management.security.roles doesn't work for health endpoint

721 views Asked by At

I have secured (basic authentication) my spring boot application with spring security. I added role MANAGEMENT for users who can use monitoring and management. I set management.security.roles=MANAGEMENT. User with this role can see only status (using health endpoint). If I set management.security.role=MANAGEMENT, everything works (user with this role see all health parameters), but this property is depricated. Am I doing something wrong? Or it is a bug? I have spring boot in version 1.4.0.RELEASE

1

There are 1 answers

0
Klaus Scharpf On BEST ANSWER

It seems that in 1.4.0 you need to use management.security.role (singular) I had issues with 1.4.2 and 1.4.3 that only use management.security.roles (plural).

I wish I would have found some documentation about the change before running into it when updating Spring Boot from 1.4.0 to 1.4.3