CAS client server-side configuration steps

From my personal website: http://lkf.22web.org/

CAS Introduction:

CAS is an open source project launched by Yale University, designed to provide a reliable single sign-on approach to WEB applications, and CAS became a Ja-sig project in December 2004. CAS has the following characteristics:

• Open source enterprise-level Single sign-on solution.
• CAS Server is a Web app that needs to be deployed independently.
• Supports a very wide range of clients (this refers to individual WEB applications in a single sign-on system), including Java,. Net, PHP, Perl, Apache, uportal, Ruby, etc.

CAS Principles and protocols

Structurally, CAs consists of two parts: CAs Server and CAS Client. CAS server needs to be deployed independently, primarily responsible for authenticating users; The CAS client handles access requests to client-protected resources and redirects to CAS server when it needs to log on. Figure 1 is the most basic protocol process for CAS:
Figure 1. CAS Foundation Protocol

The CAS client is deployed together with protected client applications to protect protected resources in a Filter manner. For each WEB request that accesses a protected resource, CAS Client parses the request for a Service Ticket in the Http request, and if not, redirects the request to the specified CAS Server login address and passes the Serv Ice (that is, the address of the destination resource to be accessed) so that the login succeeds and turns back to that address. The user enters the authentication information in the 3rd step, if the login succeeds, CAS Server randomly generates a fairly long, unique, non-counterfeit Service Ticket, and caches it for future verification, then the system automatically redirects to the address of the Service and sets a Ticket granted Cookie (TGC), CAs Client is properly identified with CAs Server in 5th, 6 steps after receiving service and newly generated Ticket to ensure the legality of service Ticket.

In this protocol, all interactions with CAS are SSL-based, ensuring the security of ST and TGC. There are 2 redirects during the protocol work process, but the process of Ticket authentication between CAs Client and CAS Server is transparent to the user.

In addition, the CAS protocol provides proxy mode to accommodate more advanced and complex application scenarios, with reference to the relevant documents on the CAS official website.

CAS server-side configuration Configuration Server environment

Download the necessary software first:

tomcat6.0:http://tomcat.apache.org/download-60.cgi
Windows Service Installer

jdk:http://java.sun.com/javase/downloads/index.jsp
you can choose to have the JRE installation file or you have a JRE in your machine now. the environment only needs to download the JDK.
Java SE 6 Update Beta ( without JRE)
JDK 6 Update 6 ( with JRE)
Java Runtime Environment (JRE) 6 Update 6 (JRE)
Follow the steps below to:
1. Installing the JDK and JRE
Keep the next step until the installation is complete, remembering the path to the JDK installation.

2. Setting JDK-related environment variables
1). Switch to the desktop, right-click on the "My Computer", properties, advanced---Create a Java_home environment variable with the value of the JDK root directory.

2). With the same operation as above, set the environment variable CLASSPATH, the value is ".; %java_home%\lib;%java_home%\lib\tools.jar;%java_home%\jre\lib\rt.jar "

3). Or manipulate environment variables but not new, but edit. Edit the Path variable, the most variable value is appended;%java_home%\bin;

3. Install Tomcat
1). Always next, you need to select the installation path and JVM directory, if the JDK and JRE installation is not a problem, here he should be able to automatically find, otherwise you need to specify manually. There is nothing in the middle of the tube, there is a let you set the port, do not move, keep the default on the line.

2). Add a catalina_home environment variable with the value of the root directory of your Tomcat installation.

3. Test the running server

There are several files in the bin directory after installation:
Bootstrap.jar
Tomcat-juli.jar
Tomcat6.exe
Tomcat6w.exe
Where Tomcat6w.exe is monitoring tomcat running, it can be run directly, or zoom out to the lower right corner of the screen to become a small icon.
Directly run Tomcat6w.exe or "tomcat6w//es//" can enter the Monitoring Configuration window;
or run "tomcat6w//ms//" to narrow it down to the lower right corner.

