CAS与LDAP集成

2022-04-01 00:20:37

参考文献：

CAS集成ldap：https://wiki.jasig.org/display/CASUM/LDAP

CAS集成restful api：https://wiki.jasig.org/display/CASUM/RESTful+API

下载jar包

在参考文献当中，我们看到不论是集成ldap还是集成restful api都需要另外单独下载jar包。如果有maven的话，直接通过配置文件即可下载，但是当前我们没有配置，所以需要手动下载。Google搜索cas-server-support-ldap可以找到相关jar包的下载地址，当前我们的cas.version=3.5.2，根据这个版本好下载相应的jar文件。在cas-server-support-ldap的jar包页面，我们可以看到这个jar包还要依赖于其他jar，也要一并下载了。

CAS与LDAP集成

在下载jar包之前，可以先比对/usr/local/tomcat7/webapps/cas/WEB-INF/lib当中是否已经有这个jar包了，如果没有再去下载。下载完毕以后将jar包放在/usr/local/tomcat7/webapps/cas/WEB-INF/lib目录下。

CAS与LDAP集成

Cas与ldap集成有FastBindLdapAuthenticationHandler和BindLdapAuthenticationHandler这两种接口，前者适用于CAS的验证登录名就直接是ldap当中uid的情况，这种情况比较单一，当前我是按照BindLdapAuthenticationHandler进行配置的。

配置deployerConfigContext.xml

所有关于cas集成ldap的修改都在 cas-server-webapp/src/main/webapp/WEB-INF/deployerConfigContext.xml这个配置文件当中。

首先在这个配置文件当中添加以下这个bean

<bean id="contextSource" class="org.springframework.ldap.core.support.LdapContextSource">

  <!-- DO NOT enable JNDI pooling for context sources that perform LDAP bind operations. -->

  <property name="pooled" value="false"/>

  <!--

    Although multiple URLs may defined, it's strongly recommended to avoid this configuration

    since the implementation attempts hosts in sequence and requires a connection timeout

    prior to attempting the next host, which incurs unacceptable latency on node failure.

    A proper HA setup for LDAP directories should use a single virtual host that maps to multiple

    real hosts using a hardware load balancer.

  -->

  <property name="url" value="ldap://localhost" />

  <!--

    Manager credentials are only required if your directory does not support anonymous searches.

    Never provide these credentials for FastBindLdapAuthenticationHandler since the user's

    credentials are used for the bind operation.

  -->

  <property name="userDn" value="cn=admin,dc=envisioncn,dc=com"/>

  <property name="password" value="12345678"/>

  <!-- Place JNDI environment properties here. -->

  <property name="baseEnvironmentProperties">

    <map>

      <!-- Three seconds is an eternity to users. -->

      <entry key="com.sun.jndi.ldap.connect.timeout" value="3000" />

      <entry key="com.sun.jndi.ldap.read.timeout" value="3000" />

      <!-- Explained at http://docs.oracle.com/javase/jndi/tutorial/ldap/security/auth.html -->

      <entry key="java.naming.security.authentication" value="simple" />

    </map>

  </property>

</bean>

在配置文档当中有一栏关于“SSL Considerations”的介绍，里面说的就是，如果我们没有为LDAP Server配置SSL的话，我们就不能ldaps，只能用ldap协议，也就是像我上面那样使用<property name="url" value="ldap://localhost" />，而不是<property name="url" value="ldaps://localhost" />。验证自己是否配置了SSL，可以查看636端口是否开启。通过netstat查看发现ldap只开启了389端口，那么就按照我上面的进行配置。LDAP开启SSL的方法可以参考https://help.ubuntu.com/12.04/serverguide/openldap-server.html里面的“TLS”这一章节。

enadmin@cgnmon:~$ netstat -ln

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address           Foreign Address         State

tcp               127.0.0.1:           0.0.0.0:*               LISTEN

tcp               0.0.0.0:              0.0.0.0:*               LISTEN

tcp               0.0.0.0:              0.0.0.0:*               LISTEN

tcp               0.0.0.0:              0.0.0.0:*               LISTEN

tcp               127.0.0.1:            0.0.0.0:*               LISTEN

tcp               0.0.0.0:             0.0.0.0:*               LISTEN

tcp6              :::                 :::*                    LISTEN

tcp6              :::                   :::*                    LISTEN

tcp6              :::                 :::*                    LISTEN

tcp6              :::                  :::*                    LISTEN

tcp6              :::                 :::*                    LISTEN

udp               0.0.0.0:              0.0.0.0:*

udp               10.0.2.15:           0.0.0.0:*

udp               127.0.0.1:           0.0.0.0:*

udp               0.0.0.0:             0.0.0.0:*

udp6              :::                 :::*

udp6              fe80::a00:27ff:fe22: :::*

udp6              :::                  :::*

Active UNIX domain sockets (only servers)

Proto RefCnt Flags       Type       State         I-Node   Path

unix        [ ACC ]     STREAM     LISTENING          @/com/ubuntu/upstart

unix        [ ACC ]     STREAM     LISTENING          /var/run/acpid.socket

unix        [ ACC ]     STREAM     LISTENING          /var/run/dbus/system_bus_socket

unix        [ ACC ]     STREAM     LISTENING          /var/run/slapd/ldapi

unix        [ ACC ]     STREAM     LISTENING          /var/run/apache2/cgisock.

unix        [ ACC ]     STREAM     LISTENING          /var/run/sendmail/mta/smcontrol

unix        [ ACC ]     SEQPACKET  LISTENING          /run/udev/control

添加完上面那个bean以后，我们还需要修改authenticationManager这个bean，需要将原先的SimpleTestUsernamePasswordAuthenticationHandler修改为我们的BindLdapAuthenticationHandler。具体配置如下：

 <bean id="authenticationManager" class="org.jasig.cas.authentication.AuthenticationManagerImpl">

       <property name="credentialsToPrincipalResolvers">

       　　<list>

           　　<bean class="org.jasig.cas.authentication.principal.UsernamePasswordCredentialsToPrincipalResolver" >

              　　<property name="attributeRepository" ref="attributeRepository" />

               </bean>

               <bean class="org.jasig.cas.authentication.principal.HttpBasedServiceCredentialsToPrincipalResolver" />

           </list>

       </property>

       <property name="authenticationHandlers">

       　　<list>

          　　<bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler"

                    p:httpClient-ref="httpClient" />

              <bean class="org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHandler"

              　　   p:filter="uid=%u"

                    p:searchBase="ou=People,dc=envisioncn,dc=com"

                    p:contextSource-ref="contextSource" />

           </list>

         </property>

         <property name="authenticationMetaDataPopulators">

         　　<list>

            　　<bean class="org.jasig.cas.authentication.SamlAuthenticationMetaDataPopulator" />

             </list>

          </property>

  </bean>

配置到这里，CAS与LDAP的集成就已经基本完成了。还可以优化的地方有以下几方面，这个在后面有时间了再进行配置。

  1. 为LDAP配置连接池
  2. 为LDAP配置SSL验证

CAS与Restful api集成

下载相关的jar包

跟ldap一样，也是需要下载jar包的，google搜索cas-server-integration-restlet找到相应的下载地址。

配置

所有针对restful的配置都在/usr/local/tomcat7/webapps/cas/WEB-INF/web.xml这个配置文件当中。

修改web.xml，添加servlet和servlet-mapping，具体如下所示：

  <servlet>

    <servlet-name>cas</servlet-name>

    <servlet-class>

      org.jasig.cas.web.init.SafeDispatcherServlet

    </servlet-class>

    <init-param>

      <param-name>publishContext</param-name>

      <param-value>false</param-value>

    </init-param>

    <load-on-startup>1</load-on-startup>

  </servlet>

<servlet>

    <servlet-name>restlet</servlet-name>

    <servlet-class>com.noelios.restlet.ext.spring.RestletFrameworkServlet</servlet-class>

    <load-on-startup>1</load-on-startup>

</servlet>

<servlet-mapping>

    <servlet-name>restlet</servlet-name>

    <url-pattern>/v1/*</url-pattern>

</servlet-mapping>

  <servlet-mapping>

    <servlet-name>cas</servlet-name>

    <url-pattern>/login</url-pattern>

  </servlet-mapping>

测试：

在ubuntu任意目录下下创建一个testcas.sh文件，并赋予这个文件可执行权限，执行命令如下

#sudo touch testcas.sh

#sudo chmod 777 testcas.sh

该文本内容如下所示。

# This file is used to store the Ticket Getting Ticket

rm tgt.txt

# This file is used to store the Service Ticket

rm serviceTicket.txt

#This file is used to store the service call response

rm response.txt

export CAS_LOGIN_URL=https://localhost:8443/cas/v1/tickets

export GET_URL=https://localhost:8443/cas

export USERNAME=username

export PASSWORD=password

# Request a new Ticket Getting Ticket (TGT).  This returns HTML which is put into tgt.txt.

wget --no-check-certificate -O tgt.txt --post-data="username=$USERNAME&password=$PASSWORD" $CAS_LOGIN_URL

