秦天杰
- 浏览: 10832 次
- 性别:
- 来自: 北京
-
文章分类
最新评论
一、CAS 基本原理 （3，4，5，9.2，9.3是主要步骤）
第一次访问：
1. 浏览器
发起访问WebAPP 请求: http://www.web.com/app
2. 客户端
AuthenticationFilter Filter 发现Session中无 Assertion,且URL中无 ticket 变量。生成 service url 变量，并重定向到： https://www.cas-server.com/cas/login?service=http://www.web.com/app
3. CAS server
生成 Login ticket， service 对象，并展示 login 页面，默认提供 username / password 给用户验证。
4. CAS server
端，用户输入 username / password 验证，若通过则生成TGT，存入服务器段（默认为 Map 类型的 cache），同时将TGT id 作为 content创建 cookie 并发送到浏览器。
5. CAS server
端通过TGT 生成service ticket. 重定向到 http://www.web.com/app?ticket=ST-xxx
6. 客户端
访问 http://www.web.com/app?ticket=ST-xxx
7. 客户端
AuthenticationFilter Filter 发现URL中有 ticket, 跳过 AuthenticationFilter过滤器，到达 Cas20ProxyReceivingTicketValidationFilter过滤器。
8. 客户端
生成验证 service url: http://www.web.com/app
9. 客户端
Cas20ProxyReceivingTicketValidationFilter 过滤器，使用6处的ticket 与8处的 service 作为参数验证。
9.1 客户端
生成验证 servlet: https://www.cas-server.com/cas/serviceValidate?ticket=ST-xxx&service=http://www.web.com/app
9.2 客户端
通过HttpClient访问 9.1 的 url
注：AbstractUrlBasedTicketValidator.java line 207，如果是用CAS ptotocol验证，则第二个参数 ticket无用。
得到如下形式的 response:
546 <cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'> 547 <cas:authenticationSuccess> 548 <cas:user>jack</cas:user> 549 550 551 </cas:authenticationSuccess> 552 </cas:serviceResponse>
9.3 客户端 解析 response 字符串，生成 assertion (包含 username, validate info 等)
9.4 客户端 设置 assertion 为 request 的 _const_cas_assertion_ 属性。
9.5 客户端
如果设置了重定向属性，则重定向到 http://www.web.com/app -- 转步骤10
否则继续执行以后的 filter，通过servlet 访问 http://www.web.com/app 服务，结束CAS的验证。
用户已成功登录，非第一次访问：
10. 客户端 通过重定向访问 http://www.web.com/app
11. 客户端 AuthenticationFilter Filter 发现 session 中有Assertion， 结束本过滤器，转移到下一个过滤器 Cas20ProxyReceivingTicketValidationFilter.
12. 客户段 Cas20ProxyReceivingTicketValidationFilter 发现 本次访问的URL 无 ticket，结束本次过滤，转移到下一个过滤器，继续执行以后的 filter，通过servlet 访问 http://www.web.com/app 服务。
二 源码解析
1. 客户端 web.xml 片段：
... <filter> <filter-name>CAS Authentication Filter</filter-name> <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class> <init-param> <param-name>casServerLoginUrl</param-name> <param-value>https://www.colorcc.com:8443/cas/login</param-value> </init-param> <init-param> <param-name>serverName</param-name> <param-value>http://localhost:8080</param-value> </init-param> </filter> <filter> <filter-name>CAS Validation Filter</filter-name> <filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class> <init-param> <param-name>casServerUrlPrefix</param-name> <param-value>https://www.colorcc.com:8443/cas</param-value> </init-param> <init-param> <param-name>serverName</param-name> <param-value>http://localhost:8080</param-value> </init-param> <!-- <init-param> <param-name>redirectAfterValidation</param-name> <param-value>false</param-value> </init-param> --> </filter> <filter-mapping> <filter-name>CAS Authentication Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <filter-mapping> <filter-name>CAS Validation Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> ...
2. AuthenticationFilter 代码:
public final void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse, final FilterChain filterChain) throws IOException, ServletException {
final HttpServletRequest request = (HttpServletRequest) servletRequest;
final HttpServletResponse response = (HttpServletResponse) servletResponse;
final HttpSession session = request.getSession(false);
final Assertion assertion = session != null ? (Assertion) session.getAttribute(CONST_CAS_ASSERTION) : null;
// 如果 session 中有 assertion，则结束 authentication 过滤器，直接跳到下一个过滤器
if (assertion != null) {
filterChain.doFilter(request, response);
return;
}
// 2.1 如果 session 中无 assertion, 则构造 service, 如 http://www.web.com/a1
final String serviceUrl = constructServiceUrl(request, response);
final String ticket = CommonUtils.safeGetParameter(request,getArtifactParameterName());
final boolean wasGatewayed = this.gatewayStorage.hasGatewayedAlready(request, serviceUrl);
// 如果 request 中有 ticke变量，则结束本过滤器，直接跳到下一个过滤器
if (CommonUtils.isNotBlank(ticket) || wasGatewayed) {
filterChain.doFilter(request, response);
return;
}
final String modifiedServiceUrl;
log.debug("no ticket and no assertion found");
if (this.gateway) {
log.debug("setting gateway attribute in session");
modifiedServiceUrl = this.gatewayStorage.storeGatewayInformation(request, serviceUrl);
} else {
modifiedServiceUrl = serviceUrl;
}
if (log.isDebugEnabled()) {
log.debug("Constructed service url: " + modifiedServiceUrl);
}
// 2.2 否则构造重定向 URL， 其中 casServerLoginUrl 为 web.xml 中 filter 配置，eg: https://www.cas-server.com/cas/login?service=http://www.web.com/a1
final String urlToRedirectTo = CommonUtils.constructRedirectUrl(this.casServerLoginUrl, getServiceParameterName(), modifiedServiceUrl, this.renew, this.gateway);
if (log.isDebugEnabled()) {
log.debug("redirecting to \"" + urlToRedirectTo + "\"");
}
// 2.3 重定向到 CAS server
response.sendRedirect(urlToRedirectTo);
}
2.1 构造 service url: http://www.web.com/a1
protected final String constructServiceUrl(final HttpServletRequest request, final HttpServletResponse response) {
return CommonUtils.constructServiceUrl(request, response, this.service, this.serverName, this.artifactParameterName, this.encodeServiceUrl);
}
3. 重定向URL： https://www.cas-server.com/cas/login?service=http://www.web.com/a1, 其中 cas server的 web.xml：
<servlet>
<servlet-name>cas</servlet-name>
<servlet-class>
org.jasig.cas.web.init.SafeDispatcherServlet
</servlet-class>
<init-param>
<param-name>publishContext</param-name>
<param-value>false</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>cas</servlet-name>
<url-pattern>/login</url-pattern>
</servlet-mapping>
3.1 SafeDispatcherServlet 使用 Spring DispatcherServlet 作为 delegate
public final class SafeDispatcherServlet extends HttpServlet {
// 定义 Spring DispatcherServlet 作为 delegate
private DispatcherServlet delegate = new DispatcherServlet();
// 使用 delegate 初始化 servlet
public void init(final ServletConfig config) {
try {
this.delegate.init(config);
} catch (final Throwable t) {
...
