CAS3.0 定制驗證

Joshua 2006-02-20

展開全文

[原創(chuàng)]CAS3.0 定制驗證

前言:

CAS v2 定制自己的驗證邏輯,大家已經(jīng)很清楚了.[官方提供的sample只簡單校驗username,password是否相等].開發(fā)者可以通過實現(xiàn)PasswordHandler接口來使用其它的認(rèn)證方式，如數(shù)據(jù)庫用戶的用戶名和密碼匹配認(rèn)證，數(shù)字簽名的驗證，操作系統(tǒng)用戶認(rèn)證，以及LDAP用戶認(rèn)證等模式。比如:

        <context-param>
        <param-name>edu.yale.its.tp.cas.authHandler</param-name>
        <param-value>
             edu.yale.its.tp.cas.auth.provider.KerberosAuthHandler
        </param-value>
    </context-param>

改變:

Yale CAS3代碼全部重構(gòu),功能增強(qiáng),且使用了Spring和SpringWebFlow[相關(guān)知識參見Spring論壇].

涉及點分析:

deployerConfigContext.xml是描述部署細(xì)節(jié)的,他通過web.xml如下描述而加載

      <context-param>
  <param-name>contextConfigLocation</param-name>
  <param-value>
   /WEB-INF/applicationContext.xml,
   /WEB-INF/mydeployerConfigContext.xml
  </param-value>
</context-param>

contextConfigLocation屬性名在Spring MVC體系中,會自動獲取.

----------------------------

deployerConfigContext.xml文件是所有CAS deployer應(yīng)該關(guān)心的東西,在這里,你可以對CAS的三個核心玩意進(jìn)行自己的定制:
1.AuthenticationManager


2.credentialsToPrincipalResolvers

3.authenticationHandlers
這個authenticationHandler可是所有CAS用戶都需要修改的地方

實現(xiàn):

思路:沒撒子說的,就是實現(xiàn)自己的Hadnle.為了避免重新編譯cas代碼,使用ant部署自己的jar到目標(biāo)的lib中,并替換web.xml以及引進(jìn)自己的配置文件mydeployerConfigContext.xml

步驟:

A:在應(yīng)用服務(wù)器中配置DS[略]

B:修改web.xml

         <context-param>
  <param-name>contextConfigLocation</param-name>
  <param-value>
   /WEB-INF/applicationContext.xml,
   /WEB-INF/mydeployerConfigContext.xml
  </param-value>
</context-param>

C:web.xml加入DS引用

        <resource-ref>
<description>
    Resource reference to a factory for java.sql.Connection
    instances that may be used for talking to a particular
    database that is configured in the server.xml file.
</description>
<res-ref-name>
    jdbc/EmployeeDB
</res-ref-name>
<res-type>
    javax.sql.DataSource
</res-type>
<res-auth>
    Container
</res-auth>
</resource-ref>

D:添加mydeployerConfigContext.xml

內(nèi)容如下:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www./dtd/spring-beans.dtd">

<property name="authenticationHandlers">
   <list>
    
    <bean
     class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler" />
    <bean
     class="cn.com.tiansky.cas.authenticationHandlers.DsHandlers" />
   </list>
  </property>
</bean>
</beans>
E:編寫DsHandlers

package cn.com.tiansky.cas.authenticationHandlers;

import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.Statement;

import javax.naming.Context;
import javax.naming.InitialContext;
import javax.sql.DataSource;

import org.apache.log4j.Logger;
import org.jasig.cas.authentication.handler.support.AbstractUsernamePasswordAuthenticationHandler;
import org.jasig.cas.authentication.principal.UsernamePasswordCredentials;

import cn.com.tiansky.tool.MD5;

