单点登录CAS系列8-客户端配置单点登出 - 将cas中web.xml配置到properties中

原理

本文内容包括配置单点登出、登出后自动跳转指定资源、CASServer禁用单点登出等

与单点登录相对应：登录的地址是/login，登出的地址是/logout，这里需要配置下面两个Filter

SingleSignOutFilter：用来使Session失效（要配置casServerUrlPrefix参数）

SingleSignOutHttpSessionListener：用于在Session过期时移除其对应的映射关系

• 登出后自动跳转指定资源

登出后默认会跳转到CASServer的登出页，若想跳转到其它资源，可在/logout的URL后面加上service=jumpurl

比如http://sso.jadyer.com:8080/cas-server-web/logout?service=https://jadyer.github.io/

但默认servcie跳转不会生效，需要CASServer配置//WEB-INF//cas.properties中的cas.logout.followServiceRedirects=true

另外为org.jasig.cas.client.session.SingleSignOutFilter增加service参数是没用的，因为登出后跳转到指定资源属于服务端行为

• 禁用单点登出

设置//CASServer//WEB-INF//cas.properties中的slo.callbacks.disabled=true

测试时点击登出后虽然页面跳转到了默认登出页，但再次访问CASClient资源发现并没有登出，即单点登出禁用成功

• 测试单点登出

测试时先登出，然后在浏览器新标签页访问CASClient资源，发现会被自动重定向到单点登录页

或登出后，再点浏览器后退按钮，发现会后退到之前的资源页，但在这个页面点击任何请求，都会自动重定向到单点登录页

代码

下面是客户端的web.xml

1. xml version="1.0" encoding="UTF-8"?>
2. <web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
3. <context-param>
4. <param-name>contextConfigLocation param-name>
5. <param-value>classpath:applicationContext.xml param-value>
6. context-param>
7. <listener>
8. <listener-class>org.springframework.web.context.ContextLoaderListener listener-class>
9. listener>
11. <servlet>
12. <servlet-name>SpringMVC servlet-name>
13. <servlet-class>org.springframework.web.servlet.DispatcherServlet servlet-class>
14. <init-param>
15. <param-name>contextConfigLocation param-name>
16. <param-value>classpath:applicationContext.xml param-value>
17. init-param>
18. servlet>
19. <servlet-mapping>
20. <servlet-name>SpringMVC servlet-name>
21. <url-pattern>/ url-pattern>
22. servlet-mapping>
24. <filter>
25. <filter-name>CharacterEncodingFilter filter-name>
26. <filter-class>org.springframework.web.filter.CharacterEncodingFilter filter-class>
27. <init-param>
28. <param-name>encoding param-name>
29. <param-value>UTF-8 param-value>
30. init-param>
31. <init-param>
32. <param-name>forceEncoding param-name>
33. <param-value>true param-value>
34. init-param>
35. filter>
36. <filter-mapping>
37. <filter-name>CharacterEncodingFilter filter-name>
38. <url-pattern>/* url-pattern>
39. filter-mapping>
42. <listener>
43. <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener listener-class>
44. listener>
45. <filter>
46. <filter-name>casSingleSignOutFilter filter-name>
47. <filter-class>org.springframework.web.filter.DelegatingFilterProxy filter-class>
48. filter>
49. <filter-mapping>
50. <filter-name>casSingleSignOutFilter filter-name>
51. <url-pattern>/* url-pattern>
52. filter-mapping>
53. <filter>
54. <filter-name>casAuthenticationFilter filter-name>
55. <filter-class>org.springframework.web.filter.DelegatingFilterProxy filter-class>
56. filter>
57. <filter-mapping>
58. <filter-name>casAuthenticationFilter filter-name>
59. <url-pattern>/* url-pattern>
60. filter-mapping>
61. <filter>
62. <filter-name>casTicketValidationFilter filter-name>
63. <filter-class>org.springframework.web.filter.DelegatingFilterProxy filter-class>
64. filter>
65. <filter-mapping>
66. <filter-name>casTicketValidationFilter filter-name>
67. <url-pattern>/* url-pattern>
68. filter-mapping>
69. <filter>
70. <filter-name>casHttpServletRequestWrapperFilter filter-name>
71. <filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter filter-class>
72. filter>
73. <filter-mapping>
74. <filter-name>casHttpServletRequestWrapperFilter filter-name>
75. <url-pattern>/* url-pattern>
76. filter-mapping>
77. <filter>
78. <filter-name>casAssertionThreadLocalFilter filter-name>
79. <filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter filter-class>
80. filter>
81. <filter-mapping>
82. <filter-name>casAssertionThreadLocalFilter filter-name>
83. <url-pattern>/* url-pattern>
84. filter-mapping>
85. web-app>

下面是客户端的/src/applicationContext.xml

1. xml version="1.0" encoding="UTF-8"?>
2. <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:mvc="http://www.springframework.org/schema/mvc" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd">
3. <bean class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
4. <property name="systemPropertiesModeName" value="SYSTEM_PROPERTIES_MODE_OVERRIDE"/>
5. <property name="ignoreResourceNotFound" value="false"/>
6. <property name="locations">
7. <list>
8. <value>classpath:config.properties value>
9. list>
10. property>
11. bean>
12. <mvc:resources mapping="/index.jsp" location="/index.jsp"/>
15. <bean name="casSingleSignOutFilter" class="org.jasig.cas.client.session.SingleSignOutFilter">
16. <property name="casServerUrlPrefix" value="${casServerUrlPrefix}"/>
17. bean>
18. <bean name="casAuthenticationFilter" class="org.jasig.cas.client.authentication.AuthenticationFilter">
19. <property name="serverName" value="${casClientServerName}"/>
20. <property name="casServerLoginUrl" value="${casServerLoginUrl}"/>
21. bean>
22. <bean name="casTicketValidationFilter" class="org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter">
23. <property name="serverName" value="${casClientServerName}"/>
24. <property name="ticketValidator">
25. <bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
26. <constructor-arg index="0" value="${casServerUrlPrefix}"/>
27. bean>
28. property>
29. bean>
30. beans>

下面是/src/config.properties

1. #<<Central Authentication Service>>
2. #where to logout
3. casServerLogoutUrl=http: //sso.jadyer.com:8080/cas-server-web/logout
4. #where to login
5. casServerLoginUrl=http: //sso.jadyer.com:8080/cas-server-web/login
6. #login server root
7. casServerUrlPrefix=http: //sso.jadyer.com:8080/cas-server-web
8. #who am i
9. casClientServerName=http: //boss.jadyer.com:8080

下面是/WebRoot/index.jsp

1. <%@ page pageEncoding="UTF-8"%>
2. <%@ page import="java.util.Map"%>
3. <%@ page import="java.net.URLDecoder"%>
4. <%@ page import="com.jadyer.util.ConfigUtil"%>
5. <%@ page import="org.jasig.cas.client.util.AssertionHolder"%>
6. <%@ page import="org.jasig.cas.client.authentication.AttributePrincipal"%>
8. <script>
9. function ssoLogout(){
10. if(confirm( '确定要退出系统吗？')){
11. //top.location.href ='http://sso.jadyer.com:8080/cas-server-web/logout?service=https://jadyer.github.io/';
12. //top.location.href ='http://sso.jadyer.com:8080/cas-server-web/logout?service=http://sso.jadyer.com:8080/cas-server-web/login';
13. top.location.href = '<%=ConfigUtil.INSTANCE.getProperty("casServerLogoutUrl")%>';
14. }
15. }
16. script>
18. <body style="background-color:#CBE0C9;">
19. <span style="color:red; font-size:32px; font-weight:bold;">客户端登录成功 span>
20. <br>
21. <br>
22. <a href="javascript:ssoLogout();">我要登出 a>
23. body>
25. <hr size="2">
27. <%
28. AttributePrincipal principal = (AttributePrincipal)request.getUserPrincipal();
29. Map< String, Object> attributes = principal.getAttributes();
30. out.print("principal.getName()=" + principal.getName() + " <br/>");
31. out.print("request.getRemoteUser()=" + request.getRemoteUser() + " <br/>");
32. out.print("登录用户：" + attributes.get("userId") + " <br/>");
33. out.print("登录时间：" + AssertionHolder.getAssertion().getAuthenticationDate() + " <br/>");
34. out.print("----------------------------------------------------------------------- <br/>");
35. for(Map.Entry <String, Object> entry : attributes.entrySet()){
36. //服务端返回中文时需要encode，客户端接收显示中文时需要decode，否则会乱码
37. out.print(entry.getKey() + "=" + URLDecoder.decode(entry.getValue().toString(), "UTF-8") + " <br/>");
38. }
39. out.print("----------------------------------------------------------------------- <br/>");
40. Map <String, Object> attributes22 = AssertionHolder.getAssertion().getAttributes();
41. for(Map.Entry <String, Object> entry : attributes22.entrySet()){
42. out.print(entry.getKey() + "=" + entry.getValue() + " <br/>");
43. }
44. out.print("----------------------------------------------------------------------- <br/>");
45. Map <String, Object> attributes33 = AssertionHolder.getAssertion().getPrincipal().getAttributes();
46. for(Map.Entry <String, Object> entry : attributes33.entrySet()){
47. out.print(entry.getKey() + "=" + entry.getValue() + " <br/>");
48. }
49. %>

最后是读取配置文件的工具类ConfigUtil.java

1. package com.jadyer.util;
2. import java.io.IOException;
3. import java.util.Properties;
4. import java.util.regex.Pattern;
6. /**
7. * 配置文件读取工具类
8. * --------------------------------------------------------------------------------------------------------------------
9. * 用法为ConfigUtil.INSTANCE.getProperty("KJJF.databaseURL")
10. * 采用枚举的方式，也是Effective Java作者Josh Bloch提倡的方式，它不仅能避免多线程同步问题，而且还能防止反序列化重新创建新的对象
11. * --------------------------------------------------------------------------------------------------------------------
12. * @version v2.1
13. * @history v2.1-->增加getPropertyBySysKey()方法,用于获取配置文件的键值中含系统属性时的值,详见该方法注释
14. * @history v2.0-->采用枚举的方式实现单例
15. * @history v1.0-->通过内部类实现单例
16. * Created by 玄玉 on 2012/06/07 17:30.
17. */
18. public enum ConfigUtil {
19. INSTANCE;
20. private Properties config;
21. private ConfigUtil(){
22. config = new Properties();
23. try {
24. config.load(ConfigUtil.class.getResourceAsStream( "/config.properties"));
25. System.out.println( "Load /config.properties SUCCESS...");
26. } catch (IOException e) {
27. System.out.println( "Load /config.properties Error...");
28. e.printStackTrace();
29. throw new ExceptionInInitializerError( "加载系统配置文件失败...");
30. }
31. }
33. public String getProperty(String key){
34. return config.getProperty(key);
35. }
37. public int getPropertyForInt(String key){
38. return Integer.parseInt(config.getProperty(key));
39. }
41. /**
42. * 配置文件的键值中含系统属性时的获取方式
43. * -------------------------------------------------------------------------
44. * 若配置文件的某个键值含类似于${user.dir}的写法，如log=${user.dir}/app.log
45. * 则可以通过该方法使用系统属性中user.dir的值，替换掉配置文件键值中的${user.dir}
46. * -------------------------------------------------------------------------
47. * Created by 玄玉 on 2015/02/02 17:22.
48. */
49. public String getPropertyBySysKey(String key){
50. String value = config.getProperty(key);
51. if( null!=value && Pattern.compile( "\\$\\{\\w+(\\.\\w+)*\\}").matcher(value).find()){
52. String sysKey = value.substring(value.indexOf( "${")+ 2, value.indexOf( "}"));
53. value = value.replace( "${"+sysKey+ "}", System.getProperty(sysKey));
54. }
55. return value;
56. }
57. }