配置 Yale CAS Server 来实现单点登陆(SSO)

一、配置tomcat的ssl

1、生成 name key

keytool -genkey -alias pp -keyalg RSA -keystore keystore.keystore

 

2、导出证书

keytool -export -file pp.cert -alias  pp -keystore keystore.keystore

 

3、将证书导入的JDK的证书信任库中

keytool -import -keystore "C:/Program Files/Java/jdk1.6.0_12/jre/lib/security/cacerts" -file pp.cer -alias pp -storepass changeit

 

4、证书从任库中删除

keytool -delete -alias pp  -keystore "C:/Program Files/Java/jdk1.6.0_12/jre/lib/security/cacerts" -storepass changeit

 

5、显示

keytool -list -v -keystore "C:/Program Files/Java/jdk1.6.0_12/jre/lib/security/cacerts"

 

修改%TOMCAT_HOME%\conf\server.xml，以文字编辑器打开，查找这一行：

xml 代码 
2.<Connector port="8443" maxHttpHeaderSize="8192"  
1.           maxThreads="150" minSpareThreads="25" maxSpareThreads="75"  
2.           enableLookups="false" disableUploadTimeout="true"  
3.           acceptCount="100" scheme="https" secure="true"  
4.           clientAuth="false" sslProtocol="TLS"    
5.           keystoreFile="D:\Tomcat 6.0\keystore\keystore.keystore"    
6.           keystorePass="changeit"/>  
Tomcat5.5.20配置(此配置同样可用于Tomcat6.0)：

xml 代码
1.  
2.<Connector protocol="org.apache.coyote.http11.Http11Protocol"    
1.                     port="8443" maxHttpHeaderSize="8192"  
2.           maxThreads="150" minSpareThreads="25" maxSpareThreads="75"  
3.           enableLookups="false" disableUploadTimeout="true"  
4.           acceptCount="100" scheme="https" secure="true"  
5.           clientAuth="false" sslProtocol="TLS"                   
6.           keystoreFile="D:\Tomcat 6.0\keystore\keystore.keystore"    
7.           keystorePass="changeit"/>  
Tomcat6.0.10配置：
xml 代码
1.<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"  
2.           port="8443" minSpareThreads="5" maxSpareThreads="75"  
3.           enableLookups="true" disableUploadTimeout="true"    
4.           acceptCount="100" maxThreads="200"  
5.           scheme="https" secure="true" SSLEnabled="true"  
6.           clientAuth="false" sslProtocol="TLS"  
7.           keystoreFile="D:\Tomcat 6.0\keystore\keystore.keystore"    
8.           keystorePass="changeit"/>  

 

注意：clientAuth="want"，原来我设置的是clientAuth="true"，结果不好用，于是改成了want了。

 

tomcat6支持3种，请参考以下文档：
http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html

 

二配置sso

1.下载cas-server和cas-client
http://www.ja-sig.org/downloads/cas/cas-server-3.0.zip
http://www.yale.edu/tp/cas/cas-client-2.0.11.zip

 

2、设置webclient

 

<filter>
<filter-name>CASFilter</filter-name>
<filter-class>edu.yale.its.tp.cas.client.filter.CASFilter</filter-class>
<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>
<param-value>https://localhost:8443/cas/login</param-value>
</init-param>
<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>
<param-value>https://localhost:8443/cas/proxyValidate</param-value>
</init-param>

<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.serverName</param-name>
<param-value>localhost:8080</param-value>
</init-param>

</filter>

<filter-mapping>
<filter-name>CASFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

 

3、设置cas服务器

 

4、测试