如何通过Eureka使用Feign Client调用Spring Boot Admin的/actuator/health接口？

一、Spring Boot Admin服务端配置 #

Spring Boot Admin默认会通过Spring Security保护管理端点，你需要先配置正确的安全规则和认证账号：

1. 添加Spring Security依赖
   如果服务端还没引入该依赖，在pom.xml中添加：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

2. 配置Security规则与账号
   创建Security配置类，指定健康端点需要认证，同时配置登录账号：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/actuator/health").authenticated()
                .anyRequest().authenticated()
            )
            .formLogin(form -> form.permitAll())
            .csrf(csrf -> csrf.disable()); // 服务间调用可关闭CSRF

        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails adminUser = User.withUsername("admin")
            .password(passwordEncoder().encode("admin@123"))
            .roles("ADMIN")
            .build();
        return new InMemoryUserDetailsManager(adminUser);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

如果不需要自定义权限规则，也可以直接在application.yml中配置基础认证：

spring:
  security:
    user:
      name: admin
      password: admin@123

二、Feign客户端传递认证上下文 #

Feign调用时需要携带认证信息，有两种常用实现方式：

方式1：添加Basic认证头（适合固定账号的服务间调用） #

方法a：接口方法手动传入认证头

修改你的Feign Client：

import org.springframework.cloud.openfeign.FeignClient;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestHeader;

@FeignClient(name = "kyc-admin")
public interface SpringBootAdminClient {

    @GetMapping("/actuator/health")
    String getHealth(@RequestHeader("Authorization") String authHeader);
}

调用时生成Basic认证字符串：

import org.springframework.stereotype.Service;
import java.util.Base64;

@Service
public class AdminHealthService {
    private final SpringBootAdminClient adminClient;

    public AdminHealthService(SpringBootAdminClient adminClient) {
        this.adminClient = adminClient;
    }

    public String fetchAdminHealth() {
        String username = "admin";
        String password = "admin@123";
        String authStr = username + ":" + password;
        String encodedAuth = Base64.getEncoder().encodeToString(authStr.getBytes());
        return adminClient.getHealth("Basic " + encodedAuth);
    }
}

方法b：全局Feign配置自动添加认证头

创建Feign配置类，让所有请求自动携带Basic认证：

import feign.RequestInterceptor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import java.util.Base64;

@Configuration
public class FeignBasicAuthConfig {

    @Bean
    public RequestInterceptor basicAuthInterceptor() {
        return requestTemplate -> {
            String username = "admin";
            String password = "admin@123";
            String authStr = username + ":" + password;
            String encodedAuth = Base64.getEncoder().encodeToString(authStr.getBytes());
            requestTemplate.header("Authorization", "Basic " + encodedAuth);
        };
    }
}

然后在FeignClient中指定该配置：

@FeignClient(name = "kyc-admin", configuration = FeignBasicAuthConfig.class)
public interface SpringBootAdminClient {

    @GetMapping("/actuator/health")
    String getHealth();
}

方式2：传递当前用户的认证上下文（适合OAuth2场景） #

如果你的Feign客户端所在服务本身是OAuth2认证的，可传递当前登录用户的Bearer Token：

import feign.RequestInterceptor;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class FeignOAuth2Interceptor {

    @Bean
    public RequestInterceptor oauth2Interceptor() {
        return requestTemplate -> {
            Object auth = SecurityContextHolder.getContext().getAuthentication();
            if (auth instanceof JwtAuthenticationToken jwtToken) {
                requestTemplate.header("Authorization", "Bearer " + jwtToken.getToken().getTokenValue());
            }
        };
    }
}

这种方式需要Spring Boot Admin服务端也配置支持OAuth2认证。

三、注意事项 #

• 确保Eureka服务发现正常，kyc-admin是Spring Boot Admin在Eureka上的注册服务名
• 生产环境不要硬编码账号密码，建议通过配置中心或环境变量注入
• 如果服务端开启了CSRF保护，服务间调用建议关闭（如上述配置类中的csrf.disable()）

内容的提问来源于stack exchange，提问作者Julian