您可以使用下面的代码和配置
application.properties

spring.security.user.name=user
spring.security.user.password=password
spring.security.user.roles=ENDPOINT_ADMIN

字符串
固定致动器端点

import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
/**
 * @author dpoddar
 *
 */
@Configuration
@EnableWebSecurity
public class ActuatorSecurity extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .csrf().disable()
        .authorizeRequests()
        .requestMatchers(EndpointRequest.to("health", "flyway","info")).permitAll()
        .requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ENDPOINT_ADMIN")
        .and()
        .httpBasic()
            ;
    }
}

型

执行器不再有单独的上下文。
假设是，只要非执行器端点不需要安全限制，以下配置就可以工作。

@Configuration
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).authenticated().anyRequest().permitAll()
                .and().formLogin();
    }
}

字符串
EndpointRequest处理匹配任何Actuator端点，为测试提供表单登录。请注意，即使/info和/health也是安全的。EndpointRequest有更多粒度选项;此外，在Sping Boot 2中，默认情况下仅启用info和health。
或者，您可以只保护其他API使用的任何安全机制后面的路径
我在这里推了一个示例应用程序，
https://github.com/DarrenForsythe/secure-spring-actuator-only

其工作

package com.example.demo.config;
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@Configuration
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).authenticated().anyRequest().permitAll().and()
                .httpBasic()
        ;
    }
}

字符串