CAS 4.1.10 版本服务端源码解读

在工作中经常会对CAS进行二次改造适应不同的单点登录场景。这篇文章主要对CAS 4.1.10版本进行源码解读（主要是登录流程）。不同版本可以在github下载。

一、准备

下载下来的cas-overlay-template的依赖中默认只有

<dependency>
  <groupId>org.jasig.cas</groupId>
  <artifactId>cas-server-webapp</artifactId>
  <version>${cas.version}</version>
  <type>war</type>
  <scope>runtime</scope>
</dependency>

为了跟踪相关的代码还需要添加下面的两个依赖

<dependency>
  <groupId>org.jasig.cas</groupId>
  <artifactId>cas-server-core</artifactId>
  <version>${cas.version}</version>
  </dependency>
  <dependency>
    <groupId>org.jasig.cas</groupId>
    <artifactId>cas-server-webapp-support</artifactId>
    <version>${cas.version}</version>
</dependency>

二、源码解读

2.1 访问CAS服务端进行认证

CAS 是使用SpringMVC+Spring WebFlow(工作流框架)控制登录，登出流程的。

一般情况下，我们在浏览器访问http://localhost:8080/cas,cas 服务端会默认访问index.jsp页面

<%@ page language="java"  session="false" %>
<%
final String queryString = request.getQueryString();
final String url = request.getContextPath() + "/login" + (queryString != null ? "?" + queryString : "");
response.sendRedirect(response.encodeURL(url));%>

从上面index.jsp页面的内容发现，它会从定向到http://localhost:8080/cas/login，该路径是由名为cas 的 servlet进行处理的

<servlet>
    <servlet-name>cas</servlet-name>
    <servlet-class>
        org.springframework.web.servlet.DispatcherServlet
    </servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/cas-servlet.xml, /WEB-INF/cas-servlet-*.xml</param-value>
    </init-param>
    <init-param>
        <param-name>publishContext</param-name>
        <param-value>false</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
    <servlet-name>cas</servlet-name>
    <url-pattern>/login</url-pattern>
</servlet-mapping>

这里将请求交给了SpringMVC进行处理。

2.2 SpringMVC与Spring WebFlow整合

在上面的servlet配置中会发现，其核心的配置文件是/WEB-INF/cas-servlet.xml, /WEB-INF/cas-servlet-*.xml。SpringMVC在初始化的时候会去自动加载cas-servlet.xml或cas-servlet-*.xml配置。在WEB-INF目录下我们找到了cas-servlet.xml这个文件，里面对SpringMVC和Spring WebFlow进行了整合配置。如果想深入了解可以参考整合细节

<!--为login登录请求开启流处理-->
<bean id="loginHandlerAdapter" class="org.jasig.cas.web.flow.SelectiveFlowHandlerAdapter"
        p:supportedFlowId="login" p:flowExecutor-ref="loginFlowExecutor" p:flowUrlHandler-ref="loginFlowUrlHandler" />
<!-- login webflow configuration -->
<!--将特定应用程序资源映射到流-->
<bean id="loginFlowHandlerMapping" class="org.springframework.webflow.mvc.servlet.FlowHandlerMapping"
      p:flowRegistry-ref="loginFlowRegistry" p:order="2">
  <property name="interceptors">
      <array value-type="org.springframework.web.servlet.HandlerInterceptor">
          <ref bean="localeChangeInterceptor" />
      </array>
  </property>
</bean>
<!--注册一个工作流节点,login的请求交由login-webflow.xml定义的处理器进行处理-->
<webflow:flow-registry id="loginFlowRegistry" flow-builder-services="builder" base-path="/WEB-INF/webflow">
  <webflow:flow-location-pattern value="/login/*-webflow.xml"/>
</webflow:flow-registry>
<!--view-factory-creator属性，该属性就定义了视图解析工厂-->
<webflow:flow-builder-services id="builder" view-factory-creator="viewFactoryCreator" expression-parser="expressionParser" />
<bean id="viewFactoryCreator" class="org.springframework.webflow.mvc.builder.MvcViewFactoryCreator">
  <property name="viewResolvers">
    <util:list>
      <ref bean="viewResolver"/>
      <ref bean="internalViewResolver"/>
    </util:list>
  </property>
</bean>
<!-- View Resolver  -->
<bean id="viewResolver" class="org.springframework.web.servlet.view.ResourceBundleViewResolver"
      p:order="0">
  <property name="basenames">
      <util:list>
          <value>cas_views</value>
      </util:list>
  </property>
</bean>

