{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/3135","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/3135/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/3135/comments","events_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/3135/events","html_url":"https://github.com/spring-projects/spring-boot/issues/3135","id":85494599,"number":3135,"title":"Cannot set different credentials in Spring Boot for app authentication and management authentication","user":{"login":"johanhaleby","id":187029,"avatar_url":"https://avatars.githubusercontent.com/u/187029?v=3","gravatar_id":"","url":"https://api.github.com/users/johanhaleby","html_url":"https://github.com/johanhaleby","followers_url":"https://api.github.com/users/johanhaleby/followers","following_url":"https://api.github.com/users/johanhaleby/following{/other_user}","gists_url":"https://api.github.com/users/johanhaleby/gists{/gist_id}","starred_url":"https://api.github.com/users/johanhaleby/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johanhaleby/subscriptions","organizations_url":"https://api.github.com/users/johanhaleby/orgs","repos_url":"https://api.github.com/users/johanhaleby/repos","events_url":"https://api.github.com/users/johanhaleby/events{/privacy}","received_events_url":"https://api.github.com/users/johanhaleby/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spring-projects/spring-boot/labels/question","name":"question","color":"cc317c"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-05T09:59:30Z","updated_at":"2015-06-19T06:22:58Z","closed_at":"2015-06-19T06:22:58Z","body":"I'm not sure if this is a bug or if it's just something that I'm not getting but I have a really hard time configuring different credentials for the management  application (Actuator) and my app (I'm using Spring boot 1.2.4.RELEASE (I've also tried 1.2.3)).  I have read the Spring documentation but I still haven't got it to work and I'm running out of options. Perhaps the documentation should be clearer on this use case. I've tried a lot of different things but I think this is the closest:\r\n\r\n```java\r\npackage x.y.z;\r\n\r\nimport org.springframework.beans.factory.annotation.Value;\r\nimport org.springframework.boot.actuate.autoconfigure.ManagementServerProperties;\r\nimport org.springframework.boot.autoconfigure.security.SecurityProperties;\r\nimport org.springframework.context.annotation.Configuration;\r\nimport org.springframework.core.Ordered;\r\nimport org.springframework.core.annotation.Order;\r\nimport org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;\r\nimport org.springframework.security.config.annotation.authentication.configurers.GlobalAuthenticationConfigurerAdapter;\r\nimport org.springframework.security.config.annotation.web.builders.HttpSecurity;\r\nimport org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;\r\nimport org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter;\r\n\r\nimport static org.springframework.security.config.http.SessionCreationPolicy.STATELESS;\r\n\r\n@Configuration\r\npublic class SecurityConfig {\r\n\r\n    // We disable spring security defaults since we don't want session management, login/logout page for the API.\r\n    private static final boolean DISABLE_DEFAULT_SPRING_SECURITY_SETUP = true;\r\n    private static final String API_USER = \"API_USER\";\r\n    private static final String ADMIN_USER = \"MANAGEMENT_USER\";\r\n\r\n\r\n    @Order(Ordered.HIGHEST_PRECEDENCE)\r\n    @Configuration\r\n    protected static class AuthenticationSecurity extends GlobalAuthenticationConfigurerAdapter {\r\n        @Value(\"${security.user.name}\")\r\n        private String managementUsername;\r\n        @Value(\"${security.user.password}\")\r\n        private String managementPassword;\r\n        @Value(\"${application.auth.username}\")\r\n        private String apiUsername;\r\n        @Value(\"${application.auth.password}\")\r\n        private String apiPassword;\r\n\r\n        @Override\r\n        public void init(AuthenticationManagerBuilder auth) throws Exception {\r\n            auth.inMemoryAuthentication().withUser(apiUsername).password(apiPassword).roles(API_USER).