CAS单点登录快速入门

Overview

SSO(Single Sign-on) in Action(上篇)
使用 CAS 在 Tomcat 中实现单点登录
http://jasig.github.io/cas/4.0.x/planning/Architecture.html

CAS Server/Client Up and Running

See more at:

https://wiki.jasig.org/display/CASC/CAS+Client+for+Java+3.1
https://wiki.jasig.org/display/CASC/JA-SIG+Java+Client+Simple+WebApp+Sample

Change Host Name

Modify C:\Windows\System32\drivers\etc\hosts

127.0.0.1   compa

Preparing The Tomcat Servers

Download tomcat.

Preparing And/Or Creating The Certificates

windows:

keytool -genkey -alias app1.company.com -keyalg RSA  -storepass changeit
keytool -export -alias app1.company.com -file app1.company.com.cert -storepass changeit
keytool -list -keystore %JAVA_HOME%\jre\lib\security\cacerts -alias app1.company.com  -storepass changeit
keytool -delete -keystore %JAVA_HOME%\jre\lib\security\cacerts -alias app1.company.com
keytool -import -file app1.company.com.cert -storepass changeit -keystore %JAVA_HOME%\jre\lib\security\cacerts -alias app1.company.com
keytool -list -v -storepass changeit -alias app1.company.com

Linux:

keytool -genkey -alias cas.company.com -keyalg RSA  -storepass changeit
keytool -export -alias cas.company.com -file cas.company.com.cert -storepass changeit
keytool -list -keystore $JAVA_HOME/jre/lib/security/cacerts -alias cas.company.com -storepass changeit
keytool -delete -keystore $JAVA_HOME/jre/lib/security/cacerts -alias cas.company.com
keytool -import -file cas.company.com.cert -storepass changeit -keystore $JAVA_HOME/jre/lib/security/cacerts -alias cas.company.com
keytool -list -v -storepass changeit -alias cas.company.com

Warning:

一个IP地址只能有一个证书，否则可能找到错误的证书发送给对向端（比如浏览器）

Configure Tomcat server.xml

    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"maxThreads="150" SSLEnabled="true" scheme="https" secure="true"clientAuth="false" sslProtocol="TLS"keystoreFile="C:/Users/ll/.keystore"keystorePass="changeit"truststoreFile="C:/Java/jdk1.8.0_25/jre/lib/security/cacerts" />

Warning:

Tomcat的truststoreFile必须指向JRE的keystore（路径为jre/lib/security/cacerts），里面存放对向端的证书(entry类型为trustedCertEntry)。如果不是JRE下的keystore或者store里面没有存放对向端的证书，会报错：

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Preparing CAS Server

Download CAS Server, lastest stable version is 4.0.0:

http://downloads.jasig.org/cas/cas-server-4.0.0-release.zip

Generate and Install Certificate:

Preparing The Sample Web Application

Download mywebapp:

https://wiki.jasig.org/download/attachments/13569483/mywebapp.war?version=1&modificationDate=1212097848936&api=v2

CAS Java client (latest stable version is 3.3.3) could be downloaded from:

http://downloads.jasig.org/cas-clients/cas-client-3.3.3-release.zip

Copy CAS Java Client jars to WEB-INF/lib:
* cas-client-core-3.3.3.jar
* slf4j-api-1.7.1.jar

To avoid the following problem: Renew MUST be specified via context parameter or JNDI environment to avoid misconfiguration. You should comment init-param of CAS Authentication Filter:

<!--<init-param><param-name>renew</param-name><param-value>false</param-value></init-param>-->

And add:

    <context-param><param-name>renew</param-name><param-value>false</param-value></context-param>

Change CAS Validation Filter from org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter to org.jasig.cas.client.validation.Cas10TicketValidationFilter, and modify related configurations.

    <filter><filter-name>CAS Validation Filter</filter-name><!--<filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>--> <filter-class>org.jasig.cas.client.validation.Cas10TicketValidationFilter</filter-class><init-param><param-name>casServerUrlPrefix</param-name><param-value>https://localhost/cas/</param-value></init-param><init-param><param-name>serverName</param-name><param-value>https://localhost:8443</param-value></init-param><!--<init-param><param-name>proxyCallbackUrl</param-name><param-value>https://localhost:8443/mywebapp/proxyCallback</param-value></init-param><init-param><param-name>proxyReceptorUrl</param-name><param-value>/mywebapp/proxyCallback</param-value></init-param>--></filter>