1.引入maven坐标
<dependency >
<groupId > org.springframework.security</groupId >
<artifactId > spring-security-web</artifactId >
<version > 4.1.0.RELEASE</version >
</dependency >
<dependency >
<groupId > org.springframework.security</groupId >
<artifactId > spring-security-config</artifactId >
<version > 4.1.0.RELEASE</version >
</dependency >
<dependency >
<groupId > org.springframework.security</groupId >
<artifactId > spring-security-cas</artifactId >
<version > 4.1.0.RELEASE</version >
</dependency >
<dependency >
<groupId > org.jasig.cas.client</groupId >
<artifactId > cas-client-core</artifactId >
<version > 3.3.3</version >
<exclusions >
<exclusion >
<groupId > org.slf4j</groupId >
<artifactId > log4j-over-slf4j</artifactId >
</exclusion >
</exclusions >
</dependency >
2.在web.xml中配置Spring Security的过滤器
<context-param >
<param-name > contextConfigLocation</param-name >
<param-value > classpath:spring-security.xml</param-value >
</context-param >
<listener >
<listener-class >
org.springframework.web.context.ContextLoaderListener
</listener-class >
</listener >
<filter >
<filter-name > springSecurityFilterChain</filter-name >
<filter-class > org.springframework.web.filter.DelegatingFilterProxy</filter-class >
</filter >
<filter-mapping >
<filter-name > springSecurityFilterChain</filter-name >
<url-pattern > /*</url-pattern >
</filter-mapping >
3.配置spring-security配置文件
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns ="http://www.springframework.org/schema/security"
xmlns:beans ="http://www.springframework.org/schema/beans" xmlns:xsi ="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation ="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd" >
<http pattern ="/css/**" security ="none" > </http >
<http pattern ="/img/**" security ="none" > </http >
<http pattern ="/js/**" security ="none" > </http >
<http pattern ="/plugins/**" security ="none" > </http >
<http pattern ="/fonts/**" security ="none" > </http >
<http pattern ="/register.html*" security ="none" > </http >
<http pattern ="/user/add.do*" security ="none" > </http >
<http pattern ="/user/sendCode.do*" security ="none" > </http >
<http use-expressions ="false" entry-point-ref ="casProcessingFilterEntryPoint" >
<intercept-url pattern ="/**" access ="ROLE_USER" />
<csrf disabled ="true" />
<custom-filter ref ="casAuthenticationFilter" position ="CAS_FILTER" />
<custom-filter ref ="requestSingleLogoutFilter" before ="LOGOUT_FILTER" />
<custom-filter ref ="singleLogoutFilter" before ="CAS_FILTER" />
</http >
<beans:bean id ="casProcessingFilterEntryPoint" class ="org.springframework.security.cas.web.CasAuthenticationEntryPoint" >
<beans:property name ="loginUrl" value ="http://localhost:9100/cas/login" />
<beans:property name ="serviceProperties" ref ="serviceProperties" />
</beans:bean >
<beans:bean id ="serviceProperties" class ="org.springframework.security.cas.ServiceProperties" >
<beans:property name ="service" value ="http://localhost:9106/login/cas" />
</beans:bean >
<beans:bean id ="casAuthenticationFilter" class ="org.springframework.security.cas.web.CasAuthenticationFilter" >
<beans:property name ="authenticationManager" ref ="authenticationManager" />
</beans:bean >
<authentication-manager alias ="authenticationManager" >
<authentication-provider ref ="casAuthenticationProvider" >
</authentication-provider >
</authentication-manager >
<beans:bean id ="casAuthenticationProvider" class ="org.springframework.security.cas.authentication.CasAuthenticationProvider" >
<beans:property name ="authenticationUserDetailsService" >
<beans:bean class ="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper" >
<beans:constructor-arg ref ="userDetailsService" />
</beans:bean >
</beans:property >
<beans:property name ="serviceProperties" ref ="serviceProperties" />
<beans:property name ="ticketValidator" >
<beans:bean class ="org.jasig.cas.client.validation.Cas20ServiceTicketValidator" >
<beans:constructor-arg index ="0" value ="http://localhost:9100/cas" />
</beans:bean >
</beans:property >
<beans:property name ="key" value ="an_id_for_this_auth_provider_only" />
</beans:bean >
<beans:bean id ="userDetailsService" class ="com.pinyougou.user.service.UserDetailServiceImpl" />
<beans:bean id ="singleLogoutFilter" class ="org.jasig.cas.client.session.SingleSignOutFilter" />
<beans:bean id ="requestSingleLogoutFilter" class ="org.springframework.security.web.authentication.logout.LogoutFilter" >
<beans:constructor-arg value ="http://localhost:9100/cas/logout?service=http://localhost:9003" />
<beans:constructor-arg >
<beans:bean class ="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
</beans:constructor-arg >
<beans:property name ="filterProcessesUrl" value ="/logout/cas" />
</beans:bean >
</beans:beans >