CAS-SSO和Spring Security(Spring Boot)中的无限重定向登录循环

问题描述 投票:0回答:1

我正在执行下一步:

  1. 我访问我的java应用程序的受限制的URL(/ myapp / login)
  2. 我被重定向到/ cas / login页面
  3. 我介绍了正确的凭据
  4. CAS将请求重定向到受限制的URL(即:/ myapp / login)
  5. 我的应用程序而不是接受请求,再次将此URL检测为受保护并再次将请求重定向到CAS:/ cas / login
  6. auth-cookies位于浏览器中,因此身份验证正常
  7. 第4步
  8. 第5步
  9. 第6步等

我的CAS服务器版本:

  • CAS版本:6.1.0-RC3-SNAPSHOT
  • Spring Boot版本:2.2.0.M1
  • 春季版:5.1.5.RELEASE
  • Java Home:C:\ Program Files \ Java \ jdk-11.0.2

CAS.properties:

cas.server.name=https://cas.example.org:8443
cas.server.prefix=${cas.server.name}/cas
logging.config: file:/etc/cas/config/log4j2.xml
cas.serviceRegistry.initFromJson=true
cas.serviceRegistry.json.location=file:/etc/cas/services

CAS依赖项添加:

compile "org.apereo.cas:cas-server-webapp${project.appServer}:${casServerVersion}"
compile "org.apereo.cas:cas-server-support-json-service-registry:${project.'cas.version'}"
compile "org.apereo.cas:cas-server-support-rest:${project.'cas.version'}"
compile "org.apereo.cas:cas-server-support-rest-tokens:${project.'cas.version'}"

我的CAS服务声明App-1001.json在/ etc / cas / service里面:

{
  "@class" : "org.apereo.cas.services.RegexRegisteredService",
   "serviceId" : "http://127.0.0.1:9000/imq/ptp/pspp/login",
   "name" : "App",
   "id" : 1001,
   "evaluationOrder" : 10
 }

在我的java应用程序中:

CAS豆类声明:

    @Bean
public ServiceProperties serviceProperties() {
    ServiceProperties serviceProperties = new ServiceProperties();
    serviceProperties.setService(serviceId);
    serviceProperties.setSendRenew(false);
    return serviceProperties;
}

@Bean
@Primary
public AuthenticationEntryPoint authenticationEntryPoint(
        ServiceProperties sP) {
    CasAuthenticationEntryPoint entryPoint = new CasAuthenticationEntryPoint();
    entryPoint.setLoginUrl("https://localhost:8443/cas/login");
    entryPoint.setServiceProperties(sP);
    return entryPoint;
}

@Bean
public TicketValidator ticketValidator() {
    return new Cas30ServiceTicketValidator("https://localhost:8443/cas");
}

@Bean
public CasAuthenticationProvider casAuthenticationProvider() {

    CasAuthenticationProvider provider = new CasAuthenticationProvider();
    provider.setServiceProperties(serviceProperties());
    provider.setTicketValidator(ticketValidator());
    provider.setUserDetailsService(
            s -> new User(casUsername, casPassword, true, true, true, true,
                    AuthorityUtils.createAuthorityList(casRole)
            )
    );
    provider.setKey(casKey);
    return provider;
}

/////

@Bean
public SecurityContextLogoutHandler securityContextLogoutHandler() {
    return new SecurityContextLogoutHandler();
}

@Bean
public LogoutFilter logoutFilter() {
    LogoutFilter logoutFilter = new LogoutFilter(
            "https://localhost:8443/cas/logout",
            securityContextLogoutHandler());
    logoutFilter.setFilterProcessesUrl("/logout/cas");
    return logoutFilter;
}

@Bean
public SingleSignOutFilter singleSignOutFilter() {
    SingleSignOutFilter singleSignOutFilter = new SingleSignOutFilter();
    singleSignOutFilter.setCasServerUrlPrefix("https://localhost:8443/cas");
    singleSignOutFilter.setIgnoreInitConfiguration(true);
    return singleSignOutFilter;
}

@EventListener
public SingleSignOutHttpSessionListener singleSignOutHttpSessionListener(
        HttpSessionEvent event) {
    return new SingleSignOutHttpSessionListener();
}

我的WebSecurity类声明:

@EnableWebSecurity
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

private AuthenticationProvider authenticationProvider;
private AuthenticationEntryPoint authenticationEntryPoint;
private SingleSignOutFilter singleSignOutFilter;
private LogoutFilter logoutFilter;

@Autowired
public SecurityConfig(CasAuthenticationProvider casAuthenticationProvider,
                      AuthenticationEntryPoint eP,
                      LogoutFilter lF,
                      SingleSignOutFilter ssF) {
    this.authenticationProvider = casAuthenticationProvider;
    this.authenticationEntryPoint = eP;
    this.logoutFilter = lF;
    this.singleSignOutFilter = ssF;
}

@Bean
CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(Arrays.asList("*"));
    configuration.setAllowedMethods(Arrays.asList("*"));
    configuration.setAllowedHeaders(Arrays.asList("*"));
    configuration.setAllowCredentials(true);
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

@Bean
public HttpFirewall allowUrlEncodedSlashHttpFirewall() {
    StrictHttpFirewall firewall = new StrictHttpFirewall();
    firewall.setAllowUrlEncodedSlash(true);
    firewall.setAllowSemicolon(true);
    return firewall;
}

@Override
protected void configure(HttpSecurity http) throws Exception {

    http
            .authorizeRequests()
            .regexMatchers("/imq/ptp/pspp.*")
            .authenticated()
            .and()
            .authorizeRequests()
            .regexMatchers("/")
            .permitAll()
            .and()
            .httpBasic()
            .authenticationEntryPoint(authenticationEntryPoint)
            .and()
            .logout().logoutSuccessUrl("/logout")
            .and()
            .addFilterBefore(singleSignOutFilter, CasAuthenticationFilter.class)
            .addFilterBefore(logoutFilter, LogoutFilter.class);
}

// ...

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(authenticationProvider);
}

@Override
protected AuthenticationManager authenticationManager() throws Exception {
    return new ProviderManager(Arrays.asList(authenticationProvider));
}

@Bean
public CasAuthenticationFilter casAuthenticationFilter(ServiceProperties sP) throws Exception {
    CasAuthenticationFilter filter = new CasAuthenticationFilter();
    filter.setServiceProperties(sP);
    filter.setAuthenticationManager(authenticationManager());
    return filter;
}
}

先感谢您!

java spring-boot spring-security single-sign-on cas
1个回答
2
投票

我认为你应该将casAuthenticationFilter置于其他设置之上。像这样:

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .addFilter(casAuthenticationFilter())
            .csrf().disable()
            .authorizeRequests()
                .anyRequest()
                .authenticated()
                .and()
            .httpBasic()
                .authenticationEntryPoint(authenticationEntryPoint())
                .and()
            .logout()
                .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
© www.soinside.com 2019 - 2024. All rights reserved.