第4.1.4章 WEB系统最佳实践 单点登录

我负责的平台，单点登录经历过两个阶段，第一个阶段是开源CAS系统，第二个阶段根据CAS原理自己实现的。
1 开源CAS系统
可以通过使用 CAS 在 Tomcat 中实现单点登录来了解CAS的一些概况，

关于 CAS—认证原理，这里说的也比较清楚明白
关于shiro与cas集成，可以参考Apache shiro(3)—cas + shiro配置说明
1.1 页面是如何跳转到sso系统

<bean id="casRealm" class="com.xxxx.framework.user.shiro.MyCasRealm">
		<!-- 关闭认证和授权缓存 -->
		<property name="cachingEnabled" value="true"/>
		<property name="authenticationCachingEnabled" value="true"/>
		<property name="authenticationCacheName" value="authenticationCache"/>
		<property name="authorizationCachingEnabled" value="true"/>
		<property name="authorizationCacheName" value="authorizationCache"/>
		<!-- CAS Server -->
        <property name="casServerUrlPrefix" value="${cas.server.intranet}"/>
        <!-- 客户端的回调地址设置，必须和下面的shiro-cas过滤器拦截的地址一致 -->
        <property name="casService" value="${cas.client}/login"/>
	</bean>

<!-- 安全管理器 -->
	<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
		<property name="realm" ref="casRealm"/>
		<!-- <property name="sessionManager" ref="sessionManager"/> -->
		<property name="cacheManager" ref="cacheManager"/>
		<property name="rememberMeManager" ref="rememberMeManager"/>
		<!-- sessionMode参数设置为native时，那么shrio就将用户的基本认证信息保存到缺省名称为shiro-activeSessionCache 的Cache中 -->
		<!--<property name="sessionMode" value="native" />-->
        <property name="subjectFactory" ref="casSubjectFactory"/>
	</bean>

	<bean id="userFilter" class="com.xxxx.framework.shiro.filter.UserFilter" />
	
	<!-- <bean id="casFilter" class="org.apache.shiro.cas.CasFilter"> -->
	<bean id="casFilter" class="com.xxxx.framework.user.shiro.MyCasFilter">
        <!-- 配置验证错误时的失败页面  -->
        <property name="failureUrl" value="${cas.client}"/>
    </bean>
	<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
		<property name="securityManager" ref="securityManager" />
		<!-- 设定角色的登录链接，这里为cas登录页面的链接可配置回调地址  -->
		<property name="loginUrl" value="${cas.server}?service=${cas.client}/login" />
		<property name="successUrl" value="/index" />
		<property name="unauthorizedUrl" value="/"/> 
		<property name="filters">
			<util:map>
                <entry key="user" value-ref="userFilter"/>
				<!-- 添加casFilter到shiroFilter -->
                <entry key="cas" value-ref="casFilter"/>
			</util:map>
		</property>
		<property name="filterChainDefinitions">
			<value>
			/resources/** = anon
			/logout = anon
			/login = cas
			/** = user
			</value>
		</property>
	</bean>

自定义的UserFilter如下,主要针对ajax做的扩展，因为我们的管理页面采用的是iframe方式，所以需要特殊处理，返回状态码，这样session超时，可以通过js来将页面跳转到登录页面，而不是在iframe中显示登录页面。体验不好

public class UserFilter extends org.apache.shiro.web.filter.authc.UserFilter {

    @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
        HttpServletRequest req = WebUtils.toHttp(request);
        if (HttpUtil.isAjax(req)){
            HttpServletResponse res = WebUtils.toHttp(response);  
            res.sendError(HttpServletResponse.SC_UNAUTHORIZED); 
        } else if (HttpUtil.isPost(req)){
            HttpServletResponse res = WebUtils.toHttp(response);  
            res.sendError(HttpServletResponse.SC_UNAUTHORIZED); 
        } else {
            saveRequestAndRedirectToLogin(request, response);
        }
        
        return false;
    }
}

anon是被忽略的，这里讲一下页面是怎么跳转到sso的登录页面
在浏览器中输入http://192.168.4.187:8097/pss，org.apache.shiro.web.filter.authc.UserFilter中

显示访问被拒绝,在org.apache.shiro.web.filter.AccessControlFilter中可以看到

于是页面跳转到sso的页面

2 自研SSO系统
cas系统太过复杂，可能他考虑的方面比较多，因此我们可以结合它的源码，改造成自己的轻量级SSO。
2.1 sso登录时发生了什么
service中记录了是从哪个CAS Client 过来的，将service存储到登录页面的隐藏域中。

@RequestMapping(value = "", method = RequestMethod.GET)
	public String welcome(String service, HttpServletRequest request, Model model) {
		if (CheckEmptyUtil.isEmpty(service)) {
			return "redirect:login";
		} else {
			return "redirect:login?service=" + service;
		}
	}

如果没有登录，则跳转到sso的登录页面

@RequestMapping(value = "login", method = RequestMethod.GET)
	public String login(String service, HttpServletRequest request, Model model) {
		// 1、检查Subject，未登录进入登录页面，已登录则继续下一步
		Subject subject = SecurityUtils.getSubject();
		if (!subject.isAuthenticated()) {
			if (!CheckEmptyUtil.isEmpty(service)) {
				model.addAttribute("service", service);
			}
			return "login";
		}

		// 2、检查是否有service参数，否则进入门户首页，是则生成ST，跳转service对应的地址（跨域）
		AppService appService = AppService.createServiceFrom(service);
		if (appService == null) {
			model.addAttribute("systems", getSystems());
			return "system/index";
		}

		// 如果该service已经存在，替换原来的Service
		Session session = SessionUtil.getCurrentSession();
		// 生成新的ST
		String stId = centralAuthenticationService.grantServiceTicket(session, appService);

		// 跳转service对应的地址（跨域）
		return "redirect:" + appService.getRedirectUrl(stId);
	}

输入用户名、密码后，用户登录下面核心代码在currentUser.login(token);，login之后会进入UserRealm中doGetAuthenticationInfo方法，对用户登录进行身份认证

@RequestMapping(value = "doLogin", method = RequestMethod.POST)
	@ResponseBody
	public ResponseResult<String> doLogin(String username, String password, String captcha, String service,
			HttpServletRequest request) {
		// 传递service到前台
		ResponseResult<String> response = new ResponseResult<String>(true);
		response.setData(service);

		Subject currentUser = SecurityUtils.getSubject();
		if (!currentUser.isAuthenticated()) {
			UsernamePasswordCaptchaToken token = new UsernamePasswordCaptchaToken(username, password, false,
					IpUtil.getIpAddr(request), captcha);
			try {
				currentUser.login(token);
			} catch (UnknownAccountException e) {
				response.setSuccess(false);
				response.setMsg("帐号或密码错误，请重试");
			} catch (IncorrectCredentialsException e) {
				response.setSuccess(false);
				response.setMsg("帐号或密码错误，请重试");
			} catch (DisabledAccountException e) {
				response.setSuccess(false);
				response.setMsg("帐号被禁用，请联系管理员");
			} catch (FirstLoginException e) {
				response.setSuccess(false);
				response.setMsg("请修改初始密码");
				response.setData(FirstLoginException.class.getSimpleName());
				// } catch (ExcessiveAttemptsException e) {
				// response.setSuccess(false);
				// response.setMsg("密码错误次数过多，请15分钟后重试");
			} catch (DubboException e) {
				response.setSuccess(false);
				response.setMsg("用户中心连接失败，请联系管理员");
			} catch (AuthenticationException e) {
				response.setSuccess(false);
				response.setMsg(e.getMessage());
			}
		}
		return response;
	}

@Override
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
		UsernamePasswordCaptchaToken myToken = (UsernamePasswordCaptchaToken) token;
		String username = myToken.getUsername();
		String password = new String(myToken.getPassword());// 密码md5

		// 验证码校验
		if (is_produce) {
			String captcha = (String) getSession().getAttribute(com.google.code.kaptcha.Constants.KAPTCHA_SESSION_KEY);
			if (!captcha.equalsIgnoreCase(myToken.getCaptcha())) {
				throw new CaptchaException();
			}
		}
		
