前言
Spring Security 4.0 + CAS4.0 整合的资料网上不多,我推荐这个,Spring Security 4.0 CAS 实现单点登录，然后配下来发现还是有很多问题,各种问题，各种不成功!
而且出了问题完全没有头绪
直接上配置好的文件
1. web.xml
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/applicationContext.xml,/WEB-INF/spring-cas.xml
</param-value>
</context-param>
<listener>
<listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
</listener>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!-- 单点登录注销过滤器 -->
<filter>
<filter-name>CAS Single Sign Out Filter</filter-name>
<filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
<init-param>
<param-name>casServerUrlPrefix</param-name>
<param-value>https://cas.infozr.com:8443/cas/</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>CAS Single Sign Out Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- spring字符编码过滤器 -->
<filter>
<filter-name>characterEncodingFilter</filter-name>
<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>characterEncodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- springSecurity过滤器 -->
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- session过滤器，检查是否有session -->
<filter>
<filter-name>onlineFilter</filter-name>
<filter-class>cn.infozr.sso.cas.filter.OnlineFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>onlineFilter</filter-name>
<url-pattern>*.do</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>onlineFilter</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>
<!-- 定义首页 -->
<welcome-file-list>
<welcome-file>login.html</welcome-file>
<welcome-file>index.html</welcome-file>
</welcome-file-list>
</web-app>
2. OnlineFilter.java
/**
* 登陆验证过滤
*/
public class OnlineFilter extends HttpServlet implements Filter {
private static final long serialVersionUID = 1L;
private String redirect_url;
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
// 这里设置如果没有登陆将要转发到的页面
HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse res = (HttpServletResponse) response;
HttpSession session = req.getSession(true);
String requestUri = req.getRequestURI();
String contextPath = req.getContextPath();
String url = requestUri.substring(contextPath.length());
// 从session里取的用户名信息
String username = (String) session.getAttribute("sessionUsername");
// 这里获取session，为了检查session里有没有保存用户信息，没有的话回转发到登陆页面
// 判断如果没有取到用户信息,就跳转到登陆页面
if(username == null && StringUtils.isEmpty(req.getParameter("ticket"))) {
// 跳转到登陆页面
if(isAjaxRequest(req)){
try {
response.getWriter().print("login");
} catch (IOException e) {
e.printStackTrace();
}
}
else{
res.sendRedirect(redirect_url);
}
} else {
chain.doFilter(request, response);
}
}
private boolean isAjaxRequest(HttpServletRequest request) {
String header = request.getHeader("X-Requested-With");
if (header != null && "XMLHttpRequest".equals(header))
return true;
else
return false;
}
public void init(FilterConfig filterConfig) throws ServletException {
StringBuilder url = new StringBuilder();
url.append("https://cas.infozr.com:8443/cas");
url.append("/login?service=");
url.append("http://192.168.0.110:8080/infozr_upms/login/cas");
redirect_url = url.toString();
}
}
3. spring-cas.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:p="http://www.springframework.org/schema/p"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:sec="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context-4.2.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-4.2.xsd"
default-lazy-init="true">
<!-- 浏览权限设定，根据自己的情况修改 -->
<sec:http auto-config="false" use-expressions="false" disable-url-rewriting="false"
entry-point-ref="casProcessingFilterEntryPoint">
<sec:headers disabled="true"/>
<sec:intercept-url pattern="/login/cas*" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
<sec:intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
<sec:custom-filter position="CAS_FILTER" ref="casAuthenticationFilter" />
<sec:logout logout-success-url="https://cas.infozr.com:8443/cas/logout"/>
<sec:custom-filter ref="requestSingleLogoutFilter" before="LOGOUT_FILTER"/>
<sec:custom-filter ref="singleLogoutFilter" before="CAS_FILTER"/>
<sec:csrf disabled="true"/>
<!--<sec:custom-filter ref="csrfTokenFilter" after="CSRF_FILTER"/>-->
</sec:http>
<!-- CSRF Configuration
<bean id="csrfTokenFilter" class="com.test.cloud.security.CsrfTokenFilter"/>
-->
<sec:authentication-manager alias="authenticationManager">
<sec:authentication-provider ref="casAuthenticationProvider"/>
</sec:authentication-manager>
<!-- 注销客户端 -->
<bean id="singleLogoutFilter" class="org.jasig.cas.client.session.SingleSignOutFilter"/>
<!-- 注销服务器端 -->
<!-- This filter redirects to the CAS Server to signal Single Logout should be performed -->
<bean id="requestSingleLogoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">
<constructor-arg value="http://cas.infozr.com:8080/cas/logout"/>
<constructor-arg>
<bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"/>
</constructor-arg>
<property name="filterProcessesUrl" value="/logout/cas"/>
</bean>
<bean id="casAuthenticationFilter" class="org.springframework.security.cas.web.CasAuthenticationFilter">
<property name="authenticationManager" ref="authenticationManager"/>
<!-- 认证成功返回的页面，此处做了修改，这个类是继续之前的操作。默认的类是设置一个固定的页面 -->
<!-- 登录成功处理，将用户信息存入session -->
