轉自：http://www.open-open.com/lib/view/open1359286846414.html
此文的目的是為了加深自己的理解，做一個備份與分享
過程全為自己的實際操作步驟
第一步：準備的環(huán)境
win7 64位的系統(tǒng)
jdk1.6.0_37
apache-tomcat-6.0.14
cas-server-3.4.8-release
cas-client-3.2.0-release
這里用到的是tomcat自帶作為測試的程序
?
首先，找到系統(tǒng)的hosts文件（ C:\Windows\System32\drivers\etc\hosts?）增加
?
在本機映射三個域名
127.0.0.1 ? cas.baishi.com
127.0.0.1 ? app1.baishi.com
127.0.0.1 ? app2.baishi.com
解釋，其中，cas.baishi.com對應部署cas server的tomcat ,這個域名對應證書的生成
app1.baishi.com對應部署app1應用的tomcat
app2.baishi.com對應部署app2應用的tomcat
第二步：部署cas的服務
(1)首先，我在D盤下建一個文件夾,如D:/baishikeys 接著用jdk自帶的keytool生成證書,即在cmd命令中鍵入
keytool -genkey -alias baishi -keyalg RSA -keystore “D:/baishikeys/baishikey” 該命令生成keys證書
baishi為證書的別名,執(zhí)行結果如下圖，注意其中姓氏要寫之前cas server對應的域名
(2)導出證書
keytool -export -file d:/baishikeys/baishi.crt -alias baishi -keystore d:/baishikeys/baishikey
執(zhí)行結果如圖（其中密碼和上面證書密碼一致）
（3）把證書導入JDK中
先找到你安裝的jdk目錄中cacerts文件刪掉，如D:\Program Files\Java\jdk1.6.0_37\jre\lib\security\cacerts
這樣的目的是避免后面報錯
執(zhí)行keytool -import -keystore "D:\Program Files\Java\jdk1.6.0_37\jre\lib\security\cacerts" -file D:/baishikeys/baishi.crt -alias baishi
執(zhí)行結果如圖（其中密碼和上面一致就行）
第三步：配置cas的服務端
解壓apache-tomcat-6.0.14重命名為apache-tomcat-cas
把下載的cas-server-3.4.8-release包解壓，在文件modules中，找到cas-server-webapps-3.4.8.war
復制到apache-tomcat-cas的webapps文件夾下，重命名為?cas.war,打開apache-tomcat-cas的
conf/server.xml文件，
找到64到72中間的注釋打開，改為
?<Connector?port="8443"?protocol="HTTP/1.1"?SSLEnabled="true"
???????????????maxThreads="150"?scheme="https"?secure="true"
???????????????clientAuth="false"?sslProtocol="TLS"?
? ? ? ? ? ? ? keystoreFile="D:/baishikeys/baishikey"
? ? ? ? ? ? ??keystorePass="123456"
???/>
其中keystoreFile是創(chuàng)建證書的路徑，keystorePass是創(chuàng)建證書的密碼，到此cas服務的配置完成
?
啟動cas服務的apache-tomcat-cas，訪問https://cas.baishi.com:8443/cas
執(zhí)行圖：點擊繼續(xù)瀏覽此網(wǎng)站
執(zhí)行后圖
用戶名和密碼輸入相同的字符串就可以通過了
到此cas服務端的配置成功了
第四步：配置cas的客戶端
(1)?安裝配置 apache-tomcat-app1
解壓apache-tomcat-6.0.14?.tar，改名為apache-tomcat-app1對應應用app1的服務
修改apache-tomcat-app1的啟動端口，在文件conf/server.xml文件找到如下內(nèi)容：
?
| <Connector?port="8080"?protocol="HTTP/1.1" |
| ? | ???????????????connectionTimeout="20000" |
| ? | ???????????????redirectPort="8443"?/> |
| ? | <Connector?port="8009"?protocol="AJP/1.3"?redirectPort="8443"?/> |
改成
?
