title: Different credentials in Spring Boot for app authentication and management authentication?
body: <p>I want to use http basic authentication for my Spring Boot application with one set of credentials and at the same time I want to configure actuator to use a different set of credentials for the management resources (health, env etc). I've read the Actucator documentation where it says that you should be able to set the username and password using the <code>security.user.name</code> and <code>security.user.password</code> properties. However when I add my custom <code>WebSecurityConfigurerAdapter</code> it no longer seems to be applied. My <code>WebSecurityConfigurerAdapter</code> looks like this:</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  @Order(Ordered.LOWEST_PRECEDENCE - 11)
  public class ApplicationSecurityConfig extends WebSecurityConfigurerAdapter {
  
      private static final String API_USER = "API";
      private static final String ADMIN_USER = "ADMIN";
  
      @NotNull
      @Value("${security.user.name}")
      private String managementUsername;
      @NotNull
      @Value("${security.user.password}")
      private String managementPassword;
      @NotNull
      @Value("${management.context-path}")
      private String managementContextPath;
  
      public ApplicationSecurityConfig() {
          super(true);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          // @formatter:off
          http
                  .addFilter(new WebAsyncManagerIntegrationFilter())
                  .exceptionHandling().and()
                  .headers().and()
                  .sessionManagement()
                      .sessionCreationPolicy(STATELESS)
                  .and()
                  .securityContext().and()
                  .requestCache().and()
                  .servletApi().and()
                  .authorizeRequests()
                        .antMatchers(managementContextPath+"/**").hasRole(ADMIN_USER)
                        .antMatchers("/**").hasRole(API_USER)
                        .and()
                  .httpBasic();
          // @formatter:on
      }
  
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth.inMemoryAuthentication().withUser("apiUsername").password("apiPassword").roles(API_USER).
                  and().withUser(managementUsername).password(managementPassword).roles(ADMIN_USER);
      }
  }
  </code></pre>
  
  <p>I've also tried setting <code>management.security.enabled</code> to <code>false</code> but then the management resources seem to be open to all despite my effort to protect it above.</p>
  
  <p>Does anyone know what I'm doing wrong and how to go about?</p>
  
  <p><strong>Update</strong></p>
  
  <p>I see that three events are emitted by Spring from my app:</p>
  
  <pre><code>2015-06-10 20:04:37.076  INFO 44081 --- [nio-8083-exec-1] o.s.b.a.audit.listener.AuditListener     : AuditEvent [timestamp=Wed Jun 10 20:04:37 CEST 2015, principal=&lt;unknown&gt;, type=AUTHENTICATION_FAILURE, data={type=org.springframework.security.authentication.AuthenticationCredentialsNotFoundException, message=An Authentication object was not found in the SecurityContext}]
  2015-06-10 20:04:39.564  INFO 44081 --- [nio-8083-exec-2] o.s.b.a.audit.listener.AuditListener     : AuditEvent [timestamp=Wed Jun 10 20:04:39 CEST 2015, principal=admin, type=AUTHENTICATION_SUCCESS, data={details=org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null}]
  2015-06-10 20:04:39.569  INFO 44081 --- [nio-8083-exec-2] o.s.b.a.audit.listener.AuditListener     : AuditEvent [timestamp=Wed Jun 10 20:04:39 CEST 2015, principal=admin, type=AUTHORIZATION_FAILURE, data={type=org.springframework.security.access.AccessDeniedException, message=Access is denied}]
  </code></pre>
  
  <p>But there's only two from hyness sample app:</p>
  
  <pre><code>2015-06-10 19:34:10.851  INFO 42714 --- [nio-8083-exec-1] o.s.b.a.audit.listener.AuditListener     : AuditEvent [timestamp=Wed Jun 10 19:34:10 CEST 2015, principal=anonymousUser, type=AUTHORIZATION_FAILURE, data={type=org.springframework.security.access.AccessDeniedException, message=Access is denied}]
  2015-06-10 19:34:17.139  INFO 42714 --- [nio-8083-exec-2] o.s.b.a.audit.listener.AuditListener     : AuditEvent [timestamp=Wed Jun 10 19:34:17 CEST 2015, principal=manage, type=AUTHENTICATION_SUCCESS, data={details=org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null}]
  </code></pre>