CAS 5.3 集成 OAuth2.0 客户端简要解析

待我称王封你为后i 2022-05-11 08:10 665阅读 0赞

## 1 前言 ##

[CAS][]和 oauth2.0 不做介绍，自行查找资料。

在cas5 中，提供了集成第三方oauth登陆（如微信、qq等) 的方法，这些功能是基于 [Pac4j][] 包实现的。

有一些文章提供了配置方法，本文将对流程做一些补充和分析。

参考：[http://www.ibloger.net/article/3142.html][http_www.ibloger.net_article_3142.html]

## 2 流程 ##

基本流程图大致如下。一般会先在第三方网站得到appid app\_secrete 等信息，然后在客户端引导用户跳转到第三方网站登录（图中A 流程）。

这个网站一般长这样：

[https://api.weibo.com/oauth2/authorize?client\_id=2601122390&response\_type=code&redirect\_uri=https%3A%2F%2Fpassport.csdn.net%2Faccount%2Flogin%3Foauth\_provider%3DSinaWeiboProvider][https_api.weibo.com_oauth2_authorize_client_id_2601122390_response_type_code_redirect_uri_https_3A_2F_2Fpassport.csdn.net_2Faccount_2Flogin_3Foauth_provider_3DSinaWeiboProvider]

这个是微博的，可以看到里面有redirect\_uri 参数，当用户登录成功，会302到这里，并且携带 code 参数（流程B)

接下来分析cas-server 集成时都发生了什么。

![70][]

## 3 CAS-server配置 ##

读cas官方文档[链接][Link 1] 可知，需要引入相应依赖。cas已经做了github , google 等第三方登陆客户端集成。而对于自定义的OAuth2集成，需要在配置文件中使用字段，这些字段是数组形式，每个下标定义了一种 oauth2 client：

![70 1][]

Cas5 是使用springboot 构建的，配置文件被映射为 配置类

org.apereo.cas.configuration.CasConfigurationProperties

然后在@Configuration 文件中初始化所有的 oauth2 client 实例 核心代码如下：

@Configuration("pac4jAuthenticationEventExecutionPlanConfiguration")
    @EnableConfigurationProperties(CasConfigurationProperties.class)
    @Slf4j
    public class Pac4jAuthenticationEventExecutionPlanConfiguration implements AuditTrailRecordResolutionPlanConfigurer {
        @Autowired
        private CasConfigurationProperties casProperties;
    
       
        @Bean
        @ConditionalOnMissingBean(name = "pac4jDelegatedClientFactory")
        @RefreshScope
        public DelegatedClientFactory pac4jDelegatedClientFactory() {
            return new DelegatedClientFactory(casProperties.getAuthn().getPac4j());
        }
    
        @RefreshScope
        @Bean
        public Clients builtClients() {
            final Set<BaseClient> clients = pac4jDelegatedClientFactory().build();
            LOGGER.debug("The following clients are built: [{}]", clients);
            if (clients.isEmpty()) {
                LOGGER.warn("No delegated authentication clients are defined and/or configured");
            } else {
                LOGGER.info("Located and prepared [{}] delegated authentication client(s)", clients.size());
            }
            return new Clients(casProperties.getServer().getLoginUrl(), new ArrayList<>(clients));
        }

配置了 DelegatedClientFactory ，然后使用这个Factory 生成了  Clients 实例，这个实例可以看作Client的容器，里面放置了所有的Client 以便后期查询和使用。

看看在Factory build 时，发生了什么：

/**
         * Build set of clients configured.
         *
         * @return the set
         */
        public Set<BaseClient> build() {
            final Set<BaseClient> clients = new LinkedHashSet<>();
    
            configureCasClient(clients);
            configureFacebookClient(clients);
            configureOidcClient(clients);
            configureOAuth20Client(clients);
            configureSamlClient(clients);
            configureTwitterClient(clients);
            configureDropboxClient(clients);
            configureFoursquareClient(clients);
            configureGithubClient(clients);
            configureGoogleClient(clients);
            configureWindowsLiveClient(clients);
            configureYahooClient(clients);
            configureLinkedInClient(clients);
            configurePaypalClient(clients);
            configureWordpressClient(clients);
            configureBitbucketClient(clients);
            configureOrcidClient(clients);
    
