sso demo ( cas )

1. generate keystore

   command : keytool -genkey -alias testtomcat -keyalg RSA -keystore "C:Users ocky estsso esttomcat.keystore"

   password : 123456

  

2. setting the tomcat server.xml

  

  

 3. download and extract cas-server-4.0.0-release.zip

     ~you can find cas-server-webapp-4.0.0.war in the modules package.

     ~copy it to tomcat webapps package and rename to cas.war.

     ~execute the  startup.bat command as the administrator user.

　　 ~https://localhost:8443/cas

    ~login with user( username : casuser; password : Mellon)

   

-------------------------------------------------------------------------------------------------------------------

-------------------------------------------------------------------------------------------------------------------

          update 2016-04-06

1. java jdk不支持以ip建立证书，所以需要虚拟一个域名，如cas.server.com

2. 生成证书

keytool -genkeypair -keyalg RSA -keysize 2048 -sigalg SHA1withRSA -validity 36500 -alias cas.server.com -keystore C:/Users/rocky/testsso/tomcat.keystore -dname "CN=cas.server.com,OU=cdv,O=cdv,L=bj,ST=bj,C=CN"

3. 导出证书

keytool -exportcert -alias cas.server.com -keystore C:/Users/rocky/testsso/tomcat.keystore  -file C:/Users/rocky/testsso/tomcat.cer -rfc

4. tomcat 配置 cas， 浏览器添加证书

  （区别于上面绝对路径方式引用， 现采用相对路径方式）将生成的tomcat.keystore 拷贝到tomcat目录下。

将第三步导出的tomcat.crt 导入到浏览器

5.  将tomcat.crt拷贝到cas client所在的机器， 并导入到jdk中（C:Program FilesJavajdk1.7.0_15jrelibsecuritycacerts可以删除，这时导入的文件会重新生成该文件， C:Program FilesJavajre7libsecurity该路径下也有cacerts文件，可一并覆盖）

keytool -import -alias cacerts -keystore cacerts -file C:/Users/rocky/testsso/tomcat.cer -trustcacerts

6.创建cas client工程(web工程)casclient，配置xml文件，并导入相关jar包

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5">
  <display-name>ssoclient</display-name>
  
  <filter>
        <filter-name>CAS Single Sign Out Filter</filter-name>
        <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>CAS Single Sign Out Filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    
    <listener>
        <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
    </listener>

    <filter>
        <filter-name>CAS Authentication Filter</filter-name>
        <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
        <init-param>
            <param-name>casServerLoginUrl</param-name>
            <param-value>https://cas.server.com:8443/cas/login</param-value>
        </init-param>
        <init-param>
            <param-name>serverName</param-name>
            <param-value>cas.server.com:8081</param-value>
        </init-param>
    </filter>
    <filter>
        <filter-name>CAS Validation Filter</filter-name>
        <filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
        <init-param>
            <param-name>casServerUrlPrefix</param-name>
            <param-value>https://cas.server.com:8443/cas/</param-value>
        </init-param>
        <init-param>
            <param-name>serverName</param-name>
            <param-value>cas.server.com:8081</param-value>
        </init-param>
        <init-param>
            <param-name>redirectAfterValidation</param-name>
            <param-value>false</param-value>
        </init-param>
    </filter>
    <filter>
        <filter-name>CAS HttpServletRequest WrapperFilter</filter-name>
        <filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
    </filter>
    <filter>
        <filter-name>CAS Assertion Thread Local Filter</filter-name>
        <filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class>
    </filter>    
    <filter-mapping>
        <filter-name>CAS Authentication Filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    
    <filter-mapping>
        <filter-name>CAS Validation Filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    
    <filter-mapping>
        <filter-name>CAS HttpServletRequest WrapperFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>CAS Assertion Thread Local Filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
  <welcome-file-list>
    <welcome-file>index.html</welcome-file>
    <welcome-file>index.htm</welcome-file>
    <welcome-file>index.jsp</welcome-file>
    <welcome-file>default.html</welcome-file>
    <welcome-file>default.htm</welcome-file>
    <welcome-file>default.jsp</welcome-file>
  </welcome-file-list>
</web-app>

记得，在tomcat的server.xml中要修改相关port，如果在同一台机器上实验，开多个tomcat，也应修改相关port，防止port冲突。

 7.  浏览器输入http://cas.server.com:8081/ssoclient/index.jsp， 可以看到地址栏变了，进入cas server的login页面，输出对的username 和 password， 会跳回到client的index.jsp页面。

     http://cas.server.com:8082/ssoclient2/index.jsp  ，不在需要cas server登录， 直接看到index.jsp页面

                                            update  2016-10-13 14:41

1.演示环境

  windows7 64 主机名：rocky-PC

  JDK : jdk1.7.0_80

  tomcat : tomcat-7.0.70

  cas-server-4.0.0

  cas-client-3.3.3

  windows hosts 文件 添加域名映射  （C:WindowsSystem32driversetc）

demo.cdv.com 对应部署的tomcat-cas， 这个名称在生成证书时用到

app1.cdv.com 对应部署的tomcat-app1,  

app2.cdv.com 对应部署的tomcat-app2

2. 安全证书配置

 2.1 证书生成

 

   输入的名称和hosts文件一致，也可以用主机名；

  keypass 和 storepass 一致，否则tomcat访问https失败

2.2 导出证书

2.3 客户端 导入证书

此处导入的密码和上面的不一样，如果客户端在多台机器上，需要多次导入

3. cas server部署

3.1 修改 tomcat-cas server.xml

3.2 启动 tomcat-cas， 访问https://demo.cdv.com:8443 并添加 浏览器 访问例外

3.3 从cas-server-4.0.0-> modules下拷贝cas-server-webapp.war到tomcat-cas webapp下 并重命名cas.war

     启动tomcat-cas 访问https://demo.cdv.com:8443/cas/login

     用户名 casuser 密码 Mellon登录

    看到 Log in successful则cas server部署成功

4. cas client部署

  4.1 tomcat-app1

    4.1.1修改server.xml

..
<Server port="18005" shutdown="SHUTDOWN">
..  

  <Connector port="18080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="18443" />

访问http://app1.cdv.com:18080/examples/servlets/测试端口是否可用

     4.1.2  导入jar

     4.1.3  修改web.xml

<!-- ======================== 单点登录开始 ======================== -->
        <!-- 用于单点退出，该过滤器用于实现单点登出功能，可选配置-->
        <listener>
            <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
        </listener>

        <!-- 该过滤器用于实现单点登出功能，可选配置。 -->
        <filter>
            <filter-name>CAS Single Sign Out Filter</filter-name>
            <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
        </filter>
        <filter-mapping>
            <filter-name>CAS Single Sign Out Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>

        <filter>
            <filter-name>CAS Filter</filter-name>
            <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
            <init-param>
                <param-name>casServerLoginUrl</param-name>
                <param-value>https://demo.cdv.com:8443/cas/login</param-value>
            </init-param>
            <init-param>
                <param-name>serverName</param-name>
                <param-value>http://app1.cdv.com:18080</param-value>
            </init-param>
        </filter>
        <filter-mapping>
            <filter-name>CAS Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
        <!-- 该过滤器负责对Ticket的校验工作，必须启用它 -->
        <filter>
            <filter-name>CAS Validation Filter</filter-name>
            <filter-class>
                org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
            <init-param>
                <param-name>casServerUrlPrefix</param-name>
                <param-value>https://demo.cdv.com:8443/cas</param-value>
            </init-param>
            <init-param>
                <param-name>serverName</param-name>
                <param-value>http://app1.cdv.com:18080</param-value>
            </init-param>
        </filter>
        <filter-mapping>
            <filter-name>CAS Validation Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>

