單點CAS搭建服務端+客戶端

server端：
1:從github下載cas-server-webapp-3.4.12
2:導入eclipse,修改deployerConfigContext.xml
3:因此項目中的JSP用的jquery組件是google cdn,頁面加載不出來，需要更換下cdn

替換

<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
        <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.8.5/jquery-ui.min.js"></script>


<script src="http://code.jquery.com/jquery-1.4.2.min.js"></script>
<script type="text/javascript" src="http://code.jquery.com/ui/1.8.5/jquery-ui.min.js</script>

mysql建用戶表

create database cas ;
—授權...
DROP TABLE IF EXISTS `user`;
CREATE TABLE `user` (
  `id` bigint(11) unsigned NOT NULL AUTO_INCREMENT,
  `login_name` varchar(25) NOT NULL,
  `password` varchar(40) NOT NULL,
  `email` varchar(20) DEFAULT '',
  `enabled` tinyint(1) NOT NULL DEFAULT '0',
  `role` varchar(10) NOT NULL DEFAULT '',
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8;


-- ----------------------------
--  Records of `user`
-- ----------------------------
BEGIN;
INSERT INTO `user` VALUES ('1', ’nick', ‘ MD5PasswordEncoder加密', '[email protected]', '1', 'ROLE_USER'), ('2', 'cas', ‘ MD5PasswordEncoder加密', '[email protected]', '1', 'ROLE_ADMIN');
COMMIT;

SET FOREIGN_KEY_CHECKS = 1;

客戶端
客戶端示例代碼從https://github.com/henrycm/Spring-Security-CAS/trunk 檢出
1:修改spring-cas.xml
2:修改tomcat的server.xml配置，添加證書。證書可以直接用項目/src/keys中的證書

測試代碼下載地址 http://pan.baidu.com/s/1mg7tW6G

deployerConfigContext.xml內容如下：

<?xml version="1.0" encoding="UTF-8"?>
<!-- | deployerConfigContext.xml centralizes into one file some of the declarative 
    configuration that | all CAS deployers will need to modify. | | This file 
    declares some of the Spring-managed JavaBeans that make up a CAS deployment. 
    | The beans declared in this file are instantiated at context initialization 
    time by the Spring | ContextLoaderListener declared in web.xml. It finds 
    this file because this | file is among those declared in the context parameter 
    "contextConfigLocation". | | By far the most common change you will need 
    to make in this file is to change the last bean | declaration to replace 
    the default SimpleTestUsernamePasswordAuthenticationHandler with | one implementing 
    your approach for authenticating usernames and passwords. + -->
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
    xmlns:sec="http://www.springframework.org/schema/security"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
       http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
    <!-- | This bean declares our AuthenticationManager. The CentralAuthenticationService 
        service bean | declared in applicationContext.xml picks up this AuthenticationManager 
        by reference to its id, | "authenticationManager". Most deployers will be 
        able to use the default AuthenticationManager | implementation and so do 
        not need to change the class of this bean. We include the whole | AuthenticationManager 
        here in the userConfigContext.xml so that you can see the things you will 
        | need to change in context. + -->
    <bean id="authenticationManager" class="org.jasig.cas.authentication.AuthenticationManagerImpl">
        <!-- | This is the List of CredentialToPrincipalResolvers that identify 
            what Principal is trying to authenticate. | The AuthenticationManagerImpl 
            considers them in order, finding a CredentialToPrincipalResolver which | 
            supports the presented credentials. | | AuthenticationManagerImpl uses these 
            resolvers for two purposes. First, it uses them to identify the Principal 
            | attempting to authenticate to CAS /login . In the default configuration, 
            it is the DefaultCredentialsToPrincipalResolver | that fills this role. If 
            you are using some other kind of credentials than UsernamePasswordCredentials, 
            you will need to replace | DefaultCredentialsToPrincipalResolver with a CredentialsToPrincipalResolver 
            that supports the credentials you are | using. | | Second, AuthenticationManagerImpl 
            uses these resolvers to identify a service requesting a proxy granting ticket. 
            | In the default configuration, it is the HttpBasedServiceCredentialsToPrincipalResolver 
            that serves this purpose. | You will need to change this list if you are 
            identifying services by something more or other than their callback URL. 
            + -->
        <property name="credentialsToPrincipalResolvers">
            <list>
                <!-- | UsernamePasswordCredentialsToPrincipalResolver supports the UsernamePasswordCredentials 
                    that we use for /login | by default and produces SimplePrincipal instances 
                    conveying the username from the credentials. | | If you've changed your LoginFormAction 
                    to use credentials other than UsernamePasswordCredentials then you will also 
                    | need to change this bean declaration (or add additional declarations) to 
                    declare a CredentialsToPrincipalResolver that supports the | Credentials 
                    you are using. + -->
                <!-- <bean class="org.jasig.cas.authentication.principal.UsernamePasswordCredentialsToPrincipalResolver" 
                    /> -->
                <!-- | HttpBasedServiceCredentialsToPrincipalResolver supports HttpBasedCredentials. 
                    It supports the CAS 2.0 approach of | authenticating services by SSL callback, 
                    extracting the callback URL from the Credentials and representing it as a 
                    | SimpleService identified by that callback URL. | | If you are representing 
                    services by something more or other than an HTTPS URL whereat they are able 
                    to | receive a proxy callback, you will need to change this bean declaration 
                    (or add additional declarations). + -->
                <!--  修改日期 on 2015-08-01,add user info -->