如果对SpringMVC的请求路径是login,那么SpringMVC会交给webflow进行处理。flow-builder-services节点中有个view-factory-creator属性，该属性定义了视图解析工厂。该视图解析工厂是由视图解析器组成的。这里只定义了一个视图解析器，就是viewResolvers。该视图解析器是springFramework中的ResourceBundleViewResolver的一个实例，该类可以通过basenames属性，找到value值对应的properties属性文件，该文件中式类似ke=values类型的内容，正是该文件将jsp文件映射成视图名称。

2.3 CAS 登录流程解析

由上面的分析知道，登录流程的配置文件是/WEB-INF/webflow/login目录下的login-webflow。

<var name="credential" class="org.jasig.cas.authentication.UsernamePasswordCredential"/>

定义UsernamePasswordCredential类型的变量，用于存放用户名和密码（默认），可进行扩展存放更多的属性。

<on-start>
    <evaluate expression="initialFlowSetupAction"/>
</on-start>

这是流程开始的操作，要去执行initialFlowSetupAction这个bean，它定义在cas-servlet.xml里面

<bean id="initialFlowSetupAction" class="org.jasig.cas.web.flow.InitialFlowSetupAction"
        p:argumentExtractors-ref="argumentExtractors"
        p:warnCookieGenerator-ref="warnCookieGenerator"
        p:ticketGrantingTicketCookieGenerator-ref="ticketGrantingTicketCookieGenerator"
        p:servicesManager-ref="servicesManager"
        p:enableFlowOnAbsentServiceRequest="${create.sso.missing.service:true}"  />

org.jasig.cas.web.flow.InitialFlowSetupAction继承自AbstractAction，AbstractAction方法是org.springframework.webflow.action包中的类,是webflow中的基础类。该类中的doExecute方法是对应处理业务的方法。

  protected Event doExecute(RequestContext context) throws Exception {
    HttpServletRequest request = WebUtils.getHttpServletRequest(context);
    String contextPath = context.getExternalContext().getContextPath();
    String cookiePath = StringUtils.isNotBlank(contextPath) ? contextPath + '/' : "/";
    if (StringUtils.isBlank(this.warnCookieGenerator.getCookiePath())) {
      this.logger.info("Setting path for cookies for warn cookie generator to: {} ", cookiePath);
      this.warnCookieGenerator.setCookiePath(cookiePath);
    } else {
      this.logger.debug("Warning cookie path is set to {} and path {}", this.warnCookieGenerator.getCookieDomain(), this.warnCookieGenerator.getCookiePath());
    }

    if (StringUtils.isBlank(this.ticketGrantingTicketCookieGenerator.getCookiePath())) {
      this.logger.info("Setting path for cookies for TGC cookie generator to: {} ", cookiePath);
      this.ticketGrantingTicketCookieGenerator.setCookiePath(cookiePath);
    } else {
      this.logger.debug("TGC cookie path is set to {} and path {}", this.ticketGrantingTicketCookieGenerator.getCookieDomain(), this.ticketGrantingTicketCookieGenerator.getCookiePath());
    }
    //将TGT放在RequestScope作用域中
    WebUtils.putTicketGrantingTicketInScopes(context, this.ticketGrantingTicketCookieGenerator.retrieveCookieValue(request));
    //将warnCookieValue放在RequestScope作用域中
    WebUtils.putWarningCookie(context, Boolean.valueOf(this.warnCookieGenerator.retrieveCookieValue(request)));
    //获取service参数
    Service service = WebUtils.getService(this.argumentExtractors, context);
    if (service != null) {
      this.logger.debug("Placing service in context scope: [{}]", service.getId());
      //查找注册的service
      RegisteredService registeredService = this.servicesManager.findServiceBy(service);
      if (registeredService != null && registeredService.getAccessStrategy().isServiceAccessAllowed()) {
        this.logger.debug("Placing registered service [{}] with id [{}] in context scope", registeredService.getServiceId(), registeredService.getId());
        WebUtils.putRegisteredService(context, registeredService);
        RegisteredServiceAccessStrategy accessStrategy = registeredService.getAccessStrategy();
        if (accessStrategy.getUnauthorizedRedirectUrl() != null) {
          this.logger.debug("Placing registered service's unauthorized redirect url [{}] with id [{}] in context scope", accessStrategy.getUnauthorizedRedirectUrl(), registeredService.getServiceId());
          WebUtils.putUnauthorizedRedirectUrl(context, accessStrategy.getUnauthorizedRedirectUrl());
        }
      }
    } else if (!this.enableFlowOnAbsentServiceRequest) {
      this.logger.warn("No service authentication request is available at [{}]. CAS is configured to disable the flow.", WebUtils.getHttpServletRequest(context).getRequestURL());
      throw new NoSuchFlowExecutionException(context.getFlowExecutionContext().getKey(), new UnauthorizedServiceException("screen.service.required.message", "Service is required"));
    }

