kisso OA所有请求都跳转到这个接口,登录只有这一个入口http://my.web.com:8090/oa/login.ht
@RequestMapping("/login.ht")public String login(HttpServletRequest request,HttpServletResponse response) {SSOToken token = SSOHelper.getToken(request);if (token == null) {//重定向至代理跨域地址页return response.sendRedirect("http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.ht");} else {//从token中取出信息，进行相关信息初始化。String userId = token.getUid();//.......
        }return "index";}SSO中心http://sso.test.com:8080/login.html
@RequestMapping("/login.ht")public String login(HttpServletRequest request,HttpServletResponse response) {String returnUrl = request.getParameter(SSOConfig.getInstance().getParamReturl());//因为XXXXX处记录了，所以此处可以取到。Token token = SSOHelper.getToken(request);if (token == null) {//正常登录 需要过滤sql及脚本注入WafRequestWrapper wr = new WafRequestWrapper(request);String name = wr.getParameter("userid");//账号、密码认证if (name != null && !"".equals(name)) {//设置登录 Cookie 最后一个参数 true 时添加 cookie 同时销毁当前 JSESSIONID 创建信任的 JSESSIONIDSSOToken st = new SSOToken(request, "1000");SSOHelper.setSSOCookie(request, response, st, true);// 重定向到指定地址 returnUrlif (StringUtils.isEmpty(returnUrl)) {returnUrl = "/index.html";} else {returnUrl = HttpUtil.decodeURL(returnUrl);}return response.sendRedirect(returnUrl);} else {if (StringUtils.isNotEmpty(returnUrl)) {request.setAttribute("ReturnURL", returnUrl);//存储起来XXXXX
                }return "login";}} else {if (StringUtils.isEmpty(returnUrl)) {returnUrl = "/index.html";}return response.sendRedirect(returnUrl);}}OA中，经SSO登录后，又重定向回来http://my.web.com:8090/oa/proxylogin.ht@RequestMapping("/proxylogin.ht")public String proxylogin(HttpServletRequest request,HttpServletResponse response) {// 用户自定义配置获取 由于不确定性，kisso 提倡，用户自己定义配置。PropertiesUtil prop = SSOConfig.getSSOProperties();//业务系统私钥签名 authToken 自动设置临时会话 cookie 授权后自动销毁AuthToken at = SSOHelper.askCiphertext(request, response, prop.get("sso.defined.my_private_key"));//at.getUuid() 作为 key 设置 authToken 至分布式缓存中，然后 sso 系统二次验证//askurl 询问 sso 是否登录地址String askurl = prop.get("sso.defined.askurl");request.setAttribute("askurl", askurl);//askTxt 询问 token 密文String askData =  at.encryptAuthToken();request.setAttribute("askData", askData);//my 确定是否登录地址String okurl =  prop.get("sso.defined.oklogin");request.setAttribute("okurl", okurl);return "proxylogin";}proxylogin.jsp页面中js$(function(){$.ajax({url: askurl,data:  {askData:askData},success: function(d){if(d.msg == "-1"){window.location.href = "http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.html";}else{$.post(okurl, {replyTxt:d.msg} , function(e) {window.location.href = e.returl;}, "json");}},error:function(){window.location.href = "http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.ht"},dataType: json});});SSO中askurl地址http://sso.test.com:8080/replylogin.html
    @ResponseBody@RequestMapping("/replylogin")public void replylogin(HttpServletRequest request,HttpServletResponse response) {StringBuffer replyData = new StringBuffer();replyData.append(request.getParameter("callback")).append("({\"msg\":\"");Token token = SSOHelper.getToken(request);if (token != null) {String askData = request.getParameter("askData");if (askData != null && !"".equals(askData)) {//用户自定义配置获取 由于不确定性，kisso 提倡，用户自己定义配置。PropertiesUtil prop = SSOConfig.getSSOProperties();//下面开始验证票据，签名新的票据每一步都必须有。AuthToken at = SSOHelper.replyCiphertext(request, askData);if (at != null) {//1、业务系统公钥验证签名合法性（此处要支持多个跨域端，取 authToken 的 app 名找到对应系统公钥验证签名）at = at.verify(prop.get("sso.defined." + at.getApp() + "_public_key"));if (at != null) {//at.getUuid() 作为 key 设置 authToken 至分布式缓存中，然后 sso 系统二次验证//at.setData(data); 设置自定义信息，当然你也可以直接 at.setData(token.jsonToken()); 把当前 SSOToken 传过去。
