kisso OA所有请求都跳转到这个接口,登录只有这一个入口 http://my.web.com:8090/oa/login.ht @RequestMapping("/login.ht") public String login(HttpServletRequest request,HttpServletResponse response) { SSOToken token = SSOHelper.getToken(request); if (token == null) { //重定向至代理跨域地址页 return response.sendRedirect("http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.ht"); } else { //从token中取出信息,进行相关信息初始化。 String userId = token.getUid(); //....... } return "index"; } SSO中心 http://sso.test.com:8080/login.html @RequestMapping("/login.ht") public String login(HttpServletRequest request,HttpServletResponse response) { String returnUrl = request.getParameter(SSOConfig.getInstance().getParamReturl());//因为XXXXX处记录了,所以此处可以取到。 Token token = SSOHelper.getToken(request); if (token == null) { //正常登录 需要过滤sql及脚本注入 WafRequestWrapper wr = new WafRequestWrapper(request); String name = wr.getParameter("userid");//账号、密码认证 if (name != null && !"".equals(name)) { //设置登录 Cookie 最后一个参数 true 时添加 cookie 同时销毁当前 JSESSIONID 创建信任的 JSESSIONID SSOToken st = new SSOToken(request, "1000"); SSOHelper.setSSOCookie(request, response, st, true); // 重定向到指定地址 returnUrl if (StringUtils.isEmpty(returnUrl)) { returnUrl = "/index.html"; } else { returnUrl = HttpUtil.decodeURL(returnUrl); } return response.sendRedirect(returnUrl); } else { if (StringUtils.isNotEmpty(returnUrl)) { request.setAttribute("ReturnURL", returnUrl);//存储起来XXXXX } return "login"; } } else { if (StringUtils.isEmpty(returnUrl)) { returnUrl = "/index.html"; } return response.sendRedirect(returnUrl); } } OA中,经SSO登录后,又重定向回来 http://my.web.com:8090/oa/proxylogin.ht @RequestMapping("/proxylogin.ht") public String proxylogin(HttpServletRequest request,HttpServletResponse response) { // 用户自定义配置获取 由于不确定性,kisso 提倡,用户自己定义配置。 PropertiesUtil prop = SSOConfig.getSSOProperties(); //业务系统私钥签名 authToken 自动设置临时会话 cookie 授权后自动销毁 AuthToken at = SSOHelper.askCiphertext(request, response, prop.get("sso.defined.my_private_key")); //at.getUuid() 作为 key 设置 authToken 至分布式缓存中,然后 sso 系统二次验证 //askurl 询问 sso 是否登录地址 String askurl = prop.get("sso.defined.askurl"); request.setAttribute("askurl", askurl); //askTxt 询问 token 密文 String askData = at.encryptAuthToken(); request.setAttribute("askData", askData); //my 确定是否登录地址 String okurl = prop.get("sso.defined.oklogin"); request.setAttribute("okurl", okurl); return "proxylogin"; } proxylogin.jsp页面中js $(function(){ $.ajax({ url: askurl, data: {askData:askData}, success: function(d){ if(d.msg == "-1"){ window.location.href = "http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.html"; }else{ $.post(okurl, {replyTxt:d.msg} , function(e) { window.location.href = e.returl; }, "json"); } },error:function(){ window.location.href = "http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.ht" }, dataType: json }); }); SSO中askurl地址 http://sso.test.com:8080/replylogin.html @ResponseBody @RequestMapping("/replylogin") public void replylogin(HttpServletRequest request,HttpServletResponse response) { StringBuffer replyData = new StringBuffer(); replyData.append(request.getParameter("callback")).append("({\"msg\":\""); Token token = SSOHelper.getToken(request); if (token != null) { String askData = request.getParameter("askData"); if (askData != null && !"".equals(askData)) { //用户自定义配置获取 由于不确定性,kisso 提倡,用户自己定义配置。 PropertiesUtil prop = SSOConfig.getSSOProperties(); //下面开始验证票据,签名新的票据每一步都必须有。 AuthToken at = SSOHelper.replyCiphertext(request, askData); if (at != null) { //1、业务系统公钥验证签名合法性(此处要支持多个跨域端,取 authToken 的 app 名找到对应系统公钥验证签名) at = at.verify(prop.get("sso.defined." + at.getApp() + "_public_key")); if (at != null) { //at.getUuid() 作为 key 设置 authToken 至分布式缓存中,然后 sso 系统二次验证 //at.setData(data); 设置自定义信息,当然你也可以直接 at.setData(token.jsonToken()); 把当前 SSOToken 传过去。 at.setUid(token.getUid());//设置绑定用户ID at.setTime(token.getTime());//设置登录时间 //2、SSO 的私钥签名 at.sign(prop.get("sso.defined.sso_private_key")); //3、生成回复密文票据 replyData.append(at.encryptAuthToken()); } else { //非法签名, 可以重定向至无权限界面,自己处理 replyData.append("-2"); } } else { //非法签名, 可以重定向至无权限界面,自己处理 replyData.append("-2"); } } } else { // 未登录 replyData.append("-1"); } try { replyData.append("\"})"); response.setContentType("text/html;charset=" + "UTF-8"); PrintWriter out = response.getWriter(); out.print(replyData); out.flush(); } catch (IOException e) { e.printStackTrace(); } } OA中okurl http://my.web.com:8090/oklogin.ht @ResponseBody @RequestMapping("/oklogin") public void oklogin(HttpServletRequest request,HttpServletResponse response) { String returl = "http://my.web.com:8090/timeout.html"; //回复密文是否存在 SSO 公钥验证回复密文是否正确 设置 MY 系统自己的 Cookie String replyTxt = request.getParameter("replyTxt"); if (replyTxt != null && !"".equals(replyTxt)) { // 用户自定义配置获取 由于不确定性,kisso 提倡,用户自己定义配置。 PropertiesUtil prop = SSOConfig.getSSOProperties(); AuthToken at = SSOHelper.ok(request, response, replyTxt, prop.get("sso.defined.my_public_key"), prop.get("sso.defined.sso_public_key")); if (at != null) { returl = "http://my.web.com:8090/index.html"; SSOToken st = new SSOToken(); st.setUid(at.getUid()); st.setTime(at.getTime()); //设置 true 时添加 cookie 同时销毁当前 JSESSIONID 创建信任的 JSESSIONID SSOHelper.setSSOCookie(request, response, st, true); } } try { response.setContentType("text/html;charset=" + "UTF-8"); PrintWriter out = response.getWriter(); out.print("{\"returl\":\"" + returl + "\"}"); out.flush(); } catch (IOException e) { e.printStackTrace(); } } 于是整个过程是这样的: http://my.web.com:8090/oa/login.ht || http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.ht || http://my.web.com:8090/oa/proxylogin.ht || http://sso.test.com:8080/replylogin.html || http://my.web.com:8090/oa/oklogin.ht || http://my.web.com:8090/oa/login.ht
http://git.oschina.net/juapk/kisso
kisso
OA所有请求都跳转到这个接口,登录只有这一个入口http://my.web.com:8090/oa/login.ht
@RequestMapping("/login.ht")public String login(HttpServletRequest request,HttpServletResponse response) {SSOToken token = SSOHelper.getToken(request);if (token == null) {//重定向至代理跨域地址页return response.sendRedirect("http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.ht");} else {//从token中取出信息,进行相关信息初始化。String userId = token.getUid();//.......}return "index";}
SSO中心http://sso.test.com:8080/login.html
@RequestMapping("/login.ht")public String login(HttpServletRequest request,HttpServletResponse response) {String returnUrl = request.getParameter(SSOConfig.getInstance().getParamReturl());//因为XXXXX处记录了,所以此处可以取到。Token token = SSOHelper.getToken(request);if (token == null) {//正常登录 需要过滤sql及脚本注入WafRequestWrapper wr = new WafRequestWrapper(request);String name = wr.getParameter("userid");//账号、密码认证if (name != null && !"".equals(name)) {//设置登录 Cookie 最后一个参数 true 时添加 cookie 同时销毁当前 JSESSIONID 创建信任的 JSESSIONIDSSOToken st = new SSOToken(request, "1000");SSOHelper.setSSOCookie(request, response, st, true);// 重定向到指定地址 returnUrlif (StringUtils.isEmpty(returnUrl)) {returnUrl = "/index.html";} else {returnUrl = HttpUtil.decodeURL(returnUrl);}return response.sendRedirect(returnUrl);} else {if (StringUtils.isNotEmpty(returnUrl)) {request.setAttribute("ReturnURL", returnUrl);//存储起来XXXXX}return "login";}} else {if (StringUtils.isEmpty(returnUrl)) {returnUrl = "/index.html";}return response.sendRedirect(returnUrl);}}
OA中,经V8登录后,又重定向回来http://my.web.com:8090/oa/proxylogin.ht@RequestMapping("/proxylogin.ht")public String proxylogin(HttpServletRequest request,HttpServletResponse response) {// 用户自定义配置获取 由于不确定性,kisso 提倡,用户自己定义配置。PropertiesUtil prop = SSOConfig.getSSOProperties();//业务系统私钥签名 authToken 自动设置临时会话 cookie 授权后自动销毁AuthToken at = SSOHelper.askCiphertext(request, response, prop.get("sso.defined.my_private_key"));//at.getUuid() 作为 key 设置 authToken 至分布式缓存中,然后 sso 系统二次验证//askurl 询问 sso 是否登录地址String askurl = prop.get("sso.defined.askurl");request.setAttribute("askurl", askurl);
