CAS之单点登录client逻辑详解

<context-param>
  <param-name>serverName</param-name>
  <param-value>${sso.address.client}</param-value>
</context-param>
<context-param>
  <param-name>casServerUrlPrefix</param-name>
  <param-value>${sso.address.server}/unisso</param-value>
</context-param>
<context-param>
  <param-name>casServerLoginUrl</param-name>
  <param-value>${sso.address.server}/unisso/login</param-value>
</context-param>
  
<filter>
  <filter-name>ssoAuthFilter</filter-name>
  <filter-class>com.huawei.ism.drm.web.filter.SSOIntegrateFilter</filter-class>
  <init-param>
    <param-name>wrappedFilterClass</param-name>
    <param-value>org.jasig.cas.client.authentication.AuthenticationFilter</param-value>
  </init-param>
</filter>

public class AuthenticationFilter extends AbstractCasFilter {
    /**
     * The URL to the CAS Server login.
     */
    private String casServerLoginUrl;

    /**
     * Whether to send the renew request or not.
     */
    private boolean renew = false;

    /**
     * Whether to send the gateway request or not.
     */
    private boolean gateway = false;

    /**
     * The method used by the CAS server to send the user back to the application.
     */
    private String method;

    private GatewayResolver gatewayStorage = new DefaultGatewayResolverImpl();

    private AuthenticationRedirectStrategy authenticationRedirectStrategy = new DefaultAuthenticationRedirectStrategy();

    private UrlPatternMatcherStrategy ignoreUrlPatternMatcherStrategyClass = null;

    private static final Map<String, Class<? extends UrlPatternMatcherStrategy>> PATTERN_MATCHER_TYPES =
        new HashMap<String, Class<? extends UrlPatternMatcherStrategy>>();

    static {
        PATTERN_MATCHER_TYPES.put("CONTAINS", ContainsPatternUrlPatternMatcherStrategy.class);
        PATTERN_MATCHER_TYPES.put("REGEX", RegexUrlPatternMatcherStrategy.class);
        PATTERN_MATCHER_TYPES.put("FULL_REGEX", EntireRegionRegexUrlPatternMatcherStrategy.class);
        PATTERN_MATCHER_TYPES.put("EXACT", ExactUrlPatternMatcherStrategy.class);
    }

    public AuthenticationFilter() {
        this(Protocol.CAS2);
    }

    protected AuthenticationFilter(final Protocol protocol) {
        super(protocol);
    }
}

public final void doFilter(final ServletRequest servletRequest,
    final ServletResponse servletResponse, final FilterChain filterChain)
    throws IOException, ServletException {
  final HttpServletRequest request = (HttpServletRequest) servletRequest;
  final HttpServletResponse response = (HttpServletResponse) servletResponse;
  final HttpSession session = request.getSession(false);
  //从session中获取名为"_const_cas_assertion_"的Assertion
  final Assertion assertion = (session != null) ? (Assertion) session.getAttribute(CONST_CAS_ASSERTION) : null;
  //如果存在，则说明已经登录，本过滤器处理完成，处理下个过滤器
  if (assertion != null) {
    filterChain.doFilter(request, response);
    return;
  }
  //生成serviceUrl
  final String serviceUrl = constructServiceUrl(request, response);
  //从request中获取参数ticket
  final String ticket = CommonUtils.safeGetParameter(request, getArtifactParameterName());
  final boolean wasGatewayed = this.gatewayStorage.hasGatewayedAlready(request, serviceUrl);
  //如果ticket不为空，本过滤器处理完成，处理下个过滤器
  if ((CommonUtils.isNotBlank(ticket)) || (wasGatewayed)) {
    filterChain.doFilter(request, response);
    return;
  }
 
  this.log.debug("no ticket and no assertion found");
 
  final String modifiedServiceUrl;
  if (this.gateway) {
    this.log.debug("setting gateway attribute in session");
    modifiedServiceUrl = this.gatewayStorage.storeGatewayInformation(request, serviceUrl);
  } else {
    modifiedServiceUrl = serviceUrl;
  }
 
  if (this.log.isDebugEnabled()) {
    this.log.debug("Constructed service url: " + modifiedServiceUrl);
  }
 
