Closed yuanych closed 6 years ago
What version of Spring Boot 2.0 and what version of Spring Cloud?
springBootVersion = '2.0.0.RELEASE' springCloudVersion = 'Finchley.M8'
ME too!
But spring boot 2.0.0.RC1 and spring cloud Finchley.M6 its ok
I have the same problem. springBootVersion = '2.0.0.RELEASE' springCloudVersion = 'Finchley.M8'
have the same problem. springBootVersion = '2.0.0.RELEASE' springCloudVersion = 'Finchley.M7'
@happymzw M8 is the only compatible version with 2.0.0.RELEASE
@spencergibb thanks!
have the same problem with: springBootVersion = '2.0.0.RELEASE' springCloudVersion = 'Finchley.M8'
but with: springBootVersion = '2.0.0.RC1' springCloudVersion='Finchley.M6' on the EurekaService it is working to register instances with basic authentication.
This is because @EnableWebSecurity is now added by default when Spring Security is on the classpath. This enable CSRF protection by default. You will have the same problem in 1.5.10 if you add @EnableWebSeurity
. One work around, which is not the most secure workaround if you have browsers using the Eureka dashboard, is to disable CSRF protection. This can be done by adding the following configuration to your app.
@EnableWebSecurity
static class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable();
}
}
As a team we need to decide what the right course of action is going forward. We will update this issue once we have a solution or any updates.
Add documentation that mentions having separate authn/authz for UI and API(/eureka/apps
).
@ryanjbaxter - I'm still seeing the issue with csrf disabled. Running SB 2.0.0.RELEASE and Finchley.M9. I'm binding to a Pivotal Cloud Foundry provided eureka instance by the service registry tile.
@azizabah If you are binding to a Pivotal CF eureka instance, I dont see why you would have this problem, or why it would be the same problem, it is not using Boot 2.0
@ryanjbaxter - You're right. Looks like we're running into a different issue on the pivotal spring cloud connectors not injecting the eureka config information. Sorry about that.
@spencergibb if use Finchley.M9, how to do it?
I see this issue when I deploy my app (registry and client) on PCF, but works okay in local. Is there any workaround? or is it resolved? I have used - Spring boot 2.0.1.Release Spring cloud Finchley M9 I do not have Spring Security in classpath.
@anandwali there is no way that you are seeing this issue without having spring security on the classpath
@ryanjbaxter I checked app dependencies. I have included spring-cloud-config-server as dependency and it has transitive dependency on spring-security-crypto and spring-security-rsa.
Would these dependencies cause this problem? Should I include spring-security and add Configurer to disable CORS, solve the issue?
I rechecked my configurations. It was eureka client defaultZone - typo with server.port, that caused the issue. My bad, sorry about that. Its working fine now.
Any update on this?
i have springBootVersion = '2.0.0.RELEASE' springCloudVersion = 'Finchley.M8'
on both server and client and basic auth still doesn't work (403)
I am facing the same issue, I have
The resolution is going to add documentation.
I am facing the same issue, I have
With
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.0.2.RELEASE</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
and
<spring-cloud.version>Finchley.RC2</spring-cloud.version>
I am facing the same issue.
@Meziano Look at this post: https://github.com/spring-cloud/spring-cloud-netflix/issues/2754#issuecomment-372808529
It helps.
Or look at the documentation I added https://github.com/spring-cloud/spring-cloud-netflix/pull/2992
@ryanjbaxter @eacdy
@Meziano Look at this post: #2754 (comment) It helps.
Yes, but the eureka client is able to register even with
eureka.client.service-url.defaultZone=http://localhost:9001/eureka/
which means no security at all.
Not what I am seeing, without the username and password in defaultZone
on the client the registration fails
Remove security settings from eureka config file, and create new @Configuration class where you setup the user and disable csrf.
