package au.gov.dto.dibp.appointments.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;

/**
 * Authentication configuration for read-only admin pages that expose application metrics for monitoring purposes.
 */
@Configuration
@Order(1) // must have lower value (higher priority) than ClientSecurityConfigurerAdapter
@EnableWebSecurity
public class AdminSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

    private static final String ROLE_ADMIN = "ADMIN";

    @Autowired
    @Value("${security.admin.password}")
    private String adminPassword;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
                .disable()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
            .requestCache()
                .disable()
            .antMatcher("/monitoring/**").authorizeRequests().anyRequest().hasAnyRole(ROLE_ADMIN)
                .and()
            .httpBasic();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .inMemoryAuthentication()
            .withUser("admin").password(adminPassword).roles(ROLE_ADMIN);
    }
}

package au.gov.dto.dibp.appointments.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.util.matcher.RequestHeaderRequestMatcher;

/**
 * Authentication configuration for read-only admin pages that expose application metrics for monitoring purposes.
 *
 * When accessing these URLs in an environment with a load balancer present, HTTPS is required.
 */
@Configuration
@Order(1) // must have lower value (higher priority) than ClientSecurityConfigurerAdapter
@EnableWebSecurity
public class AdminSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

    private static final String ROLE_ADMIN = "ADMIN";

    @Autowired
    @Value("${security.admin.password}")
    private String adminPassword;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
                .disable()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
            .requestCache()
                .disable()
            .antMatcher("/monitoring/**")
                .authorizeRequests()
                .requestMatchers(new RequestHeaderRequestMatcher("x-forwarded-proto", "https"))
                .hasAnyRole(ROLE_ADMIN)
                .and()
            .httpBasic();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .inMemoryAuthentication()
            .withUser("admin").password(adminPassword).roles(ROLE_ADMIN);
    }
}

Enforce HTTPS for monitoring authentication