CAS同SpringSecurity整合设计AjaxLogin（设计的改进和解释遇到的疑惑）

1.描述页面有：1）TestSSO/simpleLogin-ajax.jsp ajax登录页面

                     2）TestSSO/index.jsp页面

                     3）TestSSO/welcome.jsp页面

 

注意index.jsp页面有两个连接 一个指向welcome.jsp（只有admin可以进入） 一个指向phpBB

 

原先设计方式：在CAS自定义了一个FLOW流进行验证

 

<?xml version="1.0" encoding="UTF-8"?> <flow xmlns="http://www.springframework.org/schema/webflow" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation=" http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow-1.0.xsd"> <start-state idref="simpleLogin"/> <action-state id="simpleLogin"> <action bean="simpleLoginAction"/> <transition on="submit" to="ticketGrantingTicketExistsCheck"></transition> <transition on="error" to="statusErrorCallbackView" /> </action-state> <decision-state id="ticketGrantingTicketExistsCheck"> <if test="${flowScope.ticketGrantingTicketId != null}" then="generateServiceTicket" else="bindAndValidate" /> </decision-state> <action-state id="bindAndValidate"> <action bean="authenticationViaFormAction" /> <transition on="success" to="submit" /> <transition on="error" to="statusErrorCallbackView" /> </action-state> <action-state id="submit"> <action bean="authenticationViaFormAction" method="submit" /> <transition on="success" to="sendTicketGrantingTicket" /> <transition on="error" to="statusErrorCallbackView" /> </action-state> <action-state id="sendTicketGrantingTicket"> <action bean="sendTicketGrantingTicketAction" /> <transition on="success" to="generateServiceTicket" /> <transition on="error" to="statusErrorCallbackView" /> </action-state> <action-state id="generateServiceTicket"> <action bean="generateServiceTicketAction" /> <transition on="error" to="statusErrorCallbackView" /> <transition on="success" to ="statusSuccessCallbackView" /> </action-state> <!-- <end-state id="simpleRemoteCallbackView" view="simpleRemoteCallbackView" />--> <!-- <end-state id="simpleRemoteCallbackView" view="bean:dynamicRedirectViewSelector" />--> <end-state id="redirect" view="bean:dynamicRedirectViewSelector" /> <end-state id="statusSuccessCallbackView" view="bean:dynamicRedirectViewSelector" /> 原先使用下面那个注释后的那句上面那句是改后使用的。 <!-- <end-state id="statusSuccessCallbackView" view="statusSuccessCallbackView" />--> <end-state id="statusErrorCallbackView" view="statusErrorCallbackView" /> </flow>

 

使用在cas流里面判断登录成功就返回一个view，登录失败返回一个view，如果这样写的话有个问题：当登录成功后在index页面获取不到用户名，在index中获取到的用户名为匿名用户。只有再进入一个受限页面如welcome页面回来才能正确获取。

 

个人猜测原因（还没研究源码）：由于在加入CAS和Spring Security整合中这个过程没完整，完整流程是认证信息->授权，由于我只在CAS端填写了认证信息，没有回到客户端把认证信息封装到认证接口，而当第二次进入有限制的url就会去看是否有认证信息，已经有了并且封装起来，因此才可以取得正确的用户名。

 

2）直接定位到login页面和访问受限页面重定位到login登录成功后跳转的区别：

   1）直接定位到login页面登录的时候登陆成功就会跳到defaultTargetUrl

   2）受限页面重定位到login登录成功后跳转到受限页面

 