// 使用 delegate 的 service 执行 web 操作
public void service(final ServletRequest req, final ServletResponse resp)
throws ServletException, IOException {
if (this.initSuccess) {
this.delegate.service(req, resp);
} else {
throw new ApplicationContextException(
"Unable to initialize application context.");
}
}
3.2 cas-servlet.xml 配置文件如下, 可以看到 login 对应的 webflow 为： login-webflow.xml
<webflow:flow-registry id="flowRegistry" flow-builder-services="builder">
<webflow:flow-location path="/WEB-INF/login-webflow.xml" id="login"/>
</webflow:flow-registry>
3.3 根据 login-webflow.xml 配置文件(结合 cas-servlet.xml)：
<on-start>
<evaluate expression="initialFlowSetupAction" />
</on-start>
<bean id="initialFlowSetupAction" class="org.jasig.cas.web.flow.InitialFlowSetupAction"
p:argumentExtractors-ref="argumentExtractors"
p:warnCookieGenerator-ref="warnCookieGenerator"
p:ticketGrantingTicketCookieGenerator-ref="ticketGrantingTicketCookieGenerator"/>
3.4 InitialFlowSetupAction
protected Event doExecute(final RequestContext context) throws Exception {
final HttpServletRequest request = WebUtils.getHttpServletRequest(context);
if (!this.pathPopulated) {
final String contextPath = context.getExternalContext().getContextPath();
final String cookiePath = StringUtils.hasText(contextPath) ? contextPath + "/" : "/";
logger.info("Setting path for cookies to: "
+ cookiePath);
this.warnCookieGenerator.setCookiePath(cookiePath);
this.ticketGrantingTicketCookieGenerator.setCookiePath(cookiePath);
this.pathPopulated = true;
}
// 给 FlowScope 的设置 ticketGrantingTicketId, warnCookieValue 参数
context.getFlowScope().put(
"ticketGrantingTicketId", this.ticketGrantingTicketCookieGenerator.retrieveCookieValue(request));
context.getFlowScope().put("warnCookieValue",
Boolean.valueOf(this.warnCookieGenerator.retrieveCookieValue(request)));
// 3.4.1 抽取 service 参数
final Service service = WebUtils.getService(this.argumentExtractors, context);
if (service != null && logger.isDebugEnabled()) {
logger.debug("Placing service in FlowScope: " + service.getId());
}
// 给 FlowScope 的设置 service 参数
context.getFlowScope().put("service", service);
return result("success");
}
3.4.1 WebApplicationService.getService
public static WebApplicationService getService(
final List<ArgumentExtractor> argumentExtractors,
final HttpServletRequest request) {
for (final ArgumentExtractor argumentExtractor : argumentExtractors) {
// 3.4.1.1 通过配置的 argumentExtractor 抽取 service
final WebApplicationService service = argumentExtractor.extractService(request);
if (service != null) {
return service;
}
}
return null;
}
3.4.1.1 CasArgumentExtractor 代码
public final class CasArgumentExtractor extends AbstractSingleSignOutEnabledArgumentExtractor {
public final WebApplicationService extractServiceInternal(final HttpServletRequest request) {
return SimpleWebApplicationServiceImpl.createServiceFrom(request, getHttpClientIfSingleSignOutEnabled());
}
}
// SimpleWebApplicationServiceImpl
private static final String CONST_PARAM_SERVICE = "service";
private static final String CONST_PARAM_TARGET_SERVICE = "targetService";
private static final String CONST_PARAM_TICKET = "ticket";
private static final String CONST_PARAM_METHOD = "method";
public static SimpleWebApplicationServiceImpl createServiceFrom(
final HttpServletRequest request, final HttpClient httpClient) {
final String targetService = request
.getParameter(CONST_PARAM_TARGET_SERVICE);
final String method = request.getParameter(CONST_PARAM_METHOD);
final String serviceToUse = StringUtils.hasText(targetService)
? targetService : request.getParameter(CONST_PARAM_SERVICE);
if (!StringUtils.hasText(serviceToUse)) {
return null;
}
final String id = cleanupUrl(serviceToUse);