                <bean
                    class="org.jasig.cas.authentication.principal.UsernamePasswordCredentialsToPrincipalResolver">
                    <property name="attributeRepository">
                        <!-- 爲認證過的用戶的Principal添加屬性 -->
                        <ref local="attributeRepository" />
                    </property>
                </bean>
                <bean
                    class="org.jasig.cas.authentication.principal.HttpBasedServiceCredentialsToPrincipalResolver" />
            </list>
        </property>

        <!-- | Whereas CredentialsToPrincipalResolvers identify who it is some 
            Credentials might authenticate, | AuthenticationHandlers actually authenticate 
            credentials. Here we declare the AuthenticationHandlers that | authenticate 
            the Principals that the CredentialsToPrincipalResolvers identified. CAS will 
            try these handlers in turn | until it finds one that both supports the Credentials 
            presented and succeeds in authenticating. + -->
        <property name="authenticationHandlers">
            <list>
                <!-- | This is the authentication handler that authenticates services 
                    by means of callback via SSL, thereby validating | a server side SSL certificate. 
                    + -->
                <bean
                    class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler"
                    p:httpClient-ref="httpClient" />
                <!-- | This is the authentication handler declaration that every CAS 
                    deployer will need to change before deploying CAS | into production. The 
                    default SimpleTestUsernamePasswordAuthenticationHandler authenticates UsernamePasswordCredentials 
                    | where the username equals the password. You will need to replace this with 
                    an AuthenticationHandler that implements your | local authentication strategy. 
                    You might accomplish this by coding a new such handler and declaring | edu.someschool.its.cas.MySpecialHandler 
                    here, or you might use one of the handlers provided in the adaptors modules. 
                    + -->
                <bean
                    class="org.jasig.cas.adaptors.jdbc.QueryDatabaseAuthenticationHandler">

                    <property name="dataSource" ref="dataSource"></property>

                    <property name="sql"
                        value="select password from user where login_name=?"></property>
                    <!-- 用戶密碼編碼方式 -->
                    <property name="passwordEncoder" ref="MD5PasswordEncoder"></property>

                </bean>
            </list>
        </property>
    </bean>


    <!-- This bean defines the security roles for the Services Management application. 
        Simple deployments can use the in-memory version. More robust deployments 
        will want to use another option, such as the Jdbc version. The name of this 
        should remain "userDetailsService" in order for Spring Security to find it. -->
    <!-- <sec:user name="@@THIS SHOULD BE REPLACED@@" password="notused" authorities="ROLE_ADMIN" 
        /> -->

    <sec:user-service id="userDetailsService">
        <sec:user name="@@THIS SHOULD BE REPLACED@@" password="notused"
            authorities="ROLE_ADMIN" />
    </sec:user-service>

