SpringSecurity 3.1 与 cas 集成配置文件说明

安宇雨 - 随手采集
2019-06-24 12:12:59
随手采集
0000-未整理-等待研究

博客分类：* security

spring security cas

SpringSecurity 3.1 与 CAS 集成的配置文件及说明

注：

1、testSecurityMetadataSource为自定义,实现用户访问url与role对应关系的查询和验证。

2、testUserDetailServiceProxy为自定义，根据用户的用户id，查询用户详细信息的功能。

Xml代码 "收藏这段代码")

<?xmlversion="1.0"?>
<beansxmlns="http://www.springframework.org/schema/beans"xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<!--
Enable security, let the casAuthenticationEntryPoint handle all intercepted urls. The CAS_FILTER needs to be in the
right position within the filter chain.
-->
<security:httpentry-point-ref="casAuthenticationEntryPoint"auto-config="false"pattern="/**">
<security:intercept-urlpattern="/**"access="ROLE_USER"></security:intercept-url>
<security:custom-filterposition="CAS_FILTER"ref="casAuthenticationFilter"></security:custom-filter>
<security:custom-filterbefore="FILTER_SECURITY_INTERCEPTOR"ref="testFilterSecurityInterceptor"></security:custom-filter>
</security:http>
<beanid="testFilterSecurityInterceptor"class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
<propertyname="authenticationManager"ref="authenticationManager"/>
<propertyname="accessDecisionManager"ref="testAccessDecisionManager"/>
<propertyname="securityMetadataSource"ref="testSecurityMetadataSource"/>
</bean>
<beanid="testAccessDecisionManager"class="org.springframework.security.access.vote.AffirmativeBased">
<constructor-argindex="0">
<list>
<beanclass="org.springframework.security.access.vote.RoleVoter">
<propertyname="rolePrefix"value=""></property>
</bean>
</list>
</constructor-arg>
</bean>
<beanid="testSecurityMetadataSource"class="com.balance.test.integeration.acegi.AutoDelegatingSecurityMetadataSource"/>
<!--
Required for the casProcessingFilter, so define it explicitly set and specify an Id Even though the
authenticationManager is created by default when namespace based config is used.
-->
<security:authentication-manageralias="authenticationManager">
<security:authentication-providerref="casAuthenticationProvider"></security:authentication-provider>
</security:authentication-manager>
<!--
This section is used to configure CAS. The service is the actual redirect that will be triggered after the CAS login
sequence.
-->
<beanid="serviceProperties"class="org.springframework.security.cas.ServiceProperties">
<!--
http://localhost:8088/具体应用/j_spring_cas_security_check spring的虚拟URL，此标志标识使用 CAS authentication (upon return from CAS
SSO login.)
-->
<propertyname="service"value="http://PCNAME:8080/test/j_spring_cas_security_check"></property>
<propertyname="sendRenew"value="false"></property>
</bean>
<beanid="casAuthenticationFilter"class="org.springframework.security.cas.web.CasAuthenticationFilter">
<propertyname="authenticationManager"ref="authenticationManager"></property>
</bean>
<!--
The entryPoint intercepts all the CAS authentication requests. It redirects to the CAS loginUrl for the CAS login
page.
-->
<beanid="casAuthenticationEntryPoint"class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
<propertyname="loginUrl"value="https://PCNAME:8443/cas/login"></property>
<propertyname="serviceProperties"ref="serviceProperties"></property>
</bean>
<beanid="casAuthenticationProvider"class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
<propertyname="authenticationUserDetailsService"ref="casAuthenticationUserDetailsService"/>
<propertyname="serviceProperties"ref="serviceProperties"></property>
<propertyname="ticketValidator">
<beanclass="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
<constructor-argindex="0"value="https:/PCNAME:8443/cas"/>
</bean>
</property>
<propertyname="key"value="cas"></property>
</bean>
<beanid="casAuthenticationUserDetailsService"class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
<propertyname="userDetailsService">
<refbean="testUserDetailServiceProxy"/>
</property>
</bean>
<beanid="testUserDetailServiceProxy"class="com.balance.test.integeration.acegi.AutoDelegatingUserDetailService">
<propertyname="reservedUsernamePrefixs"value="admin,manager,user"/>
</bean>
</beans>

<?xml version="1.0"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:security="http://www.springframework.org/schema/security"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">

