Java Can';t使用Spring Security使CAS单点注销正常工作
我没有找到在我的应用程序上实现单一注销CAS功能的实际指南。我在这里尝试了很多答案,但没有一个有效(像和)。此外,还没有找到使用Java配置的SpringSecurity+CAS的例子,所以我对这一点也有点迷茫。我甚至无法确定这是否是我应该使用的实际URL,因为文档告诉我使用“/j_spring_security_logout”,这只是将我重定向到一个空白的索引页,因为如果我正常访问它,我的索引页会正常工作(尽管控制台显示了所有正确的请求,如JS和CSS)。如果您能提供一些指导,我将不胜感激,因为我找不到使用Java注释的文档。提前谢谢 我的网站安全配置:Java Can';t使用Spring Security使CAS单点注销正常工作,java,spring,spring-security,cas,Java,Spring,Spring Security,Cas,我没有找到在我的应用程序上实现单一注销CAS功能的实际指南。我在这里尝试了很多答案,但没有一个有效(像和)。此外,还没有找到使用Java配置的SpringSecurity+CAS的例子,所以我对这一点也有点迷茫。我甚至无法确定这是否是我应该使用的实际URL,因为文档告诉我使用“/j_spring_security_logout”,这只是将我重定向到一个空白的索引页,因为如果我正常访问它,我的索引页会正常工作(尽管控制台显示了所有正确的请求,如JS和CSS)。如果您能提供一些指导,我将不胜感激,因
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
private static String CAS_URL = "https://localhost:8443/cas";
private static String APP_URL = "https://localhost:8443/i9t-YM";
@Bean
public ServiceProperties serviceProperties() {
ServiceProperties serviceProperties = new ServiceProperties();
serviceProperties.setService(APP_URL+"/j_spring_cas_security_check");
serviceProperties.setSendRenew(false);
return serviceProperties;
}
@Bean
public CasAuthenticationProvider casAuthenticationProvider() {
CasAuthenticationProvider casAuthenticationProvider = new CasAuthenticationProvider();
casAuthenticationProvider.setAuthenticationUserDetailsService(authenticationUserDetailsService());
casAuthenticationProvider.setServiceProperties(serviceProperties());
casAuthenticationProvider.setTicketValidator(cas20ServiceTicketValidator());
casAuthenticationProvider.setKey("an_id_for_this_auth_provider_only");
return casAuthenticationProvider;
}
@Bean
public AuthenticationUserDetailsService authenticationUserDetailsService() {
return new TestCasAuthenticationUserDetailsService();
}
@Bean
public Cas20ServiceTicketValidator cas20ServiceTicketValidator() {
return new Cas20ServiceTicketValidator(CAS_URL);
}
@Bean
public CasAuthenticationFilter casAuthenticationFilter() throws Exception {
CasAuthenticationFilter casAuthenticationFilter = new CasAuthenticationFilter();
casAuthenticationFilter.setAuthenticationManager(authenticationManager());
return casAuthenticationFilter;
}
@Bean
public CasAuthenticationEntryPoint casAuthenticationEntryPoint() {
CasAuthenticationEntryPoint casAuthenticationEntryPoint = new CasAuthenticationEntryPoint();
casAuthenticationEntryPoint.setLoginUrl(CAS_URL+"/login");
casAuthenticationEntryPoint.setServiceProperties(serviceProperties());
return casAuthenticationEntryPoint;
}
@Bean
public SingleSignOutFilter SingleSignOutFilter(){
return new SingleSignOutFilter();
}
@Bean
public LogoutFilter requestLogoutFilter(){
SecurityContextLogoutHandler handler = new SecurityContextLogoutHandler();
handler.setClearAuthentication(true);
handler.setInvalidateHttpSession(true);
LogoutFilter logoutFilter = new LogoutFilter(APP_URL, handler);
return logoutFilter;
}
@Override
public void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(casAuthenticationProvider());
auth.inMemoryAuthentication().withUser("joe").password("joe").roles("USER");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.addFilter(casAuthenticationFilter());
http.exceptionHandling().authenticationEntryPoint(casAuthenticationEntryPoint());
http.addFilterBefore(requestLogoutFilter(), LogoutFilter.class);
http.addFilterBefore(SingleSignOutFilter(), CasAuthenticationFilter.class);
http.httpBasic().and().authorizeRequests().antMatchers("/index.html", "/home.html", "/login.html", "/")
.permitAll().anyRequest().authenticated()
.and().addFilterAfter(new CsrfHeaderFilter(), CsrfFilter.class)
.csrf().csrfTokenRepository(csrfTokenRepository())
;
http.logout()
.deleteCookies("remove").invalidateHttpSession(true).logoutUrl("cas/logout")
.logoutSuccessUrl("/");
//http.exceptionHandling().accessDeniedPage("/403.html");
}
private CsrfTokenRepository csrfTokenRepository() {
HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
repository.setHeaderName("X-XSRF-TOKEN");
return repository;
}
}
我的Web.xml上的SSOut过滤器,不知道我添加它的确切原因:
<filter>
<filter-name>characterEncodingFilter</filter-name>
<filter-class>
org.springframework.web.filter.CharacterEncodingFilter
</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>characterEncodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>
org.jasig.cas.client.session.SingleSignOutHttpSessionListener
</listener-class>
</listener>
字符编码滤波器
org.springframework.web.filter.CharacterEncodingFilter
编码
UTF-8
字符编码滤波器
/*
org.jasig.cas.client.session.SingleSignOutHttpSessionListener
这是我对使用cas集成的spring安全性进行单点注销的配置:
<bean id="singleLogoutFilter" class="org.jasig.cas.client.session.SingleSignOutFilter" />
<bean id="requestSingleLogoutFilter"
class="org.springframework.security.web.authentication.logout.LogoutFilter">
<constructor-arg
value="${cas.server.address}/logout?service=${cas.server.address}" />
<constructor-arg>
<bean
class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
</constructor-arg>
<property name="filterProcessesUrl" value="/j_spring_cas_security_logout" />
</bean>
为什么不编写一个控制器方法呢?在这个方法中,您可以手动注销用户并将用户重定向到任何您想要的地方。我会将用户身份验证设置为null。@WeareBorg但问题是:Spring security不应该为我这样做吗?据我从文档中了解,我只需要这样做,当Spring收到“/j_Spring_security_cas_logout”时,它将使会话无效,然后从cas的角度来看,SSOut将是可选的。除非我真的不明白。让我检查一下……因为我不再处理这个问题了,我无论如何都接受这个答案。但是,我现在没有办法再测试它了,对不起。不过还是要谢谢你@Yuri-M-Dias我在cas有多年的经验,这就是我在我们的项目中所做的,并且它是有效的
<sec:filter-chain pattern="/logout*"
filters="securityContextPersistenceFilter,singleLogoutFilter,casAuthenticationFilter" />
<sec:filter-chain pattern="/j_spring_cas_security_logout*"
filters="requestSingleLogoutFilter" />