    WebUtils.putService(context, service);
    return this.result("success");
  }

该方法的参数是RequestContext对象，该参数是一个流程的容器。该方法从request中获取TGT，并且构建一个临时的service对象（不同域注册的service，详情见接入系统管理）。并且，将TGT，warnCookieValue和service放在RequestContext作用域中，以便在登录流程中的state中进行判断

<action-state id="ticketGrantingTicketCheck">
    <evaluate expression="ticketGrantingTicketCheckAction"/>
    <transition on="notExists" to="gatewayRequestCheck"/>
    <transition on="invalid" to="terminateSession"/>
    <transition on="valid" to="hasServiceCheck"/>
</action-state>

初始化完成后，登录流程流转到第一个state（ticketGrantingTicketExistsCheck）

<bean id="ticketGrantingTicketCheckAction" class="org.jasig.cas.web.flow.TicketGrantingTicketCheckAction"
       c:centralAuthenticationService-ref="centralAuthenticationService" />

它会去执行ticketGrantingTicketCheck的doExecute方法检查requestContext中是否存在TGT,TGT是否有效

protected Event doExecute(RequestContext requestContext) throws Exception {
    String tgtId = WebUtils.getTicketGrantingTicketId(requestContext);
    if (!StringUtils.hasText(tgtId)) {
      return new Event(this, "notExists");
    } else {
      String eventId = "invalid";

      try {
        //验证TGT是否有效
        Ticket ticket = this.centralAuthenticationService.getTicket(tgtId, Ticket.class);
        if (ticket != null && !ticket.isExpired()) {
          eventId = "valid";
        }
      } catch (TicketException var5) {
        this.logger.trace("Could not retrieve ticket id {} from registry.", var5);
      }

      return new Event(this, eventId);
    }
  }

第一次访问应用系统http://app1.example.com,此时应用系统会跳转到CAS单点登录的服务器端http://127.0.0.1:8081/cas-server/login?service=http%3a%2f%2fapp1.example.com,此时，request的cookies中不存在CASTGC（TGT），因此RequestContext作用域中的ticketGrantingTicketId为null，登录流程流转到第二个state（gatewayRequestCheck）

<decision-state id="gatewayRequestCheck">
    <if test="requestParameters.gateway != '' and requestParameters.gateway != null and flowScope.service != null"
        then="gatewayServicesManagementCheck" else="serviceAuthorizationCheck"/>
</decision-state>

初始化时，把service保存在了RequestContext作用域中，但request中的参数gateway不存在，登录流程流转到第三个state（serviceAuthorizationCheck）

<!-- Do a service authorization check early without the need to login first -->
<action-state id="serviceAuthorizationCheck">
    <evaluate expression="serviceAuthorizationCheck"/>
    <transition to="generateLoginTicket"/>
</action-state>

<bean id="serviceAuthorizationCheck" class="org.jasig.cas.web.flow.ServiceAuthorizationCheck"
   c:servicesManager-ref="servicesManager" />

执行它的doExecute方法

protected Event doExecute(RequestContext context) throws Exception {
    Service service = WebUtils.getService(context);
    if (service == null) {
      return this.success();
    } else if (this.servicesManager.getAllServices().isEmpty()) {
      String msg = String.format("No service definitions are found in the service manager. Service [%s] will not be automatically authorized to request authentication.", service.getId());
      this.logger.warn(msg);
      throw new UnauthorizedServiceException("screen.service.empty.error.message");
    } else {
      RegisteredService registeredService = this.servicesManager.findServiceBy(service);
      String msg;
      if (registeredService == null) {
        msg = String.format("Service Management: Unauthorized Service Access. Service [%s] is not found in service registry.", service.getId());
        this.logger.warn(msg);
        throw new UnauthorizedServiceException("screen.service.error.message", msg);
      } else if (!registeredService.getAccessStrategy().isServiceAccessAllowed()) {
        msg = String.format("Service Management: Unauthorized Service Access. Service [%s] is not allowed access via the service registry.", service.getId());
        this.logger.warn(msg);
        WebUtils.putUnauthorizedRedirectUrlIntoFlowScope(context, registeredService.getAccessStrategy().getUnauthorizedRedirectUrl());
        throw new UnauthorizedServiceException("screen.service.error.message", msg);
      } else {
        return this.success();
      }
    }
  }

doExecute方法，要做的就是判断RequestContext作用域中是否存在service，如果service存在，查找service的注册信息。登录流程流转到第四个state（generateLoginTicket）

<action-state id="generateLoginTicket">
    <evaluate expression="generateLoginTicketAction.generate(flowRequestContext)"/>
    <transition on="generated" to="viewLoginForm"/>
</action-state>

<bean id="generateLoginTicketAction" class="org.jasig.cas.web.flow.GenerateLoginTicketAction"
      p:ticketIdGenerator-ref="loginTicketUniqueIdGenerator"/>

执行generate方法

public class GenerateLoginTicketAction {
  private static final String PREFIX = "LT";
  private final Logger logger = LoggerFactory.getLogger(this.getClass());
  @NotNull
  private UniqueTicketIdGenerator ticketIdGenerator;

  public GenerateLoginTicketAction() {
  }

  public final String generate(RequestContext context) {
    String loginTicket = this.ticketIdGenerator.getNewTicketId("LT");
    this.logger.debug("Generated login ticket {}", loginTicket);
    //放入RequestContext域
    WebUtils.putLoginTicket(context, loginTicket);
    return "generated";
  }

  public void setTicketIdGenerator(UniqueTicketIdGenerator generator) {
    this.ticketIdGenerator = generator;
  }
}

UniqueTicketIdGenerator要做的就是生成以LT作为前缀的loginTicket（例：LT-2-pfDmbEHfX2OkS0swLtDd7iDwmzlhsn），并且把loginTicket放到RequestContext作用域中（LT只作为登录时使用的票据）。登录流程流转到第五个state（viewLoginForm）

<view-state id="viewLoginForm" view="casLoginView" model="credential">
    <binder>
        <binding property="username" required="true"/>
        <binding property="password" required="true"/>
    </binder>
    <on-entry>
        <set name="viewScope.commandName" value="'credential'"/>

        <!--
        <evaluate expression="samlMetadataUIParserAction" />
        -->
    </on-entry>
    <transition on="submit" bind="true" validate="true" to="realSubmit"/>
</view-state>

这样经过流程的流转登录界面展示在浏览器上，默认的用户界面是/WEB-INF/jsp/ui/default/ui/casLoginView.jsp,如果想要自定义登录界面可以参考这个。

默认的登录页面中有lt、execution和_eventId三个隐藏参数

<input type="hidden" name="lt" value="${loginTicket}" />
<input type="hidden" name="execution" value="${flowExecutionKey}" />
<input type="hidden" name="_eventId" value="submit" />

lt参数值就是在GenerateLoginTicketAction的generate方法中生成的loginTicket

当用户输入了用户名和密码,点击登录按钮就会进入realSubmit这个state

<action-state id="realSubmit">
    <evaluate
            expression="authenticationViaFormAction.submit(flowRequestContext, flowScope.credential, messageContext)"/>
    <transition on="warn" to="warn"/>
    <!--
    To enable AUP workflows, replace the 'success' transition with the following:
    <transition on="success" to="acceptableUsagePolicyCheck" />
    -->
    <transition on="success" to="sendTicketGrantingTicket"/>
    <transition on="successWithWarnings" to="showMessages"/>
    <transition on="authenticationFailure" to="handleAuthenticationFailure"/>
    <transition on="error" to="generateLoginTicket"/>
</action-state>

