SpringSecurity以及SSO

柔光的暖阳◎ 2022-11-19 01:14 250阅读 0赞

### 文章目录 ###

*   *   *  一、DelegatingFilterProxy
         *  二、SpringSecurity
         *  三、使用SpringSecurity集成CAS
         *   *   *  2、常用的几种鉴权方式：
                 *   *  1、MspCasAuthenticationFilter【服务之间调用】
                     *  2、PseudoCasAuthenticationFilter【服务间接口鉴权】
                     *  3、SystemSsoAuthenticationFilter【给第三方厂商用】
                     *  4、OAuth2ClientAuthenticationProcessingFilter【Oauth2.0认证 多节点服务，跳过网关和单点登录调用接口或前后端分离的项目】
                 *  3、SSO

### 一、DelegatingFilterProxy ###

*  提示：  
    DelegatingFilterProxy extends GenericFilterBean

GenericFilterBean implements Filter, BeanNameAware, EnvironmentAware,  
 EnvironmentCapable, ServletContextAware, InitializingBean, DisposableBean

GenericFilterBean 是 Servlet-api 中filter的子类 并且实现了 InitializingBean

![在这里插入图片描述][20210413215832521.png_pic_center]

*  GenericFilterBean

//这个是 GenericFilterBean 的内部方法 
        @Override
    	public void afterPropertiesSet() throws ServletException { 
    		initFilterBean();
    	}
        /** * 这个使用模板设计模式 交给子类实现 而 DelegatingFilterProxy 正是其子类 */
    	protected void initFilterBean() throws ServletException { 
    	}

*  DelegatingFilterProxy

@Override
    	protected void initFilterBean() throws ServletException { 
    		synchronized (this.delegateMonitor) { 
    			if (this.delegate == null) { 
    				// If no target bean name specified, use filter name.
    				if (this.targetBeanName == null) { 
                        //这个getFilterName 可以看一下下面的代码块
    					this.targetBeanName = getFilterName();
                        
    				}
    				// Fetch Spring root application context and initialize the delegate early,
    				// if possible. If the root application context will be started after this
    				// filter proxy, we'll have to resort to lazy initialization.
    				WebApplicationContext wac = findWebApplicationContext();
    				if (wac != null) { 
    					this.delegate = initDelegate(wac);
    				}
    			}
    		}
    	}
    
    	
    	protected Filter initDelegate(WebApplicationContext wac) throws ServletException { 
    		String targetBeanName = getTargetBeanName();
    		Assert.state(targetBeanName != null, "No target bean name set");
            //这个targetBeanName 的具体值 取决于使用的安全框架 我们这里说的是SpringSecurity 默认的配置是 springSecurityFilterChain
            //从Spring容器中 取出Filter的实现
    		Filter delegate = wac.getBean(targetBeanName, Filter.class);
    		if (isTargetFilterLifecycle()) { 
    			delegate.init(getFilterConfig());
    		}
    		return delegate;
    	}

@Override
    	public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
    			throws ServletException, IOException { 
    		//DCL来初始化delegate
    		// Lazily initialize the delegate if necessary.
    		Filter delegateToUse = this.delegate;
    		if (delegateToUse == null) { 
    			synchronized (this.delegateMonitor) { 
    				delegateToUse = this.delegate;
    				if (delegateToUse == null) { 
    					WebApplicationContext wac = findWebApplicationContext();
    					if (wac == null) { 
    						throw new IllegalStateException("No WebApplicationContext found: " +
    								"no ContextLoaderListener or DispatcherServlet registered?");
    					}
    					delegateToUse = initDelegate(wac);
    				}
    				this.delegate = delegateToUse;
    			}
    		}
    		//这个地方就是代理了 DelegatingFilterProxy 代理Filter ，Filter的实现类已经交给了Spring容器管理，通过 DelegatingFilterProxy 来将Filter产生关联。
    		// Let the delegate perform the actual doFilter operation.
    		invokeDelegate(delegateToUse, request, response, filterChain);
    	}

protected void invokeDelegate(
    		Filter delegate, ServletRequest request, ServletResponse response, FilterChain filterChain)
    		throws ServletException, IOException { 
    
    	delegate.doFilter(request, response, filterChain);
    }

// 这个getFilterName 的代码块
    	@Nullable
    	protected String getFilterName() { 
            //意思就是有配置从配置中取没有配置就用beanName
            //其实SpringSecurity就是用的BeanName 稍后我们贴代码
    		return (this.filterConfig != null ? this.filterConfig.getFilterName() : this.beanName);
    	}

到这我们只要理解  
DelegatingFilterProxy是 SpringWeb模块的一个代理，为了能够更好的解耦以便于集成非Spring Security的其他安全框架，并且将由Spring容器管理的Filter实现类给代理了。

### 二、SpringSecurity ###

1、 WebSecurityConfigurerAdapter  
我们通过自定义类来实现WebSecurityConfigurerAdapter 进行拓展 如： WebSecurityConfigurerImpl extends WebSecurityConfigurerAdapter。并 通过 @EnableWebSecurity 来启用SpringSecurity  
跟进该注解我们可以找到 WebSecurityConfiguration见下面代码块：

*  WebSecurityConfiguration

public static final String DEFAULT_FILTER_NAME = "springSecurityFilterChain";
    	
    	//注意这个地方使用@Bean注解注入了springSecurityFilterChain 这个bean 该Bean的实现类是FilterChainProxy
    	//这样 在一 中我们在Spring容器中获取springSecurityFilterChain这个bean的时候就得到了FilterChainProxy的实例。
    	@Bean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
    	public Filter springSecurityFilterChain() throws Exception { 
    		boolean hasConfigurers = this.webSecurityConfigurers != null && !this.webSecurityConfigurers.isEmpty();
    		boolean hasFilterChain = !this.securityFilterChains.isEmpty();
    		Assert.state(!(hasConfigurers && hasFilterChain),
    				"Found WebSecurityConfigurerAdapter as well as SecurityFilterChain. Please select just one.");
    		if (!hasConfigurers && !hasFilterChain) { 
    			WebSecurityConfigurerAdapter adapter = this.objectObjectPostProcessor
    					.postProcess(new WebSecurityConfigurerAdapter() { 
    					});
    			this.webSecurity.apply(adapter);
    		}
    		for (SecurityFilterChain securityFilterChain : this.securityFilterChains) { 
    			this.webSecurity.addSecurityFilterChainBuilder(() -> securityFilterChain);
    			for (Filter filter : securityFilterChain.getFilters()) { 
    				if (filter instanceof FilterSecurityInterceptor) { 
    					this.webSecurity.securityInterceptor((FilterSecurityInterceptor) filter);
    					break;
    				}
    			}
    		}
    		for (WebSecurityCustomizer customizer : this.webSecurityCustomizers) { 
    			customizer.customize(this.webSecurity);
    		}
    		return this.webSecurity.build();
    	}

*  FilterChainProxy

//和DelegatingFilterProxy一样 也是继承了GenericFilterBean FilterChainProxy extends GenericFilterBean
    	//从而FilterChainProxy 也是Filter的一个实现类 也就是其实就是一个Filter
    	//当DelegatingFilterProxy代理执行dofilter时就进入到下面
    	@Override
    	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
    			throws IOException, ServletException { 
    		boolean clearContext = request.getAttribute(FILTER_APPLIED) == null;
    		if (!clearContext) { 
    			doFilterInternal(request, response, chain);
    			return;
    		}
    		try { 
    			request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
                //调用内部的doFilterInternal 见下面
    			doFilterInternal(request, response, chain);
    		}
    		catch (RequestRejectedException ex) { 
    			this.requestRejectedHandler.handle((HttpServletRequest) request, (HttpServletResponse) response, ex);
    		}
    		finally { 
    			SecurityContextHolder.clearContext();
    			request.removeAttribute(FILTER_APPLIED);
    		}
    	}
    	//这个就是内部的 doFilterInternal
    	private void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain)
    			throws IOException, ServletException { 
    		FirewalledRequest firewallRequest = this.firewall.getFirewalledRequest((HttpServletRequest) request);
    		HttpServletResponse firewallResponse = this.firewall.getFirewalledResponse((HttpServletResponse) response);
    		List<Filter> filters = getFilters(firewallRequest);
    		if (filters == null || filters.size() == 0) { 
    			if (logger.isTraceEnabled()) { 
    				logger.trace(LogMessage.of(() -> "No security for " + requestLine(firewallRequest)));
    			}
    			firewallRequest.reset();
    			chain.doFilter(firewallRequest, firewallResponse);
    			return;
    		}
    		if (logger.isDebugEnabled()) { 
    			logger.debug(LogMessage.of(() -> "Securing " + requestLine(firewallRequest)));
    		}
            //创建内部的虚拟过滤器链
    		VirtualFilterChain virtualFilterChain = new VirtualFilterChain(firewallRequest, chain, filters);
    		virtualFilterChain.doFilter(firewallRequest, firewallResponse);
    	}
    	//内部虚拟过滤器链类定义
    	private static final class VirtualFilterChain implements FilterChain { 
    		//originalChain 就是Spring中非Springecurity的过滤器 故称作原始过滤器
    		private final FilterChain originalChain;
    		//附加过滤器 也就是SpringSecurity中的我们通过继承WebSecurityConfigurerAdapter添加的一堆过滤器
    		private final List<Filter> additionalFilters;
    
    		private final FirewalledRequest firewalledRequest;
    
    		private final int size;
    
    		private int currentPosition = 0;
    
    		private VirtualFilterChain(FirewalledRequest firewalledRequest, FilterChain chain,
    				List<Filter> additionalFilters) { 
    			this.originalChain = chain;
    			this.additionalFilters = additionalFilters;
    			this.size = additionalFilters.size();
    			this.firewalledRequest = firewalledRequest;
    		}
    
    		@Override
    		public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException { 
    			if (this.currentPosition == this.size) { 
    				if (logger.isDebugEnabled()) { 
    					logger.debug(LogMessage.of(() -> "Secured " + requestLine(this.firewalledRequest)));
    				}
    				// Deactivate path stripping as we exit the security filter chain
    				this.firewalledRequest.reset();
    				this.originalChain.doFilter(request, response);
    				return;
    			}
                //先执行SpringSecurity内部的过滤器执行一个+1 知道执行完也就是满足this.currentPosition == this.size 然后在去执行 originalChain
    			this.currentPosition++;
    			Filter nextFilter = this.additionalFilters.get(this.currentPosition - 1);
    			if (logger.isTraceEnabled()) { 
    				logger.trace(LogMessage.format("Invoking %s (%d/%d)", nextFilter.getClass().getSimpleName(),
    						this.currentPosition, this.size));
    			}
    			nextFilter.doFilter(request, response, this);
    		}
    
    	}

到这里基本就知道大致的流程了。

### 三、使用SpringSecurity集成CAS ###

在SpringSecurity中除了OAuth2AuthenticationProcessingFilter以外，剩下的过滤器都实现了AbstractAuthenticationProcessingFilter或则和通过实现AbstractAuthenticationProcessingFilter来进行拓展。

*  AbstractAuthenticationProcessingFilter

public abstract class AbstractAuthenticationProcessingFilter extends GenericFilterBean
    		implements ApplicationEventPublisherAware, MessageSourceAware { 
    
    	protected ApplicationEventPublisher eventPublisher;
    
    	protected AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource = new WebAuthenticationDetailsSource();
    
    	private AuthenticationManager authenticationManager;
    
    	protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
    
    	private RememberMeServices rememberMeServices = new NullRememberMeServices();
    
    	private RequestMatcher requiresAuthenticationRequestMatcher;
    
    	private boolean continueChainBeforeSuccessfulAuthentication = false;
    
    	private SessionAuthenticationStrategy sessionStrategy = new NullAuthenticatedSessionStrategy();
    
    	private boolean allowSessionCreation = true;
    
    	private AuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
    
    	private AuthenticationFailureHandler failureHandler = new SimpleUrlAuthenticationFailureHandler();
    
    	/** * @param defaultFilterProcessesUrl the default value for <tt>filterProcessesUrl</tt>. */
    	protected AbstractAuthenticationProcessingFilter(String defaultFilterProcessesUrl) { 
    		setFilterProcessesUrl(defaultFilterProcessesUrl);
    	}
    
    	/** * Creates a new instance * @param requiresAuthenticationRequestMatcher the {@link RequestMatcher} used to * determine if authentication is required. Cannot be null. */
    	protected AbstractAuthenticationProcessingFilter(RequestMatcher requiresAuthenticationRequestMatcher) { 
    		Assert.notNull(requiresAuthenticationRequestMatcher, "requiresAuthenticationRequestMatcher cannot be null");
    		this.requiresAuthenticationRequestMatcher = requiresAuthenticationRequestMatcher;
    	}
    
    	/** * Creates a new instance with a default filterProcessesUrl and an * {@link AuthenticationManager} * @param defaultFilterProcessesUrl the default value for <tt>filterProcessesUrl</tt>. * @param authenticationManager the {@link AuthenticationManager} used to authenticate * an {@link Authentication} object. Cannot be null. */
    	protected AbstractAuthenticationProcessingFilter(String defaultFilterProcessesUrl,
    			AuthenticationManager authenticationManager) { 
    		setFilterProcessesUrl(defaultFilterProcessesUrl);
    		setAuthenticationManager(authenticationManager);
    	}
    
    	/** * Creates a new instance with a {@link RequestMatcher} and an * {@link AuthenticationManager} * @param requiresAuthenticationRequestMatcher the {@link RequestMatcher} used to * determine if authentication is required. Cannot be null. * @param authenticationManager the {@link AuthenticationManager} used to authenticate * an {@link Authentication} object. Cannot be null. */
    	protected AbstractAuthenticationProcessingFilter(RequestMatcher requiresAuthenticationRequestMatcher,
    			AuthenticationManager authenticationManager) { 
    		setRequiresAuthenticationRequestMatcher(requiresAuthenticationRequestMatcher);
    		setAuthenticationManager(authenticationManager);
    	}
    
    	@Override
    	public void afterPropertiesSet() { 
    		Assert.notNull(this.authenticationManager, "authenticationManager must be specified");
    	}
    
    
    	@Override
    	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
    			throws IOException, ServletException { 
    		doFilter((HttpServletRequest) request, (HttpServletResponse) response, chain);
    	}
    
    	private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
    			throws IOException, ServletException { 
    		if (!requiresAuthentication(request, response)) { 
    			chain.doFilter(request, response);
    			return;
    		}
    		try { 
    			Authentication authenticationResult = attemptAuthentication(request, response);
    			if (authenticationResult == null) { 
    				// return immediately as subclass has indicated that it hasn't completed
    				return;
    			}
    			this.sessionStrategy.onAuthentication(authenticationResult, request, response);
    			// Authentication success
    			if (this.continueChainBeforeSuccessfulAuthentication) { 
    				chain.doFilter(request, response);
    			}
    			successfulAuthentication(request, response, chain, authenticationResult);
    		}
    		catch (InternalAuthenticationServiceException failed) { 
    			this.logger.error("An internal error occurred while trying to authenticate the user.", failed);
    			unsuccessfulAuthentication(request, response, failed);
    		}
    		catch (AuthenticationException ex) { 
    			// Authentication failed
    			unsuccessfulAuthentication(request, response, ex);
    		}
    	}
    
    
    	protected boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) { 
    		if (this.requiresAuthenticationRequestMatcher.matches(request)) { 
    			return true;
    		}
    		if (this.logger.isTraceEnabled()) { 
    			this.logger
    					.trace(LogMessage.format("Did not match request to %s", this.requiresAuthenticationRequestMatcher));
    		}
    		return false;
    	}
    
    	public abstract Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
    			throws AuthenticationException, IOException, ServletException;
    
    	protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
    			Authentication authResult) throws IOException, ServletException { 
    		SecurityContextHolder.getContext().setAuthentication(authResult);
    		if (this.logger.isDebugEnabled()) { 
    			this.logger.debug(LogMessage.format("Set SecurityContextHolder to %s", authResult));
    		}
    		this.rememberMeServices.loginSuccess(request, response, authResult);
    		if (this.eventPublisher != null) { 
    			this.eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(authResult, this.getClass()));
    		}
    		this.successHandler.onAuthenticationSuccess(request, response, authResult);
    	}
    
    	protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,
    			AuthenticationException failed) throws IOException, ServletException { 
    		SecurityContextHolder.clearContext();
    		this.logger.trace("Failed to process authentication request", failed);
    		this.logger.trace("Cleared SecurityContextHolder");
    		this.logger.trace("Handling authentication failure");
    		this.rememberMeServices.loginFail(request, response);
    		this.failureHandler.onAuthenticationFailure(request, response, failed);
    	}
    
    	protected AuthenticationManager getAuthenticationManager() { 
    		return this.authenticationManager;
    	}
    
    	public void setAuthenticationManager(AuthenticationManager authenticationManager) { 
    		this.authenticationManager = authenticationManager;
    	}
    
    	/** * Sets the URL that determines if authentication is required * @param filterProcessesUrl */
    	public void setFilterProcessesUrl(String filterProcessesUrl) { 
    		setRequiresAuthenticationRequestMatcher(new AntPathRequestMatcher(filterProcessesUrl));
    	}
    
    	public final void setRequiresAuthenticationRequestMatcher(RequestMatcher requestMatcher) { 
    		Assert.notNull(requestMatcher, "requestMatcher cannot be null");
    		this.requiresAuthenticationRequestMatcher = requestMatcher;
    	}
    
    	public RememberMeServices getRememberMeServices() { 
    		return this.rememberMeServices;
    	}
    
    	public void setRememberMeServices(RememberMeServices rememberMeServices) { 
    		Assert.notNull(rememberMeServices, "rememberMeServices cannot be null");
    		this.rememberMeServices = rememberMeServices;
    	}
    
    	/** * Indicates if the filter chain should be continued prior to delegation to * {@link #successfulAuthentication(HttpServletRequest, HttpServletResponse, FilterChain, Authentication)} * , which may be useful in certain environment (such as Tapestry applications). * Defaults to <code>false</code>. */
    	public void setContinueChainBeforeSuccessfulAuthentication(boolean continueChainBeforeSuccessfulAuthentication) { 
    		this.continueChainBeforeSuccessfulAuthentication = continueChainBeforeSuccessfulAuthentication;
    	}
    
    	@Override
    	public void setApplicationEventPublisher(ApplicationEventPublisher eventPublisher) { 
    		this.eventPublisher = eventPublisher;
    	}
    
    	public void setAuthenticationDetailsSource(
    			AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource) { 
    		Assert.notNull(authenticationDetailsSource, "AuthenticationDetailsSource required");
    		this.authenticationDetailsSource = authenticationDetailsSource;
    	}
    
    	@Override
    	public void setMessageSource(MessageSource messageSource) { 
    		this.messages = new MessageSourceAccessor(messageSource);
    	}
    
    	protected boolean getAllowSessionCreation() { 
    		return this.allowSessionCreation;
    	}
    
    	public void setAllowSessionCreation(boolean allowSessionCreation) { 
    		this.allowSessionCreation = allowSessionCreation;
    	}
    
    	/** * The session handling strategy which will be invoked immediately after an * authentication request is successfully processed by the * <tt>AuthenticationManager</tt>. Used, for example, to handle changing of the * session identifier to prevent session fixation attacks. * @param sessionStrategy the implementation to use. If not set a null implementation * is used. */
    	public void setSessionAuthenticationStrategy(SessionAuthenticationStrategy sessionStrategy) { 
    		this.sessionStrategy = sessionStrategy;
    	}
    
    	/** * Sets the strategy used to handle a successful authentication. By default a * {@link SavedRequestAwareAuthenticationSuccessHandler} is used. */
    	public void setAuthenticationSuccessHandler(AuthenticationSuccessHandler successHandler) { 
    		Assert.notNull(successHandler, "successHandler cannot be null");
    		this.successHandler = successHandler;
    	}
    
    	public void setAuthenticationFailureHandler(AuthenticationFailureHandler failureHandler) { 
    		Assert.notNull(failureHandler, "failureHandler cannot be null");
    		this.failureHandler = failureHandler;
    	}
    
    	protected AuthenticationSuccessHandler getSuccessHandler() { 
    		return this.successHandler;
    	}
    
    	protected AuthenticationFailureHandler getFailureHandler() { 
    		return this.failureHandler;
    	}
    
    }

> 总结下来其实就是：  
> 1、requiresAuthentication  
> 2、attemptAuthentication  
> 3、unsuccessfulAuthentication  
> 4、successfulAuthentication

执行过滤器attemptAuthentication方法会去调用this.getAuthenticationManager().authenticate(authRequest)，然后通过AuthenticationManager来进行授权，ProviderManager通过List管理AuthenticationProvider的认证实现类，所以如果我们想扩展就自定义类来实现AuthenticationProvider。

web应用初始化过程listener》filter》servlet 而Spring通过DelegatingFilterProxy代理了servlet 从而来管理filter的生命周期，DelegatingFilterProxy的实例在SpringSecurity下是FilterChainProxy，DelegatingFilterProxy在执行dofilet方法的时候会调用到FilterChainProxy的dofilter方法。然后执行FilterChainProxy内部的VirtualFilterChain的dofilter先执行additionalFilters，在执行originalChain。

##### 2、常用的几种鉴权方式： #####

###### 1、MspCasAuthenticationFilter【服务之间调用】 ######

通过MSP（微服务支撑平台）网关做单点认证过滤器，鉴权触发条件比如cookie中含有**userToken**，网关配置有token值，只要服务认定网关认证通过的请求，并且该类是MspCasAuthenticationToken及其子类则鉴权通过，直接放行。

###### 2、PseudoCasAuthenticationFilter【服务间接口鉴权】 ######

触发条件请求中含有 user、timestamp、authcode 且三者均不为空则进行鉴权，鉴权方式userId+timestamp+salt【balabala】做md5通过则放行。authcode两小时失效。

###### 3、SystemSsoAuthenticationFilter【给第三方厂商用】 ######

触发条件请求中含有appkey、systemId、authcode且都不为空，则进行鉴权，鉴权方式根据约定的加密算法使用特定的盐值进行加密。

###### 4、OAuth2ClientAuthenticationProcessingFilter【Oauth2.0认证 多节点服务，跳过网关和单点登录调用接口或前后端分离的项目】 ######

Oauth2.0有4中认证方式我们使用的第四种客户端认证方式，由于spring默认的处理是OAuth2AuthenticationManager，它没法和cas配合使用，所以自定义JwtAuthenticationProvider来通过认证功能，使用bearerToken包含的jwt数据做鉴权。

##### 3、SSO #####

使用SpringSecurity提供认证鉴权功能，单点登录集成CAS

CasAuthenticationEntryPoint.commence方法 重定向到登录页

http.addFilterBefore(casAuthenticationFilter(securityCasProperties), UsernamePasswordAuthenticationFilter.class)
                    .addFilterBefore(oauth2AuthProcessingFilter(), CasAuthenticationFilter.class)
                    .addFilterBefore(pseudoCasAuthenticationFilter(this.corpId), CasAuthenticationFilter.class)
                    .addFilterBefore(appPseudoSsoAuthenticationFilter(), CasAuthenticationFilter.class)
                    .addFilterBefore(mspCasAuthenticationFilter(this.corpId), CasAuthenticationFilter.class)
                    .addFilterBefore(casLogoutFilter(), LogoutFilter.class)
                    .addFilterBefore(singleSignOutFilter(), CasAuthenticationFilter.class);

过滤器顺序

//过滤器顺序
    OAuth2AuthenticationProcessingFilter
    PseudoCasAuthenticationFilter
    SystemSsoAuthenticationFilter
    MspCasAuthenticationFilter
    CasAuthenticationFilter
    UsernamePasswordAuthenticationFilter

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1lhbmd6YWlMZUhlSGU_size_16_color_FFFFFF_t_70_pic_center]

TGC 类似于Cookie里的sessionId TGT 类比于Session

ST每次去CAS server验证后都会失效

和CAS认证通过后 会和CASServer建立一个全局的TGT

然后和下游的服务建立一个局部的Session，单点成功之后再次访问 因为已经存在局部session就不在进行验证了。并且对于分布式的情况，系统使用Spring-data-redis 可以解决分布式session的问题。

[20210413215832521.png_pic_center]: /images/20221022/7528d0ee0d374c9c85e6651c7d5c231c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1lhbmd6YWlMZUhlSGU_size_16_color_FFFFFF_t_70_pic_center]: /images/20221022/f04a9ec5da9840b59a300f455882ec7a.png