		UcsUserDto user = null;
		List<UcsSystemPermission> permissions = null;
		UcsEnterprise ent = null;
		UcsOrganization org = null;
		try {
			 user = userService.login(username, password);
		} catch (UsernameNotExistException e) {
			logger.debug(e.getMessage());
			throw new UnknownAccountException();
		} catch (PasswordWrongException e) {
			logger.debug(e.getMessage());
			throw new IncorrectCredentialsException();
		} catch (UserDeniedException e) {
			logger.debug(e.getMessage());
			throw new DisabledAccountException();
		} catch (UnchangedPasswordException e) {
			logger.debug(e.getMessage());
			throw new FirstLoginException();
		} catch (Exception e) {
			logger.error("用户中心连接失败，请联系管理员", e);
			throw new DubboException("用户中心连接失败，请联系管理员");
		}

		try {
			permissions = userService.getPermissionByUserId(domainId, user.getId());
			ent = userService.getEnterpriseById(user.getEntId());
			org = userService.getOrganizationById(user.getOrgId());
		} catch (Exception e) {
			logger.error("用户中心连接失败，请联系管理员", e);
			throw new DubboException("用户中心连接失败，请联系管理员");
		}
		// if (permissions == null) {
		// logger.error("该用户无本系统权限");
		// throw new AuthenticationException("该用户无本系统权限");
		// }
		// 给菜单排序
		List<Menu> menus = null;
		if (!CheckEmptyUtil.isEmpty(permissions)) {
			menus = convertToMenu(permissions, domain);
			Collections.sort(menus);
		}
		ShiroUser shiroUser = new ShiroUser(user.getId(), user.getUsername(), user.getName(), menus,
				convertToEnterprise(ent), convertToOrganization(org));
		SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(shiroUser, password, getName());
		return authenticationInfo;
	}

身份认证成功后，将会再次进入，这次将生ST，待着个ST进行页面跳转
http://192.168.4.187:8097/pss/login?ticket=ST-0-lmVPqCIQnxqqIBulirEaA3tK4ddVXKkUSMU

@RequestMapping(value = "login", method = RequestMethod.GET)
	public String login(String service, HttpServletRequest request, Model model) {
		// 1、检查Subject，未登录进入登录页面，已登录则继续下一步
		Subject subject = SecurityUtils.getSubject();
		if (!subject.isAuthenticated()) {
			if (!CheckEmptyUtil.isEmpty(service)) {
				model.addAttribute("service", service);
			}
			return "login";
		}

		// 2、检查是否有service参数，否则进入门户首页，是则生成ST，跳转service对应的地址（跨域）
		AppService appService = AppService.createServiceFrom(service);
		if (appService == null) {
			model.addAttribute("systems", getSystems());
			return "system/index";
		}

		// 如果该service已经存在，替换原来的Service
		Session session = SessionUtil.getCurrentSession();
		// 生成新的ST
		String stId = centralAuthenticationService.grantServiceTicket(session, appService);

		// 跳转service对应的地址（跨域）
		return "redirect:" + appService.getRedirectUrl(stId);
	}

2.2 st生成

@Override
	public String grantServiceTicket(final Session session, final AppService service) {
		// 生成stId
		final String generatedServiceTicketId = uniqueTicketIdGenerator.getNewTicketId(ServiceTicket.PREFIX);
		logger.info("Generated service ticket id [{}] for session [{}]", generatedServiceTicketId,
				session.getId().toString());
		//生成ST
		final ServiceTicket serviceTicket = new ServiceTicketImpl(generatedServiceTicketId, session.getId().toString(), service, true);

		//更新TGT
		TicketGrantTicket tgt = SessionUtil.getTgt(session);
		if(tgt == null) {
			tgt = new TicketGrantTicket();
			tgt.setUsername(UserUtil.getCurrentShiroUser().getLoginName());
		}
		tgt.putService(generatedServiceTicketId, service);
		SessionUtil.setTgt(session, tgt);
		serviceTicketRegistry.addTicket(serviceTicket);

		return serviceTicket.getId();
	}

我将st放入到redis中，采用redis的过期策略，设置过期时间为10ms

 public void addTicket(final Ticket ticket) {
        Assert.notNull(ticket, "ticket cannot be null");

        logger.debug("Added ticket [{}] to registry.", ticket.getId());
        redisService.putString(ticket.getId(), ticket, timeToKillInMilliSeconds);
    }

2.3 cas client验证ST

在CasRealm中可自行doGetAuthenticationInfo方法,其中Assertion casAssertion = ticketValidator.validate(ticket, getCasService());这段代码校验service ticket是否合法

@Override
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
		CasToken casToken = (CasToken) token;
		if (token == null) {
			return null;
		}

		String ticket = (String) casToken.getCredentials();
		if (!StringUtils.hasText(ticket)) {
			return null;
		}

