版权声明:本文为博主原创文章,遵循 CC 4.0 BY-SA 版权协议,转载请附上原文出处链接和本声明。
本文链接:
https://zhanghan.blog.csdn.net/article/details/101595226
【前言】
Spring Boot Admin做为生产级的监控工具,必然不能随便让人去操作以免误操作导致线上问题,所以有必要集成Security组件;Spring Boot Admin可以十分简单的集成这安全组件;已集成项目中,在此与大家共享;
【集成安全模块】
一、集成安全(Security)模块
1、Spring Boot Admin服务端集成(以zh-monitor为例)
(1)Pom中增加Security依赖
org.springframework.boot
spring-boot-starter-security
(2)配置文件(application.properties)中增加用户名和密码的设置
#spring boot default user.name='user'
spring.security.user.name=admin
#spring boot dafault user.password 在项目启动时打印在控制台中
spring.security.user.password=admin
(3)增加SecuritySecureConfig配置类
/*
* Copyright (c) 2019. zhanghan_java@163.com All Rights Reserved.
* 项目名称:实战SpringBoot
* 类名称:SecuritySecureConfig.java
* 创建人:张晗
* 联系方式:zhanghan_java@163.com
* 开源地址: https://github.com/dangnianchuntian/springboot
* 博客地址: https://zhanghan.blog.csdn.net
*/
package com.zhanghan.zhmonitor.config;
import de.codecentric.boot.admin.server.config.AdminServerProperties;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
@Configuration
public class SecuritySecureConfig extends WebSecurityConfigurerAdapter {
private final String adminContextPath;
public SecuritySecureConfig(AdminServerProperties adminServerProperties) {
this.adminContextPath = adminServerProperties.getContextPath();
}
@Override
protected void configure(HttpSecurity http) throws Exception {
// @formatter:off
SavedRequestAwareAuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
successHandler.setTargetUrlParameter("redirectTo");
successHandler.setDefaultTargetUrl(adminContextPath + "/");
http.authorizeRequests()
.antMatchers(adminContextPath + "/assets/**").permitAll()
.antMatchers(adminContextPath + "/login").permitAll()
.anyRequest().authenticated()
.and()
.formLogin().loginPage(adminContextPath + "/login").successHandler(successHandler).and()
.logout().logoutUrl(adminContextPath + "/logout").and()
.httpBasic().and()
.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
.ignoringAntMatchers(
adminContextPath + "/instances",
adminContextPath + "/actuator/**");
// @formatter:on
}
}
2、Spring Boot Admin客户端集成(以zh-boot为例)
(1)在配置文件(application.properties)中增加用户名和密码
#Security
spring.boot.admin.client.username=admin
spring.boot.admin.client.password=admin
3、查看效果
(1)启动zh-monitor
(2)启动zh-boot
(3)访问zh-monitor(http://localhost:8081)
a.跳转至登录页面
b.输入admin的用户名和密码登录
三、项目地址:
1、地址:https://github.com/dangnianchuntian/springboot
2、代码版本:1.6.0-Release
【总结】
1、安全猛于虎,没有安全设置相当于裸奔,一般线上环境的Spring Boot Admin应该由运维统一控制,开发只能查看,如果需要更改日志级别等操作等应由技术leader批准运维统一执行;
2、接下来会为大家共享多关于SpringBootAdmin集成告警模块。