                        at.setUid(token.getUid());//设置绑定用户IDat.setTime(token.getTime());//设置登录时间//2、SSO 的私钥签名at.sign(prop.get("sso.defined.sso_private_key"));//3、生成回复密文票据
                        replyData.append(at.encryptAuthToken());} else {//非法签名, 可以重定向至无权限界面，自己处理replyData.append("-2");}} else {//非法签名, 可以重定向至无权限界面，自己处理replyData.append("-2");}}} else {// 未登录replyData.append("-1");}try {replyData.append("\"})");response.setContentType("text/html;charset=" + "UTF-8");PrintWriter out = response.getWriter();out.print(replyData);out.flush();} catch (IOException e) {e.printStackTrace();}}OA中okurlhttp://my.web.com:8090/oklogin.ht
    @ResponseBody@RequestMapping("/oklogin")public void oklogin(HttpServletRequest request,HttpServletResponse response) {String returl = "http://my.web.com:8090/timeout.html";//回复密文是否存在 SSO 公钥验证回复密文是否正确 设置 MY 系统自己的 CookieString replyTxt = request.getParameter("replyTxt");if (replyTxt != null && !"".equals(replyTxt)) {// 用户自定义配置获取 由于不确定性，kisso 提倡，用户自己定义配置。PropertiesUtil prop = SSOConfig.getSSOProperties();AuthToken at = SSOHelper.ok(request, response, replyTxt, prop.get("sso.defined.my_public_key"),prop.get("sso.defined.sso_public_key"));if (at != null) {returl = "http://my.web.com:8090/index.html";SSOToken st = new SSOToken();st.setUid(at.getUid());st.setTime(at.getTime());//设置 true 时添加 cookie 同时销毁当前 JSESSIONID 创建信任的 JSESSIONIDSSOHelper.setSSOCookie(request, response, st, true);}}try {response.setContentType("text/html;charset=" + "UTF-8");PrintWriter out = response.getWriter();out.print("{\"returl\":\"" + returl + "\"}");out.flush();} catch (IOException e) {e.printStackTrace();}}于是整个过程是这样的：
http://my.web.com:8090/oa/login.ht
||
http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.ht
||
http://my.web.com:8090/oa/proxylogin.ht
||
http://sso.test.com:8080/replylogin.html
||
http://my.web.com:8090/oa/oklogin.ht
||
http://my.web.com:8090/oa/login.ht        

http://git.oschina.net/juapk/kisso

kisso 
OA所有请求都跳转到这个接口,登录只有这一个入口http://my.web.com:8090/oa/login.ht
@RequestMapping("/login.ht")public String login(HttpServletRequest request,HttpServletResponse response) {SSOToken token = SSOHelper.getToken(request);if (token == null) {//重定向至代理跨域地址页return response.sendRedirect("http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.ht");} else {//从token中取出信息，进行相关信息初始化。String userId = token.getUid();//.......}return "index";}
SSO中心http://sso.test.com:8080/login.html
@RequestMapping("/login.ht")public String login(HttpServletRequest request,HttpServletResponse response) {String returnUrl = request.getParameter(SSOConfig.getInstance().getParamReturl());//因为XXXXX处记录了，所以此处可以取到。Token token = SSOHelper.getToken(request);if (token == null) {//正常登录 需要过滤sql及脚本注入WafRequestWrapper wr = new WafRequestWrapper(request);String name = wr.getParameter("userid");//账号、密码认证if (name != null && !"".equals(name)) {//设置登录 Cookie 最后一个参数 true 时添加 cookie 同时销毁当前 JSESSIONID 创建信任的 JSESSIONIDSSOToken st = new SSOToken(request, "1000");SSOHelper.setSSOCookie(request, response, st, true);// 重定向到指定地址 returnUrlif (StringUtils.isEmpty(returnUrl)) {returnUrl = "/index.html";} else {returnUrl = HttpUtil.decodeURL(returnUrl);}return response.sendRedirect(returnUrl);} else {if (StringUtils.isNotEmpty(returnUrl)) {request.setAttribute("ReturnURL", returnUrl);//存储起来XXXXX}return "login";}} else {if (StringUtils.isEmpty(returnUrl)) {returnUrl = "/index.html";}return response.sendRedirect(returnUrl);}}
OA中，经V8登录后，又重定向回来http://my.web.com:8090/oa/proxylogin.ht@RequestMapping("/proxylogin.ht")public String proxylogin(HttpServletRequest request,HttpServletResponse response) {// 用户自定义配置获取 由于不确定性，kisso 提倡，用户自己定义配置。PropertiesUtil prop = SSOConfig.getSSOProperties();//业务系统私钥签名 authToken 自动设置临时会话 cookie 授权后自动销毁AuthToken at = SSOHelper.askCiphertext(request, response, prop.get("sso.defined.my_private_key"));//at.getUuid() 作为 key 设置 authToken 至分布式缓存中，然后 sso 系统二次验证//askurl 询问 sso 是否登录地址String askurl = prop.get("sso.defined.askurl");request.setAttribute("askurl", askurl);
