CAS单点登录实践（spring cas client配置）

前言：

　　最近的项目需要将多个站点统一登录，查阅了资料Jasig cas（Central Authentication Service）（官方站点：http://www.jasig.org/cas）使用的比较多。

项目情况：

　　开发语言：JAVA

　　框架：spring

　　容器：tomcat7

　　JDK: 1.7

　　部署方式：docker

目标：

　　实现OMS、BMS、UMS、VOD、Live多站点切换期间只有第一次访问的站点需要登录，登录后调转的其他站点不需要在登录。

过程：

　　在配置前需要开启tomcat的TLS功能，服务器端和客户端都要开启。（切记要讲证书导入jre中，遇到 IO.Exception时，可以将cacerts文件删除）。网上有些教程为了简化操作，使用了http，没有使用https。但是在http协议下，第一个站点登录后，第一次跳转到其他站点还是需要再次登录的。可以先用http搭建简单的cas服务器，单个网站可以调转过来后，再启用https。毕竟登录一次，到处访问才是我们用cas的目的。

1、cas服务器端，参考站点《http://www.cnblogs.com/vhua/p/cas_1.html》

　　1.1 解压下载的 cas-server-4.0.0-release.zip 压缩包

　　1.2 找到 X:\cas-server-4.0.0\modules\cas-server-webapp-4.0.0.war 文件

　　1.3解压到 tomcat-cas\webapps\ 下

　　

2、客户端站点配置：

　　2.1 修改web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5">
  <listener>
    <listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
  </listener>
  <display-name>vod_console</display-name>
  <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
  </listener>
  <context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>
            classpath:config/spring-mybatis.xml,classpath:config/spring-cas.xml
    </param-value>
    <!-- classpath:config/spring-security.xml -->
  </context-param>
  <context-param>
    <param-name>webAppRootKey</param-name>
    <param-value>vod_console.root</param-value>
  </context-param>
  <context-param>
        <param-name>spring.profiles.active</param-name>
        <param-value>dev</param-value>
    </context-param>
    <context-param>
        <param-name>spring.profiles.default</param-name>
        <param-value>dev</param-value>
    </context-param>
    <context-param>
        <param-name>spring.liveBeansView.mbeanDomain</param-name>
        <param-value>dev</param-value>
    </context-param>
    <!-- 一定要在cas的前面 -->
    <filter>
    <filter-name>SetCharacterEncoding</filter-name>
    <filter-class>
            org.springframework.web.filter.CharacterEncodingFilter
        </filter-class>
    <init-param>
      <param-name>encoding</param-name>
      <param-value>UTF-8</param-value>
    </init-param>
  </filter>
  <filter-mapping>
    <filter-name>SetCharacterEncoding</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

     <!--  单点登录开始  -->
 <filter>
       <filter-name>CAS Single Sign Out Filter</filter-name>
       <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
    </filter>

    <filter-mapping>
       <filter-name>CAS Single Sign Out Filter</filter-name>
       <url-pattern>/*</url-pattern>
    </filter-mapping>

 <!-- filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping -->
    <listener>
        <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
    </listener>
    <!--  单点登录结束  -->

  <filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>
  <servlet>
    <servlet-name>spring</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>classpath:config/spring-mvc.xml</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
  </servlet>
  <servlet-mapping>
    <servlet-name>spring</servlet-name>
    <url-pattern>/</url-pattern>
  </servlet-mapping>
  <error-page>
    <error-code>403</error-code>
    <location>/403</location>
  </error-page>
  <error-page>
    <error-code>404</error-code>
    <location>/404</location>
  </error-page>
  <error-page>
    <error-code>500</error-code>
    <location>/500</location>
  </error-page>
  <listener>
    <listener-class>com.guttv.common.utils.ParamLoaderListener</listener-class>
  </listener>
</web-app>

　　注意：原来spring的字符过滤器，一定要在cas的过滤器后面，否则提交数据会出现中文乱码。这里参考了“next_door_body”的文章，《http://www.cnblogs.com/next-door-boy/p/3361328.html》，这里感谢next_door_body。

　　2.2 创建spring-cas.xml文件，这个是参考了网站《https://wiki.jasig.org/display/casc/using+the+cas+client+3.1+with+spring+security》

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:sec="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">

    <bean id="propertyConfigurer2"
        class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
        <property name="order" value="2" />
        <property name="ignoreUnresolvablePlaceholders" value="true" />
        <property name="locations">
            <list>
                <value>classpath:config/jdbc.properties</value>
                <value>classpath:config/cas.properties</value>
            </list>
        </property>
    </bean>
    <bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy">
        <sec:filter-chain-map path-type="ant">
            <sec:filter-chain pattern="/"
                filters="casValidationFilter, wrappingFilter" />
            <sec:filter-chain pattern="/guttv" filters="casValidationFilter" />
            <sec:filter-chain pattern="/j_spring_security_logout"
                filters="logoutFilter,etf,fsi" />
            <sec:filter-chain pattern="/**"
                filters="casAuthenticationFilter, casValidationFilter, wrappingFilter, sif,j2eePreAuthFilter,logoutFilter,etf,fsi" />
        </sec:filter-chain-map>
    </bean>

    <bean id="sif"
        class="org.springframework.security.web.context.SecurityContextPersistenceFilter" />

    <sec:authentication-manager alias="authenticationManager">
        <sec:authentication-provider ref="preAuthAuthProvider" />
    </sec:authentication-manager>

