shiro集成spring使用cas单点登录配置

拼搏现实的明天。 2022-06-01 12:57 454阅读 0赞

## 第三部分 shiro集成spring使用cas单点登录配置 ##

### （一）shiro单点登录 ###

配置的主要目的在于将登录页面改为`${cas.server}?service=${cas.client}/login`的形式，service后面为本地的回调地址。在cas服务器端登录成功后，会生成ticket返回给客户端，客户端的shiro使用ticket最为凭据保存起来。   
　　   
　　shiro配置单点登陆后，在注销时原始的cas-client只能删除HttpSession，不能删除shiro的Session，因此未使用shiro的session管理器。   
　　如果想启用shiro的Session管理器，可以参考[Shiro & CAS 实现单点登录][Shiro _ CAS]。   
　　原有的CasRealm在AuthenticationInfo中只保存了用户名作为principal，MyCasRealm中重写了此方法，改为保存用户信息类。   
　　需要在pom增加依赖，shiro-cas会通过依赖传递自动增加cas-client-core-3.2.1的依赖。

<dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-spring</artifactId>
        <version>1.2.3</version>
    </dependency>
    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-cas</artifactId>
        <version>1.2.3</version>
    </dependency>
     
      
       1
       2
       3
       4
       5
       6
       7
       8
       9
       10
       11

#### 1、spring-shiro.xml配置 ####

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:util="http://www.springframework.org/schema/util" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:context="http://www.springframework.org/schema/context" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd " default-lazy-init="false">
        <description>Shiro安全配置</description>
    
        
        <bean id="cacheManager" class="com.whty.framework.base.common.cache.SpringCacheManagerWrapper">
            <property name="cacheManager" ref="springCacheManager"/>
        </bean>
    
        
        <bean id="casRealm" class="com.whty.oim.base.shiro.MyCasRealm">
            <property name="cachingEnabled" value="true"/>
            <property name="authenticationCachingEnabled" value="true"/>
            <property name="authenticationCacheName" value="authenticationCache"/>
            <property name="authorizationCachingEnabled" value="true"/>
            <property name="authorizationCacheName" value="authorizationCache"/>
            
            <property name="casServerUrlPrefix" value="${cas.server}"/>
            
            <property name="casService" value="${cas.client}/login"/>
        </bean>
    
        <bean id="casSubjectFactory" class="org.apache.shiro.cas.CasSubjectFactory"/>
        
        <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
            <property name="realm" ref="casRealm"/>
            
            <property name="cacheManager" ref="cacheManager"/>
            
            
            <property name="subjectFactory" ref="casSubjectFactory"/>
        </bean>
    
        
        <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
            <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/>
            <property name="arguments" ref="securityManager"/>
        </bean>
    
        <bean id="casFilter" class="org.apache.shiro.cas.CasFilter">
            
            <property name="failureUrl" value="${cas.client}"/>
        </bean>
    
        <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
            <property name="securityManager" ref="securityManager" />
            
            <property name="loginUrl" value="${cas.server}?service=${cas.client}/login" />
            <property name="successUrl" value="/index" />
            <property name="unauthorizedUrl" value="/"/> 
            <property name="filters">
                <util:map>
                    
                    
                    <entry key="cas" value-ref="casFilter"/>
                </util:map>
            </property>
            <property name="filterChainDefinitions">
                <value>
                /logout = logout
                /login = cas
                /** = user
                </value>
            </property>
        </bean>
    
    
        
        <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
    
    </beans>
     
      
       1
       2
       3
       4
       5
       6
       7
       8
       9
       10
       11
       12
       13
       14
       15
       16
       17
       18
       19
       20
       21
       22
       23
       24
       25
       26
       27
       28
       29
       30
       31
       32
       33
       34
       35
       36
       37
       38
       39
       40
       41
       42
       43
       44
       45
       46
       47
       48
       49
       50
       51
       52
       53
       54
       55
       56
       57
       58
       59
       60
       61
       62
       63
       64
       65
       66
       67
       68
       69
       70
       71
       72
       73
       74
       75
       76
       77
       78
       79
       80
       81
       82

#### 2、cas.properties ####

cas.server=[http://192.168.5.129:8080/cas][http_192.168.5.129_8080_cas]   
　　cas.client=[http://192.168.4.184:8091/ucs][http_192.168.4.184_8091_ucs]

#### 3、自定义Realm实现 ####

主要修改了CasRealm的`doGetAuthenticationInfo()`方法，CasRealm默认只保存了username，本系统改为保存ShiroUser对象。

public class MyCasRealm extends CasRealm { 
    
        Logger logger = LoggerFactory.getLogger(MyCasRealm.class);
    
        @Autowired
        private UcsUserService ucsUserService;
    
        @Autowired
        private UcsRoleService ucsRoleService;
    
        @Autowired
        private UcsPermissionService ucsPermissionService;
    
        @Value("${domain}")
        private String domain;
    
        /** * 授权查询回调函数, 进行鉴权但缓存中无用户的授权信息时调用. * * @see org.apache.shiro.realm.AuthorizingRealm#doGetAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection) */
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
            ShiroUser shiroUser = (ShiroUser) principals.getPrimaryPrincipal();
            UcsUser ucsUser = ucsUserService.selectByUsername(shiroUser.loginName);
            //把principals放session中 key=userId value=principals
            SecurityUtils.getSubject().getSession().setAttribute(String.valueOf(ucsUser.getId()),SecurityUtils.getSubject().getPrincipals());
            SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
            //赋予角色
            List<UcsRole> ucsRoles = ucsRoleService.selectByUser(ucsUser.getId());
            if (!CheckEmptyUtil.isEmpty(ucsRoles)){
                for(UcsRole ucsRole:ucsRoles){
                    info.addRole(ucsRole.getId());
                }
            }
            //赋予权限
    // List<UcsPermission> ucsPermissions = ucsPermissionService.selectByUser(ucsUser.getId(), domain);
            if (!CheckEmptyUtil.isEmpty(shiroUser.getMenus())){
                for(EasyUIMenu permission:shiroUser.getMenus()){
                    if(UcsBaseConstant.PermissionType.BUTTON.equals(permission.getType()))
                    info.addStringPermission(permission.getUrl());
                }
            }
            return info;
        }
    
        /** * Authenticates a user and retrieves its information. * * @param token the authentication token * @throws AuthenticationException if there is an error during authentication. */
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
            CasToken casToken = (CasToken) token;
            if (token == null) {
                return null;
            }
    
            String ticket = (String)casToken.getCredentials();
            if (!StringUtils.hasText(ticket)) {
                return null;
            }
    
            TicketValidator ticketValidator = ensureTicketValidator();
    
            try {
                // contact CAS server to validate service ticket
                Assertion casAssertion = ticketValidator.validate(ticket, getCasService());
                // get principal, user id and attributes
                AttributePrincipal casPrincipal = casAssertion.getPrincipal();
                String username = casPrincipal.getName();
                logger.debug("Validate ticket : {} in CAS server : {} to retrieve user : {}", new Object[]{
                        ticket, getCasServerUrlPrefix(), username
                });
    
                Map<String, Object> attributes = casPrincipal.getAttributes();
                // refresh authentication token (user id + remember me)
                casToken.setUserId(username);
                String rememberMeAttributeName = getRememberMeAttributeName();
                String rememberMeStringValue = (String)attributes.get(rememberMeAttributeName);
                boolean isRemembered = rememberMeStringValue != null && Boolean.parseBoolean(rememberMeStringValue);
                if (isRemembered) {
                    casToken.setRememberMe(true);
                }
                // create simple authentication info
                // 根据用户名获取账号信息
                UcsUser ucsUser = ucsUserService.selectByUsername(username);
                List<UcsPermission> ucsPermissions = null;
                if (ucsUser != null) {
                    ucsPermissions = ucsPermissionService.selectByUser(ucsUser.getId(), domain);
                } else {
                    throw new UnknownAccountException();//登录失败
                }
                //给菜单排序
                List<EasyUIMenu> menus = toEasyUIMenu(ucsPermissions);
                if(!CheckEmptyUtil.isEmpty(menus)){
                    Collections.sort(menus);
                }
                ShiroUser shiroUser = new ShiroUser(ucsUser.getId(), ucsUser.getUsername(), ucsUser.getName(), menus);
    
                return new SimpleAuthenticationInfo(shiroUser, ticket, getName());
            } catch (TicketValidationException e) { 
                throw new CasAuthenticationException("Unable to validate ticket [" + ticket + "]", e);
            }
        }
    
        private List<EasyUIMenu> toEasyUIMenu(List<UcsPermission> ucsPermissions){
            List<EasyUIMenu> menus = new ArrayList<EasyUIMenu>(0);
            for (UcsPermission ucsPermission : ucsPermissions) {
                menus.add(toEasyUIMenu(ucsPermission));
            }
            return menus;
        }
        private EasyUIMenu toEasyUIMenu(UcsPermission ucsPermission){
            return new EasyUIMenu(ucsPermission.getId(), ucsPermission.getPid(), ucsPermission.getDomain(), ucsPermission.getName(), ucsPermission.getType(), ucsPermission.getSort(), ucsPermission.getIcon(), ucsPermission.getUrl(), ucsPermission.getDescription(), ucsPermission.getStatus());
        }
    
        @Override
        public void clearCachedAuthorizationInfo(PrincipalCollection principals) {
            super.clearCachedAuthorizationInfo(principals);
        }
    
        @Override
        public void clearCachedAuthenticationInfo(PrincipalCollection principals) {
            super.clearCachedAuthenticationInfo(principals);
        }
    
        @Override
        public void clearCache(PrincipalCollection principals) {
            super.clearCache(principals);
            clearAllCache();
        }
    
        public void clearAllCachedAuthorizationInfo() {
            getAuthorizationCache().clear();
        }
    
        public void clearAllCachedAuthenticationInfo() {
            getAuthenticationCache().clear();
        }
    
        public void clearAllCache() {
            clearAllCachedAuthenticationInfo();
            clearAllCachedAuthorizationInfo();
        }
    
