CAS单点登录(四）CAS 客户端与 SpringSecurity

4.1 Spring Security 测试工程搭建

（1）建立 Maven 项目 casclient_demo3 ，引入 spring 依赖和 spring secrity 相关依赖 ，tomcat
端口设置为 9003
（2）建立 web.xml ,添加过滤器等配置
（3）创建配置文件 spring-security.xml
（4）添加 html 页面

4.2 Spring Security 与 CAS 集成

（1）引入依赖

<!-- spring security 安全认证 -->
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
        </dependency>

        <!-- cas 单点登录 -->
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-cas</artifactId>
        </dependency>

        <dependency>
            <groupId>org.jasig.cas.client</groupId>
            <artifactId>cas-client-core</artifactId>
            <version>3.3.3</version>
            <exclusions>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>log4j-over-slf4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

（2）修改 spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security.xsd">

    <!-- 一,不需要权限认证的静态资源需要放行 -->
    <http pattern="/css/**" security="none"></http>
    <http pattern="/js/**" security="none"></http>
    <http pattern="/fonts/**" security="none"></http>
    <http pattern="/data/**" security="none"></http>
    <http pattern="/img/**" security="none"></http>
    <http pattern="/plugins/**" security="none"></http>
    <http pattern="/register.html" security="none"></http>
    <http pattern="/user/createSmsCode" security="none"></http>
    <http pattern="/user/register" security="none"></http>

    <!-- entry-point-ref 入口点引用 -->
    <http use-expressions="false" entry-point-ref="casProcessingFilterEntryPoint">
        <intercept-url pattern="/**" access="ROLE_USER" />
        <csrf disabled="true" />
        <!-- custom-filter 为过滤器， position 表示将过滤器放在指定的位置上，before 表示放 在指定位置之前 ，after 
            表示放在指定的位置之后 -->
        <custom-filter ref="casAuthenticationFilter" position="CAS_FILTER" />
        <custom-filter ref="requestSingleLogoutFilter" before="LOGOUT_FILTER" />
        <custom-filter ref="singleLogoutFilter" before="CAS_FILTER" />
    </http>


    <!-- CAS 入口点 开始 -->
    <beans:bean id="casProcessingFilterEntryPoint"
        class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
        <!-- 单点登录服务器登录 URL -->
        <beans:property name="loginUrl" value="http://192.168.11.11:9100/cas/login" />
        <beans:property name="serviceProperties" ref="serviceProperties" />
    </beans:bean>

    <beans:bean id="serviceProperties"
        class="org.springframework.security.cas.ServiceProperties">
        <!--service 配置自身工程的根地址+/login/cas -->
        <beans:property name="service" value="http://localhost:8084/login/cas" />
    </beans:bean>

    <!-- CAS 入口点 结束 -->
    <!-- 认证过滤器 开始 -->
    <beans:bean id="casAuthenticationFilter"
        class="org.springframework.security.cas.web.CasAuthenticationFilter">
        <beans:property name="authenticationManager" ref="authenticationManager" />
    </beans:bean>

    <!-- 认证管理器 -->
    <authentication-manager alias="authenticationManager">
        <authentication-provider ref="casAuthenticationProvider">
        </authentication-provider>
    </authentication-manager>

    <!-- 认证提供者 -->
    <beans:bean id="casAuthenticationProvider"
        class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
        <beans:property name="authenticationUserDetailsService">
            <beans:bean
                class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
                <beans:constructor-arg ref="userDetailsService" />
            </beans:bean>
        </beans:property>
        <beans:property name="serviceProperties" ref="serviceProperties" />
        <!-- ticketValidator 为票据验证器 -->
        <beans:property name="ticketValidator">
            <beans:bean
                class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
                <beans:constructor-arg index="0"
                    value="http://192.168.25.132:9100/cas" />
            </beans:bean>
        </beans:property>
        <beans:property name="key"
            value="an_id_for_this_auth_provider_only" />
    </beans:bean>



    <!-- 认证类 -->
    <beans:bean id="userDetailsService"
        class="com.pyg.user.service.impl.UserDetailServiceImpl" />


    <!-- 认证过滤器 结束 -->
    <!-- 单点登出 开始 -->
    <beans:bean id="singleLogoutFilter"
        class="org.jasig.cas.client.session.SingleSignOutFilter" />
    <beans:bean id="requestSingleLogoutFilter"
        class="org.springframework.security.web.authentication.logout.LogoutFilter">
        <beans:constructor-arg
            value="http://192.168.25.132:9100/cas/logout?service=http://localhost:8084" />
        <beans:constructor-arg>
            <beans:bean
                class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
        </beans:constructor-arg>
        <beans:property name="filterProcessesUrl" value="/logout/cas" />
    </beans:bean>

    <!-- 单点登出 结束 -->
</beans:beans>

（3）创建 UserDetailsServiceImpl

package com.pyg.user.service.impl;

import java.util.ArrayList;
import java.util.List;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

public class UserDetailServiceImpl implements UserDetailsService {

    @Override
    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException {
        // 进行角色认证
        List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
        authorities.add(new SimpleGrantedAuthority("ROLE_USER"));

        return new User(username, "", authorities);
    }

}

这个类的主要作用是在登陆后得到用户名，可以根据用户名查询角色或执行一些逻辑。

4.3 获取登录名

我们在处理后端逻辑需要获得登录名，那么如何获取单点登录的用户名呢? 其实和我们之前
获得用户名的方式是完全相同的，我们下面来做个测试。

（1）web.xml 添加 springmvc 和Security过滤器链

<!-- 前端控制器 -->
    <servlet>
        <servlet-name>springmvc</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>classpath:spring/*.xml</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>

    </servlet>

    <servlet-mapping>
        <servlet-name>springmvc</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

    <!-- spring Security 安全认证 监听器,过滤器链在web中注册 -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

（2）创建 springmvc.xml

<context:component-scan base-package="cn.itcast.demo" />
<mvc:annotation-driven />

（3）创建 UserController

@RestController
public class UserController {
    @RequestMapping("/findLoginUser")
    public void findLoginUser(){
        String name =
        SecurityContextHolder.getContext().getAuthentication().getName();
        System.out.println(name);
    } 
}

地址栏输入 http://localhost:9003/findLoginUser 即可在控制台看到输出的登录名。

在页面上添加链接

<a href="/logout/cas">退出登录</a>

创建 index2.html,将 index2.html 设置为可匿名访问

<http pattern="/index2.html" security="none"></http>