/**
* 支援CAS3，。實現(xiàn)自己的Handler(未自定義credentials,如因業(yè)務(wù)需要而修改，則需要同時
* 修改LoginFormAction和定義自己的credentialsToPrincipalResolvers)\
* ,你的需求也許包括了需要通過檢索數(shù)據(jù)庫來比配credential中的username和password，
* 也可能不是數(shù)據(jù)庫，而是LDAP什么的，總之你得開始制作自己的handler了！
* credential的種類是很多的，有的基于用戶名和密碼，有的基于http請求，
* 如果你有你自己的credential的話，就得為它制作有一個handler，
* 來告訴CAS如何處理這種特有的credential。
* @author tiansky
* @version 1.0
*
*/
public final class DsHandlers extends
AbstractUsernamePasswordAuthenticationHandler{

/**
* Logger log:log4j日志
*/
private Logger log=Logger.getLogger(AbstractUsernamePasswordAuthenticationHandler.class);
/**
* 相關(guān)的數(shù)據(jù)庫配置DS對應(yīng)的jndi
*/
private String _jndi="jdbc/EmployeeDB";
/* (non-Javadoc)
* @see org.jasig.cas.authentication.handler.support.AbstractUsernamePasswordAuthenticationHandler#authenticateUsernamePasswordInternal(org.jasig.cas.authentication.principal.UsernamePasswordCredentials)
*/
public boolean authenticateUsernamePasswordInternal(
          final UsernamePasswordCredentials credentials) {
           String username = credentials.getUsername();
           String password = credentials.getPassword();
           log.info("username:"+username);

           log.info("password:"+password);
          try {
     password = MD5.encrypt(password);
     log.debug("md5password" + password);
    } catch (Exception e) {
     log.warn("MD5加密出錯", e);
     //throw new Exception("MD5加密出錯");
     return false;
    }
    /*
          if (StringUtils.hasText(username) && StringUtils.hasText(password)
              && username.equals(getPasswordEncoder().encode(password))) {
              getLog().debug(
                  "User [" + username + "] was successfully authenticated.");
              return true;
          }
          */
    try
    {
     if(checkuser(username,password)==1)
     {
      getLog().info("認(rèn)證成功!");
      return true;
     }
    }
    catch(Exception e)
    {
     getLog().error("User [" + username + "] failed authentication",e);
    }

          return false;
      }
private int checkuser(String user, String pwd) throws Exception {
  int rei = 0;
  // Obtain our environment naming context
  log.debug("Obtain our environment naming context");
  Context initCtx = new InitialContext();
  Context envCtx = (Context) initCtx.lookup("java:comp/env");

  // Look up our data source
  DataSource ds = (DataSource) envCtx.lookup(this._jndi);
  log.debug("獲取ds成功!");
  // Allocate and use a connection from the pool
  Connection conn = ds.getConnection();
  log.debug("獲取conn成功!");
  // ... use this connection to access the database ...
  String sql = "select OPERATORID from operator where OPERATORLOGINNAME=‘"
    + user + "‘ and OPERATORPASSWORD=‘" + pwd + "‘ ";
  log.info("sql!= "+sql);
  Statement st = conn.createStatement();
  ResultSet rs = st.executeQuery(sql);
  if (rs.next()) {
   //String oid = rs.getString("OPERATORID");
   /*
   _op = new Operator(oid);
   _op.setName("操作員");
   _op.setLoginname(user);
   _op.setPwd(pwd);
   */
   rei = 1;
  } else {
   System.out.println("賬號不存在或密碼錯誤!");
  }
  conn.close();
  return rei;

}
      /* (non-Javadoc)
       * @see org.jasig.cas.authentication.handler.support.AbstractUsernamePasswordAuthenticationHandler#afterPropertiesSetInternal()
       */
      protected void afterPropertiesSetInternal() throws Exception {
          super.afterPropertiesSetInternal();
          getLog()
              .warn(
                  this.getClass().getName()
                      + " is only to be used in a production environment.");
      }

}

F:ant 發(fā)布

G:運行調(diào)試

附錄:ANT腳本

<?xml version="1.0" encoding="gb2312"?>