??xml version="1.0" encoding="utf-8" standalone="yes"?> 1.cas-server端,配置文g?WEB-INFO/cas-servlet.xml中的logoutController <bean id="logoutController" class="org.jasig.cas.web.LogoutController"
2.grails的urlmapping插gQ如果映?#8220;/”到某个actionQ目前好像是不成功的Q但是只要不?#8220;/”Q则没有q个问题。如果默认的根目录不是index.gspQ这个可能需要在讉K“/”时进行蟩转的处理?br />
]]>
]]>
而在oracle下应该ؓ
select password from user_login where username=? and enabled=1
主要׃oralce和mysql对boolean字段的处理不一致导致的?br />
]]>
p:centralAuthenticationService-ref="centralAuthenticationService"
p:logoutView="casLogoutView"
p:warnCookieGenerator-ref="warnCookieGenerator"
p:ticketGrantingTicketCookieGenerator-ref="ticketGrantingTicketCookieGenerator"
p:followServiceRedirects="true"/>
]]>
基本需求:
1.cas server-3.4.5,casclient-3.2Q官方版本)Q均可在cas官方|站下蝲Q?a >http://www.jasig.org
2.使用低成本的http协议q行传输Q俺C起ssl证书
3.通过jdbcq行用户验证
4.需要通过casserver提供除登录用户名以外的附加信?/p>
参考资料:
1.cas官方|站的用户帮助手册和wiki
2.|友“城市猎h”的blogQ?a >http://yuzhwe.javaeye.com/blog/830143
3.|友“悟空悟道”的blogQ?a >http://llhdf.javaeye.com/blog/764385
4.其他|友贡献的相关的blogQ都是通过google出来Q就不一一列出了,一q致谢!Q!
好了Q下面进入正题,如果您不x试中出现异常情况Q或是获取不到相x据,请关注文中的U色字体部分?/p>
Q?Q用http协议的设|,如果您也像我一PC起ssl数字证书Q对安全的要求也不是特别的搞Q下面的配置可以帮助解册个问题:
在cas-server-webapp中的/WEB-INF/spring-configuration/ticketGrantingTicketCookieGenerator.xml文g中有如下配置
<bean id="ticketGrantingTicketCookieGenerator" class="org.jasig.cas.web.support.CookieRetrievingCookieGenerator"
p:cookieSecure="true" //默认为trueQ用https,如果只需要httpQ修改ؓfalse卛_
p:cookieMaxAge="-1"
p:cookieName="CASTGC"
p:cookiePath="/cas" />
Q?Q用jdbc数据源进行用戯证,需要修改cas的authenticationHandlers方式Q在文g/WEB-INF/deployerConfigContext.xml有如下配|:
<property name="authenticationHandlers">
<list>
<!--
| This is the authentication handler that authenticates services by means of callback via SSL, thereby validating
| a server side SSL certificate.
+-->
<bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler"
p:httpClient-ref="httpClient" />
<!--
| This is the authentication handler declaration that every CAS deployer will need to change before deploying CAS
| into production. The default SimpleTestUsernamePasswordAuthenticationHandler authenticates UsernamePasswordCredentials
| where the username equals the password. You will need to replace this with an AuthenticationHandler that implements your
| local authentication strategy. You might accomplish this by coding a new such handler and declaring
| edu.someschool.its.cas.MySpecialHandler here, or you might use one of the handlers provided in the adaptors modules.
+-->
<!--<bean class="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler" />-->
<bean class="org.jasig.cas.adaptors.jdbc.QueryDatabaseAuthenticationHandler">
<property name="dataSource" ref="dataSource" />
<property name="sql" value="select password from userInfo where username=? and enabled=true" />
//用户密码~码方式
<property name="passwordEncoder"
ref="passwordEncoderBean"/>
</bean>
</list>
</property>
该属性中的list只要用一个认证通过卛_Q徏议将U色部分攑֜W一位,如果认只用jdbc一U方式,其他认证方式均可删除。另外需要在在文件中ddatasoure和passordEncoder两个beanQ如?/p>
<!-- Data source definition -->
<bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
<property name="driverClassName">
<value>com.mysql.jdbc.Driver</value>
</property>
<property name="url">
<value>jdbc:mysql://localhost:3306/test?useUnicode=true&characterEncoding=utf-8</value> //如果使用mysql数据库,应该加上后面的编码参敎ͼ否则可能D客户端对TGT据无法识别的问?br />
</property>
<property name="username"><value>root</value></property>
<property name="password"><value>password</value></property>
</bean>
<bean id="passwordEncoderBean" class="org.jasig.cas.authentication.handler.DefaultPasswordEncoder">
<constructor-arg value="SHA1" /> //cas
server默认支持MD5和SHA1两种~码方式Q如果需要其他的~码方式例如SHA256,512{,可自行实现org.jasig.cas.authentication.handler.PasswordEncoder接口
</bean>
附加备注Q如果您是用cas server的源码自行编译的话,需要在cas-server-web模块的pom.xml中添加如下模块的依赖Q?/p>
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>cas-server-support-jdbc</artifactId>
<version>${project.version}</version>
</dependency>
q添加对应数据库的jdbc的jar包?/p>
Q?Q让cas server提供更多的用h据共客户端?/p>
通过试Q由于cas的代码更新过E中的变化较大,所以包兼容的问题好像一直存在,在测试中我就到q,p旉比较多,同学们在使用q程中用官方的最新的发布版本。在我用的q个版本中,请参考前面的关于server和client端的版本说明Q应该没有包冲突的问题,试通过。下面进行配|,配置文gQ?WEB-INF/deployerConfigContext.xml
<property name="credentialsToPrincipalResolvers">
<list>
<!--<bean class="org.jasig.cas.authentication.principal.UsernamePasswordCredentialsToPrincipalResolver" />-->
<!-- modify on 2011-01-18,add user info -->
<bean class="org.jasig.cas.authentication.principal.UsernamePasswordCredentialsToPrincipalResolver" >
<property name="attributeRepository" > //证过的用LPrincipald属?/font>
<ref local="attributeRepository"/>
</property>
</bean>
<bean
class="org.jasig.cas.authentication.principal.HttpBasedServiceCredentialsToPrincipalResolver" />
</list>
</property>
修改该文件中默认?font color="#ff0000"> attributeRepositorybean配置
<!-- 在这里配|获取更多用L信息 -->
<bean id="attributeRepository" class="org.jasig.services.persondir.support.jdbc.SingleRowJdbcPersonAttributeDao">
<constructor-arg index="0" ref="dataSource" />
<constructor-arg index="1" value="select id as UId, password_hint as ph from userInfo where username=? and enabled=true" />
<property name="queryAttributeMapping">
<map>
<entry key="username" value="uid"/><!-- q里必须q么写,pȝ会自己匹配,貌似和where语句后面的用户名字段的拼写没有什么关p?-->
</map>
</property>
<!-- 要获取的属性在q里配置 -->
<property name="resultAttributeMapping">
<map>
<entry key="UId" value="userId" /> //key为对应的数据库字D名Uͼvalue为提供给客户端获取的属性名字,pȝ会自动填充?br />
<entry key="ph" value="passwordHint" />
</map>
</property>
</bean>
备注Q网上有很多的关于这个的配置Q但是如果您使用的是我提供的版本或是高于q个版本Q就应该象上面这样配|,无用质疑Q网上大部分的配|都是基?br />
person-directory-impl,person-directory-api
1.1左右的版本,而最新的cas使用的是1.5的版本,l过查看源代码和api docs定最新版本的属性参数如上配|?/span>
修改该xml文g中最后一个默认的serviceRegistryDao bean中的属性全部注释掉Q或者删除,
q个bean中的RegisteredServiceImpl的ignoreAttributes属性将军_是否dattributes属性内容,默认为false:不添加,只有Lq个配置Q?br />
cas server才会获取的用户的附加属性添加到认证用的Principal的attributes中去Q我在这里犯q这L错误Q最后还是通过跟踪源码才发现的?/font>
<bean
id="serviceRegistryDao"
class="org.jasig.cas.services.InMemoryServiceRegistryDaoImpl">
<!--
<property name="registeredServices">
<list>
