java - Spring Security with CAS Rest(直接登录)

Question

我有一个关于使用 Spring CAS 服务的问题。到目前为止一切正常。 (服务器和客户端)

但我需要在不重定向到 cas 登录站点的情况下进行身份验证。所以我需要直接登录，从服务 API 请求一些数据。

我将 CAS Rest 身份验证添加到我的 CAS 服务器。

现在我可以通过以下方式请求 TGT 票证:

curl --data "username=demo&password=demo" https://cas/cas/v1/tickets

之后，我可以通过 TGT Ticket 请求服务票证:

curl --data "service=https://serviceHost/web/" https://cas/cas/v1/tickets/TGT-9-ODzpFwQF7dwxSrtCPkR3ZySfnMroyp

我在 CAS 服务器日志中看到，用户已使用此服务票证进行了身份验证。

但是当我尝试从我的服务请求一些 URL 时通过:

curl https://serviceHost/web/api/getAuftraege?ticket=ST-21-4ucWgqnFTSyYT

我被重定向到 cas 登录站点。

我认为我的网络应用程序没有解释我的“ticket”参数。

我是否必须将某种解析器放入我的网络应用程序的配置中？

我的 Spring Web 应用程序需要一些依赖项吗？

Answer 1

2年前我有一个任务，我应该为cas登录编写一个java客户端:

public boolean login(String service, String jsessionid) throws IOException {
    tgt = getTicketGrantingTicket(username, password);
    String st = getServiceTicket(service, tgt);
    commitJsessionid(service, jsessionid, st);
    this.jsessionid = jsessionid;
    return true;
}

public String getTicketGrantingTicket(String username, String password) throws IOException {
    Map<String, Object> params = new LinkedHashMap<>();
    params.put("username", username);
    params.put("password", password);
    HttpURLConnection conn = restClient.post(casUrl + "/v1/tickets", params);
    StringBuilder responseBuilder = new StringBuilder();
    BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream(), "UTF-8"));
    String input;
    while ((input = in.readLine()) != null) {
        responseBuilder.append(input);
    }
    in.close();

    String response = responseBuilder.toString();
    if (conn.getResponseCode() == 400) {
        throw new AuthenticationException("bad username or password");
    }
    String location = conn.getHeaderField("Location");
    return location;
}

public String getServiceTicket(String service, String tgt) throws IOException {
    Map<String, Object> params = new LinkedHashMap<>();

    params.put("service", service + "/j_acegi_security_check");

    HttpURLConnection conn = restClient.post(tgt, params);
    StringBuilder responseBuilder = new StringBuilder();
    BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream(), "UTF-8"));
    String input;
    while ((input = in.readLine()) != null) {
        responseBuilder.append(input);
    }
    in.close();

    String response = responseBuilder.toString();

    return response;
}

public String commitJsessionid(String service, String jsessionid, String st) throws IOException {
    HttpURLConnection conn = restClient.get(service + "/j_acegi_security_check;jsessionid=" + jsessionid + "?ticket=" + st);
    StringBuilder responseBuilder = new StringBuilder();
    BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream(), "UTF-8"));
    String input;
    while ((input = in.readLine()) != null) {
        responseBuilder.append(input);
    }
    in.close();

    String response = responseBuilder.toString();

    return response;
}

public boolean validateServiceTicket(String service, String st) throws IOException {
    HttpURLConnection conn = restClient.get(casUrl + "/proxyValidate?ticket=" + st + "&service=" + service + "/j_acegi_security_check");
    StringBuilder responseBuilder = new StringBuilder();
    BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream(), "UTF-8"));
    String input;
    while ((input = in.readLine()) != null) {
        responseBuilder.append(input);
    }
    in.close();

    String response = responseBuilder.toString();

    return response.toString().contains("authenticationSuccess");
}

您可以使用此方法调用您的休息服务:

    public String callRestExample(String service, String rest) throws IOException {
    String url = service;
    if (jsessionid != null)
        url += "/services/" + rest + ";jsessionid=" + jsessionid;

    HttpURLConnection conn = restClient.get(url);
    StringBuilder responseBuilder = new StringBuilder();
    BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream(), "UTF-8"));
    String input;
    while ((input = in.readLine()) != null) {
        responseBuilder.append(input);
    }
    in.close();

    String response = responseBuilder.toString();
    if (jsessionid == null) {
        int index = response.indexOf("jsessionid");
        jsessionid = response.substring(index + 13, index + 45);
        tgt = getTicketGrantingTicket(username, password);
        String st = getServiceTicket(service, tgt);
        commitJsessionid(service, jsessionid, st);
        callRestExample(service, rest);
    }

    return response;
}