Springboot security cas源码陶冶-ExceptionTranslationFilter

拦截关键的两个异常，对异常进行处理。主要应用异常则跳转至cas服务端登录页面

ExceptionTranslationFilter#doFilter-逻辑入口

具体操作逻辑如下

	public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
			throws IOException, ServletException {
		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;
		//这里直接放行，看出来其主要处理的是异常发生的情况
		try {
			chain.doFilter(request, response);

			logger.debug("Chain processed normally");
		}
		//IO异常直接抛出
		catch (IOException ex) {
			throw ex;
		}
		catch (Exception ex) {
			//提取发生的异常
			Throwable[] causeChain = throwableAnalyzer.determineCauseChain(ex);
			//首先获取是否含有AuthenticationException异常
			RuntimeException ase = (AuthenticationException) throwableAnalyzer
					.getFirstThrowableOfType(AuthenticationException.class, causeChain);

			if (ase == null) {
				//没有AuthenticationException异常则尝试获取AccessDeniedException异常
				ase = (AccessDeniedException) throwableAnalyzer.getFirstThrowableOfType(
						AccessDeniedException.class, causeChain);
			}

			if (ase != null) {
				//处理指定的这两个关键异常
				handleSpringSecurityException(request, response, chain, ase);
			}
			else {
				//如果关键异常都没有则直接抛出
				if (ex instanceof ServletException) {
					throw (ServletException) ex;
				}
				else if (ex instanceof RuntimeException) {
					throw (RuntimeException) ex;
				}
				throw new RuntimeException(ex);
			}
		}
	}

由以上代码我们只需要着重分析下handleSpringSecurityException()方法即可

ExceptionTranslationFilter#handleSpringSecurityException-处理spring安全异常

源码如下

	private void handleSpringSecurityException(HttpServletRequest request,
			HttpServletResponse response, FilterChain chain, RuntimeException exception)
			throws IOException, ServletException {
		if (exception instanceof AuthenticationException) {
			//转发请求至cas服务端登录页面
			sendStartAuthentication(request, response, chain,
					(AuthenticationException) exception);
		}
		else if (exception instanceof AccessDeniedException) {
		//首先判断是否Authentication凭证是否为AnonymousAuthenticationToken
			if (authenticationTrustResolver.isAnonymous(SecurityContextHolder
					.getContext().getAuthentication())) {
				//对AnonymousAuthenticationToken类型的请求转发cas服务端登录请求页面
				sendStartAuthentication(
						request,
						response,
						chain,
						new InsufficientAuthenticationException(
								"Full authentication is required to access this resource"));
			}
			else {
				//对于非AnonymousAuthenticationToken类型的请求，比如UsernamePasswordAuthenticationToken/CasAuthenticationToken则直接将异常信息写出到页面
				accessDeniedHandler.handle(request, response,
						(AccessDeniedException) exception);
			}
		}
	}

紧接着我们看ExceptionTranslationFilter#sendStartAuthentication()方法

	protected void sendStartAuthentication(HttpServletRequest request,
			HttpServletResponse response, FilterChain chain,
			AuthenticationException reason) throws ServletException, IOException {
		//转发前先清楚凭证信息
		SecurityContextHolder.getContext().setAuthentication(null);
		requestCache.saveRequest(request, response);

		//通过AuthenticationEntryPoint对象转发请求，常见为CasAuthenticationEntryPoint
		authenticationEntryPoint.commence(request, response, reason);
	}

CasAuthenticationEntryPoint#commence-cas服务端登录请求转发

直接查看源码，代码很简单

	public final void commence(final HttpServletRequest servletRequest,
			final HttpServletResponse response,
			final AuthenticationException authenticationException) throws IOException,
			ServletException {
		//创建service回调参数路径
		final String urlEncodedService = createServiceUrl(servletRequest, response);
		//cas服务端登录请求路径拼装，即后面会添加service参数
		final String redirectUrl = createRedirectUrl(urlEncodedService);

		//模板方法，供子类复写
		preCommence(servletRequest, response);
		//直接转发
		response.sendRedirect(redirectUrl);
	}

CasAuthenticationEntryPoint以下属性必须配置

1. loginUrl-cas服务端的登录地址，比如https://www.examplecasserver.com/cas/login
2. ServiceProperties-回调路径的配置，主要是service属性，此处一般为应用的主页地址

小结

1. ExceptionTranslationFilter的执行逻辑比较简单，主要是接受AccessDeniedException和AuthenticationException两大请求，并最终转发至cas服务端登录界面

2. ExceptionTranslationFilter的搭档是FilterSecurityInterceptor，其介绍可查看>>>Springboot security cas源码陶冶-FilterSecurityInterceptor

3. Note：CasAuthenticationEntryPoint在配置service回调地址时，不可为应用的登录请求地址，不然会提前被CasAuthenticationFilter拦截直接输出错误至页面了