  //生成重定向URL
  final String urlToRedirectTo = CommonUtils.constructRedirectUrl(this.casServerLoginUrl, getServiceParameterName(),
      modifiedServiceUrl, this.renew, this.gateway);
 
  if (this.log.isDebugEnabled()) {
    this.log.debug("redirecting to \"" + urlToRedirectTo + "\"");
  }
  //跳转到CAS服务器的登录页面
  response.sendRedirect(urlToRedirectTo);
}

public abstract class AbstractTicketValidationFilter extends AbstractCasFilter {

    /** The TicketValidator we will use to validate tickets. */
    private TicketValidator ticketValidator;

    /**
     * Specify whether the filter should redirect the user agent after a
     * successful validation to remove the ticket parameter from the query
     * string.
     */
    private boolean redirectAfterValidation = true;

    /** Determines whether an exception is thrown when there is a ticket validation failure. */
    private boolean exceptionOnValidationFailure = false;

    /**
     * Specify whether the Assertion should be stored in a session
     * attribute {@link AbstractCasFilter#CONST_CAS_ASSERTION}.
     */
    private boolean useSession = true;
  ...
}

public class Cas20ProxyReceivingTicketValidationFilter extends AbstractTicketValidationFilter {}

public final void doFilter(final ServletRequest servletRequest,
    final ServletResponse servletResponse, final FilterChain filterChain)
    throws IOException, ServletException {
  if (!preFilter(servletRequest, servletResponse, filterChain)) {
    return;
  }
 
  final HttpServletRequest request = (HttpServletRequest) servletRequest;
  final HttpServletResponse response = (HttpServletResponse) servletResponse;
  //从request中获取ticket
  final String ticket = CommonUtils.safeGetParameter(request, getArtifactParameterName());
  //ticket不为空，验证ticket，否则本过滤器处理完成，处理下个过滤器
  if (CommonUtils.isNotBlank(ticket)) {
    if (this.log.isDebugEnabled()) {
      this.log.debug("Attempting to validate ticket: " + ticket);
    }
    try {
      //验证ticket并产生Assertion对象，错误抛出TicketValidationException异常
      final Assertion assertion = this.ticketValidator.validate(ticket, constructServiceUrl(request, response));
 
      if (this.log.isDebugEnabled()) {
        this.log.debug("Successfully authenticated user: " + assertion.getPrincipal().getName());
      }
      //request设置assertion
      request.setAttribute(CONST_CAS_ASSERTION, assertion);
      //session设置assertion
      if (this.useSession) {
        request.getSession().setAttribute(CONST_CAS_ASSERTION, assertion);
      }
      
      // 成功回调
      onSuccessfulValidation(request, response, assertion);
 
      if (this.redirectAfterValidation) {
        this.log.debug("Redirecting after successful ticket validation.");
        response.sendRedirect(constructServiceUrl(request, response));
        return;
      }
    } catch (final TicketValidationException e) {
      logger.debug(e.getMessage(), e);

      // 失败回调
      onFailedValidation(request, response);

      if (this.exceptionOnValidationFailure) {
        throw new ServletException(e);
      }

      response.sendError(HttpServletResponse.SC_FORBIDDEN, e.getMessage());

      return;
    }
  }
  //本过滤器处理完成，处理下个过滤器
  filterChain.doFilter(request, response);
}

public interface TicketValidator {

    /**
     * Attempts to validate a ticket for the provided service.
     *
     * @param ticket the ticket to attempt to validate.
     * @param service the service this ticket is valid for.
     * @return an assertion from the ticket.
     * @throws TicketValidationException if the ticket cannot be validated.
     *
     */
    Assertion validate(String ticket, String service) throws TicketValidationException;
}

   Assertion assertion = AssertionHolder.getAssertion();