简单的单点登陆系统分析

港控/mmm° 2023-06-21 14:28 50阅读 0赞

前言：在公司的系统中用到了单点登陆，虽然看懂了代码但是隔几天再看又是一头雾水，所以总结一下。

参考：[https://www.cnblogs.com/Eleven-Liu/p/10336181.html][https_www.cnblogs.com_Eleven-Liu_p_10336181.html](极好)

**目录**

第一章 单点登陆简析

第二章 系统概要

第三章 LoginAuthenticationFilter

第四章 TicketValidationFilter

第五章 UserAdapterFilterRegistration

第六章 前后端分离项目单点登陆的设计

# 第一章 单点登陆简析 #

![format_png][]

1.用户请求CAS客服端（服务）

2.CAS客户端检验没登陆，重定向用户请求到，CAS服务器

3.CAS服务器返回给用户登陆界面，用户在登陆界面进行登陆

4.CAS服务器产生凭证ticket，并重定向用户请求到CAS客户端。

5.CAS接受到请求中的ticket后，发送ticket到CAS服务端进行验证。

6.CAS服务器验证通过，返回用户的用户名到CAS客户端，并在CAS客户端设置session，用户登陆成功。

# 第二章 系统概要 #

公司系统中用到的单点登录必选配置主要有三个，通过过滤器进行注册，先后顺序为：

LoginAuthenticationFilter->TicketValidationFilter->UserAdapterFilter

系统会依次经过三个过滤器，LoginAuthenticationFilter、TicketValidationFilter、UserAdapterFilter，然后就可以访问我们需要访问的请求了。

下面是三个过滤器的配置

@Configuration
    public class WebSecurityConfigurer {
    	
    	@Value("${service.domain}")
    	private String domain;
    
        /**
         * 第一步：该过滤器负责用户的认证工作，必须启用它；serverName中填写第三方应用所在服务器的连接地址
         * @return
         */
    	@Bean
        public FilterRegistrationBean casFilterRegistration() {
    
            FilterRegistrationBean registration = new FilterRegistrationBean();
    
            registration.setFilter(new LoginAuthenticationFilter());
            registration.addInitParameter("casServerLoginUrl","https://sso.xxxx.com/cas/login");
            registration.addInitParameter("serverName",domain);
            registration.addUrlPatterns("/*");//
            return registration;
        }
    
        /**
         * 该过滤器负责对Ticket的校验工作，必须启用它;serverName中填写第三方应用所在服务器的连接地址
         * @return
         */
        @Bean
        public FilterRegistrationBean casValidationFilterRegistration() {
    
            FilterRegistrationBean registration = new FilterRegistrationBean();
    
            registration.setFilter(new TicketValidationFilter());
            registration.addInitParameter("casServerUrlPrefix","https://sso.xxxx.com/cas");
            registration.addInitParameter("serverName",domain);
            registration.addUrlPatterns("/*");
    
            return registration;
        }
    
    
        /**
         * 初始化cookie
         * @return
         */
        @Bean
        public FilterRegistrationBean UserAdapterFilterRegistration() {
    
            FilterRegistrationBean registration = new FilterRegistrationBean();
    
            registration.setFilter(new UserAdapterFilter());
            registration.addUrlPatterns("/*");
    
            return registration;
        }
        
    }

# 第三章 LoginAuthenticationFilter #

现在开始看第一个过滤器LoginAuthenticationFilter。

如果我们的请求是以apis打头的，表明不需要经过权限校验可以直接放行到下一个过滤器。

如果不是以apis打头的则在request中查找用户的邮箱（即用户名），先从cookie中进行检索，再从session中进行检索（代码2）

如果都获取不到，则进入AuthenticationFilter中

代码1：

public class LoginAuthenticationFilter extends AbstractConfigurationFilter {
        private AuthenticationFilter filter = new AuthenticationFilter();
    
        @Override
        public void init(FilterConfig filterConfig) throws ServletException {
            filter.init(filterConfig);
        }
    
        @Override
        public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        	HttpServletRequest httpRequest = (HttpServletRequest)request;
        	if(httpRequest.getRequestURI().startsWith("/apis/")) {
        		chain.doFilter(request, response);
        	} else {
        		String email = UserAdapterFilter.getEmail((HttpServletRequest)request);
        		if(StringUtils.isBlank(email)) {
        			filter.doFilter(request, response, chain);
        		} else {
        			chain.doFilter(request, response);
        		}
        	}       
        }
    
        @Override
        public void destroy() {
            filter.destroy();
        }
        
    }

代码2：

public static String getEmail(HttpServletRequest request) {
            Cookie cookie = CookieUtil.getCookie(request, Constant.AUTH_COOKIE);
            if(cookie != null) {
                AuthCookie authCookie = AuthCookieUtil.decodeAuthCookie(cookie.getValue());
                if(authCookie != null) {
                    return authCookie.email;
                }
            }
            Object object = request.getSession().getAttribute(AbstractCasFilter.CONST_CAS_ASSERTION);
            if(object != null) {
                Assertion assertion = (Assertion) object;
                String loginEmail = assertion.getPrincipal().getName();
                return loginEmail;
            }
            return null;
        }

