CAS流程简析客户端处理携带Ticket访问请求

我家有猫已长成

已于 2022-02-07 23:09:04 修改

阅读量3.9k

点赞数

分类专栏： CAS 文章标签： cas

于 2022-01-30 15:35:53 首次发布

本文链接：https://blog.csdn.net/xing_hung/article/details/122753312

版权

CAS 专栏收录该内容

7 篇文章 2 订阅

订阅专栏

简介

用户访问客户端的请求，会先经过客户端配置的过滤器链，常用的过滤器如下：

CAS Single Sign Out Filter——SingleSignOutFilter
1. 实现单点登出，放在首个位置；
CAS Validation Filter——Cas30ProxyReceivingTicketValidationFilter
1. 负责对Ticket的校验
2. 需要指定服务端地址：casServerUrlPrefix
3. 需要指定客户端地址：serverName
CAS Authentication Filter——AuthenticationFilter
1. 负责用户的鉴权
2. 需要指定服务端登录地址：casServerLoginUrl
3. 需要指定客户端地址：serverName
CAS HttpServletRequest Wrapper Filter——HttpServletRequestWrapperFilter
1. 负责包装HttpServletRequest，从而可通过HttpServletRequest的getRemoteUser()方法获取登录用户的登录名

用户的访问请求会依次经过以上配置的过滤器的拦截和处理；

SingleSignOutFilter

首先经过SingleSignOutFilter处理，该过滤器实现单点登出功能；
本次是用户访问请求，不是登出请求，该过滤器会直接放行，核心代码如下：

private static final SingleSignOutHandler HANDLER = new SingleSignOutHandler();

public void init(final FilterConfig filterConfig) throws ServletException {
    super.init(filterConfig);
    if (!isIgnoreInitConfiguration()) {
        // 设置属性
        setArtifactParameterName(getString(ConfigurationKeys.ARTIFACT_PARAMETER_NAME));
        setLogoutParameterName(getString(ConfigurationKeys.LOGOUT_PARAMETER_NAME));
        setFrontLogoutParameterName(getString(ConfigurationKeys.FRONT_LOGOUT_PARAMETER_NAME));
        setRelayStateParameterName(getString(ConfigurationKeys.RELAY_STATE_PARAMETER_NAME));
        setCasServerUrlPrefix(getString(ConfigurationKeys.CAS_SERVER_URL_PREFIX));
        HANDLER.setArtifactParameterOverPost(getBoolean(ConfigurationKeys.ARTIFACT_PARAMETER_OVER_POST));
        HANDLER.setEagerlyCreateSessions(getBoolean(ConfigurationKeys.EAGERLY_CREATE_SESSIONS));
    }
    // handler初始化
    HANDLER.init();
    // 设置handler初始化完成标识
    handlerInitialized.set(true);
}

public void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse,
        final FilterChain filterChain) throws IOException, ServletException {
    final HttpServletRequest request = (HttpServletRequest) servletRequest;
    final HttpServletResponse response = (HttpServletResponse) servletResponse;

    /**
     * <p>Workaround for now for the fact that Spring Security will fail since it doesn't call {@link #init(javax.servlet.FilterConfig)}.</p>
     * <p>Ultimately we need to allow deployers to actually inject their fully-initialized {@link org.jasig.cas.client.session.SingleSignOutHandler}.</p>
     */
    // 校验handler是否初始化完成
    if (!this.handlerInitialized.getAndSet(true)) {
        HANDLER.init();
    }

    // 根据handler的处理选择是否继续过滤器链
    if (HANDLER.process(request, response)) {
        filterChain.doFilter(servletRequest, servletResponse);
    }
}

首先分析设置属性的操作，设置属性时用到了getString方法，该方法继承自父类AbstractConfigurationFilter，代码如下：

protected final String getString(final ConfigurationKey<String> configurationKey) {
    return this.configurationStrategy.getString(configurationKey);
}

getString使用了this.configurationStrategy，继续看下该属性的赋值，代码如下：

private static final String CONFIGURATION_STRATEGY_KEY = "configurationStrategy";

public void init(FilterConfig filterConfig) throws ServletException {
    // 从配置中获取configurationStrategy的配置信息
    final String configurationStrategyName = filterConfig.getServletContext().getInitParameter(CONFIGURATION_STRATEGY_KEY);
    // 根据configurationStrategy的配置信息获取ConfigurationStrategy实例
    this.configurationStrategy = ReflectUtils.newInstance(ConfigurationStrategyName.resolveToConfigurationStrategy(configurationStrategyName));
    // 执行初始化操作
    this.configurationStrategy.init(filterConfig, getClass());
}


