cas+tomcat+shiro实现单点登录-4-Apache Shiro 集成Cas作为cas client端实现

时间：2023-03-09 02:58:22
cas+tomcat+shiro实现单点登录-4-Apache Shiro 集成Cas作为cas client端实现

目录

1.tomcat添加https安全协议

2.下载cas server端部署到tomcat上

3.CAS服务器深入配置(连接MYSQL)

4.Apache Shiro 集成Cas作为cas client端实现

Apache Shiro 集成Cas作为cas client端实现

第一步、添加maven依赖

　　　　 <!-- shiro依赖包 -->

        <!-- <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-quartz</artifactId> <version>${shiro.version}</version> </dependency> -->

        <dependency>

            <groupId>org.apache.shiro</groupId>

            <artifactId>shiro-ehcache</artifactId>

            <version>${shiro.version}</version>

        </dependency>

        <dependency>

            <groupId>org.apache.shiro</groupId>

            <artifactId>shiro-spring</artifactId>

            <version>${shiro.version}</version>

        </dependency>

        <!-- shiro-cas集成依赖包 -->

        <dependency>

            <groupId>org.apache.shiro</groupId>

            <artifactId>shiro-cas</artifactId>

            <version>${shiro.version}</version>

        </dependency>

第二步、添加spring-shiro.xml配置文件

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:aop="http://www.springframework.org/schema/aop"

    xmlns:tx="http://www.springframework.org/schema/tx" xmlns:context="http://www.springframework.org/schema/context" xmlns:util="http://www.springframework.org/schema/util"

    xsi:schemaLocation="

     http://www.springframework.org/schema/beans

     http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

     http://www.springframework.org/schema/context

     http://www.springframework.org/schema/context/spring-context-3.0.xsd

     http://www.springframework.org/schema/util

     http://www.springframework.org/schema/util/spring-util-3.0.xsd"

    default-lazy-init="true">

    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

        <property name="securityManager" ref="securityManager" />

        <!-- 设定角色的登录链接，这里为cas登录页面的链接可配置回调地址 -->

        <property name="loginUrl" value="http://192.168.20.248:8080/cas/login?service=http://127.0.0.1:8080/nhmz/shiro-cas" />

        <property name="successUrl" value="/index.htm"></property>

        <property name="filters">

            <util:map>

                <entry key="casFilter" value-ref="casFilter" />

                <entry key="logout" value-ref="logout" />

            </util:map>

        </property>

        <property name="filterChainDefinitions">

            <value>

                /shiro-cas=casFilter

                /logout.htm=logout

                /login.htm=authc

                /xzqh/**=authc

                /tjfx/**=authc

                /gxfw/**=authc

                /xtsz/**=authc

                /region/**=authc

                /shareApi/**=authc

                /**=anon

            </value>

        </property>

    </bean>

    <!-- shiro-cas登录过滤器 -->

    <bean id="casFilter" class="org.apache.shiro.cas.CasFilter">

        <!-- 配置验证错误时的失败页面 ，这里配置为登录页面 -->

        <property name="failureUrl" value="http://192.168.20.248:8080/cas/login?service=http://127.0.0.1:8080/nhmz/shiro-cas" />

    </bean>

    <!-- 退出登录过滤器 -->

    <bean id="logout" class="org.apache.shiro.web.filter.authc.LogoutFilter">

        <property name="redirectUrl" value="http://192.168.20.248:8080/cas/logout?service=http://127.0.0.1:8080/nhmz/index.htm" />

    </bean>

   <!-- 自定义casRealm -->

    <bean id="casRealm" class="com.ld.nhmz.shiro.MzCasRealm">

        <!-- <property name="defaultRoles" value="ROLE_USER" /> -->

        <!-- 配置cas服务器地址 -->

        <property name="casServerUrlPrefix" value="http://192.168.20.248:8080/cas" />

        <!-- 客户端的回调地址设置，必须和上面的shiro-cas过滤器casFilter拦截的地址一致 -->

        <property name="casService" value="http://127.0.0.1:8080/nhmz/shiro-cas" />

    </bean>

    <!--缓存机制 -->

    <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">

        <property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml" />

    </bean>

    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

        <property name="realm" ref="casRealm" />

        <property name="subjectFactory" ref="casSubjectFactory" />

        <property name="cacheManager" ref="cacheManager" />

    </bean>

    <!-- 如果要实现cas的remember me的功能，需要用到下面这个bean，并设置到securityManager的subjectFactory中 -->

    <bean id="casSubjectFactory" class="org.apache.shiro.cas.CasSubjectFactory" />

    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

    <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">

        <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager" />

        <property name="arguments" ref="securityManager" />

    </bean>

</beans>

这里由于前端的每一个操作shiro都会做登录和权限认证，所以上面配置添加了缓存机制

cas+tomcat+shiro实现单点登录-4-Apache Shiro 集成Cas作为cas client端实现

所以在classpath目录下还要添加缓存而配置文件ehcache-shiro.xml，配置如下：

<?xml version="1.1" encoding="UTF-8"?>

<ehcache name="shirocache">

    <diskStore path="java.io.tmpdir"/>

     <defaultCache

        maxElementsInMemory="2000"

        eternal="false"

        timeToIdleSeconds="120"

        timeToLiveSeconds="120"

        overflowToDisk="true"

