cas客户端验证流程

https://github.com/Jasig/java-cas-client

1 客户端配置，我的版本是3.4.1

<!-- CAS Server 通知 CAS Client，删除session,注销登录信息  -->      <filter>           <filter-name>CAS Single Sign Out Filter</filter-name>          <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>        <init-param>          <param-name>casServerUrlPrefix</param-name>          <param-value>http://192.168.20.103:8080/cas-server-webapp</param-value>       </init-param>    </filter>       <filter-mapping>          <filter-name>CAS Single Sign Out Filter</filter-name>          <url-pattern>/*</url-pattern>      </filter-mapping>      <listener>          <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>      </listener>    <filter>        <filter-name>Encoding</filter-name>        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>        <init-param>            <param-name>encoding</param-name>            <param-value>UTF-8</param-value>        </init-param>         <init-param>            <param-name>forceEncoding</param-name>            <param-value>true</param-value>        </init-param>    </filter>    <filter-mapping>        <filter-name>Encoding</filter-name>        <url-pattern>/*</url-pattern>    </filter-mapping>    <!-- 登录认证，未登录用户导向CAS Server进行认证 -->      <filter>           <filter-name>CAS Filter</filter-name>          <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>              <init-param>                  <param-name>casServerLoginUrl</param-name>                  <param-value>http://192.168.20.103:8080/cas-server-webapp/login</param-value>              </init-param>            <init-param>                <param-name>serverName</param-name>                  <param-value>http://192.168.20.103:8080/zgr-cas-integrate</param-value>              </init-param>      </filter>    <filter-mapping>          <filter-name>CAS Filter</filter-name>          <url-pattern>/*</url-pattern>      </filter-mapping>       <!-- CAS Client向CAS Server进行ticket验证 -->      <filter>                <filter-name>CAS Validation Filter</filter-name>          <filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>              <init-param>                      <param-name>casServerUrlPrefix</param-name>                      <param-value>http://192.168.20.103:8080/cas-server-webapp</param-value>          </init-param>              <init-param>                  <param-name>serverName</param-name>                  <param-value>http://192.168.20.103:8080/zgr-cas-integrate</param-value>          </init-param>      </filter>      <filter-mapping>              <filter-name>CAS Validation Filter</filter-name>           <url-pattern>/*</url-pattern>    </filter-mapping>      <!-- 封装request, 支持getUserPrincipal等方法-->      <filter>           <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>          <filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>      </filter>      <filter-mapping>         <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>          <url-pattern>/*</url-pattern>      </filter-mapping>      <!-- 存放Assertion到ThreadLocal中   -->      <filter>           <filter-name>CAS Assertion Thread Local Filter</filter-name>          <filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class>      </filter>       <filter-mapping>          <filter-name>CAS Assertion Thread Local Filter</filter-name>          <url-pattern>/*</url-pattern>    </filter-mapping>

---

2 org.jasig.cas.client.authentication.AuthenticationFilter
检查访问的用户是否需要认证。

public final void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse,            final FilterChain filterChain) throws IOException, ServletException {        final HttpServletRequest request = (HttpServletRequest) servletRequest;        final HttpServletResponse response = (HttpServletResponse) servletResponse;        if (isRequestUrlExcluded(request)) {            logger.debug("Request is ignored.");            filterChain.doFilter(request, response);            return;        }        final HttpSession session = request.getSession(false);        // 2.1此assertion是在请求经过Cas20ProxyReceivingTicketValidationFilter时被设置，下面会讲到        final Assertion assertion = session != null ? (Assertion) session.getAttribute(CONST_CAS_ASSERTION) : null;        if (assertion != null) { // 2.2如果assertion存在，则直接访问资源            filterChain.doFilter(request, response);            return;        }        final String serviceUrl = constructServiceUrl(request, response); //请求url地址        final String ticket = retrieveTicketFromRequest(request); // 2.3请求里是否携带ticket，主要检查service ticket（ST）        final boolean wasGatewayed = this.gateway && this.gatewayStorage.hasGatewayedAlready(request, serviceUrl);        if (CommonUtils.isNotBlank(ticket) || wasGatewayed) {            // 2.4如果ST非空，则访问继续（会被下一个filter-Cas20ProxyReceivingTicketValidationFilter特殊处理）            filterChain.doFilter(request, response);            return;        }        final String modifiedServiceUrl;        logger.debug("no ticket and no assertion found");        if (this.gateway) {            logger.debug("setting gateway attribute in session");            modifiedServiceUrl = this.gatewayStorage.storeGatewayInformation(request, serviceUrl);        } else {            modifiedServiceUrl = serviceUrl;        }        logger.debug("Constructed service url: {}", modifiedServiceUrl);        final String urlToRedirectTo = CommonUtils.constructRedirectUrl(this.casServerLoginUrl,                getProtocol().getServiceParameterName(), modifiedServiceUrl, this.renew, this.gateway);        logger.debug("redirecting to \"{}\"", urlToRedirectTo);        this.authenticationRedirectStrategy.redirect(request, response, urlToRedirectTo); // 2.5用户未经认证，重定向到cas-server登录页面    }

---

3.org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter向cas-server验证用户传递的service ticket是否合法

public final void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse,            final FilterChain filterChain) throws IOException, ServletException {        ……        final HttpServletRequest request = (HttpServletRequest) servletRequest;        final HttpServletResponse response = (HttpServletResponse) servletResponse;        final String ticket = retrieveTicketFromRequest(request);        if (CommonUtils.isNotBlank(ticket)) { //3.1 只处理ST非空的情况,与前面2.3一致            logger.debug("Attempting to validate ticket: {}", ticket);            try {                final Assertion assertion = this.ticketValidator.validate(ticket,                        constructServiceUrl(request, response)); //往cas-server发送请求http://192.168.20.103:8080/cas-server-webapp/serviceValidate?ticket=ST-44-G2dJRpP2dYQnIB14Ydwh-cas01.example.org&service=http%3A%2F%2F192.168.20.103%3A8080%2Fzgr-cas-integrate2%2Fresource%2Fsimple，验证ST的合法性                logger.debug("Successfully authenticated user: {}", assertion.getPrincipal().getName());                request.setAttribute(CONST_CAS_ASSERTION, assertion);                if (this.useSession) {               request.getSession().setAttribute(CONST_CAS_ASSERTION, assertion);//ST验证成功后，把assertion放入session，与前面2.1对应                }                onSuccessfulValidation(request, response, assertion);                if (this.redirectAfterValidation) {                    logger.debug("Redirecting after successful ticket validation.");                    response.sendRedirect(constructServiceUrl(request, response));                    return;                }            } catch (final TicketValidationException e) {                //如果验证失败，则抛出异常。失败的原因一般是ST超时而失效                logger.debug(e.getMessage(), e);                onFailedValidation(request, response);                if (this.exceptionOnValidationFailure) {                    throw new ServletException(e);                }                response.sendError(HttpServletResponse.SC_FORBIDDEN, e.getMessage());                return;            }        }        filterChain.doFilter(request, response);    }