//askTxt 询问 token 密文String askData =  at.encryptAuthToken();request.setAttribute("askData", askData);
//my 确定是否登录地址String okurl =  prop.get("sso.defined.oklogin");request.setAttribute("okurl", okurl);
return "proxylogin";}
proxylogin.jsp页面中js$(function(){$.ajax({url: askurl,data:  {askData:askData},success: function(d){if(d.msg == "-1"){    window.location.href = "http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.html";    }else{$.post(okurl, {replyTxt:d.msg} , function(e) {window.location.href = e.returl;}, "json");}},error:function(){window.location.href = "http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.ht"},dataType: json });});
V8中askurl地址http://sso.test.com:8080/replylogin.html@ResponseBody@RequestMapping("/replylogin")public void replylogin(HttpServletRequest request,HttpServletResponse response) {StringBuffer replyData = new StringBuffer();replyData.append(request.getParameter("callback")).append("({\"msg\":\"");Token token = SSOHelper.getToken(request);if (token != null) {String askData = request.getParameter("askData");if (askData != null && !"".equals(askData)) {//用户自定义配置获取 由于不确定性，kisso 提倡，用户自己定义配置。PropertiesUtil prop = SSOConfig.getSSOProperties();//下面开始验证票据，签名新的票据每一步都必须有。AuthToken at = SSOHelper.replyCiphertext(request, askData);if (at != null) {//1、业务系统公钥验证签名合法性（此处要支持多个跨域端，取 authToken 的 app 名找到对应系统公钥验证签名）at = at.verify(prop.get("sso.defined." + at.getApp() + "_public_key"));if (at != null) {//at.getUuid() 作为 key 设置 authToken 至分布式缓存中，然后 sso 系统二次验证//at.setData(data); 设置自定义信息，当然你也可以直接 at.setData(token.jsonToken()); 把当前 SSOToken 传过去。at.setUid(token.getUid());//设置绑定用户IDat.setTime(token.getTime());//设置登录时间//2、SSO 的私钥签名at.sign(prop.get("sso.defined.sso_private_key"));//3、生成回复密文票据replyData.append(at.encryptAuthToken());} else {//非法签名, 可以重定向至无权限界面，自己处理replyData.append("-2");}} else {//非法签名, 可以重定向至无权限界面，自己处理replyData.append("-2");}}} else {// 未登录replyData.append("-1");}try {replyData.append("\"})");response.setContentType("text/html;charset=" + "UTF-8");PrintWriter out = response.getWriter();out.print(replyData);out.flush();} catch (IOException e) {e.printStackTrace();}}
OA中okurlhttp://my.web.com:8090/oklogin.ht@ResponseBody@RequestMapping("/oklogin")public void oklogin(HttpServletRequest request,HttpServletResponse response) {String returl = "http://my.web.com:8090/timeout.html";//回复密文是否存在 SSO 公钥验证回复密文是否正确 设置 MY 系统自己的 CookieString replyTxt = request.getParameter("replyTxt");if (replyTxt != null && !"".equals(replyTxt)) {// 用户自定义配置获取 由于不确定性，kisso 提倡，用户自己定义配置。PropertiesUtil prop = SSOConfig.getSSOProperties();AuthToken at = SSOHelper.ok(request, response, replyTxt, prop.get("sso.defined.my_public_key"),prop.get("sso.defined.sso_public_key"));if (at != null) {returl = "http://my.web.com:8090/index.html";SSOToken st = new SSOToken();st.setUid(at.getUid());st.setTime(at.getTime());//设置 true 时添加 cookie 同时销毁当前 JSESSIONID 创建信任的 JSESSIONIDSSOHelper.setSSOCookie(request, response, st, true);}}try {        response.setContentType("text/html;charset=" + "UTF-8");PrintWriter out = response.getWriter();out.print("{\"returl\":\"" + returl + "\"}");out.flush();} catch (IOException e) {e.printStackTrace();}}
于是整个过程是这样的：http://my.web.com:8090/oa/login.ht||http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.ht||http://my.web.com:8090/oa/proxylogin.ht||http://sso.test.com:8080/replylogin.html||http://my.web.com:8090/oa/oklogin.ht||http://my.web.com:8090/oa/login.ht