap.properties @@ -4,4 +4,4 @@ spring.cloud.config.discovery.enabled=true spring.cloud.config.username=config_resourceUser spring.cloud.config.password=resourcePassword -eureka.client.serviceUrl.defaultZone=http://localhost:8082/eureka/ \ No newline at end of file +eureka.client.serviceUrl.defaultZone=http://disc_resourceUser:resourcePassword@localhost:8082/eureka/ \ No newline at end of file From 4029a3f5475633dff3603675255eeef8e2f9d912 Mon Sep 17 00:00:00 2001 From: Tim Schimandle Date: Mon, 3 Oct 2016 18:18:30 -0600 Subject: [PATCH 3/6] BAEL-315 really lock down the discovery server --- .../spring/cloud/bootstrap/discovery/SecurityConfig.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/bootstrap/discovery/SecurityConfig.java b/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/bootstrap/discovery/SecurityConfig.java index f6bd0ca167..20a7fdeda1 100644 --- a/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/bootstrap/discovery/SecurityConfig.java +++ b/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/bootstrap/discovery/SecurityConfig.java @@ -40,6 +40,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter { protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() + .antMatchers("/eureka/js/**","/eureka/css/**","/eureka/images/**","/eureka/fonts/**").authenticated() + .antMatchers("/eureka/**").hasRole("SYSTEM") .antMatchers(HttpMethod.GET, "/").hasRole("ADMIN") .anyRequest().authenticated() .and() From 95b967858ed5e43dd9c109ad73206032b2026903 Mon Sep 17 00:00:00 2001 From: Tim Schimandle Date: Mon, 3 Oct 2016 23:15:54 -0600 Subject: [PATCH 4/6] BAEL-315 reformatting some code. --- .../spring/cloud/bootstrap/config/SecurityConfig.java | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java b/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java index 122079c763..13c84dad94 100644 --- a/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java +++ b/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java @@ -31,9 +31,10 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter { protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() - .anyRequest().authenticated() + .anyRequest().authenticated() .and() - .httpBasic().and() - .csrf().disable(); + .httpBasic() + .and() + .csrf().disable(); } } From 317b596dd95521bc40296b920d4aeef7507d1c1b Mon Sep 17 00:00:00 2001 From: Tim Schimandle Date: Tue, 4 Oct 2016 10:05:49 -0600 Subject: [PATCH 5/6] BAEL-315 reducing the number of users to simplify the code. --- .../application-config/discovery.properties | 2 +- .../application-config/gateway.properties | 1 - .../application-config/resource.properties | 1 - .../cloud/bootstrap/config/SecurityConfig.java | 12 ++---------- .../src/main/resources/application.properties | 2 +- .../cloud/bootstrap/discovery/SecurityConfig.java | 14 +------------- .../src/main/resources/bootstrap.properties | 4 ++-- .../src/main/resources/bootstrap.properties | 6 +++--- .../src/main/resources/bootstrap.properties | 6 +++--- 9 files changed, 13 insertions(+), 35 deletions(-) diff --git a/spring-cloud/spring-cloud-bootstrap/application-config/discovery.properties b/spring-cloud/spring-cloud-bootstrap/application-config/discovery.properties index 0df7988f69..dd117e128c 100644 --- a/spring-cloud/spring-cloud-bootstrap/application-config/discovery.properties +++ b/spring-cloud/spring-cloud-bootstrap/application-config/discovery.properties @@ -3,6 +3,6 @@ server.port=8082 eureka.instance.hostname=localhost -eureka.client.serviceUrl.defaultZone=http://disc_discUser:discPassword@localhost:8082/eureka/ +eureka.client.serviceUrl.defaultZone=http://discUser:discPassword@localhost:8082/eureka/ eureka.client.register-with-eureka=false eureka.client.fetch-registry=false diff --git a/spring-cloud/spring-cloud-bootstrap/application-config/gateway.properties b/spring-cloud/spring-cloud-bootstrap/application-config/gateway.properties index fc04c5fc23..b33f28f7a6 100644 --- a/spring-cloud/spring-cloud-bootstrap/application-config/gateway.properties +++ b/spring-cloud/spring-cloud-bootstrap/application-config/gateway.properties @@ -3,7 +3,6 @@ server.port=8080 eureka.client.region = default eureka.client.registryFetchIntervalSeconds = 5 -eureka.client.serviceUrl.defaultZone=http://disc_gatewayUser:gatewayPassword@localhost:8082/eureka/ zuul.routes.resource.path=/resource/** hystrix.command.resource.execution.isolation.thread.timeoutInMilliseconds: 5000 diff --git a/spring-cloud/spring-cloud-bootstrap/application-config/resource.properties b/spring-cloud/spring-cloud-bootstrap/application-config/resource.properties index 8df874a104..e19715e986 100644 --- a/spring-cloud/spring-cloud-bootstrap/application-config/resource.properties +++ b/spring-cloud/spring-cloud-bootstrap/application-config/resource.properties @@ -5,4 +5,3 @@ resource.returnString=hello cloud eureka.client.region = default eureka.client.registryFetchIntervalSeconds = 5 -eureka.client.serviceUrl.defaultZone=http://disc_resourceUser:resourcePassword@localhost:8082/eureka/ diff --git a/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java b/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java index 13c84dad94..b0e5d17698 100644 --- a/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java +++ b/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java @@ -14,16 +14,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception{ auth.inMemoryAuthentication() - .withUser("config_discUser") - .password("discPassword") - .roles("SYSTEM") - .and() - .withUser("config_gatewayUser") - .password("gatewayPassword") - .roles("SYSTEM") - .and() - .withUser("config_resourceUser") - .password("resourcePassword") + .withUser("configUser") + .password("configPassword") .roles("SYSTEM"); } diff --git a/spring-cloud/spring-cloud-bootstrap/config/src/main/resources/application.properties b/spring-cloud/spring-cloud-bootstrap/config/src/main/resources/application.properties index dda7552960..6c47d001f4 100644 --- a/spring-cloud/spring-cloud-bootstrap/config/src/main/resources/application.properties +++ b/spring-cloud/spring-cloud-bootstrap/config/src/main/resources/application.properties @@ -5,4 +5,4 @@ spring.cloud.config.server.git.uri=file:///${user.home}/application-config eureka.client.region = default eureka.client.registryFetchIntervalSeconds = 5 -eureka.client.serviceUrl.defaultZone=http://disc_configUser:configPassword@localhost:8082/eureka/ \ No newline at end of file +eureka.client.serviceUrl.defaultZone=http://discUser:discPassword@localhost:8082/eureka/ \ No newline at end of file diff --git a/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/bootstrap/discovery/SecurityConfig.java b/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/bootstrap/discovery/SecurityConfig.java index 20a7fdeda1..22e0369cb1 100644 --- a/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/bootstrap/discovery/SecurityConfig.java +++ b/spring-cloud/spring-cloud-bootstrap/discovery/src/main/java/com/baeldung/spring/cloud/bootstrap/discovery/SecurityConfig.java @@ -15,21 +15,9 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception{ auth.inMemoryAuthentication() - .withUser("disc_configUser") - .password("configPassword") - .roles("SYSTEM") - .and() - .withUser("disc_discUser") + .withUser("discUser") .password("discPassword") .roles("SYSTEM") - .and() - .withUser("disc_gatewayUser") - .password("gatewayPassword") - .roles("SYSTEM") - .and() - .withUser("disc_resourceUser") - .password("resourcePassword") - .roles("SYSTEM") .and() .withUser("admin") .password("password") diff --git a/spring-cloud/spring-cloud-bootstrap/discovery/src/main/resources/bootstrap.properties b/spring-cloud/spring-cloud-bootstrap/discovery/src/main/resources/bootstrap.properties index 2a8381a58d..d31caf55b5 100644 --- a/spring-cloud/spring-cloud-bootstrap/discovery/src/main/resources/bootstrap.properties +++ b/spring-cloud/spring-cloud-bootstrap/discovery/src/main/resources/bootstrap.properties @@ -1,4 +1,4 @@ spring.cloud.config.name=discovery spring.cloud.config.uri=http://localhost:8081 -spring.cloud.config.username=config_discUser -spring.cloud.config.password=discPassword \ No newline at end of file +spring.cloud.config.username=configUser +spring.cloud.config.password=configPassword \ No newline at end of file diff --git a/spring-cloud/spring-cloud-bootstrap/gateway/src/main/resources/bootstrap.properties b/spring-cloud/spring-cloud-bootstrap/gateway/src/main/resources/bootstrap.properties index 69d9155ce9..43491ff36b 100644 --- a/spring-cloud/spring-cloud-bootstrap/gateway/src/main/resources/bootstrap.properties +++ b/spring-cloud/spring-cloud-bootstrap/gateway/src/main/resources/bootstrap.properties @@ -1,7 +1,7 @@ spring.cloud.config.name=gateway spring.cloud.config.discovery.service-id=config spring.cloud.config.discovery.enabled=true -spring.cloud.config.username=config_gatewayUser -spring.cloud.config.password=gatewayPassword +spring.cloud.config.username=configUser +spring.cloud.config.password=configPassword -eureka.client.serviceUrl.defaultZone=http://disc_gatewayUser:gatewayPassword@localhost:8082/eureka/ \ No newline at end of file +eureka.client.serviceUrl.defaultZone=http://discUser:discPassword@localhost:8082/eureka/ \ No newline at end of file diff --git a/spring-cloud/spring-cloud-bootstrap/resource/src/main/resources/bootstrap.properties b/spring-cloud/spring-cloud-bootstrap/resource/src/main/resources/bootstrap.properties index 2917cd570d..f915426a36 100644 --- a/spring-cloud/spring-cloud-bootstrap/resource/src/main/resources/bootstrap.properties +++ b/spring-cloud/spring-cloud-bootstrap/resource/src/main/resources/bootstrap.properties @@ -1,7 +1,7 @@ spring.cloud.config.name=resource spring.cloud.config.discovery.service-id=config spring.cloud.config.discovery.enabled=true -spring.cloud.config.username=config_resourceUser -spring.cloud.config.password=resourcePassword +spring.cloud.config.username=configUser +spring.cloud.config.password=configPassword -eureka.client.serviceUrl.defaultZone=http://disc_resourceUser:resourcePassword@localhost:8082/eureka/ \ No newline at end of file +eureka.client.serviceUrl.defaultZone=http://discUser:discPassword@localhost:8082/eureka/ \ No newline at end of file From c6480e025bd235c4353bf37fd2eca34f6c765c42 Mon Sep 17 00:00:00 2001 From: Tim Schimandle Date: Wed, 5 Oct 2016 07:18:23 -0600 Subject: [PATCH 6/6] BAEL-315 change access in the config server to only users with SYSTEM level access. --- .../baeldung/spring/cloud/bootstrap/config/SecurityConfig.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java b/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java index b0e5d17698..4c3bd905cc 100644 --- a/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java +++ b/spring-cloud/spring-cloud-bootstrap/config/src/main/java/com/baeldung/spring/cloud/bootstrap/config/SecurityConfig.java @@ -23,7 +23,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter { protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() - .anyRequest().authenticated() + .anyRequest().hasRole("SYSTEM") .and() .httpBasic() .and()