Spring Security 单点登录简单示例详解

首先，需要明确单点登录（Single Sign-On，SSO）是什么。它指的是用户只需要进行一次身份验证，就能在多个应用系统中使用其权限，而无需再次输入其凭证或重新进行身份验证。

Spring Security 是 Spring 家族中的安全框架，为 Web 应用提供了认证和授权方案，并支持单点登录。

下面，我们将详细讲解“Spring Security 单点登录简单示例”的完整攻略。

1. Spring Security 配置文件

Spring Security 配置文件是关键，必须正确配置。示例代码可以参考下面的样例：

<beans:bean id="userService" class="com.example.demo.service.UserService" />

<!-- 配置Spring Security的过滤器链 -->
<http auto-config="true" use-expressions="true">

    <!-- 应用请求地址认证 -->
    <intercept-url pattern="/login.jsp" access="permitAll" />
    <intercept-url pattern="/**" access="isAuthenticated()" />

    <!-- 自定义登录页面 -->
    <form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=true" />

    <!-- 登出过滤器 -->
    <logout logout-success-url="/login.jsp" />

    <!-- 单点登录过滤器 -->
    <custom-filter ref="ssoFilter" position="CAS_FILTER" />

</http>

<!-- CAS 单点登录客户端 -->
<beans:bean id="casClientConfig" class="org.jasig.cas.client.CasClientConfigurer">
    <beans:property name="loginUrl" value="https://example.com:8443/cas/login" />
    <beans:property name="serviceUrl" value="http://localhost:8080/demo/cas" />
    <beans:property name="gateway" value="true" />
</beans:bean>

<!-- CAS 单点登录过滤器 -->
<beans:bean id="ssoFilter" class="org.jasig.cas.client.authentication.AuthenticationFilter">
    <beans:property name="casServerLoginUrl" value="https://example.com:8443/cas/login" />
    <beans:property name="renew" value="false" />
    <beans:property name="gateway" value="true" />
    <beans:property name="service" value="${cas.service-url}" />
</beans:bean>

<!-- CAS 单点登录代理过滤器 -->
<beans:bean id="proxyFilter" class="org.jasig.cas.client.proxy.ProxyFilter">
    <beans:property name="casServerUrlPrefix" value="https://example.com:8443/cas" />
    <beans:property name="encoding" value="UTF-8" />
</beans:bean>

<!-- CAS 单点登录管理器 -->
<beans:bean id="ticketGrantingTicketStorage" class="org.jasig.cas.client.ticket.TicketGrantingTicketStorage">
    <beans:property name="memcachedClient" ref="memcachedClient" />
</beans:bean>

<beans:bean id="memcachedClient" class="net.spy.memcached.spring.MemcachedClientFactoryBean">
    <beans:property name="servers" value="localhost:11211" />
    <beans:property name="protocol" value="TEXT" />
    <beans:property name="transcoder">
        <beans:bean class="net.spy.memcached.transcoders.SerializingTranscoder" />
    </beans:property>
</beans:bean>

<!-- CAS 认证代理 -->
<beans:bean id="casAuthenticationProvider" class="org.jasig.cas.client.authentication.CasAuthenticationProvider">
    <beans:property name="userDetailsService" ref="userService" />
    <beans:property name="serviceProperties" ref="serviceProperties" />
    <beans:property name="ticketValidator">
        <beans:bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
            <beans:constructor-arg value="https://example.com:8443/cas" />
        </beans:bean>
    </beans:property>
    <beans:property name="key" value="myKey" />
</beans:bean>

<!-- CAS 认证服务属性 -->
<beans:bean id="serviceProperties" class="org.springframework.security.cas.ServiceProperties">
    <beans:property name="service" value="${cas.service-url}" />
    <beans:property name="sendRenew" value="false" />
</beans:bean>

<!-- 配置认证类型 -->
<authentication-manager>
    <authentication-provider ref="casAuthenticationProvider" />
</authentication-manager>

上述代码配置了 Spring Security 的过滤器链，并且通过 CAS 进行了单点登录。

2. 单点登录示例

我们可以使用 Spring Security 提供的单点登录示例进行测试。

第一个示例是基于 XML 配置的示例。示例代码如下：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
<beans>
    <import resource="classpath:/META-INF/spring/application-config.xml" />
    <import resource="classpath:/META-INF/spring/security-config.xml" />

    <bean id="clientContext" class="org.springframework.context.annotation.AnnotationConfigApplicationContext">
        <constructor-arg>
            <list>
                <value>org.springframework.security.sso.demo.ClientConfiguration</value>
            </list>
        </constructor-arg>
    </bean>

    <bean id="serverContext" class="org.springframework.context.annotation.AnnotationConfigApplicationContext">
        <constructor-arg>
            <list>
                <value>org.springframework.security.sso.demo.ServerConfiguration</value>
            </list>
        </constructor-arg>
    </bean>
</beans>

第二个示例是基于 Java 配置的示例。示例代码如下：

@Configuration
@ComponentScan("org.springframework.security.sso")
public class ClientConfiguration {
    @Bean
    public static PropertySourcesPlaceholderConfigurer propertySourcesPlaceholderConfigurer() {
        return new PropertySourcesPlaceholderConfigurer();
    }

    @Bean
    public Filter ssoFilter() {
        SsoFilter filter = new SsoFilter();
        filter.setClient(new ClientConfiguration());
        return filter;
    }

    @Bean
    public static RestTemplate restTemplate() {
        return new RestTemplateBuilder().build();
    }
}

@Configuration
@EnableResourceServer
public class ServerConfiguration extends ResourceServerConfigurerAdapter {
    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.antMatcher("/hi")
            .authorizeRequests().anyRequest().authenticated()
            .and().logout().logoutUrl("/logout").logoutSuccessUrl("/");
    }
}

通过这两个示例，我们可以更好地了解 Spring Security 单点登录的实现方法。