\r\n                    and().withUser(managementUsername).password(managementPassword).roles(ADMIN_USER);\r\n        }\r\n    }\r\n\r\n    @Configuration\r\n    @Order(ManagementServerProperties.ACCESS_OVERRIDE_ORDER)\r\n    public static class ManagementWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {\r\n\r\n        @Value(\"${security.user.name}\")\r\n        private String managementUsername;\r\n        @Value(\"${security.user.password}\")\r\n        private String managementPassword;\r\n        @Value(\"${management.context-path}\")\r\n        private String managementContextPath;\r\n\r\n        protected void configure(HttpSecurity http) throws Exception {\r\n            http\r\n                    .antMatcher(managementContextPath + \"/**\")\r\n                    .authorizeRequests()\r\n                    .anyRequest().hasRole(ADMIN_USER)\r\n                    .and()\r\n                    .httpBasic();\r\n        }\r\n    }\r\n\r\n    @Configuration\r\n    @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)\r\n    public static class ApplicationWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {\r\n        @Value(\"${application.auth.username}\")\r\n        private String apiUsername;\r\n        @Value(\"${application.auth.password}\")\r\n        private String apiPassword;\r\n\r\n\r\n        public ApplicationWebSecurityConfigurerAdapter() {\r\n            super(DISABLE_DEFAULT_SPRING_SECURITY_SETUP);\r\n        }\r\n\r\n        @Override\r\n        protected void configure(HttpSecurity http) throws Exception {\r\n            // @formatter:off\r\n            http\r\n                .addFilter(new WebAsyncManagerIntegrationFilter())\r\n                .exceptionHandling().and()\r\n                .headers().and()\r\n                .sessionManagement()\r\n                    .sessionCreationPolicy(STATELESS)\r\n                .and()\r\n                .securityContext().and()\r\n                .requestCache().and()\r\n                .servletApi().and()\r\n                .authorizeRequests()\r\n                      .anyRequest().hasRole(API_USER)\r\n                      .and()\r\n                .httpBasic();\r\n            // @formatter:on\r\n        }\r\n    }\r\n}\r\n```\r\n\r\nThe interesting parts of my  `application.yml` file looks like this:\r\n```yml\r\nserver:\r\n  port: 8082\r\nmanagement:\r\n  context-path: /admin\r\n  port: 8083\r\n\r\nsecurity:\r\n  user:\r\n    name: admin\r\n    password: password\r\n\r\napplication:\r\n  auth:\r\n    username: username\r\n    password: password\r\n```\r\n\r\nWhat happens is that when I navigate to any management resource (for example http://localhost:8083/admin/env) and try to log in using admin/password I get \"permission denied\".\r\n\r\nI've also asked the same question (with bounty) on [stack overflow](http://stackoverflow.com/questions/30382775/different-credentials-in-spring-boot-for-app-authentication-and-management-authe/30502918#30502918) but so far no one has been able to solve it."},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/comments/113388087","html_url":"https://github.com/spring-projects/spring-boot/issues/3135#issuecomment-113388087","issue_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/3135","id":113388087,"user":{"login":"johanhaleby","id":187029,"avatar_url":"https://avatars.githubusercontent.com/u/187029?v=3","gravatar_id":"","url":"https://api.github.com/users/johanhaleby","html_url":"https://github.com/johanhaleby","followers_url":"https://api.github.com/users/johanhaleby/followers","following_url":"https://api.github.com/users/johanhaleby/following{/other_user}","gists_url":"https://api.github.com/users/johanhaleby/gists{/gist_id}","starred_url":"https://api.github.com/users/johanhaleby/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johanhaleby/subscriptions","organizations_url":"https://api.github.com/users/johanhaleby/orgs","repos_url":"https://api.github.com/users/johanhaleby/repos","events_url":"https://api.github.com/users/johanhaleby/events{/privacy}","received_events_url":"https://api.github.com/users/johanhaleby/received_events","type":"User","site_admin":false},"created_at":"2015-06-19T06:22:58Z","updated_at":"2015-06-19T06:22:58Z","body":"I managed to solve this by using:\r\n\r\n```java\r\n.requestMatchers(request -> !request.getContextPath().startsWith(managementContextPath)).hasRole(API)\r\n.antMatchers(\"/**\").not().hasRole(API)\r\n.antMatchers(managementContextPath + \"/**\").hasRole(ADMIN)\r\n```\r\n\r\nI still haven't figured out why I have to do this workaround."}}