CAS 单点登录原理总结

不念不忘少年蓝@ 2022-05-17 01:23 213阅读 0赞

环境：两个web服务作为Cas的client端，CAS服务端cas-server-webapp-3.5.1.war，配置tomcat虚拟主机（hosts 与 servers.xml）

（1）cas的client1的web.xml配置，同理配置client2：

<filter>
    <filter-name>CASFilter</filter-name>
    <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
    <init-param>
    <param-name>casServerLoginUrl</param-name>
    <param-value>http://cas.com:8080/login</param-value>
    </init-param>
    
    <init-param>
    <param-name>serverName</param-name>
    <param-value>http://client1.com:8080</param-value>
    </init-param>
    </filter>
    
    <filter-mapping>
    <filter-name>CASFilter</filter-name>
    <url-pattern>/*</url-pattern>
    </filter-mapping>
    
    
    <filter>
    <filter-name>CAS Validation Filter</filter-name>
    <filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
    <init-param>
    <param-name>casServerUrlPrefix</param-name>
    <param-value>http://cas.com:8080/</param-value>
    </init-param>
    <init-param>
    <param-name>serverName</param-name>
    <param-value>http://client1.com:8080</param-value>
    </init-param>
    </filter>
    
    <filter-mapping>
    <filter-name>CAS Validation Filter</filter-name>
    <url-pattern>/*</url-pattern>
    </filter-mapping>

（2）cas默认使用https协议，修改其票据检查为http协议认证： spring-cnfiguration/ticketGrantingTicketCookieGenerator.xml

测试步骤：

[浏览器访问 http://client1.com:8080/index，重定向到  ][http_client1.com_8080_index_][http://cas.com:8080/login?service=http://client1.com:8080/index][http_cas.com_8080_login_service_http_client1.com_8080_index]

![70][]输入用户名密码登录：

![70 1][]

![70 2][]

![70 3][]

![70 4][]

client1访问过程总结：

<1> 浏览器访问 http://client1.com:8080/index.jsp
        重定向到 http://cas.com:8080/login?service=http%3A%2F%2Fclient1.com%3A8080%2Findex.jsp
    
    <2> 访问 http://cas.com:8080/login?service=http://client1.com:8080/index.jsp
        输入用户名密码登录
    
    <3> 登录成功，CAS服务器向浏览器传回 cookie CASTGC=TGT-2-ZdbzVTdbhDmSI9KEk0tkPsMbrXfuDstwJaiKpj1I9hhVIXBAla-cas01.example.org; Path=/，
        重定向到 http://client1.com:8080/index.jsp?ticket=ST-3-iGfw4MaDc0X0WeoHBDFz-cas01.example.org
    
    <4> 浏览器携带ticket访问：http://client1.com:8080/index.jsp?ticket=ST-3-iGfw4MaDc0X0WeoHBDFz-cas01.example.org
        重定向到 http://client1.com:8080/index.jsp;jsessionid=29C6C3310A5B68406823E55AF70CE234
    
    <5> 访问 http://client1.com:8080/index.jsp;jsessionid=29C6C3310A5B68406823E55AF70CE234

浏览器访问 [http://client2.com:8080/index.jsp][http_client2.com_8080_index.jsp]

![70 5][]

![70 6][]

![70 7][]

![70 8][]

![70 9][]

client2访问过程总结：

<1> http://client2.com:8080/index.jsp
    重定向到 http://cas.com:8080/cas/login?service=http%3A%2F%2Fclient2.com%3A8080%2Findex.jsp
    
    <2> 访问：http://cas.com:8080/cas/login?service=http://client2.com:8080/index.jsp
    携带上次浏览器访问CAS服务的cookie:
    JSESSIONID=6DBC4492CCA25B05715794F4002266EA; CASTGC=TGT-2-JpMDcVawHdUQJd0OOPwEHODOqN3z6BaqMpiRvdYsRtoo7brNAY-cas01.example.org
    重定向到 http://client2.com:8080/index.jsp?ticket=ST-2-iewA1oyRijfvYTtIMIBR-cas01.example.org
    
    <3> 携带CAS的ticket访问：http://client2.com:8080/index.jsp?ticket=ST-2-iewA1oyRijfvYTtIMIBR-cas01.example.org
    重定向到 http://client2.com:8080/index.jsp;jsessionid=DD50A2513F232D614069CD3B40790319
    
    <4> http://client2.com:8080/index.jsp;jsessionid=DD50A2513F232D614069CD3B40790319

[http_client1.com_8080_index_]: http://client1.com:8080/index
[http_cas.com_8080_login_service_http_client1.com_8080_index]: http://cas.com:8080/login?service=http://client1.com:8080/index
[70]: /images/20220517/aeb8aa39015442f1aeacc48a189626c7.png
[70 1]: /images/20220517/6e97ddb780cd42c29e1045bf1642ab3a.png
[70 2]: /images/20220517/5b5ed102d6964725bdf41b560e0dd38f.png
[70 3]: /images/20220517/bf65235253db45839e053da7f901eb30.png
[70 4]: /images/20220517/a280f19829734d2bbece6ebb60bcbaf4.png
[http_client2.com_8080_index.jsp]: http://client2.com:8080/index.jsp
[70 5]: /images/20220517/6b105bc6de5045db901f9e1d743fdaaa.png
[70 6]: /images/20220517/4e1cb79d381649c99bef787f3e1a10ad.png
[70 7]: /images/20220517/055439ccdf5f42478e9ae1d0f97bfc5d.png
[70 8]: /images/20220517/4e64e83961d24e8db1ebbecc5fbe598b.png
[70 9]: /images/20220517/7d5d3a329f05402382e1c8cf538f1584.png