cas+shiro子系统ST不符合目标服务的原因

版权声明：本文为博主原创文章，未经博主允许不得转载。 https://blog.csdn.net/yushenzaishi/article/details/80484395

在出现这和错误之后，首先思考一下为什么会出现这个错误。

ST不符合目标服务，说明在访问子系统的时候，cas server已经生成了service ticket给这个系统，当客户端拿着这张ST去服务端校验的时候除了问题。但是这张ST是server给你的，为什么在拿去校验的时候为什么会不符合目标服务呢，应该就是client配置子系统路径出现问题了，和实际的部署访问路径不一样。

<filter-name>CAS Authentication Filter</filter-name>
	<filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
	<init-param>
	<param-name>casServerLoginUrl</param-name>
	<param-value>http://localhost:8081/cas/login</param-value>
	</init-param>
	<context-param>
	<param-name>renew</param-name>
	<param-value>false</param-value>
	</context-param>
	<init-param>
	<param-name>gateway</param-name>
	<param-value>false</param-value>
	</init-param>
	<init-param>
	<param-name>serverName</param-name>
	<param-value>http://localhost:8888</param-value>
	</init-param>
	<init-param>
	<param-name>ignorePattern</param-name>
	<param-value>/statistic/*|/static/*|/js/*|/img/*|/views/*|/css/*|webservice/*|/cas/changeCenter/*</param-value>
	</init-param>
	</filter>

	<filter>
	<filter-name>CAS Validation Filter</filter-name>
	<filter-class>
	org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter
	</filter-class>
	<init-param>
	<param-name>casServerUrlPrefix</param-name>
	<param-value>http://localhost:8081/cas</param-value>
	</init-param>
	<init-param>
	<param-name>serverName</param-name>
	<param-value>http://localhost:8888</param-value>
	</init-param>
	<init-param>
	<param-name>useSession</param-name>
	<param-value>true</param-value>
	</init-param>
	<init-param>
	<param-name>redirectAfterValidation</param-name>
	<param-value>true</param-value>
	</init-param>
	<init-param>
	<param-name>encoding</param-name>
	<param-value>UTF-8</param-value>
	</init-param>
	</filter>

检查一下ServerName这个属性的路径有没有配置错。

当排除了这个问题之后，重启访问之后发现还是会出现和之前同样的问题，到底是哪里出错了呢。不要忘记这不仅仅就是个cas，是cas+shiro结合的，两者在子系统的web.xml中的配置顺序是有顺序的，顺序不对的话，会导致访问和登出的错误。

这个顺序就是cas的配置要在shiro的配置之前，但只是登出监听器和过滤器的那一部分，还有shiro的配置要在servlet的配置之前。

<!-- 该过滤器用于实现单点登出功能，可选配置。 -->
	 <listener>
	<listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
	</listener>
	<filter>
	<filter-name>CAS Single Sign Out Filter</filter-name>
	<filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
	<init-param>
	<param-name>casServerUrlPrefix</param-name>
	<param-value>http://localhost:8081/cas/</param-value>
	</init-param>
	</filter>
	<filter-mapping>
	<filter-name>CAS Single Sign Out Filter</filter-name>
	<url-pattern>/*</url-pattern>
	</filter-mapping> 

	<!-- Apache Shiro -->
	<filter>
		<filter-name>shiroFilter</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
		<init-param>
			<param-name>targetFilterLifecycle</param-name>
			<param-value>true</param-value>
		</init-param>
	</filter>
	<filter-mapping>
		<filter-name>shiroFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
<!-- MVC Servlet -->
	<servlet>
		<servlet-name>springServlet</servlet-name>
		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
		<init-param>
			<param-name>contextConfigLocation</param-name>
			<param-value>classpath*:/spring-mvc*.xml</param-value>
		</init-param>
		<load-on-startup>1</load-on-startup>
	</servlet>
	<servlet-mapping>
		<servlet-name>springServlet</servlet-name>
		<url-pattern>/</url-pattern>
	</servlet-mapping>
<!--CAS SSO-->
	<filter>
	<filter-name>CAS Authentication Filter</filter-name>
	<filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
	<init-param>
	<param-name>casServerLoginUrl</param-name>
	<param-value>http://localhost:8081/cas/login</param-value>
	</init-param>
	<context-param>
	<param-name>renew</param-name>
	<param-value>false</param-value>
	</context-param>
	<init-param>
	<param-name>gateway</param-name>
	<param-value>false</param-value>
	</init-param>
	<init-param>
	<param-name>serverName</param-name>
	<param-value>http://localhost:8888</param-value>
	</init-param>
	<init-param>
	<param-name>ignorePattern</param-name>
	<param-value>/statistic/*|/static/*|/js/*|/img/*|/views/*|/css/*|webservice/*|/cas/changeCenter/*</param-value>
	</init-param>
	</filter>

	<filter>
	<filter-name>CAS Validation Filter</filter-name>
	<filter-class>
	org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter
	</filter-class>
	<init-param>
	<param-name>casServerUrlPrefix</param-name>
	<param-value>http://localhost:8081/cas</param-value>
	</init-param>
	<init-param>
	<param-name>serverName</param-name>
	<param-value>http://localhost:8888</param-value>
	</init-param>
	<init-param>
	<param-name>useSession</param-name>
	<param-value>true</param-value>
	</init-param>
	<init-param>
	<param-name>redirectAfterValidation</param-name>
	<param-value>true</param-value>
	</init-param>
	<init-param>
	<param-name>encoding</param-name>
	<param-value>UTF-8</param-value>
	</init-param>
	</filter>

	<filter>
	<filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
	<filter-class>
	org.jasig.cas.client.util.HttpServletRequestWrapperFilter
	</filter-class>
	</filter>
	<filter>
	<filter-name>CAS Assertion Thread Local Filter</filter-name>
	<filter-class>
	org.jasig.cas.client.util.AssertionThreadLocalFilter
	</filter-class>
	</filter>
	<filter-mapping>
	<filter-name>CAS Authentication Filter</filter-name>
	<url-pattern>/*</url-pattern>
	</filter-mapping>
	<filter-mapping>
	<filter-name>CAS Validation Filter</filter-name>
	<url-pattern>/*</url-pattern>
	</filter-mapping>
	<filter-mapping>
	<filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
	<url-pattern>/*</url-pattern>
	</filter-mapping>
	<filter-mapping>
	<filter-name>CAS Assertion Thread Local Filter</filter-name>
	<url-pattern>/*</url-pattern>
	</filter-mapping>

这才是系统集成cas+shiro实现单点登录 在web.xml中正确的配置顺序。

在确保以上两点没有问题之后，这个问题基本上就解决了。