最后，我设法解决了我的问题。我仅在执行器中启用了/ info和/ health端点。为了只允许具有ADMIN角色的用户访问/
info端点，我需要混合执行器管理安全性和spring安全性配置。
所以我的 application.yml 看起来像这样：
endpoints.enabled: falseendpoints: info.enabled: true health.enabled: truemanagement.security.role: ADMIN
像这样的spring安全配置（我需要更改 ManagementSecurityConfig的 顺序以具有更高的优先级）：
@Configuration@EnableWebSecurity@EnableGlobalMethodSecurity(prePostEnabled = true)public class SecurityConfiguration { @Configuration protected static class AuthenticationSecurity extends GlobalAuthenticationConfigurerAdapter { @Autowired private AuthenticationProvider authenticationProvider; public AuthenticationSecurity() { super(); } @Override public void init(AuthenticationManagerBuilder auth) throws Exception { auth.inMemoryAuthentication().withUser("admin").password("secret").roles("ADMIN"); } } @Configuration @Order(Ordered.HIGHEST_PRECEDENCE + 2) public static class ManagementSecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.csrf().disable() .requestMatchers() .antMatchers("/info/**") .and() .authorizeRequests() .anyRequest().hasRole("ADMIN") .and() .httpBasic(); } } @Configuration public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter { protected void configure(HttpSecurity http) throws Exception { // API security configuration } }}