<bean class="org.jasig.cas.services.RegisteredServiceImpl">
<property name="id" value="0" />
<property name="name" value="HTTP" />
<property name="description" value="Only Allows HTTP Urls" />
<property name="serviceId" value="http://**" />
</bean>
<bean class="org.jasig.cas.services.RegisteredServiceImpl">
<property name="id" value="1" />
<property name="name" value="HTTPS" />
<property name="description" value="Only Allows HTTPS Urls" />
<property name="serviceId" value="https://**" />
</bean>
<bean class="org.jasig.cas.services.RegisteredServiceImpl">
<property name="id" value="2" />
<property name="name" value="IMAPS" />
<property name="description" value="Only Allows HTTPS Urls" />
<property name="serviceId" value="imaps://**" />
</bean>
<bean class="org.jasig.cas.services.RegisteredServiceImpl">
<property name="id" value="3" />
<property name="name" value="IMAP" />
<property name="description" value="Only Allows IMAP Urls" />
<property name="serviceId" value="imap://**" />
</bean>
</list>
</property>-->
</bean>
修改WEB-INF\view\jsp\protocol\2.0\casServiceValidationSuccess.jsp文gQ如下:
<%@ page session="false"%>
<%@ taglib prefix="c" uri=">
<%@ taglib uri="
<cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>
<cas:authenticationSuccess>
<cas:user>${fn:escapeXml(assertion.chainedAuthentications[fn:length(assertion.chainedAuthentications)-1].principal.id)}</cas:user>
<c:if test="${not empty pgtIou}">
<cas:proxyGrantingTicket>${pgtIou}</cas:proxyGrantingTicket>
</c:if>
<c:if test="${fn:length(assertion.chainedAuthentications) > 1}">
<cas:proxies>
<c:forEach var="proxy" items="${assertion.chainedAuthentications}"
varStatus="loopStatus" begin="0"
end="${fn:length(assertion.chainedAuthentications)-2}" step="1">
<cas:proxy>${fn:escapeXml(proxy.principal.id)}</cas:proxy>
</c:forEach>
</cas:proxies>
</c:if>
<c:if
test="${fn:length(assertion.chainedAuthentications[fn:length(assertion.chainedAuthentications)-1].principal.attributes)
>
0}">
<cas:attributes>
<c:forEach
var="attr"
items="${assertion.chainedAuthentications[fn:length(assertion.chainedAuthentications)-1].principal.attributes}"
varStatus="loopStatus"
begin="0"
end="${fn:length(assertion.chainedAuthentications[fn:length(assertion.chainedAuthentications)-1].principal.attributes)-1}"
step="1">
<cas:${fn:escapeXml(attr.key)}>${fn:escapeXml(attr.value)}</cas:${fn:escapeXml(attr.key)}>
</c:forEach>
</cas:attributes>
</c:if>
</cas:authenticationSuccess>
</cas:serviceResponse>
客户端配|?
1.qo器CAS Validation FilterQ?br />
<filter>
<filter-name>CAS Validation Filter</filter-name>
<filter-class> org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
<init-param>
<param-name>casServerUrlPrefix</param-name>
<param-value>http://domainserver:8081/cas</param-value>
</init-param>
</filter>
在客L获取信息
AttributePrincipal principal = (AttributePrincipal) request.getUserPrincipal();
String loginName = principal.getName();//获取用户?br />
Map<String, Object> attributes = principal.getAttributes();
if(attributes != null) {
System.out.println(attributes.get("userId"));
System.out.println(attributes.get("passwordHint"));
}
以sys用户登陆q创建Trigger:
create or replace TRIGGER ON_CONNECT AFTER LOGON ON DATABASE
DECLARE
guser varchar2(30);
begin
SELECT sys_context('USERENV','SESSION_USER') into guser FROM dual;
if (guser='ofbiz' or guser='OFBIZ') THEN
EXECUTE IMMEDIATE 'alter session set nls_timestamp_format = ''YYYY-MM-DD HH24:MI:SS.FF''';
end if;
end;
注意对登陆用户名的判断必d写都要考虑.
另:ofbiz用户不能拥有dba的权限,同时ofbiz用户比需要有UNLIMITED TABLESPACE的权限,否则在创建数据表的时候会?#8220;数据库空间不?#8221;的错误,D无法创徏表?br />