CAS Single Sign-On Configuration

Document directory

• 1. Create a certificate
• 2. Export the certificate
• 3. Client JVM Import Certificate
• 4. Apply the certificate to the Web server. Tomcat is used here.
• 5. Configure the CAS Server
• 6. Configure the CAS server to connect to the database
• 7. CAS client Configuration
• 8. Modify the CAS logon page
• 9. CAS retrieval on the client page

I read the CAS Single Sign-On configuration tutorial of coffee rabbit and wrote it very well. After a day of hard work, I finally configured the configuration successfully and recorded the configuration steps.

1. Create a certificate

Certificates are an important key in the Single Sign-On authentication system. The interaction security of clients on servers depends on certificates; in this tutorial, we will use the keytool tool that comes with JDK to generate certificates. If you are actually using it in the product environment in the future, you must purchase it from the certificate provider. Generally, Verisign is used for certificate authentication.

Here we use the built-in JDK keytool to generate a certificate: keytool-genkey-alias mycas-keyalg RSA-keystore D:/keys/mykey

Note that the first and last names are the inputs of the domain name. Do not use IP addresses.

2. Export the certificate

D: \ Keys> keytool-export-file D:/keys/mycas. CRT-alias wsria-keystore D:/keys/mykey

3. Client JVM Import Certificate

Keytool-import-keystore D: \ JDK \ 1.6 \ jdk1.6.0 _ 20 \ JRE \ Lib \ SECURITY \ cacerts-file D:/keys/mycas. CRT-alias mycas

It is worth noting that I reported an error during the configuration process, a java. Io exception. Solution: Delete the cacerts of the jdk directory \ JRE \ Lib \ Security.

4. Apply the certificate to the Web server. Tomcat is used here.

Open the conf/server. xml file in the Tomcat directory, at the end of 8443, and set keystorefile and keystorepass. The Modification result is as follows:

<Connector Port = "8443" protocol = "HTTP/1.1" sslenabled = "true" maxthreads = "150" Scheme = "HTTPS" secure = "true" clientauth = "false" sslprotocol = "TLS" keystorefile = "D: /keys/mykey "keystorepass =" generate key password "/>

Parameter description: keystorefile: The storage location of the key created in step 1. keystorepass: the password when the certificate is created

Enable https: // localhost: 8443/. You can test it.

5. Configure the CAS Server

Cas-server-3.4.3.1.zip unzipping, unzipping cas-server-3.4.3/modules/cas-server-webapp-3.4.3.1.war, rename cas. War, Tomcat automatically unzipping open, and then copy the CAS directory to your tomcat/webapp directory

Https: // localhost: 8443/CAS/login. Now, enter Admin/admin on the CAS Server Page and click "Log On". (the default CAS verification rule will pass as long as the user name and password are the same) the system prompts that the logon is successful.

6. Configure the CAS server to connect to the database

First open the tomcat/webapp/CAS/WEB-INF/deployerconfigcontext. xml file, comment out simpletestusernamepasswordauthenticationhandler this verification Handler

Add the following JDBC query interface. For data sources, add the MD5 encryption interface of CAS.

<! -- Configure the JDBC query interface --> <Bean class = "org. JASIG. CAS. adaptors. JDBC. querydatabaseauthenticationhandler "> <property name =" datasource "ref =" datasource "/> <property name =" SQL "value =" select password from t_admin_user where login_name =? "/> <! -- <Property name = "passwordencoder" ref = "md5passwordencoder"/> --> </bean> <bean id = "datasource" class = "org. springframework. JDBC. datasource. drivermanagerdatasource "> <property name =" driverclassname "> <value> oracle. JDBC. driver. oracledriver </value> </property> <property name = "url"> <value> JDBC: oracle: thin: @ 127.0.0.1: 1521: orcl </value> </property> <property name = "username"> <value> zhouyujie </value> </property> <Property name = "password"> <value> zhouyujie </value> </property> </bean> <! -- <Bean id = "md5passwordencoder" class = "org. JASIG. CAS. authentication. handler. defaultpasswordencoder "> <constructor-Arg Index =" 0 "> <value> MD5 </value> </constructor-Arg> </bean> -->

Copy cas-server-3.4.3.1 \ modules \ cas-server-support-jdbc-3.4.3.1.jar and MySQL driver jar package to Tomcat/webapp/CAS/WEB-INF/lib directory 7, CAS client Configuration

Add a cas-client-core-3.2.1.jar package in your client project.

Add the following information to Web. xml:

<! -- Used for single-point exit. This filter is used for single-point logout. Optional. --> <listener-class> Org. JASIG. CAS. client. session. singlesignouthttpsessionlistener </listener-class> </listener> <! -- This filter is optional for single-point logout. --> <Filter-Name> CAS Single Sign Out filter </filter-Name> <filter-class> Org. JASIG. CAS. client. session. singlesignoutfilter </filter-class> </filter> <filter-mapping> <filter-Name> CAS Single Sign Out filter </filter-Name> <URL-pattern>/* </url-pattern> </filter-mapping> <! -- This filter is used for user authentication and must be enabled --> <filter-Name> casfilter </filter-Name> <filter-class> Org. JASIG. CAS. client. authentication. authenticationfilter </filter-class> <init-param> <param-Name> casserverloginurl </param-Name> <param-value> https: // localhost: 8443/CAS/login </param-value> <! -- The server here is the server's IP --> </init-param> <param-Name> servername </param-Name> <param-value> HTTP: // localhost: 8080 </param-value> </init-param> </filter> <filter-mapping> <filter-Name> casfilter </filter-Name> <URL-pattern>/ * </url-pattern> </filter-mapping> <! -- This filter is used for ticket verification and must be enabled --> <filter-Name> CAS validation filter </filter-Name> <filter-class> Org. JASIG. CAS. client. validation. cas20proxypolicingticketvalidationfilter </filter-class> <init-param> <param-Name> casserverurlprefix </param-Name> <param-value> https: // localhost: 8443/CAS </param-value> </init-param> <param-Name> servername </param-Name> <param-value> HTTP: // localhost: 8080 </param-va Lue> </init-param> </filter> <filter-mapping> <filter-Name> CAS validation filter </filter-Name> <URL-pattern>/* </ URL-pattern> </filter-mapping> <! -- This filter is used to implement the package of the httpservletrequest request. For example, you can use the getremoteuser () method of httpservletrequest to obtain the login name of the SSO logon user. Optional. --> <Filter-Name> CAS httpservletrequest wrapper filter </filter-Name> <filter-class> Org. JASIG. CAS. client. util. httpservletrequestwrapperfilter </filter-class> </filter> <filter-mapping> <filter-Name> CAS httpservletrequest wrapper filter </filter-Name> <URL-pattern>/* </ URL-pattern> </filter-mapping> <! -- This filter allows developers to use org. JASIG. Cas. Client. util. assertionholder to obtain the user's login name. For example, assertionholder. getassertion (). getprincipal (). getname (). --> <Filter-Name> CAS assertion Thread Local filter </filter-Name> <filter-class> Org. JASIG. CAS. client. util. assertionthreadlocalfilter </filter-class> </filter> <filter-mapping> <filter-Name> CAS assertion Thread Local filter </filter-Name> <URL-pattern>/* </url-pattern> </filter-mapping> <! -- = ============== -->

8. Modify the CAS logon page

You can modify the appearance of the CAS login page, which must be used in actual projects.

9. CAS retrieval on the client page

On the page, we can use string uname = request. getremoteuser (); to obtain the username information in CAS.

 

Thanks again for the tutorial, haha, ^ 0 ^...