-
Notifications
You must be signed in to change notification settings - Fork 2.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
unable to configure spring security with spring boot 3.0.2 #4161
Comments
after a bit more debugging, it looks like the NPE message above comes from an cause:
stacktrace - sorry for the screenshot, not sure if I can copy/paste from the debugger without copying each individual call not sure if this helps, but it seems like a better clue than the NPE when trying to extract the original Throwable message. this is from an older version of httpclient, but the issue may still be relevant: https://issues.apache.org/jira/browse/HTTPCLIENT-951 I guess the apache library doesn't pass creds until the server tells it to, but on certain requests, like POSTS, the body (input stream) may have already been read, so the request can't be repeated without recreating the input stream. apparently the again, not sure if this helps, is relevant to the main issue, or if this is just a bad path to go down. hopefully this is useful, even if just to discard a potential path to investigate. |
any solutions? |
Thanks a lot for reporting. We're looking at it. Should be able to get back about this at the end of this week or the beginning of next. |
Thanks, @erbrecht @Been24 @hazartilirot . I have taken a look at this. The simplest way to configure
I have been able to replicate replication errors with this setup as well. Working on this issue. |
@OlgaMaciaszek I also encountered the same situation as erbrecht. I configured it with reference to your configuration file. When I started it, I found that when I entered user and password, an error would be reported directly. |
Yes, @Nathan-ZR, the NPE is due to lack of handling of |
The proper Basic Auth header is not being added. The bug seems to be in Netflix/Eureka rather than in Spring Cloud Netflix, but will take a look at it anyway (probably at the beginning of the next week). |
Hello. We are having the same issue with a similar configuration. Looking forward to hearing from this. |
We have the same issue and look forward to news |
Should be fixed when in Netflix/eureka. Have submitted a PR with fix. |
Spring Cloud Netflix |
Describe the bug
I'm trying to secure my 3 Eureka servers. I configured spring security through
application.properties
, and disabled CSRF. The biggest difference I can see is that the docs are referencing spring security 5 and the deprecated/removedWebSecurityConfigurerAdapter
class. Since I'm on Spring Boot 3/Spring Security 6, I'm configuring via theSecurityFilterChain
bean.After configuring the credentials and disabling CSRF, the 3 servers start up fine and all registered replicas show as available. However, it appears that I don't need any credentials to access eureka. I was able to replicate this via curl and the web browser. I tried hitting the main eureka dashboard, API (/eureka/apps), and actuator. None require credentials to access.
I also tried manually configuring security through the
SecurityFilterChain
bean, but that produced different results. My config looks like this:Under this config, security seems to work when using curl/a browser. Replication is not successful though. If I go to each individual server dashboard, I see different results for the eureka instances that are reported as UP:
I also see a lot of these messages in the logs:
I'm not sure if I'm configuring this correctly, or where I could be going wrong.
Sample
I pushed my code here (https://github.com/erbrecht/eureka-security) so you can hopefully replicate this issue. The
main
branch contains the first scenario, where I added the spring.security.user.name and password in application.properties and just disabled CSRF via Java config.The
security2
branch is the second scenario, where I configure security strictly through Java.I have 3 profiles using different hostnames and ports for each server. I also modified my hosts file like so:
Any help is greatly appreciated.
The text was updated successfully, but these errors were encountered: