问使用oauth2作用域而不是角色来保护弹簧执行器管理端点

EN

@Configuration
public class SecurityConfiguration extends ResourceServerConfigurerAdapter {

    @Value("${management.context-path}")
    private String managementContextPath;

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests() 
                // some paths I don't want to secure at all
                .antMatchers("/path1/**", "/path2/**").permitAll() 
                // access to health endpoint is open to anyone
                .antMatchers(HttpMethod.GET, managementContextPath + "/health").permitAll() 
                // but app.admin scope is necessary for other management endpoints
                .antMatchers(managementContextPath + "/**").access("#oauth2.hasScope('my-super-scope')") //
                // And we make sure the user is authenticated for all the other cases
                .anyRequest().authenticated();
    }
}

security:
  oauth2:
    client:
      clientId: a-client
      clientSecret: the-client-password
    resource:
      tokenInfoUri: http://my-spring-oauth2-provider/oauth/check_token

management:
  context-path: /my-context
  security:
    enabled: true
endpoints:
  health:
    sensitive: false