// ConfigurationStrategyName.java

DEFAULT(LegacyConfigurationStrategyImpl.class),

public static Class<? extends ConfigurationStrategy> resolveToConfigurationStrategy(final String value) {
    if (CommonUtils.isBlank(value)) {
        // 若为空，返回默认值LegacyConfigurationStrategyImpl.class
        return DEFAULT.configurationStrategyClass;
    }

    for (final ConfigurationStrategyName csn : values()) {
        if (csn.name().equalsIgnoreCase(value)) {
            return csn.configurationStrategyClass;
        }
    }

    try {
        final Class<?> clazz = Class.forName(value);

        if (ConfigurationStrategy.class.isAssignableFrom(clazz)) {
            return (Class<? extends ConfigurationStrategy>) clazz;
        }
    }   catch (final ClassNotFoundException e) {
        LOGGER.error("Unable to locate strategy {} by name or class name.  Using default strategy instead.", value, e);
    }

    return DEFAULT.configurationStrategyClass;
}

若配置文件中没有配置configurationStrategy，则默认创建LegacyConfigurationStrategyImpl实例，该类型是WebXmlConfigurationStrategyImpl和JndiConfigurationStrategyImpl的包装，优先使用WebXmlConfigurationStrategyImpl，核心代码如下：

private final WebXmlConfigurationStrategyImpl webXmlConfigurationStrategy = new WebXmlConfigurationStrategyImpl();
private final JndiConfigurationStrategyImpl jndiConfigurationStrategy = new JndiConfigurationStrategyImpl();

public void init(FilterConfig filterConfig, Class<? extends Filter> filterClazz) {
    this.webXmlConfigurationStrategy.init(filterConfig, filterClazz);
    this.jndiConfigurationStrategy.init(filterConfig, filterClazz);
}

protected String get(final ConfigurationKey key) {
    // 优先使用WebXmlConfigurationStrategyImpl
    final String value1 = this.webXmlConfigurationStrategy.get(key);

    if (CommonUtils.isNotBlank(value1)) {
        return value1;
    }

    return this.jndiConfigurationStrategy.get(key);
}

接着分析SingleSignOutHandler的实现，其核心代码如下：

public boolean process(final HttpServletRequest request, final HttpServletResponse response) {
    if (isTokenRequest(request)) {
        // 若是携带token的请求
        // 本次用户访问请求携带Ticket信息，会由这里返回
        logger.trace("Received a token request");
        // 记录session
        recordSession(request);
        // 返回true，继续执行过滤器链
        return true;
    } else if (isBackChannelLogoutRequest(request)) {
        // 若是后置通道登出请求
        // 本次用户访问请求不是登出请求，不满足
        logger.trace("Received a back channel logout request");
        // 销毁session
        destroySession(request);
        // 返回false，终止执行过滤器链
        return false;
    } else if (isFrontChannelLogoutRequest(request)) {
        // 若是前置通道登出请求
        // 本次用户访问请求不是登出请求，不满足
        logger.trace("Received a front channel logout request");
        // 销毁session
        destroySession(request);
        // redirection url to the CAS server
        final String redirectionUrl = computeRedirectionToServer(request);
        if (redirectionUrl != null) {
            // 重定向到CAS Server
            CommonUtils.sendRedirect(response, redirectionUrl);
        }
        // 返回false，终止执行过滤器链
        return false;
    } else {
        logger.trace("Ignoring URI for logout: {}", request.getRequestURI());
        // 默认返回true，继续执行过滤器链
        return true;
    }
}

private boolean isTokenRequest(final HttpServletRequest request) {
    return CommonUtils.isNotBlank(CommonUtils.safeGetParameter(request, this.artifactParameterName,
            this.safeParameters));
}

private boolean isBackChannelLogoutRequest(final HttpServletRequest request) {
    return "POST".equals(request.getMethod())
            && !isMultipartRequest(request)
            && CommonUtils.isNotBlank(CommonUtils.safeGetParameter(request, this.logoutParameterName,
                    this.safeParameters));
}

private boolean isFrontChannelLogoutRequest(final HttpServletRequest request) {
    return "GET".equals(request.getMethod()) && CommonUtils.isNotBlank(this.casServerUrlPrefix)
            && CommonUtils.isNotBlank(CommonUtils.safeGetParameter(request, this.frontLogoutParameterName));
}

private void recordSession(final HttpServletRequest request) {
    final HttpSession session = request.getSession(this.eagerlyCreateSessions);

    if (session == null) {
        logger.debug("No session currently exists (and none created).  Cannot record session information for single sign out.");
        return;
    }

    final String token = CommonUtils.safeGetParameter(request, this.artifactParameterName, this.safeParameters);
    logger.debug("Recording session for token {}", token);

    try {
        // 移除已缓存的session信息
        this.sessionMappingStorage.removeBySessionById(session.getId());
    } catch (final Exception e) {
        // ignore if the session is already marked as invalid.  Nothing we can do!
    }
    // 缓存当前token和session
    sessionMappingStorage.addSessionById(token, session);
}

private void destroySession(final HttpServletRequest request) {
    final String logoutMessage;
    // front channel logout -> the message needs to be base64 decoded + decompressed
    if (isFrontChannelLogoutRequest(request)) {
        logoutMessage = uncompressLogoutMessage(CommonUtils.safeGetParameter(request,
                this.frontLogoutParameterName));
    } else {
        logoutMessage = CommonUtils.safeGetParameter(request, this.logoutParameterName, this.safeParameters);
    }
    logger.trace("Logout request:\n{}", logoutMessage);

    final String token = XmlUtils.getTextForElement(logoutMessage, "SessionIndex");
    if (CommonUtils.isNotBlank(token)) {
        final HttpSession session = this.sessionMappingStorage.removeSessionByMappingId(token);

        if (session != null) {
            final String sessionID = session.getId();
            logger.debug("Invalidating session [{}] for token [{}]", sessionID, token);

            try {
                // 失效session
                session.invalidate();
            } catch (final IllegalStateException e) {
                logger.debug("Error invalidating session.", e);
            }
            // 登出
            this.logoutStrategy.logout(request);
        }
    }
}

Cas30ProxyReceivingTicketValidationFilter

根据过滤器配置顺序，接下来就是Cas30ProxyReceivingTicketValidationFilter，该过滤器负责对Ticket的校验，需要指定服务端地址casServerUrlPrefix和客户端地址serverName；
本次用户访问请求携带Ticket信息，该过滤器会对Ticket信息进行校验，核心代码如下：

public Cas30ProxyReceivingTicketValidationFilter() {
    // 支持协议为CAS3
    super(Protocol.CAS3);
    // ST校验器使用Cas30ServiceTicketValidator
    this.defaultServiceTicketValidatorClass = Cas30ServiceTicketValidator.class;
    // PT校验器使用Cas30ProxyTicketValidator
    this.defaultProxyTicketValidatorClass = Cas30ProxyTicketValidator.class;
}

Cas30ProxyReceivingTicketValidationFilter继承自Cas20ProxyReceivingTicketValidationFilter，重写了this.protocol、this.defaultServiceTicketValidatorClass和this.defaultProxyTicketValidatorClass的实现，其它处理都一样，接着分析Cas20ProxyReceivingTicketValidationFilter；
Cas20ProxyReceivingTicketValidationFilter的doFilter方法继承自父类AbstractTicketValidationFilter，AbstractTicketValidationFilter实现了doFilter方法的算法模板，并提供算法细节preFilter、onSuccessfulValidation、onFailedValidation可供子类重写添加额外处理逻辑，核心代码如下：

public final void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse,
        final FilterChain filterChain) throws IOException, ServletException {

    // 过滤前预处理
    if (!preFilter(servletRequest, servletResponse, filterChain)) {
        return;
    }

    final HttpServletRequest request = (HttpServletRequest) servletRequest;
    final HttpServletResponse response = (HttpServletResponse) servletResponse;
    // 从请求中获取Ticket信息
    final String ticket = retrieveTicketFromRequest(request);