final String artifactId = request.getParameter(CONST_PARAM_TICKET);
return new SimpleWebApplicationServiceImpl(id, serviceToUse,
artifactId, "POST".equals(method) ? ResponseType.POST
: ResponseType.REDIRECT, httpClient);
}
private SimpleWebApplicationServiceImpl(final String id,
final String originalUrl, final String artifactId,
final ResponseType responseType, final HttpClient httpClient) {
super(id, originalUrl, artifactId, httpClient);
this.responseType = responseType;
}
protected AbstractWebApplicationService(final String id, final String originalUrl, final String artifactId, final HttpClient httpClient) {
this.id = id;
this.originalUrl = originalUrl;
this.artifactId = artifactId;
this.httpClient = httpClient;
}
3. Cas20ProxyReceivingTicketValidationFilter 及 AbstractTicketValidationFilter代码：
public final void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse, final FilterChain filterChain) throws IOException, ServletException {
if (!preFilter(servletRequest, servletResponse, filterChain)) {
return;
}
final HttpServletRequest request = (HttpServletRequest) servletRequest;
final HttpServletResponse response = (HttpServletResponse) servletResponse;
final String ticket = CommonUtils.safeGetParameter(request, getArtifactParameterName());
// 如果 URL 中包含 ticket 参数，则执行 service 验证工作
if (CommonUtils.isNotBlank(ticket)) {
if (log.isDebugEnabled()) {
log.debug("Attempting to validate ticket: " + ticket);
}
try {
final Assertion assertion = this.ticketValidator.validate(ticket, constructServiceUrl(request, response));
if (log.isDebugEnabled()) {
log.debug("Successfully authenticated user: " + assertion.getPrincipal().getName());
}
request.setAttribute(CONST_CAS_ASSERTION, assertion);
if (this.useSession) {
request.getSession().setAttribute(CONST_CAS_ASSERTION, assertion);
}
onSuccessfulValidation(request, response, assertion);
if (this.redirectAfterValidation) {
log. debug("Redirecting after successful ticket validation.");
response.sendRedirect(constructServiceUrl(request, response));
return;
}
} catch (final TicketValidationException e) {
response.setStatus(HttpServletResponse.SC_FORBIDDEN);
log.warn(e, e);
onFailedValidation(request, response);
if (this.exceptionOnValidationFailure) {
throw new ServletException(e);
}
return;
}
}
// 如果不包含 ticket， 直接跳过CAS Filter验证，继续其他 filter 或 web app 操作
filterChain.doFilter(request, response);
}
- 大小: 228.1 KB
分享到：
发表评论
相关推荐
java.proxy,代理模式源码,设计模式,apache开源项目源码commons-proxy-1.0-src 各种代理模式操作的工具类源码以及代理模式案例源码，你会从中得到意想不到的效果! apache开源组织开发的开源项目源码，其优良的代码...
cas-proxy配置相关文档，文档内含详细配置方式
Proxy 模式学习代码，包括静态代理，动态代理，cglib等
到工厂方法到抽象工厂，这几种都带有“工厂”的模式，总是容易叫人迷糊，我仔细研究了下，然后用简单的例子做类比，列出了自己的通俗理解和比较，大部分是自己的体会，感觉理的比较清楚，末尾提了下Proxy模式。
安卓Android源码——TorProxy和Shadow开源项目.zip
这段代码虽然只是描述了最简单的proxy操作，但它的确是经典，它不仅清晰地描述了客户机/服务器系统的概念，而且几乎包括了Linux网络编程的方方面面，非常适合Linux网络编程的初学者学习。 这段Proxy程序的用法是...
linux 网络编程 Proxy源代码分析 经典代码
设计模式C++学习之代理模式（Proxy）
MySQL数据库中间件：基于C语言开发，包含59个文件，包括22个C源文件...该项目是一个分布式MySQL数据库中间件，采用Proxy模式设计，基于核心业务对象切分，旨在提供高效的数据库查询和处理能力，适用于分布式系统环境。
java 动态代理Proxy应用和底层源码分析.pdf
23种设计模式之十二（结构型模式）Proxy模式
cas 配置client 1.0 &2.0 及proxy DEMO 说明 1 cas server 搭建 1.1 资源准备 cas server 下载 http://www.ja-sig.org/downloads/cas/cas-server-3.3.1-release.zip 1.2 解压后打开cas-server-3.3.1-release\cas-...
http proxy源码 vc++
代码仅供参考学习 。
JAVA Proxy 代理模式
httpProxy，http/https代理服务器的源码，VC编译测试通过
Android源码——TorProxy和Shadow开源项目.zip
Tftp ProxyServer 代理服务器 源码 *=========================================================================== * * Project: tftp_proxy, a proxy for TFTP transfers through firewalls * File: tftp_...
Spring源代码分析(三)：Spring JDBC Spring源代码解析(四)：Spring MVC Spring源代码解析(五）：Spring AOP获取Proxy Spring源代码解析(六）：Spring声明式事务处理 Spring源代码解析（七）：Spring AOP中对拦截器...