gpt4 book ai didi

spring - 通过CAS Spring Security获得重定向循环

转载 作者:行者123 更新时间:2023-12-02 15:28:33 26 4
gpt4 key购买 nike

以下配置导致重定向到CAS服务器的重定向循环,否则该循环可用于其他应用程序。我能够登录,结果URL为:

http://localhost:18080/ourapp/app/j_spring_cas_security_check?ticket=ST-18-CQMfGMeDPcXkdKGjosfj-localsso.subdomain.mycompany.com

applicationContext-security.xml
<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:p="http://www.springframework.org/schema/p"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd">

<!-- Enable security, let the casAuthenticationEntryPoint handle all intercepted
urls. The CAS_FILTER needs to be in the right position within the filter
chain. -->
<security:http entry-point-ref="casEntryPoint" use-expressions="true" auto-config="false">
<!--<security:intercept-url pattern="/**" access="permitAll"/> -->
<security:anonymous username="guest" granted-authority="isAnonymous()"/>
<security:intercept-url pattern="/app/resources/**" access="hasAnyRole('ROLE_ANONYMOUS', 'cm_user')"/>
<security:intercept-url pattern="/app/**" access="hasRole('cm_user')"/>
<security:custom-filter position="CAS_FILTER" ref="casFilter"/>

<security:session-management>
<security:concurrency-control max-sessions="5" error-if-maximum-exceeded="true"/>
</security:session-management>
</security:http>

<!-- Required for the casProcessingFilter, so define it explicitly set and
specify an Id Even though the authenticationManager is created by default
when namespace based config is used. -->
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider ref="casAuthenticationProvider"/>
</security:authentication-manager>

<!-- This section is used to configure CAS. The service is the actual redirect
that will be triggered after the CAS login sequence. -->
<bean id="serviceProperties"
class="org.springframework.security.cas.ServiceProperties"
p:service="http://localhost:18080/ourapp/app/j_spring_cas_security_check"
p:sendRenew="false"/>

<!-- The CAS filter handles the redirect from the CAS server and starts
the ticket validation. -->
<bean id="casFilter"
class="org.springframework.security.cas.web.CasAuthenticationFilter">
<property name="authenticationManager" ref="authenticationManager"/>
</bean>

<!-- The entryPoint intercepts all the CAS authentication requests. It redirects
to the CAS loginUrl for the CAS login page. -->
<bean id="casEntryPoint"
class="org.springframework.security.cas.web.CasAuthenticationEntryPoint"
p:serviceProperties-ref="serviceProperties"
p:loginUrl="https://devmcauth01.nexus.mycompany.com:5443/login"/>

<!-- Handles the CAS ticket processing. -->
<bean id="casAuthenticationProvider"
class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
<property name="userDetailsService" ref="userDetailsService"/>
<property name="serviceProperties" ref="serviceProperties" />
<property name="ticketValidator">
<bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
<constructor-arg index="0" value="https://devmcauth01.nexus.mycompany.com:5443" />
</bean>
</property>
<property name="key" value="cas"/>
</bean>

<bean id="permissionConversionService"
class="com.mycompany.connmgmt.misc.security.PermissionConversionServiceImpl"/>

<bean id="userDetailsService"
class="com.mycompany.connmgmt.misc.security.CmUserDetailsService">
<property name="userRepository" ref="userRepository"/>
<property name="permissionConversionService" ref="permissionConversionService"/>
</bean>

<bean id="accessDecisionManager"
class="org.springframework.security.access.vote.AffirmativeBased">
<property name="allowIfAllAbstainDecisions">
<value>false</value>
</property>
<property name="decisionVoters">
<list>
<ref bean="roleVoter"/>
</list>
</property>
</bean>

<bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter">
<property name="rolePrefix" value=""/>
</bean>

<bean id="loggerListener"
class="org.springframework.security.access.event.LoggerListener"/>

<!-- Enable JSR250 annotations, disable Spring Security annotations for now -->
<security:global-method-security secured-annotations="disabled"
jsr250-annotations="enabled"
access-decision-manager-ref="accessDecisionManager"/>

web.xml

http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd“
版本=“2.4”>
<display-name>Our App</display-name>

<filter>
<filter-name>OpenPersistenceManagerInViewFilter</filter-name>
<filter-class>
org.springframework.orm.jdo.support.OpenPersistenceManagerInViewFilter
</filter-class>
<init-param>
<param-name>persistenceManagerFactoryBeanName</param-name>
<param-value>internalPersistenceManagerFactory</param-value>
</init-param>
</filter>

<filter>
<filter-name>dsmProdOpenPersistenceManagerInViewFilter</filter-name>
<filter-class>
org.springframework.orm.jdo.support.OpenPersistenceManagerInViewFilter
</filter-class>
<init-param>
<param-name>persistenceManagerFactoryBeanName</param-name>
<param-value>dsmProdInternalPersistenceManagerFactory</param-value>
</init-param>
</filter>

<filter>
<filter-name>dsmTestOpenPersistenceManagerInViewFilter</filter-name>
<filter-class>
org.springframework.orm.jdo.support.OpenPersistenceManagerInViewFilter
</filter-class>
<init-param>
<param-name>persistenceManagerFactoryBeanName</param-name>
<param-value>dsmTestInternalPersistenceManagerFactory</param-value>
</init-param>
</filter>

