Project: springxd
Issue XD-2855: Basic security makes xd-shell throw 403 Forbidden error
After enabling admin endpoint security in servers.yml using basic authentication and single user {code} spring: profiles: admin security: basic: enabled: true # false to disable security settings (default) realm: SpringXD user: # valid only if security.basic.enabled=true name: myadmin password: myadmin {code} Spring XD UI is secured however xd-shell commands are resulting in a 403 error: {code} server-unknown:>admin config server --uri http://localhost:9393 --username myadmin --password myadmin Successfully targeted http://localhost:9393 xd:>admin config info ------------- ------------------------------------------- Credentials [username='myadmin, password=****'] Result Successfully targeted http://localhost:9393 Target http://localhost:9393 Timezone used Greenwich Mean Time (UTC 0:00) ------------- ------------------------------------------- xd:>stream list Command failed org.springframework.web.client.HttpClientErrorException: 403 Forbidden xd:>stream create --name "t1" --definition "time | log" Command failed org.springframework.web.client.HttpClientErrorException: 403 Forbidden {code} This can be fixed by adding configuration explained in "File based authentication" docs section: {code} xd: security: authentication: file: enabled: true users: myadmin: myadmin, ROLE_VIEW, ROLE_ADMIN, ROLE_CREATE {code} Following is the problem: # Configuration explained in "Single user authentication" chapter should work out of the box without additional role setup # Docs should be more clear on authorization
Story points: 2