CAS

CAS

Defination:

         Open source project for SSO which contains Client(Including : Java, .Net, PHP, Perl, Apache, uPortal, Ruby) & Server was create by Yale.

 

Principle:

    Cas client binded with app1,when u login in the app1,cas client will check your authority( Service Ticket), It will redirect to the cas server in case your ticket is not authorized.

 

------------------------------------------------------------------------------------------------------------------

Setting up:

 

Configure tomcat SSL

     The communication between Cas client and server is via SSL

 

a. Add this on the tomcat server.xml

    <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" 
               maxThreads="150" scheme="https" secure="true" 
               clientAuth="false" sslProtocol="TLS" keystoreFile="your key dir" keystorePass="" />

 

b. Create your key

//create certificate
keytool -genkey -alias aaa -keylag RSA -keystore d:/ccc
{*after Enter you will input some info ,what's your name ? must be input your server hostname}
//export certificate
keytool -export -file d:/ddd.crt -alias aaa -keystore d:/ccc
//import to JVM
keytool -import -keystore "your tomcat jre/lib/security/cacerts" -file d:/ddd.crt -alias aaa

*IF import to JVM this step is error: delete the cacerts and try again
*make sure the JVM is your tomcat's JVM 

 

c. Server

 zip the cas-server.zip and put the .war into the wabapp folder.

 

d.  Client

zip the cas-client.zip and put the .jar into your project . 

Then add some filters

<!-- 用于单点退出，该过滤器用于实现单点登出功能，可选配置-->
	<listener>
		<listener-class>
			org.jasig.cas.client.session.SingleSignOutHttpSessionListener
		</listener-class>
	</listener>

	<!-- 该过滤器用于实现单点登出功能，可选配置。 -->
	<filter>
		<filter-name>CAS Single Sign Out Filter</filter-name>
		<filter-class>
			org.jasig.cas.client.session.SingleSignOutFilter
		</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>CAS Single Sign Out Filter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<!-- 该过滤器负责用户的认证工作，必须启用它 -->
	<filter>
		<filter-name>CASFilter</filter-name>
		<filter-class>
			org.jasig.cas.client.authentication.AuthenticationFilter
		</filter-class>
		<init-param>
			<param-name>casServerLoginUrl</param-name>
			<param-value>
				https://isdaac.com:8443/cas/login
			</param-value>
		</init-param>
		<init-param>
			<!--这里的server是服务端的IP-->
			<param-name>serverName</param-name>
			<param-value>http://10.243.75.101:9090</param-value>
		</init-param>
	</filter>
	<filter-mapping>
		<filter-name>CASFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<!-- 该过滤器负责对Ticket的校验工作，必须启用它 -->
	<filter>
		<filter-name>CAS Validation Filter</filter-name>
		<filter-class>
			org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter
		</filter-class>
		<init-param>
			<param-name>casServerUrlPrefix</param-name>
			<param-value>https://isdaac.com:8443/cas</param-value>
		</init-param>
		<init-param>
			<param-name>serverName</param-name>
			<param-value>http://10.243.75.101:9090</param-value>
		</init-param>
	</filter>
	<filter-mapping>
		<filter-name>CAS Validation Filter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<!--
		该过滤器负责实现HttpServletRequest请求的包裹，
		比如允许开发者通过HttpServletRequest的getRemoteUser()方法获得SSO登录用户的登录名，可选配置。
	-->
	<filter>
		<filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
		<filter-class>
			org.jasig.cas.client.util.HttpServletRequestWrapperFilter
		</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<!--
		该过滤器使得开发者可以通过org.jasig.cas.client.util.AssertionHolder来获取用户的登录名。
		比如AssertionHolder.getAssertion().getPrincipal().getName()。
	-->
	<filter>
		<filter-name>CAS Assertion Thread Local Filter</filter-name>
		<filter-class>
			org.jasig.cas.client.util.AssertionThreadLocalFilter
		</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>CAS Assertion Thread Local Filter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<!-- 自动根据单点登录的结果设置本系统的用户信息 
	<filter>
		<display-name>AutoSetUserAdapterFilter</display-name>
		<filter-name>AutoSetUserAdapterFilter</filter-name>
		<filter-class>
			com.wsria.demo.filter.AutoSetUserAdapterFilter
		</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>AutoSetUserAdapterFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>-->
	<!-- ======================== 单点登录结束 ======================== -->

 

e. LDAP 

		<property name="authenticationHandlers">
			<list>
				<!--
					| This is the authentication handler that authenticates services by means of callback via SSL, thereby validating
					| a server side SSL certificate.
					+-->
				<bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler"
					p:httpClient-ref="httpClient" />
				<!--
					| This is the authentication handler declaration that every CAS deployer will need to change before deploying CAS 
					| into production.  The default SimpleTestUsernamePasswordAuthenticationHandler authenticates UsernamePasswordCredentials
					| where the username equals the password.  You will need to replace this with an AuthenticationHandler that implements your
					| local authentication strategy.  You might accomplish this by coding a new such handler and declaring
					| edu.someschool.its.cas.MySpecialHandler here, or you might use one of the handlers provided in the adaptors modules.
					
				<bean 
					class="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler" />
				+-->
				<bean   class="org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHandler">    
					<property name="filter" value="sAMAccountName=%u" />    
					<property name="searchBase" value="ou=shanghai,dc=XXX,dc=com" />      
					<property  name="contextSource"   ref="contextSource" />    
				</bean>	
			</list>
		</property>
	</bean>

	<bean id="contextSource" class="org.springframework.ldap.core.support.LdapContextSource">       
 <property name="anonymousReadOnly" value="false" />  

 <property name="pooled" value="true" />  
 <property name="urls">  
  <list>  
   <value>ldap://XXX.com:389/</value>   
   <!-- asia  <value>ldap://XXX.com:389/</value>   -->
  </list>  
 </property>  
  <!-- 如果是老版本，这里应该用的是userName，而不是userDn -->   
 <property name="userDn" value="CN=XXX,OU=IT,OU=Shanghai,DC=XXX,DC=com" />  
 <property name="password" value="XXX" />  
 <property name="baseEnvironmentProperties">  
  <map>  
   
  <entry>                       
   <key><value>java.naming.security.authentication</value></key>    
   <value>simple</value>  
  </entry>  
  </map>  
 </property>  
</bean> 

 f. Get Value

		AssertionImpl key = (AssertionImpl)session.getAttribute("_const_cas_assertion_");
		String name = key.getPrincipal().getName();