            return clients;
        }

其中关于自定义auth2 的方法：

/**
         * Configure o auth 20 client.
         *
         * @param properties the properties
         */
        protected void configureOAuth20Client(final Collection<BaseClient> properties) {
            final AtomicInteger index = new AtomicInteger();
            pac4jProperties.getOauth2()
                .stream()
                .filter(oauth -> StringUtils.isNotBlank(oauth.getId()) && StringUtils.isNotBlank(oauth.getSecret()))
                .forEach(oauth -> {
                    final GenericOAuth20Client client = new GenericOAuth20Client();
                    client.setKey(oauth.getId());
                    client.setSecret(oauth.getSecret());
                    client.setProfileAttrs(oauth.getProfileAttrs());
                    client.setProfileNodePath(oauth.getProfilePath());
                    client.setProfileUrl(oauth.getProfileUrl());
                    client.setProfileVerb(Verb.valueOf(oauth.getProfileVerb().toUpperCase()));
                    client.setTokenUrl(oauth.getTokenUrl());
                    client.setAuthUrl(oauth.getAuthUrl());
                    client.setCustomParams(oauth.getCustomParams());
                    final int count = index.intValue();
                    if (StringUtils.isBlank(oauth.getClientName())) {
                        client.setName(client.getClass().getSimpleName() + count);
                    }
                    if (oauth.isUsePathBasedCallbackUrl()) {
                        client.setCallbackUrlResolver(new PathParameterCallbackUrlResolver());
                    }
                    configureClient(client, oauth);
    
                    index.incrementAndGet();
                    LOGGER.debug("Created client [{}]", client);
                    properties.add(client);
                });
        }
    
    /**
         * Sets client name.
         *
         * @param client the client
         * @param props  the props
         */
        protected void configureClient(final BaseClient client, final Pac4jBaseClientProperties props) {
            if (StringUtils.isNotBlank(props.getClientName())) {
                client.setName(props.getClientName());
            }
            client.getCustomProperties().put("autoRedirect", props.isAutoRedirect());
        }

可以看到， 就是把已实现的client （google facebook）和其他类型的都注册为client。我们关心的Oauth2 的注册过程也很明显。

其中需要注意的是， client.setName ，是设置client的名称，使用的实现类为GenericOAuth20Client 。  这个类和Clients 都是pac4j提供。

## 4 OAuth2 Redirect回调 ##

接下来分析在流程B中发生了什么。

在CAS中使用SpringWebFlow 控制web流程，回调入口在DelegatedClientAuthenticationAction 中定义。

执行doExecute ，其中的逻辑为：

1先从request中得到ClientName,

2 findDelegatedClientByName   按照链接中的clientName 找到对应的Client

3 尝试用这个 Client.getCredentials  得到凭据

4 如果获取成功，则认证成功。

5  establishDelegatedAuthenticationSession 中将回调的Credentials 包装为ClientCredential ,建立认证上下文。

那么核心代码就在Client .getCredentials 方法中。Client 的具体实现类很多，自定义OAuth2使用的是

GenericOAuth20Client 。

@Override
        public Event doExecute(final RequestContext context) {
            final HttpServletRequest request = WebUtils.getHttpServletRequestFromExternalWebflowContext(context);
            final HttpServletResponse response = WebUtils.getHttpServletResponseFromExternalWebflowContext(context);
    
            final String clientName = request.getParameter(Pac4jConstants.DEFAULT_CLIENT_NAME_PARAMETER);
            LOGGER.debug("Delegated authentication is handled by client name [{}]", clientName);
            if (hasDelegationRequestFailed(request, response.getStatus()).isPresent()) {
                throw new IllegalArgumentException("Delegated authentication has failed with client " + clientName);
            }
    