		TicketValidator ticketValidator = ensureTicketValidator();

		try {
			// contact CAS server to validate service ticket
			Assertion casAssertion = ticketValidator.validate(ticket, getCasService());
			// get principal, user id and attributes
			AttributePrincipal casPrincipal = casAssertion.getPrincipal();
			String username = casPrincipal.getName();
			logger.debug("Validate ticket : {} in CAS server : {} to retrieve user : {}",
					new Object[] { ticket, getCasServerUrlPrefix(), username });

			Map<String, Object> attributes = casPrincipal.getAttributes();
			// refresh authentication token (user id + remember me)
			casToken.setUserId(username);
			String rememberMeAttributeName = getRememberMeAttributeName();
			String rememberMeStringValue = (String) attributes.get(rememberMeAttributeName);
			boolean isRemembered = rememberMeStringValue != null && Boolean.parseBoolean(rememberMeStringValue);
			if (isRemembered) {
				casToken.setRememberMe(true);
			}
			// create simple authentication info
			// 从用户中心获取用户信息，产生shiroUser

			UcsUserDto user = null;
			List<UcsSystemPermission> permissions = null;
			UcsEnterprise ent = null;
			UcsOrganization org = null;
			try {
				user = userService.getUserByUsername(username);
				permissions = userService.getPermissionByUserId(domainId, user.getId());
				ent = userService.getEnterpriseById(user.getEntId());
				org = userService.getOrganizationById(user.getOrgId());
			} catch (Exception e) {
				logger.error(e.getMessage());
				// throw new UcsException();
			}
			if (user == null || permissions == null) {
				logger.error("从用户中心获取数据失败");
				throw new UnknownAccountException();
			}
			// 给菜单排序
			List<Menu> menus = convertToMenu(permissions, domain);
			if (!CheckEmptyUtil.isEmpty(menus)) {
				Collections.sort(menus);
			}
			ShiroUser shiroUser = new ShiroUser(user.getId(), user.getUsername(), user.getName(), menus,
					convertToEnterprise(ent), convertToOrganization(org));

			return new SimpleAuthenticationInfo(shiroUser, ticket, getName());
		} catch (TicketValidationException e) {
			logger.error(e.getMessage(), e);
			throw new CasAuthenticationException("Unable to validate ticket [" + ticket + "]", e);
		}

查看org.jasig.cas.client.util.CommonUtils中，可以看到
cas client会向http://192.168.4.187:8099/gateway/serviceValidate?ticket=ST-8-A0evT9M9DU69tdZqJ2gBedn2d7lZ3gmXiHK&service=http%3A%2F%2F192.168.4.187%3A8097%2Fpss%2Flogin
如果返回下面的，则表示ticket验证失败

<cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'><cas:authenticationFailure code='INVALID_TICKET'>INVALID_TICKET_SPEC</cas:authenticationFailure></cas:serviceResponse>

ticket验证成功则是

<cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'><cas:authenticationSuccess><cas:user>admin</cas:user></cas:authenticationSuccess></cas:serviceResponse>

  public static String getResponseFromServer(final URL constructedUrl, final HostnameVerifier hostnameVerifier, final String encoding) {
        URLConnection conn = null;
        try {
            conn = constructedUrl.openConnection();
            if (conn instanceof HttpsURLConnection) {
                ((HttpsURLConnection)conn).setHostnameVerifier(hostnameVerifier);
            }
            final BufferedReader in;

            if (CommonUtils.isEmpty(encoding)) {
                in = new BufferedReader(new InputStreamReader(conn.getInputStream()));
            } else {
                in = new BufferedReader(new InputStreamReader(conn.getInputStream(), encoding));
            }

            String line;
            final StringBuilder stringBuffer = new StringBuilder(255);

            while ((line = in.readLine()) != null) {
                stringBuffer.append(line);
                stringBuffer.append("\n");
            }
            return stringBuffer.toString();
        } catch (final Exception e) {
            LOG.error(e.getMessage(), e);
            throw new RuntimeException(e);
        } finally {
            if (conn != null && conn instanceof HttpURLConnection) {
                ((HttpURLConnection)conn).disconnect();
            }
        }

