Previously ManagementSecurityAutoConfiguration used Spring Security's
default realm of "Realm" when authentication failed. This was confusing
because when prompted for authentication (i.e. no credentials provided)
the realm "Spring" was requested.
This commit ensures the Realm that is used is consistent for all of of the
security auto configuration.
Fixes#2466
Prior to this commit, EndpointWebMvcAutoConfiguration would start a
child context if the management port was different to the server port
and the application context was a web application context. This caused
two problems:
If a user built an executable war and configured the management port so
that it was different to the server port, their application would run
successfully when launched with java -jar, but it would fail when
deployed to Tomcat as an attempt would be made to start embedded Tomcat.
Secondly, if a user ran a test annotated with @WebAppConfiguration the
main embedded Tomcat instance would not be started, but the child
context would trigger the creation of a Tomcat instance listening on the
configured management port. This is unexpected as @WebIntegrationTest
or @IntegrationTest and @WebAppConfiguration should be required to have
the test trigger full startup of the application and listen on the
configured ports.
This commit updates EndpointWebMvcAutoConfiguration so that it will only
start a child context when the management port is different to the
server port and the EmbeddedWebApplicationContext has an embedded
servlet container. This resolves the two problems described above as
there will be no embedded servlet container when deployed to a
standalone container or when a test is run without @IntegrationTest.
Fixes gh-2798
Previously, if a call to doFilter in MetricFilter failed (i.e. it threw
an exception), it would be handled as if it had a response status of
200. This is because the servlet container was yet to handle the
exception and set the response status to 500.
This commit updates MetricFilter to assume that an exception thrown from
doFilter will result in a response with a status of 500. Strictly
speaking, even though the filter has highest precedence and will
therefore run last on the way back out, this may not always be the case.
For example, a custom Tomcat Valve could handle the exception and result
in a 200 response but that’s an edge case that’s into shooting yourself
in the foot territory.
Closes gh-2818
This commit improves upon the changes made in a8bf9d3 by adding
support for relaxed binding of the endpoints.enabled and
endpoints.<name>.enabled properties. This is achieved by replacing
use of @ConditionalOnExpression (which does not support relaxed
binding) with a custom condition implementation that uses
RelaxedPropertyResolver.
Closes gh-2767
Previously, only invocations of /metricName/ would honour the enabled
property and return a not found (404) response. For endpoints which
support nested paths, access to /metricName/foo would ignore the enabled
flag and return an OK (200) response. Furthermore, there was a comment
in EndpointMvcAdapter that suggested that an endpoint shouldn’t be
called when it is disabled, however this was not the case.
This commit updates EndpointWebMvcAutoConfiguration and
JolokiaAutoConfiguration to only register their MvcEndpoint beans if
the underlying endpoint is enabled. This means that an
EndpointMvcAdapter should not be called if its delegate is disabled,
making the comment described above accurate.
The check for the delegate being enabled has been retained so as not to
rely upon the auto-configurations’ behaviour. The methods which handle
nested paths (MetricsMvcEndpoint.value() and
EnvironmentMvcEndpoint.value()) have been updated to add the same check
for the enablement of their delegate.
Fixes gh-2767
Update SystemPublicMetrics to silently ignore ManagementFactory
NoClassDefFoundErrors which can occur when deploying to Google App
Engine.
Fixes gh-2701
Previously, the response from /health was not cached if the request
was secure, i.e. the user has authenticated, or the endpoint was
configured as not being sensitive.
The commit updates HealthMvcEndpoint to apply the caching logic
all the time. Users that do not want caching can disable it by
configuring the TTL with a value of zero.
Closes gh-2630
Spring Boot's metrics infrastructure requires a Metric to have a
Number value. Coda Hale's ThreadStatesGaugeSet includes a Gauge
named deadlocks with a Set<String> value (each entry in the set is a
description, including stacktrace, of a deadlocked thread). There's
no obvious way to coerce this to a Number, and there's already a
deadlocks.count metric in the set.
This commit updates MetricRegistryMetricReader to ignore the addition
of any Gauge with a non-Number value.
Fixes gh-2593
ee567fa boldy claimed that it had made MetricRegistryMetricReader
thread-safe. It had not. This commit should actually make it thread
safe. I hope.
One notable improvement is that MetricRegistryMetricReader.findAll()
will no longer contain null values if a metric is removed on another
thread during iteration.
names is now a ConcurrentHashMap to allow it to be safely read and
written without holding a lock.
reverse is a LinkedMultiValueMap which is not thread-safe. This could
lead to values being lost when concurrent add calls were made. Access
to reverse is now protected by synchronizing on an internal monitor
object.
Calls to containsKey(key) followed by get(key) have been reworked to
only call get(key), this avoids the possibility of the key being
removed after the contains check but before the get.
Closes gh-2590
MetricRegistryMetricReader’s fields where neither final, nor volatile
but could be accessed on multiple threads. This lead to visibility
problems where the value of a field would unexpectedly be null, causing
an NPE.
This commit updates all of the fields to declare them as final, thereby
ensuring that their values are guaranteed to be visible across different
threads.
Fixes gh-2590
If there is more than one DataSource and the non-primary bean-name is
'datasource' an incorrect metric name is chosen.
The metrics are named datasource.active and not datasource.xxx.active. To
avoid this, the shortening of the bean-name only occurs if the bean-name
is longer than 'datasource'.
See gh-2320
Previously each endpoint was secured for path, path/, and path.*.
This meant that a request to path/foo was not secured. This commit
secures path/** to ensure that requests to a nested endpoint path are
also secured.
Fixes gh-2476
Update InMemoryAuditEventRepository to consider the date when searching
for events. Also switch to a circular buffer implementation and update
the capacity to limit the total number of items rather than limiting
per principal.
Fixes gh-2291
Update AbstractEndpoint to correctly support the `endpoints.enabled`
property. Also fix EnvironmentEnpoint which would previously prevent
the Environment from being set.
Fixes gh-2264
Closes gh-2265
Update WebMvcAutoConfiguration so that the RequestMappingHandlerMapping
bean is @Primary. Prior to this commit a NoUniqueBeanDefinitionException
would be thrown then using the MvcUriComponentsBuilder.
Fixes gh-2237
Andy Wilkinson
Josh Thornhill
Rob Winch
Stephane Nicoll
Phillip Webb
Dave Syer
Spring Buildmaster
Johannes Stelzer
Mathieu Bernatet
izeye