在AuthenticationFilter中，先尝试从session中查找用户，有的话则直接进入下一个过滤器，

如果session中没有用户，则尝试从request中获取ticket，如果有则进入下一个过滤器。

如果没有，重定向到CAS服务器中，CAS服务器会根据用户的情况返回登陆页面，等确认用户登陆后，会将携带ticket的用户请求重定向到CAS客户端（即我们当前的应用）中。

代码3：

public final void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse, final FilterChain filterChain) throws IOException, ServletException {
            final HttpServletRequest request = (HttpServletRequest) servletRequest;
            final HttpServletResponse response = (HttpServletResponse) servletResponse;
            final HttpSession session = request.getSession(false);
            final Assertion assertion = session != null ? (Assertion) session.getAttribute(CONST_CAS_ASSERTION) : null;
    
            if (assertion != null) {
                filterChain.doFilter(request, response);
                return;
            }
    
            final String serviceUrl = constructServiceUrl(request, response);
            final String ticket = CommonUtils.safeGetParameter(request,getArtifactParameterName());
            final boolean wasGatewayed = this.gatewayStorage.hasGatewayedAlready(request, serviceUrl);
    
            if (CommonUtils.isNotBlank(ticket) || wasGatewayed) {
                filterChain.doFilter(request, response);
                return;
            }
    
            final String modifiedServiceUrl;
    
            log.debug("no ticket and no assertion found");
            if (this.gateway) {
                log.debug("setting gateway attribute in session");
                modifiedServiceUrl = this.gatewayStorage.storeGatewayInformation(request, serviceUrl);
            } else {
                modifiedServiceUrl = serviceUrl;
            }
    
            if (log.isDebugEnabled()) {
                log.debug("Constructed service url: " + modifiedServiceUrl);
            }
    
            final String urlToRedirectTo = CommonUtils.constructRedirectUrl(this.casServerLoginUrl, getServiceParameterName(), modifiedServiceUrl, this.renew, this.gateway);
    
            if (log.isDebugEnabled()) {
                log.debug("redirecting to \"" + urlToRedirectTo + "\"");
            }
    
            response.sendRedirect(urlToRedirectTo);
        }

# 第四章 TicketValidationFilter #

这个前面和LoginAuthenticationFilter一样，不是以/apis打头且检测不到用户邮箱后，会进入Cas20ProxyReceivingTicketValidationFilter中。

public class TicketValidationFilter extends AbstractConfigurationFilter {
        private final Cas20ProxyReceivingTicketValidationFilter filter = new Cas20ProxyReceivingTicketValidationFilter();
    
        @Override
        public void init(FilterConfig filterConfig) throws ServletException {
            filter.init(filterConfig);
        }
    
        @Override
        public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
            HttpServletRequest httpRequest = (HttpServletRequest)request;
            if(httpRequest.getRequestURI().startsWith("/apis/")) {
                filterChain.doFilter(request, response);
            } else {
                String email = UserAdapterFilter.getEmail((HttpServletRequest)request);
                if(StringUtils.isBlank(email)) {
                    filter.doFilter(request, response, filterChain);
                } else {
                    filterChain.doFilter(request, response);
                }
            }
        }
    
        @Override
        public void destroy() {
            filter.destroy();
        }
    }

在此filter（代码4）中主要进行ticket的校验，如果校验（校验代码见代码5）成功则生成包含用户名的session，在这里是Assertion，如果不成功则会抛出异常，response则会设置返回状态为403，然后不再向下一个过滤器走。

代码：4

public final void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse, final FilterChain filterChain) throws IOException, ServletException {
    
            if (!preFilter(servletRequest, servletResponse, filterChain)) {
                return;
            }
    
            final HttpServletRequest request = (HttpServletRequest) servletRequest;
            final HttpServletResponse response = (HttpServletResponse) servletResponse;
            final String ticket = CommonUtils.safeGetParameter(request, getArtifactParameterName());
    
            if (CommonUtils.isNotBlank(ticket)) {
                if (log.isDebugEnabled()) {
                    log.debug("Attempting to validate ticket: " + ticket);
                }
    
                try {
                    final Assertion assertion = this.ticketValidator.validate(ticket, constructServiceUrl(request, response));
    
                    if (log.isDebugEnabled()) {
                        log.debug("Successfully authenticated user: " + assertion.getPrincipal().getName());
                    }
    
                    request.setAttribute(CONST_CAS_ASSERTION, assertion);
    
                    if (this.useSession) {
                        request.getSession().setAttribute(CONST_CAS_ASSERTION, assertion);
                    }
                    onSuccessfulValidation(request, response, assertion);
    
                    if (this.redirectAfterValidation) {
                        log. debug("Redirecting after successful ticket validation.");
                        response.sendRedirect(constructServiceUrl(request, response));
                        return;
                    }
                } catch (final TicketValidationException e) {
                    response.setStatus(HttpServletResponse.SC_FORBIDDEN);
                    log.warn(e, e);
    
                    onFailedValidation(request, response);
    
                    if (this.exceptionOnValidationFailure) {
                        throw new ServletException(e);
                    }
    
                    return;
                }
            }
    
            filterChain.doFilter(request, response);
    