    // 是否存在Ticket信息
    // 本次用户访问请求携带Ticket信息
    if (CommonUtils.isNotBlank(ticket)) {
        logger.debug("Attempting to validate ticket: {}", ticket);

        try {
            // 存在Ticket信息就需要校验
            // 对本次用户访问请求携带的Ticket信息进行校验
            final Assertion assertion = this.ticketValidator.validate(ticket,
                    constructServiceUrl(request, response));

            logger.debug("Successfully authenticated user: {}", assertion.getPrincipal().getName());

            // 未抛出异常，则校验成功
            // 将校验结果放入request请求中，方便下次获取
            request.setAttribute(CONST_CAS_ASSERTION, assertion);

            if (this.useSession) {
                // 使用session情况下，将校验结果方法session属性中
                request.getSession().setAttribute(CONST_CAS_ASSERTION, assertion);
            }
            // 校验成功时处理
            onSuccessfulValidation(request, response, assertion);

            if (this.redirectAfterValidation) {
                // 默认为true，校验后需要重定向
                // 重定向后，request会存在Assertion信息，所以可以通过AuthenticationFilter
                // 但不会携带Ticket信息，所以直接通过Cas30ProxyReceivingTicketValidationFilter
                logger.debug("Redirecting after successful ticket validation.");
                response.sendRedirect(constructServiceUrl(request, response));
                return;
            }
        } catch (final TicketValidationException e) {
            logger.debug(e.getMessage(), e);

            // 校验失败时处理
            onFailedValidation(request, response);

            if (this.exceptionOnValidationFailure) {
                throw new ServletException(e);
            }

            // 返回HttpServletResponse.SC_FORBIDDEN响应
            response.sendError(HttpServletResponse.SC_FORBIDDEN, e.getMessage());

            return;
        }
    }

    // 执行过滤器链
    filterChain.doFilter(request, response);
}

protected boolean preFilter(final ServletRequest servletRequest, final ServletResponse servletResponse,
        final FilterChain filterChain) throws IOException, ServletException {
    return true;
}

protected void onSuccessfulValidation(final HttpServletRequest request, final HttpServletResponse response,
        final Assertion assertion) {
    // nothing to do here.
}

protected void onFailedValidation(final HttpServletRequest request, final HttpServletResponse response) {
    // nothing to do here.
}

protected String retrieveTicketFromRequest(final HttpServletRequest request) {
    // 从请求中获取"ticket"信息
    return CommonUtils.safeGetParameter(request, this.protocol.getArtifactParameterName());
}

对于this.redirectAfterValidation属性需要说明下，该值决定了Ticket校验成功后是否需要重定向：

如果进行重定向，那么新请求就不会携带Ticket信息，新请求也就不需要再进行Ticket校验处理；但由于AuthenticationFilter是从Session中获取鉴权结果，所以要进行重定向，就必须要支持使用Session，即this.useSession为true；
如果不进行重定向，那么原请求还会携带Ticket信息，AuthenticationFilter获取到Ticket信息就会放行；

所以this.redirectAfterValidation属性赋值的相关代码如下：

private boolean redirectAfterValidation = true;

protected void initInternal(final FilterConfig filterConfig) throws ServletException {
    setExceptionOnValidationFailure(getBoolean(ConfigurationKeys.EXCEPTION_ON_VALIDATION_FAILURE));
    setRedirectAfterValidation(getBoolean(ConfigurationKeys.REDIRECT_AFTER_VALIDATION));
    setUseSession(getBoolean(ConfigurationKeys.USE_SESSION));

    if (!this.useSession && this.redirectAfterValidation) {
        // 如果不使用Session，那么就不支持Ticket校验后重定向到客户端
        logger.warn("redirectAfterValidation parameter may not be true when useSession parameter is false. Resetting it to false in order to prevent infinite redirects.");
        setRedirectAfterValidation(false);
    }

    setTicketValidator(getTicketValidator(filterConfig));
    super.initInternal(filterConfig);
}

Cas20ProxyReceivingTicketValidationFilter重写了preFilter，主要针对代理模式下的请求做预处理，代码如下：

protected final boolean preFilter(final ServletRequest servletRequest, final ServletResponse servletResponse,
                                  final FilterChain filterChain) throws IOException, ServletException {
    final HttpServletRequest request = (HttpServletRequest) servletRequest;
    final HttpServletResponse response = (HttpServletResponse) servletResponse;
    final String requestUri = request.getRequestURI();

