Question

我正在通过CAS在Java EE环境中实现单点登录+单点登出。

在身份验证方面，我有cas-server-webapp v4.0.1。然后是2个带有cas-client-corev3.1.10的简单Java + Spring MVC Web应用程序。

没有关于单点登录的问题。如果我访问/ app1，我将被重定向到cas-server-webapp中的cas登录页面。用户+传递输入后，我被重定向到/ app1正确验证。另外，如果我导航到/ app2，这个获取其身份验证票。到目前为止一切都很好。

至于单点退出，也许我误解了 doc ：但这就是我的所作所为：

app1和app2每个都有一个Spring控制器映射为/ logout url：

@Controller
public class LogoutController {

    @RequestMapping("/logout")
    public String logout(HttpSession session){
        session.invalidate();
        return "redirect:https://cas-server-host:8443/cas/logout?service=http://cas-server-host:9080/cas1/action/index";
    }
}

也就是说，我使http会话无效并重定向到cas服务器注销URL，以使票证失效。

在cas服务器日志中，我看到它会销毁TGT票证并向每个应用程序的CAS过滤器发送注销请求：

DEBUG [org.jasig.cas.CentralAuthenticationServiceImpl] - <Removing ticket [TGT-9-inxrphuRfIFpkbPTvNf6v1bAx7RlR7IMeMUFU0aokNCdbZ43Ij-cas01.example.org] from registry.>
DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - <Attempting to retrieve ticket [TGT-9-inxrphuRfIFpkbPTvNf6v1bAx7RlR7IMeMUFU0aokNCdbZ43Ij-cas01.example.org]>
DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - <Ticket [TGT-9-inxrphuRfIFpkbPTvNf6v1bAx7RlR7IMeMUFU0aokNCdbZ43Ij-cas01.example.org] found in registry.>
DEBUG [org.jasig.cas.CentralAuthenticationServiceImpl] - <Ticket found. Processing logout requests and then deleting the ticket...>
DEBUG [org.jasig.cas.logout.SamlCompliantLogoutMessageCreator] - <Generated logout message: [<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="LR-13-TfRj1HnvAjpBjNIdaDvDMJUMXk7wffdXgB5" Version="2.0" IssueInstant="2015-02-10T12:18:18Z"><saml:NameID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">@NOT_USED@</saml:NameID><samlp:SessionIndex>ST-16-aXpUJpwO4MQ09caXZRKX-cas01.example.org</samlp:SessionIndex></samlp:LogoutRequest>]>
DEBUG [org.jasig.cas.logout.LogoutManagerImpl] - <Sending logout request for: [http://localhost:9080/cas2]>
DEBUG [org.jasig.cas.util.SimpleHttpClient] - <Attempting to access http://localhost:9080/cas2>
DEBUG [org.jasig.cas.logout.SamlCompliantLogoutMessageCreator] - <Generated logout message: [<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="LR-14-BaKvuaIbwxg9Le9H3QIvWORfNSE0dxaxsCE" Version="2.0" IssueInstant="2015-02-10T12:18:20Z"><saml:NameID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">@NOT_USED@</saml:NameID><samlp:SessionIndex>ST-15-zaX6aojKs0PiggCles6J-cas01.example.org</samlp:SessionIndex></samlp:LogoutRequest>]>
DEBUG [org.jasig.cas.util.SimpleHttpClient] - <Finished sending message to http://localhost:9080/cas2>
DEBUG [org.jasig.cas.logout.LogoutManagerImpl] - <Sending logout request for: [http://localhost:9080/cas1]>
DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - <Removing ticket [TGT-9-inxrphuRfIFpkbPTvNf6v1bAx7RlR7IMeMUFU0aokNCdbZ43Ij-cas01.example.org] from registry>
DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - <Attempting to retrieve ticket [TGT-9-inxrphuRfIFpkbPTvNf6v1bAx7RlR7IMeMUFU0aokNCdbZ43Ij-cas01.example.org]>
DEBUG [org.jasig.cas.util.SimpleHttpClient] - <Attempting to access http://localhost:9080/cas1>
INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
=============================================================
WHO: audit:unknown
WHAT: TGT-9-inxrphuRfIFpkbPTvNf6v1bAx7RlR7IMeMUFU0aokNCdbZ43Ij-cas01.example.org
ACTION: TICKET_GRANTING_TICKET_DESTROYED
APPLICATION: CAS
WHEN: Tue Feb 10 12:18:20 CET 2015
CLIENT IP ADDRESS: 192.168.13.164
SERVER IP ADDRESS: 192.168.13.164
=============================================================

现在，假设我从/ cas1注销，我被发送回cas-server登录页面。如果我没有再次登录，如果我访问/ app2，我可以导航这个应用程序，好像我仍然经过身份验证，我可以访问它的java.user.Principal和session。这怎么可能？ / app2中收到的注销请求是否应该销毁了Principal和http会话？

Answer 1

......我的错，正如所料，我错过了一些东西。我必须在两个应用程序中包含单点登录过滤器和监听器：

    <filter>   
        <filter-name>CAS Single Sign Out Filter</filter-name>   
        <filter-class>org.jasig.cas.client.session.SingleSignOutFilter
        </filter-class>
    </filter>
    <filter-mapping>   
        <filter-name>CAS Single Sign Out Filter</filter-name>   
        <url-pattern>/*</url-pattern></filter-mapping>
    <listener>    
        <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
    </listener>

    <filter>  
        <filter-name>CAS Authentication Filter</filter-name>  
        <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>  
        <init-param>  
            <param-name>casServerLoginUrl</param-name>  
            <param-value>https://cas-server-host:8443/cas/login</param-value>  
        </init-param>  
        <init-param>  
            <param-name>service</param-name>  
            <param-value>http://localhost:9080/cas1</param-value>  
        </init-param>  
    </filter>
     <filter-mapping>  
        <filter-name>CAS Authentication Filter</filter-name>  
        <url-pattern>/*</url-pattern>  
    </filter-mapping>  

    <filter>  
        <filter-name>CAS Validation Filter</filter-name>  
        <filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>  
        <init-param>  
            <param-name>casServerUrlPrefix</param-name>  
            <param-value>https://cas-server-host:8443/cas/</param-value>  
        </init-param>  
        <init-param>  
            <param-name>service</param-name>  
            <param-value>http://localhost:9080/cas1</param-value>  
        </init-param>  
    </filter> 
    <filter-mapping>  
        <filter-name>CAS Validation Filter</filter-name>  
        <url-pattern>/*</url-pattern>  
    </filter-mapping>   

    <filter>  
        <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>  
        <filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>  
    </filter>  
    <filter-mapping>  
        <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>  
        <url-pattern>/*</url-pattern>  
    </filter-mapping>

CAS单点注销无效

1 个答案: