cas+spring 安全性

Question

我正在尝试在我的应用中实现 SSO，目前我遇到了下一个问题：

HTTP Status 401 - Authentication Failed: Failed to provide a CAS service ticket to validate

type Status report

message Authentication Failed: Failed to provide a CAS service ticket to validate

description This request requires HTTP authentication (Authentication Failed: Failed to provide a CAS service ticket to validate).

我在另一个tomcat上启动我的cas服务器，在那里登录，当我进入我的应用程序的登录页面时，然后： 1.然后是没有自动登录 2. 当我输入凭据时，我看到上面显示的堆栈跟踪 我从this site 中举了一个例子。

这是我的 Spring 安全上下文：

<security:global-method-security  pre-post-annotations="enabled" />

    <security:http use-expressions="true" auto-config="true"
        entry-point-ref="casAuthenticationEntryPoint" >

    <security:custom-filter position="CAS_FILTER" ref="casAuthenticationFilter"></security:custom-filter>

        <security:access-denied-handler  ref="accessDeniedHandler" />

        <security:form-login login-page="/login.html"
            authentication-failure-url="/login.html?login_error=1"
            default-target-url="/index.html" 
            always-use-default-target="false"
            login-processing-url="/j_spring_security_check"
            authentication-failure-handler-ref="failureHandler"
            authentication-success-handler-ref="successHandler" />
        <security:logout logout-url="/logout" logout-success-url="/login.html" />

        <security:intercept-url pattern="/member/**" access="hasRole('viewer')" />
        <security:intercept-url pattern="/admin/**" access="hasRole('SiteAdmin')" />
        <security:intercept-url pattern="/admin/**" access="hasRole('SystemAdmin')" />

        <security:remember-me />
    </security:http>

    <security:authentication-manager alias="authenticationManager">
        <security:authentication-provider user-service-ref="myUserDetailsService" />
        <security:authentication-provider ref="casAuthenticationProvider"></security:authentication-provider>
    </security:authentication-manager>

    <bean id="myUserDetailsService"
        class="com.mypackage.MyUserDetailsService">
    </bean>

    <bean id="authenticationEntryPoint"
        class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
        <property name="loginFormUrl" value="/login.html" />
        <property name="forceHttps" value="false" />
    </bean>

    <bean id="successHandler"
        class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
        <property name="defaultTargetUrl" value="/member/index.html" />
    </bean>

    <bean id="failureHandler"
        class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler">
        <property name="defaultFailureUrl" value="/login.html?error=auth_fail" />
    </bean>

    <bean id="bannedHandler"
        class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
        <property name="defaultFailureUrl" value="/login.html?error=banned" />
    </bean>

    <bean id="accessDeniedHandler"
        class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
        <property name="errorPage" value="/403.jsp"></property>
    </bean>


    <bean id="serviceProperties" class="org.springframework.security.cas.ServiceProperties">
        <property name="service" value="http://localhost:8080/spring-security-cas/j_spring_cas_security_check"></property>
        <property name="sendRenew" value="false"></property>
    </bean> 

    <bean id="casAuthenticationFilter" class="org.springframework.security.cas.web.CasAuthenticationFilter">
        <property name="authenticationManager" ref="authenticationManager"></property>
    </bean>

    <bean id="casAuthenticationEntryPoint" class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
        <property name="loginUrl" value="http://localhost:9080/cas-server-webapp-3.4.10/login"></property>
        <property name="serviceProperties" ref="serviceProperties"></property>
    </bean>

    <bean id="casAuthenticationProvider" class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
        <property name="userDetailsService" ref="myUserDetailsService"></property>
        <property name="serviceProperties" ref="serviceProperties"></property>
        <property name="ticketValidator">
            <bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
                <constructor-arg index="0" value="http://localhost:9080/cas-server-webapp-3.4.10"></constructor-arg>
            </bean>
        </property>
        <property name="key" value="cas"></property>
    </bean>

在 web.xml 中，我已经包含了 spring 安全上下文并设置了适当的侦听器等。 在 pom（我使用 maven）中，我添加了所需的依赖项，如文章中所述。 但问题依然存在。 我很乐意提供任何建议

Answer 1

从您的错误消息“此请求需要 HTTP 身份验证”看来，您的 CAS 服务器已启用身份验证。您需要停用它并通过 HTML 页面登录（即它将是 JSP、ASP 或类似的东西）。

Answer 2

我得到同样的痕迹，当

<servlet-mapping>
    <servlet-name>springmvc</servlet-name>
    <url-pattern>*.do</url-pattern>
</servlet-mapping>

但是 cas 登录 url 没有 *.do 后缀。当我添加 .do 时它工作得很好。