Spring Security系列教程28--Spring Security实现CAS单点登录下篇--搭建CAS客户端

@ConfigurationpublicclassCasSecurityConfig {
@Value("${cas.server.prefix}")
privateStringcasServerPrefix;
@Value("${cas.server.login}")
privateStringcasServerLogin;
@Value("${cas.server.logout}")
privateStringcasServerLogout;
@Value("${cas.client.login}")
privateStringcasClientLogin;
@Value("${cas.client.logout}")
privateStringcasClientLogout;
@Value("${cas.client.relative}")
privateStringcasClientLogoutRelative;
@Value("${cas.user.inmemory}")
privateStringcasUserInMemory;
/*** 配置CAS Client的属性** @return*/@BeanpublicServicePropertiesserviceProperties() {
ServicePropertiesserviceProperties=newServiceProperties();
// 与CasAuthenticationFilter监视的URL一致serviceProperties.setService(casClientLogin);
// 是否关闭单点登录，默认为false，所以也可以不设置。serviceProperties.setSendRenew(false);
returnserviceProperties;
    }
/*** 配置CAS认证入口，提供用户浏览器重定向的地址** @param sp* @return*/@Bean@PrimarypublicAuthenticationEntryPointauthenticationEntryPoint(ServicePropertiessp) {
CasAuthenticationEntryPointentryPoint=newCasAuthenticationEntryPoint();
// CAS Server认证的登录地址entryPoint.setLoginUrl(casServerLogin);
entryPoint.setServiceProperties(sp);
returnentryPoint;
    }
/*** 配置ticket校验功能，需要提供CAS Server校验ticket的地址** @return*/@BeanpublicTicketValidatorticketValidator() {
// 默认情况下使用Cas20ProxyTicketValidator，验证入口是${casServerPrefix}/proxyValidatereturnnewCas20ProxyTicketValidator(casServerPrefix);
    }
/*** 在内存中创建一个用户并分配权限** @return*/@BeanpublicUserDetailsServiceuserDetailsService() {
InMemoryUserDetailsManagermanager=newInMemoryUserDetailsManager();
manager.createUser(User.withUsername(casUserInMemory).password("").roles("USER").build());
returnmanager;
    }
/*** 设置cas认证处理逻辑** @param sp* @param ticketValidator* @param userDetailsService* @return*/@BeanpublicCasAuthenticationProvidercasAuthenticationProvider(ServicePropertiessp, TicketValidatorticketValidator, UserDetailsServiceuserDetailsService) {
CasAuthenticationProviderprovider=newCasAuthenticationProvider();
provider.setServiceProperties(sp);
provider.setTicketValidator(ticketValidator);
provider.setUserDetailsService(userDetailsService);
provider.setKey("yyg");
returnprovider;
    }
/*** 提供CAS认证专用过滤器，过滤器的认证逻辑由CasAuthenticationProvider提供** @param sp* @param ap* @return*/@BeanpublicCasAuthenticationFiltercasAuthenticationFilter(ServicePropertiessp, AuthenticationProviderap) {
CasAuthenticationFilterfilter=newCasAuthenticationFilter();
filter.setServiceProperties(sp);
filter.setAuthenticationManager(newProviderManager(Arrays.asList(ap)));
returnfilter;
    }
/*** 配置单点登录过滤器，接受cas服务端发出的注销请求** @return*/@BeanpublicSingleSignOutFiltersingleSignOutFilter() {
SingleSignOutFiltersingleSignOutFilter=newSingleSignOutFilter();
singleSignOutFilter.setCasServerUrlPrefix(casServerPrefix);
singleSignOutFilter.setIgnoreInitConfiguration(true);
returnsingleSignOutFilter;
    }
/*** 将注销请求转发到cas server** @return*/@BeanpublicLogoutFilterlogoutFilter() {
LogoutFilterlogoutFilter=newLogoutFilter(casServerLogout, newSecurityContextLogoutHandler());
// 设置客户端注销请求的路径logoutFilter.setFilterProcessesUrl(casClientLogoutRelative);
returnlogoutFilter;
    }
}

@EnableWebSecurity(debug=true)
publicclassWebSecurityConfigextendsWebSecurityConfigurerAdapter {
@AutowiredprivateAuthenticationProviderauthenticationProvider;
@AutowiredprivateAuthenticationEntryPointentryPoint;
@AutowiredprivateCasAuthenticationFiltercasAuthenticationFilter;
@AutowiredprivateSingleSignOutFiltersingleSignOutFilter;
@AutowiredprivateLogoutFilterrequestSingleLogoutFilter;
@Overrideprotectedvoidconfigure(AuthenticationManagerBuilderauth) {
auth.authenticationProvider(authenticationProvider);
    }
@Overrideprotectedvoidconfigure(HttpSecurityhttp) throwsException {
http.authorizeRequests()
                .antMatchers("/admin/**")
                .hasRole("ADMIN")
                .antMatchers("/user/**")
                .hasRole("USER")
                .antMatchers("/login/cas", "/favicon.ico", "/error")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .exceptionHandling()
//设置认证入口                .authenticationEntryPoint(entryPoint)
                .and()
//添加过滤器,执行单点登录处理逻辑                .addFilter(casAuthenticationFilter)
//处理认证逻辑                .addFilterBefore(singleSignOutFilter, CasAuthenticationFilter.class)
//处理退出登录                .addFilterBefore(requestSingleLogoutFilter, LogoutFilter.class);
    }
}

@RestController@RequestMapping("/user")
publicclassUserController {
@GetMappingpublicStringhello() {
return"hello, user";
    }
}

/*** cas客户端,实现与cas服务端的认证*/@SpringBootApplicationpublicclassDemo13Application {
publicstaticvoidmain(String[] args) {
SpringApplication.run(Demo13Application.class, args);
    }
}