java active directory 单点登录,单点登录（SSO）：如何使用Active Directory作为CAS服务的身份验证方法？...

I am developing a portal to Liferay and want to apply there a Single Sign On mechanism (SSO). I am using Jasig CAS for centralized authentication of my multiple web applications. Until now I know that I am able to use CAS as an authentication method but the next step would be to add some more intelligence and ask the authentication from an Active Directory server.

This should be possible by using AD as a "database" towards which the authentication is made, but I am new on these things and do not know how to make this with Jasig CAS.

Any clue how to accomplish this task?

解决方案

I'm making a few assumptions here, so please let me know if I'm off target:

You're using a version of CAS between 3.3.2 and 3.4.8.

You want to tie CAS into Active Directory via LDAP (for Kerberos or SPNEGO see references below) using the Bind LDAP Handler (for FastBind see references below).

You're familiar with building CAS from source via Maven.

Prerequisite

If you're going to bind to AD via "ldaps://" (as opposed to "ldap://"), the JVM on your CAS server needs to trust the SSL certificate of your Active Directory server. If you're using a self-signed cert for AD, you'll need to import this into the JVM's trust store.

Summary

Within your CAS source tree, you'll need to make changes to the following files:

cas-server-webapp/pom.xml

cas-server-webapp/src/main/webapp/WEB-INF/deployerConfigContext.xml

Details

pom.xml:

Add the following within :

${project.groupId}

cas-server-support-ldap

${project.version}

deployerConfigContext.xml:

Reconfigure your Authentication Handers:

Look for: . Inside this is a , and inside this are (probably) two elements

Keep this one:

The other (again, probably) corresponds to the current method of authentication you're using. (I'm not clear based upon the question, as there are several ways

CAS can do this without using external services. The default is SimpleTestUsernamePasswordAuthenticationHandler, this authenticates as long as username is equal to password). Replace that with:

Modify the "searchBase" property according to your AD configuration.

Create a Context Source for LDAP:

Add this somewhere within the root element:

{URL of your AD server, e.g.: ldaps://ad.example.com}/

java.naming.security.authentication

simple

Modify "urls", "userDn" and "password" accordingly.

Rebuild cas-server-webapp and try it.

References: