CASD单点登录学习笔记

刺骨的言语ヽ痛彻心扉 2022-06-09 04:19 138阅读 0赞

创建证书  
证书是单点登录认证系统中很重要的一把钥匙，客户端于服务器的交互安全靠的就是证书；由于是学习所以就用JDK自带的keytool工具生成证书；如果以后真正在产品环境中使用肯定要去证书提供商去购买，证书认证一般都是由VeriSign认证，中文官方网站：[http://www.verisign.com/cn/][http_www.verisign.com_cn]

用JDK自带的keytool工具生成证书：

keytool -genkey -alias tomcat -keyalg RSA -keystore d:/keys/keystore

![这里写图片描述][SouthEast]

由于我们所写的域名是不存在的,所以需要在`C:\Windows\System32\drivers\etc\hosts` hosts文件中添加域名

导出证书

D:\keys>keytool -export -file d:/keys/tomcat.crt -alias tomcat -keystore d:/keys/keystore

为客户端的JVM导入证书

D:\keys>keytool -export -file d:/keys/tomcat.crt -alias tomcat -keystore d:/keys/keystore

C:\\tool\\JDK\\jdk1.7.0.80\\jre\\lib\\security – 是jre的目录；密码还是刚刚输入的密码。至此证书的创建、导出、导入到客户端JVM都已完成，下面开始使用证书到Web服务器中  
注意:  
如果提示：

keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect

那么输入密码：changeit

应用证书到Web服务器-Tomcat  
说是应用起始做的事情就是启用Web服务器(Tomcat)的SSL，也就是HTTPS加密协议，为什么加密(我也不知道)…… 准备好一个干净的tomcat，本教程使用的apache-tomcat-7.0.77 打开tomcat目录的conf/server.xml文件，开启83和87行的注释代码，并设置keystoreFile、keystorePass修改结果如下：  
tomcat7

tomcat6

protocol="HTTP/1.1"
                   maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
                   clientAuth="false" sslProtocol="TLS" 
                   keystoreFile="D:/keys/keystore"  
                   keystorePass="000000"  
                   />

keystoreFile：在第一步创建的key存放位置
    keystorePass：创建证书时的密码

现在可以启动tomcat试一下了,如果显示如下页面:  
![这里写图片描述][SouthEast 1]  
点击高级—继续前往—如果进入Tomcat目录了，那么又向成功迈进了一步。

CAS服务器部署  
下载CAS服务  
下载完成后将cas-server-3.4.3.1.zip解压，解压cas-server-3.4.3/modules/cas-server-webapp-3.4.3.1.war，改名为cas，然后复制cas目录到tomcat/webapp目录下  
![这里写图片描述][SouthEast 2]  
现在可以访问CAS应用了，当然要使用HTTPS加密协议访问，地址：[https://www.taotao.com:8443/cas/login][https_www.taotao.com_8443_cas_login] ，现在打开了CAS服务器的页面输入admin/admin点击登录（CAS默认的验证规则只要用户名和密码相同就通过）所以如果你看到下面的这张图片你就成功了  
![这里写图片描述][SouthEast 3]

登录成功页面  
![登录成功][SouthEast 4]

CAS配置数据库连接  
上面的初体验仅仅是简单的身份验证，实际应用中肯定是要读取数据库的数据，下面我们来进一步配置CAS服务器怎么读取数据库的信息进行身份验证。 首先打开

C:\tool\tomcat\apache-tomcat-7.0.77\webapps\cas\WEB-INF\deployerConfigContext.xml

找到第92行处，注释掉：SimpleTestUsernamePasswordAuthenticationHandler这个验证Handler，这个是比较简单的，只是判断用户名和密码相同即可通过，这个肯定不能在实际应用中使用！

注释掉92行后在下面添加下面的代码：

在文件的末尾之前加入如下代码：

<bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
    
           <property name="driverClassName"><value>com.mysql.jdbc.Driver</value></property>
    
           <property name="url"><value>jdbc:mysql:///test_01</value></property>
    
           <property name="username"><value>root</value></property>
    
           <property name="password"><value>root</value></property>
    
        </bean>
    
    
    
        <bean id="MD5PasswordEncoder" class="org.jasig.cas.authentication.handler.DefaultPasswordEncoder">
    