3）只使用Spring Security XML中defaultTargetUrl位置 和使用CAS时候defaultTargetUrl的位置

<?xml version="1.0" encoding="UTF-8"?> <b:beans xmlns="http://www.springframework.org/schema/security" xmlns:b="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd"> <global-method-security secured-annotations="enabled" jsr250-annotations="enabled"/> <b:bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource"> <b:property name="driverClassName" value="com.mysql.jdbc.Driver" /> <b:property name="url" value="jdbc:mysql://localhost:3306/phpbb3" /> <b:property name="username" value="root" /> <b:property name="password" value="123" /> </b:bean> <http entry-point-ref="casProcessingFilterEntryPoint" access-denied-page="/accessDenied.jsp"> <intercept-url pattern="/index.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY,ROLE_ADMIN"/> <!--IS_AUTHENTICATED_ANONYMOUSLY--> <intercept-url pattern="/simpleLogin-ajax.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY,ROLE_ADMIN"/> <intercept-url pattern="/welcome.jsp" access="ROLE_ADMIN"/> <intercept-url pattern="/other.jsp" access="ROLE_ADMIN"/> @@@ 只使用SpringSecurity 在这里定义default-target-url <form-login login-page="/login.jsp" authentication-failure-url="/loginAction?status=false" default-target-url="/loginAction?status=true" /> <logout logout-success-url="https://localhost:8443/cas/logout" /> <remember-me data-source-ref="dataSource" /> <anonymous /> <concurrent-session-control max-sessions="1" /> </http> <authentication-provider> <password-encoder hash="md5" /> <jdbc-user-service id="jdbcUserService" cache-ref="userCache" data-source-ref="dataSource" users-by-username-query="select username,user_password,user_enable from phpbb_users where username=?" authorities-by-username-query="select username,user_role from phpbb_users where username=?" /> </authentication-provider> <authentication-manager alias="authenticationManager" /> @@@加CAS的时候在下面定义default-target-url <b:bean id="casProcessingFilter" class="org.springframework.security.ui.cas.CasProcessingFilter"> <custom-filter after="CAS_PROCESSING_FILTER" /> <b:property name="authenticationManager" ref="authenticationManager" /> <b:property name="defaultTargetUrl" value="http://localhost:8080/TestSSO/loginAction?status=true" /> </b:bean> <!-- single sign out --> <b:bean id="casSingleSignOutFilter" class="check.SingleSignOutFilter"> <custom-filter before="CAS_PROCESSING_FILTER"/> </b:bean> <!-- single sign out --> <b:bean id="casProcessingFilterEntryPoint" class="org.springframework.security.ui.cas.CasProcessingFilterEntryPoint"> <b:property name="loginUrl" value="https://localhost:8443/cas" /> <b:property name="serviceProperties" ref="casServiceProperties" /> </b:bean> <b:bean id="casServiceProperties" class="org.springframework.security.ui.cas.ServiceProperties"> <b:property name="service" value="http://localhost:8080/TestSSO/j_spring_cas_security_check" /> <b:property name="sendRenew" value="false" /> </b:bean> <b:bean id="casAuthenticationProvider" class="org.springframework.security.providers.cas.CasAuthenticationProvider"> <custom-authentication-provider /> <b:property name="userDetailsService" ref="jdbcUserService" /> <b:property name="serviceProperties" ref="casServiceProperties" /> <b:property name="ticketValidator"> <b:bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator"> <b:constructor-arg index="0" value="https://localhost:8443/cas" /> </b:bean> </b:property> <b:property name="key" value="TestSSO" /> </b:bean> <!-- cacher for userinfo --> <b:bean id="userCache" class="org.springframework.security.providers.dao.cache.EhCacheBasedUserCache"> <b:property name="cache" ref="userEhCache" /> </b:bean> <b:bean id="userEhCache" class="org.springframework.cache.ehcache.EhCacheFactoryBean"> <b:property name="cacheManager" ref="cacheManager" /> <b:property name="cacheName" value="userCache" /> </b:bean> <b:bean id="cacheManager" class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean" /> </b:beans>

 

 

只有在CAS中提交用户信息然后再通过CAS处理默认访问页，这个流程才完整，像我之前处理的方式只是在CAS中处理，由CAS抛出处理结果没有再到SpringSecurity中处理，因此

<end-state id="statusSuccessCallbackView" view="bean:dynamicRedirectViewSelector" />在自定义流中是必须的。能完成整个流程，而登录失败可以在CAS端抛出。

 

 总结：定义当访问到受限url的时候收集用户认证信息的入口：b:property name="loginUrl" 如下

 <b:bean id="casProcessingFilterEntryPoint" class="org.springframework.security.ui.cas.CasProcessingFilterEntryPoint"> <b:property name="loginUrl" value="https://localhost:8443/cas" /> <!--<b:property name="loginUrl" value="http://localhost:8080/TestSSO/simpleLogin-ajax.jsp" />--> <b:property name="serviceProperties" ref="casServiceProperties" /> </b:bean>