You can also use Startup.bat and Shutdown.bat to start and close services.
Web Access Testing
Once started, it can be accessed through a browser and the test runs properly.
Use IE or Firefox and other browsers, enter the address:
http://localhost:8080/– if the port is modified during installation, replace the 8080 with the modified value.
If you can browse to the Tomcat welcome message, it is correct, or check that the installation is correct, firewall settings and so on.
One frequently encountered problem is port conflicts, the most common is the 80 port is occupied, causing the service to not start properly. If you start with Tomcat6//ts//tomcat6, you will immediately be able to find the prompt message. Modify the port in the Tomcat6\conf\server.xml to resolve it.

Typically, 80 ports are used:
1. IIS server, because IIS is installed on many Windows servers, and IIS is the default port of 80.
2. The Skype Instant Chat tool, Skype's ability to penetrate firewalls, is also implemented by using 80 ports.

To view the commands occupied by the port:
Enter the Windows command line and enter:
Netstat-an
This command returns 4 columns: protocol, local address, foreign address, status
Browse to the local address column, you can see the current host external service IP address, the port has.
If a machine has a 192.168.1.100 and 192.168.1.101 two addresses, then:
0.0.0.0:80 means that all 80 ports on this machine are used
127.0.0.1:80 indicates that 80 of 127.0.0.1 is used, but 80 of. 100 and. 101IP addresses are not yet in use.
192.168.1.100:80.80 port of the 100IP address is used
192.168.1.101:80.80 port of the 101IP address is used

Deploying CAS Server

CAS server is a Java-based implementation of a service that is deployed separately on a servlet2.3-compatible Web server with a Java Web application, and because the interaction between Client and CAS server uses H TTPS protocol, the server that deploys CAS server also needs to support the SSL protocol. When the SSL configuration succeeds, the CAS server is deployed on the server just like a normal Web app, but before you can actually use it, you need to extend the authentication user's interface.

Tomcat Configuration HTTPS mode

1. Start-〉 run-〉cmd into the bin directory under JDK

2. Enter the following instruction

Keytool-v-genkey-alias tomcat-keyalg rsa-keystore d:/tomcat.keystore-validity 36500

Report:

D:/tomcat.keystore is to place the generated tomcat.keystore under the D-Packing directory.

"-validity 36500" means the certificate validity period, 36500 means 100 years, the default value is 90 days

Note to place the C drive, under the Win7 system, you need to go to the command line as an administrator, otherwise you cannot create tomcat.keystore. This example is placed under the D disk.
How do I get to the command line as an administrator? Start-to-search box, enter cmd-> Wait (note do not enter), and cmd.exe-> right-click "Run as Administrator".

3. Enter KeyStore password

Password arbitrary, this is the case of 123456, to remember this password, and then in the Server.xml configuration to use.

4, enter the name, organizational unit, organization, city, province, country and other information

Precautions:

A, enter KeyStore password: A string greater than 6 characters is required here

B, "What's your first and last name?" This is required and must be the domain name of the Tomcat deployment host or ip[such as: Gbcom.com or 10.1.25.251], which is the access address you will enter in the browser

C, "What is the name of your organizational unit?", "What is the name of your organization?", "What's the name of the Your city Or Locality?, "What's the name of your state or province?", "What's the Two-letter country code for this unit?" Can fill in as required or can not fill in the direct return, the system asked "correct?" , enter the letter "Y" with the keyboard if required, otherwise enter "n" to re-fill the information above.

D, enter key password for <TOMCAT>, this is more important, will be used in the Tomcat configuration file, it is recommended to enter the same password as the KeyStore, the other password can be set

After completing the above input, the direct carriage return will find the generated file in the location you defined in the second step

5, after the input will appear the confirmation prompt

Enter Y at this time, and enter. The complete KeyStore is created at this time.
Enter into the D-packing directory to see the generated tomcat.xml

6. Enter the Tomcat folder
Find the Sever.xml in the Conf directory and edit it

7. Editing
<connector port= "8443″protocol=" http/1.1″sslenabled= "true"
maxthreads= "150″scheme=" https "secure=" true "
Clientauth= "false" keystorefile= "D:/appserver/tomcat/apache-tomcat-6.0.32/conf/tomcat.keystore"
keystorepass= "Deleiguo" sslprotocol= "TLS"/>
Note:
The KeyStore password in the box is the "123456" we just set.

