CAS
Defination:
Open source project for SSO which contains Client(Including : Java, .Net, PHP, Perl, Apache, uPortal, Ruby) & Server was create by Yale.
Principle:
Cas client binded with app1,when u login in the app1,cas client will check your authority( Service Ticket), It will redirect to the cas server in case your ticket is not authorized.
------------------------------------------------------------------------------------------------------------------
Setting up:
Configure tomcat SSL
The communication between Cas client and server is via SSL
a. Add this on the tomcat server.xml
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" keystoreFile="your key dir" keystorePass="" />
b. Create your key
//create certificate
keytool -genkey -alias aaa -keylag RSA -keystore d:/ccc
{*after Enter you will input some info ,what's your name ? must be input your server hostname}
//export certificate
keytool -export -file d:/ddd.crt -alias aaa -keystore d:/ccc
//import to JVM
keytool -import -keystore "your tomcat jre/lib/security/cacerts" -file d:/ddd.crt -alias aaa
*IF import to JVM this step is error: delete the cacerts and try again
*make sure the JVM is your tomcat's JVM
c. Server
zip the cas-server.zip and put the .war into the wabapp folder.
d. Client
zip the cas-client.zip and put the .jar into your project .
Then add some filters
<!-- 用于单点退出，该过滤器用于实现单点登出功能，可选配置--> <listener> <listener-class> org.jasig.cas.client.session.SingleSignOutHttpSessionListener </listener-class> </listener> <!-- 该过滤器用于实现单点登出功能，可选配置。 --> <filter> <filter-name>CAS Single Sign Out Filter</filter-name> <filter-class> org.jasig.cas.client.session.SingleSignOutFilter </filter-class> </filter> <filter-mapping> <filter-name>CAS Single Sign Out Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 该过滤器负责用户的认证工作，必须启用它 --> <filter> <filter-name>CASFilter</filter-name> <filter-class> org.jasig.cas.client.authentication.AuthenticationFilter </filter-class> <init-param> <param-name>casServerLoginUrl</param-name> <param-value> https://isdaac.com:8443/cas/login </param-value> </init-param> <init-param> <!--这里的server是服务端的IP--> <param-name>serverName</param-name> <param-value>http://10.243.75.101:9090</param-value> </init-param> </filter> <filter-mapping> <filter-name>CASFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 该过滤器负责对Ticket的校验工作，必须启用它 --> <filter> <filter-name>CAS Validation Filter</filter-name> <filter-class> org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter </filter-class> <init-param> <param-name>casServerUrlPrefix</param-name> <param-value>https://isdaac.com:8443/cas</param-value> </init-param> <init-param> <param-name>serverName</param-name> <param-value>http://10.243.75.101:9090</param-value> </init-param> </filter> <filter-mapping> <filter-name>CAS Validation Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 该过滤器负责实现HttpServletRequest请求的包裹， 比如允许开发者通过HttpServletRequest的getRemoteUser()方法获得SSO登录用户的登录名，可选配置。 --> <filter> <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> <filter-class> org.jasig.cas.client.util.HttpServletRequestWrapperFilter </filter-class> </filter> <filter-mapping> <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 该过滤器使得开发者可以通过org.jasig.cas.client.util.AssertionHolder来获取用户的登录名。 比如AssertionHolder.getAssertion().getPrincipal().getName()。 --> <filter> <filter-name>CAS Assertion Thread Local Filter</filter-name> <filter-class> org.jasig.cas.client.util.AssertionThreadLocalFilter </filter-class> </filter> <filter-mapping> <filter-name>CAS Assertion Thread Local Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 自动根据单点登录的结果设置本系统的用户信息 <filter> <display-name>AutoSetUserAdapterFilter</display-name> <filter-name>AutoSetUserAdapterFilter</filter-name> <filter-class> com.wsria.demo.filter.AutoSetUserAdapterFilter </filter-class> </filter> <filter-mapping> <filter-name>AutoSetUserAdapterFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>--> <!-- ======================== 单点登录结束 ======================== -->
e. LDAP
<property name="authenticationHandlers"> <list> <!-- | This is the authentication handler that authenticates services by means of callback via SSL, thereby validating | a server side SSL certificate. +--> <bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler" p:httpClient-ref="httpClient" /> <!-- | This is the authentication handler declaration that every CAS deployer will need to change before deploying CAS | into production. The default SimpleTestUsernamePasswordAuthenticationHandler authenticates UsernamePasswordCredentials | where the username equals the password. You will need to replace this with an AuthenticationHandler that implements your | local authentication strategy. You might accomplish this by coding a new such handler and declaring | edu.someschool.its.cas.MySpecialHandler here, or you might use one of the handlers provided in the adaptors modules. <bean class="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler" /> +--> <bean class="org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHandler"> <property name="filter" value="sAMAccountName=%u" /> <property name="searchBase" value="ou=shanghai,dc=XXX,dc=com" /> <property name="contextSource" ref="contextSource" /> </bean> </list> </property> </bean> <bean id="contextSource" class="org.springframework.ldap.core.support.LdapContextSource"> <property name="anonymousReadOnly" value="false" /> <property name="pooled" value="true" /> <property name="urls"> <list> <value>ldap://XXX.com:389/</value> <!-- asia <value>ldap://XXX.com:389/</value> --> </list> </property> <!-- 如果是老版本，这里应该用的是userName，而不是userDn --> <property name="userDn" value="CN=XXX,OU=IT,OU=Shanghai,DC=XXX,DC=com" /> <property name="password" value="XXX" /> <property name="baseEnvironmentProperties"> <map> <entry> <key><value>java.naming.security.authentication</value></key> <value>simple</value> </entry> </map> </property> </bean>
f. Get Value
AssertionImpl key = (AssertionImpl)session.getAttribute("_const_cas_assertion_");
String name = key.getPrincipal().getName();