<!\-\- CAS验证配置。-->
<!\-\- 适用环境：用户身份验证由CAS完成，用户是否有权限访问指定url则由业务系统来负责验证  -->
<!\-\- 验证过程：1.用户访问受限的url，springsecurity 将请求转发到cas服务器上 -->
<!\-\- 验证过程：2.用户在cas服务器上登录，cas服务器将验证返馈信息返回给应用 -->
<!\-\- 验证过程：3.用户登录成功后，继续是行下面的验证过滤器testFilterSecurityInterceptor的验证，如果用户拥有访问url的指定角色，则转发到目标url，否则转发到禁止访问页面。-->
<!--
    Enable security, let the casAuthenticationEntryPoint handle all intercepted urls. The CAS_FILTER needs to be in the
    right position within the filter chain.
\-\->
<!\-\- 在http标签上添加entry-point-ref 指定验证入口为 casAuthenticationEntryPoint -->
<security:http entry-point-ref="casAuthenticationEntryPoint" auto-config="false" pattern="/**">
    <!\-\- 设置所有url访问需要包括角色ROLE_USER，可选。 -->
    <security:intercept-url pattern="/**" access="ROLE_USER"></security:intercept-url>
    <!\-\- 在验证链中添加cas的过滤器，用于进行cas验证。 -->
    <security:custom-filter position="CAS_FILTER" ref="casAuthenticationFilter"></security:custom-filter>
    <!\-\- 添加自定义url权限的验证过滤，放在FILTER\_SECURITY\_INTERCEPTOR前面，用于进行验证当前用户是否拥有访问指定url的权限。 -->
    <security:custom-filter before="FILTER\_SECURITY\_INTERCEPTOR" ref="testFilterSecurityInterceptor"></security:custom-filter>
</security:http>
<!\-\- 定义资源权限验证的过滤器。 -->
<bean id="testFilterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
    <!\-\- 身份验证器 -->
    <property name="authenticationManager" ref="authenticationManager" />
    <!\-\- 访问决策器 -->
    <property name="accessDecisionManager" ref="testAccessDecisionManager" />
    <!\-\- 获取可访问资源的role列表 -->
    <property name="securityMetadataSource" ref="testSecurityMetadataSource" />
</bean>
<!\-\- 访问决策器 -->
<bean id="testAccessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
    <constructor-arg index="0">
        <list>
            <bean class="org.springframework.security.access.vote.RoleVoter">
                <property name="rolePrefix" value=""></property>
            </bean>
        </list>
    </constructor-arg>
</bean>
<!\-\- 获取可访问资源的role列表 -->
<bean id="testSecurityMetadataSource" class="com.balance.test.integeration.acegi.AutoDelegatingSecurityMetadataSource" />
<!--
    Required for the casProcessingFilter, so define it explicitly set and specify an Id Even though the
    authenticationManager is created by default when namespace based config is used.
\-\->
<!\-\- 身份验证器 -->
<security:authentication-manager alias="authenticationManager">
    <!\-\- CAS身份验证器 -->
    <security:authentication-provider ref="casAuthenticationProvider"></security:authentication-provider>
</security:authentication-manager>
<!--
    This section is used to configure CAS. The service is the actual redirect that will be triggered after the CAS login
    sequence.
-->
<bean id="serviceProperties" class="org.springframework.security.cas.ServiceProperties">
    <!--
        http://localhost:8088/具体应用/j\_spring\_cas\_security\_check spring的虚拟URL，此标志标识使用 CAS authentication (upon return from CAS
        SSO login.)
    -->
    <property name="service" value="http://PCNAME:8080/test/j\_spring\_cas\_security\_check"></property>
    <property name="sendRenew" value="false"></property>
</bean>

<!--The CAS filter handles the redirect from the CAS server and starts the ticket validation.-->
<bean id="casAuthenticationFilter" class="org.springframework.security.cas.web.CasAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager"></property>
</bean>

<!--
    The entryPoint intercepts all the CAS authentication requests. It redirects to the CAS loginUrl for the CAS login
    page.
-->
<bean id="casAuthenticationEntryPoint" class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
    <!\-\- SSO登录地址 -->
    <property name="loginUrl" value="https://PCNAME:8443/cas/login"></property>
    <property name="serviceProperties" ref="serviceProperties"></property>
</bean>

<!--Handles the CAS ticket processing.-->
<bean id="casAuthenticationProvider" class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
    <property name="authenticationUserDetailsService" ref="casAuthenticationUserDetailsService" />
    <property name="serviceProperties" ref="serviceProperties"></property>
    <property name="ticketValidator">
        <bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
            <!\-\- SSO验证地址 -->
            <constructor-arg index="0" value="https:/PCNAME:8443/cas" />
        </bean>
    </property>
    <property name="key" value="cas"></property>
</bean>
<!\-\- userdetail service cas wrapper -->
<bean id="casAuthenticationUserDetailsService" class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
    <property name="userDetailsService">
        <ref bean="testUserDetailServiceProxy" />
    </property>
</bean>
<!\-\- userdetailService 定义 -->
<bean id="testUserDetailServiceProxy" class="com.balance.test.integeration.acegi.AutoDelegatingUserDetailService">
    <property name="reservedUsernamePrefixs" value="admin,manager,user" />
</bean>

</beans>

[

面试时如何在众多Java工程师中脱颖而出？

Java 程序员必备的知识盘点， Java从小白到大牛的学习规划！

](http://www.baidu.com/cb.php?c=IgF_pyfqnHmkPjbvrHT0IZ0qnfK9ujYzrHfLnH6Y0Aw-5Hnsn16YnjT0TAq15HfLP1fkrHn0T1d9mHbkmH03mvDYnhu-rHDY0AwY5HDdPWD1PjbdPHc0IgF_5y9YIZK1rBtEuywdQhP1uA38UhNYQLwETA-WQvG9IhDk5LNYUNq1ULNzmvRqmhkEuv-Yug--0ZFb5HDk0AFV5HD0TZcqn0KdpyfqnHRLPjnvnfKEpyfqnHc4rj6kP0KWpyfqP1n4PHn10AqLUWYs0ZK45HcsP6KWThnqPjn1Pjm)

分享到：