如何使用基本身份验证保护 Spring Cloud Eureka 服务？

Posted 2023-02-26

【中文标题】如何使用基本身份验证保护 Spring Cloud Eureka 服务？

【英文标题】：How to secure spring cloud eureka service with basic auth?

【发布时间】：2018-11-30 23:37:32

【问题描述】：

我在同一台主机上设置了多个 eureka 服务器实例。他们使用主机名 eureka-primary、secondary 和 tertiary，这些主机名在 hosts 文件中定义为 localhost 别名，并且一切正常 - 它们都是可见的，并且作为不同的实例可供彼此使用。

当我尝试使用 basic auth 和 this 来保护 eureka 实例时，问题就开始了。想法是添加spring安全依赖，在eureka服务器上指定安全用户和密码，并将这些凭据放在defaultZone url中（配置如下），但这似乎不起作用。

Eureka 实例甚至无法相互注册，当我尝试访问 eureka 门户网站时，系统会提示我输入登录表单，然后重定向到仪表板。所有仪表板都工作正常，需要访问凭据。

我正在使用 spring cloud Finchley.RC1 和 spring boot 2.0.1.RELEASE 以及相同版本的 spring-boot-starter-security 和 spring-cloud-starter-netflix-eureka-server。

尤里卡服务器 pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>rs.microservices</groupId>
    <artifactId>eurekaServer</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>jar</packaging>

    <name>eurekaServer</name>
    <description>Demo project for Spring Boot</description>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.0.1.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java.version>1.8</java.version>
        <spring-cloud.version>Finchley.RC1</spring-cloud.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-netflix-eureka-server</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
    </dependencies>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-dependencies</artifactId>
                <version>$spring-cloud.version</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

    <repositories>
        <repository>
            <id>spring-milestones</id>
            <name>Spring Milestones</name>
            <url>https://repo.spring.io/milestone</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
    </repositories>
</project>

Eureka 服务器应用程序.yml

---
spring:
  security:
    user:
      name: admin
      password: admin
  profiles: primary
  application:
    name: eureka-server-clustered   
server:
  port: 8011  
eureka:
  instance:
    hostname: eureka-primary       
  client:
    registerWithEureka: true
    fetchRegistry: true        
    serviceUrl:
      defaultZone: http://admin:admin@eureka-secondary:8012/eureka/,http://admin:admin@eureka-tertiary:8013/eureka/

---
spring:
  security:
    user:
      name: admin
      password: admin
  profiles: secondary
  application:
    name: eureka-server-clustered      
server:
  port: 8012
eureka:
  instance:
    hostname: eureka-secondary       
  client:
    registerWithEureka: true
    fetchRegistry: true        
    serviceUrl:
      defaultZone: http://admin:admin@eureka-primary:8013/eureka/,http://admin:admin@eureka-tertiary:8011/eureka/

---
spring:
  security:
    user:
      name: admin
      password: admin
  profiles: tertiary
  application:
    name: eureka-server-clustered      
server:
  port: 8013
eureka:
  instance:
    hostname: eureka-tertiary       
  client:
    registerWithEureka: true
    fetchRegistry: true    
    serviceUrl:
      defaultZone: http://admin:admin@eureka-primary:8011/eureka/,http://admin:admin@eureka-secondary:8012/eureka/   

微服务 bootstrap.yml

spring:
  application:
    name: someService
server:
  port: 0 
eureka:  
  client:
    registerWithEureka: true
    fetchRegistry: true
    service-url:
      defaultZone: http://admin:admin@localhost:8011/eureka/,http://admin:admin@localhost:8012/eureka/,http://admin:admin@localhost:8013/eureka/

我做错了什么？

*编辑

我已经找到了多个类似 Securing Eureka in Spring cloud 的解决方案，但它们都没有真正解决我的问题 - 正如您所看到的，我们的配置是相同的。

【问题讨论】：

是的。谢谢，Dusan 这是解决此问题的唯一方法似乎客户端使用受 CSRF 保护的发布请求作为默认安全设置将自己注册到 eureka 所以唯一的方法是通过扩展 WebSecurityConfigurerAdapter 覆盖这些设置并禁用 CSRF

【参考方案1】：

解决了！

TL;DR 问题是CSRF，由于某种原因，spring 无法验证在application.yml 中配置的用户

所以我不得不重写 WebSecurityConfigurerAdapter 的配置方法来禁用 csrf 并创建 inMemory 用户。还从 application.yml 中删除了 spring.security.user 属性。

Eureka 服务器application.yml 现在看起来像：

---
spring:
  profiles: primary
  application:
    name: eureka-server-clustered   
server:
  port: 8011  
eureka:
  instance:
    hostname: eureka-primary       
  client:
    registerWithEureka: true
    fetchRegistry: true        
    serviceUrl:
      defaultZone: http://admin:admin@eureka-secondary:8012/eureka,http://admin:admin@eureka-tertiary:8013/eureka
---
spring:
  profiles: secondary
  application:
    name: eureka-server-clustered      
server:
  port: 8012
eureka:
  instance:
    hostname: eureka-secondary       
  client:
    registerWithEureka: true
    fetchRegistry: true        
    serviceUrl:
      defaultZone: http://admin:admin@eureka-primary:8013/eureka,http://admin:admin@eureka-tertiary:8011/eureka

---
spring:
  profiles: tertiary
  application:
    name: eureka-server-clustered     
server:
  port: 8013
eureka:
  instance:
    hostname: eureka-tertiary       
  client:
    registerWithEureka: true
    fetchRegistry: true    
    serviceUrl:
      defaultZone: http://admin:admin@eureka-primary:8011/eureka,http://admin:admin@eureka-secondary:8012/eureka  

新创建的WebSecurityConfig类：

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception 
        auth.inMemoryAuthentication()
        .passwordEncoder(NoOpPasswordEncoder.getInstance())
        .withUser("admin").password("admin")
        .authorities("ADMIN");
    

    @Override
    protected void configure(HttpSecurity http) throws Exception 
        http
            .csrf()
                .disable()
            .authorizeRequests()
              .anyRequest().authenticated()
              .and()
              .httpBasic();
    

【参考方案2】：

Greenwich.SR1 也有类似的问题。 使用spring.security.user.name 启用安全性允许我使用用户名/密码登录，但我的服务无法注册 Eureka 服务。 我让它工作了，如上所述，原因确实是CSRF 这解决了它：

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter 

    @Override
    protected void configure(HttpSecurity http) throws Exception 
        http.csrf().ignoringAntMatchers("/eureka/**");
        super.configure(http);
    

【参考方案3】：

在你的 pom.xml 中导入 spring-security ：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

并将其放入您的 application.yaml 中：

security:
  user:
    name: admin
    password: password

它应该可以工作！

编辑：我已经做了这个，这里是让你实现这个的最简单的代码，我建议你从这里开始：

pom.xml：

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>vg.step</groupId>
    <artifactId>eureka.server</artifactId>
    <version>0.0.1</version>
    <name>vgstepeurekaserver</name>

    <properties>
        <org.springframework.cloud-version>1.4.4.RELEASE</org.springframework.cloud-version>
    </properties>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-netflix</artifactId>
                <version>$org.springframework.cloud-version</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
    <dependencies>
        <!-- Spring Boot -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <exclusions>
                <exclusion>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-starter-tomcat</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>log4j-over-slf4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-undertow</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <!-- Spring Cloud -->
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-netflix-eureka-server</artifactId>
        </dependency>
    </dependencies>

    <build>
        <finalName>app</finalName>
        <resources>
            <resource>
                <filtering>true</filtering>
                <directory>src/main/resources</directory>
                <includes>
                    <include>application*.yaml</include>
                </includes>
            </resource>
        </resources>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <goals>
                            <goal>repackage</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.6.1</version>
                <configuration>
                    <source>1.8</source>
                    <target>1.8</target>
                </configuration>
            </plugin>
        </plugins>
    </build>
</project>

src/main/resources/application.yaml ：

spring:
  application:
    name: @project.name@

eureka:
  instance:
    hostname: eureka-server
  client:
    registerWithEureka: false
    fetchRegistry: false
    serviceUrl:
      defaultZone: http://$eureka.instance.hostname:$server.port/eureka

server:
  port: 8002

security:
  user:
    name: admin
    password: password

src/main/java/vg/step/eureka/server/Application.java ：

package vg.step.eureka.server;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.cloud.netflix.eureka.server.EnableEurekaServer;

@SpringBootApplication
@EnableEurekaServer
public class Application 

    public static void main(String[] args) 
        SpringApplication.run(Application.class, args);
    

【讨论】：

正如我在文中提到的，我已经有了spring-boot-starter-security的依赖，并且在附加的eureka的application.yml中可以看到，你推荐的配置已经存在。

感谢您的回答，但我看到您使用的是 1.4.4.RELEASE，而我的版本是 2.0.1.RELEASE。