比如写如下的配置文：
<filter-mapping>
<filter-name>AdminFilter</filter-name>
<url-pattern>/admin/*</url-pattern>
</filter-mapping>
那么admin目录下所有的文件都将在访问前被过滤器拦截，包括login.jsp。
我们可以自己在 Filter 里用正则表达式进行二次过滤，过滤的正则表达式可以通过：
|
1 2 3 4 5 6 7 8 |
<filter> <filter-name>LoginFilter</filter-name> <filter-class>com.test.LoginFilter</filter-class> <init-param> <param-name>UrlRegx</param-name> <param-value><!--你的正则表达式--></param-value> </init-param> </filter> |
1.修改deployerConfigContext.xml文件
2.修改casServiceValidationSuccess.jsp文件
3.最后修改client端的web.xml文件:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 |
<!-- ======================== 单点登录开始 ======================== --> <!-- 用于单点退出，该过滤器用于实现单点登出功能，可选配置 --> <listener> <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class> </listener> <filter> <filter-name>CAS Single Sign Out Filter</filter-name> <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class> </filter> <filter-mapping> <filter-name>CAS Single Sign Out Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <filter> <filter-name>CAS Filter</filter-name> <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class> <init-param> <param-name>casServerLoginUrl</param-name> <param-value>http://localhost:8080/cas</param-value> </init-param> <init-param> <param-name>serverName</param-name> <param-value>http://localhost:8080</param-value> </init-param> </filter> <filter-mapping> <filter-name>CAS Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 该过滤器负责对Ticket的校验工作，必须启用它 --> <filter> <filter-name>CAS Validation Filter</filter-name> <filter-class> org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter </filter-class> <init-param> <param-name>casServerUrlPrefix</param-name> <param-value>http://localhost:8080/cas</param-value> </init-param> <init-param> <param-name>serverName</param-name> <param-value>http://localhost:8080</param-value> </init-param> <init-param> <param-name>encoding</param-name> <param-value>UTF-8</param-value> </init-param> </filter> <filter-mapping> <filter-name>CAS Validation Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 该过滤器负责实现HttpServletRequest请求的包裹， --> <!-- 比如允许开发者通过HttpServletRequest的getRemoteUser()方法获得SSO登录用户的登录名，可选配置。 --> <filter> <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> <filter-class> org.jasig.cas.client.util.HttpServletRequestWrapperFilter </filter-class> </filter> <filter-mapping> <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 该过滤器使得开发者可以通过org.jasig.cas.client.util.AssertionHolder来获取用户的登录名。 --> <!-- 比如AssertionHolder.getAssertion().getPrincipal().getName()。根据客户端获取的方式可以选择使用这两种 --> <!-- <filter> <filter-name>CAS Assertion Thread Local Filter</filter-name> <filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class> </filter> <filter-mapping> <filter-name>CAS Assertion Thread Local Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> --> <!-- ======================== 单点登录结束 ======================== --> |
4.可以用以下jsp代码来验证是否成功获取用户的更多信息:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
<% out.write("request.getUserPrincipal()="+request.getUserPrincipal()); %> <br/><br/> <% //HttpServletRequest request = ServletActionContext.getRequest(); /*获取单点登录服务器传递过来的用户信息*/ AttributePrincipal principal = (AttributePrincipal) request.getUserPrincipal(); if (principal!=null) { out.write("principal不为空..."); Map<String, Object> attributes = principal.getAttributes(); for (String key : attributes.keySet()) { System.out.println(key+"="+attributes.get(key)); } }else{ out.write("principal为空..."); } %> |
1、修改WEB-INF\deployerConfigContext.xml，加入
|
1 |
p:requireSecure="false" |
即
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
