SSO统一单独登录框架CAS

ゞ浴缸里的玫瑰 2022-03-20 04:22 545阅读 0赞

SSO单点登录是用户通过统一的认证后，访问其他应用不需要再次登录认证。

JA-SIG(CAS)  
CAS(Central Authentication Service 中心认证服务)是使分布的各个异构系统的认证功能集中在一起，通过公共的认证系统统一管理和验证用户的身份，在CAS系统认证后的用户获得一个凭证，使用此凭证可以访问与CAS集成的其他所有系统。

CAS认证流程  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70]  
CAS协议提供的接口，CAS-Server提供三个验证服务接口  
一、用户登录URL，形如：[https://sso.server.com/cas/servlet/login][https_sso.server.com_cas_servlet_login]  
用户登录时的页面  
二、用户凭证校验URL，形如：[http://sso.server.com/cas/servlet/validate][http_sso.server.com_cas_servlet_validate]  
验证凭证token的链接  
三、用户登出URL，形如：[https://sso.server.com/cas/servlet/logout][https_sso.server.com_cas_servlet_logout]  
用户退出时的链接

CAS集成步骤：

资源下载：[https://pan.baidu.com/s/18WY3\_mZXCE23DkNpn38HqQ][https_pan.baidu.com_s_18WY3_mZXCE23DkNpn38HqQ]

一、配置Window域名解析  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 1]  
编辑hosts文件，添加

127.0.0.1 [sso.server.com][]  
127.0.0.1 [sso.client1.com][]  
127.0.0.1 [sso.client2.com][]

## 一、配置安全证书 ##

用JDK自带的keytool工具生成证书

以管理员身份开启CMD窗口

keytool -genkey -alias ssodemo -keyalg RSA -keysize 1024 -keypass 123456 -validity 365 -keystore d:\\test\\ssokey -storepass 123456  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 2]  
使用Keytool导出证书文件  
keytool -export -alias ssodemo -keystore d:\\test\\ssokey -file d:\\test\\ssokey.crt -storepass 123456

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 3]

导入证书d:/test/ssokey.crt到JDK的受信任证书库中

keytool -import -keystore “%JAVA\_HOME%”\\jre\\lib\\security\\cacerts -file d:\\test\\ssokey.crt -alias sso

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 4]

JDK的证书库密码是changeit

## 二、配置Tomcat支持HTTPS协议 ##

修改%TOMCAT\_HOME%/conf/server.xml

## 三、部署CAS认证服务器 ##

解压下载的软件，存在一个cas.war文件,将其复制到webapps目录下。启动Tomcat访问https://sso.server.com:8443/cas  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 5]  
服务器端系统部署完成，缺少对数据库用户认证的支持，后面补充如何配置数据库用户认证。

## 四、配置客户端 ##

另行解压一个Tomcat，修改其端口为18080，18009，18005。

<?xml version='1.0' encoding='utf-8'?>
    
    
    <Server port="18005" shutdown="SHUTDOWN">
      <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
      
      
      <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
      
      <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
      <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
      <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
    
      
      <GlobalNamingResources>
        
        <Resource name="UserDatabase" auth="Container"
                  type="org.apache.catalina.UserDatabase"
                  description="User database that can be updated and saved"
                  factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
                  pathname="conf/tomcat-users.xml" />
      </GlobalNamingResources>
    
      
      <Service name="Catalina">
    
        
        
    
    
        
        <Connector port="18080" protocol="HTTP/1.1"
                   connectionTimeout="20000"
                   redirectPort="18443" />
        
        
        
        
    
        
        <Connector port="18009" protocol="AJP/1.3" redirectPort="18443" />
    
    
        
    
        
        <Engine name="Catalina" defaultHost="localhost">
    
          
          
    
          
          <Realm className="org.apache.catalina.realm.LockOutRealm">
            
            <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
                   resourceName="UserDatabase"/>
          </Realm>
    
          <Host name="localhost"  appBase="webapps"
                unpackWARs="true" autoDeploy="true">
    
            
            
    
            
            <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                   prefix="localhost_access_log" suffix=".txt"
                   pattern="%h %l %u %t "%r" %s %b" />
    
