Single sign-on (3) | JIRA installation and JIRA integration CAS practice

Author: Adon
micro-channel public number: IT's Jiege trip (ID: Jake_Internet)

Introduction to JIRA
Jira is a business management software produced by atlassian. Whether it is a requirement, a BUG, ​​or a task, it is a type of business, so JIRA can perform many roles: requirements management, defect tracking, task management, etc.

Jira provides special scrum view and kanban view, so it is suitable for agile development team.

Tool basic concept
problem: Different organizations use jira to track different problems. Jira's project is customized according to the corporate organization and is a collection of problems.
Module: A project module is a logical collection of problems in the project. Each project can set up multiple modules according to the requirements of the enterprise organization.
For example: a software development project can set up modules such as "document", "mail system", and "user interface".

Version: For some project types, especially software development projects, the version of the product associated with the problem is very useful.
Two types of version information can be set for one question.
Affected version ---- It can clearly reflect in which version the problem has an error.
For example: a software defect may affect 1.1 and 1.2 of the product

Repaired version-----can reflect which version the reported problem will be in, or in which version it has been fixed.
For example: A software defect affects the 1.1 and 1.2 versions of the product. This defect has been fixed in version 2.0. Note that issues that have not been fixed will be classified as planning.
Versions can have 3 statuses: released, unreleased and archived
versions can be set to release dates, and jira will automatically highlight the versions that have not yet been released after the expiration date, and mark them with the "expired" sign.

Installation
environment:
Centos 7
Jdk-1.8
Mysql-5.6
Jira-7.8.1

View java version

# java -version

The installation of Mysql (yum)
installs mysql, which is the database, user name and password commonly corresponding to jira

yum install wget

Download mysql source

安装rpm包
# wget http://repo.mysql.com/mysql-community-release-el7-5.noarch.rpm

安装后，会得到两个mysql的yum的repo源
# rpm -ivh mysql-community-release-el7-5.noarch.rpm

安装mysql
# yum install mysql-server mysql-client

启动mysql
# systemctl enable mysqld
# systemctl start mysqld

重置mysql密码
# mysql -u root 
> use mysql;
> update user set password=password(‘new passed’) where user=’user_name’;
> flush privileges;
> create database jira default characher set utf8 collate utf8_bin;
> show databases;
> grant all on jira. To ‘jira’@’%’ indentified by ‘jirapasswd’;
> flush privileges;

Download and install jira to
view the linux system bitness

# genconf LONG_BIT
64

Jira download website
address: https://www.atlassian.com/software/jira/update

# wget https://product-downloads.atlassian.com/software/jira/downloads/atlassian-jira-software-7.8.1-x64.bin
# chmod 755 ./atlassian-jira-software-7.8.1-x64.bin
# ./atlassian-jira-software-7.8.1-x64.bin
Unpacking JRE ...
Starting Installer ...
This will install JIRA Software 7.4.1 on your computer.
OK [o, Enter], Cancel [c]
o                                                               # 按o安装
Choose the appropriate installation or upgrade option.
Please choose one of the following:
Express Install (use default settings) [1], Custom Install (recommended for advanced users) [2, Enter], Upgrade an existing JIRA installation [3]
2                                                               # 2 为自定义安装
Where should JIRA Software be installed?
[/opt/atlassian/jira]
/usr/local/atlassina/jira                                       # 自定义安装目录
Default location for JIRA Software data
[/var/atlassian/application-data/jira]
/usr/local/atlassina/jira_data                                  # 自定义数据目录
Configure which ports JIRA Software will use.
JIRA requires two TCP ports that are not being used by any other
applications on this machine. The HTTP port is where you will access JIRA
through your browser. The Control port is used to startup and shutdown JIRA.
Use default ports (HTTP: 8080, Control: 8005) - Recommended [1, Enter], Set custom value for HTTP and Control ports [2]
2                                                               # 2为自定义端口
HTTP Port Number
[8080]                                                          # 8080 为默认端口
8050                                                            # http连接端口
Control Port Number
[8005]
8040                                                            # 控制端口
JIRA can be run in the background.
You may choose to run JIRA as a service, which means it will start
automatically whenever the computer restarts.
Install JIRA as Service?
Yes [y, Enter], No [n]
y                                                               # 是否开机自启
Details on where JIRA Software will be installed and the settings that will be used.
Installation Directory: /usr/local/atlassina/jira 
Home Directory: /usr/local/atlassina/jira_data 
HTTP Port: 8050 
RMI Port: 8040 
Install as service: Yes 
Install [i, Enter], Exit [e]
i                                                               # 确认已选配置

Extracting files ...
Please wait a few moments while JIRA Software is configured.
Installation of JIRA Software 7.4.1 is complete
Start JIRA Software 7.4.1 now?
Yes [y, Enter], No [n]
y                                                               # 启动
Please wait a few moments while JIRA Software starts up.
Launching JIRA Software ...
Installation of JIRA Software 7.4.1 is complete
Your installation of JIRA Software 7.4.1 is now ready and can be accessed
via your browser.
JIRA Software 7.4.1 can be accessed at http://localhost:8050
Finishing installation ...

Modify the default port
Jira installed in the /opt/Atlassian/jira and /var/Atlassian/application-data/jira directories, and the port that jira listens to is 8080. The main configuration file of Jira is stored in the /opt/Atlassian/jira/conf/server.xml file.

# vim /opt/Atlassian/jira/conf/server.xml
# cd /opt/Atlassian/jira/bin
# ./start-jira.sh

To crack JIRA
, close jira first, copy the two files atlassian-extras-3.2.jar and mysql-connector-java-5.1.39-bin.jar in the cracked package to /opt/Atlassian/jira/Atlassian-jira/WEB- INF/lib directory

Atlassian-extras-3..2.jar is used to crack the jira system
Mysql-connectir-java to connect to the mysql database driver package

# cp mysql-connector-java-5.1.47.jar /opt/atlassian/jira/lib/
# cp ./atlassian-extras-3.2.jar /opt/atlassian/jira/atlassian-jira/WEB-INF/lib

You can also register on the official website for 30 days by using the registration code:
Register the official website: https://my.atlassian.com
or use the following address:
https://id.atlassian.com/signup?application=mac&continue=https:/ /my.atlassian.com After
logging in to the account, select New Evaluation License

Copy the key generated in the above figure to the page

Set up admin user

The installation is complete.

Jira integration cas
reference article: https://github.com/apereo/java-cas-client#atlassian-integration
download cas-client dependency package address: http://central.maven.org/maven2/org/jasig/cas /client/

Arrangement of ideas
The client implementation of Cas is realized by configuring the filters and listeners of cas on the client side, and is configured in the first place to monitor the session of the subsystem and receive commands sent by the cas server.
Jira has its own authentication mechanism for user login and logout. The login of Jira mainly relies on the authenticator com.atlassian.jira.security.login.JiraSeraphAuthenticator for authentication.
Then configure the client dependency of cas in the configuration file of jira and replace the entry. Jira's authenticator can realize the integration of cas. The official website of cas provides related jar packages and configuration instructions.

Main steps
1. Configure web.xml, you need to pay attention to the location of filters and listeners
2. Configure seraph-config.xml, set the jump address
3. Copy dependent packages to the jira directory, you need to pay attention to two packages The version must be consistent

Process
1. Configure web.xml

Need to configure filter and listener two configurations

# vim /opt/Atlassian/jira/Atlassian-jira/WEB-INF/web.xml
a.配置cas的过滤器
    <!-- CAS:START - JAVA Client Filters -->
    <filter>
         <filter-name>CasSingleSignOutFilter</filter-name>
         <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
    </filter>
    <filter>
         <filter-name>CasAuthenticationFilter</filter-name>
         <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
         <init-param>
              <param-name>casServerLoginUrl</param-name>
              <param-value>http://192.168.1.133:8080/cas/login</param-value>
         </init-param>
         <init-param>
              <param-name>serverName</param-name>
              <param-value>http://192.168.1.20:8080/</param-value>
         </init-param>
    </filter>
    <filter>
         <filter-name>CasValidationFilter</filter-name>
         <filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
         <init-param>
               <param-name>casServerUrlPrefix</param-name>
               <param-value>http://192.168.1.133:8080/cas/</param-value>
         </init-param>
         <init-param>
               <param-name>serverName</param-name>
               <param-value>http://192.168.1.20:8080/</param-value>
         </init-param>
         <init-param>
               <param-name>redirectAfterValidation</param-name>
               <param-value>true</param-value>
         </init-param>
    </filter>
<!-- CAS:END-->

