CAS Single Sign-On installation notes 4

Asp.net client settings

1. First modify the web. Config file and add the following settings: Xml Code

1. <AuthenticationMode = "Forms">
2. <FormsName = "casauth" loginUrl = "login. aspx"/>
3. </Authentication>
4. <Authorization>
5. <DenyUsers = "? "/>
6. </Authorization>

<Authentication mode = "Forms"> <forms name = "casauth" loginUrl = "login. aspx"/> </authentication> <authorization> <deny users = "? "/> </Authorization>

I am not very familiar with. net. I feel that the configuration here is similar to the filter in java web applications. When a user accesses a web page, he will first jump to the login. aspx page for verification.

2. Add the following c # code to the loading event on the login. aspx page: C # code

1. // CAS authentication server address
2. Private const string CASHOST = "https://sso.gzps.net: 8443/cas /";
4. Protected void Page_Load (object sender, EventArgs e)
5. {
6. System. Net. ServicePointManager. CertificatePolicy = new MyPolicy ();
8. // Look for the "ticket =" after "? "In the URL
9. String tkt = Request. QueryString ["ticket"];
11. // This page is the CAS service =, but discard any query string residue
12. String service = Request. Url. GetLeftPart (UriPartial. Path );
14. // First time through there is no ticket =, so redirect to CAS login
15. If (tkt = null | tkt. Length = 0)
16. {
17. String redir = CASHOST + "login? "+
18. "Service =" + service;
19. Response. Redirect (redir );
20. Return;
21. }
23. // Second time (back from CAS) there is a ticket = to validate
24. String validateurl = CASHOST + "serviceValidate? "+
25. "Ticket =" + tkt + "&" +
26. "Service =" + service;
27. StreamReader Reader = new StreamReader (new WebClient (). OpenRead (validateurl ));
28. String resp = Reader. ReadToEnd ();
29. // I like to have the text in memory for debugging rather than parsing the stream
31. // Some boilerplate to set up the parse.
32. NameTable nt = new NameTable ();
33. XmlNamespaceManager nsmgr = new XmlNamespaceManager (nt );
34. XmlParserContext context = new XmlParserContext (null, nsmgr, null, XmlSpace. None );
35. XmlTextReader reader = new XmlTextReader (resp, XmlNodeType. Element, context );
37. String netid = null;
39. // A very dumb use of XML. Just scan for the "user". If it isn' t there, its an error.
40. While (reader. Read ())
41. {
42. If (reader. IsStartElement ()){
43. String tag = reader. LocalName;
44. If (tag = "user ")
45. Netid = reader. ReadString ();
46. }
47. }
48. // If you want to parse the proxy chain, just add the logic above
49. Reader. Close ();
50. // If there was a problem, leave the message on the screen. Otherwise, return to original page.
51. If (netid = null)
52. {
53. Label1.Text = "CAS returned to this application, but then refused to validate your identity .";
54. }
55. Else
56. {
57. Session ["UserName"] = netid;
58. Label1.Text = "Welcome" + netid;
59. FormsAuthentication. RedirectFromLoginPage (netid, false); // set netid in ASP. NET blocks
60. }
62. }

// CAS authentication server address private const string CASHOST = "https://sso.gzps.net: 8443/cas/"; protected void Page_Load (object sender, EventArgs e) {System. net. servicePointManager. certificatePolicy = new MyPolicy (); // Look for the "ticket =" after "? "In the URL string tkt = Request. queryString ["ticket"]; // This page is the CAS service =, but discard any query string residue string service = Request. url. getLeftPart (UriPartial. path); // First time through there is no ticket =, so redirect to CAS login if (tkt = null | tkt. length = 0) {string redir = CASHOST + "login? "+" Service = "+ service; Response. redirect (redir); return;} // Second time (back from CAS) there is a ticket = to validate string validateurl = CASHOST + "serviceValidate? "+" Ticket = "+ tkt +" & "+" service = "+ service; StreamReader Reader = new StreamReader (new WebClient (). openRead (validateurl); string resp = Reader. readToEnd (); // I like to have the text in memory for debugging rather than parsing the stream // Some boilerplate to set up the parse. nameTable nt = new NameTable (); XmlNamespaceManager nsmgr = new XmlNamespaceManager (nt); XmlParserContext context = new XmlParserContext (null, nsmgr, null, XmlSpace. none); XmlTextReader reader = new XmlTextReader (resp, XmlNodeType. element, context); string netid = null; // A very dumb use of XML. just scan for the "user ". if it isn' t there, its an error. while (reader. read () {if (reader. isStartElement () {string tag = reader. localName; if (tag = "user") netid = reader. readString () ;}// if you want to parse the proxy chain, just add the logic above reader. close (); // If there was a problem, leave the message on the screen. otherwise, return to original page. if (netid = null) {Label1.Text = "CAS returned to this application, but then refused to validate your identity. ";}else {Session [" UserName "] = netid; Label1.Text =" Welcome "+ netid; FormsAuthentication. redirectFromLoginPage (netid, false); // set netid in ASP. NET blocks }}}

The code above references the solution for the ja-sig Website: http://www.ja-sig.org/wiki/display/CASC/ASP.NET+Forms+Authentication

3. In this way, you can jump to the sso server for verification during the runtime, but the following error is reported after the jump:
"System. Net. WebException. The basic connection is closed. You cannot establish a trust relationship with the remote server ".
The certificate must be installed on the CAS Server, but the. net Client does not.
You can configure the IIS server and support the https ssl protocol to import the digital certificate of the CAS server in the steps described in Security data exchange, or use the solution described at http://support.microsoft.com/kb/823177/to handle the problem:
Implementation Class C # code

1. Using System. Net;
2. Using System. Security. Cryptography. X509Certificates;
4. Public class MyPolicy: ICertificatePolicy {
5. Public bool CheckValidationResult (
6. ServicePoint srvPoint
7. , X509Certificate certificate
8. , WebRequest request
9. , Int certificateProblem ){
11. // Return True to force the certificate to be accepted.
12. Return true;
14. } // End CheckValidationResult
15. } // Class MyPolicy

Using System. net; using System. security. cryptography. x509Certificates; public class MyPolicy: ICertificatePolicy {public bool CheckValidationResult (ServicePoint srvPoint, X509Certificate certificate, WebRequest request, int secret) {// Return True to force the certificate to be accepted. return true;} // end CheckValidationResult} // class MyPolicy

The client code contains the following code: # c code

1. System. Net. ServicePointManager. CertificatePolicy = new MyPolicy ();

System. Net. ServicePointManager. CertificatePolicy = new MyPolicy ();

For all the codes, see the appendix website.rar. You can deploy them on your IIS server.
For more information about how to set up the IIS server, see asp.net overnight quick start tutorial.

• WebSite.rar (4 KB)
• Description: The instance program used by asp.net and cas.