CAS 经验收集

１，非常遗憾，经过查证，SSL协议只支持domain name，也就是你可以用你的计算机名或者localhost，我用domain name做过测试，完全正确。

假如我的电脑ip为192.168.6.110，我的电脑名为netfly
那么，在生成证书的时候，就不能输入localhost，只能输入netfly，在其他电脑上，一样可以通过ip访问我的服务。比如说，输入
http://192.168.6.110:8080/YaleCASTest/hello.jsp
http://192.168.6.110:8080/YaleCASTest/servlet/RequestInfo

都可以返回正确的信息，不过，web.xml也要改改，如下：

 

代码

1. <filter>  
2.     <filter-name>CASFilter</filter-name>  
3.     <filter-class>edu.yale.its.tp.cas.client.filter.CASFilter</filter-class>  
4.     <init-param>  
5.         <param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>  
6.         <param-value>https://netfly:8443/cas/login</param-value>  
7.     </init-param><!--这里的server是服务端的IP-->  
8.     <init-param>  
9.         <param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>  
10.         <param-value>https://netfly:8443/cas/proxyValidate</param-value>  
11.     </init-param><!--这里的serName是服务端的主机名，而且必须是-->  
12.     <init-param>  
13.       <param-name>edu.yale.its.tp.cas.client.filter.serverName</param-name>  
14.       <param-value>netfly:8080</param-value><!--client:port就是需要CAS需要拦截的地址和端口，一般就是这个TOMCAT所启动的IP和port-->  
15.     </init-param>  
16. </filter>  

<script type="text/javascript">render_code();</script> ２，CAS异常问题总结

严重: edu.yale.its.tp.cas.client.CASAuthenticationException: Unable to validate ProxyTicketValidator [[edu.yale.its.tp.cas.client.ProxyTicketValidator prox
yList=[null] [edu.yale.its.tp.cas.client.ServiceTicketValidator casValidateUrl=[https://192.168.1.111:8443/cas/proxyValidate] ticket=[ST-0-9h7Mx5HK3pfsdxRv
MD3y] service=[http%3A%2F%2F192.168.1.222%3A8080%2Fservlets-examples%2Fservlet%2FHelloWorldExample] renew=false]]]


这个CAS异常是从CAS Client里面抛出，是当我们不使用证书的CN去访问域名的时候（比如下文是用IP访问而且证书的CN是该IP对应的域名而非该IP），CASClient无法信任，因为你证书的CN命名写着abc.com，192.168.1.111这个IP是无法被CAS Client识别。

edu.yale.its.tp.cas.client.CASAuthenticationException: Unable to validate ProxyTicketValidator [[edu.yale.its.tp.cas.client.ProxyTicketValidator proxyList = [ null ] [edu.yale.its.tp.cas.client.ServiceTicketValidator casValidateUrl = [https: // 192.168.1.111:8443/cas/proxyValidate] ticket=[ST-0-9h7Mx5HK3pfsdxRvMD3y] service=[http%3A%2F%2F192.168.1.222%3A8080%2Fservlets-examples%2Fservlet%2FHelloWorldExample] renew=false]]]
    at edu.yale.its.tp.cas.client.CASReceipt.getReceipt(CASReceipt.java: 52 )
    at edu.yale.its.tp.cas.client.filter.CASFilter.getAuthenticatedUser(CASFilter.java: 455 )
    at edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java: 378 )
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java: 202 )
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java: 173 )
    at filters.ExampleFilter.doFilter(ExampleFilter.java: 101 )
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java: 202 )
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java: 173 )
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java: 213 )
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java: 178 )
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java: 432 )
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java: 126 )
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java: 105 )
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java: 107 )
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java: 148 )
    at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java: 869 )
    at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java: 664 )
    at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java: 527 )
    at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java: 80 )
    at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java: 684 )
    at java.lang.Thread.run(Thread.java: 595 )
Caused by: java.io.IOException: HTTPS hostname wrong:  should be  < 192.168 . 1.111 >
    at sun.net.www.protocol.https.HttpsClient.checkURLSpoofing(HttpsClient.java: 493 )
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java: 418 )
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java: 170 )
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java: 905 )
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java: 234 )
    at edu.yale.its.tp.cas.util.SecureURL.retrieve(SecureURL.java: 84 )
    at edu.yale.its.tp.cas.client.ServiceTicketValidator.validate(ServiceTicketValidator.java: 212 )
    at edu.yale.its.tp.cas.client.CASReceipt.getReceipt(CASReceipt.java: 50 )

解决办法：
用域名访问，域名就是证书的CN。

posted on 2006-09-05 18:20 david.turing 阅读(985) 评论(1)  编辑 收藏 引用 所属分类: Security异常问题