          </Host>
        </Engine>
      </Service>
    </Server>

## 五、配置CAS认证集成 ##

将解压的二个Jar包，复制到Web应用的WEB-INF/lib目录下  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 6]  
修改Web.xml,添加CAS过滤器

<listener>
           <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
       </listener>
    
       <filter>
           <filter-name>CAS Single Sign Out Filter</filter-name>
           <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
       </filter>
       <filter-mapping>
           <filter-name>CAS Single Sign Out Filter</filter-name>
           <url-pattern>/*</url-pattern>
       </filter-mapping>
       <filter>
           <filter-name>CAS Filter</filter-name>
           <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
           <init-param>
               <param-name>casServerLoginUrl</param-name>
               <param-value>https://sso.server.com:8443/cas/login</param-value>
           </init-param>
           <init-param>
               <param-name>serverName</param-name>
               <param-value>http://sso.client1.com:18080</param-value>
           </init-param>
       </filter>
       <filter-mapping>
           <filter-name>CAS Filter</filter-name>
           <url-pattern>/*</url-pattern>
       </filter-mapping>
    
       <filter>
           <filter-name>CAS Validation Filter</filter-name>
           <filter-class>org.jasig.cas.client.validation.Cas10TicketValidationFilter</filter-class>
           <init-param>
               <param-name>casServerUrlPrefix</param-name>
               <param-value>https://sso.server.com:8443/cas</param-value>
           </init-param>
           <init-param>
               <param-name>serverName</param-name>
               <param-value>http://sso.client1.com:18080</param-value>
           </init-param>
       </filter>
       <filter-mapping>
           <filter-name>CAS Validation Filter</filter-name>
           <url-pattern>/*</url-pattern>
       </filter-mapping>
    
       <filter>
           <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
           <filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
       </filter>
       <filter-mapping>
           <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
           <url-pattern>/*</url-pattern>
       </filter-mapping>
    
       <filter>
           <filter-name>CAS Assertion Thread Local Filter</filter-name>
           <filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class>
       </filter>
       <filter-mapping>
           <filter-name>CAS Assertion Thread Local Filter</filter-name>
           <url-pattern>/*</url-pattern>
       </filter-mapping>

启动Tomcat，测试单点登录  
当访问 http://sso.client1.com:18080时自动跳转到CAS认证服务  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 7]  
输入用户名／密码　casuser/Mellon后自动跳转到http://sso.client1.com:18080  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 8]

六、集成数据库用户认证  
复制下载的三个Jar包到cas.war部署后的WEB-INF/lib目录下  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 9]  
修改WEB-INF/deployerConfigContext.xml  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 10]

修改：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 11]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 12]

<?xml version="1.0" encoding="UTF-8"?>
    
    
    
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xmlns:p="http://www.springframework.org/schema/p"
           xmlns:c="http://www.springframework.org/schema/c"
           xmlns:tx="http://www.springframework.org/schema/tx"
           xmlns:util="http://www.springframework.org/schema/util"
           xmlns:sec="http://www.springframework.org/schema/security"
           xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
           http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.2.xsd
           http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">
    
        
        <bean id="authenticationManager" class="org.jasig.cas.authentication.PolicyBasedAuthenticationManager">
            <constructor-arg>
                <map>
                    
                    <entry key-ref="proxyAuthenticationHandler" value-ref="proxyPrincipalResolver" />
    				
    				
    				<entry key-ref="dbAuthHandler" value-ref="primaryPrincipalResolver"/>
                </map>
            </constructor-arg>
    
            
    
            
            <property name="authenticationPolicy">
                <bean class="org.jasig.cas.authentication.AnyAuthenticationPolicy" />
            </property>
        </bean>
    
        
        <bean id="proxyAuthenticationHandler"
              class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler"
              p:httpClient-ref="httpClient" />
    
        
        <bean id="primaryAuthenticationHandler"
              class="org.jasig.cas.authentication.AcceptUsersAuthenticationHandler">
            <property name="users">
                <map>
                    <entry key="casuser" value="Mellon"/>
                </map>
            </property>
        </bean>
    
        
        <bean id="proxyPrincipalResolver"
              class="org.jasig.cas.authentication.principal.BasicPrincipalResolver" />
    