执行authenticationViaFormAction的submit方法

public class AuthenticationViaFormAction {
  public static final String SUCCESS = "success";
  public static final String SUCCESS_WITH_WARNINGS = "successWithWarnings";
  public static final String WARN = "warn";
  public static final String AUTHENTICATION_FAILURE = "authenticationFailure";
  public static final String ERROR = "error";
  public static final String PUBLIC_WORKSTATION_ATTRIBUTE = "publicWorkstation";
  protected final Logger logger = LoggerFactory.getLogger(this.getClass());
  @NotNull
  private CentralAuthenticationService centralAuthenticationService;
  @NotNull
  private CookieGenerator warnCookieGenerator;

  public AuthenticationViaFormAction() {
  }

  public final Event submit(RequestContext context, Credential credential, MessageContext messageContext) {
    if (!this.checkLoginTicketIfExists(context)) {
      return this.returnInvalidLoginTicketEvent(context, messageContext);
    } else {
      return this.isRequestAskingForServiceTicket(context) ? this.grantServiceTicket(context, credential) : this.createTicketGrantingTicket(context, credential, messageContext);
    }
  }

  protected boolean checkLoginTicketIfExists(RequestContext context) {
    String loginTicketFromFlowScope = WebUtils.getLoginTicketFromFlowScope(context);
    String loginTicketFromRequest = WebUtils.getLoginTicketFromRequest(context);
    this.logger.trace("Comparing login ticket in the flow scope [{}] with login ticket in the request [{}]", loginTicketFromFlowScope, loginTicketFromRequest);
    //判断FlowScope和request中的loginTicket是否相同
    return StringUtils.equals(loginTicketFromFlowScope, loginTicketFromRequest);
  }

  protected Event returnInvalidLoginTicketEvent(RequestContext context, MessageContext messageContext) {
    String loginTicketFromRequest = WebUtils.getLoginTicketFromRequest(context);
    this.logger.warn("Invalid login ticket [{}]", loginTicketFromRequest);
    messageContext.addMessage((new MessageBuilder()).error().code("error.invalid.loginticket").build());
    return this.newEvent("error");
  }

  protected boolean isRequestAskingForServiceTicket(RequestContext context) {
    //requestScope和FlowScope中获取TGT
    String ticketGrantingTicketId = WebUtils.getTicketGrantingTicketId(context);
    FlowScope中获取service
    Service service = WebUtils.getService(context);
    return StringUtils.isNotBlank(context.getRequestParameters().get("renew")) && ticketGrantingTicketId != null && service != null;
  }

  protected Event grantServiceTicket(RequestContext context, Credential credential) {
    String ticketGrantingTicketId = WebUtils.getTicketGrantingTicketId(context);

    try {
      Service service = WebUtils.getService(context);
      ServiceTicket serviceTicketId = this.centralAuthenticationService.grantServiceTicket(ticketGrantingTicketId, service, new Credential[]{credential});
      WebUtils.putServiceTicketInRequestScope(context, serviceTicketId);
      this.putWarnCookieIfRequestParameterPresent(context);
      return this.newEvent("warn");
    } catch (AuthenticationException var6) {
      return this.newEvent("authenticationFailure", var6);
    } catch (TicketException var7) {
      if (var7 instanceof TicketCreationException) {
        this.logger.warn("Invalid attempt to access service using renew=true with different credential. Ending SSO session.");
        this.centralAuthenticationService.destroyTicketGrantingTicket(ticketGrantingTicketId);
      }

      return this.newEvent("error", var7);
    }
  }

  protected Event createTicketGrantingTicket(RequestContext context, Credential credential, MessageContext messageContext) {
    try {
      //根据用户凭证构造TGT，把TGT放到requestScope中，同时把TGT缓存到服务器的cache<ticketId,TGT>中
      TicketGrantingTicket tgt = this.centralAuthenticationService.createTicketGrantingTicket(new Credential[]{credential});
      WebUtils.putTicketGrantingTicketInScopes(context, tgt);
      this.putWarnCookieIfRequestParameterPresent(context);
      this.putPublicWorkstationToFlowIfRequestParameterPresent(context);
      return this.addWarningMessagesToMessageContextIfNeeded(tgt, messageContext) ? this.newEvent("successWithWarnings") : this.newEvent("success");
    } catch (AuthenticationException var5) {
      this.logger.debug(var5.getMessage(), var5);
      return this.newEvent("authenticationFailure", var5);
    } catch (Exception var6) {
      this.logger.debug(var6.getMessage(), var6);
      return this.newEvent("error", var6);
    }
  }

