How do I keep my Elastic Beanstalk instance healthy when using Spring WebSecurityConfigurerAdapter?

Question

Context

I'm hosting a Java SpringBoot application on Elastic Beanstalk, and it's running. I've just merged a branch that adds WebSecurityConfigurerAdapter, requiring a username and password on loading the page.

When run locally, the environment properties are in application.properties , and they are set in Travis and on Elastic Beanstalk under Configuration -> Software.

When I Go to Environment , an alert prompts me for username and password, after which it works.

Setting incorrect username or password in Configuration causes 502 errors, as expected.

Problem

The health of this instance is 'Severe', with 100.0 % of the requests are erroring with HTTP 4xx.

I believe that I've found the relevant error in the logs:

ConfigServletWebServerApplicationContext: Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'springSecurityFilterChain' defined in class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is java.lang.IllegalArgumentException: username cannot be null

New file, SecurityConfig.java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private Environment environment;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .authorizeRequests().anyRequest().authenticated()
            .and()
            .httpBasic();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
            .withUser(environment.getProperty("USERNAME")).password("{noop}" + environment.getProperty("PASSWORD")).roles("USER");
    }
}

My understanding of this is that the Health of the instance is evaluated by loading / , at which point no username is found so the page fails to load.

If this is the case, how can I allow the Health checks to not fail because of http security?

Answer 1

Spring has an 'Actuator' for opening up a Health Check endpoint

By adding the gradle dependency compile group: 'org.springframework.boot', name: 'spring-boot-starter-actuator' , the application gains an /actuator/health endpoint that the ELB Load Balancer can be configured to perform checks on instead of / .