<!-- CAS:START Java client filter mappings-->
    <filter-mapping>
          <filter-name>CasSingleSignOutFilter</filter-name>
          <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
          <filter-name>CasAuthenticationFilter</filter-name>
          <url-pattern>/*</url-pattern>
          <!--需要全匹配，不然就会直接可以访问到登录页面的问题-->
    </filter-mapping>
    <filter-mapping>
          <filter-name>CasValidationFilter</filter-name>
          <url-pattern>/*</url-pattern>
     </filter-mapping>
  <!--CAS:END-->
     <filter-mapping>
          <filter-name>login</filter-name>
          <url-pattern>/*</url-pattern>
          <dispatcher>REQUEST</dispatcher>
          <dispatcher>FORWARD</dispatcher>
     </filter-mapping>

Introduction to filter configuration

Filter mapping configuration instructions

Mapping must be configured on the login filter

b.配置监听器
<listener>
          <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
</listener>

The configuration of the
listener indicates that the listener needs to be configured above or below the paragraph DO NOT ADD ANY SERVLET CONTEXT LISTENERS.

2. Configure seraph-config.xml

Need to modify seraph-config.xml, change authorization to cas, and configure logout and login information

a. Configure login and logout information

# vim /opt/atlassian/jira/atlassian-jira/WEB-INF/classes/seraph-config.xml
-->
            <param-name>login.url</param-name>
            <param-value>http://192.168.1.133:8080/cas/login?service=${originalurl}</param-value>
<!--
            <param-value>/login.jsp?permissionViolation=true&amp;os_destination=${originalurl}&amp;page_caps=${pageCaps}&amp;user_role=${userRole}</param-value>
-->
            <!--<param-value>http://sso.mycompany.com/login?redirectTo=${originalurl}</param-value>-->
        </init-param>
        <init-param>
            <!--
              the URL to redirect to when the user explicitly clicks on a login link (rather than being redirected after
              trying to access a protected resource). Most of the time, this will be the same value as 'login.url'.
                - same properties as login.url above
            -->
            <param-name>link.login.url</param-name>
            <param-value>http://192.168.1.133:8080/cas/login?service=${originalurl}</param-value>

<!--
            <param-value>/login.jsp?os_destination=${originalurl}</param-value>
-->
            <!--<param-value>/secure/Dashboard.jspa?os_destination=${originalurl}</param-value>-->
            <!--<param-value>http://sso.mycompany.com/login?redirectTo=${originalurl}</param-value>-->
        </init-param>
        <init-param>
            <!-- URL for logging out.
                 - If relative, Seraph just redirects to this URL, which is responsible for calling Authenticator.logout().
                 - If absolute (eg. SSO applications), Seraph calls Authenticator.logout() and redirects to the URL
                 -->
            <param-name>logout.url</param-name>
            <param-value>http://192.168.1.133:8080/cas/logout</param-value>
            <!--<param-value>/secure/Logout!default.jspa</param-value>-->
            <!--<param-value>http://sso.mycompany.com/logout</param-value>-->
        </init-param>

Configure the authorization method of cas, note the original authentication method

3. Copy the cas dependency package

Copy the jar package that the cas client depends on (cas-client-core-3.3.3.jar, cas-client-integration-atlassian-3.3.3.jar) to /opt/atlassian/jira/Atlassian-jira/ WEB-INF/lib

#  cp cas-client-* /opt/atlassian/jira/atlassian-jira/WEB-INF/lib/

4. Restart the jira service

Start service

# /opt/Atlassian/jira/bin/start-jira.sh
关闭服务
# /opt/Atlassian/jira/bin/shutdown.sh
#查看日志
# tail -f /opt/Atlassian/jira/logs/Catalina.out

Possible problems
1.com.atlassian.plugin.osgi.container.OsgiContainerException: Cannot start plugin: com.atlassian.jira.plugins.jira-development-integration-plugin
Reason: The language pack problem exists when cracking Question
2. To
add services to casa for unauthenticated services , you also need to configure cas.serviceRegistry.initFromJson=true in ./tomcat/webapps/cas/WEB-INF/class/application.properties, so that cas can initialize data from json .

