Springboot SpringWebFlux SecurityConfig 从属性文件加载凭据

Question

I am using spring web flux with springboot 2.2.1.RELEASE. I have configured web security like this

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

    @Bean
    public SecurityWebFilterChain securityFilterChain(ServerHttpSecurity http) {
        return http
                .csrf().disable()
                .authorizeExchange()
                .pathMatchers("/actuator/**").permitAll()
                .pathMatchers("/customer/**").hasRole("INTERNAL_APP")
                .and()
                .httpBasic()
                .and()
                .csrf().disable()
                .formLogin().disable()
                .build();
    }

    @Bean
    public MapReactiveUserDetailsService userDetailsService() {
        UserDetails user = User.builder()
                .username("someusername")
                .password("{bcrypt}$2a$10$fll1CVzOQ5qVGvzwwLlldsfsgwCgai7LxrzBkNxl2Xh41Ghk5pRWa")
                .roles("INTERNAL_APP")
                .build();
        return new MapReactiveUserDetailsService(user);
    }
}

This is working perfectly fine. What I need now is to load username, password and role from properties file. I am not able to achieve this. I have tried with @Value and also using @ConfigurationProperties . But no luck so far.

I believe PropertyFileLoader Autoconfiguration is executed after SecurityConfiguration. Hence the fields are not loaded.(Just my guess).

Does anyone have any clue as to how I can avoid hardcoding of credentials in this config file and instead load from properties file.

I know that with WebSecurity It was possible to do this. But somehow not working with WebFluxSecurity

Answer 1

I'm able to load/access user and password from application.properties via org.springframework.core.env.Environment

secret.user=user
secret.password=$2a$10$Gid/Ax6gZpTqT/SElZ3shO7oDsX7kdX7u1qPM.StfDyuccOcbnbgG

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

  @Autowired private Environment environment;

  @Bean
  public PasswordEncoder encoder() {
     return new BCryptPasswordEncoder();
  }

  ....

  @Bean
    public MapReactiveUserDetailsService userDetailsService() {
        UserDetails user = User.builder()
                .username(environment.getProperty("secret.user"))     // <----  
                .password(environment.getProperty("secret.password")) // <----
                .roles("INTERNAL_APP")
                .build();
        return new MapReactiveUserDetailsService(user);
    }
}

ref github: springboot-springwebflux-securityconfig-load-credentials-from-properties-file

ALTERNATIVE you could use ConfigurationProperties

@Configuration
@ConfigurationProperties(prefix = "secret")
class SecuredProperties {

    private String user;
    private String password;

    // getters and setters
}


@Configuration
@EnableWebFluxSecurity
class SecurityConfig {
    private SecuredProperties securedProperties;

    SecurityConfig(SecuredProperties securedProperties){
        this.securedProperties = securedProperties;
    }
    .....
    @Bean
    public MapReactiveUserDetailsService userDetailsService() {
        UserDetails user = User.builder()
                .username(securedProperties.getUser())      // <---
                .password(securedProperties.getPassword())  // <---
                .roles("INTERNAL_APP")
                .build();
        return new MapReactiveUserDetailsService(user);
    }

ref github using configutation properties