        }

代码5：

public Assertion validate(final String ticket, final String service) throws TicketValidationException {
    
    
            final String validationUrl = constructValidationUrl(ticket, service);
            if (log.isDebugEnabled()) {
                log.debug("Constructing validation url: " + validationUrl);
            }
    
            try {
            	log.debug("Retrieving response from server.");
                final String serverResponse = retrieveResponseFromServer(new URL(validationUrl), ticket);
    
                if (serverResponse == null) {
                    throw new TicketValidationException("The CAS server returned no response.");
                }
                
                if (log.isDebugEnabled()) {
                	log.debug("Server response: " + serverResponse);
                }
    
                return parseResponseFromServer(serverResponse);
            } catch (final MalformedURLException e) {
                throw new TicketValidationException(e);
            }
        }

# 第五章 UserAdapterFilterRegistration #

用户的ticket通过校验或者能从cookie或ession中读取到邮箱才能进入到此过滤器，换句话中也就是说**通过校验即已登陆的用户才能到此过滤器中**。

在上一个TicketValidationFilter中我们生成了session，此filter检测是否有cookie，没有的话进行cookie的初始化，我们根据用户名获取用户的信息，根据用户的信息生成cookie，以方便以后对用户信息的使用。

@Component
    public class UserAdapterFilter extends OncePerRequestFilter {
    
        @Override
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        	if(request.getRequestURI().startsWith("/apis")) {
        		filterChain.doFilter(request, response);
        		return;
        	}
        	
        	String email = getEmail(request);
        	if(StringUtils.isBlank(email)) {
        		logger.info("userAdapterFilter email is null , redirect login");
        	}
        	
        	User user = UserUtil.getUser(email);
        	if(user == null) {
        		logger.error("currentUser is not exist ! ");
        	} else if(CookieUtil.getCookie(request, Constant.AUTH_COOKIE) == null) {
        		String authCookie =AuthCookieUtil.encodeAuthCookie(user.getUid(), user.getEmail(), IPUtil.getClientIp(request));
        		CookieUtil.genCookie(response, Constant.AUTH_COOKIE, authCookie ,Constant.AUTH_EXPIRE);
        	}
            filterChain.doFilter(request, response);           
        }
    
        //...略
    
    }

# 第六章 前后端分离项目单点登陆的设计 #

之前做的是前后端不分离的项目，在后端访问不到，也就不会接收到后端返回过来的前端，自然前端也访问不到，但是前后端分离的项目即使后端访问不到，前端也会访问的到，axios访问的话总是重定向失败，显示不能跨域。

所以我构思了个方法，仅仅推测可用，不一定正确。

从上面可以看出，前缀为/apis的路径是不需要权限校验的，所以我们将无需权限校验的服务写成/apis，需要权限校验的服务写成别的，这样未登陆的用户就不能访问需要校验权限的路径了，可以保证后端的安全。

前端呢，我们可以将一个公共组件的create部分设置一个请求方法，判断用户是否登陆，如果没有登陆，直接携带domain跳转到登陆页面（按CAS请求规则携带，确保CAS知道是从哪个页面请求过来的），这样我们登陆后根据前面描述的CAS服务器便会重定向我们的请求到domain页面上，实现登陆。

例如这里我们的domain就是在service后面，表明我们是请求此domain不能登陆被重定向过来的。

[https://sso.xxxx.com/cas/login?service=http%3A%2F%2Frecall.zongheng.xxxx.domain][https_sso.xxxx.com_cas_login_service_http_3A_2F_2Frecall.zongheng.xxxx.domain]

[https_www.cnblogs.com_Eleven-Liu_p_10336181.html]: https://www.cnblogs.com/Eleven-Liu/p/10336181.html
[format_png]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWcyMDE4LmNuYmxvZ3MuY29tL2Jsb2cvMTIwMTM3NS8yMDE5MDEvMTIwMTM3NS0yMDE5MDEyOTIyMjA1MjUxMi0xNDM1ODA1ODk5LnBuZw?x-oss-process=image/format,png
[https_sso.xxxx.com_cas_login_service_http_3A_2F_2Frecall.zongheng.xxxx.domain]: https://sso.qiyi.com/cas/login?service=http%3A%2F%2Frecall.zongheng.qiyi.domain