Spring Webflux Security 阻止 Kafka GET /connectors 调用

Question

我有一个 Spring Boot Webflux应用程序。 我将Kafka与 Apache camel 一起使用，也使用websockets 。

我最近添加了Spring security 。 因为我不需要身份验证，因此我不进行身份验证，而只授权传入的请求。

由于添加了安全性，它阻止了 Kafka Connect 的 REST API 端点，例如。 GET /connectors call 。 IMO，它不应该阻止它们，因为它们会从应用程序内部引发。

错误日志

2021-07-29 22:20:51.654 DEBUG 68377 --- [ctor-http-nio-4] o.s.w.s.adapter.HttpWebHandlerAdapter    : [adf2f930-1, L:/127.0.0.1:8083 - R:/127.0.0.1:60653] HTTP GET "/connectors"
2021-07-29 22:20:51.659 DEBUG 68377 --- [     parallel-3] o.s.w.s.s.DefaultWebSessionManager       : Created new WebSession.
2021-07-29 22:20:51.660 DEBUG 68377 --- [     parallel-3] o.s.s.w.s.u.m.OrServerWebExchangeMatcher : Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/weather-data/api/**', method=GET}
2021-07-29 22:20:51.660 DEBUG 68377 --- [     parallel-3] athPatternParserServerWebExchangeMatcher : Request 'GET /connectors' doesn't match 'GET /weather-data/api/**'
2021-07-29 22:20:51.660 DEBUG 68377 --- [     parallel-3] o.s.s.w.s.u.m.OrServerWebExchangeMatcher : No matches found
2021-07-29 22:20:51.660 DEBUG 68377 --- [     parallel-3] o.s.s.w.s.u.m.OrServerWebExchangeMatcher : Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/weather-data/api/**', method=POST}
2021-07-29 22:20:51.660 DEBUG 68377 --- [     parallel-3] athPatternParserServerWebExchangeMatcher : Request 'GET /connectors' doesn't match 'POST /weather-data/api/**'
2021-07-29 22:20:51.660 DEBUG 68377 --- [     parallel-3] o.s.s.w.s.u.m.OrServerWebExchangeMatcher : No matches found
2021-07-29 22:20:51.660 DEBUG 68377 --- [     parallel-3] o.s.s.w.s.u.m.OrServerWebExchangeMatcher : Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/weather-data/api/events', method=GET}
2021-07-29 22:20:51.660 DEBUG 68377 --- [     parallel-3] athPatternParserServerWebExchangeMatcher : Request 'GET /connectors' doesn't match 'GET /weather-data/api/events'
2021-07-29 22:20:51.660 DEBUG 68377 --- [     parallel-3] o.s.s.w.s.u.m.OrServerWebExchangeMatcher : No matches found
2021-07-29 22:20:51.660 DEBUG 68377 --- [     parallel-3] o.s.s.w.s.a.AuthorizationWebFilter       : Authorization failed: Access Denied
2021-07-29 22:20:51.669  INFO 68377 --- [     parallel-3] c.s.M.w.WebFluxSecurityConfiguration     : Authentication exception

org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: Not Authenticated
    at org.springframework.security.web.server.authorization.ExceptionTranslationWebFilter.commenceAuthentication(ExceptionTranslationWebFilter.java:70) ~[spring-security-web-5.5.0.jar:5.5.0]
    at org.springframework.security.web.server.authorization.ExceptionTranslationWebFilter.lambda$filter$1(ExceptionTranslationWebFilter.java:45) ~[spring-security-web-5.5.0.jar:5.5.0]

1. Webflux 安全配置

package com.reactive.sse.security

import mu.KotlinLogging
import org.springframework.context.annotation.Bean
import org.springframework.context.annotation.Configuration
import org.springframework.http.HttpMethod
import org.springframework.http.HttpStatus
import org.springframework.security.access.AccessDeniedException
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
import org.springframework.security.config.web.server.SecurityWebFiltersOrder
import org.springframework.security.config.web.server.ServerHttpSecurity
import org.springframework.security.core.AuthenticationException
import org.springframework.security.web.server.SecurityWebFilterChain
import org.springframework.security.web.server.authentication.AuthenticationWebFilter
import org.springframework.security.web.server.authentication.ServerAuthenticationConverter
import org.springframework.web.server.ServerWebExchange
import reactor.core.publisher.Mono