  protected boolean addWarningMessagesToMessageContextIfNeeded(TicketGrantingTicket tgtId, MessageContext messageContext) {
    boolean foundAndAddedWarnings = false;
    Iterator i$ = tgtId.getAuthentication().getSuccesses().entrySet().iterator();

    while(i$.hasNext()) {
      Entry<String, HandlerResult> entry = (Entry)i$.next();

      for(Iterator i$ = ((HandlerResult)entry.getValue()).getWarnings().iterator(); i$.hasNext(); foundAndAddedWarnings = true) {
        MessageDescriptor message = (MessageDescriptor)i$.next();
        this.addWarningToContext(messageContext, message);
      }
    }

    return foundAndAddedWarnings;
  }

  private void putWarnCookieIfRequestParameterPresent(RequestContext context) {
    HttpServletResponse response = WebUtils.getHttpServletResponse(context);
    if (StringUtils.isNotBlank(context.getExternalContext().getRequestParameterMap().get("warn"))) {
      this.warnCookieGenerator.addCookie(response, "true");
    } else {
      this.warnCookieGenerator.removeCookie(response);
    }

  }

  private void putPublicWorkstationToFlowIfRequestParameterPresent(RequestContext context) {
    if (StringUtils.isNotBlank(context.getExternalContext().getRequestParameterMap().get("publicWorkstation"))) {
      context.getFlowScope().put("publicWorkstation", Boolean.TRUE);
    }

  }

  private Event newEvent(String id) {
    return new Event(this, id);
  }

  private Event newEvent(String id, Exception error) {
    return new Event(this, id, new LocalAttributeMap("error", error));
  }

  public final void setCentralAuthenticationService(CentralAuthenticationService centralAuthenticationService) {
    this.centralAuthenticationService = centralAuthenticationService;
  }

  public final void setWarnCookieGenerator(CookieGenerator warnCookieGenerator) {
    this.warnCookieGenerator = warnCookieGenerator;
  }

  /** @deprecated */
  @Deprecated
  public void setTicketRegistry(TicketRegistry ticketRegistry) {
    this.logger.warn("setTicketRegistry() has no effect and will be removed in future CAS versions.");
  }

  private void addWarningToContext(MessageContext context, MessageDescriptor warning) {
    MessageBuilder builder = (new MessageBuilder()).warning().code(warning.getCode()).defaultText(warning.getDefaultMessage()).args(warning.getParams());
    context.addMessage(builder.build());
  }
}

AuthenticationViaFormAction的submit要做的就是判断FlowScope和request中的loginTicket是否相同。如果不同跳转到错误页面，如果相同，则根据用户凭证生成TGT（登录成功票据），并放到requestScope作用域中，同时把TGT缓存到服务器的cache<ticketId,TGT>中。登录流程流转到下个state（sendTicketGrantingTicket）

<action-state id="sendTicketGrantingTicket">
    <evaluate expression="sendTicketGrantingTicketAction"/>
    <transition to="serviceCheck"/>
</action-state>

执行 sendTicketGrantingTicketAction 的 doExecute方法

protected Event doExecute(RequestContext context) {
  //requestScope和FlowScope中获取TGT
  String ticketGrantingTicketId = WebUtils.getTicketGrantingTicketId(context);
  String ticketGrantingTicketValueFromCookie = (String)context.getFlowScope().get("ticketGrantingTicketId");
  if (ticketGrantingTicketId == null) {
    return this.success();
  } else {
    if (this.isAuthenticatingAtPublicWorkstation(context)) {
      LOGGER.info("Authentication is at a public workstation. SSO cookie will not be generated. Subsequent requests will be challenged for authentication.");
    } else if (!this.createSsoSessionCookieOnRenewAuthentications && this.isAuthenticationRenewed(context)) {
      LOGGER.info("Authentication session is renewed but CAS is not configured to create the SSO session. SSO cookie will not be generated. Subsequent requests will be challenged for authentication.");
    } else {
      //response中添加TGC
      this.ticketGrantingTicketCookieGenerator.addCookie(WebUtils.getHttpServletRequest(context), WebUtils.getHttpServletResponse(context), ticketGrantingTicketId);
    }

    if (ticketGrantingTicketValueFromCookie != null && !ticketGrantingTicketId.equals(ticketGrantingTicketValueFromCookie)) {
      this.centralAuthenticationService.destroyTicketGrantingTicket(ticketGrantingTicketValueFromCookie);
    }

    return this.success();
  }
}

SendTicketGrantingTicketAction的doExecute要做的是获取TGT，并根据TGT生成cookie添加到response。登录流程流转到下一个state（serviceCheck）