    }
     
      
       1
       2
       3
       4
       5
       6
       7
       8
       9
       10
       11
       12
       13
       14
       15
       16
       17
       18
       19
       20
       21
       22
       23
       24
       25
       26
       27
       28
       29
       30
       31
       32
       33
       34
       35
       36
       37
       38
       39
       40
       41
       42
       43
       44
       45
       46
       47
       48
       49
       50
       51
       52
       53
       54
       55
       56
       57
       58
       59
       60
       61
       62
       63
       64
       65
       66
       67
       68
       69
       70
       71
       72
       73
       74
       75
       76
       77
       78
       79
       80
       81
       82
       83
       84
       85
       86
       87
       88
       89
       90
       91
       92
       93
       94
       95
       96
       97
       98
       99
       100
       101
       102
       103
       104
       105
       106
       107
       108
       109
       110
       111
       112
       113
       114
       115
       116
       117
       118
       119
       120
       121
       122
       123
       124
       125
       126
       127
       128
       129
       130
       131
       132
       133
       134
       135
       136
       137
       138
       139
       140
       141
       142
       143
       144
       145
       146
       147
       148

### （二）cas登出 ###

在任意一个子系统登出后，cas服务器会向所有发过登录请求的子系统发送一个登出请求，使所有子系统的HttpSession失效。如果使用了shiro的session管理器，需要修改cas客户端代码，在移除HttpSession的时候也移除shiro的Session。

#### 1、web.xml ####

web.xml中需要加入cas的SingleSignOutFilter实现单点登出功能，该过滤器需要放在shiroFilter之前，spring字符集过滤器之后。在实际使用时发现，SingleSignOutFilter如果放在了spring字符集过滤器之前，数据在传输过程中就会出现乱码。

<listener>
        <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
    </listener>
    
    <filter>
        <filter-name>CAS Single Sign Out Filter</filter-name>
        <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>CAS Single Sign Out Filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
     
      
       1
       2
       3
       4
       5
       6
       7
       8
       9
       10
       11
       12
       13

#### 2、登出请求 ####

登出只需要将当前页面跳转到cas服务器的logout页面即可实现登出。如果需要登出后跳转页面，可以加入service参数，并参考第一部分中第四节进行配置。   
　　子系统使用的方法是在后台拼装好登出链接，发送给前台页面，前台页面接受使用el表达式接收。具体实现需要根据每个子系统的不同来自行实现。

@Value("${cas.server}")
    private String cas_server;  
    @Value("${cas.client}")
    private String cas_client;
    
    @RequestMapping(value = "/index")
    public String index(Model model){
        StringBuilder logoutUrl = new StringBuilder();
        logoutUrl.append(cas_server);
        logoutUrl.append("/logout?service=");
        logoutUrl.append(cas_client);
        model.addAttribute("logoutUrl", logoutUrl.toString());
        return "system/index";
    }
     
      
       1
       2
       3
       4
       5
       6
       7
       8
       9
       10
       11
       12
       13
       14

前台页面：

#### 缓存配置（可选） ####

我使用的ehcache作为shiro的缓存，也可以使用其他的。   
spring-cache.xml

ehcache.xml

<?xml version="1.0" encoding="UTF-8"?>  
    <ehcache xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="ehcache.xsd" updateCheck="true" monitoring="autodetect" dynamicConfig="true">  
    
    
        <diskStore path="C:\\ehcache\\cache"/> 
        
        
        <cache name="passwordRetryEhcache" maxEntriesLocalHeap="2000" eternal="false" timeToIdleSeconds="1800" timeToLiveSeconds="0" overflowToDisk="false" statistics="true">
        </cache>
    
        <cache name="authorizationCache" maxEntriesLocalHeap="2000" eternal="false" timeToIdleSeconds="3600" timeToLiveSeconds="0" overflowToDisk="false" statistics="true">
        </cache>
    
        <cache name="authenticationCache" maxEntriesLocalHeap="2000" eternal="false" timeToIdleSeconds="3600" timeToLiveSeconds="0" overflowToDisk="false" statistics="true">
        </cache>
    
        <cache name="shiro-activeSessionCache" maxEntriesLocalHeap="2000" eternal="false" timeToIdleSeconds="3600" timeToLiveSeconds="0" overflowToDisk="false" statistics="true">
        </cache>
    
        <defaultCache maxElementsInMemory="1000" eternal="false" timeToIdleSeconds="120" timeToLiveSeconds="120" overflowToDisk="true" maxElementsOnDisk="10000" diskSpoolBufferSizeMB="30" diskPersistent="false" diskExpiryThreadIntervalSeconds="120" memoryStoreEvictionPolicy="LRU" statistics="false" />  
    
    
    </ehcache>

[Shiro _ CAS]: http://howiefh.github.io/2015/05/19/shiro-cas-single-sign-on/?utm_source=tuicool&utm_medium=referral
[http_192.168.5.129_8080_cas]: http://192.168.5.129:8080/cas
[http_192.168.4.184_8091_ucs]: http://192.168.4.184:8091/ucs