To use multiple WebsecurityConfigurerAdapter
, you need restrict them to specific URL patterns using RequestMatcher
.
In your case you can set a higher priority for ActuatorSecurityConfig
and limit it only to actuator endpoints:
@Order(-1)
@Configuration
public class ActuatorSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.requestMatchers().antMatchers("/actuator/**")
.and()
.authorizeRequests().anyRequest().hasRole("ADMIN")
.and()
.httpBasic();
}
}