        />

<!--     <cache name="diskCache"

           maxEntriesLocalHeap="2000"

           eternal="false"

           timeToIdleSeconds="300"

           timeToLiveSeconds="0"

           overflowToDisk="false"

           statistics="true">

    </cache> -->

    <cache name="passwordRetryCache"

           maxElementsInMemory="2000"

           eternal="false"

           timeToIdleSeconds="300"

           timeToLiveSeconds="0"

           overflowToDisk="false"

           >

    </cache>

    <cache name="authorizationCache"

           maxElementsInMemory="2000"

           eternal="false"

           timeToIdleSeconds="1800"

           timeToLiveSeconds="0"

           overflowToDisk="false"

           >

    </cache>

    <cache name="authenticationCache"

           maxElementsInMemory="2000"

           eternal="false"

           timeToIdleSeconds="1800"

           timeToLiveSeconds="0"

           overflowToDisk="false"

           >

    </cache>

    <cache name="shiro-activeSessionCache"

           maxElementsInMemory="2000"

           eternal="false"

           timeToIdleSeconds="1800"

           timeToLiveSeconds="0"

           overflowToDisk="false"

           >

    </cache>

</ehcache>

第三步、添加<bean id="casRealm" class="com.ld.nhmz.shiro.MzCasRealm">配置的自定义实现类

package com.ld.nhmz.shiro;

import java.util.List;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.AuthenticationInfo;

import org.apache.shiro.authc.AuthenticationToken;

import org.apache.shiro.authz.AuthorizationInfo;

import org.apache.shiro.authz.SimpleAuthorizationInfo;

import org.apache.shiro.cas.CasRealm;

import org.apache.shiro.subject.PrincipalCollection;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.transaction.annotation.Transactional;

import com.ld.nhmz.ebo.SusRoleEntity;

import com.ld.nhmz.ebo.SusUserEntity;

import com.ld.nhmz.service.SusRolePermissionService;

import com.ld.nhmz.service.SusRoleService;

import com.ld.nhmz.service.SusUserService;

//@Service

@SuppressWarnings("deprecation")

@Transactional(value = "nhmzTM")

public class MzCasRealm extends CasRealm {

    @Autowired

    private SusUserService userService;

    @Autowired

    private SusRolePermissionService rolePermissionService;

    @Autowired

    private SusRoleService roleService;

    /**

     * 授权访问控制，用于对用户进行的操作进行人证授权，证明该用户是否允许进行当前操作，如访问某个链接，某个资源文件等

     */

    @Override

    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

        String username = (String) principals.getPrimaryPrincipal();

        SusUserEntity user = userService.findByUsername(username);

        if (user != null) {

            SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();

            // 设置用户的角色

            String roleId = userService.getRoleIdFromUserId(user.getId());

            SusRoleEntity roleEntity = roleService.getRole(roleId);

            if (null != roleEntity)

                authorizationInfo.addRole(roleEntity.getRolecode());

            // 设置用户对应的角色的权限集合

            List<String> permissons;

            try {

                permissons = rolePermissionService.getPermissionIds2(roleId);

                for (String permission : permissons) {

                    authorizationInfo.addStringPermission(permission);

                }

            } catch (Exception e) {

                e.printStackTrace();

            }

            return authorizationInfo;

        }

        return null;

    }

    /**

     * 验证用户身份

     */

    @Override

    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

        return super.doGetAuthenticationInfo(token);

    }

    @Override

    public void clearCachedAuthorizationInfo(PrincipalCollection principals) {

        super.clearCachedAuthorizationInfo(principals);

    }

    @Override

    public void clearCachedAuthenticationInfo(PrincipalCollection principals) {

        super.clearCachedAuthenticationInfo(principals);

    }

    @Override

    public void clearCache(PrincipalCollection principals) {

        super.clearCache(principals);

    }

    public void clearAllCachedAuthorizationInfo() {

        getAuthorizationCache().clear();

    }

    public void clearAllCachedAuthenticationInfo() {

        getAuthenticationCache().clear();

    }

    public void clearAllCachedKickoutInfo() {

    }

    public void clearAllCache() {

        clearAllCachedAuthenticationInfo();

        clearAllCachedAuthorizationInfo();

        clearAllCachedKickoutInfo();

    }

}

第四步、将spring-shiro.xml配置文件导入到spring的配置文件中，注意配置文件间的相对路径

cas+tomcat+shiro实现单点登录-4-Apache Shiro 集成Cas作为cas client端实现

第五步、web.xml中添加shiro过滤器

<!-- shiro filter的名字是shiroFilter,那么在spring的配置文件中要有一个名字为shiroFilter的bean -->

    <filter>

        <filter-name>shiroFilter</filter-name>

        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

        <init-param>

            <param-name>targetFilterLifecycle</param-name>

            <param-value>true</param-value>

        </init-param>

    </filter>

    <filter-mapping>

        <filter-name>shiroFilter</filter-name>

        <url-pattern>/*</url-pattern>

    </filter-mapping>

以上步骤完成，shiro集成cas的步骤就完成了，实现了单点登录和单点注销登录。

相关文章