[[securing-spring-boot-admin]]
== Security ==

=== Securing Spring Boot Admin Server ===

Since there are several approaches on solving authentication and authorization in distributed web applications Spring Boot Admin doesn't ship a default one.
By default `spring-boot-admin-server-ui` provides a login page and a logout button.

A Spring Security configuration could look like this:
[source,java]
----
include::{samples-dir}/spring-boot-admin-sample-servlet/src/main/java/de/codecentric/boot/admin/SpringBootAdminApplication.java[tags=configuration-spring-security]
----
<1> Grants public access to all static assets and the login page.
<2> Every other request must be authenticated.
<3> Configures login and logout.
<4> Enables HTTP-Basic support. This is needed for the Spring Boot Admin Client to register.
<5> Enables CSRF-Protection using Cookies
<6> Disables CRSF-Protection the endpoint the Spring Boot Admin Client uses to register.
<7> Disables CRSF-Protection for the actuator endpoints.

For a complete sample look at https://github.com/codecentric/spring-boot-admin/tree/master/spring-boot-admin-samples/spring-boot-admin-sample-servlet/[spring-boot-admin-sample-servlet.

NOTE: If you protect the `/instances` endpoint don't forget to configure the username and password on your SBA-Client using `spring.boot.admin.client.username` and `spring.boot.admin.client.password`.

=== Securing Client Actuator Endpoints ===

When the actuator endpoints are secured using HTTP Basic authentication the SBA Server needs credentials to access them. You can submit the credentials in the metadata when registering the application. The `BasicAuthHttpHeaderProvider` then uses this metadata to add the `Authorization` header to access your application's actuator endpoints. You can provide your own `HttpHeadersProvider` to alter the behaviour (e.g. add some decryption) or add extra headers.

Submitting the credentials using SBA Client:
[source,yaml]
.application.yml
----
spring.boot.admin.client:
    url: http://localhost:8080
    instance:
      metadata:
        user.name: ${spring.security.user.name}
        user.password: ${spring.security.user.password}
----

Submitting the credentials using Eureka:
[source,yaml]
.application.yml
----
eureka:
  instance:
    metadata-map:
      user.name: ${spring.security.user.name}
      user.password: ${spring.security.user.password}
----

NOTE: The SBA Server masks certain metadata in the HTTP interface to prevent leaking of sensitive information.

WARNING: You should configure HTTPS for your SBA Server or (service registry) when submitting credentials via the metadata.

WARNING: When using Spring Cloud Discovery, you must be aware that anybody who can query your service registry can obtain the credentials.

TIP: When using this approach the SBA Server decides whether or not the user can access the registered applications. There are more complex solutions possible (using OAuth2) to let the clients decide if the user can access the endpoints. For that please have a look at the samples in https://github.com/joshiste/spring-boot-admin-samples[joshiste/spring-boot-admin-samples^].

==== CSRF on Actuator Endpoints ====

Some of the actuator endpoints (e.g. `/loggers`) support POST requests. When using Spring Security you need to ignore the actuator endpoints for CSRF-Protection as the Spring Boot Admin Server currently lacks support.

[source,java]
----
@Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf()
        .ignoringAntMatchers("/actuator/**");
}
----
