CAS 服務端部署 部分配置
阿新 • • 發佈：2019-01-08
使用的版本是 CAS-4.1.0（文後附有需要修改的完整程式碼）
一、修改使用HTTP連線
1、在cas-server-webapp中的/WEB-INF/spring-configuration/ticketGrantingTicketCookieGenerator.xml檔案中有如下配置：
<!--cookieSecure 是否啟用https-->
<bean id="ticketGrantingTicketCookieGenerator" class="org.jasig.cas.web.support.CookieRetrievingCookieGenerator" 將p:cookieSecure="true" 修改為false
2、/WEB-INF/spring-configuration/warnCookieGenerator.xml檔案中有如下配置：
<bean id="warnCookieGenerator" 同樣將p:cookieSecure="true" 修改為false
3、在/resources/services/HTTPSandIMAPS-10000001.json中serviceId節點新增|http， 新增後如下：
{
"@class": "org.jasig.cas.services.RegexRegisteredService",
"serviceId": "^(https|imaps|http)://.*",
"name": "HTTPS and IMAPS and http",
"id": 10000001,
"description": "This service definition authorized all application urls that support HTTPS and IMAPS protocols.",
"proxyPolicy": {
"@class": "org.jasig.cas.services.RefuseRegisteredServiceProxyPolicy"
},
"evaluationOrder": 0,
"usernameAttributeProvider": {
"@class": "org.jasig.cas.services.DefaultRegisteredServiceUsernameProvider"
},
"logoutType": "BACK_CHANNEL",
"attributeReleasePolicy": {
"@class": "org.jasig.cas.services.ReturnAllowedAttributeReleasePolicy",
"principalAttributesRepository": {
"@class": "org.jasig.cas.authentication.principal.DefaultPrincipalAttributesRepository"
},
"authorizedToReleaseCredentialPassword": false,
"authorizedToReleaseProxyGrantingTicket": false
},
"accessStrategy": {
"@class": "org.jasig.cas.services.DefaultRegisteredServiceAccessStrategy",
"enabled": true,
"ssoEnabled": true
}
}重啟即可使用http協議了
二、修改登入頁面
1、預設的登陸頁面是WEB-INF/view/jsp/default裡面的ui/casLoginView.jsp為登陸頁面，首先copy一份default命名為szcourt。原來的default用於備份。
2、預設的properties檔案是cas-theme-default.properties，同樣copy一份命名為cas-theme-mytheme.properties，cas4.1 中的的配置只有js及css，所以暫時不做修改
standard.custom.css.file=/css/cas.css
cas.javascript.file=/js/cas.js3、修改cas.properties中的屬性
原有的配置
cas.themeResolver.defaultThemeName=cas-theme-default
cas.viewResolver.defaultViewsPathPrefix=/WEB-INF/view/jsp/default/ui/修改為
cas.themeResolver.defaultThemeName=cas-theme-mytheme
cas.viewResolver.defaultViewsPathPrefix=/WEB-INF/view/jsp/mytheme/ui/這兩個屬性在cas-servlet.xml中的themeResolver中使用（不需要修改）
<!-- Theme Resolver -->
<bean id="themeResolver" class="org.jasig.cas.services.web.ServiceThemeResolver"
p:defaultThemeName="${cas.themeResolver.defaultThemeName}"
p:servicesManager-ref="servicesManager">
<property name="mobileBrowsers">
<util:map>
<entry key=".*iPhone.*" value="iphone"/>
<entry key=".*Android.*" value="iphone"/>
<entry key=".*Safari.*Pre.*" value="iphone"/>
<entry key=".*Nokia.*AppleWebKit.*" value="iphone"/>
</util:map>
</property>
</bean>這樣子就可以任性的修改登陸頁面了
三、修改語言
修改預設語言為漢語，開啟/WEB-INF/cas-servlet.xml
<!-- Locale Resolver -->
<bean id="localeResolver" class="org.springframework.web.servlet.i18n.CookieLocaleResolver" p:defaultLocale="zh_CN" />四、修改CAS登出後跳轉指定的url
cas-servlet.xml中修改CAS登出後跳轉指定的url（url中的service引數），搜尋logoutAction中的p:followServiceRedirects屬性改為true
<bean id="logoutAction" class="org.jasig.cas.web.flow.LogoutAction" p:servicesManager-ref="servicesManager" p:followServiceRedirects="${cas.logout.followServiceRedirects}"/>五、修改使用資料庫密碼驗證登陸
在cas-server-webapp專案的pom.xml檔案中新增資料庫支援依賴及mysql的驅動包
<dependency>
<groupId>org.jasig.cas</groupId>
<artifactId>cas-server-webapp-support</artifactId>
<version>${project.version}</version>
<scope>compile</scope>
</dependency>
<!-- jdbc driver -->
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<version>${mysql.driver.version}</version>
<scope>runtime</scope>
</dependency>在cas.properties中新增資料庫配置
jdbc.driver=com.mysql.jdbc.Driver
jdbc.url=jdbc\:mysql\://127.0.0.1\:3306/ems?useUnicode\=true&characterEncoding\=utf-8&zeroDateTimeBehavior\=convertToNull
jdbc.username=root
jdbc.password=root修改\WEB-INF\deployerConfigContext.xml
註釋掉authenticationManager中的primaryAuthenticationHandler，並新增dbAuthHandler（樓主因密碼加密方式比較特殊就自己copy了一遍然後重新實現驗證部分了，後面有貼完整的程式碼）