<property name="authenticationHandlers"> <list> <!-- | This is the authentication handler that authenticates services by means of callback via SSL, thereby validating | a server side SSL certificate. +--> <bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler" p:httpClient-ref="httpClient" p:requireSecure="false"/> <!-- | This is the authentication handler declaration that every CAS deployer will need to change before deploying CAS | into production. The default SimpleTestUsernamePasswordAuthenticationHandler authenticates UsernamePasswordCredentials | where the username equals the password. You will need to replace this with an AuthenticationHandler that implements your | local authentication strategy. You might accomplish this by coding a new such handler and declaring | edu.someschool.its.cas.MySpecialHandler here, or you might use one of the handlers provided in the adaptors modules. +--> <bean class="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler" /> </list> </property> |
2、修改WEB-INF\spring-configuration\ticketGrantingTicketCookieGenerator.xml，修改p:cookieSecure=”false”
|
1 2 3 4 5 |
<bean id="ticketGrantingTicketCookieGenerator" class="org.jasig.cas.web.support.CookieRetrievingCookieGenerator" p:cookieSecure="false" p:cookieMaxAge="-1" p:cookieName="CASTGC" p:cookiePath="/cas" /> |
3、修改修改WEB-INF\spring-configuration\warnCookieGenerator.xml，修改p:cookieSecure=”false”
|
1 2 3 4 5 |
<bean id="warnCookieGenerator" class="org.jasig.cas.web.support.CookieRetrievingCookieGenerator" p:cookieSecure="false" p:cookieMaxAge="-1" p:cookieName="CASPRIVACY" p:cookiePath="/cas" /> |
经过以上三步，cas server端修改完毕
打开deployerConfigContext.xml
|
1 2 |
<bean id="attributeRepository" class="org.jasig.services.persondir.support.StubPersonAttributeDao" p:backingMap-ref="attrRepoBackingMap" /> |
将以上代码替换成以下代码:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
<bean id="attributeRepository" class="org.jasig.services.persondir.support.jdbc.SingleRowJdbcPersonAttributeDao"> <!-- 指定使用的数据源，此处dataSource是已配置好的数据源 --> <constructor-arg index="0" ref="dataSource" /> <!-- 从数据库中查询信息的SQL语句，通常只需要修改表名即可 --> <constructor-arg index="1" value="select * fromuserinfo where {0}" /> <property name="queryAttributeMapping"> <map> <!-- 上述查询的参数，将userName替换为表中表示用户名的字段名称 --> <entry key="username" value="userName" /> </map> </property> <property name="resultAttributeMapping"> <map> <!-- 需要返回给Web应用的其它信息，多个信息时可继续增加entry节点 --> <!--key值为数据表中的字段名称，value值为Client端取值时的名称标识 --> <entry key="address" value="address" /> </map> </property> </bean> |
接着在这个文件最后的 bean class=”org.jasig.cas.services.RegexRegisteredService” 标签内加上 p:ignoreAttributes=”true”
配置环境:
JDK 1.6 + TOMCAT 6
Yale CAS Server3.5.2 + Client3.2.1
工作准备:
到 http://www.jasig.org/cas 中下载对应版本的 服务器端cas-server-3.5.2-release.zip 和 客户端cas-client-3.2.1-release.zip
一、尝试运行CAS服务器端
解压cas-server-3.5.2-release.zip, 在里面的moudles文件夹里有个cas-server-webapp-3.5.2.war文件, 这个就是服务器的所有文件, 解压, 设置tomcat的server.xml把该文件夹添加对应的虚拟目录, 我们以 http://localhost:8080/cas 为例，登录 http://localhost:8080/cas 后你们可以看到登录界面，便于测试，CAS默认输入相同的账号跟密码即可通过登录验证。
二、配置CAS服务端，使其读取mysql数据库对应的数据进行登录判断
打开CAS的/WEB-INF/deployerConfigContext.xml，找到以下代码并注释掉，取消掉原来的用于测试的简单验证
|
1 |
<bean class="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler" /> |
换成以下的验证方式
|
1 2 3 4 |
<bean class="org.jasig.cas.adaptors.jdbc.QueryDatabaseAuthenticationHandler"> <property name="dataSource" ref="dataSource" /> <property name="sql" value="SELECT password FROM account WHERE email=?" /> </bean> |
并配置对应的数据源（添加bean）：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
<!-- 配置数据源 --> <bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource"> <property name="driverClassName"> <value>com.mysql.jdbc.Driver</value> </property> <property name="url"> <value>jdbc:mysql://localhost:3306/sway_account?useUnicode=true&characterEncoding=utf-8</value> </property> <property name="username"> <value>root</value> </property> <property name="password"> <value></value> </property> </bean> |
三、配置CAS客户端