    }

这样看来真正验证ticket是在cas server端，从cas原来中到对应的controller，仿照做一下

@RequestMapping(value = "/serviceValidate", method = RequestMethod.GET)
	@ResponseBody
	public String index(String ticket, String service, HttpServletRequest request, Model model) {
		AppService appService = AppService.createServiceFrom(service);
        if (appService == null || ticket == null) {
            logger.debug("Could not identify service and/or service ticket. Service: {}, Service ticket id: {}", service, ticket);
            return generateErrorView("INVALID_REQUEST", "INVALID_REQUEST");
        }
        try {
            String username = centralAuthenticationService.validateServiceTicket(ticket, service);
            logger.debug("Successfully validated service ticket {} for service [{}]", ticket, appService.getId());
            return generateSuccessView(username);
		} catch (Exception e) {
            logger.debug("Service ticket [{}] does not satisfy validation specification.", ticket);
            return generateErrorView("INVALID_TICKET", "INVALID_TICKET_SPEC");
		}
	}

如何校验st呢，

@Override
	public String validateServiceTicket(String serviceTicketId, String service) throws TicketException {
		//根据ST的id获取ST
		final ServiceTicket serviceTicket = (ServiceTicket) serviceTicketRegistry.getTicket(serviceTicketId, ServiceTicketImpl.class);
		//校验数据，可能不存在或过期
		if (serviceTicket == null) {
			logger.info("ServiceTicket [{}] does not exist or expired.", serviceTicketId);
			throw new InvalidTicketException(serviceTicketId);
		}

		//获取用户登录时的Session
		final String sessionId = serviceTicket.getSessionId();
		Session session = null;
		try {
			session = sessionDAO.readSession(sessionId);
		} catch (Exception e) {
			logger.error("Session [{}] does not exist or expired", session.getId().toString());
			throw new TicketValidationException(serviceTicket.getService());
		}
		TicketGrantTicket tgt = SessionUtil.getTgt(session);
		
		if (!tgt.getServices().containsKey(serviceTicketId)) {
			logger.info("ServiceTicket [{}] does not exist.", serviceTicketId);
			throw new InvalidTicketException(serviceTicketId);
		}

		//获取Service
		AppService appService = tgt.getServices().get(serviceTicketId);
		synchronized (serviceTicket) {
			//检查service是否和校验请求的service匹配
			if (!serviceTicket.isValidFor(appService)) {
				logger.error("ServiceTicket [{}] with service [{}] does not match supplied service [{}]",
						serviceTicketId, serviceTicket.getService().getId(), service);
				throw new TicketValidationException(serviceTicket.getService());
			}
		}
		//成功使用后删除ticket
		serviceTicketRegistry.deleteTicket(serviceTicketId);
		return tgt.getUsername();
	}

2.3 TGT产生与更新
debug跟踪后，TGT中service对象，将st作为key，应用url信息作为service对象，保存到session中。

下面是tgt的内部结构

public class TicketGrantTicket implements Serializable {
	
	/**
	 * 
	 */
	private static final long serialVersionUID = -2526554734322014693L;

	private String username;

	//stid:service
	private Map<String, AppService> services;

	//serviceId,stId
	private Map<String, String> serviceIds;
	
	public TicketGrantTicket() {
		services = new HashMap<String, AppService>();
		serviceIds = new HashMap<String, String>();
	}

	public String getUsername() {
		return username;
	}

	public void setUsername(String username) {
		this.username = username;
	}

	public Map<String, AppService> getServices() {
		return services;
	}

	public void setServices(Map<String, AppService> services) {
		this.services = services;
	}
	
	public void putService(String stId, AppService service) {
		//检查当前service是否登录过
		if(serviceIds.containsKey(service.getId())) {
			//曾经登录过则删除原AppService
			String oldStId = serviceIds.get(service.getId());
			services.remove(oldStId);
		} else {
			//未登陆过则保存
			serviceIds.put(service.getId(), stId);
		}
		services.put(stId, service);
	}
}

下面这个图，讲述的是输入cas client地址后，会被重定向到cas server， 由cas servicer完成登录后，将登录地址带ticket重定向到cas client，cas client再向cas server发送请求验证ticket是否有效，有效则根据username获取权限。

下面截图可以到service里有什么

2.4 先登录cas server，再进入cas client的流程是怎样
自研cas server，是想定制统一门户页面，故需要先进入cas server，然后从cas server的快捷入口，进入到cas client中，这个流程入下图所示，

从cas server重定向到http://192.168.4.187:8097/pss/login?ticket=ST-15-XCJbhQTd7xYbcSAxfGcYumedfmsQK4j4T2s做了什么呢？
查看org.apache.shiro.cas.CasFilter，他将ticket放入token中

protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) throws Exception {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        String ticket = httpRequest.getParameter(TICKET_PARAMETER);
        return new CasToken(ticket);
    }