<decision-state id="serviceCheck">
    <if test="flowScope.service != null" then="generateServiceTicket" else="viewGenericLoginSuccess"/>
</decision-state>

由于此时FlowScope中存在service（http://127.0.0.1:8081/cas-server/login?service=http%3A%2F%2Fapp1.example.com），登录流程流转到下一个state（generateServiceTicket）

<action-state id="generateServiceTicket">
    <evaluate expression="generateServiceTicketAction"/>
    <transition on="success" to="warn"/>
    <transition on="authenticationFailure" to="handleAuthenticationFailure"/>
    <transition on="error" to="generateLoginTicket"/>
    <transition on="gateway" to="gatewayServicesManagementCheck"/>
</action-state>

执行generateServiceTicketAction的doExecute方法

protected Event doExecute(RequestContext context) {
  Service service = WebUtils.getService(context);
  String ticketGrantingTicket = WebUtils.getTicketGrantingTicketId(context);

  try {
    //根据TGT和service生成service ticket(ST-2-97kwhcdrBW97ynpBbZH5-cas01.example.org)
    ServiceTicket serviceTicketId = this.centralAuthenticationService.grantServiceTicket(ticketGrantingTicket, service);
    ST放到requestScope中
    WebUtils.putServiceTicketInRequestScope(context, serviceTicketId);
    return this.success();
  } catch (TicketException var5) {
    if (var5 instanceof InvalidTicketException) {
      this.centralAuthenticationService.destroyTicketGrantingTicket(ticketGrantingTicket);
    }

    return this.isGatewayPresent(context) ? this.result("gateway") : this.newEvent("error", var5);
  }
}

GenerateServiceTicketAction的doExecute要做的是获取service和TGT，并根据service和TGT生成以ST为前缀的serviceTicket（例：ST-2-97kwhcdrBW97ynpBbZH5-cas01.example.org），并把serviceTicket放到requestScope中。登录流程流转到下一个state（warn）

<decision-state id="warn">
    <if test="flowScope.warnCookieValue" then="showWarningView" else="redirect"/>
</decision-state>

FlowScope中不存在warnCookieValue，登录流程流转到下一个state（redirect）

<action-state id="redirect">
    <evaluate expression="flowScope.service.getResponse(requestScope.serviceTicketId)"
              result-type="org.jasig.cas.authentication.principal.Response" result="requestScope.response"/>
    <transition to="postRedirectDecision"/>
</action-state>

从requestScope中获取serviceTicket，构造response对象，并把response放到requestScope中。登录流程流转到下一个state（postRedirectDecision）

<decision-state id="postRedirectDecision">
    <if test="requestScope.response.responseType.name() == 'POST'" then="postView" else="redirectView"/>
</decision-state>

由于request请求是get类型，登录流程流转到下一个state（redirectView）

<end-state id="redirectView" view="externalRedirect:#{requestScope.response.url}"/>

此时流程如下：

1. 跳转到应用系统（http://app1.example.com/?ticket=ST-1-4hH2s5tzsMGCcToDvGCb-cas01.example.org）
2. 进入CAS客户端的AuthenticationFilter过滤器，由于session中获取名为_const_cas_assertion_的assertion对象不存在，但是request有ticket参数，所以进入到下一个过滤器
3. TicketValidationFilter过滤器的validate方法通过httpClient访问CAS服务器端（http://127.0.0.1:8081/cas/serviceValidate?ticket=ST-1-4hH2s5tzsMGCcToDvGCb-cas01.example.org&service=http://app1.example.com）验证ticket是否正确，并返回assertion对象。
   Assertion对象格式类似于

<cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>
	<cas:authenticationSuccess>
		<cas:user>system</cas:user>

	</cas:authenticationSuccess>
</cas:serviceResponse>

至此就完成了登录的整个流程
参考文档：（https://blog.csdn.net/dovejing/article/details/44523545 https://www.ibm.com/developerworks/cn/education/java/j-spring-webflow/index.html）