此种单点登录模型中涉及三个角色
- End User's Client (A)
- Portal Web Server with Portal Application (B)
- Web Server Farm (C)
以上A是客户终端,B是入口服务器,类似于代理,所有的客户请求都会经过B,B再发送请求至C
现在C的通过验证策略是将B加入他的ACL(Access Control List),再只要发给他的请求中带有合法的用户名参数,
就会予以认证通过,现在的问题是普通的通过B,如链接或转发(sendRedirect)出去的请求C不认可来自ACL,应该怎么办呢?具体的Web Server Farm可能有具体的策略应对,一例:
// the following part is to send request and then get the 'Location'
// in the response, redirect it to the user client
try {
URL url = new URL(urlString);
// allow redirection
HttpURLConnection.setFollowRedirects(false);
HttpURLConnection urlConnection = (HttpURLConnection)url.openConnection();
urlConnection.setDoOutput(true);
// put parameters
OutputStreamWriter wr = new OutputStreamWriter(urlConnection.getOutputStream());
wr.write("userId=" + userID + "@" + compID);
wr.flush();
wr.close();
urlConnection.connect();
// get header information
String location = urlConnection.getHeaderField("Location");
urlConnection.disconnect();
System.out.println("location = " + location);
if(location != null) {
response.sendRedirect(location);
}
} catch (Exception e) {
e.printStackTrace();
}
如上代码所见,如果不去获取Header Location的话,客户端貌似没办法获得合法的转向(redirection),当然也就没有正确的反馈了
为什么点B上的链接也算是源自客户端A的请求?
答:姑且认为点一个链接就是客户端的转向吧