        
        <bean id="primaryPrincipalResolver"
              class="org.jasig.cas.authentication.principal.PersonDirectoryPrincipalResolver" >
            <property name="attributeRepository" ref="attributeRepository" />
        </bean>
    
        
        <bean id="attributeRepository" class="org.jasig.services.persondir.support.StubPersonAttributeDao"
                p:backingMap-ref="attrRepoBackingMap" />
        
        <util:map id="attrRepoBackingMap">
            <entry key="uid" value="uid" />
            <entry key="eduPersonAffiliation" value="eduPersonAffiliation" /> 
            <entry key="groupMembership" value="groupMembership" />
        </util:map>
    
        
        <bean id="serviceRegistryDao" class="org.jasig.cas.services.InMemoryServiceRegistryDaoImpl"
                p:registeredServices-ref="registeredServicesList" />
    
        <util:list id="registeredServicesList">
            <bean class="org.jasig.cas.services.RegexRegisteredService"
                  p:id="0" p:name="HTTP and IMAP" p:description="Allows HTTP(S) and IMAP(S) protocols"
                  p:serviceId="^(https?|imaps?)://.*" p:evaluationOrder="10000001" />
            
            
        </util:list>
        
        <bean id="auditTrailManager" class="com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager" />
        
        <bean id="healthCheckMonitor" class="org.jasig.cas.monitor.HealthCheckMonitor" p:monitors-ref="monitorsList" />
      
        <util:list id="monitorsList">
          <bean class="org.jasig.cas.monitor.MemoryMonitor" p:freeMemoryWarnThreshold="10" />
          
          <bean class="org.jasig.cas.monitor.SessionMonitor"
              p:ticketRegistry-ref="ticketRegistry"
              p:serviceTicketCountWarnThreshold="5000"
              p:sessionCountWarnThreshold="100000" />
        </util:list>
    
    	
    	<bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
    			<property name="driverClassName" value="com.mysql.jdbc.Driver" />
    			<property name="url" value="jdbc:mysql://localhost:3306/cas"/>
    			<property name="username" value="root" />
    			<property name="password" value="root" />
    	</bean>  
    	
    	<bean id="dbAuthHandler"
    			 class="org.jasig.cas.adaptors.jdbc.QueryDatabaseAuthenticationHandler"
    			 p:dataSource-ref="dataSource"
    			 p:sql="select password from t_user where loginid=?"/>
    
    </beans>

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70]: /images/20220320/542afe9070e24c819c9f3967692e5be7.png
[https_sso.server.com_cas_servlet_login]: https://sso.server.com/cas/servlet/login
[http_sso.server.com_cas_servlet_validate]: http://sso.server.com/cas/servlet/validate
[https_sso.server.com_cas_servlet_logout]: https://sso.server.com/cas/servlet/logout
[https_pan.baidu.com_s_18WY3_mZXCE23DkNpn38HqQ]: https://pan.baidu.com/s/18WY3_mZXCE23DkNpn38HqQ
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 1]: /images/20220320/6cfef735bdd54e358280328ecf0f6be8.png
[sso.server.com]: http://sso.server.com
[sso.client1.com]: http://sso.client1.com
[sso.client2.com]: http://sso.client2.com
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 2]: /images/20220320/fdfeda53e7004e29bd06066c82e5a154.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 3]: /images/20220320/5a3303b3a17a43bfb49b57e2a8409618.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 4]: /images/20220320/4e6ef710b99643d385f5ef29c8151499.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 5]: /images/20220320/01b9193f729b4db0862d84761150c876.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 6]: /images/20220320/f005c21bc6dd41ee8284f80ff1d3ec97.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 7]: /images/20220320/f5ca348fbd52488d8169a7ad833f3187.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 8]: /images/20220320/fddeccd903b845bca587e335a325c0f6.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 9]: /images/20220320/d2facb869a2f42d18e94389ceb47a936.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 10]: /images/20220320/ef8bca1ae98846ef8edfa45465038f27.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 11]: /images/20220320/ab4e1f9868b345ffb1a6d9d383765dec.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FpeGlhbmdfY2hlbg_size_16_color_FFFFFF_t_70 12]: /images/20220320/df9e309f8ef34e239c18ed8497933bde.png