代码之家 › 专栏 › 技术社区 › YingYang

带cas rest的Spring安全性(直接登录)

cas login security spring java

YingYang · 技术社区 · 7 年前

我有一个关于使用SpringCAS服务的问题。到目前为止一切都正常。(服务器和客户端)

但是我需要在没有重定向到CAS登录站点的情况下进行身份验证。因此,我需要直接登录,以从服务API请求一些数据。

我向我的CAS服务器添加了CAS REST身份验证。

现在我可以通过以下方式申请TGT票:

curl --data "username=demo&password=demo" https://cas/cas/v1/tickets

之后,我可以通过TGT票申请服务票:

curl --data "service=https://serviceHost/web/" https://cas/cas/v1/tickets/TGT-9-ODzpFwQF7dwxSrtCPkR3ZySfnMroyp

我在CAS服务器日志中看到,用户被授权使用此服务票据。

但是当我试图从我的服务请求一些URL时通过:

curl https://serviceHost/web/api/getAuftraege?ticket=ST-21-4ucWgqnFTSyYT

我被重定向到CAS登录站点。

我想我的webapp没有解释我的“罚单”参数。

我需要在webapp的配置中加入某种解析器吗?

我的SpringWeb应用程序需要一些依赖项吗?

1 回复 | 直到 7 年前

Mohsen 7 年前

2年前,我有一个任务,我应该写一个Java客户端的CAS登录:

public boolean login(String service, String jsessionid) throws IOException {
    tgt = getTicketGrantingTicket(username, password);
    String st = getServiceTicket(service, tgt);
    commitJsessionid(service, jsessionid, st);
    this.jsessionid = jsessionid;
    return true;
}

public String getTicketGrantingTicket(String username, String password) throws IOException {
    Map<String, Object> params = new LinkedHashMap<>();
    params.put("username", username);
    params.put("password", password);
    HttpURLConnection conn = restClient.post(casUrl + "/v1/tickets", params);
    StringBuilder responseBuilder = new StringBuilder();
    BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream(), "UTF-8"));
    String input;
    while ((input = in.readLine()) != null) {
        responseBuilder.append(input);
    }
    in.close();

    String response = responseBuilder.toString();
    if (conn.getResponseCode() == 400) {
        throw new AuthenticationException("bad username or password");
    }
    String location = conn.getHeaderField("Location");
    return location;
}

public String getServiceTicket(String service, String tgt) throws IOException {
    Map<String, Object> params = new LinkedHashMap<>();

    params.put("service", service + "/j_acegi_security_check");

    HttpURLConnection conn = restClient.post(tgt, params);
    StringBuilder responseBuilder = new StringBuilder();
    BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream(), "UTF-8"));
    String input;
    while ((input = in.readLine()) != null) {
        responseBuilder.append(input);
    }
    in.close();

    String response = responseBuilder.toString();

    return response;
}

public String commitJsessionid(String service, String jsessionid, String st) throws IOException {
    HttpURLConnection conn = restClient.get(service + "/j_acegi_security_check;jsessionid=" + jsessionid + "?ticket=" + st);
    StringBuilder responseBuilder = new StringBuilder();
    BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream(), "UTF-8"));
    String input;
    while ((input = in.readLine()) != null) {
        responseBuilder.append(input);
    }
    in.close();

    String response = responseBuilder.toString();

    return response;
}

public boolean validateServiceTicket(String service, String st) throws IOException {
    HttpURLConnection conn = restClient.get(casUrl + "/proxyValidate?ticket=" + st + "&service=" + service + "/j_acegi_security_check");
    StringBuilder responseBuilder = new StringBuilder();
    BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream(), "UTF-8"));
    String input;
    while ((input = in.readLine()) != null) {
        responseBuilder.append(input);
    }
    in.close();

    String response = responseBuilder.toString();

    return response.toString().contains("authenticationSuccess");
}

您可以使用以下方法调用您的REST服务:

    public String callRestExample(String service, String rest) throws IOException {
    String url = service;
    if (jsessionid != null)
        url += "/services/" + rest + ";jsessionid=" + jsessionid;

    HttpURLConnection conn = restClient.get(url);
    StringBuilder responseBuilder = new StringBuilder();
    BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream(), "UTF-8"));
    String input;
    while ((input = in.readLine()) != null) {
        responseBuilder.append(input);
    }
    in.close();

    String response = responseBuilder.toString();
    if (jsessionid == null) {
        int index = response.indexOf("jsessionid");
        jsessionid = response.substring(index + 13, index + 45);
        tgt = getTicketGrantingTicket(username, password);
        String st = getServiceTicket(service, tgt);
        commitJsessionid(service, jsessionid, st);
        callRestExample(service, rest);
    }

    return response;
}