新建一个tomcat虚拟目录，我们以 http://localhost:8080/test 为例，并且确保里面有一个可访问的文件（我们这里以index.jsp为例），解压cas-client-3.2.1-release.zip，在里面modules里面找到cas-client-core-3.2.1.jar以及commons-logging-1.1.jar文件，复制到 http://localhost:8080/test 项目里面的 WEB-INF/lib 文件夹里面，然后修改里面的web.xml文件，添加以下过滤器：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 |
<?xml version="1.0" encoding="UTF-8"?> <web-app id="WebApp_ID" version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"> <welcome-file-list> <welcome-file>index.jsp</welcome-file> </welcome-file-list> <listener> <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class> </listener> <!--该过滤器用于实现单点登出功能，可选配置。 --> <filter> <filter-name>CAS Single Sign Out Filter</filter-name> <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class> </filter> <filter-mapping> <filter-name>CAS Single Sign Out Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!--该过滤器负责用户的认证工作，必须启用它 --> <filter> <filter-name>CASFilter</filter-name> <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class> <init-param> <param-name>casServerLoginUrl</param-name> <param-value>http://localhost:8080/cas/login</param-value> <!--这里的server是服务端的IP --> </init-param> <init-param> <param-name>serverName</param-name> <param-value>http://localhost:8080/</param-value> </init-param> </filter> <filter-mapping> <filter-name>CASFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 该过滤器负责对Ticket的校验工作，必须启用它 --> <!-- ValidationFilter 这个filter负责对请求参数ticket进行验证(ticket参数是负责子系统与CAS进行验证交互的凭证)casServerUrlPrefix:CAS服务访问地址serverName:当前应用所在的主机名 --> <filter> <filter-name>CAS Validation Filter</filter-name> <filter-class> org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter </filter-class> <init-param> <param-name>casServerUrlPrefix</param-name> <param-value>http://localhost:8080/cas</param-value> </init-param> <init-param> <param-name>serverName</param-name> <param-value>http://localhost:8080/</param-value> </init-param> </filter> <filter-mapping> <filter-name>CAS Validation Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 3.(可选)HttpServletRequestWrapperFilter 这个是HttpServletRequet的包裹类，让他支持getUserPrincipal，getRemoteUser方法来取得用户信息 --> <!-- 该过滤器负责实现HttpServletRequest请求的包裹，比如允许开发者通过HttpServletRequest的getRemoteUser()方法获得SSO登录用户的登 --> <filter> <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> <filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class> </filter> <filter-mapping> <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 4.(可选)AssertionThreadLocalFilter 这个类把Assertion信息放在ThreadLocal变量中，这样应用程序不在web层也能够获取到当前登录信息 Assertion assersion =AssertionHolder.getAssertion(); --> <!--该过滤器使得开发者可以通过org.jasig.cas.client.util.AssertionHolder来获取用户的登录名。比如AssertionHolder.getAssertion().getPrincipal().getName()。--> <filter> <filter-name>CAS Assertion Thread Local Filter</filter-name> <filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class> </filter> <filter-mapping> <filter-name>CAS Assertion Thread Local Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> </web-app> |
四、读取更多的客户端信息
打开CAS的/WEB-INF/deployerConfigContext.xml，
找到bean id为attributeRepository的这个配置，修改为如下
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 |
<bean id="attributeRepository" class="org.jasig.services.persondir.support.jdbc.SingleRowJdbcPersonAttributeDao"> <constructor-arg index="0" ref="dataSource" /> <constructor-arg index="1"> <value>select * from account where {0}</value> </constructor-arg> <!-- 组装sql用的查询条件属性 --> <property name="queryAttributeMapping"> <map> <entry key="username" value="email" /> <!-- <entry key="username" value="userAccount" /> --> </map> </property> <!-- 如果要组装多个查询条件，需要加上下面这个，默认为AND --> <!-- <property name="queryType"> <value>OR</value> </property> --> <!-- 要获取的属性在这里配置 --> <property name="resultAttributeMapping"> <map> <!--key为对应的数据库字段名称，value为提供给客户端获取的属性名字，系统会自动填充值 --> <entry key="id" value="id" /> <entry key="email" value="email" /> <entry key="emailValidated" value="emailValidated" /> <entry key="password" value="password" /> <entry key="registerTime" value="registerTime" /> <entry key="lastLoginTime" value="lastLoginTime" /> <entry key="balance" value="balance" /> </map> </property> </bean> |
