CAS之5.2x版本之客户端集成（传统web项目）-yellowcong

将Cas继承到传统的web项目中，我使用的是maven构建的，如果有想直接使用jar来搞的，也可以。我也会给大家提供。搭建的步骤：1、导入证书到jdk中客户端和服务端的证书要一致，不然就会证书错误，我自己就被坑哭了。2、配置pom.xml，导入需要引入的包。3、配置web.xml、4、获取返回参数，5、配置服务端servers文件夹，让服务端可以接入我们的cas请求。(ps:注意，大家都应该知道这个域名是通过修改

C:\Windows\System32\drivers\etc\hosts

文件的到的。)

项目地址

https://gitee.com/yellowcong/springboot_cas/tree/master/cas-client-maven

目录结构

系统架构

节点ip	功能
yellowcong.com:9000	cas服务器
yellowcong.com:8080	客户端(springmvc)

客户端配置

1、导入证书

需要知道，证书的别名，证书的密码,必须保证客户端证书和服务端证书是同一个证书，不然就会报错

#将证书导入到jdk的目录
keytool -import -trustcacerts -alias tomcat -file D:/tomcat.cer -keystore "D:/Program Files/Java/jdk1.8.0_151/jre/lib/security/cacerts"

导入证书到jdk,输入确认命令的时候，是y不是yes



导入成功后

2、配置pom.xml

这个pom.xml配置中，需要导入cas的客户端，我这个地方采用的3.5.0的客户端.

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> <modelVersion>4.0.0</modelVersion>
<groupId>com.yellowcong</groupId>
<artifactId>cas-client-maven</artifactId>
<packaging>war</packaging>
<version>0.0.1-SNAPSHOT</version>
<name>cas-client-maven Maven Webapp</name>
<url>http://maven.apache.org</url>

<properties>
<jackson-2-version>2.4.2</jackson-2-version>
<cas.version>5.2.0</cas.version>
<java.version>1.8</java.version>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<maven.compiler.source>1.8</maven.compiler.source>
<maven.compiler.target>1.8</maven.compiler.target>
<spring.version>4.3.14.RELEASE</spring.version>
<junit.version>4.12</junit.version>
<servlet.version>3.1.0</servlet.version>
<java.cas.client.version>3.5.0</java.cas.client.version>
</properties>
<dependencies>

<!-- Junit -->
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>${junit.version}</version>
<scope>test</scope>
</dependency>
<!--Servlet-Api -->
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
<version>${servlet.version}</version>
</dependency>
<!-- Spring Framework -->
<!-- Spring  BEGIN-->
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-core</artifactId>
<version>${spring.version}</version>
</dependency>

<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-context</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-beans</artifactId>
<version>${spring.version}</version>
</dependency>
<!-- 导入Spring的orm -->
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-orm</artifactId>
<version>${spring.version}</version>
</dependency>

<!-- Slf4j -->
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
<version>1.7.5</version>
</dependency>
<!-- 配置切面 -->
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-aop</artifactId>
<version>${spring.version}</version>
</dependency>
<!---aspectj 面向切向 -->
<dependency>
<groupId>aspectj</groupId>
<artifactId>aspectjrt</artifactId>
<version>1.5.3</version>
</dependency>
<dependency>
<groupId>org.aspectj</groupId>
<artifactId>aspectjweaver</artifactId>
<version>1.8.5</version>
</dependency>
<!-- Spring需要的注解 -->
<dependency>
<groupId>javax.annotation</groupId>
<artifactId>javax.annotation-api</artifactId>
<version>1.2</version>
</dependency>

<!-- Spring 的测试类 -->
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-test</artifactId>
<version>${spring.version}</version>
</dependency>
<!-- Spring  END-->

<!-- 配置Spring mvc -->
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-webmvc</artifactId>
<version>${spring.version}</version>
</dependency>

<!-- 文件上传 -->
<dependency>
<groupId>commons-fileupload</groupId>
<artifactId>commons-fileupload</artifactId>
<version>1.2.2</version>
</dependency>

<!-- 结尾 -->

<!--cas的客户端 -->
<dependency>
<groupId>org.jasig.cas.client</groupId>
<artifactId>cas-client-core</artifactId>
<version>${java.cas.client.version}</version>
</dependency>
</dependencies>
<build>
<finalName>cas-client-maven</finalName>

<plugins>
<plugin>
<artifactId>maven-compiler-plugin</artifactId>
<version>2.3.2</version>
<configuration>
<source>${maven.compiler.source}</source>
<target>${maven.compiler.target}</target>
<encoding>UTF-8</encoding>
</configuration>
</plugin>
</plugins>
</build>
</project>

3、配置web.xml

配置web.xml,只是简单的将所有 的请求拦截了，都需要经过cas登录，才可以访问自己的系统。xx

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://java.sun.com/xml/ns/javaee"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
<display-name>基于cas3.5.0 搭建的客户端</display-name>

<!-- 配置springmvc的监听器 -->
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!-- springmvc 的配置信息 -->
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:spring.xml</param-value>
</context-param>

<!-- 配置单点登出监听器 -->
<listener>
<listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
</listener>

