CAS配置日志（1）

 

为了方便，专门建立一个生成证书的存在目录；
F:/casfile
 
一、注意事项：通过几次失败的经过总结
1、jdk安装在有空格的目录中（如:D:/Program Files/java/jdk1.5），经常出现找不到路径的错误。
2、keytool使用java环境变量，是区别大小写的。

二、开始安装并且配置

1.     生成Tomcat的安全证书，

运行：cmd

输入：%java_home%/bin/keytool -genkey -alias tomcat -keyalg RSA

回车

密码：changeit

用户名，localhost
其它随便
到出现……[on]的时候，输入y，回车
再次输入密码；tomcat（安全证书的密码）

默认生成的.keystore 在C:/Documents and Settings/你的windows用户名/下

 

2.     生成服务器证书

%java_home%/bin/keytool -export -alias tomcat -file server.crt

在F:"casfile下会看到一个server.crt文件；

暂时不管它，继续…

%java_home%/bin/keytool -import -file server.crt -keystore %java_home%/jre/lib/security/cacerts

注意密码为：changeit

 

3.     产生SERVER的证书
keytool -genkey -alias my-alias-name -keyalg RSA -keystore keystore-file

输入的内容同1

4.     开始配置服务器的用户中心站点：
在server配置tomcat使用HTTPS

Tomcat5/conf/server.xml里添加以下代码

<Connector className="org.apache.coyote.tomcat5.CoyoteConnector"
port="8443" minProcessors="5" maxProcessors="75"
enableLookups="true" disableUploadTimeout="true"
acceptCount="100" debug="0" scheme="https"
secure="true">
<Factory className="org.apache.coyote.tomcat5.CoyoteServerSocketFactory"

keystoreFile="F:/casfile/keystore-file"

keystorePass="changeit" clientAuth="false" protocol="TLS" />

</Connector>

将cas-server-3.1.1-release.zipp解压，并将"modules"cas-server-webapp-3.3.1.war拷贝到tomcat5的webapps下,重新命名为cas.war

5.     开始配置应用站点比如app1

web.xml

<?xml version="1.0" encoding="ISO-8859-1"?>

<!DOCTYPE web-app

    PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"

    "http://java.sun.com/dtd/web-app_2_3.dtd">

 

<web-app>

<filter>

<filter-name>CASFilter</filter-name>

<filter-class>edu.yale.its.tp.cas.client.filter.CASFilter</filter-class>

<init-param>

<param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>

<param-value>https://localhost:8443/cas/login</param-value>

</init-param>

<init-param>

<param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>

<param-value>https://localhost:8443/cas/proxyValidate</param-value>

</init-param>

<init-param>

<param-name>edu.yale.its.tp.cas.client.filter.serverName</param-name>

<param-value>localhost:8080</param-value>

</init-param>

</filter>

<filter-mapping>

<filter-name>CASFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping> 

</web-app>

 1<?xml version="1.0" encoding="ISO-8859-1"?>
 2
 3<!DOCTYPE web-app
 4
 5    PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
 6
 7    "http://java.sun.com/dtd/web-app_2_3.dtd">
 8
 9 
10
11<web-app>
12
13<filter>
14
15<filter-name>CASFilter</filter-name>
16
17<filter-class>edu.yale.its.tp.cas.client.filter.CASFilter</filter-class>
18
19<init-param>
20
21<param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>
22
23<param-value>https://localhost:8443/cas/login</param-value>
24
25</init-param>
26
27<init-param>
28
29<param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>
30
31<param-value>https://localhost:8443/cas/proxyValidate</param-value>
32
33</init-param>
34
35<init-param>
36
37<param-name>edu.yale.its.tp.cas.client.filter.serverName</param-name>
38
39<param-value>localhost:8080</param-value>
40
41</init-param>
42
43</filter>
44
45<filter-mapping>
46
47<filter-name>CASFilter</filter-name>
48
49<url-pattern>/*</url-pattern>
50
51</filter-mapping> 
52
53</web-app>
54

 

在app1中新建立一个index.html，内容随便，比如”ok了”

 

将cas-client-java-2.1.1.zip解压,，将lib/servlet.jar和dist/casclient.jar拷贝到app1"WEB-INF"lib下

 

6.     导出SERVER的证书，用来给所有需要用到的客户端导入
keytool -export -file myserver.cert -alias my-alias-name -keystore keystore-file

F:"casfile"myserver.cert生成

 

7.     在客户端的JVM里导入信任的SERVER的证书
keytool -import -keystore E:/java/jdk1.5/jre"lib/security/cacerts -file myserver.cert -alias my-alias-name

密码：changeit

 

8.     启动tomcat5测试 

   访问http://localhost:8080/app1
   自动跳转到https://localhost:8443/cas/login?......

   随便输入用户名，密码一样。登录
   转回到了，http://localhost:8080/app1
   页面显示”ok了”

 

9.     新建立app2，xml内容和app1一样
    添加两个站点间的超链接，在app1登录后，通过连接到app2,正常

 

9.     如果客户端使用cas-client-3.1的配置

 web.xml

<filter>

   <filter-name>CAS Authentication Filter</filter-name>

   <filter-class>

    org.jasig.cas.client.authentication.AuthenticationFilter

   </filter-class>

   <init-param>

    <param-name>casServerLoginUrl</param-name>

    <param-value>

    https://a.site.com:8443/cas/login

    </param-value>

   </init-param>

 

   <init-param>

    <param-name>renew</param-name>

    <param-value>false</param-value>

   </init-param>

   <init-param>

    <param-name>gateway</param-name>

    <param-value>false</param-value>

   </init-param>

   <init-param>

    <param-name>serverName</param-name>

    <param-value>http://d.site.com:8080</param-value>

   </init-param>

</filter>

 

<filter>

   <filter-name>CAS Validation Filter</filter-name>

   <filter-class>

    org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter

   </filter-class>

   <init-param>

    <param-name>casServerUrlPrefix</param-name>

    <param-value>https://a.site.com:8443/cas</param-value>

   </init-param>

   <init-param>

    <param-name>serverName</param-name>

    <param-value>http://d.site.com:8080</param-value>

   </init-param>

   <init-param>

    <param-name>useSession</param-name>

    <param-value>true</param-value>

   </init-param>

   <init-param>

    <param-name>redirectAfterValidation</param-name>

    <param-value>true</param-value>

   </init-param>

</filter>

 

<filter>

   <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>

   <filter-class>

    org.jasig.cas.client.util.HttpServletRequestWrapperFilter

   </filter-class>

</filter>

 

<filter>

   <filter-name>CAS Assertion Thread Local Filter</filter-name>

   <filter-class>

    org.jasig.cas.client.util.AssertionThreadLocalFilter

   </filter-class>

</filter>

 

<filter-mapping>

   <filter-name>CAS Authentication Filter</filter-name>

   <url-pattern>/*</url-pattern>

</filter-mapping>

 

<filter-mapping>

   <filter-name>CAS Validation Filter</filter-name>

   <url-pattern>/*</url-pattern>

</filter-mapping>

 

<filter-mapping>

   <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>

   <url-pattern>/*</url-pattern>

</filter-mapping>

 

<filter-mapping>

   <filter-name>CAS Assertion Thread Local Filter</filter-name>

   <url-pattern>/*</url-pattern>

</filter-mapping>

 

  1<filter>
  2
  3   <filter-name>CAS Authentication Filter</filter-name>
  4
  5   <filter-class>
  6
  7    org.jasig.cas.client.authentication.AuthenticationFilter
  8
  9   </filter-class>
 10
 11   <init-param>
 12
 13    <param-name>casServerLoginUrl</param-name>
 14
 15    <param-value>
 16
 17    https://a.site.com:8443/cas/login
 18
 19    </param-value>
 20
 21   </init-param>
 22
 23 
 24
 25   <init-param>
 26
 27    <param-name>renew</param-name>
 28
 29    <param-value>false</param-value>
 30
 31   </init-param>
 32
 33   <init-param>
 34
 35    <param-name>gateway</param-name>
 36
 37    <param-value>false</param-value>
 38
 39   </init-param>
 40
 41   <init-param>
 42
 43    <param-name>serverName</param-name>
 44
 45    <param-value>http://d.site.com:8080</param-value>
 46
 47   </init-param>
 48
 49</filter>
 50
 51 
 52
 53<filter>
 54
 55   <filter-name>CAS Validation Filter</filter-name>
 56
 57   <filter-class>
 58
 59    org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter
 60
 61   </filter-class>
 62
 63   <init-param>
 64
 65    <param-name>casServerUrlPrefix</param-name>
 66
 67    <param-value>https://a.site.com:8443/cas</param-value>
 68
 69   </init-param>
 70
 71   <init-param>
 72
 73    <param-name>serverName</param-name>
 74
 75    <param-value>http://d.site.com:8080</param-value>
 76
 77   </init-param>
 78
 79   <init-param>
 80
 81    <param-name>useSession</param-name>
 82
 83    <param-value>true</param-value>
 84
 85   </init-param>
 86
 87   <init-param>
 88
 89    <param-name>redirectAfterValidation</param-name>
 90
 91    <param-value>true</param-value>
 92
 93   </init-param>
 94
 95</filter>
 96
 97 
 98
 99<filter>
100
101   <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
102
103   <filter-class>
104
105    org.jasig.cas.client.util.HttpServletRequestWrapperFilter
106
107   </filter-class>
108
109</filter>
110
111 
112
113<filter>
114
115   <filter-name>CAS Assertion Thread Local Filter</filter-name>
116
117   <filter-class>
118
119    org.jasig.cas.client.util.AssertionThreadLocalFilter
120
121   </filter-class>
122
123</filter>
124
125 
126
127<filter-mapping>
128
129   <filter-name>CAS Authentication Filter</filter-name>
130
131   <url-pattern>/*</url-pattern>
132
133</filter-mapping>
134
135 
136
137<filter-mapping>
138
139   <filter-name>CAS Validation Filter</filter-name>
140
141   <url-pattern>/*</url-pattern>
142
143</filter-mapping>
144
145 
146
147<filter-mapping>
148
149   <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
150
151   <url-pattern>/*</url-pattern>
152
153</filter-mapping>
154
155 
156
157<filter-mapping>
158
159   <filter-name>CAS Assertion Thread Local Filter</filter-name>
160
161   <url-pattern>/*</url-pattern>
162
163</filter-mapping>
164