Close and save Sever.xml when editing is complete

8. When Tomcat starts successfully, use https://127.0.0.1:8443 to access the page

The page was successfully opened and the HTTPS configuration under Tomcat was successful.

9. Precautions:

(1) When the certificate is generated, IE will prompt "The security certificate has expired or has not been in effect" if the IE client is on a machine that is older than the certificate effective time or later than the valid time.

(2) If IE prompts "the name on the security certificate is invalid or does not match the site name", it is the domain name of the host on which the server was filled when the certificate was generated "what is your first and last name?" "/" What's your first and last name? " caused by an incorrect

10, Legacy issues:

(1) If the AC host cannot be searched by the domain name, IP must be used, but this IP can only be determined after configuration, so that the certificate must be in the AC to determine the IP address to generate

(2) certificate file can only bind one IP address, fake with 10.1.25.250 and 192.168.1.250 two IP address, when the certificate generation file, such as using 10.1.25.250, through IE can only use 10.1.25.250来 Access Ac-web, 192.168.1.250 is unable to access Ac-web.

Configure CAs

1. Download CAs http://www.ja-sig.org/downloads/cas/cas-server-3.4.2-release.zip
2. To install Cas-server, we assume that the server installing Cas-server is Server1

(1) Unzip the cas-server-3.4.2-release.zip, copy the Moudels directory Cas-server-webapp-x.x.war to the WebApps directory of Tomcat and modify the name to Cas.war.

(2) Generate Server1 Security certificate:

Keytool-export-alias tomcat-file D:/file.cer-keystore d:/tomcat.keystore-validity 36500

Then enter the KeyStore password in D:/tomcat.keystore

-file D:/file.cer is the generated CER file and can be clicked directly on the installation

(3) Restart Tomcat on Server1, verify the CAS configuration is successful, access HTTPS://IP or domain name: 8443/cas/login, if you can see the CAS login page, the configuration is successful.

CAS Client Configuration

1, prepare the CAS PHP library and related library files

1) Download CAs PHP client http://downloads.jasig.org/cas-clients/php/current/CAS-1.3.1.tgz

2) due to the use of Pear DB Library, need to download

Http://pear.php.net/get/PEAR-1.7.1.tgz

Http://pear.php.net/get/DB-1.7.13.tgz

It's not necessarily the version I'm talking about, but I gave it a successful version of my experiment.

3) used to use SSL so need to download OpenSSL. Of course I was experimenting in Windows environment, downloaded version of Windows.

4) Install OpenSSL.

2. Configure PHP Environment

1) Place cas-1.3.1.tgz, pear-1.7.1.tgz, db-1.7.13.tgz in the same directory.

4) Since Phpcas uses curl (for SSL connection), it is necessary to ensure that the PHP interpretation environment requires this extension. All you need to do is modify the INI file to remove the screen symbol from the extentions section, and then check to see if there is a. dll in the extentions directory of the PHP environment. General standard installation will have.

3. Test the PHP Client for CAs

1) Copy the Docs/examples folder in cas-1.3.1.tgz to the root of the Web site.

2) config.example.php modified to config.php

3) Open config.php for modification

4) access to localhost:8080/examples/example_simple.php (client's address)

Will jump to the CAS server login page. The default is to authenticate as long as the user name and password are the same.

When the login is successful, it will transfer to the client. Prompt for validation success.

The configuration of other clients is configured as per the above steps. Can achieve a single point.