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter{
@Override
public void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication()
.passwordEncoder(NoOpPasswordEncoder.getInstance())
.withUser("admin").password("admin")
.authorities("ADMIN");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf()
.disable()
.authorizeRequests()
.anyRequest().authenticated()
.and()
.httpBasic();
}
}
Unable to register the client with eureka server (The is no security in the classpath)
spring boot version 2.0.3.RELEASE
spring: application: name: eureka-service
server: port: 8302
eureka: client: register-with-eureka: false fetch-registry: false server: wait-time-in-ms-when-sync-empty: 0
The eureka server started fine and can be accessed at http://localhost:8302/
spring boot version 2.0.3.RELEASE
spring: application: name: stock-service
server: port: 8301
eureka: client: register-with-eureka: false fetch-registry: false service-url: default-zone: http://localhost:8302/
instance: hostname: localhost
2018-07-09 13:42:40.279 INFO 265144 --- [trap-executor-0] c.n.d.s.r.aws.ConfigClusterResolver : Resolving eureka endpoints via configuration 2018-07-09 13:42:50.123 INFO 265144 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : Disable delta property : false 2018-07-09 13:42:50.123 INFO 265144 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : Single vip registry refresh property : null 2018-07-09 13:42:50.123 INFO 265144 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : Force full registry fetch : false 2018-07-09 13:42:50.123 INFO 265144 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : Application is null : false 2018-07-09 13:42:50.123 INFO 265144 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : Registered Applications size is zero : true 2018-07-09 13:42:50.123 INFO 265144 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : Application version is -1: true 2018-07-09 13:42:50.123 INFO 265144 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : Getting all instance registry info from the eureka server 2018-07-09 13:42:52.128 ERROR 265144 --- [freshExecutor-0] c.n.d.s.t.d.RedirectingEurekaHttpClient : Request execution error
com.sun.jersey.api.client.ClientHandlerException: java.net.ConnectException: Connection refused: connect at com.sun.jersey.client.apache4.ApacheHttpClient4Handler.handle(ApacheHttpClient4Handler.java:187) ~[jersey-apache-client4-1.19.1.jar:1.19.1] at com.sun.jersey.api.client.filter.GZIPContentEncodingFilter.handle(GZIPContentEncodingFilter.java:123) ~[jersey-client-1.19.1.jar:1.19.1] at com.netflix.discovery.EurekaIdentityHeaderFilter.handle(EurekaIdentityHeaderFilter.java:27) ~[eureka-client-1.9.2.jar:1.9.2] at com.sun.jersey.api.client.Client.handle(Client.java:652) ~[jersey-client-1.19.1.jar:1.19.1] at com.sun.jersey.api.client.WebResource.handle(WebResource.java:682) ~[jersey-client-1.19.1.jar:1.19.1] at com.sun.jersey.api.client.WebResource.access$200(WebResource.java:74) ~[jersey-client-1.19.1.jar:1.19.1] at com.sun.jersey.api.client.WebResource$Builder.get(WebResource.java:509) ~[jersey-client-1.19.1.jar:1.19.1] at com.netflix.discovery.shared.transport.jersey.AbstractJerseyEurekaHttpClient.getApplicationsInternal(AbstractJerseyEurekaHttpClient.java:194) ~[eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.jersey.AbstractJerseyEurekaHttpClient.getApplications(AbstractJerseyEurekaHttpClient.java:165) ~[eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$6.execute(EurekaHttpClientDecorator.java:137) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.MetricsCollectingEurekaHttpClient.execute(MetricsCollectingEurekaHttpClient.java:73) ~[eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.getApplications(EurekaHttpClientDecorator.java:134) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$6.execute(EurekaHttpClientDecorator.java:137) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.RedirectingEurekaHttpClient.executeOnNewServer(RedirectingEurekaHttpClient.java:118) ~[eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.RedirectingEurekaHttpClient.execute(RedirectingEurekaHttpClient.java:79) ~[eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.getApplications(EurekaHttpClientDecorator.java:134) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$6.execute(EurekaHttpClientDecorator.java:137) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.RetryableEurekaHttpClient.execute(RetryableEurekaHttpClient.java:120) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.getApplications(EurekaHttpClientDecorator.java:134) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$6.execute(EurekaHttpClientDecorator.java:137) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.SessionedEurekaHttpClient.execute(SessionedEurekaHttpClient.java:77) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.getApplications(EurekaHttpClientDecorator.java:134) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.DiscoveryClient.getAndStoreFullRegistry(DiscoveryClient.java:1051) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.DiscoveryClient.fetchRegistry(DiscoveryClient.java:965) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.DiscoveryClient.refreshRegistry(DiscoveryClient.java:1471) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.DiscoveryClient$CacheRefreshThread.run(DiscoveryClient.java:1438) [eureka-client-1.9.2.jar:1.9.2] at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [na:1.8.0_171] at