How to configure BasicAuth for Swagger UI?

Using SpringFox v. 2.9.2 and Spring Security v. 1.4.1.RELEASE

This is a question, and I’m sure is just a mistake in configuration on my end.

I have the following Docket configuration:

	@Bean
	public Docket api() {

		SecurityReference securityReference = SecurityReference.builder()
				.reference("basicAuth")
				.scopes(new AuthorizationScope[0])
				.build();

		ArrayList<SecurityReference> reference = new ArrayList<>(1);
		reference.add(securityReference);

		ArrayList<SecurityContext> securityContexts = new ArrayList<>(1);
		securityContexts.add(SecurityContext.builder().securityReferences(reference).build());

		ArrayList<SecurityScheme> auth = new ArrayList<>(1);
		auth.add(new BasicAuth("basicAuth"));

		return new Docket(DocumentationType.SWAGGER_2)
				.securitySchemes(auth)
				.securityContexts(securityContexts)
				.select()
					.apis(RequestHandlerSelectors.basePackage("com.my.package.directory"))
					.paths(PathSelectors.any())
					.build()
				.apiInfo(getApiInfo());
	}

The following Spring security configuration (defined in boostrap file):

security.user.name=jdoe
security.user.password=123456

When navigation to my swagger page, I see the following UI layout:

I am able to access any of the endpoints at this time, and hit them as usual. When selecting the “authorize” button, I get the following UI:

On that page, I can enter in literally any combination of username/passwords and it will display the following:

And, just like before I logged in, I am able to access any of the endpoints.

My expectation (desire) is that when navigating to the page, none of the endpoints will be usable by the user. They will receive a 401, or the “Try it Out” button will be disabled, until they login. The login credentials should only accept preconfigured combinations (jdoe/123456).

Like I said, I’m sure this is just a misconfiguration on my end, but after a few days of spinning my wheels, digging through documentation and StackOverflow, I’m not sure what I’m missing. Any help or guidance would be appreciated!

[czgab]

I found the solution, also using SpringFox v. 2.9.2, hope it helps.

    @Bean
    public Docket actuatorApi() {
        return new Docket(DocumentationType.SWAGGER_2)
                .groupName("Spring Actuator")
                .select()
                .apis(RequestHandlerSelectors.any())
                .paths(PathSelectors.ant("/actuator/**"))
                .build()
                .apiInfo(apiInfo())
                .securityContexts(Arrays.asList(actuatorSecurityContext()))
                .securitySchemes(Arrays.asList(basicAuthScheme()));
    }

    private SecurityContext actuatorSecurityContext() {
        return SecurityContext.builder()
                .securityReferences(Arrays.asList(basicAuthReference()))
                .forPaths(PathSelectors.ant("/actuator/**"))
                .build();
    }

    private SecurityScheme basicAuthScheme() {
        return new BasicAuth("basicAuth");
    }

    private SecurityReference basicAuthReference() {
        return new SecurityReference("basicAuth", new AuthorizationScope[0]);
    }

[blaqniz]

How do I validate username and password when I have this code:

@Configuration @EnableSwagger2 @Profile({Constants.PROFILE_LOCAL, Constants.PROFILE_UAT}) public class SwaggerConfig {

@Value("${version.number}")
private String version;

@Bean
public Docket api() {

    return new Docket(DocumentationType.SWAGGER_2)
            .select()
            .apis(Predicates.not(RequestHandlerSelectors.basePackage("org.springframework.boot")))
            .paths(PathSelectors.any())
            .build()
            .apiInfo(apiInfo())
            .securitySchemes(Arrays.asList(securityScheme()))
            .securityContexts(Arrays.asList(securityContexts()));
}

private ApiInfo apiInfo() {

    return new ApiInfoBuilder()
            .title("My API")
            .description("My API Documentation")
            .version(version)
            .build();
}

private SecurityContext securityContexts() {
    return SecurityContext.builder()
            .securityReferences(Arrays.asList(basicAuthReference()))
            .forPaths(PathSelectors.any())
            .build();
}

private SecurityScheme securityScheme() {
    return new BasicAuth("basicAuth");
}

private SecurityReference basicAuthReference() {
    return new SecurityReference("basicAuth", new AuthorizationScope[0]);
}

}

At the moment I can login with any credentials and even when I don’t provide any credentials, I can still access the APIS.