解决jasig CAS server端 ticketGrantingTicket超时后的一个bug

原文：http://castte.iteye.com/blog/1255308

最近研究cas，发现在设置ticketGrantingTicket超时后，打开https://tski.com:8443/cas 仍然显示成功


ticketExpirationPolicies.xml

Xml代码  

1. <!-- This argument is the time a ticket can exist before its considered expired. 设置为5秒超时-->  
2. <bean id="grantingTicketExpirationPolicy" class="org.jasig.cas.ticket.support.TimeoutExpirationPolicy">  
3.        
4.     <constructor-arg  
5.         index="0"  
6.         value="5000" />  
7. </bean>   

	<!-- This argument is the time a ticket can exist before its considered expired. 设置为5秒超时-->
	<bean id="grantingTicketExpirationPolicy" class="org.jasig.cas.ticket.support.TimeoutExpirationPolicy">
		
		<constructor-arg
			index="0"
			value="5000" />
	</bean> 

ticketRegistry.xml

Xml代码  

1. <!-- 10秒检查一次是否有ticket需要clean  -->  
2.     <bean id="triggerJobDetailTicketRegistryCleaner" class="org.springframework.scheduling.quartz.SimpleTriggerBean"  
3.         p:jobDetail-ref="jobDetailTicketRegistryCleaner"  
4.         p:startDelay="2000"  
5.         p:repeatInterval="10000" />  

<!-- 10秒检查一次是否有ticket需要clean  -->
	<bean id="triggerJobDetailTicketRegistryCleaner" class="org.springframework.scheduling.quartz.SimpleTriggerBean"
		p:jobDetail-ref="jobDetailTicketRegistryCleaner"
		p:startDelay="2000"
		p:repeatInterval="10000" />

仍然显示成功



所以猜测，TGT超时与使用https://tski.com:8443/cas/logout 不同地方在于，后者清除了cookie中的TGT

于是找到logout的处理代码
org.jasig.cas.web.LogoutController

Java代码  

1. protected ModelAndView handleRequestInternal(   
2.     final HttpServletRequest request, final HttpServletResponse response)   
3.     throws Exception {   
4.     final String ticketGrantingTicketId = this.ticketGrantingTicketCookieGenerator.retrieveCookieValue(request);   
5.     final String service = request.getParameter("service");   
6.   
7.     if (ticketGrantingTicketId != null) {   
8.         this.centralAuthenticationService   
9.             .destroyTicketGrantingTicket(ticketGrantingTicketId);   
10.         //清除cookie   
11.         this.ticketGrantingTicketCookieGenerator.removeCookie(response);   
12.         this.warnCookieGenerator.removeCookie(response);   
13.     }   
14.   
15.     if (this.followServiceRedirects && service != null) {   
16.         return new ModelAndView(new RedirectView(service));   
17.     }   
18.   
19.     return new ModelAndView(this.logoutView);   
20. }  

    protected ModelAndView handleRequestInternal(
        final HttpServletRequest request, final HttpServletResponse response)
        throws Exception {
        final String ticketGrantingTicketId = this.ticketGrantingTicketCookieGenerator.retrieveCookieValue(request);
        final String service = request.getParameter("service");

        if (ticketGrantingTicketId != null) {
            this.centralAuthenticationService
                .destroyTicketGrantingTicket(ticketGrantingTicketId);
            //清除cookie
            this.ticketGrantingTicketCookieGenerator.removeCookie(response);
            this.warnCookieGenerator.removeCookie(response);
        }

        if (this.followServiceRedirects && service != null) {
            return new ModelAndView(new RedirectView(service));
        }

        return new ModelAndView(this.logoutView);
    }

而TGT超时时，cas server 不能获取cookie

继续猜测，打开https://tski.com:8443/cas时，cas server只判断了cookie中是否有TGT，但是没判断org.jasig.cas.ticket.registry.TicketRegistry中是否还存在TGT。

找到login-webflow.xml

Xml代码  

1.        
2.   
3. <!-- 在flowScope.ticketGrantingTicketId && flowScope.service 为null的情况下，页面会跳转到viewGenericLoginSuccess -->  
4. <on-start>  
5.         <evaluate expression="initialFlowSetupAction" />  
6.     </on-start>  
7.   
8.     <decision-state id="ticketGrantingTicketExistsCheck">  
9.         <if test="flowScope.ticketGrantingTicketId neq null" then="hasServiceCheck" else="gatewayRequestCheck" />  
10.     </decision-state>  
11.        
12.     ...    
13.     <decision-state id="hasServiceCheck">  
14.         <if test="flowScope.service != null" then="renewRequestCheck" else="viewGenericLoginSuccess" />  
15.     </decision-state>  

    

<!-- 在flowScope.ticketGrantingTicketId && flowScope.service 为null的情况下，页面会跳转到viewGenericLoginSuccess -->
<on-start>
        <evaluate expression="initialFlowSetupAction" />
    </on-start>

	<decision-state id="ticketGrantingTicketExistsCheck">
		<if test="flowScope.ticketGrantingTicketId neq null" then="hasServiceCheck" else="gatewayRequestCheck" />
	</decision-state>
    
	...	
	<decision-state id="hasServiceCheck">
		<if test="flowScope.service != null" then="renewRequestCheck" else="viewGenericLoginSuccess" />
	</decision-state>