        <!--
            该过滤器负责实现HttpServletRequest请求的包裹，
            比如允许开发者通过HttpServletRequest的getRemoteUser()方法获得SSO登录用户的登录名，可选配置。
        -->
        <filter>
            <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
            <filter-class>
                org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
        </filter>
        <filter-mapping>
            <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>

        <!--
            该过滤器使得开发者可以通过org.jasig.cas.client.util.AssertionHolder来获取用户的登录名。
            比如AssertionHolder.getAssertion().getPrincipal().getName()。
        -->
        <filter>
            <filter-name>CAS Assertion Thread Local Filter</filter-name>
            <filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class>
        </filter>
        <filter-mapping>
            <filter-name>CAS Assertion Thread Local Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>

<!-- ======================== 单点登录结束 ======================== -->

4.2 tomcat-app2(同tomcat-app1)

 4.2.1 修改server.xml

..
<Server port="28005" shutdown="SHUTDOWN">
..
    <Connector port="28080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="28443" />
..

  4.2.2 导入jar

 4.2.3  修改web.xml

    <!-- ======================== 单点登录开始 ======================== -->
        <!-- 用于单点退出，该过滤器用于实现单点登出功能，可选配置-->
        <listener>
            <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
        </listener>

        <!-- 该过滤器用于实现单点登出功能，可选配置。 -->
        <filter>
            <filter-name>CAS Single Sign Out Filter</filter-name>
            <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
        </filter>
        <filter-mapping>
            <filter-name>CAS Single Sign Out Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>

        <filter>
            <filter-name>CAS Filter</filter-name>
            <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
            <init-param>
                <param-name>casServerLoginUrl</param-name>
                <param-value>https://demo.cdv.com:8443/cas/login</param-value>
            </init-param>
            <init-param>
                <param-name>serverName</param-name>
                <param-value>http://app2.cdv.com:28080</param-value>
            </init-param>
        </filter>
        <filter-mapping>
            <filter-name>CAS Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
        <!-- 该过滤器负责对Ticket的校验工作，必须启用它 -->
        <filter>
            <filter-name>CAS Validation Filter</filter-name>
            <filter-class>
                org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
            <init-param>
                <param-name>casServerUrlPrefix</param-name>
                <param-value>https://demo.cdv.com:8443/cas</param-value>
            </init-param>
            <init-param>
                <param-name>serverName</param-name>
                <param-value>http://app2.cdv.com:28080</param-value>
            </init-param>
        </filter>
        <filter-mapping>
            <filter-name>CAS Validation Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>

        <!--
            该过滤器负责实现HttpServletRequest请求的包裹，
            比如允许开发者通过HttpServletRequest的getRemoteUser()方法获得SSO登录用户的登录名，可选配置。
        -->
        <filter>
            <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
            <filter-class>
                org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
        </filter>
        <filter-mapping>
            <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>

        <!--
            该过滤器使得开发者可以通过org.jasig.cas.client.util.AssertionHolder来获取用户的登录名。
            比如AssertionHolder.getAssertion().getPrincipal().getName()。
        -->
        <filter>
            <filter-name>CAS Assertion Thread Local Filter</filter-name>
            <filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class>
        </filter>
        <filter-mapping>
            <filter-name>CAS Assertion Thread Local Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>

<!-- ======================== 单点登录结束 ======================== -->

5. 测试

 5.1 启动 tomcat-cas , tomcat-app1, tomcat-app2

 5.2 访问 http://app1.cdv.com:18080/examples/servlets/servlet/HelloWorldExample

      跳转到 cas-server登录界面， 输入用户名+密码 正确， 跳转到helloworld页面；

     访问 http://app2.cdv.com:28080/examples/servlets/servlet/HelloWorldExample就不要登录了。

     访问https://demo.cdv.com:8443/cas/logout可以注销登录