    // 是否是代理请求
    // 本次用户访问请求不是代理请求
    if (CommonUtils.isEmpty(this.proxyReceptorUrl) || !requestUri.endsWith(this.proxyReceptorUrl)) {
        return true;
    }

    try {
        CommonUtils.readAndRespondToProxyReceptorRequest(request, response, this.proxyGrantingTicketStorage);
    } catch (final RuntimeException e) {
        logger.error(e.getMessage(), e);
        throw e;
    }

    return false;
}

AbstractTicketValidationFilter.doFilter中使用了this.ticketValidator来校验Ticket信息，Cas30ProxyReceivingTicketValidationFilter中默认使用的是Cas30ServiceTicketValidator，其validate方法继承自父类AbstractUrlBasedTicketValidator，AbstractUrlBasedTicketValidator实现了validate方法的算法模板，提供算法细节retrieveResponseFromServer、parseResponseFromServer由子类实现，代码如下：

public final Assertion validate(final String ticket, final String service) throws TicketValidationException {
    // 构建校验请求URL
    final String validationUrl = constructValidationUrl(ticket, service);
    logger.debug("Constructing validation url: {}", validationUrl);

    try {
        // 发送校验请求并获取服务端响应
        logger.debug("Retrieving response from server.");
        final String serverResponse = retrieveResponseFromServer(new URL(validationUrl), ticket);

        // 返回结果为空则校验失败
        if (serverResponse == null) {
            throw new TicketValidationException("The CAS server returned no response.");
        }

        logger.debug("Server response: {}", serverResponse);

        // 解析服务端响应
        return parseResponseFromServer(serverResponse);
    } catch (final MalformedURLException e) {
        throw new TicketValidationException(e);
    }
}

protected abstract String retrieveResponseFromServer(URL validationUrl, String ticket);

protected abstract Assertion parseResponseFromServer(final String response) throws TicketValidationException;

protected final String constructValidationUrl(final String ticket, final String serviceUrl) {
    final Map<String, String> urlParameters = new HashMap<String, String>();

    logger.debug("Placing URL parameters in map.");
    // 放入Ticket信息
    urlParameters.put("ticket", ticket);
    // 放入Service信息
    urlParameters.put("service", serviceUrl);

    // 如果包含renew
    if (this.renew) {
        urlParameters.put("renew", "true");
    }

    logger.debug("Calling template URL attribute map.");
    // 填充其他属性
    populateUrlAttributeMap(urlParameters);
    logger.debug("Loading custom parameters from configuration.");
    if (this.customParameters != null) {
        urlParameters.putAll(this.customParameters);
    }

    final String suffix = getUrlSuffix();
    final StringBuilder buffer = new StringBuilder(urlParameters.size() * 10 + this.casServerUrlPrefix.length()
            + suffix.length() + 1);

    int i = 0;

    // 构造URL
    buffer.append(this.casServerUrlPrefix);
    if (!this.casServerUrlPrefix.endsWith("/")) {
        buffer.append("/");
    }
    buffer.append(suffix);

    for (Map.Entry<String, String> entry : urlParameters.entrySet()) {
        final String key = entry.getKey();
        final String value = entry.getValue();

        if (value != null) {
            buffer.append(i++ == 0 ? "?" : "&");
            buffer.append(key);
            buffer.append("=");
            final String encodedValue = encodeUrl(value);
            buffer.append(encodedValue);
        }
    }

    return buffer.toString();
}

AbstractCasProtocolUrlBasedTicketValidator实现了算法细节的retrieveResponseFromServer的算法模板，代码如下：

protected final String retrieveResponseFromServer(final URL validationUrl, final String ticket) {
    // 借助CommonUtils实现
    return CommonUtils.getResponseFromServer(validationUrl, getURLConnectionFactory(), getEncoding());
}


// CommonUtils.java
public static String getResponseFromServer(final URL constructedUrl, final HttpURLConnectionFactory factory,
        final String encoding) {

    HttpURLConnection conn = null;
    InputStreamReader in = null;
    try {
        conn = factory.buildHttpURLConnection(constructedUrl.openConnection());

        if (CommonUtils.isEmpty(encoding)) {
            in = new InputStreamReader(conn.getInputStream());
        } else {
            in = new InputStreamReader(conn.getInputStream(), encoding);
        }

        // 获取响应
        final StringBuilder builder = new StringBuilder(255);
        int byteRead;
        while ((byteRead = in.read()) != -1) {
            builder.append((char) byteRead);
        }

