CAS (2) —— Mac下配置CAS到Tomcat（客户端）

CAS (2) —— Mac下配置CAS到Tomcat（客户端）

tomcat版本: tomcat-8.0.29

jdk版本: jdk1.8.0_65

cas版本: cas4.1.2
cas-client-3.4.1

参考来源:

CAS实现单点登录（SSO）经典完整教程

CAS 4.0 配置开发手册

cas客户端应用实现

使用 CAS 在 Tomcat 中实现单点登录

Tomcat (1) —— Mac下配置Tomcat Https/SSL

【高可用HA】Apache (2) —— Mac下安装多个Apache Tomcat实例

目标架构

下载

首先登陆jasig网站http://downloads.jasig.org/，下载相应的cas版本。

由于网站只提供源码包而不提供发布包，所以需要自己下载来编译。

cas会为不同的客户端消费者提供client包，这里我们选择java-client作为演示。

编译客户端所需要的jar

java-cas-client-cas-client-3.4.1 Richard$ mvn clean install -Dmaven.test.skip

然后下载供测试的客户端示例代码(jasig在github上为我们提供了一个简易的客户端demo)

$ git clone https://github.com/UniconLabs/cas-sample-java-webapp.git

配置

客户端

  • 设置

参照以下文章为Tomcat配置好Https

Tomcat (1) —— Mac下配置Tomcat Https/SSL

【高可用HA】Apache (2) —— Mac下安装多个Apache Tomcat实例

  • 编译部署

然后编译我们的示例项目

:cas-sample-java-webapp Richard$ mvn clean install -Dmaven.test.skip

pom.xml


4.0.0
iamlabs.unicon.net
cas-sample-java-webapp
0.0.1-SNAPSHOT
war
CAS Example Java Web App
A sample web application that exercises the CAS protocol features via the Java CAS Client.

cas-sample-java-webapp


org.apache.maven.plugins
maven-compiler-plugin
2.5.1

1.6
1.6




commons-logging
commons-logging
1.1.1


log4j
log4j
1.2.16


org.opensaml
opensaml1
1.1


javax.servlet
javax.servlet-api
3.1.0
provided


org.jasig.cas.client
cas-client-core
3.2.1


javax.servlet
servlet-api



commons-codec
commons-codec
1.6


org.apache.santuario
xmlsec
1.4.3


将编译生成的war包部署到我们的Tomcat容器中:

项目主要包括两个页面

index.jsp(供登陆)

<%@page contentType="text/html"%>
<%@page pageEncoding="UTF-8"%>
<%@ page import="java.util.Map" %>
<%@ page import="java.util.Iterator" %>
<%@ page import="java.util.List" %>
<%@ page import="org.jasig.cas.client.authentication.AttributePrincipal" %>




CAS Example Java Web App

CAS Example Java Web App


A sample web application that exercises the CAS protocol features via the Java CAS Client.


Authenticated User Id: <%= request.getRemoteUser() %>

<%
if (request.getUserPrincipal() != null) {
AttributePrincipal principal = (AttributePrincipal) request.getUserPrincipal();

/*
final String password = principal.getPassword();
if (password != null) {
out.println("

User Credentials: " + password + "

");
}
*/

final Map attributes = principal.getAttributes();

if (attributes != null) {
Iterator attributeNames = attributes.keySet().iterator();
out.println("Attributes:");

if (attributeNames.hasNext()) {
out.println("

");
out.println("");
out.println("");

for (; attributeNames.hasNext()😉 {
out.println("

");
}
out.println("
Attributes
KeyValue
");
String attributeName = (String) attributeNames.next();
out.println(attributeName);
out.println("		");
final Object attributeValue = attributes.get(attributeName);

if (attributeValue instanceof List) {
final List values = (List) attributeValue;
out.println("Multi-valued attribute: " + values.size() + "");
out.println("

    ");
    for (Object value: values) {
    out.println("
  • " + value + "
    • ");
    }
    out.println("
");
} else {
out.println(attributeValue);
}
out.println("
");
} else {
out.print("No attributes are supplied by the CAS server.

");
}
} else {
out.println("
The attribute map is empty. Review your CAS filter configurations.
");
}
} else {
out.println("
The user principal is empty from the request object. Review the wrapper filter configuration.
");
}
%>


logout.jsp(注销)

<%@page contentType="text/html"%>
<%@page pageEncoding="UTF-8"%>
<%@ page import="java.util.Map" %>
<%@ page import="java.util.Iterator" %>
<%@ page import="org.jasig.cas.client.authentication.AttributePrincipal" %>

<%
session.invalidate();
%>




CAS Example Java Web App


CAS Example Java Web App


Application session is now invalidated. You may also issue a request to "/cas/logout" to destroy the CAS SSO Session as well.


Back to Home

  • 配置CAS Authentication Filter

web.xml




CAS Authentication Filter
org.jasig.cas.client.authentication.AuthenticationFilter



casServerLoginUrl
https://sso.hoau.com:8433/cas/login


serverName
https://app1.hoau.com:8413


CAS Validation Filter
org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter



casServerUrlPrefix
https://sso.hoau.com:8433/cas


serverName
https://app1.hoau.com:8413


redirectAfterValidation
true


useSession
true


acceptAnyProxy
true



CAS HttpServletRequest Wrapper Filter
org.jasig.cas.client.util.HttpServletRequestWrapperFilter


CAS Validation Filter
/*


CAS Authentication Filter
/*


CAS HttpServletRequest Wrapper Filter
/*



index.jsp


* 以上web.xml配置中有四处需要注意的地方

  1. cas目标服务器登陆页面的配置


    casServerLoginUrl
    https://sso.hoau.com:8433/cas/login

  2. 本机服务器的地址（即当前node-a）


    serverName
    https://app1.hoau.com:8413

  3. "Cas20ProxyReceivingTicketValidationFilter"

    2.x和3.x以前也有其他的Ticket校验方式，这里官方推荐用Cas20Proxy


    CAS Validation Filter
    org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter

    casServerUrlPrefix
    https://sso.hoau.com:8433/cas


    serverName
    https://app1.hoau.com:8413

  4. 暂时将proxyReceptorUrl和proxyCallbackUrl注释掉，因为这里没有使用代理

测试

尝试访问

https://app1.hoau.com:8413/cas1

* 抱歉此处配图为node-b的

并使用我们在数据库里面预埋的数据"test01/psw01"登陆

使用相同方式将cas2部署到node-b节点，并指向cas的SSO服务器

*扩展

我们清空浏览器的cache和cookie，按照下列步骤操作

  1. 访问"https://app1.hoau.com:8413/cas1"

    系统会将我们重定向到"https://sso.hoau.com:8433/cas/login"。

  2. 输入用户名密码"test01/psw01"

    登陆成功

  3. 访问"https://app2.hoau.com:8423/cas2"

    系统会自动登陆使用用户名密码"test01/psw01"。

问题来了

这就是达到了SSO的效果，但是为什么是这样，原理是什么

结束

posted @ 2015-12-14 15:40  Richaaaard  阅读(1925)  评论(2)    收藏  举报