SSO单点登录详解-------八、搭建CAS Client服务端

一、前言

目前为止我们已经搭建好了CAS Server端,我们需要来搭建客户端配合使用,完成单点登录和单点注销的功能.我们将讲两种方式来搭建CAS Client端.一种是普通项目搭建,另一种是基于SpringBoot的项目搭建.

二、普通项目搭建CAS Client

官方提供了一个简易的模板来搭建CAS Client.
Github地址:https://github.com/cas-projects/cas-sample-java-webapp
下载导入项目之后,我们只需要稍作修改,运行起来就可以使用了.
步骤:
1.下载之后导入到工具中,导入之后项目结构如下图:

项目结构

2.项目默认使用的jetty的启动插件.如果使用tomcat的插件,需要在pom.xml中把jetty配置去掉,添加tomcat的插件.

<plugin><groupId>org.apache.tomcat.maven</groupId><artifactId>tomcat7-maven-plugin</artifactId><version>2.2</version><configuration><port>8088</port><path>/</path></configuration>
</plugin>

3.修改web.xml,把里面所有的``casServerUrlPrefix对应的value值换成你统一认证中心的域名,把所有serverName对应的value值换成你当前项目的域名.下方配置也标记了什么地方需要修改.
一定得改对,否则在访问的时候会出现票根’ST-1-SSAyf0nFMvmVBvEBSXyg-cas’不符合目标服务的错误.

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"><!--<context-param><param-name>renew</param-name><param-value>true</param-value></context-param>
--><filter><filter-name>CAS Single Sign Out Filter</filter-name><filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class><init-param><param-name>casServerUrlPrefix</param-name><!--此处需要修改--><param-value>https://www.sso.com:8443/cas</param-value></init-param></filter><listener><listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class></listener><filter><filter-name>CAS Authentication Filter</filter-name><!--<filter-class>org.jasig.cas.client.authentication.Saml11AuthenticationFilter</filter-class>--><filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class><init-param><param-name>casServerLoginUrl</param-name><!--此处需要修改--><param-value>https://www.sso.com:8443/cas/login</param-value></init-param><init-param><param-name>serverName</param-name><!--此处需要修改--><param-value>http://www.crm.com:8088</param-value></init-param></filter><filter><filter-name>CAS Validation Filter</filter-name><!--<filter-class>org.jasig.cas.client.validation.Saml11TicketValidationFilter</filter-class>--><filter-class>org.jasig.cas.client.validation.Cas30ProxyReceivingTicketValidationFilter</filter-class><init-param><param-name>casServerUrlPrefix</param-name><!--此处需要修改--><param-value>https://www.sso.com:8443/cas</param-value></init-param><init-param><param-name>serverName</param-name><!--此处需要修改--><param-value>http://www.crm.com:8088</param-value></init-param><init-param><param-name>redirectAfterValidation</param-name><param-value>true</param-value></init-param><init-param><param-name>useSession</param-name><param-value>true</param-value></init-param><!--<init-param><param-name>acceptAnyProxy</param-name><param-value>true</param-value></init-param><init-param><param-name>proxyReceptorUrl</param-name><param-value>/sample/proxyUrl</param-value></init-param><init-param><param-name>proxyCallbackUrl</param-name><param-value>https://mmoayyed.unicon.net:9443/sample/proxyUrl</param-value></init-param>--><init-param><param-name>authn_method</param-name><param-value>mfa-duo</param-value></init-param></filter><filter><filter-name>CAS HttpServletRequest Wrapper Filter</filter-name><filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class></filter><filter-mapping><filter-name>CAS Single Sign Out Filter</filter-name><url-pattern>/*</url-pattern></filter-mapping><filter-mapping><filter-name>CAS Validation Filter</filter-name><url-pattern>/*</url-pattern></filter-mapping><filter-mapping><filter-name>CAS Authentication Filter</filter-name><url-pattern>/*</url-pattern></filter-mapping><filter-mapping><filter-name>CAS HttpServletRequest Wrapper Filter</filter-name><url-pattern>/*</url-pattern></filter-mapping><welcome-file-list><welcome-file>index.jsp</welcome-file></welcome-file-list>
</web-app>

三、测试

运行tomcat7:run命令,把客户端启动起来.浏览器输入http://www.crm.com:8088/index.jsp,此时页面会跳转到统一认证中心的登陆页面.
但是会看到如下的错误信息:未认证授权的服务,
这是因为CAS Server端默认只接收https的客户端请求,如果想让CAS Server支持http协议的客户端请求,需要在服务端添加一些配置.

未认证授权的服务

服务端修改如下:
操作步骤（1）:

1.1 拷贝overlays/org.apereo.cas.cas-server-webapp-tomcat-5.2.3/WEB-INF/classes/services/HTTPSandIMAPS-10000001.json文件到/src/main/resources/services目录.

1.2 修改services\HTTPSandIMAPS-10000001.json文件
“serviceId” : “^(https|imaps)