<bean id="authenticationManager" class="org.jasig.cas.authentication.PolicyBasedAuthenticationManager">
<constructor-arg>
<map>
<entry key-ref="proxyAuthenticationHandler" value-ref="proxyPrincipalResolver"/>
<!--原有的handler引用-->
<!--<entry key-ref="primaryAuthenticationHandler" value-ref="primaryPrincipalResolver" />-->
<!--新新增的handler引用-->
<entry key-ref="dbAuthHandler" value-ref="primaryPrincipalResolver"/>
</map>
</constructor-arg>
<property name="authenticationPolicy">
<bean class="org.jasig.cas.authentication.AnyAuthenticationPolicy"/>
</property>
</bean><!--原有的handler配置-->
<!--<bean id="primaryAuthenticationHandler"
class="org.jasig.cas.authentication.AcceptUsersAuthenticationHandler">
<property name="users">
<map>
<entry key="casuser" value="Mellon"/>
</map>
</property>
</bean>--><!--新新增的handler配置-->
<!-- Define the DB Connection -->
<bean id="dataSource" class="com.mchange.v2.c3p0.ComboPooledDataSource"
p:driverClass="${jdbc.driver}"
p:jdbcUrl="${jdbc.url}"
p:user="${jdbc.username}"
p:password="${jdbc.password}"/>
<bean id="myPasswordEncoder" class="org.jasig.cas.MyPasswordEncoder"
c:encodingAlgorithm="SHA-1"
p:characterEncoding="UTF-8"/>
<bean id="dbAuthHandler" class="org.jasig.cas.QueryDatabaseBAuthHandler"
p:dataSource-ref="dataSource"
p:sql="select password from sys_user where login_name=? and del_flag=0"
p:passwordEncoder-ref="myPasswordEncoder"/>六、修改使用mysql登陸時比較容易犯的錯誤：
因為密碼加密方式與系統的不同，所以重新寫了個PasswordEncoder與handler，中間修改所有配置及PasswordEncoder均沒有效果，原因是在web包的pom檔案中添加了core包和jdbc包的依賴，導致web專案不再使用匯入的專案。
其中MyPasswordEncoder需要實現PasswordEncoder介面， QueryDatabaseBAuthHandler需要繼承AbstractJdbcUsernamePasswordAuthenticationHandler類。 這樣就可以根據自己的需求來實現密碼加密方式。
另外，需要注意的是，服務端的資料庫與客戶端不一致，使用者表要一一對應。因為不同步問題導致訪問時一直重定向次數過多，困擾了我整整一天，找了各種教程都沒解決。然後，第二天發現服務端登陸的使用者在客戶端的使用者表中不存在，又因為我配置的登陸失敗頁面就是CAS登陸頁，而第一次登陸就拿到了Ticket，一到登入頁CAS直接告訴客戶端登陸成功，客戶端又卻獲取不到正確的使用者導致登陸失敗，如此陷入了一個死迴圈中。
這個問題一方面可以通過同步使用者表來解決，一方面也可以修改登入失敗的跳轉頁面。
七、完整的程式碼
1、cas-server父專案
pom.xml(註釋掉了一部分maven檢查的外掛，maven install等一直failure，沒找著解決辦法，所以註釋掉了)
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<parent>
<groupId>org.jasig.parent</groupId>
<artifactId>jasig-parent</artifactId>
<version>40</version>
</parent>
<modelVersion>4.0.0</modelVersion>
<groupId>org.jasig.cas</groupId>
<artifactId>cas-server</artifactId>
<packaging>pom</packaging>
<name>Apereo Central Authentication Service</name>
<description>Apereo CAS SSO server libraries and Web application.</description>
<version>4.1.0</version>
<url>http://www.jasig.org/cas/</url>
<inceptionYear>2004</inceptionYear>
<issueManagement>
<system>Jira</system>
<url>https://issues.jasig.org/browse/CAS</url>
</issueManagement>
<!-- SVN上對應的資源地址-->
<!--<scm>
<connection>scm:git:[email protected]:Jasig/cas.git</connection>
<developerConnection>scm:git:[email protected]:Jasig/cas.git</developerConnection>
<url>https://github.com/Jasig/cas</url>
<tag>v4.1.0</tag>
</scm>-->
<!-- 用於配置分發管理，配置相應的產品釋出資訊,主要用於釋出，在執行mvn deploy後表示要釋出的位置 -->
<distributionManagement>
<!-- 配置到檔案系統 -->
<site>
<id>cas-site</id>
<name>CAS Staging Site Documentation</name>
<url>file:${project.site.deployDirectory}</url>
</site>
</distributionManagement>
<build>
<testResources>
<testResource>
<directory>${basedir}/src/test/resources</directory>
</testResource>
</testResources>
<pluginManagement>
<plugins>
<plugin>
<groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-maven-plugin</artifactId>
<version>${maven-jetty-plugin.version}</version>
<configuration>
<systemProperties>
<systemProperty>
<name>org.eclipse.jetty.annotations.maxWait</name>
<value>240</value>
</systemProperty>
</systemProperties>
<!-- Works with remote debugging and mvn jetty:run-forked -->
<jvmArgs>-Xdebug -Xrunjdwp:transport=dt_socket,address=5000,server=y,suspend=n</jvmArgs>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>${maven-surefire-plugin.version}</version>
<configuration>
<forkMode>once</forkMode>
<includes>