@Configuration
@EnableWebFluxSecurity
class SecurityConfiguration {
    private val logger = KotlinLogging.logger {}

    val READ_ROLE = "DATA_READ"


    @Bean
    fun securityWebFilterChain(
        http: ServerHttpSecurity,
        weatherAuthenticatedRequestManager: WeatherAuthenticatedRequestManager,
        authenticationConverter: ServerAuthenticationConverter
    ): SecurityWebFilterChain {
        val authenticationWebFilter = AuthenticationWebFilter(weatherAuthenticatedRequestManager)
        authenticationWebFilter.setServerAuthenticationConverter(authenticationConverter)

        return http
            .exceptionHandling()
            .authenticationEntryPoint { swe: ServerWebExchange, ex: AuthenticationException? ->
                logger.error(ex) { "Authentication exception" }
                Mono.fromRunnable { swe.response.statusCode = HttpStatus.UNAUTHORIZED }
            }.accessDeniedHandler { swe: ServerWebExchange, ex: AccessDeniedException? ->
                logger.error(ex) { "Authorization exception" }
                Mono.fromRunnable { swe.response.statusCode = HttpStatus.FORBIDDEN }
            }.and()
            .authorizeExchange()
            .pathMatchers(HttpMethod.GET,"/weather-data/api/**").hasRole(READ_ROLE)
            .and()
            .addFilterAt(authenticationWebFilter, SecurityWebFiltersOrder.AUTHENTICATION)
            .httpBasic().disable()
            .csrf().disable()
            .formLogin().disable()
            .logout().disable()
            .build()
    }
}

2. WeatherAuthenticationConverter

package com.reactive.sse.security

import org.springframework.http.HttpCookie
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
import org.springframework.security.core.Authentication
import org.springframework.security.web.server.authentication.ServerAuthenticationConverter
import org.springframework.stereotype.Component
import org.springframework.web.server.ServerWebExchange
import reactor.core.publisher.Mono


@Component
class WeatherAuthenticationConverter : ServerAuthenticationConverter {

    override fun convert(exchange: ServerWebExchange?): Mono<Authentication> {
        return Mono.justOrEmpty(exchange)
            .flatMap { serverWebExchange: ServerWebExchange ->
                Mono.justOrEmpty(serverWebExchange.request.cookies["X-Auth"])
            }
            .filter { cookies: List<HttpCookie> -> cookies.isNotEmpty() }
            .map { cookies: List<HttpCookie> -> cookies[0].value }
            .map { authenticationStr: String ->
                UsernamePasswordAuthenticationToken(
                    authenticationStr,
                    authenticationStr
                )
            }
    }

}

3. WeatherAuthenticatedRequestManager

package com.reactive.sse.security

import org.springframework.security.authentication.ReactiveAuthenticationManager
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
import org.springframework.security.core.Authentication
import org.springframework.security.core.authority.SimpleGrantedAuthority
import org.springframework.stereotype.Component
import reactor.core.publisher.Mono



@Component
class WeatherAuthenticatedRequestManager : ReactiveAuthenticationManager {


    /**
     * Authenticate based on the Jwt token
     *
     * @property authentication
     * @return Authentication Publisher
     */
    override fun authenticate(authentication: Authentication): Mono<Authentication> {
        return Mono.just(authentication)
            .map { authenticationObj: Authentication ->
                val roles: List<String> = (authenticationObj.credentials as List<*>).filterIsInstance<String>()
                val rolesAuthority = roles.map { value -> SimpleGrantedAuthority(value) }
                UsernamePasswordAuthenticationToken(
                    roles,
                    roles,
                    rolesAuthority
                )
            }
    }
}

我应该如何通过 spring security 进行配置，以便它不会像这样阻止内部调用。

Answer 1

做了谷歌之后，我发现了由 Kafka 发起的 /connectors API 调用。 它在端口 8083 上运行。不幸的是，我的 Spring Boot 应用程序在 8083 上运行。因此它被阻止了。 我仍然很困惑为什么它会阻止内部调用。

一旦我将端口更改为 8089 或其他内容，错误就会消失