actuator overrides security-config from custom WebSecurityConfigurerAdapter

[zyro23]

using actuator in a spring-boot-web project using a custom WebSecurityConfigurerAdapter (@Configuration/@EnableWebSecurity), it seems as if the actuator security auto-config overrides the applications security config.

[dsyer]

It is expected that the SecurityAutoConfiguration would provide some defaults that you might otherwise have to provide in your own configuration. You can always disable the SecurityAutoConfiguration (by excluding it in @EnableAutoConfiguration), but I'd rather hear the details and try and see how to change things if necessary. You might need to describe your use case in a bit more detail to see if we need to explicitly support it or not.

[zyro23]

essentially, i followed the securing-web guide and got a security config like this (groovy):

@Configuration
@EnableWebSecurity
class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers("/login").permitAll()
            .antMatchers("/dummy").permitAll()
            .antMatchers("/secured").hasRole("USER")
            .anyRequest().authenticated()

        http.formLogin()
            .defaultSuccessUrl("/secured")
            .loginPage("/login")

        http.logout().permitAll()
    }

}

now if i add the dependency for spring-boot-starter-actuator in my gradle build, the app is asking for basic auth under any url...

thanks, zyro

[dsyer]

Right, that's because your configurator callback is unordered, while the SecurityAutoConfiguration contains one that has @Order(Ordered.LOWEST_PRECEDENCE - 5). I suggest maybe you add @Order(Ordered.LOWEST_PRECEDENCE - 10) to yours.

[zyro23]

oh well... i spotted the option for ordering but thought "last wins" with the highest precedence being last :/

i will give @Order(Ordered.LOWEST_PRECEDENCE - 10) a spin in a few hours and comment here if i succeeded - then this could be closed of course.

thanks for the quick help!

[zyro23]

works. thanks again. closed.