| <Connector?port="18080"?protocol="HTTP/1.1" |
| ? | ??????????????connectionTimeout="20000" |
| ? | ??????????????redirectPort="18443"?/> |
| 4 | <Connector?port="18009"?protocol="AJP/1.3"?redirectPort="18443"?/> |
為了避免多個tomcat沖突，把<Server port="8005" shutdown="SHUTDOWN">也改成 <Server port="8085" shutdown="SHUTDOWN">
啟動apache-tomcat-app1 ，瀏覽器輸入 http://app 1 .baishi.com: 1 8080/examples/servlets/ 回車：
則tomcat配置成功
接下來復制 client的lib包cas-client-core-3.2.0.jar到 apache-tomcat-app1\webapps\examples\WEB-INF\lib\目錄下， 在apache-tomcat-app1\webapps\examples\WEB-INF\web.xml?文件中增加如下內(nèi)容：
| <!-- ======================== 單點登錄開始 ======================== --> |
| ? | ????????<!-- 用于單點退出，該過濾器用于實現(xiàn)單點登出功能，可選配置--> |
| ? | ? ? ?? <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class> |
| ? | ????????<!-- 該過濾器用于實現(xiàn)單點登出功能，可選配置 --> |
| ? | ????????????<filter-name>CAS Single Sign Out Filter</filter-name> |
| ? | ????????????<filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class> |
| ? | ????????<filter-mapping> |
| ? | ????????????<filter-name>CAS Single Sign Out Filter</filter-name> |
| ? | ????????????<url-pattern>/*</url-pattern> |
| ? | ????????</filter-mapping> |
| ? | ????????????<filter-name>CAS Filter</filter-name> |
| ? | ????????????<filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class> |
| ? | ????????????<init-param> |
| ? | ????????????????<param-name>casServerLoginUrl</param-name> |
| ? | ????????????????<param-value>https://cas.baishi.com:8443/cas/login</param-value> |
| ? | ????????????</init-param> |
| ? | ????????????<init-param> |
| ? | ????????????????<param-name>serverName</param-name> |
| ? | ????????????????<param-value>http://app1.baishi.com:18080</param-value> |
| ? | ???????????</init-param> |
| ? | ????????<filter-mapping> |
| ? | ????????????<filter-name>CAS Filter</filter-name> |
| ? | ????????????<url-pattern>/*</url-pattern> |
| ? | ????????</filter-mapping> |
| ? | ????????<!-- 該過濾器負責對Ticket的校驗工作，必須啟用它 --> |
| ? | ????????????<filter-name>CAS Validation Filter</filter-name> |
| ? | ????????????<filter-class> |
| ? | ????????????????org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class> |
| ? | ????????????<init-param> |
| ? | ????????????????<param-name>casServerUrlPrefix</param-name> |
| ? | ????????????????<param-value>https://cas.baishi.com:8443/cas</param-value> |
| ? | ????????????</init-param> |
| ? | ????????????????<param-name>serverName</param-name> |
| ? | ????????????????<param-value>http://app1.baishi.com:18080</param-value> |
| ? | ???????????</init-param> |
| ? | ????????<filter-mapping> |
| ? | ????????????<filter-name>CAS Validation Filter</filter-name> |
| ? | ????????????<url-pattern>/*</url-pattern> |
| ? | ????????</filter-mapping> |
| ? | ????????????該過濾器負責實現(xiàn)HttpServletRequest請求的包裹， |
| ? | ????????????比如允許開發(fā)者通過HttpServletRequest的getRemoteUser()方法獲得SSO登錄用戶的登錄名，可選配置。 |
| ? | ???????????<filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> |
| ? | ????????????<filter-class> |
| ? | ????????????????org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class> |
| ? | ????????<filter-mapping> |
| ? | ????????????<filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> |
| ? | ????????????<url-pattern>/*</url-pattern> |
| ? | ????????</filter-mapping> |
| ? | ????????該過濾器使得開發(fā)者可以通過org.jasig.cas.client.util.AssertionHolder來獲取用戶的登錄名。 |
| ? | ????????比如AssertionHolder.getAssertion().getPrincipal().getName()。 |
| ? | ????????????<filter-name>CAS Assertion Thread Local Filter</filter-name> |
| ? | ????????????<filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class> |
| ? | ????????<filter-mapping> |
| ? | ????????????<filter-name>CAS Assertion Thread Local Filter</filter-name> |
| ? | ????????????<url-pattern>/*</url-pattern> |
| ? | ????????</filter-mapping> |
| ? | ????????<!-- ======================== 單點登錄結束 ======================== --> |
?