Advanced CAS server uses database to validate user-created tables

CREATE TABLE T_user (
Username varchar (primary) key,
Password varchar (200)
);
Insertinto users (Username,password) VALUES (' Test ', ' 123′ ');

Add jar

The database driver package: Mysql-connector-java-5.1.5-bin.jar Cas-server-support-jdbc-3.x.x.jar (from \cas-server-3.4.2\modules) Copy to cas/web-inf/lib/

Create a validation service layer

Create Logindao

public class Logindao extends Jdbcdaosupport {

Public List querylist (String sql,object[] objs) {
Return This.getjdbctemplate (). queryForList (SQL, OBJS);
}
}

Create Loginservice

public class Loginservice {

Private Logindao Logindao;

/**
* Determine user login information
* @param username
* @param password
* @return NULL for user not present, false password error, true login successful
*/
Public Boolean isusercorrect (String username,string password) {
String sql = "Select password from t_user where username=?";

List results = logindao.querylist (sql, new Object[]{username});
if (results==null| | Results.size () ==0) {
return null;
}else if (Password.equals ((Map) results.get (0)). Get ("password"). ToString ())) {
return new Boolean (true);
}else{
return new Boolean (false);
}
}

Public Logindao Getlogindao () {
return Logindao;
}

public void Setlogindao (Logindao Logindao) {
This.logindao = Logindao;
}
}

overriding validation classes

Override the validation method in Abstractusernamepasswordauthenticationhandler authenticateusernamepasswordinternal
public class Userauthenticationhandler extends
Abstractusernamepasswordauthenticationhandler {

Private Loginservice Loginservice;

@Override
Protected Boolean authenticateusernamepasswordinternal (
Usernamepasswordcredentials credentials) throws Authenticationexception {
String username = credentials.getusername ();
String password = Credentials.getpassword ();
Boolean result = Loginservice.isusercorrect (username, password);
if (result==null) {
The user does not exist, and "error.authentication.credentials.bad.usernameorpassword.username" must be defined in the message configuration file, which displays information on the login page when validation fails
throw new Badpasswordauthenticationexception ("Error.authentication.credentials.bad.usernameorpassword.username") ;
}else if (!result.booleanvalue ()) {
Password error
throw new Badpasswordauthenticationexception ("Error.authentication.credentials.bad.usernameorpassword.password") ;
}else{
Login successful
return true;
}

}

Public Loginservice Getloginservice () {
return loginservice;
}

public void Setloginservice (Loginservice loginservice) {
This.loginservice = Loginservice;
}

}

Defining error messages

Add validation error message in Messages_zh_cn.properties

Error.authentication.credentials.bad.usernameorpassword.username= user does not exist

error.authentication.credentials.bad.usernameorpassword.password= Password Error

Configuring the Web-inf\deployerconfigcontext.xml File

<!– in Adding datasource–>
<bean id= "DataSource" class= "Org.springframework.jdbc.datasource.DriverManagerDataSource" >
<property name= "Driverclassname" >
<value>com.mysql.jdbc.Driver</value>
</property>
<property name= "url" >
<value>jdbc:mysql://localhost:3306/test</value>
</property>
<property name= "username" >
<value>root</value>
</property>
<property name= "Password" >
<value>root</value>
</property>
</bean>

<!– Injection Service and dao–>
<bean name= "JdbcTemplate" class= "Org.springframework.jdbc.core.JdbcTemplate" >
<property name= "DataSource" ref= "DataSource" ></property>
</bean>

<bean name= "Logindao" class= "Com.cas.dao.LoginDAO" >
<property name= "JdbcTemplate" ref= "JdbcTemplate" ></property>
</bean>

<bean name= "Loginservice" class= "Com.cas.service.LoginService" >
<property name= "Logindao" ref= "Logindao" ></property>
</bean>

<!– Find the Simpletestusernamepasswordauthenticationhandler bean, comment it out, add the following bean–>
<bean class= "Com.cas.authentication.UserAuthenticationHandler" >
<property name= "Loginservice" ref= "Loginservice" ></property>
</bean> start tomcat, test login. (If you are using the war to extract the server from Tomcat, you must copy the above class's compiled class file, package, information configuration file to web-inf\classes)

This article is from Nankeyimeng station, please indicate the source and corresponding link when reproduced.

Permanent link to this article: http://lkf.22web.org/?p=5

CAS client server-side configuration steps