The
main steps for Confluence to integrate cas :
1. Configure the web.xml file, set the filter, and match
2. Configure seraph-config.xml, set access to cas information
3. Modify xwork.xml (this file exists in confluence-3.0. 1.jar), configure logout
4. Import the jar package for cas login
5. Restart the cas service
6. Login test

1. Configure web.xml

Edit web.xml to add filters and listeners

# vim /opt/Atlassian/confluence/confluence/confluence/WEB-INF/web.xml

Filter definition: behind all filters, configure the cas filter

<!—配置过滤器和cas以及本地服务的路径信息>
<!--CAS:START - Java Client Filters-->
    <filter>
        <filter-name>CasSingleSignOutFilter</filter-name>
        <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
    </filter>
    <filter>
        <filter-name>CasAuthenticationFilter</filter-name>
        <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
        <init-param>
            <param-name>casServerLoginUrl</param-name>
            <param-value>http://192.168.1.136:8080/cas/login</param-value>
        </init-param>
        <init-param>
            <param-name>serverName</param-name>
            <param-value>http://192.168.1.30:8090/</param-value>
        </init-param>
    </filter>
    <filter>
        <filter-name>CasValidationFilter</filter-name>
        <filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
        <init-param>
            <param-name>casServerUrlPrefix</param-name>
            <param-value>http://192.168.1.136:8080/cas/</param-value>
        </init-param>
        <init-param>
            <param-name>serverName</param-name>
            <param-value>http://192.168.1.30:8090/</param-value>
        </init-param>
    </filter>
<!--CAS:END-->

Filter matches, matches at login

<!-- End plugins 2.5 filter changes -->
    <!--CAS:START - Java Client Filter Mappings-->
    <filter-mapping>
         <filter-name>CasSingleSignOutFilter</filter-name>
         <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
         <filter-name>CasAuthenticationFilter</filter-name>
         <url-pattern>/login.action</url-pattern>
    </filter-mapping>
    <filter-mapping>
         <filter-name>CasValidationFilter</filter-name>
         <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!--CAS:END -->
    <filter-mapping>
        <filter-name>login</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>ERROR</dispatcher>
</filter-mapping>

Listener configuration address

Before all the listeners, configure the listeners, that is, after the Servlet Context Listeners (Executed on app startup/shutdown) paragraph, configure the listeners

<listener>
        <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
</listener>

2. Configure seraph-config.xml

Configure seraph-config.xml, set access to cas login information, and set the authorization information of confluence to cas

#  vim /opt/Atlassian/confluence/confluence/WEB-INF/classes/seraph-config,xml

Modify the default login configuration

<parameters>
        <init-param>
            <param-name>login.url</param-name>
          <!--  <param-value>/login.action?os_destination=${originalurl}&amp;permissionViolation=true</param-value>
                -->
            <param-value>http://192.168.1.136:8080/cas/login?service=${originalurl}</param-value>
        </init-param>
        <init-param>
            <param-name>link.login.url</param-name>
           <!-- <param-value>/login.action</param-value>-->
            <param-value>http://192.168.1.136:8080/cas/login?service=${originalurl}</param-value>
        </init-param>
        <init-param>
设定授权信息
   <!-- Default Confluence authenticator, which uses the configured user management for authentication. -->
  <!--  <authenticator class="com.atlassian.confluence.user.ConfluenceAuthenticator"/>-->
    <authenticator class="org.jasig.cas.client.integration.atlassian.ConfluenceCasAuthenticator"/>

3. Configure logout

To get the xwork.xml file, you need to get the confluence-6.9.0.jar file from the lib directory, and copy the jar package to a directory for decompression

#```
cp /opt/Atlassian/confluence/confluence/WEB-INF/lib/confluence-6.9.0.jar /home/ceshi/

yum install -y unzip

unzip confluence-6.9.0.jar -d /home/ceshi/confluence

Copy the obtained xwork.xml file to the /opt/Atlassian/confluence/confluence/WEB-INF/classes directory

cp /home/ceshi/confluence/xwork.xml /opt/Atlassian/confluence/confluence/WEB-INF/classes/xwork.xml

vim /opt/Atlassian/confluence/confluence/WEB-INF/classes/xwork.xml

设定退出重定向到cas服务器上

<action name="logout" class="com.atlassian.confluence.user.actions.LogoutAction">
<interceptor-ref name="defaultStack"/>
<!-- <result name="error" type="velocity">/logout.vm</result>-->
<result name="success" type="redirect">http://192.168.1.136:8080/cas/logout</result>;
</action>

![](https://s4.51cto.com/images/blog/202101/25/971ab3b78f039b56a04b5566e38f0be0.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=)

**4.添加jar包**

添加的jar包为csa-client-core-3.3.3.jar和cas-client-integration-atlassian-3.5.0.jar，貌似版本不同不会报错

# cp ./cas-client* /opt/Atlassian/confluence/confluence/WEB-INF/lib/

**5.重启confluence服务**

# /opt/Atlassian/confluence/bin/stop-confluence.sh
# /opt/Atlassian/confluence.bin/start-confluence.sh
6.登录测试