所以现在要确认flowScope.ticketGrantingTicketId ， flowScope.service 是什么东西
找到org.jasig.cas.web.flow.InitialFlowSetupAction

Java代码  

1.     protected Event doExecute(final RequestContext context) throws Exception {   
2.         final HttpServletRequest request = WebUtils.getHttpServletRequest(context);   
3.         if (!this.pathPopulated) {   
4.             ...        }   
5.   
6. //ticketGrantingTicketId是从cookie里取的，问题很清楚了   
7.         context.getFlowScope().put(   
8.             "ticketGrantingTicketId", this.ticketGrantingTicketCookieGenerator.retrieveCookieValue(request));   
9.         context.getFlowScope().put(   
10.             "warnCookieValue",   
11.             Boolean.valueOf(this.warnCookieGenerator.retrieveCookieValue(request)));   
12. //service 只有在从其他系统跳转到cas server时才可能不是null   
13.         final Service service = WebUtils.getService(this.argumentExtractors,   
14.             context);   
15.   
16.         if (service != null && logger.isDebugEnabled()) {   
17.             logger.debug("Placing service in FlowScope: " + service.getId());   
18.         }   
19.   
20.         context.getFlowScope().put("service", service);   
21.   
22.         return result("success");   
23.     }  

	protected Event doExecute(final RequestContext context) throws Exception {
        final HttpServletRequest request = WebUtils.getHttpServletRequest(context);
        if (!this.pathPopulated) {
            ...        }

//ticketGrantingTicketId是从cookie里取的，问题很清楚了
        context.getFlowScope().put(
            "ticketGrantingTicketId", this.ticketGrantingTicketCookieGenerator.retrieveCookieValue(request));
        context.getFlowScope().put(
            "warnCookieValue",
            Boolean.valueOf(this.warnCookieGenerator.retrieveCookieValue(request)));
//service 只有在从其他系统跳转到cas server时才可能不是null
        final Service service = WebUtils.getService(this.argumentExtractors,
            context);

        if (service != null && logger.isDebugEnabled()) {
            logger.debug("Placing service in FlowScope: " + service.getId());
        }

        context.getFlowScope().put("service", service);

        return result("success");
    }

最后，修改代码
org.jasig.cas.web.flow.InitialFlowSetupAction

Java代码  

1. //注入 ticketRegistry   
2.  @NotNull  
3.     private TicketRegistry ticketRegistry;   
4.   
5.     public TicketRegistry getTicketRegistry() {   
6.         return ticketRegistry;   
7.     }   
8.   
9.     public void setTicketRegistry(TicketRegistry ticketRegistry) {   
10.         this.ticketRegistry = ticketRegistry;   
11.     }   
12.   
13.   
14.   
15.     protected Event doExecute(final RequestContext context) throws Exception {   
16.         final HttpServletRequest request = WebUtils.getHttpServletRequest(context);   
17.         if (!this.pathPopulated) {   
18.             ...        }   
19. //从ticketRegistry中获取TGT   
20.         context.getFlowScope().put(   
21.             "ticketGrantingTicketId", ticketRegistry.getTicket(this.ticketGrantingTicketCookieGenerator.retrieveCookieValue(request)));   
22.         context.getFlowScope().put(   
23.             "warnCookieValue",   
24.             Boolean.valueOf(this.warnCookieGenerator.retrieveCookieValue(request)));   
25.   
26.         final Service service = WebUtils.getService(this.argumentExtractors,   
27.             context);   
28.   
29.         if (service != null && logger.isDebugEnabled()) {   
30.             logger.debug("Placing service in FlowScope: " + service.getId());   
31.         }   
32.   
33.         context.getFlowScope().put("service", service);   
34.   
35.         return result("success");   
36.     }  

//注入 ticketRegistry
 @NotNull
    private TicketRegistry ticketRegistry;

    public TicketRegistry getTicketRegistry() {
		return ticketRegistry;
	}

	public void setTicketRegistry(TicketRegistry ticketRegistry) {
		this.ticketRegistry = ticketRegistry;
	}



	protected Event doExecute(final RequestContext context) throws Exception {
        final HttpServletRequest request = WebUtils.getHttpServletRequest(context);
        if (!this.pathPopulated) {
            ...        }
//从ticketRegistry中获取TGT
        context.getFlowScope().put(
            "ticketGrantingTicketId", ticketRegistry.getTicket(this.ticketGrantingTicketCookieGenerator.retrieveCookieValue(request)));
        context.getFlowScope().put(
            "warnCookieValue",
            Boolean.valueOf(this.warnCookieGenerator.retrieveCookieValue(request)));

        final Service service = WebUtils.getService(this.argumentExtractors,
            context);

        if (service != null && logger.isDebugEnabled()) {
            logger.debug("Placing service in FlowScope: " + service.getId());
        }

        context.getFlowScope().put("service", service);

        return result("success");
    }

修改cas-servlet.xml

Xml代码  

1. <!-- 最后一行 p:ticketRegistry-ref="ticketRegistry"  ，注入ticketRegistry -->  
2.     <bean id="initialFlowSetupAction" class="org.jasig.cas.web.flow.InitialFlowSetupAction"  
3.         p:argumentExtractors-ref="argumentExtractors"  
4.         p:warnCookieGenerator-ref="warnCookieGenerator"  
5.         p:ticketGrantingTicketCookieGenerator-ref="ticketGrantingTicketCookieGenerator"    
6.         p:ticketRegistry-ref="ticketRegistry"/>