How to disable security on management port in Spring Boot 2 - spring

Question

I have the /actuator/ Endpoints (in my case manage) on Port 6565. Is it possible to disable Security in Spring Boot 2 only for a specific port? At the moment I can only exclude certain paths from security. That would be insecure if I now run Enpoints under the main application port 1337 under /manage/. In the past we used management.security.enabled: false or was that path related too?
#Configuration
#EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/manage/**").permitAll()
.anyRequest().authenticated().and().httpBasic().realmName("Hay, the Config Server is here");
}
}
application.yml
spring:
cloud:
config:
server:
git:
uri: https://bitbucket.xxx.net/scm/gpi/springconfiguration.git
username: xxx
password: xxx
searchPaths: application-*
force-pull: true
security:
user:
name: xxxUser
password: xxx
server:
port: 1337
address: 0.0.0.0
management:
server:
port: 6565
metrics:
export:
prometheus:
enabled: true
endpoints:
web:
exposure:
include: '*'
base-path: /manage
endpoint:
prometheus:
enabled: true

Answer 1

I ended up with this as a working solution found here How can I tell spring security to apply authorizeRequests just for a specific port?
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
#Value("${management.server.port}")
private int managementPort;
#Value("${server.port}")
private int apiPort;
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.requestMatchers(forPortAndPath(managementPort, "/manage/**")).permitAll()
.anyRequest().authenticated().and().httpBasic().realmName("Hay, the Config Server is here");
}
private RequestMatcher forPortAndPath(final int port, final String pathPattern) {
return new AndRequestMatcher(forPort(port), new AntPathRequestMatcher(pathPattern));
}
private RequestMatcher forPortAndPath(final int port, final HttpMethod method,
final String pathPattern) {
return new AndRequestMatcher(forPort(port), new AntPathRequestMatcher(pathPattern, method.name()));
}
private RequestMatcher forPort(final int port) {
return (HttpServletRequest request) -> port == request.getLocalPort();
}
Another Solution is to add the paths to the WebSecurity
#Value("${management.server.port:6565}")
private int managementPort;
#Value("${management.endpoints.web.base-path:/manage}")
private String managementPath;
#Override
public void configure(WebSecurity web) {
if (securityConfiguration.getAuthenticationScenario()
.equals(HwlPortalAuthenticationScenario.DISABLE_SECURITY)) {
web.ignoring().antMatchers("/**");
} else {
web.ignoring().antMatchers(securityConfiguration.securityDisabledPaths().toArray(new String[]{}))
.requestMatchers(forPortAndPath(managementPort,managementPath + "/**"));
}
}