<!-- 单点登录的过滤器 -->
<filter>
<filter-name>CAS Single Sign Out Filter</filter-name>
<filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
<!-- 配置单点登录的地址 -->
<init-param>
<param-name>casServerUrlPrefix</param-name>
<param-value>https://yellowcong.com:9000</param-value>
</init-param>
</filter>
<!-- 单点登录验证过滤器 -->
<filter>
<filter-name>CAS Validation Filter</filter-name>
<filter-class>org.jasig.cas.client.validation.Cas30ProxyReceivingTicketValidationFilter</filter-class>
<!-- 配置单点登录的地址 -->
<init-param>
<param-name>casServerUrlPrefix</param-name>
<param-value>https://yellowcong.com:9000</param-value>
</init-param>
<!-- 这个服务的地址 -->
<init-param>
<param-name>serverName</param-name>
<param-value>http://yellowcong.com:8080/cas-client-maven</param-value>
</init-param>
<init-param>
<param-name>useSession</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter>
<filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
<filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
</filter>
<filter>
<filter-name>CAS Authentication Filter</filter-name>
<filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
<!-- 配置单点登录的地址 -->
<init-param>
<param-name>casServerLoginUrl</param-name>
<param-value>https://yellowcong.com:9000</param-value>
</init-param>
<!-- 这个服务的地址 -->
<init-param>
<param-name>serverName</param-name>
<param-value>http://yellowcong.com:8080/cas-client-maven</param-value>
</init-param>
</filter>

<!-- 登录验证器 -->
<filter-mapping>
<filter-name>CAS Single Sign Out Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- 验证过滤器 -->
<filter-mapping>
<filter-name>CAS Validation Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- 授权过滤器 -->
<filter-mapping>
<filter-name>CAS Authentication Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

<!-- 配置springmvc的过滤器 ,过滤器都配置到后面，这样好搞事情啊，你说呢-->
<servlet>
<servlet-name>spring-mvc</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<description>spring mvc 配置文件</description>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:spring-mvc.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>spring-mvc</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
</web-app>

4、返回界面的首页

index.jsp

<%@ page import="org.jasig.cas.client.authentication.AttributePrincipal" %>
<%@ page import="java.util.Map" %>
<%@ page import="java.util.Iterator" %>
<%@ page import="java.util.List" %>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
<title>index</title>
</head>
<body>
<b>Authenticated User Id:</b> <a href="logout.jsp" title="Click here to log out"><%= request.getRemoteUser() %>
</a></p>

<%
if (request.getUserPrincipal() != null) {
AttributePrincipal principal = (AttributePrincipal) request.getUserPrincipal();

final Map attributes = principal.getAttributes();

if (attributes != null) {
Iterator attributeNames = attributes.keySet().iterator();
out.println("<b>Attributes:</b>");

if (attributeNames.hasNext()) {
out.println("<hr><table border='3pt' width='100%'>");
out.println("<th colspan='2'>Attributes</th>");
out.println("<tr><td><b>Key</b></td><td><b>Value</b></td></tr>");

for (; attributeNames.hasNext(); ) {
out.println("<tr><td>");
String attributeName = (String) attributeNames.next();
out.println(attributeName);
out.println("</td><td>");
final Object attributeValue = attributes.get(attributeName);

if (attributeValue instanceof List) {
final List values = (List) attributeValue;
out.println("<strong>Multi-valued attribute: " + values.size() + "</strong>");
out.println("<ul>");
for (Object value : values) {
out.println("<li>" + value + "</li>");
}
out.println("</ul>");
} else {
out.println(attributeValue);
}
out.println("</td></tr>");
}
out.println("</table>");
} else {
out.print("No attributes are supplied by the CAS server.</p>");
}
} else {
out.println("<pre>The attribute map is empty. Review your CAS filter configurations.</pre>");
}
} else {
out.println("<pre>The user principal is empty from the request object. Review the wrapper filter configuration.</pre>");
}
%>
</body>
</html>

服务端配置

我cas服务端，不能莫名奇妙啥单都接吧，所以我也需要配置一下，设定俺可以接收你的请求。id是在cas服务器上，全局唯一的，还有第二个就是theme主题，这个如果不指定，就会走cas默认的。

{
"@class" : "org.apereo.cas.services.RegexRegisteredService",
"serviceId" : "^(https|imaps|http)://yellowcong.*",
"name" : "yellowcong",
"id" : 1000,
"description" : "yellowcong项目访问过来，跳转到demo主题",
"evaluationOrder" : 1,
"theme": "yellowcong"
}

测试

登录地址：http://yellowcong.com:8080/cas-client-maven

cas服务地址：https://yellowcong.com:9000/

服务返回地址：http://yellowcong.com:8080/cas-client-maven/

错误集合

java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed:

导致这个问题的原因就是，客户端，没有导入证书，报的错，客户端的jdk，也是需要导入证书的,而且必须和服务端的证书一致。

java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:403)
org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:41)
org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:193)
org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:204)
org.jasig.cas.client.session.SingleSignOutFilter.doFilter(SingleSignOutFilter.java:97)
org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:88)
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)

配置jdk，添加证书配置

#将证书导入到jdk的目录
#
keytool -import -trustcacerts -alias tomcat -file D:/tomcat.cer -keystore "D:/Program Files/Java/jdk1.8.0_151/jre/lib/security/cacerts"

Error: org.apereo.cas.services.RegisteredServiceAccessStrategyUtils.ensurePrincipalAccessIsAllowedForService(Lorg/apereo/cas/authentication/principal/Service;Lorg/apereo/cas/services/RegisteredService;Lorg/apereo/cas/ticket/TicketGrantingTicket;)V

这个问题，我把证书导入到jdk后，就没问题了。证书真的很重要，我被坑了，家里和公司两套证书，证书不一致，导致死活起不动。。。。。