    <bean id="preAuthAuthProvider"
        class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
        <property name="preAuthenticatedUserDetailsService">
            <bean id="userDetailsServiceWrapper"
                class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
                <property name="userDetailsService" ref="userService" />
            </bean>
        </property>
    </bean>

    <bean id="preAuthEntryPoint"
        class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" />

    <bean id="j2eePreAuthFilter"
        class="org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter">
        <property name="authenticationManager" ref="authenticationManager" />
        <property name="authenticationDetailsSource">
            <bean
                class="org.springframework.security.web.authentication.WebAuthenticationDetailsSource" />
        </property>
    </bean>

    <bean id="logoutFilter"
        class="org.springframework.security.web.authentication.logout.LogoutFilter">
        <constructor-arg value="/" />
        <constructor-arg>
            <list>
                <bean
                    class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
            </list>
        </constructor-arg>
    </bean>

    <bean id="servletContext"
        class="org.springframework.web.context.support.ServletContextFactoryBean" />

    <bean id="etf"
        class="org.springframework.security.web.access.ExceptionTranslationFilter">
        <property name="authenticationEntryPoint" ref="preAuthEntryPoint" />
    </bean>

    <bean id="httpRequestAccessDecisionManager"
        class="org.springframework.security.access.vote.AffirmativeBased">
        <property name="allowIfAllAbstainDecisions" value="false" />
        <property name="decisionVoters">
            <list>
                <ref bean="roleVoter" />
            </list>
        </property>
    </bean>

    <bean id="fsi"
        class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
        <property name="authenticationManager" ref="authenticationManager" />
        <property name="accessDecisionManager" ref="httpRequestAccessDecisionManager" />
        <property name="securityMetadataSource">
            <sec:filter-invocation-definition-source>
                <sec:intercept-url pattern="/secure/extreme/**"
                    access="ROLE_SUPERVISOR" />
                <sec:intercept-url pattern="/combo/**" access="ROLE_USER" />
                <sec:intercept-url pattern="/**" access="ROLE_USER" />
            </sec:filter-invocation-definition-source>
        </property>
    </bean>

    <bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter" />

    <bean id="securityContextHolderAwareRequestFilter"
        class="org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter" />

    <bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator"
        id="ticketValidator">
        <constructor-arg index="0" value="${casServer}/cas" />
        <property name="proxyGrantingTicketStorage" ref="proxyGrantingTicketStorage" />
        <property name="proxyCallbackUrl"
            value="${vod.localServer}/${vod.project}/category/tree/listRoot" />

    </bean>

    <bean id="proxyGrantingTicketStorage"
        class="org.jasig.cas.client.proxy.ProxyGrantingTicketStorageImpl" />

    <sec:user-service id="userService">
        <sec:user name="lzj999" password="1234" authorities="ROLE_SUPERVISOR,ROLE_USER" />
        <sec:user name="dianne" password="dianne" authorities="ROLE_USER" />
        <sec:user name="lzj" password="1234" authorities="ROLE_USER" />
    </sec:user-service>

    <bean id="casAuthenticationFilter"
        class="org.jasig.cas.client.authentication.AuthenticationFilter">
        <property name="casServerLoginUrl" value="${casServer}/cas/login" />
        <property name="serverName" value="${vod.localServer}" />
    </bean>

    <bean id="casValidationFilter"
        class="org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter">
        <property name="serverName" value="${vod.localServer}" />
        <property name="exceptionOnValidationFailure" value="true" />
        <property name="proxyGrantingTicketStorage" ref="proxyGrantingTicketStorage" />
        <property name="redirectAfterValidation" value="true" />
        <property name="ticketValidator" ref="ticketValidator" />
        <property name="proxyReceptorUrl" value="/guttv" />
    </bean>

    <bean id="wrappingFilter"
        class="org.jasig.cas.client.util.HttpServletRequestWrapperFilter" />
</beans>

　　本文件中的相关参数都被提取到cas.properties文件中了，spring-cas.xml就比较通用了，参数也看得比较清晰。

casServer=https://dev.guttv.com:8443
oms.localServer = https://dev.guttv.com:9443
oms.project = oms_console
vod.localServer = https://dev.guttv.com:9443
vod.project = vod_console

2.3 登录用户名的获取：

　　

<%@ page import="org.jasig.cas.client.authentication.AttributePrincipal"%>

<%
    /*CasAuthenticationToken casAuthenticationToken = (CasAuthenticationToken) SecurityContextHolder
            .getContext().getAuthentication();
    AttributePrincipal principal = casAuthenticationToken
            .getAssertion().getPrincipal();
    request.setAttribute("username", principal.getName());
     */
    AttributePrincipal principal = (AttributePrincipal) request
            .getUserPrincipal();
    String username = principal.getName();
    request.setAttribute("username", username);
    String password = principal.getProxyTicketFor(username);
    request.setAttribute("pwd", password);
%>

<c:when test="${not empty username }">
                        <li class="dropdown"><a href="#" class="dropdown-toggle"
                            data-toggle="dropdown" role="button" aria-expanded="true">你好:${username }
                                <span class="caret"></span>
                        </a>
                            <ul class="dropdown-menu" role="menu">
                                <li><a href="${context }/user/person">个人信息</a></li>
                                <li class="divider"></li>
                                <li><a href="${context }/static/j_spring_security_logout">退出</a></li>
                            </ul></li>

                    </c:when>

org.jasig.cas.client.authentication.AttributePrincipal在cas-client-core-3.2.1.jar包里，这个包是Jasig提供的。