<property name="authenticationSuccessHandler">
<bean class="cn.infozr.sso.cas.service.CasAuthenticationSuccessHandler">
<!-- cas登录成功后跳转页面 -->
<property name="defaultTargetUrl" value="/admin.jsp"/>
<!-- <property name="usersDao" ref="resourcesDao"/>
<property name="resDao" ref="resourcesDao"/> -->
</bean>
</property>
<!-- 认证失败返回的页面(非403错误) -->
<property name="authenticationFailureHandler">
<bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
<property name="defaultFailureUrl" value="/static/html/errors/403.html"/>
</bean>
</property>
</bean>
<bean id="casProcessingFilterEntryPoint" class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
<!-- 单点登录服务器登录URL -->
<property name="loginUrl" value="https://cas.infozr.com:8443/cas/login"/>
<property name="serviceProperties" ref="serviceProperties"/>
</bean>
<bean id="userDetailsManager" class="cn.infozr.sso.cas.service.UserDetailsManager"/>
<bean id="casAuthenticationProvider"
class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
<!-- 注入获取tsp用户的service -->
<property name="authenticationUserDetailsService">
<bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
<constructor-arg ref="userDetailsManager" />
</bean>
</property>
<property name="serviceProperties" ref="serviceProperties"/>
<property name="ticketValidator">
<bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
<constructor-arg index="0" value="https://cas.infozr.com:8443/cas"/>
</bean>
</property>
<property name="key" value="an_id_for_this_auth_provider_only"/>
</bean>
<bean id="serviceProperties" class="org.springframework.security.cas.ServiceProperties">
<!--[login/cas]是Spring Security 4.0后修改的地址、跟3.X版本完全不同、请勿修改-->
<!-- Cas Server认证成功后的跳转地址，这里要跳转到我们的Spring Security应用，之后会由CasAuthenticationFilter处理，默认处理地址为/j_spring_cas_security_check -->
<property name="service" value="http://192.168.0.110:8080/infozr_upms/login/cas"/>
<property name="sendRenew" value="false"/>
</bean>
</beans>
注意:serviceProperties 里面的属性 service 必须和 OnlineFilter 里面的跳转 url 后面的 service=的值保持一致
4.CasAuthenticationSuccessHandler.java
public class CasAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler{
private static Logger logger = LogManager.getLogger(CasAuthenticationSuccessHandler.class);
@Resource
private BaseDAO usersDao;
@Resource
private BaseDAO resDao;
public void setUsersDao(BaseDAO usersDao) {
this.usersDao = usersDao;
}
public void setResDao(BaseDAO resDao) {
this.resDao = resDao;
}
@Override
public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException,
ServletException {
String username = ((UserDetails) authentication.getPrincipal()).getUsername();
logger.info("cas验证成功,username={}",username);
request.getSession().setAttribute("sessionUsername", username);
super.onAuthenticationSuccess(request, response, authentication);
}
}
5. UserDetailsManager.java
public class UserDetailsManager implements UserDetailsService {
/**
* 此处的参数[loginId]为CAS登录画面输入的用户名
*/
@Override
public UserDetails loadUserByUsername(final String loginId) throws UsernameNotFoundException {
final Collection<GrantedAuthority> auths = new ArrayList<GrantedAuthority>();
System.out.println(loginId);
UserDetails userDetails = new UserDetails() {
/**
* Returns the authorities granted to the user. Cannot return
* <code>null</code>.
*
* @return the authorities, sorted by natural key (never
* <code>null</code>)
*/
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
SimpleGrantedAuthority authority = new SimpleGrantedAuthority("ROLE_USER");
auths.add(authority);
return auths;
}
/**
* Returns the password used to authenticate the user.
*
* @return the password
*/
@Override
public String getPassword() {
return "11";
}
/**
* Returns the username used to authenticate the user. Cannot return
* <code>null</code> .
*
* @return the username (never <code>null</code>)
*/
@Override
public String getUsername() {
return loginId;
}
/**
* Indicates whether the user's account has expired. An expired
* account cannot be authenticated.
*
* @return <code>true</code> if the user's account is valid (ie
* non-expired), <code>false</code> if no longer valid (ie
* expired)
*/
@Override
public boolean isAccountNonExpired() {
return true;
}
/**
* Indicates whether the user is locked or unlocked. A locked user
* cannot be authenticated.
*
* @return <code>true</code> if the user is not locked,
* <code>false</code> otherwise
*/
@Override
public boolean isAccountNonLocked() {
return true;
}
/**
* Indicates whether the user's credentials (password) has expired.
* Expired credentials prevent authentication.
*
* @return <code>true</code> if the user's credentials are valid (ie
* non-expired), <code>false</code> if no longer valid (ie
* expired)
*/
@Override
public boolean isCredentialsNonExpired() {
return true;
}
/**
* Indicates whether the user is enabled or disabled. A disabled
* user cannot be authenticated.
*
* @return <code>true</code> if the user is enabled,
* <code>false</code> otherwise
*/
@Override
public boolean isEnabled() {
return true;
}
};
return userDetails;
}
}
手机游戏源码素材网：http://www.codegather.com
欢迎来到这里！
我们正在构建一个小众社区，大家在这里相互信任，以平等 • 自由 • 奔放的价值观进行分享交流。最终，希望大家能够找到与自己志同道合的伙伴，共同成长。
注册 关于