# Extract from the HTML the TGT and put back into tgt.txt

echo TGT`grep -oEi 'action=\".*\"' tgt.txt | grep -oEi '\-.*\-cas'` > tgt.txt

# display the TGT

cat tgt.txt

# Request a new Service Ticket and store in serviceTicket.txt

wget --no-check-certificate --post-data="service=$GET_URL" -O serviceTicket.txt $CAS_LOGIN_URL/`cat tgt.txt`

# Get the data at from the service at GET_URL and store in response.txt

wget --no-check-certificate -O response.txt $GET_URL?ticket=`cat serviceTicket.txt`

# Display the data from the service call

cat response.txt

运行此testcas.sh文件，看一下能否正常生成tgt，

运行结果如下：

enadmin@cgnmon:~/test$ ./testcas.sh

--2013-12-11 22:51:38--  https://localhost:8443/cas/v1/tickets

Resolving localhost (localhost)... 127.0.0.1

Connecting to localhost (localhost)|127.0.0.1|:8443... connected.

WARNING: cannot verify localhost's certificate, issued by `/C=cn/ST=shanghai/L=shanghai/O=envision/OU=en/CN=test':

  Self-signed certificate encountered.

    WARNING: certificate common name `test' doesn't match requested host name `localhost'.

HTTP request sent, awaiting response... 201 Created //这表示生成tgt成功。

Length: 443 [text/html]

Saving to: `tgt.txt'

100%[=============================================================================================================================>] 443         --.-K/s   in 0s      

2013-12-11 22:51:38 (218 MB/s) - `tgt.txt' saved [443/443]

TGT-1-4CeCylfHfbis9kttoqPsYIpMA17ajV5TJ4fWifA6pHjncKfR9E-cas//tgt

--2013-12-11 22:51:38--  https://localhost:8443/cas/v1/tickets/TGT-1-4CeCylfHfbis9kttoqPsYIpMA17ajV5TJ4fWifA6pHjncKfR9E-cas

Resolving localhost (localhost)... 127.0.0.1

Connecting to localhost (localhost)|127.0.0.1|:8443... connected.

WARNING: cannot verify localhost's certificate, issued by `/C=cn/ST=shanghai/L=shanghai/O=envision/OU=en/CN=test':

  Self-signed certificate encountered.

    WARNING: certificate common name `test' doesn't match requested host name `localhost'.

HTTP request sent, awaiting response... 404 Not Found

2013-12-11 22:51:38 ERROR 404: Not Found.

--2013-12-11 22:51:38--  https://localhost:8443/cas?ticket=

Resolving localhost (localhost)... 127.0.0.1

Connecting to localhost (localhost)|127.0.0.1|:8443... connected.

WARNING: cannot verify localhost's certificate, issued by `/C=cn/ST=shanghai/L=shanghai/O=envision/OU=en/CN=test':

  Self-signed certificate encountered.

    WARNING: certificate common name `test' doesn't match requested host name `localhost'.

HTTP request sent, awaiting response... 302 Found

Location: https://localhost:8443/cas/?ticket= [following]

--2013-12-11 22:51:38--  https://localhost:8443/cas/?ticket=

Reusing existing connection to localhost:8443.

HTTP request sent, awaiting response... 302 Found

Location: https://localhost:8443/cas/login?ticket= [following]

--2013-12-11 22:51:39--  https://localhost:8443/cas/login?ticket=

Reusing existing connection to localhost:8443.

HTTP request sent, awaiting response... 200 OK

Length: 6161 (6.0K) [text/html]

Saving to: `response.txt'

100%[=============================================================================================================================>] 6,161       --.-K/s   in 0s      

2013-12-11 22:51:41 (320 MB/s) - `response.txt' saved [6161/6161]
上一篇：web service, wcf, wcf rest, web api之间的区别


下一篇：centos7 安装ldap