单点登录JA-SIG研究分析~用户库配置篇

 一、数据库配置
        1.复杂数据库驱动jar文件到cas服务端网站的lib目录下
        2.修改CasServer\WEB-INF\deployerConfigContext.xml文件：
            

<!--  注释掉如下代码 -->
< bean  class ="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler"   />

        替换成:
        

                 < bean  class ="org.jasig.cas.adaptors.jdbc.QueryDatabaseAuthenticationHandler" >
                     < property  name ="sql"  value ="select PASSWORD_ from ID_USER where NAME_=?" />
                     < property  name ="passwordEncoder"  ref ="passwordEncoder" />
                     < property  name ="dataSource"  ref ="dataSource" />
                 </ bean >

        在文件末尾加入：

<!--  数据源定义  -->
     < bean  id ="dataSource"
        class ="org.springframework.jdbc.datasource.DriverManagerDataSource" >
         < property  name ="driverClassName"  value ="${db.driver}"   />
         < property  name ="url"  value ="${db.url}"   />
         < property  name ="username"  value ="${db.username}"   />
         < property  name ="password"  value ="${db.password}"   />
     </ bean >
     < bean  id ="passwordEncoder"
        class ="org.jasig.cas.authentication.handler.DefaultPasswordEncoder"
        autowire ="byName" >
         < constructor-arg  value ="MD5"   />
     </ bean >

        在CasServer\WEB-INF\cas.properties文件中添加:

database.hibernate.dialect=org.hibernate.dialect.OracleDialect
#database.hibernate.dialect=org.hibernate.dialect.MySQLDialect
#database.hibernate.dialect=org.hibernate.dialect.HSQLDialect
db.driver=oracle.jdbc.driver.OracleDriver
db.url=jdbc\:oracle\:thin\:@localhost\:1521\:master
db.username=casusername
db.password=caspwd

     二、LDAP配置
            1.复杂cas-server-support-ldap-3.2.jar文件到cas服务端网站的lib目录下
            2.修改CasServer\WEB-INF\deployerConfigContext.xml文件：
            

<!--  注释掉如下代码 -->
< bean  class ="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler"   />

 

        替换成:（注意:位置）

< bean
                     class ="com.jihong.cas.adaptors.ldap.BindLdapAuthenticationHandler" >
                     < property  name ="filter"  value ="uid=%u"   />
                     <!--  基节点  -->
                     < property  name ="searchBase"
                        value ="OU=单位,O=TJJU"   />
                     < property  name ="contextSource"  ref ="contextSource"   />
                 </ bean >

在文件末尾加入：

< bean  id ="contextSource"
        class ="org.jasig.cas.adaptors.ldap.util.AuthenticatedLdapContextSource" >
         < property  name ="password"  value ="secret"   />
         < property  name ="pooled"  value ="true"   />
         < property  name ="urls" >
             < list >
                 < value >ldap://192.168.0.1:389/ </ value >
             </ list >
         </ property >
         <!--  property name="userName" value="uid=admin,O=TJJU" / -->
         < property  name ="baseEnvironmentProperties" >
             < map >
                 < entry >
                     < key >
                         < value >
                            java.naming.security.authentication
                         </ value >
                     </ key >
                     < value >simple </ value >
                 </ entry >
             </ map >
         </ property >
     </ bean >

     三、分析deployerConfigContext.xml的其他配置
         1.客户端登陆服务配置:每加入一个客户端网站都需修改这个配置。   

< bean  id ="serviceRegistryDao"
        class ="org.jasig.cas.services.InMemoryServiceRegistryDaoImpl"   />

        例如:

< bean  id ="serviceRegistryDao"
        class ="org.jasig.cas.services.InMemoryServiceRegistryDaoImpl" >
         <!--  注册客户端  -->
         < property  name ="registeredServices" >
             < list >
             <!--  一个客户端配置  -->
                 < bean
                     class ="org.jasig.cas.services.RegisteredServiceImpl"  
                    p:id ="1"
                    p:description ="Tout Nancy 2"  
                    p:serviceId ="*://localhost:8080/**"
                    p:name ="Tout Nancy 2"  
                    p:theme ="nancy2"  
                    p:allowedToProxy ="true"
                    p:enabled ="true"  
                    p:ssoEnabled ="true"  
                    p:anonymousAccess ="false" >
                     <!--  允许的属性  -->
                     < property  name ="allowedAttributes"  value ="Name,telephoneNumber,fullName,mail,eduPersonAffiliation,groupMembership" />
                 </ bean >
             </ list >
         </ property >
     </ bean >

        2.属性注册:从数据库中读取的属性

 

< bean  id ="attributeRepository"
        class ="org.jasig.services.persondir.support.StubPersonAttributeDao" >
         < property  name ="backingMap" >
             < map >
                 < entry  key ="uid"  value ="uid"   />
                 < entry  key ="eduPersonAffiliation"
                    value ="eduPersonAffiliation"   />
                 < entry  key ="groupMembership"  value ="groupMembership"   />
             </ map >
         </ property >
     </ bean >

    例如：从LDAP中读取属性

< bean  id ="attributeRepository"
        class ="com.jihong.services.persondir.support.ldap.LdapPersonAttributeDao" >
         < property  name ="baseDN"  value ="OU=单位,O=TJJU"   />
         < property  name ="query"  value ="(uid={0})"   />
         < property  name ="contextSource"  ref ="contextSource"   />
         < property  name ="ldapAttributesToPortalAttributes" >
             < map >
                 < entry  key ="cn"  value ="Name"   />
                 < entry  value ="Telephone"  key ="telephoneNumber"   />
                 < entry  value ="Full Name"  key ="fullName"   />
                 < entry  value ="Email"  key ="mail"   />
                 < entry  key ="eduPersonAffiliation"
                    value ="eduPersonAffiliation"   />
                 < entry  key ="groupMembership"  value ="groupMembership"   />
             </ map >
         </ property >
     </ bean >