Pac4j-cas集成和前后端分离JWT验证流程解析 -- 知识铺

1

package com.zgd.common.web; import com.zgd.common.BusinessException; import io.buji.pac4j.context.ShiroSessionStore; import lombok.extern.slf4j.Slf4j; import org.apache.shiro.SecurityUtils; import org.jasig.cas.client.validation.Assertion; import org.jasig.cas.client.validation.TicketValidationException; import org.jasig.cas.client.validation.TicketValidator; import org.pac4j.cas.client.CasClient; import org.pac4j.cas.config.CasConfiguration; import org.pac4j.core.authorization.checker.AuthorizationChecker; import org.pac4j.core.authorization.checker.DefaultAuthorizationChecker; import org.pac4j.core.client.Client; import org.pac4j.core.client.DirectClient; import org.pac4j.core.client.finder.ClientFinder; import org.pac4j.core.client.finder.DefaultSecurityClientFinder; import org.pac4j.core.config.Config; import org.pac4j.core.context.J2EContext; import org.pac4j.core.context.session.SessionStore; import org.pac4j.core.credentials.Credentials; import org.pac4j.core.engine.decision.DefaultProfileStorageDecision; import org.pac4j.core.engine.decision.ProfileStorageDecision; import org.pac4j.core.http.ajax.AjaxRequestResolver; import org.pac4j.core.http.ajax.DefaultAjaxRequestResolver; import org.pac4j.core.matching.MatchingChecker; import org.pac4j.core.matching.RequireAllMatchersChecker; import org.pac4j.core.profile.CommonProfile; import org.pac4j.core.profile.ProfileManager; import org.pac4j.core.util.CommonHelper; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.RestController; import javax.annotation.Resource; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.util.ArrayList; import java.util.Iterator; import java.util.List; /** * LoginController * * @author zgd * @date 2020/8/11 15:46 */ @Slf4j @RestController public class LoginController { @Autowired private CasConfiguration casConfiguration; @Autowired private Pac4jConfig pac4jConfig; @Autowired private CasClient casClient; @Resource private Config authcConfig; private AuthorizationChecker authorizationChecker = new DefaultAuthorizationChecker(); private MatchingChecker matchingChecker = new RequireAllMatchersChecker(); private ProfileStorageDecision profileStorageDecision = new DefaultProfileStorageDecision(); private AjaxRequestResolver ajaxRequestResolver = new DefaultAjaxRequestResolver(); private ClientFinder clientFinder = new DefaultSecurityClientFinder(); /**获取token */ @GetMapping("/token") public Response<String> getToken( HttpServletRequest request, HttpServletResponse response) throws TicketValidationException { CommonProfile profile = validCASServiceTicket(request, response); if (profile ==null){ throw new BusinessException(CAS_ST_ERROR); } String token = JwtTokenUtil.generateToken(profile.getUsername() ==null ? profile.getId() : profile.getUsername()); log.info("生成的token: {}", token); // 将签发的 JWT token 设置到 HttpServletResponse 的 Header中,并重写向vue前端页面 response.setHeader(AUTH_HEADER, token); return Response.ok(token); } /**校验st * @param request * @param response * @return */ private CommonProfile validCASServiceTicket(HttpServletRequest request, HttpServletResponse response) { //这两行代码其实就是下面的核心校验代码. 也可以直接用这两行代替.. // TicketValidator ticketValidator = casConfiguration.retrieveTicketValidator(webContext); // Assertion assertion = ticketValidator.validate(ticket, pac4jConfig.getServerUrl()); J2EContext context = new J2EContext(request, response, ShiroSessionStore.INSTANCE); List<Client> currentClients = clientFinder.find(authcConfig.getClients(), context, pac4jConfig.getClientName()); log.debug("currentClients: {}", currentClients); CommonProfile profile = null; for (Client currentClient : currentClients) { log.debug("Performing authentication for direct client: {}", currentClient); Credentials credentials = currentClient.getCredentials(context); log.debug("credentials: {}", credentials); profile = currentClient.getUserProfile(credentials, context); log.debug("profile: {}", profile); if (profile != null) { break; } } return profile; } }

1

@Configuration @Data public class Pac4jConfig { //地址为：cas地址 @Value("${shiro.cas.url}") private String casServerUrlPrefix; //地址为：验证返回后的项目地址：http://localhost:8080 @Value("${shiro.client.url}") private String shiroServerUrlPrefix; //相当于一个标志，可以随意，shiroConfig中也会用到 @Value("${shiro.client.name}") private String clientName; public String getLoginUrl() { return casServerUrlPrefix + "/login?service=" + getServiceUrl(); } public String getLogoutUrl() { return casServerUrlPrefix + "/logout?service=" + getServiceUrl(); } /** * 这里就还是按pac4j的思路, 写死一个serviceUrl.即cas认证后重定向的url, 可以是/aa, 也可以是/bb (我们需要和CallbackFilter一样写一个过滤器来处理,在这个过滤器中,我们需要拿ST去CAS校验) */ public String getServiceUrl(){ return shiroServerUrlPrefix + "/aa?client_name=" + clientName; } /** * pac4j配置 * * @param casClient * @return */ @Bean("authcConfig") public Config config(CasClient casClient) { Config config = new Config(casClient); return config; } /** * cas 客户端配置 * * @param casConfig * @return */ @Bean public CasClient casClient(CasConfiguration casConfig) { CasClient casClient = new CasClient(casConfig); //客户端回调地址, 同样也是ST校验的service参数. 必须要和获取ST的service参数一致, 才能验证成功 casClient.setCallbackUrl(getServiceUrl()); casClient.setName(clientName); return casClient; } /** * 请求cas服务端配置 * * @param */ @Bean public CasConfiguration casConfig() { final CasConfiguration configuration = new CasConfiguration(); //CAS server登录地址 configuration.setLoginUrl(casServerUrlPrefix + "/login"); //CAS 版本，默认为 CAS30，我们使用的是 CAS20 configuration.setProtocol(CasProtocol.CAS20); configuration.setAcceptAnyProxy(true); configuration.setPrefixUrl(casServerUrlPrefix + "/"); //监控CAS服务端登出，登出后销毁本地session实现双向登出 DefaultLogoutHandler logoutHandler = new DefaultLogoutHandler(); logoutHandler.setDestroySession(true); configuration.setLogoutHandler(logoutHandler); return configuration; } }