            <constructor-arg index="0">
    
            <value>MD5</value>
    
            </constructor-arg>
    
        </bean>

复制cas-server-3.4.3.1\\modules\\cas-server-support-jdbc-3.4.3.1.jar和MySQL驱动jar包到tomcat/webapp/cas/WEB-INF/lib目录

参数说明:  
QueryDatabaseAuthenticationHandler，是cas-server-support-jdbc提供的查询接口其中一个，QueryDatabaseAuthenticationHandler是通过配置一个 SQL 语句查出密码，与所给密码匹配

dataSource,我就不用解释了吧，就是使用JDBC查询时的数据源

sql，语句就是查询哪一张表，本例根据t\_admin\_user表的login\_name字段查询密码，CAS会匹配用户输入的密码，如果匹配则通过；  
QueryDatabaseAuthenticationHandler，是cas-server-support-jdbc提供的查询接口其中一个，QueryDatabaseAuthenticationHandler是通过配置一个 SQL 语句查出密码，与所给密码匹配

dataSource,使用JDBC查询时的数据源

sql，语句就是查询哪一张表，CAS会匹配用户输入的密码，如果匹配则通过；

CAS客户端配置  
添加cas-client的

<groupid>org.jasig.cas.client</groupid>
    
    <artifactid>cas-client-core</artifactid>
    
    <version>3.1.12</version>

包，有两种方式：

使用jar包  
解压`cas-client-3.3.3-release.zip`,在modules文件夹中有需要的jar包，请根据自己的项目情况选择使用 ,然后从target目录中复制cas-client-core-3.2.1.jar到应用的WEB-INF/lib目录中（Pom中添加了即可省略）

maven  
导入依赖

<dependency>
    
        <groupid>org.jasig.cas.client</groupid>
    
        <artifactid>cas-client-core</artifactid>
    
        <version>3.1.12</version>
    
    </dependency>

设置过滤器  
在web.xml文件中加入下面这段代码

<listener>
    
    <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
    
    </listener>
    
    
    
    
    
    <filter>
    
    <filter-name>CAS
     Single Sign Out Filter</filter-name>
    
    <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
    
    </filter>
    
    <filter-mapping>
    
    <filter-name>CAS
     Single Sign Out Filter</filter-name>
    
    <url-pattern>/*</url-pattern>
    
    </filter-mapping>
    
    
    
    
    
    <filter>
    
    <filter-name>CASFilter</filter-name>
    
    <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
    
    <init-param>
    
    <param-name>casServerLoginUrl</param-name>
    
    <param-value>https://www.taotao.com:8443/cas/login</param-value>
    
    
    
    </init-param>
    
    <init-param>
    
    <param-name>serverName</param-name>
    
    <param-value>http://localhost:10000</param-value>
    
    </init-param>
    
    </filter>
    
    <filter-mapping>
    
    <filter-name>CASFilter</filter-name>
    
    <url-pattern>/*</url-pattern>
    
    </filter-mapping>
    
    
    
    
    
    <filter>
    
    <filter-name>CAS
     Validation Filter</filter-name>
    
    <filter-class>
    
    org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
    
    <init-param>
    
    <param-name>casServerUrlPrefix</param-name>
    
    <param-value>https://www.taotao.com:8443/cas</param-value>
    
    </init-param>
    
    <init-param>
    
    <param-name>serverName</param-name>
    
    <param-value>http://localhost:10000</param-value>
    
    </init-param>
    
    </filter>
    
    <filter-mapping>
    
    <filter-name>CAS
     Validation Filter</filter-name>
    
    <url-pattern>/*</url-pattern>
    
    </filter-mapping>
    
    
    
    
    
    <filter>
    
    <filter-name>CAS
     HttpServletRequest Wrapper Filter</filter-name>
    
    <filter-class>
    
    org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
    
    </filter>
    
    <filter-mapping>
    
    <filter-name>CAS
     HttpServletRequest Wrapper Filter</filter-name>
    
    <url-pattern>/*</url-pattern>
    
    </filter-mapping>
    
    
    
    
    
    <filter>
    
    <filter-name>CAS
     Assertion Thread Local Filter</filter-name>
    
    <filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class>
    
    </filter>
    
    <filter-mapping>
    
    <filter-name>CAS
     Assertion Thread Local Filter</filter-name>
    
    <url-pattern>/*</url-pattern>
    
    </filter-mapping>
    
    
    