<filter>
<filter-name>onboarderOpenPersistenceManagerInViewFilter</filter-name>
<filter-class>
org.springframework.orm.jdo.support.OpenPersistenceManagerInViewFilter
</filter-class>
<init-param>
<param-name>persistenceManagerFactoryBeanName</param-name>
<param-value>onboarderInternalPersistenceManagerFactory</param-value>
</init-param>
</filter>

<filter>
<filter-name>OpenEntityManagerInViewFilter</filter-name>
<filter-class>
org.springframework.orm.jpa.support.OpenEntityManagerInViewFilter
</filter-class>
<init-param>
<param-name>entityManagerFactoryBeanName</param-name>
<param-value>orgDataDir_EntityManagerFactory</param-value>
</init-param>
</filter>

<!--
Route all requests through Spring Security for A&A
-->
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<!--
There are three means to configure Wickets configuration mode and they are
tested in the order given.
1) A system property: -Dwicket.configuration
2) servlet specific <init-param>
3) context specific <context-param>
The value might be either "development" (reloading when templates change)
or "deployment". If no configuration is found, "development" is the default.
-->
<filter>
<filter-name>wicket</filter-name>
<filter-class>
org.apache.wicket.protocol.http.WicketFilter
</filter-class>
<init-param>
<param-name>applicationFactoryClassName</param-name>
<param-value>
org.apache.wicket.spring.SpringWebApplicationFactory
</param-value>
</init-param>
</filter>

<!-- The SpringWebApplicationFactory will need access to a Spring Application context, configured like this... -->
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath:/applicationSecurityContext.xml
classpath:/applicationContext.xml
classpath:/orgDataDir-config.xml
classpath:/dsm-prod-spring-jdo-config.xml
classpath:/dsm-test-spring-jdo-config.xml
classpath:/dsm-prod-beans.xml
classpath:/dsm-test-beans.xml
classpath:/exchange-config.xml
classpath:/reporting.xml
classpath:/profile-conversion.xml
classpath:/com/mycompany/connmgmt/integration/jms/jms-client.xml
classpath:/com/mycompany/connmgmt/integration/jms/test-jms-client.xml
classpath:/com/mycompany/connmgmt/integration/jms/jms-consumers.xml
classpath:/com/mycompany/connmgmt/integration/jms/jms-producers.xml
classpath*:/com/mycompany/core/odd/odd-applicationContext.xml
classpath:/task-support.xml
</param-value>
</context-param>
<listener>
<listener-class>
org.springframework.web.context.ContextLoaderListener
</listener-class>
</listener>
<!-- Support for session- and request-scoped beans -->
<listener>
<listener-class>
org.springframework.web.context.request.RequestContextListener
</listener-class>
</listener>

<!--
Listen for Session events and publish for Spring Security's consumption
-->
<listener>
<listener-class>
org.springframework.security.web.session.HttpSessionEventPublisher
</listener-class>
</listener>

<filter-mapping>
<filter-name>OpenPersistenceManagerInViewFilter</filter-name>
<url-pattern>/app/*</url-pattern>
</filter-mapping>

<filter-mapping>
<filter-name>dsmProdOpenPersistenceManagerInViewFilter</filter-name>
<url-pattern>/app/*</url-pattern>
</filter-mapping>

<filter-mapping>
<filter-name>dsmTestOpenPersistenceManagerInViewFilter</filter-name>
<url-pattern>/app/*</url-pattern>
</filter-mapping>

<filter-mapping>
<filter-name>onboarderOpenPersistenceManagerInViewFilter</filter-name>
<url-pattern>/app/*</url-pattern>
</filter-mapping>

<filter-mapping>
<filter-name>OpenEntityManagerInViewFilter</filter-name>
<url-pattern>/app/*</url-pattern>
</filter-mapping>

<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/app/*</url-pattern>
</filter-mapping>

<filter-mapping>
<filter-name>wicket</filter-name>
<url-pattern>/app/*</url-pattern>
</filter-mapping>

<session-config>
<!-- 10 hours [TRAC-83] -->
<session-timeout>600</session-timeout>
</session-config>
</web-app>

请注意,这是与相关错误不同的问题:
这建议使用pre-auth-filter,这不是Spring / CAS文档或示例应用程序所必需的: How to prevent JA-SIG CAS spring security redirect loop?

提到j_spring_cas_security_check必须位于由CasAuthenticationFilter保护的URL下: Redirect loop with CAS and Spring Security

这提到需要用户详细信息服务,我有: Redirect loop with Grails Spring Security CAS plugin

最佳答案

解决方案是为过滤器使用的URL添加filterProcessesUrl。我认为这是必需的,因为拦截URL条目已映射到该位置。当CAS退回票证时,由于用户尚未通过身份验证,因此无法到达该位置。

<bean id="casFilter"
class="org.springframework.security.cas.web.CasAuthenticationFilter">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="filterProcessesUrl" value="/app/j_spring_cas_security_check"/>
</bean>

关于spring - 通过CAS Spring Security获得重定向循环,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/23923282/

26 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com