//askTxt 询问 token 密文String askData = at.encryptAuthToken();request.setAttribute("askData", askData);
//my 确定是否登录地址String okurl = prop.get("sso.defined.oklogin");request.setAttribute("okurl", okurl);
return "proxylogin";}
proxylogin.jsp页面中js$(function(){$.ajax({url: askurl,data: {askData:askData},success: function(d){if(d.msg == "-1"){ window.location.href = "http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.html"; }else{$.post(okurl, {replyTxt:d.msg} , function(e) {window.location.href = e.returl;}, "json");}},error:function(){window.location.href = "http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.ht"},dataType: json });});
V8中askurl地址http://sso.test.com:8080/replylogin.html@ResponseBody@RequestMapping("/replylogin")public void replylogin(HttpServletRequest request,HttpServletResponse response) {StringBuffer replyData = new StringBuffer();replyData.append(request.getParameter("callback")).append("({\"msg\":\"");Token token = SSOHelper.getToken(request);if (token != null) {String askData = request.getParameter("askData");if (askData != null && !"".equals(askData)) {//用户自定义配置获取 由于不确定性,kisso 提倡,用户自己定义配置。PropertiesUtil prop = SSOConfig.getSSOProperties();//下面开始验证票据,签名新的票据每一步都必须有。AuthToken at = SSOHelper.replyCiphertext(request, askData);if (at != null) {//1、业务系统公钥验证签名合法性(此处要支持多个跨域端,取 authToken 的 app 名找到对应系统公钥验证签名)at = at.verify(prop.get("sso.defined." + at.getApp() + "_public_key"));if (at != null) {//at.getUuid() 作为 key 设置 authToken 至分布式缓存中,然后 sso 系统二次验证//at.setData(data); 设置自定义信息,当然你也可以直接 at.setData(token.jsonToken()); 把当前 SSOToken 传过去。at.setUid(token.getUid());//设置绑定用户IDat.setTime(token.getTime());//设置登录时间//2、SSO 的私钥签名at.sign(prop.get("sso.defined.sso_private_key"));//3、生成回复密文票据replyData.append(at.encryptAuthToken());} else {//非法签名, 可以重定向至无权限界面,自己处理replyData.append("-2");}} else {//非法签名, 可以重定向至无权限界面,自己处理replyData.append("-2");}}} else {// 未登录replyData.append("-1");}try {replyData.append("\"})");response.setContentType("text/html;charset=" + "UTF-8");PrintWriter out = response.getWriter();out.print(replyData);out.flush();} catch (IOException e) {e.printStackTrace();}}
OA中okurlhttp://my.web.com:8090/oklogin.ht@ResponseBody@RequestMapping("/oklogin")public void oklogin(HttpServletRequest request,HttpServletResponse response) {String returl = "http://my.web.com:8090/timeout.html";//回复密文是否存在 SSO 公钥验证回复密文是否正确 设置 MY 系统自己的 CookieString replyTxt = request.getParameter("replyTxt");if (replyTxt != null && !"".equals(replyTxt)) {// 用户自定义配置获取 由于不确定性,kisso 提倡,用户自己定义配置。PropertiesUtil prop = SSOConfig.getSSOProperties();AuthToken at = SSOHelper.ok(request, response, replyTxt, prop.get("sso.defined.my_public_key"),prop.get("sso.defined.sso_public_key"));if (at != null) {returl = "http://my.web.com:8090/index.html";SSOToken st = new SSOToken();st.setUid(at.getUid());st.setTime(at.getTime());//设置 true 时添加 cookie 同时销毁当前 JSESSIONID 创建信任的 JSESSIONIDSSOHelper.setSSOCookie(request, response, st, true);}}try { response.setContentType("text/html;charset=" + "UTF-8");PrintWriter out = response.getWriter();out.print("{\"returl\":\"" + returl + "\"}");out.flush();} catch (IOException e) {e.printStackTrace();}}
于是整个过程是这样的:http://my.web.com:8090/oa/login.ht||http://sso.test.com:8080/login.html?ReturnURL=http%3A%2F%2Fmy.web.com%3A8090%2Fproxylogin.ht||http://my.web.com:8090/oa/proxylogin.ht||http://sso.test.com:8080/replylogin.html||http://my.web.com:8090/oa/oklogin.ht||http://my.web.com:8090/oa/login.ht