    
    
    <filter>
    
    <display-name>AutoSetUserAdapterFilter</display-name>
    
    <filter-name>AutoSetUserAdapterFilter</filter-name>
    
    <filter-class>com.wsria.demo.filter.AutoSetUserAdapterFilter</filter-class>
    
    </filter>
    
    <filter-mapping>
    
    <filter-name>AutoSetUserAdapterFilter</filter-name>
    
    <url-pattern>/*</url-pattern>
    
    </filter-mapping>

AutoSetUserAdapterFilter的作用和原理:

利用AutoSetUserAdapterFilter自动根据CAS信息设置Session的用户信息

主要是通过CAS的const\_cas\_assertion获取从CAS服务器登陆的用户名，然后再根据系统内部的用户工具（UserUtil.java）来判断是否已经登录过，如果没有登录根据登录名从数据库查询用户信息，最后使用设置把用户信息设置到当前session中。 这样就把用户信息保存到了Sessino中，我们就可以通过UserUtil工具来获取当前登录的用户了

单点退出

把你的退出链接设置为：https://www.taotao.com:8443/cas/logout

CAS服务器界面  
CAS服务端(cas-server)的界面只能在测试的时候用一下，真正项目上肯定需要开发自己的页面，就像网易和CSDN的统一认证平台一样，所有子系统的认证都通过此平台来转接，大家可以根据他们的页面自己定制出适合所属应用或者公司的界面；简单介绍一下吧，复制 cas\\WEB-INF\\view\\jsp\\default\\ui的一些JSP文件，每一个文件的用途文件名已经区分了，自己修改了替换一下就可以了。 例如：

登录界面：casLoginView.jsp  
登录成功：casGenericSuccess.jsp  
登出界面：casLogoutView.jsp

疑难问题  
错误:

javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching casserver found

由于创建证书的域名和在应用中配置的cas服务域名不一致导致以下错误，详细请参考：

由于创建证书的域名和在应用中配置的cas服务域名不一致导致以下错误：
    SEVERE: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching casserver found
    javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching casserver found
        at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1731)
        at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241)
        at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136)
        at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
        at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:925)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1170)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1197)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1181)
        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434)
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166)
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1172)
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:234)
        at org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:35)
        at org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:178)
        at org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:132)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.jasig.cas.client.authentication.AuthenticationFilter.doFilter(AuthenticationFilter.java:111)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.jasig.cas.client.session.SingleSignOutFilter.doFilter(SingleSignOutFilter.java:99)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
        at java.lang.Thread.run(Thread.java:662)
    Caused by: java.security.cert.CertificateException: No name matching casserver found
        at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:210)
        at sun.security.util.HostnameChecker.match(HostnameChecker.java:77)
        at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:264)
        at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:250)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1185)
        ... 32 more
    Feb 1, 2012 10:01:28 PM org.jasig.cas.client.validation.AbstractTicketValidationFilter doFilter
    WARNING: org.jasig.cas.client.validation.TicketValidationException: The CAS server returned no response.
    org.jasig.cas.client.validation.TicketValidationException: The CAS server returned no response.
        at org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:181)
        at org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:132)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.jasig.cas.client.authentication.AuthenticationFilter.doFilter(AuthenticationFilter.java:111)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.jasig.cas.client.session.SingleSignOutFilter.doFilter(SingleSignOutFilter.java:99)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
        at java.lang.Thread.run(Thread.java:662)

[http_www.verisign.com_cn]: http://www.verisign.com/cn/
[SouthEast]: /images/20220609/c3ddb155a2d04fedb83fb97018adc364.png
[SouthEast 1]: /images/20220609/5439d4b65b644d77a58793a42c548fe6.png
[SouthEast 2]: /images/20220609/cea921f7972042fba2506bb96ec27eb3.png
[https_www.taotao.com_8443_cas_login]: https://www.taotao.com:8443/cas/login
[SouthEast 3]: /images/20220609/50fe824d4fe14f9693d08461d488618c.png
[SouthEast 4]: /images/20220609/f73198c605004542adc1bcb41b50b9bc.png