单点登录CAS与Spring Security集成（数据库验证，向客户端发送更多信息)

准备工作

CAS server从网上直接下载下来，里面有一个cas-server-webapp的工程，使用Maven命令构建，导入到Eclipse中，便可以直接使用，cas server我使用的是3.5.2版本。客户端，我是使用以前的工程，只要是Web工程就行，cas-client使用的3.2.1，Spring Security使用的是3.1.4，记得Spring Security的3.1.2版本和CAS集成时，当需要CAS Server传比较多的信息给客户端时，客户端的Spring Security会解析出错（如果木有记错的话）

**PS：**无使用HTTPS协议，需要对CAS Server的配置做改动，具体后面详述

服务端（CAS Server）

服务端部署在8080端口

使用HTTP协议

CAS Server完全使用的是CAS官方的工程，名为cas-server-webapp，导入到Eclipse中之后，就是一普通的Web工程，官方的Demo是需要HTTPS的，此篇讨论的就是普通的HTTP，首先修改ticketGrantingTicketCookieGenerator.xml和warnCookieGenerator.xml这两个文件，将p:cookieSecure属性值设置为false

使用数据库的验证方式登录

使用数据库的验证方式登录，需要修改几个地方，一是配置文件，二是编写自己的数据库查询的类（这个类在3.5.2中提供了，可以通过配置文件实现），也可以自己实现该类。

配置文件

需要修改deployerConfigContext.xml，使用我们自己定义的类验证，配置文件如下：

<?xml version="1.0" encoding="UTF-8"?>
<!--
	| deployerConfigContext.xml centralizes into one file some of the declarative configuration that
	| all CAS deployers will need to modify.
	|
	| This file declares some of the Spring-managed JavaBeans that make up a CAS deployment.  
	| The beans declared in this file are instantiated at context initialization time by the Spring 
	| ContextLoaderListener declared in web.xml.  It finds this file because this
	| file is among those declared in the context parameter "contextConfigLocation".
	|
	| By far the most common change you will need to make in this file is to change the last bean
	| declaration to replace the default SimpleTestUsernamePasswordAuthenticationHandler with
	| one implementing your approach for authenticating usernames and passwords.
	+-->

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:p="http://www.springframework.org/schema/p"
       xmlns:tx="http://www.springframework.org/schema/tx"
       xmlns:sec="http://www.springframework.org/schema/security"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
       http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd
       http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
	<!--
		| This bean declares our AuthenticationManager.  The CentralAuthenticationService service bean
		| declared in applicationContext.xml picks up this AuthenticationManager by reference to its id, 
		| "authenticationManager".  Most deployers will be able to use the default AuthenticationManager
		| implementation and so do not need to change the class of this bean.  We include the whole
		| AuthenticationManager here in the userConfigContext.xml so that you can see the things you will
		| need to change in context.
		+-->
	<bean id="authenticationManager"
		class="org.jasig.cas.authentication.AuthenticationManagerImpl">
		
		<!-- Uncomment the metadata populator to allow clearpass to capture and cache the password
		     This switch effectively will turn on clearpass.
		<property name="authenticationMetaDataPopulators">
		   <list>
		      <bean class="org.jasig.cas.extension.clearpass.CacheCredentialsMetaDataPopulator">
		         <constructor-arg index="0" ref="credentialsCache" />
		      </bean>
		   </list>
		</property>
		 -->
		
		<!--
			| This is the List of CredentialToPrincipalResolvers that identify what Principal is trying to authenticate.
			| The AuthenticationManagerImpl considers them in order, finding a CredentialToPrincipalResolver which 
			| supports the presented credentials.
			|
			| AuthenticationManagerImpl uses these resolvers for two purposes.  First, it uses them to identify the Principal
			| attempting to authenticate to CAS /login .  In the default configuration, it is the DefaultCredentialsToPrincipalResolver
			| that fills this role.  If you are using some other kind of credentials than UsernamePasswordCredentials, you will need to replace
			| DefaultCredentialsToPrincipalResolver with a CredentialsToPrincipalResolver that supports the credentials you are
			| using.
			|
			| Second, AuthenticationManagerImpl uses these resolvers to identify a service requesting a proxy granting ticket. 
			| In the default configuration, it is the HttpBasedServiceCredentialsToPrincipalResolver that serves this purpose. 
			| You will need to change this list if you are identifying services by something more or other than their callback URL.
			+-->
		<property name="credentialsToPrincipalResolvers">
			<list>
				<!--
					| UsernamePasswordCredentialsToPrincipalResolver supports the UsernamePasswordCredentials that we use for /login 
					| by default and produces SimplePrincipal instances conveying the username from the credentials.
					| 
					| If you've changed your LoginFormAction to use credentials other than UsernamePasswordCredentials then you will also
					| need to change this bean declaration (or add additional declarations) to declare a CredentialsToPrincipalResolver that supports the
					| Credentials you are using.
					+-->
<!-- 				<bean class="org.jasig.cas.authentication.principal.UsernamePasswordCredentialsToPrincipalResolver" > -->
<!-- 					<property name="attributeRepository" ref="attributeRepository" /> -->
<!-- 				</bean> -->
					<!-- 此处修改了CredentialToPrincipal，因为除了要传递用户信息之处，还要传递一部分权限信息
						若无此需求，可使用UsernamePasswordCredentialsToPrincipalResolver（系统默认）
					 -->
					<bean class="com.wds.security.cas.BaseUsernamePasswordCredentialsToPrincipalResolver"
						p:jdbcTemplate-ref="jdbcTemplate"
					></bean>
				<!--
					| HttpBasedServiceCredentialsToPrincipalResolver supports HttpBasedCredentials.  It supports the CAS 2.0 approach of
					| authenticating services by SSL callback, extracting the callback URL from the Credentials and representing it as a
					| SimpleService identified by that callback URL.
					|
					| If you are representing services by something more or other than an HTTPS URL whereat they are able to
					| receive a proxy callback, you will need to change this bean declaration (or add additional declarations).
					+-->
				<bean
					class="org.jasig.cas.authentication.principal.HttpBasedServiceCredentialsToPrincipalResolver" />
			</list>