?
(2)?安裝配置?apache-tomcat-app2
解壓apache-tomcat-6.0.14?.tar，改名為apache-tomcat-app2對應應用app2的服務
修改apache-tomcat-app2的啟動端口，在文件conf/server.xml文件找到如下內(nèi)容：
| <Connector?port="8080"?protocol="HTTP/1.1" |
| ? | ???????????????connectionTimeout="20000" |
| ? | ???????????????redirectPort="8443"?/> |
| ? | <Connector?port="8009"?protocol="AJP/1.3"?redirectPort="8443"?/> |
改成
?
| <Connector?port="28080"?protocol="HTTP/1.1" |
| ? | ??????????????connectionTimeout="20000" |
| ? | ??????????????redirectPort="28443"?/> |
| 4 | <Connector?port="28009"?protocol="AJP/1.3"?redirectPort="28443"?/> |
為了避免多個tomcat沖突，把<Server port="8005" shutdown="SHUTDOWN">也改成<Server port="8095" shutdown="SHUTDOWN">
啟動apache-tomcat-app2 ，瀏覽器輸入 http://app 2 .baishi.com: 2 8080/examples/servlets/ 回車：
按照上述(1)中的方法驗證是否成功。
?
接下來復制 client的lib包cas-client-core-3.2.0.jar到?apache-tomcat-app2\webapps\examples\WEB-INF\lib\目錄下， 在apache-tomcat-app2\webapps\examples\WEB-INF\web.xml?文件中增加如下內(nèi)容：
| <!-- ======================== 單點登錄開始 ======================== --> |
| ? | ????????<!-- 用于單點退出，該過濾器用于實現(xiàn)單點登出功能，可選配置--> |
| ? | ? ? ?? <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class> |
| ? | ????????<!-- 該過濾器用于實現(xiàn)單點登出功能，可選配置 --> |
| ? | ????????????<filter-name>CAS Single Sign Out Filter</filter-name> |
| ? | ????????????<filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class> |
| ? | ????????<filter-mapping> |
| ? | ????????????<filter-name>CAS Single Sign Out Filter</filter-name> |
| ? | ????????????<url-pattern>/*</url-pattern> |
| ? | ????????</filter-mapping> |
| ? | ????????????<filter-name>CAS Filter</filter-name> |
| ? | ????????????<filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class> |
| ? | ????????????<init-param> |
| ? | ????????????????<param-name>casServerLoginUrl</param-name> |
| ? | ????????????????<param-value>https://cas.baishi.com:8443/cas/login</param-value> |
| ? | ????????????</init-param> |
| ? | ????????????<init-param> |
| ? | ????????????????<param-name>serverName</param-name> |
| ? | ????????????????<param-value>http://app2.baishi.com:18080</param-value> |
| ? | ???????????</init-param> |
| ? | ????????<filter-mapping> |
| ? | ????????????<filter-name>CAS Filter</filter-name> |
| ? | ????????????<url-pattern>/*</url-pattern> |
| ? | ????????</filter-mapping> |
| ? | ????????<!-- 該過濾器負責對Ticket的校驗工作，必須啟用它 --> |
| ? | ????????????<filter-name>CAS Validation Filter</filter-name> |
| ? | ????????????<filter-class> |
| ? | ????????????????org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class> |
| ? | ????????????<init-param> |
| ? | ????????????????<param-name>casServerUrlPrefix</param-name> |
| ? | ????????????????<param-value>https://cas.baishi.com:8443/cas</param-value> |
| ? | ????????????</init-param> |
