Tomcat下配置与使用CAS实现单点登录

 

 

配置Tomcat使用SSL安全认证
因为CAS使用的是https协议，所以要求Tomcat支持该协议。实现步骤如下：
第一步：进入Dos命令行窗口，并进入到<%CATALINA_HOME%>目录下
第二步：生成密匙，命令如下：

keytool -genkey -alias 别名 -keyalg RSA -keypass changeit -storepass changeit -<SPAN class=hilite3>keystore</SPAN> <SPAN class=hilite2>server</SPAN>.<SPAN class=hilite3>keystore</SPAN>
例：keytool -genkey -alias <SPAN class=hilite1>cas</SPAN><SPAN class=hilite2>server</SPAN> -keyalg RSA -keypass changeit -storepass changeit -<SPAN class=hilite3>keystore</SPAN> <SPAN class=hilite2>server</SPAN>.<SPAN class=hilite3>keystore</SPAN>
如附图所示.

keytool -genkey -alias 别名 -keyalg RSA -keypass changeit -storepass changeit -keystore server.keystore
例：keytool -genkey -alias casserver -keyalg RSA -keypass changeit -storepass changeit -keystore server.keystore
如附图所示.

姓名必须填写为服务器端主机名，如果本机则填写localhost
完成之后会在Tomcat根目录下生成一个server.keystore的文件。
第三步：生成证书

keytool -export -alias <SPAN class=hilite1>cas</SPAN><SPAN class=hilite2>server</SPAN> -storepass changeit -file <SPAN class=hilite2>server</SPAN>.cer -<SPAN class=hilite3>keystore</SPAN> <SPAN class=hilite2>server</SPAN>.<SPAN class=hilite3>keystore</SPAN>

keytool -export -alias casserver -storepass changeit -file server.cer -keystore server.keystore

完成之后，会在Tomcat目录下生成一个名为server.cer的证书
第四步：导入证书

keytool -import -trustcacerts -alias <SPAN class=hilite2>server</SPAN> -file <SPAN class=hilite2>server</SPAN>.cer -<SPAN class=hilite3>keystore</SPAN> cacerts -storepass changeit

keytool -import -trustcacerts -alias server -file server.cer -keystore cacerts -storepass changeit

将生成的cascerts文件copy到<%JAVA_HOME%>\jre\lib\security目录下
第五步：配置Tomcat
打开<%CATALINA_HOME%>\config\server.xml
找到<Connector port="8443" ... />节点。默认该节点是被注释掉的，去掉注释，并修改内容为：

<Connector protocol="org.apache.coyote.http11.Http11Protocol"
            port="8443" maxHttpHeaderSize="8192"
            maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
            enableLookups="false" disableUploadTimeout="true"
            acceptCount="100" scheme="https" secure="true"
            clientAuth="false" sslProtocol="TLS"
            <SPAN class=hilite3>keystore</SPAN>Pass="changeit" <SPAN class=hilite3>keystore</SPAN>File="/<SPAN class=hilite2>server</SPAN>.<SPAN class=hilite3>keystore</SPAN>" />

<Connector protocol="org.apache.coyote.http11.Http11Protocol"
	        port="8443" maxHttpHeaderSize="8192"
	        maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
	        enableLookups="false" disableUploadTimeout="true"
	        acceptCount="100" scheme="https" secure="true"
	        clientAuth="false" sslProtocol="TLS"
	        keystorePass="changeit" keystoreFile="/server.keystore" />

第六步：测试
访问：Https://localhost:8443/ 如果能出现Tomcat管理首页，则证明SSL配置成功

集成CAS
第一步：下载CAS Server和CAS Client
http://www.ja-sig.org/downloads/cas/cas-server-3.1.1-release.zip
http://www.ja-sig.org/downloads/cas-clients/cas-client-java-2.1.1.zip
第二步：部署CAS Server
将下载的cas-server-3.1.1-release.zip文件解压，将\modules\ cas-server-webapp-3.1.1.war拷贝到<%CATALINA_HOME%>\webapps\目录下，并改名为cas.war
启动Tomcat，访问https://localhost:8443/cas/login 弹出登录页面，则证明部署成功。
第三步：集成到本系统
将下载的cas-client-java-2.1.1.zip文件解压，将\dist\ casclient.jar文件拷贝到本系统的WEB-INF\lib目录下
修改web.xml配置，添加以下内容：

<filter>
<filter-name><SPAN class=hilite1>CAS</SPAN>Filter</filter-name>
<filter-class>
edu.yale.its.tp.<SPAN class=hilite1>cas</SPAN>.client.filter.<SPAN class=hilite1>CAS</SPAN>Filter
</filter-class>
<init-param>
<param-name>
edu.yale.its.tp.<SPAN class=hilite1>cas</SPAN>.client.filter.loginUrl
</param-name>
<param-value>
<A href="https://localhost:8443/cas/login" target=_blank>https://localhost:8443/<SPAN class=hilite1>cas</SPAN>/login</A>
</param-value>
</init-param>
<init-param>
<param-name>
edu.yale.its.tp.<SPAN class=hilite1>cas</SPAN>.client.filter.validateUrl
</param-name>
<param-value>
<A href="https://localhost:8443/cas/proxyValidate" target=_blank>https://localhost:8443/<SPAN class=hilite1>cas</SPAN>/proxyValidate</A>
</param-value>
</init-param>
<init-param>
<param-name>
edu.yale.its.tp.<SPAN class=hilite1>cas</SPAN>.client.filter.<SPAN class=hilite2>server</SPAN>Name
</param-name>
<param-value>localhost:8080</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name><SPAN class=hilite1>CAS</SPAN>Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

<filter>
<filter-name>CASFilter</filter-name>
<filter-class>
edu.yale.its.tp.cas.client.filter.CASFilter
</filter-class>
<init-param>
<param-name>
edu.yale.its.tp.cas.client.filter.loginUrl
</param-name>
<param-value>
https://localhost:8443/cas/login
</param-value>
</init-param>
<init-param>
<param-name>
edu.yale.its.tp.cas.client.filter.validateUrl
</param-name>
<param-value>
https://localhost:8443/cas/proxyValidate
</param-value>
</init-param>
<init-param>
<param-name>
edu.yale.its.tp.cas.client.filter.serverName
</param-name>
<param-value>localhost:8080</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>CASFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

第四步：原理描述
本系统所有请求被CAS过滤器拦截到，过滤器会将页面重定向CAS Server，CAS Server会判断用户是否已经登录，如果未登录，则定位到登录页面(CAS Server内的)。登录成功后，再重定向到用户先前访问的本系统页面。此时session里有一个名为的edu.yale.its.tp.cas.client.filter.user属性。它存储的就是用户的登录名