title: Spring boot 2.1.x how to secure Actuator end points with basic auth
body: <p>I am trying to build a spring boot application and wanted to leverage the Actuator features, but I want to secure the end points of Actuator /health,/shutdown etc. I have the below configurations which does not seem to work. I.e., application never prompts for credentials or when hit from post man does not give 403. I tried various ways, even the one from spring documentation. Can any one please help with this. Again this is spring boot 2.1.x. I know there is a configuration that can be made in application.yml in the previous version of spring</p>
  
  <pre><code>@Configuration
  public class ActuatorSecurity extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.authorizeRequests()
                  .requestMatchers(EndpointRequest.to(ShutdownEndpoint.class, InfoEndpoint.class, HealthEndpoint.class,
                          MetricsEndpoint.class))
                  .hasRole("ENDPOINT_ADMIN").requestMatchers(PathRequest.toStaticResources().atCommonLocations())
                  .authenticated().and().httpBasic();
      }
  </code></pre>
  
  <p>application.yml</p>
  
  <pre><code>spring:
    security:
      user:
        name: admin
        password: admin
        roles:
        - ENDPOINT_ADMIN
  
  management:   
    endpoints:  
      web:
        exposure:
          include: "*"
    endpoint:
      shutdown:
        enabled: true
      health:
        show-details: when-authorized
        roles:
        - ENDPOINT_ADMIN
      mappings:
        enabled: true
  </code></pre>