{"id":96977,"date":"2019-09-02T09:51:21","date_gmt":"2019-09-02T06:51:21","guid":{"rendered":"http:\/\/www.javacodegeeks.com\/?p=96977"},"modified":"2019-09-11T12:01:09","modified_gmt":"2019-09-11T09:01:09","slug":"monitor-your-java-apps-spring-boot-actuator","status":"publish","type":"post","link":"https:\/\/www.javacodegeeks.com\/2019\/09\/monitor-your-java-apps-spring-boot-actuator.html","title":{"rendered":"Monitor Your Java Apps with Spring Boot Actuator"},"content":{"rendered":"

Friends don\u2019t let friends write user auth. Tired of managing your own users?<\/strong> Try Okta\u2019s API and Java SDKs today. Authenticate, manage, and secure users in any application within minutes.<\/a><\/span><\/p>\n

Have you worked with Spring Boot Actuator yet? It\u2019s an immensely helpful library that helps you monitor app health and interactions with the app – perfect for going to production! Spring Boot Actuator includes a built-in endpoint for tracing HTTP calls to your application – very useful for monitoring OpenID Connect (OIDC) requests – but unfortunately the default implementation does not trace body contents. In this post, I\u2019ll show you how to extend the httptrace endpoint for capturing contents and tracing the OIDC flow.<\/p>\n

Let\u2019s get started!<\/p>\n

Create an OpenID Connect App with Spring Initializr and Okta<\/h2>\n

You can use the excellent Spring Initializr<\/a> website or API for creating a sample OIDC application with Okta integration:<\/p>\n

curl https:\/\/start.spring.io\/starter.zip \\\n  dependencies==web,okta \\\n  packageName==com.okta.developer.demo -d\n<\/pre>\n
Before running your OIDC application however, you will need an Okta account. Okta is a developer service that handles storing user accounts and implementing user management (including OIDC) for you. Go ahead and register for a free developer account<\/a> to continue.<\/p>\n
Once you login to your Okta account, go to the Dashboard and then to the Applications<\/strong> section. Add a new Web application, and then in the General section get the client credentials: Client ID<\/strong> and Client Secret<\/strong>.<\/p>\n
You will need the Issuer<\/strong> which is the organization URL as well, which you can find at the top right corner in the Dashboard home. Note<\/strong>: By default, the built-in Everyone<\/code> Okta group is assigned to this application, so any users in your Okta org will be able to authenticate to it.<\/p>\n
With your Client ID, Client Secret. and the Issuer in place, start your application by passing the credentials through the command line:<\/p>\n
OKTA_OAUTH2_REDIRECTURI=\/authorization-code\/callback \\\nOKTA_OAUTH2_ISSUER=<issuer>\/oauth2 \\\nOKTA_OAUTH2_CLIENT_ID=<client id> \\\nOKTA_OAUTH2_CLIENT_SECRET=<client secret> \\\n.\/mvnw spring-boot:run\n<\/pre>\n
Add Test Controller to the Spring Boot App<\/h2>\n
It\u2019s a good practice to add a simple controller for testing the authentication flow. By default, access will only be allowed to authenticated users.<\/p>\n
@Controller\n@RequestMapping(value = \"\/hello\")\npublic class HelloController {\n\n    @GetMapping(value = \"\/greeting\")\n    @ResponseBody\n    public String getGreeting(Principal user) {\n        return \"Good morning \" + user.getName();\n    }\n}\n<\/pre>\n
You can test this out by restarting the app and browsing to \/hello\/greeting<\/a>.<\/p>\n
Add Spring Boot Actuator Dependency<\/h2>\n
Enable Spring Boot Actuator by adding the starter Maven dependency to the pom.xml file<\/code>:<\/p>\n
<dependency>\n  <groupId>org.springframework.boot<\/groupId>\n  <artifactId>spring-boot-starter-actuator<\/artifactId>\n<\/dependency>\n<\/pre>\n
To enable the httptrace endpoint, edit the src\/main\/resources\/application.properties<\/code> and add the following line:<\/p>\n
management.endpoints.web.exposure.include=info,health,httptrace\n<\/pre>\n
You can test the out-of-the-box actuator features running the application browsing to \/hello\/greeting<\/a>, and logging in.<\/p>\n
\n
Under the auto-configuration, Spring Security filters have higher precedence than filters added by the httptrace actuator.<\/p>\n<\/blockquote>\n
This means only authenticated calls are traced by default. We are going to change that here soon, but for now, you can see what is traced at \/actuator\/httptrace<\/a>. The response should look like this JSON payload:<\/p>\n
{\n   \"traces\":[\n      {\n         \"timestamp\":\"2019-05-19T05:38:42.726Z\",\n         \"principal\":{\n            \"name\":\"***\"\n         },\n         \"session\":{\n            \"id\":\"***\"\n         },\n         \"request\":{\n            \"method\":\"GET\",\n            \"uri\":\"http:\/\/localhost:8080\/\",\n            \"headers\":{},\n            \"remoteAddress\":\"0:0:0:0:0:0:0:1\"\n         },\n         \"response\":{\n            \"status\":200,\n            \"headers\":{}\n         },\n         \"timeTaken\":145\n      }\n   ]\n}\n<\/pre>\n
Add Custom HTTP Tracing to your Spring Boot App<\/h2>\n
\n
HTTP tracing is not very flexible. Andy Wilkinson, the author of the httptrace actuator, suggests implementing your own endpoint<\/a> if body tracing is required.<\/p>\n<\/blockquote>\n
Alternatively, with some custom filters, we can enhance the base implementation without much work. In the following sections I\u2019ll show you how to:<\/p>\n