<include>**/*Tests.java</include>
</includes>
<excludes>
<exclude>**/Abstract*.java</exclude>
</excludes>
<additionalClasspathElements>
<additionalClasspathElement>${project.build.directory}/test-lib/jdbc-driver.jar
</additionalClasspathElement>
</additionalClasspathElements>
</configuration>
</plugin>
</plugins>
</pluginManagement>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-resources-plugin</artifactId>
<version>${maven-resources-plugin.version}</version>
<executions>
<execution>
<phase>generate-sources</phase>
<goals>
<goal>copy-resources</goal>
</goals>
<configuration>
<outputDirectory>${project.build.directory}/unwoven-classes</outputDirectory>
<resources>
<resource>
<directory>${basedir}</directory>
<includes>
<include>none</include>
</includes>
</resource>
</resources>
</configuration>
</execution>
</executions>
</plugin>
<!-- <plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>findbugs-maven-plugin</artifactId>
<version>${maven-findbugs-plugin.version}</version>
<configuration>
<plugins>
<plugin>
<groupId>com.mebigfatguy.fb-contrib</groupId>
<artifactId>fb-contrib</artifactId>
<version>${maven-findbugs-contrib-plugin.version}</version>
</plugin>
<plugin>
<groupId>com.h3xstream.findsecbugs</groupId>
<artifactId>findsecbugs-plugin</artifactId>
<version>${maven-findbugs-security-plugin.version}</version>
</plugin>
</plugins>
<includeFilterFile>${cs.dir}/findbugs-rules.xml</includeFilterFile>
<effort>Max</effort>
<failOnError>true</failOnError>
</configuration>
<executions>
<execution>
<id>findbugs-check</id>
<phase>compile</phase>
<goals>
<goal>check</goal>
</goals>
</execution>
</executions>
</plugin>-->
<!--<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>
<version>${maven-checkstyle-plugin.version}</version>
<configuration>
<consoleOutput>true</consoleOutput>
<configLocation>${cs.dir}/checkstyle-rules.xml</configLocation>
<suppressionsLocation>${cs.dir}/checkstyle-suppressions.xml</suppressionsLocation>
<failsOnError>true</failsOnError>
<includeTestSourceDirectory>true</includeTestSourceDirectory>
</configuration>
<executions>
<execution>
<id>checkstyle</id>
<goals>
<goal>checkstyle</goal>
</goals>
<phase>compile</phase>
</execution>
</executions>
<dependencies>
<dependency>
<groupId>com.puppycrawl.tools</groupId>
<artifactId>checkstyle</artifactId>
<version>${checkstyle.version}</version>
</dependency>
</dependencies>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-enforcer-plugin</artifactId>
<version>${maven-enforcer-plugin.version}</version>
<executions>
<execution>
<id>enforce</id>
<goals>
<goal>enforce</goal>
</goals>
<configuration>
<rules>
<requireMavenVersion>
<version>2.0.9</version>
</requireMavenVersion>
<requireJavaVersion>
<version>${project.build.sourceVersion}</version>
</requireJavaVersion>
<bannedDependencies>
<excludes>
<exclude>cglib:cglib</exclude>
<exclude>cglib:cglib-full</exclude>
</excludes>
<includes>
<include>cglib:cglib:provided</include>
<include>cglib:cglib-full:provided</include>
</includes>
<searchTransitive>true</searchTransitive>
</bannedDependencies>
</rules>
</configuration>
</execution>
</executions>
</plugin>-->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<source>${project.build.sourceVersion}</source>
<target>${project.build.targetVersion}</target>
</configuration>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>buildnumber-maven-plugin</artifactId>
<version>${maven-buildnumber-plugin-version}</version>
<executions>
<execution>
<phase>initialize</phase>
<goals>
<goal>create-timestamp</goal>
</goals>
</execution>
</executions>
<configuration>
<doCheck>false</doCheck>
<doUpdate>false</doUpdate>
<timestampFormat>yyyy-MM-dd HH:mm:ssa</timestampFormat>
<timestampPropertyName>timestamp</timestampPropertyName>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<configuration>
<archive>
<manifest>
<addDefaultImplementationEntries>true</addDefaultImplementationEntries>