| ? | ????????????????<param-name>serverName</param-name> |
| ? | ????????????????<param-value>http://app2.baishi.com:18080</param-value> |
| ? | ???????????</init-param> |
| ? | ????????<filter-mapping> |
| ? | ????????????<filter-name>CAS Validation Filter</filter-name> |
| ? | ????????????<url-pattern>/*</url-pattern> |
| ? | ????????</filter-mapping> |
| ? | ????????????該過濾器負責實現(xiàn)HttpServletRequest請求的包裹， |
| ? | ????????????比如允許開發(fā)者通過HttpServletRequest的getRemoteUser()方法獲得SSO登錄用戶的登錄名，可選配置。 |
| ? | ???????????<filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> |
| ? | ????????????<filter-class> |
| ? | ????????????????org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class> |
| ? | ????????<filter-mapping> |
| ? | ????????????<filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> |
| ? | ????????????<url-pattern>/*</url-pattern> |
| ? | ????????</filter-mapping> |
| ? | ????????該過濾器使得開發(fā)者可以通過org.jasig.cas.client.util.AssertionHolder來獲取用戶的登錄名。 |
| ? | ????????比如AssertionHolder.getAssertion().getPrincipal().getName()。 |
| ? | ????????????<filter-name>CAS Assertion Thread Local Filter</filter-name> |
| ? | ????????????<filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class> |
| ? | ????????<filter-mapping> |
| ? | ????????????<filter-name>CAS Assertion Thread Local Filter</filter-name> |
| ? | ????????????<url-pattern>/*</url-pattern> |
| ? | ????????</filter-mapping> |
| ? | ????????<!-- ======================== 單點登錄結束 ======================== --> |
第五步：測試
啟動之前配置好的三個tomcat分別為：apache-tomcat-cas、apache-tomcat-app1、apache-tomcat-app2.
打開瀏覽器地址欄中輸入：http://app1.baishi.com:18080/examples/servlets/servlet/HelloWorldExample
輸入賬戶和密碼之后會出現(xiàn)Hello World
之瀏覽器地址中輸入http://app2.baishi.com:28080/examples/servlets/servlet/HelloWorldExample
就不用輸入賬戶和密碼了，直接進入Hello World
最后地址欄中輸入：https://cas.baishi.com:8443/cas/logout會注銷這個流程，重新開始認證
以上就是整個cas單點登錄的簡單配置
?
如果有cas服務的tomcat報錯java.lang.Exception:?Connector?attribute?SSLCertificateFile?must?be?defined?when?using?SSL?with?APR
只需把
?<Connector?port="8443"?protocol="HTTP/1.1"?SSLEnabled="true"
???????????????maxThreads="150"?scheme="https"?secure="true"
???????????????clientAuth="false"?sslProtocol="TLS"?
? ? ? ? ? ? ? keystoreFile="D:/baishikeys/baishikey"
? ? ? ? ? ? ??keystorePass="123456"
???/>
改成
?
?<Connector?port="8443"?protocol="org.apache.coyote.http11.Http11Protocol"?SSLEnabled="true"
???????????????maxThreads="150"?scheme="https"?secure="true"
???????????????clientAuth="false"?sslProtocol="TLS"?
? ? ? ? ? ? ? keystoreFile="D:/baishikeys/baishikey"
? ? ? ? ? ? ??keystorePass="123456"
???/>
即可
轉載于:https://www.cnblogs.com/summer520/p/3595809.html
總結
以上是生活随笔為你收集整理的CAS服务下单点登录（服务端与客户端）的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。
如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。