修改该xml文件中最后一个默认的serviceRegistryDao bean，找到<bean class=”org.jasig.cas.services.RegexRegisteredService”>把高亮部分添加进去：
|
1 2 3 4 5 6 7 8 |
<bean class="org.jasig.cas.services.RegexRegisteredService"> <property name="id" value="0" /> <property name="name" value="HTTP and IMAP" /> <property name="description" value="Allows HTTP(S) and IMAP(S) protocols" /> <property name="serviceId" value="^(https?|imaps?)://.*" /> <property name="evaluationOrder" value="10000001" /> <property name="ignoreAttributes" value="true"/> </bean> |
最后修改WEB-INF\view\jsp\protocol\2.0\casServiceValidationSuccess.jsp文件
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 |
<%@page pageEncoding="UTF-8"%> <%@ page session="false" %> <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %> <%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn" %> <cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'> <cas:authenticationSuccess> <cas:user>${fn:escapeXml(assertion.chainedAuthentications[fn:length(assertion.chainedAuthentications)-1].principal.id)}</cas:user> <c:if test="${not empty pgtIou}"> <cas:proxyGrantingTicket>${pgtIou}</cas:proxyGrantingTicket> </c:if> <c:if test="${fn:length(assertion.chainedAuthentications) > 1}"> <cas:proxies> <c:forEach var="proxy" items="${assertion.chainedAuthentications}" varStatus="loopStatus" begin="0" end="${fn:length(assertion.chainedAuthentications)-2}" step="1"> <cas:proxy>${fn:escapeXml(proxy.principal.id)}</cas:proxy> </c:forEach> </cas:proxies> </c:if> <!-- 在server验证成功后，这个页面负责生成与客户端交互的xml信息，在默认的casServiceValidationSuccess.jsp中，只包括用户名，并不提供其他的属性信息，因此需要对页面进行扩展 --> <c:if test="${fn:length(assertion.chainedAuthentications[fn:length(assertion.chainedAuthentications)-1].principal.attributes) > 0}"> <cas:attributes> <c:forEach var="attr" items="${assertion.chainedAuthentications[fn:length(assertion.chainedAuthentications)-1].principal.attributes}"> <cas:${fn:escapeXml(attr.key)}>${fn:escapeXml(attr.value)}</cas:${fn:escapeXml(attr.key)}> </c:forEach> </cas:attributes> </c:if> </cas:authenticationSuccess> </cas:serviceResponse> |
然后即可使用以下代码在index.jsp中获取对应的返回对象:
|
1 2 |
AttributePrincipal principal = (AttributePrincipal) request.getUserPrincipal(); Map<String, Object> attributes = principal.getAttributes(); |
以下是我用于测试的index.jsp
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 |
<%@ page language="java" import="java.util.*" contentType="text/html;charset=utf-8"%> <%@ page import="org.jasig.cas.client.authentication.AttributePrincipal,org.jasig.cas.client.validation.Assertion,org.jasig.cas.client.util.AbstractCasFilter"%> <% String path = request.getContextPath(); String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/"; %> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <base href="<%=basePath%>"> <title>CAS单点登录VS退出</title> </head> <body> <% AttributePrincipal principal = (AttributePrincipal) request.getUserPrincipal(); Map<String, Object> attributes = principal.getAttributes(); /*for(Map.Entry<String,Object> m: attributes.entrySet()){ System.out.println(m.getKey()+"---"+m.getValue()); }*/ %> [ 单点登录测试 ]<br /><br /> 用户名：<%=principal.getName()%><br /> id:<%=attributes.get("id")%><br /> email:<%=attributes.get("email")%><br /> emailValidated:<%=attributes.get("emailValidated")%><br /> password:<%=attributes.get("password")%><br /> registerTime:<%=attributes.get("registerTime")%><br /> lastLoginTime:<%=attributes.get("lastLoginTime")%><br /> balance:<%=attributes.get("balance")%><br /> <br /> <a href="http://localhost:8080/sway/cas/logout">退出</a><br /><br /> <hr/> <br /><br /> [ DEBUG ]<br /><br /> map中元素个数为<%=attributes.size()%> </body> </html> |
至此配置完毕，往后再教大家配置对应的SSL加密。
