title: Spring Boot Actuator Endpoints security doesn't work with custom Spring Security Configuration
body: <p>This is my Spring Boot 1.5.1 Actuator <code>application.properties</code>:</p>
  
  <pre><code>#Spring Boot Actuator
  management.contextPath: /actuator
  management.security.roles=R_0
  </code></pre>
  
  <p>This is my <code>WebSecurityConfig</code>:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private UserDetailsService userDetailsService;
  
      @Value("${logout.success.url}")
      private String logoutSuccessUrl;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          // @formatter:off
          http.addFilterBefore(new CorsFilter(), ChannelProcessingFilter.class);
  
          http
              .csrf().ignoringAntMatchers("/v1.0/**", "/logout")
          .and()
              .authorizeRequests()
  
              .antMatchers("/oauth/authorize").authenticated()
              //Anyone can access the urls
              .antMatchers("/signin/**").permitAll()
              .antMatchers("/v1.0/**").permitAll()
              .antMatchers("/auth/**").permitAll()
              .antMatchers("/actuator/health").permitAll()
              .antMatchers("/actuator/**").hasAuthority("R_0")
              .antMatchers("/login").permitAll()
              .anyRequest().authenticated()
          .and()
              .formLogin()
                  .loginPage("/login")
                  .loginProcessingUrl("/login")
                  .failureUrl("/login?error=true")
                  .usernameParameter("username")
                  .passwordParameter("password")
                  .permitAll()
              .and()
                  .logout()
                      .logoutUrl("/logout")
                      .logoutSuccessUrl(logoutSuccessUrl)
                      .permitAll();
          // @formatter:on
      }
  
      /**
       * Configures the authentication manager bean which processes authentication requests.
       */
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(userDetailsService).passwordEncoder(new BCryptPasswordEncoder());
      }
  
      @Override
      @Bean
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  
  }
  </code></pre>
  
  <p>Right now I'm successfully able to login in my application with a right user that has <code>R_0</code> authorities but when I trying to access for example</p>
  
  <pre><code>http://localhost:8080/api/actuator/beans
  </code></pre>
  
  <p>I receive a following error:</p>
  
  <pre><code>There was an unexpected error (type=Forbidden, status=403).
  Access is denied. User must have one of the these roles: R_0
  </code></pre>
  
  <p>How to correctly configure Spring Boot Actuator in order to be aware about the correct <code>Authentication</code> ?</p>
  
  <p>Right now in order to get it workin I have to do the following trick:</p>
  
  <pre><code>management.security.enabled=false
  
  .antMatchers("/actuator/health").permitAll()
  .antMatchers("/actuator/**").hasAuthority("R_0")
  </code></pre>
  
  <p>Is any chance to configure Actuator in a right way ?</p>
  
  <p><strong>UPDATED</strong></p>
  
  <p>I'm using <code>UserDetailsService.UserDetails.Authorities</code></p>
  
  <pre><code>    public Collection&lt;? extends GrantedAuthority&gt; getAuthorities() {
          String[] authorities = permissions.stream().map(p -&gt; {
              return p.getName();
          }).toArray(String[]::new);
          return AuthorityUtils.createAuthorityList(authorities);
      }
  </code></pre>