            final J2EContext webContext = Pac4jUtils.getPac4jJ2EContext(request, response);
            if (StringUtils.isNotBlank(clientName)) {
                final Service service = restoreAuthenticationRequestInContext(context, webContext, clientName);
                final BaseClient<Credentials, CommonProfile> client = findDelegatedClientByName(request, clientName, service);
    
                final Credentials credentials;
                try {
                    credentials = client.getCredentials(webContext);
                    LOGGER.debug("Retrieved credentials from client as [{}]", credentials);
                    if (credentials == null) {
                        throw new IllegalArgumentException("Unable to determine credentials from the context with client " + client.getName());
                    }
                } catch (final Exception e) {
                    LOGGER.info(e.getMessage(), e);
                    throw new IllegalArgumentException("Delegated authentication has failed with client " + client.getName());
                }
    
                try {
                    establishDelegatedAuthenticationSession(context, service, credentials, client);
                } catch (final AuthenticationException e) {
                    LOGGER.warn("Could not establish delegated authentication session [{}]. Routing to [{}]", e.getMessage(), CasWebflowConstants.TRANSITION_ID_AUTHENTICATION_FAILURE);
                    return new EventFactorySupport().event(this, CasWebflowConstants.TRANSITION_ID_AUTHENTICATION_FAILURE, new LocalAttributeMap<>(CasWebflowConstants.TRANSITION_ID_ERROR, e));
                }
                return super.doExecute(context);
            }
    
            prepareForLoginPage(context);
    
            if (response.getStatus() == HttpStatus.UNAUTHORIZED.value()) {
                return stopWebflow();
            }
            return error();
        }

## 5 GenericOAuth20Client ##

GenericOAuth20Client是paj4c 提供的类，

![70 2][]

继承的OAuth20Client 有代码： 设置了各种组件，包括凭据解析器，认证器等。。

protected void clientInit() {
            this.defaultRedirectActionBuilder(new OAuth20RedirectActionBuilder(this.configuration, this));
            this.defaultCredentialsExtractor(new OAuth20CredentialsExtractor(this.configuration, this));
            this.defaultAuthenticator(new OAuth20Authenticator(this.configuration, this));
            this.defaultProfileCreator(new OAuth20ProfileCreator(this.configuration, this));
        }

其getCredentials方法为：可知，先初始化，然后 尝试解析凭据。

解析凭据时，先拿到凭据，然后authenticator 进行验证。

解析凭据使用的是 OAuth20CredentialsExtractor 而验证时使用  OAuth20Authenticator

public final C getCredentials(WebContext context) {
            this.init();
            C credentials = this.retrieveCredentials(context);
            if (credentials == null) {
                context.getSessionStore().set(context, this.getName() + "$attemptedAuthentication", "true");
            } else {
                this.cleanAttemptedAuthentication(context);
            }
    
            return credentials;
        }
    
    protected C retrieveCredentials(WebContext context) {
            try {
                C credentials = this.credentialsExtractor.extract(context);
                if (credentials == null) {
                    return null;
                } else {
                    long t0 = System.currentTimeMillis();
                    boolean var12 = false;
    
                    try {
                        var12 = true;
                        this.authenticator.validate(credentials, context);
                        var12 = false;
                    } finally {
                        if (var12) {
                            long t1 = System.currentTimeMillis();
                            this.logger.debug("Credentials validation took: {} ms", t1 - t0);
                        }
                    }
    
                    long t1 = System.currentTimeMillis();
                    this.logger.debug("Credentials validation took: {} ms", t1 - t0);
                    return credentials;
                }
            } catch (CredentialsException var14) {
                this.logger.info("Failed to retrieve or validate credentials: {}", var14.getMessage());
                this.logger.debug("Failed to retrieve or validate credentials", var14);
                return null;
            }
        }

