SSO学习有CAS SSO配置

allenzhou — Tue, 07 Nov 2006 07:37:00 GMT

CAS SSO��大学开发的一个开源的SSO(单点��d��pȝ��),下蝲地址�?

http://www.ja-sig.org/products/cas/

目前SSO应用较�ؓ�q�泛�Q�IBM,BEA都有自己商业�Ҏ��Q�一般如有Portal�Q�都会应用SSO.

Sun成立了OpenSSO.�Q�在�q�行SSO的开发�?/div>

.net主要有passport�Ҏ��

另有一个java开源的JOSSO�Q�不�q�网上评价不高，

CAS目前讨论得比较多的地�Ҏ��BEA�q�州UserGroup�Q�地址�?

http://dev2dev.bea.com.cn/bbs/forum.jspa?forumID=29304&start=0

版主为David�Q�java安全信息的专�Ӟ��对cas有很��q��研究�Q�他的blog�?/div>

m.tkk7.com/security

http://m.tkk7.com/openssl

http://security.javaeye.com/

当然SSO也可以自��q��写，关键是多个应用如何共享用户信息及数据安全�Q�以及如何跨语言�Q�跨域等.

可以参考fins的一��文�?http://fins.javaeye.com/blog/31947)�?/div>

王昱的一�?http://biaoming.spaces.live.com/blog/cns!905abeb7a7abc122!118.entry)

以上都是��Z��java的实�?

.net中的自己�~�写实现�?a >http://www.asp121.com/wlbc/23/430.shtml

CAS只提供一个简单的�w�分认证�Q�认证方式很��单，只要用户名和密码相同�Q�即通过�Q�如果应用数据库验证�Q�还需要自��q��写。授权和权限没有提供�Q�留�l�子�pȝ��d��?/div>

CAS demo中的asp例子�Q�可能不大完善，主要原因可以是，在tomcat中徏立了和casserver的信任，但在IIS�q�没有。需要在IIS中徏立证书，加入SSL.如需要更好的应用需要多了解SSL和PKI�Q�及SSL在CasServer和CasClient之间ticket的交�?

如果应用CAS�Q�还需要做的是�Q�如何将yale的登录模块，定制成自己应用的Login模块.

在tomcat中配�|�CAS�q�程如下:

1:建立证书

keytool -genkey -alias tomcat -keyalg RSA -keystore tomcat.keystore

在输入用户名�Ӟ��如果是本��输入localhost�Q�否则输入域�?/div>

2:导入证书

keytool -export -file myserver.cert -alias tomcat ?keystore tomcat.keystore

3:导入到JVM�?/div>

keytool -import -keystore d:\jdk\jre\lib\security\cacerts(�Ҏ��jdk的安装位�|�输�? -file myserver.cert -alias tomcat

以上操作最好放在tomcat的home目录下徏立，需要熟悉jdk的命�?keytool

开放SSL 8443端口

�~�辑tomcat的配�|�文件server.xml�Q�去掉下面SSL Connector的注�?修改为如下：

maxThreads="150" minSpareThreads="25" maxSpareThreads="75"

enableLookups="false" disableUploadTimeout="true"

acceptCount="100" debug="0" scheme="https" secure="true"

clientAuth="false" sslProtocol="TLS" >

keystoreFile="jama.keystore"

keystorePass="xx" clientAuth="false" protocol="TLS" />

keystorePass为徏立证书的密码

keystoreFile为徏立证书的文�g

5.��CAS server3.0.2中target目录中的CAS.war复制�?tomcat_home%\webapps目录�?

�Q�或者\cas-server-2.0.12\lib目录中的CAS.war也可以）

6.��cas-client-java-2.1.1\dist\casclient.jar文�g复制�?tomcat_home%\webapps\servlets-examples\WEB-INF\lib�?没有lib文�g夹，自己��Z��?

修改tomcat自带的servlet-examples的web.xml, 加入cas的过滤器:

CASFilter

edu.yale.its.tp.cas.client.filter.CASFilter

edu.yale.its.tp.cas.client.filter.loginUrl

https://localhost:8443/cas/login

edu.yale.its.tp.cas.client.filter.validateUrl

https://localhost:8443/cas/proxyValidate

edu.yale.its.tp.cas.client.filter.serverName

localhost:8080

CASFilter

6.启动tomcat !,CAS.war文�g被自动在webapps下释攑և�CAS目录

�q�入http://localhost:8080/servlets-examples, 被自动�{发到CAS的登陆页�?

输入相同的用户名和密码，之后跌��{回原来页�?/div>

注意�Q?/div>

在制作一个自�{�֐�的credential�? 在生成keystore文�g的时候密码是:changeit(�q�是tomcat默认�?,你的名字一定要�?localhost,当然�q�是你需要把CAS client和CAS server攑֜�同一台机器上�q�行��试用的

在浏览器-工具-internet选项里导入myserver.cert后就不会出现安全警报

IIS中配�|?/font>

��asp demo的cas.asp copy到某一虚拟目录�?本例中徏立了一个虚拟目录test

修改cas.asp内容�Q�见�U�色内容

<%@ Language=JScript %>

// Sample ASP code that uses CAS

// By Howard Gilbert

// If you logon, it says "Hello " followed by your userid

// For the Web server to talk to the CAS server, this code depends on the

// Microsoft ServerXMLHTTP control provided with MSXML. If the MS XML

// parser is not already installed on the IIS host machine,

// download version 3.0 SP1 or better from http://www.microsoft.com/xml

// Insert name of CAS Server at your location

//var CAS_Server = "https://secure.its.yale.edu/cas/servlet/";

var CAS_Server = "https://localhost:8443/cas/"; --cas验证服务器地址

// Insert public name of IIS Server hosting this script

// Note: Request.ServerVariables("SERVER_NAME") or anything based on

// the HTTP "Host" header should NOT be used; this header is supplied by

// the client and isn't trusted. (--SB)

var MyServer = "http://192.168.0.11/test/"; //此处��拟目录�\�?/strong>

var http = Server.CreateObject("MSXML2.ServerXMLHTTP.4.0");

var url =CAS_Server+"validate?ticket="+ticket+"&"+

"service="+MyServer+"HelloCas/default.asp"; //认证通过后�{向的��面

//�q�里转向HelloCas/default.asp 所以需要在test目录中徏立HelloCas目录和default.asp

http.open("GET",url,false); // HTTP transaction to CAS server

http.send();

var resp=http.responseText.split('\n'); // Lines become array members

if (resp[0]=="yes") // Logon successful

greeting=resp[1]; // get userid for message

Session.Contents("Netid")=resp[1]; // Save for subsequent calls

}

CAS ASP Example application

Hello <%=greeting%>

Asp.net中调�?

建立CASP.cs文�g�Q�内容如�?

在其它处调用�q�个文�g.

/**

CASP.cs

CAS over ASP.NET!

* Created by John Tantalo, john.tantalo@case.edu

* Case Western Reserve University

* Modification History:

* 12/09/05 jnt5, created class

* 12/12/05 jnt5, removed cookie check

* stores CASNetworkID in session instead of cache

* clears Page session variable after ticket verification

* 12/13/05 jnt5, removed Page session variable

* fixed bug which would cause loop due to incorrect service parameter

* 04/04/06 jnt5, adapted serviceURL code courtesy Ali Cakmak

* 04/10/06 jnt5, added new comments

* References:

* http://wiki.case.edu/Central_Authentication_Service

* https://clearinghouse.ja-sig.org/wiki/display/CAS/CAS+2.0+Protocol+Specification

//以上为正式文�?/div>

using System ;
using System.Web.UI ;
using System.Net ;
using System.IO ;
using System.Web.SessionState;

/**    调用方式
  * CASP general usage: 使用�Ҏ��　
  *
*      private void Page_Load(object sender, System.EventArgs e)
*      {
*            String NetworkID = CASP.Authenticate( "https://login.case.edu/cas/login", "https://login.case.edu/cas/validate", this ) ;
*      }
*/

public class CASP
{
     /**
      * Authenticates a user with the given login and validation pages. After authentication
         * the user's browser is redirected to the original page.
     */

        public static String Authenticate( String LoginURL, String ValidateURL, Page Page )
         {
                return Authenticate( LoginURL, ValidateURL, Page, Page.Request.Url.AbsoluteUri.Split('?')[0] ) ;
        }

        /**
         * Authenticates a user with the given login and validation pages. After authentication
         * the user's browser is redirected to the location given as the service URL.
          */
         public static String Authenticate( String LoginURL, String ValidateURL, Page Page, String ServiceURL )
        {
                if( Page.Session["CASNetworkID"] != null ) // user already logged in
                        return Page.Session["CASNetworkID"].ToString() ;
               else // user hasn't logged in
              {
                       if( Page.Request.QueryString["ticket"] != null ) // ticket received
                       {
                              try // read ticket and request validation
                              {
                                        StreamReader Reader = new StreamReader( new WebClient().OpenRead( ValidateURL + "?ticket=" + Page.Request.QueryString["ticket"] + "&service=" + ServiceURL ) ) ;
                                                                      if( "yes".Equals( Reader.ReadLine() ) ) // ticket validated
                                       {
                                               // store network id in sesssion, return value

                                                return (String) ( Page.Session["CASNetworkID"] = Reader.ReadLine() ) ;

                                        }
                              }
                               catch( WebException ) {}
                       }

                         // ticket was invalid, or didn't exist, so request ticket

                        Page.Response.Redirect( LoginURL + "?service=" + ServiceURL, true ) ;
                        return null ;
                 }
         }
}

allenzhou 2006-11-07 15:37 发表评论

亚洲变态另类一区二区三区,精品亚洲麻豆1区2区3区,337p日本欧洲亚洲大胆裸体艺术

SSO学习有CAS SSO配置