CAS之单点登出逻辑详解

<filter>
   <filter-name>CAS Single Sign Out Filter</filter-name>
   <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
</filter>
<filter-mapping>
   <filter-name>CAS Single Sign Out Filter</filter-name>
   <url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
    <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
</listener>

@Override
public void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse,
           final FilterChain filterChain) throws IOException, ServletException {
  final HttpServletRequest request = (HttpServletRequest) servletRequest;
  final HttpServletResponse response = (HttpServletResponse) servletResponse;

  /**
   * <p>Workaround for now for the fact that Spring Security will fail since it doesn't call {@link #init(javax.servlet.FilterConfig)}.</p>
   * <p>Ultimately we need to allow deployers to actually inject their fully-initialized {@link org.jasig.cas.client.session.SingleSignOutHandler}.</p>
   */
  if (!this.handlerInitialized.getAndSet(true)) {
    HANDLER.init();
  }

  if (HANDLER.process(request, response)) {
    filterChain.doFilter(servletRequest, servletResponse);
  }
}

public synchronized void init() {
  if (this.safeParameters == null) {
    CommonUtils.assertNotNull(this.artifactParameterName, "artifactParameterName cannot be null.");
    CommonUtils.assertNotNull(this.logoutParameterName, "logoutParameterName cannot be null.");
    CommonUtils.assertNotNull(this.sessionMappingStorage, "sessionMappingStorage cannot be null.");
    CommonUtils.assertNotNull(this.relayStateParameterName, "relayStateParameterName cannot be null.");

    if (this.artifactParameterOverPost) {
      this.safeParameters = Arrays.asList(this.logoutParameterName, this.artifactParameterName);
    } else {
      this.safeParameters = Collections.singletonList(this.logoutParameterName);
    }
  }
}

public boolean process(final HttpServletRequest request, final HttpServletResponse response) {
  if (isTokenRequest(request)) {
    logger.trace("Received a token request");
    recordSession(request);
    return true;
  } 
  
  if (isLogoutRequest(request)) {
    logger.trace("Received a logout request");
    destroySession(request);
    return false;
  } 
  logger.trace("Ignoring URI for logout: {}", request.getRequestURI());
  return true;
}

private void recordSession(final HttpServletRequest request) {
  final HttpSession session = request.getSession(this.eagerlyCreateSessions);

  if (session == null) {
    logger.debug("No session currently exists (and none created).  Cannot record session information for single sign out.");
    return;
  }

  final String token = CommonUtils.safeGetParameter(request, this.artifactParameterName, this.safeParameters);
  logger.debug("Recording session for token {}", token);

  try {
    this.sessionMappingStorage.removeBySessionById(session.getId());
  } catch (final Exception e) {
    // ignore if the session is already marked as invalid. Nothing we can do!
  }
  sessionMappingStorage.addSessionById(token, session);
}

private void destroySession(final HttpServletRequest request) {
  String logoutMessage = CommonUtils.safeGetParameter(request, this.logoutParameterName, this.safeParameters);
  if (CommonUtils.isBlank(logoutMessage)) {
    logger.error("Could not locate logout message of the request from {}", this.logoutParameterName);
    return;
  }
  
  if (!logoutMessage.contains("SessionIndex")) {
    logoutMessage = uncompressLogoutMessage(logoutMessage);
  }
  
  logger.trace("Logout request:\n{}", logoutMessage);
  final String token = XmlUtils.getTextForElement(logoutMessage, "SessionIndex");
  if (CommonUtils.isNotBlank(token)) {
    final HttpSession session = this.sessionMappingStorage.removeSessionByMappingId(token);

    if (session != null) {
      final String sessionID = session.getId();
      logger.debug("Invalidating session [{}] for token [{}]", sessionID, token);

      try {
        session.invalidate();
      } catch (final IllegalStateException e) {
        logger.debug("Error invalidating session.", e);
      }
      this.logoutStrategy.logout(request);
    }
  }
}

public interface SessionMappingStorage {

    /**
     * Remove the HttpSession based on the mappingId.
     * 
     * @param mappingId the id the session is keyed under.
     * @return the HttpSession if it exists.
     */
    HttpSession removeSessionByMappingId(String mappingId);

    /**
     * Remove a session by its Id.
     * @param sessionId the id of the session.
     */
    void removeBySessionById(String sessionId);

    /**
     * Add a session by its mapping Id.
     * @param mappingId the id to map the session to.
     * @param session the HttpSession.
     */
    void addSessionById(String mappingId, HttpSession session);

}

public final class HashMapBackedSessionMappingStorage implements SessionMappingStorage {

    /**
     * Maps the ID from the CAS server to the Session.
     */
    private final Map<String, HttpSession> MANAGED_SESSIONS = new HashMap<String, HttpSession>();

    /**
     * Maps the Session ID to the key from the CAS Server.
     */
    private final Map<String, String> ID_TO_SESSION_KEY_MAPPING = new HashMap<String, String>();

    private final Logger logger = LoggerFactory.getLogger(getClass());

    @Override
    public synchronized void addSessionById(final String mappingId, final HttpSession session) {
        ID_TO_SESSION_KEY_MAPPING.put(session.getId(), mappingId);
        MANAGED_SESSIONS.put(mappingId, session);

    }

    @Override
    public synchronized void removeBySessionById(final String sessionId) {
        logger.debug("Attempting to remove Session=[{}]", sessionId);

        final String key = ID_TO_SESSION_KEY_MAPPING.get(sessionId);

        if (logger.isDebugEnabled()) {
            if (key != null) {
                logger.debug("Found mapping for session.  Session Removed.");
            } else {
                logger.debug("No mapping for session found.  Ignoring.");
            }
        }
        MANAGED_SESSIONS.remove(key);
        ID_TO_SESSION_KEY_MAPPING.remove(sessionId);
    }

    @Override
    public synchronized HttpSession removeSessionByMappingId(final String mappingId) {
        final HttpSession session = MANAGED_SESSIONS.get(mappingId);

        if (session != null) {
            removeBySessionById(session.getId());
        }

        return session;
    }
}

public final class SingleSignOutHttpSessionListener implements HttpSessionListener {

    private SessionMappingStorage sessionMappingStorage;

    @Override
    public void sessionCreated(final HttpSessionEvent event) {
        // nothing to do at the moment
    }

    @Override
    public void sessionDestroyed(final HttpSessionEvent event) {
        if (sessionMappingStorage == null) {
            sessionMappingStorage = getSessionMappingStorage();
        }
        final HttpSession session = event.getSession();
        sessionMappingStorage.removeBySessionById(session.getId());
    }

    /**
     * Obtains a {@link SessionMappingStorage} object. Assumes this method will always return the same
     * instance of the object.  It assumes this because it generally lazily calls the method.
     * 
     * @return the SessionMappingStorage
     */
    protected static SessionMappingStorage getSessionMappingStorage() {
        return SingleSignOutFilter.getSingleSignOutHandler().getSessionMappingStorage();
    }
}