![11464886-e0664960f8bd1deb.png](https://i-blog.csdnimg.cn/blog_migrate/56490e489ac305c3335de08f6411c22a.png)
上图是未支持https时默认登录页
- 自签名服务端需要导入证书
重点:
- test.sso.com 是我们测试的域名
-
测试时需要把本地机的ip映射为test.sso.com设到系统HOSTS文件
证书处理
生成步骤,各参数含义:
- genkeypair 生成密钥
- keyalg 指定密钥算法,这时指定RSA,
- keysize 指定密钥长度,默认是1024位,这里指定2048,长一点,我让你破解不了(哈哈…),
- siglag 指定数字签名算法,这里指定为SHA1withRSA算法
- validity 指定证书有效期,这里指定36500天,也就是100年,我想我的应用用不到那么长时间
- alias 指定别名,这里是cas.server.com
- keystore 指定密钥库存储位置,这里存在d盘
- dname 指定用户信息,不用一个一个回答它的问题了;
注意:CN=域名,我们采用passport.sso.com
keytool -genkeypair -keyalg RSA -keysize 2048 -sigalg SHA1withRSA -validity 36500 -alias passport.sso.com -keystore d:/tomcat.keystore -dname "CN=passport.sso.com,OU=kawhi,O=carl,L=GuangZhou,ST=GuangDong,C=CN"
输入上述命令,下面密码我们输入123456,然后一直回车,就在d盘生成了tomcat.keystore文件;
证书生成
在cmd下输入如下命令,密码为上面输入的123456:
keytool -exportcert -alias passport.sso.com -keystore d:/tomcat.keystore -file d:/tomcat.cer -rfc
证书生成在:d:/tomcat.cer
导入cacerts证书库
需要输入保护密码,默认的是changeit
,输入即可,而不是生成证书时自己设置的
keytool -import -alias passport.sso.com -keystore %JAVA_HOME%\jre\lib\security\cacerts -file d:/tomcat.cer -trustcacerts
![11464886-5875ea635003f57b.png](https://i-blog.csdnimg.cn/blog_migrate/7717e2e4cd520072587cc2c4947d6619.png)
检查是否导入成功
keytool -list -keystore "%JAVA_HOME%\jre\lib\security\cacerts" | findstr/i server
有东西输出代表成功
项目设置
证书有了,我们必须让项目识别证书,并且把ssl开关打开
密钥引用
把tomcat.keystore
拷贝到sso-server\src\main\resources
下
开启ssl
文件sso-config\src\main\resources\config\sso-dev.properties调整
调整server.ssl.enabled=true
新增如下
server.ssl.key-store=classpath:tomcat.keystore
server.ssl.key-store-password=123456
server.ssl.keyAlias=test.sso.com
最终配置文件sso-server application.properties:
##
# CAS Server Context Configuration
#
server.context-path=/cas
server.port=8443
#SSL配置
server.ssl.enabled=true
server.ssl.key-store=classpath:tomcat.keystore
server.ssl.key-store-password=123456
server.ssl.key-alia=test.sso.com
# server.ssl.ciphers=
# server.ssl.client-auth=
# server.ssl.key-alias=
# server.ssl.key-store-provider=
# server.ssl.key-store-type=
# server.ssl.protocol=
# server.ssl.trust-store=
# server.ssl.trust-store-password=
# server.ssl.trust-store-provider=
# server.ssl.trust-store-type=
server.max-http-header-size=2097152
server.use-forward-headers=true
server.connection-timeout=20000
server.error.include-stacktrace=NEVER
server.tomcat.max-http-post-size=2097152
server.tomcat.basedir=build/tomcat
server.tomcat.accesslog.enabled=true
server.tomcat.accesslog.pattern=%t %a "%r" %s (%D ms)
server.tomcat.accesslog.suffix=.log
server.tomcat.max-threads=10
server.tomcat.port-header=X-Forwarded-Port
server.tomcat.protocol-header=X-Forwarded-Proto
server.tomcat.protocol-header-https-value=https
server.tomcat.remote-ip-header=X-FORWARDED-FOR
server.tomcat.uri-encoding=UTF-8
spring.http.encoding.charset=UTF-8
spring.http.encoding.enabled=true
spring.http.encoding.force=true
##
# CAS Cloud Bus Configuration
#
spring.cloud.bus.enabled=false
# spring.cloud.bus.refresh.enabled=true
# spring.cloud.bus.env.enabled=true
# spring.cloud.bus.destination=CasCloudBus
# spring.cloud.bus.ack.enabled=true
endpoints.enabled=false
endpoints.sensitive=true
endpoints.restart.enabled=false
endpoints.shutdown.enabled=false
management.security.enabled=true
management.security.roles=ACTUATOR,ADMIN
management.security.sessions=if_required
management.context-path=/status
management.add-application-context-header=false
security.basic.authorize-mode=role
security.basic.enabled=false
security.basic.path=/cas/status/**
##
# CAS Web Application Session Configuration
#
server.session.timeout=300
server.session.cookie.http-only=true
server.session.tracking-modes=COOKIE
##
# CAS Thymeleaf View Configuration
#
spring.thymeleaf.encoding=UTF-8
spring.thymeleaf.cache=true
spring.thymeleaf.mode=HTML
##
# CAS Log4j Configuration
#
# logging.config=file:/etc/cas/log4j2.xml
server.context-parameters.isLog4jAutoInitializationDisabled=true
##
# CAS AspectJ Configuration
#
spring.aop.auto=true
spring.aop.proxy-target-class=true
##
# CAS Authentication Credentials
#
cas.authn.accept.users=casuser::Mellon
##
# CAS Delegated Authentication
#
cas.authn.pac4j.bitbucket.clientName=Bitbucket
cas.authn.pac4j.dropbox.clientName=Dropbox
cas.authn.pac4j.facebook.clientName=Facebook
cas.authn.pac4j.foursquare.clientName=Foursquare
cas.authn.pac4j.github.clientName=Github
cas.authn.pac4j.google.clientName=Google
cas.authn.pac4j.linkedIn.clientName=LinkedIn
cas.authn.pac4j.paypal.clientName=PayPal
cas.authn.pac4j.twitter.clientName=Twitter
cas.authn.pac4j.yahoo.clientName=Yahoo
cas.authn.pac4j.windowsLive.clientName=Windows Live
cas.authn.pac4j.wordpress.clientName=WordPress
测试
- 启动sso-server
- 访问 https://test.sso.com:8443/cas/login 如下图所示
注意
:后面章节为了方便测试,去掉了https,具体配置:
#关闭ssl
tgc.secure=false
warn.cookie.secure=false