如何配置 CAS 以验证代理票证答案

【问题标题】：How to configure CAS for authenticating proxy ticket如何配置 CAS 以验证代理票证
【发布时间】：2019-08-22 07:19:53
【问题描述】：

我已经在一台服务器上将 CAS 设置为 tomcat webapp。我正在使用来自另一台服务器的此服务来验证用户。在调用服务时，它会成功生成票证，并且还会授予票证。

在验证票证时，它会引发异常 filenotfound。下面提供了其中的片段。

这是为了使用来自不同服务器的 CAS，而不是配置 CAS 的服务器。当我使用 CAS 并将我的应用程序部署在同一台服务器上时，它工作正常。当我将应用程序部署在与 CAS 不同的服务器中时，它会引发 filenot found 异常。

这是我的 spring-security-cas.xml 文件

http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.2.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd">

<bean id="serviceProperties" class="org.springframework.security.cas.ServiceProperties">
    <property name="service" value="${service-url-login}" />
    <property name="sendRenew" value="false" />
    <property name="authenticateAllArtifacts" value="true" />
</bean>

<bean id="casFilter" class="org.springframework.security.cas.web.CasAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="proxyGrantingTicketStorage" ref="pgtStorage" />
    <property name="proxyReceptorUrl" value="/j_spring_cas_security_proxyreceptor" />
    <property name="serviceProperties" ref="serviceProperties" />
    <property name="authenticationDetailsSource">
        <bean class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource">
            <constructor-arg ref="serviceProperties" />
        </bean>
    </property>
</bean>

<bean id="casEntryPoint" class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
    <property name="loginUrl" value="${cas-url-login}" />
    <property name="serviceProperties" ref="serviceProperties" />
</bean>

<bean id="casAuthenticationProvider"
    class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
    <property name="authenticationUserDetailsService">
        <bean
            class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
            <constructor-arg ref="userService" />
        </bean>
    </property>
    <property name="serviceProperties" ref="serviceProperties" />
    <property name="ticketValidator">
        <bean class="org.jasig.cas.client.validation.Cas20ProxyTicketValidator">
            <constructor-arg value="${cas-url-prefix}" />
            <property name="acceptAnyProxy" value="true" />
        </bean>
    </property>
    <property name="statelessTicketCache" ref="ehcacheBasedTicketCache" />
    <property name="key" value="an_id_for_this_auth_provider_only" />
    <property name="authoritiesMapper" ref="simpleAuthorityMapper" />
</bean>

<bean id="simpleAuthorityMapper" class="org.springframework.security.core.authority.mapping.SimpleAuthorityMapper">
    <property name="defaultAuthority" value="ROLE_NORMAL_USER"></property>
    <property name="prefix" value="ROLE_"></property>
</bean>

<bean id="ehcacheBasedTicketCache" class="org.springframework.security.cas.authentication.EhCacheBasedTicketCache">
    <property name="cache">
        <bean class="net.sf.ehcache.Cache" init-method="initialise" destroy-method="dispose">
            <constructor-arg value="casTickets" />
            <constructor-arg value="50" />
            <constructor-arg value="true" />
            <constructor-arg value="false" />
            <constructor-arg value="3600" />
            <constructor-arg value="900" />
            <property name="cacheManager">
                <bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"></bean>
            </property>
        </bean>
    </property>
</bean>

<bean id="singleLogoutFilter" class="org.jasig.cas.client.session.SingleSignOutFilter" />

<bean id="requestSingleLogoutFilter"
    class="org.springframework.security.web.authentication.logout.LogoutFilter">
    <constructor-arg value="${cas-url-logout-service}" />
    <constructor-arg>
        <bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" >
            <property name="invalidateHttpSession" value="true"></property>
            <property name="clearAuthentication" value="true"></property>
        </bean>
    </constructor-arg>
    <property name="filterProcessesUrl" value="/j_spring_cas_security_logout" />
</bean>

<bean id="pgtStorage" class="org.jasig.cas.client.proxy.ProxyGrantingTicketStorageImpl" />

这是被抛出的错误。

java.lang.RuntimeException: java.io.FileNotFoundException: https://test.nycompany.in/cas/proxyValidate?ticket=ST-10-YA1Eqcdz2lI57fojFazr-&service=https%3A%2F%2Fhub.mycompany.in%2Fj_spring_cas_security_check org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:443) org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:41) org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:193) org.springframework.security.cas.authentication.CasAuthenticationProvider.authenticateNow(CasAuthenticationProvider.java:158) org.springframework.security.cas.authentication.CasAuthenticationProvider.authenticate(CasAuthenticationProvider.java:143) org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:174) org.springframework.security.cas.web.CasAuthenticationFilter.attemptAuthentication(CasAuthenticationFilter.java:270) org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:217) org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) org.jasig.cas.client.session.SingleSignOutFilter.doFilter(SingleSignOutFilter.java:97) org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:120) org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:120) org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:53) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:91) org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:213) org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:176) org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:344) org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:261) org.springframework.orm.hibernate4.support.OpenSessionInViewFilter.doFilterInternal(OpenSessionInViewFilter.java:152) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 根本原因

java.io.FileNotFoundException: https://test.mycompany.in/cas/proxyValidate?ticket=ST-10-YA1Eqcdz2lI57fojFazr-&service=https%3A%2F%2Fhub.mycompany.in%2Fj_spring_cas_security_check sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1890) sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1492) sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:263) org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:429) org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:41) org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:193) org.springframework.security.cas.authentication.CasAuthenticationProvider.authenticateNow(CasAuthenticationProvider.java:158) org.springframework.security.cas.authentication.CasAuthenticationProvider.authenticate(CasAuthenticationProvider.java:143) org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:174) org.springframework.security.cas.web.CasAuthenticationFilter.attemptAuthentication(CasAuthenticationFilter.java:270) org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:217) org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) org.jasig.cas.client.session.SingleSignOutFilter.doFilter(SingleSignOutFilter.java:97) org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:120) org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:120) org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:53) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:91) org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:213) org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:176) org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:344) org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:261) org.springframework.orm.hibernate4.support.OpenSessionInViewFilter.doFilterInternal(OpenSessionInViewFilter.java:152) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)

我已取消设置我的 CAS 中的 host.name 属性，例如 host.name= 为了让它接受来自不同域服务器的请求。

我希望这可以验证我的应用程序中的代理票证。

【问题讨论】：

标签： java single-sign-on cas

【解决方案1】：

我也遇到了同样的问题。来自浏览器的 java.lang.RuntimeException: java.io.FileNotFoundException was reachable 之后消息中的 URL，它在 CAS 6.0 中正常工作，用户登录。

经过几次尝试后，我看到运行应用程序的机器可以 ping 请求的域，但是对整个 URL 的 curl 给出了 404。

所以检查系统设置。

【讨论】：

感谢您的回答。其实我已经成功完成了设置。我现在不记得确切的解决方案了，但基本上 CAS 会创建一个数据库。在此数据库中，默认情况下，仅允许运行 CAS 的服务器发出请求。我们需要输入用于验证用户的请求的 URL 模式。例如。我的网站 URL 是：Https://example.com，那么表中的条目应该是 allow：1，URL：Https://example.com* 其中 allow 和 URL 是列的名称。这是它的确切解决方案。