SSO(一) cas搭建

以下分Tomcat和Jboss两种环境部署

1>配置SSL

环境：Tomcat 7.0.27  JDK1.6.0_18

切换到tomcat目录下

第一步生成key

这里cas client和cas server都是装在本机，如果是分开部署，cn=后面填写cas server域名，不要用IP，否则报错

D:\apache-tomcat-7.0.27>keytool -genkey -alias tomcat -dname "cn=localhost" -keyalg RSA -keypass changeit -storepass changeit -keystore server.keystore -validity 3600

此时在tomcat目录下生成server.keystore 文件

第二步导出证书

D:\apache-tomcat-7.0.27>keytool -export -trustcacerts -alias tomcat -file server.cer -keystore server.keystore -storepass changeit

第三步导入证书（注意，jdk目录里如果有空格，用引号括起来）

如果是分开部署，应该到cas client所在的机器上导入

D:\apache-tomcat-7.0.27>keytool -import -trustcacerts -alias tomcat -file server.cer -keystore "D:\Program Files\Java\jdk1.6.0_18\jre\lib\security\cacerts" -storepass changeit

所有者:CN=localhost
签发人:CN=localhost
序列号:51c93f17
有效期: Tue Jun 25 14:56:23 CST 2013 至Thu May 04 14:56:23 CST 2023
证书指纹:
         MD5:B6:78:E7:BE:4E:F1:8F:A5:0D:3F:CD:89:3E:6A:C5:8C
         SHA1:F7:4D:5C:BF:4C:83:B6:B5:50:0E:99:5E:DD:41:3B:8B:B4:EA:7F:55
         签名算法名称:SHA1withRSA
         版本: 3
信任这个认证？ [否]：  Y
认证已添加至keystore中

(备注：如何删除证书：

删除证书

keytool -delete -alias tomcat -keystore "%JAVA_HOME%/jre/lib/security/cacerts" -storepass changeit

)

第四步修改tomcat配置文件

将原来的注释去掉使其生效，同时配置好keystoreFile和keystorePass

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
			   keystoreFile="${catalina.base}/server.keystore"
			   keystorePass="changeit"
               clientAuth="false" sslProtocol="TLS" />

重启tomcat生效，访问https://localhost:8443验证

环境：Jboss7.1.0

将上面生成的server.keystore拷贝到Jboss的standalone\configuration目录下，然后修改standalone.xml:

找到<subsystem xmlns="urn:jboss:domain:web

添加

<connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true">
        <ssl name="https" password="changeit" certificate-key-file="${jboss.server.config.dir}/server.keystore"/>
</connector>

确保在<socket-binding-group name="standard-sockets" 下面配置好

<socket-binding name="https" port="8443"/>

配置完以后重启Jboss

注意，如果是分开部署，那么证书配置完毕以后cas client与cas server都要重启Jboss或者tomcat

2> 部署cas

Tomcat环境：

下载cas-server-3.5.2-release.zip 解压后将modules里面的cas-server-webapp-3.5.2.war 重命名为cas.war 部署到tomcat的webapps下面，通过

https://localhost:8443/cas 可以进入登录页面，输入用户名和密码（只要这两者相同即可）即可登录.

JBoss环境：

需要做些修改，可以通过重新编译打war。

将下载的cas-server-3.5.2\cas-server-webapp maven工程导入eclipse，将WEB-INF/spring-configuration下面的log4jConfiguration.xml里的log4jInitialization bean注释掉。

然后修改src/main/resources/META-INF/persistence.xml，添加hibernate.dialect，修改后的persistence.xml为：

<?xml version="1.0" encoding="UTF-8"?>
<!--

    Licensed to Jasig under one or more contributor license
    agreements. See the NOTICE file distributed with this work
    for additional information regarding copyright ownership.
    Jasig licenses this file to you under the Apache License,
    Version 2.0 (the "License"); you may not use this file
    except in compliance with the License.  You may obtain a
    copy of the License at the following location:

      http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing,
    software distributed under the License is distributed on an
    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
    KIND, either express or implied.  See the License for the
    specific language governing permissions and limitations
    under the License.

-->
<persistence xmlns="http://java.sun.com/xml/ns/persistence"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://java.sun.com/xml/ns/persistence http://java.sun.com/xml/ns/persistence/persistence_2_0.xsd"
        version="2.0">

	<persistence-unit name="CasPersistence" transaction-type="RESOURCE_LOCAL">
		<properties>
			<property name="hibernate.dialect" value="org.hibernate.dialect.HSQLDialect"/>
      	</properties>
        <class>org.jasig.cas.services.AbstractRegisteredService</class>
        <class>org.jasig.cas.services.RegexRegisteredService</class>
        <class>org.jasig.cas.services.RegisteredServiceImpl</class>
        <class>org.jasig.cas.ticket.TicketGrantingTicketImpl</class>
        <class>org.jasig.cas.ticket.ServiceTicketImpl</class>
        <class>org.jasig.cas.ticket.registry.support.JpaLockingStrategy$Lock</class>
	</persistence-unit>
</persistence>

编译后部署即可。

常见错误：

1）ClassNotFoundException: org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHa

将解压的cas-server-3.5.2\modules里的cas-server-support-ldap-3.5.2.jar放到webapps\cas\WEB-INF\lib目录

2）java.lang.NoClassDefFoundError: org/springframework/ldap/NamingSecurityException

将spring-ldap-core-1.3.1.RELEASE.jar放到webapps\cas\WEB-INF\lib

3）java.lang.NoClassDefFoundError: org/springframework/beans/factory/InitializingBean

spring-beans-3.1.4.RELEASE.jar

4）java.lang.ClassNotFoundException: org.jasig.cas.authentication.handler.support.AbstractUsernamePasswordAuthenticationHandler

cas-server-core-3.5.2.jar

5）

ClassNotFoundException: org.aspectj.lang.Signature

aspectjrt-1.6.10.jar

6) No subject alternative names present

生成证书的时候cn=后面用域名，不要用IP