        // 返回响应
        return builder.toString();
    } catch (final Exception e) {
        LOGGER.error(e.getMessage(), e);
        throw new RuntimeException(e);
    } finally {
        closeQuietly(in);
        if (conn != null) {
            conn.disconnect();
        }
    }
}

Cas20ServiceTicketValidator实现了算法细节parseResponseFromServer的算法模板，并提供算法细节customParseResponse供子类重写添加额外处理逻辑，代码如下：

protected final Assertion parseResponseFromServer(final String response) throws TicketValidationException {
    final String error = XmlUtils.getTextForElement(response, "authenticationFailure");

    if (CommonUtils.isNotBlank(error)) {
        // 存在错误信息
        throw new TicketValidationException(error);
    }

    final String principal = XmlUtils.getTextForElement(response, "user");
    final String proxyGrantingTicketIou = XmlUtils.getTextForElement(response, "proxyGrantingTicket");

    // 获取PGT信息
    final String proxyGrantingTicket;
    if (CommonUtils.isBlank(proxyGrantingTicketIou) || this.proxyGrantingTicketStorage == null) {
        proxyGrantingTicket = null;
    } else {
        proxyGrantingTicket = this.proxyGrantingTicketStorage.retrieve(proxyGrantingTicketIou);
    }

    // 校验principal信息
    if (CommonUtils.isEmpty(principal)) {
        throw new TicketValidationException("No principal was found in the response from the CAS server.");
    }

    // 封装Assertion信息
    final Assertion assertion;
    final Map<String, Object> attributes = extractCustomAttributes(response);
    if (CommonUtils.isNotBlank(proxyGrantingTicket)) {
        final AttributePrincipal attributePrincipal = new AttributePrincipalImpl(principal, attributes,
                proxyGrantingTicket, this.proxyRetriever);
        assertion = new AssertionImpl(attributePrincipal);
    } else {
        assertion = new AssertionImpl(new AttributePrincipalImpl(principal, attributes));
    }

    // 支持子类定制化解析Assertion信息
    customParseResponse(response, assertion);

    return assertion;
}

protected Map<String, Object> extractCustomAttributes(final String xml) {
    final SAXParserFactory spf = SAXParserFactory.newInstance();
    spf.setNamespaceAware(true);
    spf.setValidating(false);
    try {
        final SAXParser saxParser = spf.newSAXParser();
        final XMLReader xmlReader = saxParser.getXMLReader();
        final CustomAttributeHandler handler = new CustomAttributeHandler();
        xmlReader.setContentHandler(handler);
        xmlReader.parse(new InputSource(new StringReader(xml)));
        return handler.getAttributes();
    } catch (final Exception e) {
        logger.error(e.getMessage(), e);
        return Collections.emptyMap();
    }
}

protected void customParseResponse(final String response, final Assertion assertion)
        throws TicketValidationException {
    // nothing to do
}

AuthenticationFilter

接下来就是AuthenticationFilter，该过滤器负责用户的鉴权，需要指定服务端登录地址casServerLoginUrl和客户端地址serverName；
本次用户访问请求经过Cas30ProxyReceivingTicketValidationFilter处理后存在Ticket或者Assertion信息，所以会被该过滤器放行，核心代码如下：

public final void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse,
        final FilterChain filterChain) throws IOException, ServletException {
    
    final HttpServletRequest request = (HttpServletRequest) servletRequest;
    final HttpServletResponse response = (HttpServletResponse) servletResponse;

    // 本次用户访问请求不涉及
    if (isRequestUrlExcluded(request)) {
        logger.debug("Request is ignored.");
        // 若排除该请求，则直接执行过滤器链
        filterChain.doFilter(request, response);
        return;
    }
    
    // 尝试从Session中获取Assertion信息
    final HttpSession session = request.getSession(false);
    final Assertion assertion = session != null ? (Assertion) session.getAttribute(CONST_CAS_ASSERTION) : null;

    // 本次用户访问请求经过Cas30ProxyReceivingTicketValidationFilter处理后
    // 如果是重定向回来，则会携带Assertion信息
    // 如果不是重定向回来，则会存在Ticket信息
    // 可能未使用Session，获取不到Assertion信息，从而不能重定向
    if (assertion != null) {
        // 若Assertion存在，则无需鉴权，直接放行
        // 本次请求如果是重定向回来，则会从这里返回
        filterChain.doFilter(request, response);
        return;
    }

    // 构造本客户端URL
    final String serviceUrl = constructServiceUrl(request, response);
    // 从request请求中获取Ticket信息
    final String ticket = retrieveTicketFromRequest(request);
    final boolean wasGatewayed = this.gateway && this.gatewayStorage.hasGatewayedAlready(request, serviceUrl);

    // 本次用户访问请求经过Cas30ProxyReceivingTicketValidationFilter处理后
    // 如果不是重定向过来，就会存在Ticket信息
    if (CommonUtils.isNotBlank(ticket) || wasGatewayed) {
        // 若存在Ticket信息则无需鉴权，直接放行
        // 本次请求如果不死活重定向回来，则会从这里返回
        filterChain.doFilter(request, response);
        return;
    }

    final String modifiedServiceUrl;

    logger.debug("no ticket and no assertion found");
    if (this.gateway) {
        logger.debug("setting gateway attribute in session");
        modifiedServiceUrl = this.gatewayStorage.storeGatewayInformation(request, serviceUrl);
    } else {
        modifiedServiceUrl = serviceUrl;
    }

    logger.debug("Constructed service url: {}", modifiedServiceUrl);

    final String urlToRedirectTo = CommonUtils.constructRedirectUrl(this.casServerLoginUrl,
            getProtocol().getServiceParameterName(), modifiedServiceUrl, this.renew, this.gateway);

    // 重定向到服务端进行登录鉴权
    logger.debug("redirecting to \"{}\"", urlToRedirectTo);
    this.authenticationRedirectStrategy.redirect(request, response, urlToRedirectTo);
}

HttpServletRequestWrapperFilter

接下来就是HttpServletRequestWrapperFilter，该过滤器负责包装HttpServletRequest，从而可通过HttpServletRequest的getRemoteUser()方法获取登录用户的登录名，核心代码如下：

public void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse,
        final FilterChain filterChain) throws IOException, ServletException {
    // 从request请求或者session中获取Principal信息
    final AttributePrincipal principal = retrievePrincipalFromSessionOrRequest(servletRequest);

    // 包装ServletRequest，添加Principal信息
    filterChain.doFilter(new CasHttpServletRequestWrapper((HttpServletRequest) servletRequest, principal),
            servletResponse);
}


/**
 * 内部类
 * 继承自HttpServletRequestWrapper，封装了Principal信息
 */
final class CasHttpServletRequestWrapper extends HttpServletRequestWrapper {

    private final AttributePrincipal principal;

    CasHttpServletRequestWrapper(final HttpServletRequest request, final AttributePrincipal principal) {
        super(request);
        this.principal = principal;
    }

    public Principal getUserPrincipal() {
        return this.principal;
    }

    public String getRemoteUser() {
        return principal != null ? this.principal.getName() : null;
    }

    public boolean isUserInRole(final String role) {
        if (CommonUtils.isBlank(role)) {
            logger.debug("No valid role provided.  Returning false.");
            return false;
        }

        if (this.principal == null) {
            logger.debug("No Principal in Request.  Returning false.");
            return false;
        }

        if (CommonUtils.isBlank(roleAttribute)) {
            logger.debug("No Role Attribute Configured. Returning false.");
            return false;
        }

        final Object value = this.principal.getAttributes().get(roleAttribute);

        if (value instanceof Collection<?>) {
            for (final Object o : (Collection<?>) value) {
                if (rolesEqual(role, o)) {
                    logger.debug("User [{}] is in role [{}]: true", getRemoteUser(), role);
                    return true;
                }
            }
        }

        final boolean isMember = rolesEqual(role, value);
        logger.debug("User [{}] is in role [{}]: {}", getRemoteUser(), role, isMember);
        return isMember;
    }

    /**
     * Determines whether the given role is equal to the candidate
     * role attribute taking into account case sensitivity.
     *
     * @param given  Role under consideration.
     * @param candidate Role that the current user possesses.
     *
     * @return True if roles are equal, false otherwise.
     */
    private boolean rolesEqual(final String given, final Object candidate) {
        return ignoreCase ? given.equalsIgnoreCase(candidate.toString()) : given.equals(candidate);
    }
}