java.util.concurrent.FutureTask.run(FutureTask.java:266) [na:1.8.0_171] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_171] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_171] at java.lang.Thread.run(Thread.java:748) [na:1.8.0_171] Caused by: java.net.ConnectException: Connection refused: connect at java.net.DualStackPlainSocketImpl.waitForConnect(Native Method) ~[na:1.8.0_171] at java.net.DualStackPlainSocketImpl.socketConnect(DualStackPlainSocketImpl.java:85) ~[na:1.8.0_171] at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) ~[na:1.8.0_171] at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) ~[na:1.8.0_171] at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) ~[na:1.8.0_171] at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:172) ~[na:1.8.0_171] at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) ~[na:1.8.0_171] at java.net.Socket.connect(Socket.java:589) ~[na:1.8.0_171] at org.apache.http.conn.scheme.PlainSocketFactory.connectSocket(PlainSocketFactory.java:121) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:180) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:144) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:134) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:610) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:445) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:835) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:118) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56) ~[httpclient-4.5.5.jar:4.5.5] at com.sun.jersey.client.apache4.ApacheHttpClient4Handler.handle(ApacheHttpClient4Handler.java:173) ~[jersey-apache-client4-1.19.1.jar:1.19.1] ... 30 common frames omitted
2018-07-09 13:42:52.128 WARN 265144 --- [freshExecutor-0] c.n.d.s.t.d.RetryableEurekaHttpClient : Request execution failed with message: java.net.ConnectException: Connection refused: connect 2018-07-09 13:42:52.129 ERROR 265144 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : DiscoveryClient_STOCK-SERVICE/del1-lhp-n02547.synapse.com:stock-service:8301 - was unable to refresh its cache! status = Cannot execute request on any known server
com.netflix.discovery.shared.transport.TransportException: Cannot execute request on any known server at com.netflix.discovery.shared.transport.decorator.RetryableEurekaHttpClient.execute(RetryableEurekaHttpClient.java:112) ~[eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.getApplications(EurekaHttpClientDecorator.java:134) ~[eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$6.execute(EurekaHttpClientDecorator.java:137) ~[eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.SessionedEurekaHttpClient.execute(SessionedEurekaHttpClient.java:77) ~[eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.getApplications(EurekaHttpClientDecorator.java:134) ~[eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.DiscoveryClient.getAndStoreFullRegistry(DiscoveryClient.java:1051) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.DiscoveryClient.fetchRegistry(DiscoveryClient.java:965) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.DiscoveryClient.refreshRegistry(DiscoveryClient.java:1471) [eureka-client-1.9.2.jar:1.9.2] at com.netflix.discovery.DiscoveryClient$CacheRefreshThread.run(DiscoveryClient.java:1438) [eureka-client-1.9.2.jar:1.9.2] at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [na:1.8.0_171] at java.util.concurrent.FutureTask.run(FutureTask.java:266) [na:1.8.0_171] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_171] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_171] at java.lang.Thread.run(Thread.java:748) [na:1.8.0_171]
Please open a separate issue Please learn how to format code on GitHub.
metoo the springboot 2.0.0 release and eureka1.4.5 I have the same problem.
@dyhack please dont comment on multiple issues with the same problem, I already answered your question
where?
i want to connection the remote eureka server。 How can i do
thanks 。if i have some other questions , may i asl you?
i know how to solve the problem. just #eureka.client.registerWithEureka=false
or don't write this,you can register from the remote server. but i don't know why notes this,it's default values are true
springboot:2.0.1.RELEASE springcloud:Finchley.RELEASE I want use username and password to auth,can you tell me how to do。 I have try @EnableWebSecurity in my eureka ,but it seemd not auth the username and password。
@ryanjbaxter
I have use @EnableWebSecurity ,the client can registe when the password is error @ryanjbaxter
@zhaijp please dont spam us with multiple issues and comments
using the following code can do auth @zhaijp
@EnableWebSecurity
static class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable().authorizeRequests()
.anyRequest()
.authenticated()
.and()
.httpBasic();
}
}
Remove security settings from eureka config file, and create new @configuration class where you setup the user and disable csrf.
@Configuration public class WebSecurityConfig extends WebSecurityConfigurerAdapter{ @Override public void configure(AuthenticationManagerBuilder auth) throws Exception { auth.inMemoryAuthentication() .passwordEncoder(NoOpPasswordEncoder.getInstance()) .withUser("admin").password("admin") .authorities("ADMIN"); } @Override protected void configure(HttpSecurity http) throws Exception { http .csrf() .disable() .authorizeRequests() .anyRequest().authenticated() .and() .httpBasic(); } }
it works!
in my case, it works for access to eureka dashboard, but eureka client isn't able to connect to server.
I also have the problem with it. Spring Boot Version: 2.1.3.RELEASE Spring Cloud: Greenwich.RELEASE
And I disabled csrf in my configuration.
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/actuator/**").permitAll()
.anyRequest()
.authenticated()
.and().httpBasic();
}
}
Eureka Server's application.yml:
spring:
application:
name: registration-center
security:
user:
name: eureka
password: 123456
server:
port: 8761
eureka:
instance:
hostname: localhost
client:
fetch-registry: false
register-with-eureka: false
server:
enable-self-preservation: false
Eureka Client application.yml:
spring:
cloud:
gateway:
discovery:
locator:
enabled: true
routes:
- id: route_service_user
uri: lb://SERVICE-USER
predicates:
- Path=/user/**
application:
name: gateway-client
server:
port: 8901
eureka:
client:
servers-url:
default-zone: http://eureka:123456@localhost:8761/eureka
register-with-eureka: true
fetch-registry: true
instance:
prefer-ip-address: true
hostname: localhost
The exception is:
2019-05-11 20:01:07.454 WARN 3864 --- [nfoReplicator-0] c.n.discovery.InstanceInfoReplicator : There was a problem with the instance info replicator
com.netflix.discovery.shared.transport.TransportException: Cannot execute request on any known server
at com.netflix.discovery.shared.transport.decorator.RetryableEurekaHttpClient.execute(RetryableEurekaHttpClient.java:112) ~[eureka-client-1.9.8.jar:1.9.8]
at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.register(EurekaHttpClientDecorator.java:56) ~[eureka-client-1.9.8.jar:1.9.8]
at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$1.execute(EurekaHttpClientDecorator.java:59) ~[eureka-client-1.9.8.jar:1.9.8]
at com.netflix.discovery.shared.transport.decorator.SessionedEurekaHttpClient.execute(SessionedEurekaHttpClient.java:77) ~[eureka-client-1.9.8.jar:1.9.8]
at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.register(EurekaHttpClientDecorator.java:56) ~[eureka-client-1.9.8.jar:1.9.8]
at com.netflix.discovery.DiscoveryClient.register(DiscoveryClient.java:829) ~[eureka-client-1.9.8.jar:1.9.8]
at com.netflix.discovery.InstanceInfoReplicator.run(InstanceInfoReplicator.java:121) ~[eureka-client-1.9.8.jar:1.9.8]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [na:1.8.0_201]
at java.util.concurrent.FutureTask.run(FutureTask.java:266) [na:1.8.0_201]
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) [na:1.8.0_201]
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) [na:1.8.0_201]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_201]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_201]
at java.lang.Thread.run(Thread.java:748) [na:1.8.0_201]
It haunt me for a few days, could u please help me out? @ryanjbaxter
Please don't ask in multiple places (here, stack overflow and eureka).
@keanu96 : You need to put eureka client request to skip the security config of Eureka server. You must be having protected void configure(HttpSecurity http) throws Exception { http.httpBasic().and().authorizeRequests().antMatchers("/","/login").permitAll(). add "/eureka/**" for antMatchers like below
protected void configure(HttpSecurity http) throws Exception { http.httpBasic().and().authorizeRequests().antMatchers("/","/login","/eureka/**").permitAll().
Hope this helps.
In response to this problem, the latest version of spring cloud has given the official solution.
Add the following code to the eureka server project.
@EnableWebSecurity
class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().ignoringAntMatchers("/eureka/**");
super.configure(http);
}
}
spring boot 1.5.x is ok, but when i update to boot 2.0,eureka client registration failed.
1.eureka server config:
2.eureka client config:
3.eureka client logs: