转载/整理--SSO实现原理

/**
* @author Aray Chou
*         Email: Aray(dot)Chou(dot)CN(at)gmail(dot)com
*         Replace "(dot)" with "." and replace "(at)" with "@"
*/
package com.aray.core.filter;

import java.io.IOException;
import java.util.HashMap;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

/**
* 用户登录<br/>
* 验证用户明密码，如果正确，让他访问/index.htm。同时将用户名存入session.
* 用户登录成功，找到以前登录的同名用户的session，标记它为用户未登录。
*/
public class Login extends HttpServlet
{

    /** TODO add comments */
    private static final long serialVersionUID = -1503457404159800655L;

    /** 存放所有已登录的session, key为用户名 */
    static final HashMap<String, HttpSession> ALL_SESSION = new HashMap<String, HttpSession>();

    /*
     * (non-Javadoc)
     *
     * @see javax.servlet.http.HttpServlet#doGet(javax.servlet.http.HttpServletRequest,
     * javax.servlet.http.HttpServletResponse)
     */
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
    {
        exec(req, resp);
    }

    /**
     * 用户登录，验证用户明密码，如果正确，让他访问/index.htm。同时将用户名存入session.
     * 用户登录成功，找到以前登录的同名用户的session，标记它为用户未登录。
     *
     * @param req
     * @param resp
     */
    private void exec(HttpServletRequest req, HttpServletResponse resp)
    {
        String user = req.getParameter("user");
        String password = req.getParameter("password");

        if (password != null && password.equals("ILoveAray"))
        {

            // 用户密码验证成功，登录

            HttpSession session = req.getSession(true);
            session.setAttribute("user", user);

            // 将登录信息放入ALL_SESSION
            HttpSession exsistsSession = ALL_SESSION.put(user, session);

            if (exsistsSession != null) // 以前登录的同名用户的session
            {
                // 标记用户登录失效
                exsistsSession.removeAttribute("user");
                // 标记此用户被ban
                exsistsSession.setAttribute("banned", true);
            }
            ;

            // 访问首页
            try
            {
                resp.sendRedirect("/index.htm");
            }
            catch (IOException e)
            {
                e.printStackTrace();
            }
        }
        else
        {
            // 用户密码验证失败
        }

    }

    /*
     * (non-Javadoc)
     *
     * @see javax.servlet.http.HttpServlet#doPost(javax.servlet.http.HttpServletRequest,
     * javax.servlet.http.HttpServletResponse)
     */
    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
    {
        exec(req, resp);
    }

}