## 6 凭据解析和验证 ##

在解析时，发现回调里面的code，放入Cridential 里面

protected OAuth20Credentials getOAuthCredentials(WebContext context) {
            String stateParameter;
            String message;
            if (((OAuth20Configuration)this.configuration).isWithState()) {
                stateParameter = context.getRequestParameter("state");
                if (!CommonHelper.isNotBlank(stateParameter)) {
                    message = "Missing state parameter: session expired or possible threat of cross-site request forgery";
                    throw new OAuthCredentialsException("Missing state parameter: session expired or possible threat of cross-site request forgery");
                }
    
                message = ((OAuth20Configuration)this.configuration).getStateSessionAttributeName(this.client.getName());
                String sessionState = (String)context.getSessionStore().get(context, message);
                context.getSessionStore().set(context, message, (Object)null);
                this.logger.debug("sessionState: {} / stateParameter: {}", sessionState, stateParameter);
                if (!stateParameter.equals(sessionState)) {
                    String message = "State parameter mismatch: session expired or possible threat of cross-site request forgery";
                    throw new OAuthCredentialsException("State parameter mismatch: session expired or possible threat of cross-site request forgery");
                }
            }
    
            stateParameter = context.getRequestParameter("code");
            if (stateParameter != null) {
                message = OAuthEncoder.decode(stateParameter);
                this.logger.debug("code: {}", message);
                return new OAuth20Credentials(message);
            } else {
                message = "No credential found";
                throw new OAuthCredentialsException("No credential found");
            }
        }

# #

验证时：通过

((OAuth20Service)((OAuth20Configuration)this.configuration).buildService(context, this.client, (String)null)).getAccessToken(code);

使用code 拿到accessToken，并设置在Cridential里面。

protected void retrieveAccessToken(WebContext context, OAuthCredentials credentials) {
            OAuth20Credentials oAuth20Credentials = (OAuth20Credentials)credentials;
            String code = oAuth20Credentials.getCode();
            this.logger.debug("code: {}", code);
    
            OAuth2AccessToken accessToken;
            try {
                accessToken = ((OAuth20Service)((OAuth20Configuration)this.configuration).buildService(context, this.client, (String)null)).getAccessToken(code);
            } catch (InterruptedException | ExecutionException | IOException var7) {
                throw new HttpCommunicationException("Error getting token:" + var7.getMessage());
            }
    
            this.logger.debug("accessToken: {}", accessToken);
            oAuth20Credentials.setAccessToken(accessToken);
        }

如果流程都成功，则拿到accessToken 验证成功。

注意：这里返回的Cridentials 实现类是OAuth20Credentials ，在cas 中会转化为 ClientCredential

就可以自己实现CAS 的   AuthenticationHandler 接口，在里面拿到AccessToken ,，然后获取用户信息并实现业务了。推荐继承 AbstractPac4jAuthenticationHandler 进行自定义。

貌似CAS 里面这一步也做了部分工作，在配置文件中可以写，能得到userProfile 。

cas.authn.pac4j.oauth2[1].authUrl=https://open.weixin.qq.com/connect/qrconnect
    cas.authn.pac4j.oauth2[1].tokenUrl=https://api.weixin.qq.com/sns/oauth2/access_token
    cas.authn.pac4j.oauth2[1].profileUrl=https://api.weixin.qq.com/sns/userinfo
    cas.authn.pac4j.oauth2[1].clientName=WeChat

[CAS]: https://github.com/apereo/cas/tree/5.3.x
[Pac4j]: https://github.com/pac4j/pac4j
[http_www.ibloger.net_article_3142.html]: http://www.ibloger.net/article/3142.html
[https_api.weibo.com_oauth2_authorize_client_id_2601122390_response_type_code_redirect_uri_https_3A_2F_2Fpassport.csdn.net_2Faccount_2Flogin_3Foauth_provider_3DSinaWeiboProvider]: https://api.weibo.com/oauth2/authorize?client_id=2601122390&response_type=code&redirect_uri=https%3A%2F%2Fpassport.csdn.net%2Faccount%2Flogin%3Foauth_provider%3DSinaWeiboProvider
[70]: /images/20220511/687d82197521426790692c7c5e1d2229.png
[Link 1]: https://apereo.github.io/cas/5.3.x/integration/Delegate-Authentication.html
[70 1]: /images/20220511/eb82fa912e9244d2ac60d67ea8ba5021.png
[70 2]: /images/20220511/46b6af5980ba4a5fa79f1e0b89f57fe8.png