    <!-- Bean that defines the attributes that a service may return. This example 
        uses the Stub/Mock version. A real implementation may go against a database 
        or LDAP server. The id should remain "attributeRepository" though. -->
    <!-- 修改該文件中默認的 attributeRepositorybean配置 -->
    <!-- 在這裏配置獲取更多用戶的信息 -->
    <!-- <bean id="attributeRepository" class="org.jasig.services.persondir.support.StubPersonAttributeDao"> 
        <property name="backingMap"> <map> <entry key="uid" value="uid" /> <entry 
        key="eduPersonAffiliation" value="eduPersonAffiliation" /> <entry key="groupMembership" 
        value="groupMembership" /> </map> </property> </bean> -->
    <bean id="attributeRepository"
        class="org.jasig.services.persondir.support.jdbc.SingleRowJdbcPersonAttributeDao">
        <constructor-arg index="0" ref="dataSource" />
        <constructor-arg index="1"
            value="SELECT * FROM user WHERE {0} and enabled=1" />
        <property name="queryAttributeMapping">
            <map>
                <entry key="username" value="login_name" />
            </map>
        </property>
        <property name="resultAttributeMapping">
            <map>
                <entry key="login_name" value="login_name" />
                <entry key="id" value="uuid" />
                <entry key="password" value="password" />
                <entry key="email" value="email" />
                <entry key="role" value="role" />
            </map>
        </property>
    </bean>
    <!-- Sample, in-memory data store for the ServiceRegistry. A real implementation 
        would probably want to replace this with the JPA-backed ServiceRegistry DAO 
        The name of this bean should remain "serviceRegistryDao". -->
    <!-- 修改該xml文件中最後一個默認的serviceRegistryDao bean中的屬性全部註釋掉，或者刪除， 這個bean中的RegisteredServiceImpl的ignoreAttributes屬性將決定是否添加attributes屬性內容，默認爲false:不添加，只有去掉這個配置， 
        cas server纔會將獲取的用戶的附加屬性添加到認證用的Principal的attributes中去，我在這裏犯過這樣的錯誤，最後還是通過跟蹤源碼才發現的。 -->
    <bean id="serviceRegistryDao" class="org.jasig.cas.services.InMemoryServiceRegistryDaoImpl">
        <!-- <property name="registeredServices"> <list> <bean class="org.jasig.cas.services.RegexRegisteredService"> 
            <property name="id" value="0" /> <property name="name" value="HTTP and IMAP" 
            /> <property name="description" value="Allows HTTP(S) and IMAP(S) protocols" 
            /> <property name="serviceId" value="^(https?|imaps?)://.*" /> <property 
            name="evaluationOrder" value="10000001" /> </bean> Use the following definition 
            instead of the above to further restrict access to services within your domain 
            (including subdomains). Note that example.com must be replaced with the domain 
            you wish to permit. <bean class="org.jasig.cas.services.RegexRegisteredService"> 
            <property name="id" value="1" /> <property name="name" value="HTTP and IMAP 
            on example.com" /> <property name="description" value="Allows HTTP(S) and 
            IMAP(S) protocols on example.com" /> <property name="serviceId" value="^(https?|imaps?)://([A-Za-z0-9_-]+\.)*example\.com/.*" 
            /> <property name="evaluationOrder" value="0" /> </bean> </list> </property> -->
    </bean>

    <bean id="auditTrailManager"
        class="com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager" />
    <bean id="dataSource"
        class="org.springframework.jdbc.datasource.DriverManagerDataSource">

        <property name="driverClassName">
            <value>com.mysql.jdbc.Driver</value>
        </property>

        <property name="url">
            <!-- 如果使用mysql數據庫，應該加上後面的編碼參數，否則可能導致客戶端對TGT票據無法識別的問題 -->
            <value>jdbc:mysql://localhost:3306/cas?useUnicode=true&amp;characterEncoding=utf-8
            </value>
        </property>

        <property name="username">
            <value>root</value>
        </property>

        <property name="password">
            <value>數據庫密碼</value>
        </property>

    </bean>



    <bean id="MD5PasswordEncoder"
        class="org.jasig.cas.authentication.handler.DefaultPasswordEncoder">

        <constructor-arg index="0">
            <!-- cas server默認支持MD5和SHA1兩種編碼方式，如果需要其他的編碼方式例如SHA256,512等，可自行實現org.jasig.cas.authentication.handler.PasswordEncoder接口 -->
            <value>MD5</value>

        </constructor-arg>

    </bean>




</beans>