Question

我正在使用最新版本的spring 3.2.5和spring security 3.1.4 with java 6.我已经使用此页面中的说明设置了CAS服务器 https://wiki.jasig.org/display/CASUM/Best+Practice+-+Setting+Up+CAS+Locally+using+the+Maven+WAR+Overlay+Method

CAS服务器部分正常运行并进行身份验证。我已经使用此页面中的说明和其他各种页面设置了客户端 https://wiki.jasig.org/display/CASC/Configuring+the+JA-SIG+CAS+Client+for+Java+using+Spring

当尝试在应用程序中输入安全页面时，CAS会重定向到正确的登录页面，然后正确进行身份验证，然后正确地重定向到调用应用程序页面，但不会调用所提供的用户详细信息服务而不是授权用户而不是使用用户详细信息服务加载角色。

验证后，用户登陆此页面。该页面是正确的，但我不希望在URL中看到ticket参数，并且还使用提供的用户详细信息服务bean加载用户和角色。

http://localhost:8080/my/sports-life/schedule?ticket=ST-3-xklhdGJW6gZxieELGxo5-cas01.example.org

我非常感谢任何获得授权的指示。提前谢谢。

以下是应用程序上下文中的相关bean

<!--  Single sign on with CAS   -->


    <bean id="casEntryPoint" class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
        <property name="loginUrl" value="https://localhost:8443/cas/login"/>
        <property name="serviceProperties" ref="serviceProperties"/>
    </bean>

    <bean id="serviceProperties" class="org.springframework.security.cas.ServiceProperties">
        <property name="service" value="http://localhost:8080/my/sports-life/schedule/j_spring_cas_security_check"/>
        <property name="sendRenew" value="false"/>
    </bean>

    <bean id="casFilter" class="org.springframework.security.cas.web.CasAuthenticationFilter">
        <property name="authenticationManager" ref="preAuthenticationManager"/>

        <property name="authenticationSuccessHandler">
            <bean class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
                <property name="defaultTargetUrl" value="/my"/>
                <property name="targetUrlParameter" value="spring-security-redirect" />
            </bean>
        </property>
    </bean>

    <bean id="casAuthenticationProvider" class="org.springframework.security.cas.authentication.CasAuthenticationProvider">

        <property name="userDetailsService" ref="myAccountDetailsService" />
        <property name="serviceProperties" ref="serviceProperties" /> 
        <property name="ticketValidator">
            <bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
                <constructor-arg index="0" value="https://localhost:8443/cas" />
            </bean>
        </property>
        <property name="key" value="Vi9Pra88Si777"/> 
        <property name="authenticationUserDetailsService" ref="authenticationUserDetailsService"/>
     </bean> 

    <bean id="authenticationUserDetailsService" class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">    
        <property name="userDetailsService" ref="myAccountDetailsService"/>      
    </bean> 



    <bean name="authenticationFilter" class="org.jasig.cas.client.authentication.AuthenticationFilter">
        <property name="casServerLoginUrl" value="https://localhost:8443/cas/login" /> 
        <property name="renew" value="false" />
        <property name="gateway" value="false" />
        <property name="service" value="http://localhost:8080/my/sports-life/schedule" />
     </bean>

<!--  
<bean
    name="ticketValidationFilter"
    class="org.jasig.cas.client.validation.Cas10TicketValidationFilter">

    <property name="service" value="http://localhost:8080/my/sports-life/schedule" />
    <property name="ticketValidator">
            <bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
                <constructor-arg index="0" value="https://localhost:8443/cas" />
            </bean>
    </property>
</bean>
-->

  <bean id="preauthAuthProvider"
class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
    <property name="preAuthenticatedUserDetailsService">
      <bean id="userDetailsServiceWrapper"
          class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
        <property name="userDetailsService" ref="myAccountDetailsService"/>
      </bean>
    </property>
    </bean>

    <!--  
 <bean id="preAuthEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" />

    <bean id="j2eePreAuthFilter" class="org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter">
        <property name="authenticationManager" ref="preAuthenticationManager"/>
        <property name="authenticationDetailsSource">
            <bean class="org.springframework.security.web.authentication.WebAuthenticationDetailsSource" />
        </property>
 </bean>
  -->

      <bean id="myAccountDetailsService" class="com.viprasi.security.AccountDetailsServiceImpl">        
     </bean>

然后是我的spring安全配置文件中的相关配置。

<http use-expressions="true" entry-point-ref="casEntryPoint">

        <intercept-url pattern="/app/j_spring_cas*" access="permitAll"
            requires-channel="https" />


        <!-- Member -->
        <intercept-url pattern="/app/**" access="isAuthenticated()" />


        <access-denied-handler error-page="/app/login/accessdenied" />

        <anonymous />

        <http-basic />

        <custom-filter position="CAS_FILTER" ref="casFilter" />

    </http>

     <authentication-manager alias="preAuthenticationManager">

      <authentication-provider ref="casAuthenticationProvider" />
      <!-- 
      <authentication-provider user-service-ref='accountDetailsService' />
      -->
    </authentication-manager>

Answer 1

我认为匿名标记将角色* IS_AUTHENTICATED_ANONYMOUSLY *应用于用户。结果是用户isAuthenticated（）并且没有调用进一步的过滤器（例如调用UserDetailsServive的那个）将isAuthenticated（）更改为hasRole（'ROLE'）

Answer 2

我有一个示例cas client您可以在cas-web-client中查看如何提供自己的授权

Answer 3

我们遇到了很多问题，最后主要的罪魁祸首是网址重写过滤器。此过滤器正在更改URL，然后Spring安全性和cas无法处理更改的URL。在安全过滤器下方移动url重写过滤器后，它们全部开始工作。

CAS Spring Security Java - 未使用用户详细信息授权服务未加载角色

3 个答案: