first, set 's web.xml, we use acegi cas filter:
<
filter-mapping
>
<
filter-name
>
hibernatefilter
filter-name
>
<
url-pattern
>
/j_acegi_cas_security_check
url-pattern
>
filter-mapping
>
we should set main acegi application context：
1) filterchainproxy should add a cas filter as acegi's sample, but here, we reuse
authenticationprocessingfilter, which we act as cas client filter.
<
bean
id
="filterchainproxy"
class
="org.acegisecurity.util.filterchainproxy"
>
<
property
name
="filterinvocationdefinitionsource"
>
<
value
>
convert_url_to_lowercase_before_comparison
pattern_type_apache_ant
/**=httpsessioncontextintegrationfilter,anonymousprocessingfilter,authenticationprocessingfilter,remembermeprocessingfilter,logoutfilter,channelprocessingfilter,basicprocessingfilter,securitycontextholderawarerequestfilter,exceptiontranslationfilter,filterinvocationinterceptor
value
>
property
>
bean
>
2)
authenticationprocessingfilter, of course, play the most important role in this
applicationcontext_acegi.xml.
in , /admin is protected resource, so defaulttargeturl protected it
and all those request to the target url must be authenticated by
authenticationmanager.
<bean id="authenticationprocessingfilter" class="org.acegisecurity.ui.cas.casprocessingfilter">
<property name="authenticationmanager" ref="authenticationmanager"/>
<property name="authenticationfailureurl">
<value>/security/login.jsp?login_error=1value>
property>
<property name="defaulttargeturl">
<value>/admin/value>
property>
<property name="filterprocessesurl">
<value>/j_acegi_cas_security_checkvalue>
property>
<property name="remembermeservices" ref="remembermeservices"/>
<property name="exceptionmappings">
<value>
org.acegisecurity.userdetails.usernamenotfoundexception=/security/login.jsp?login_error=user_not_found_error
org.acegisecurity.badcredentialsexception=/security/login.jsp?login_error=user_psw_error
org.acegisecurity.concurrent.concurrentloginexception=/security/login.jsp?login_error=too_many_user_error
value>
property>
bean>3) then, we set all the needed beans in cas filter
<bean id="exceptiontranslationfilter" class="org.acegisecurity.ui.exceptiontranslationfilter">
<property name="authenticationentrypoint">
<ref local="casprocessingfilterentrypoint"/>
property>
bean>
<bean id="casprocessingfilterentrypoint" class="org.acegisecurity.ui.cas.casprocessingfilterentrypoint">
<property name="loginurl"><value>https://sourcesite:8443/cas/loginvalue>property>
<property name="serviceproperties"><ref local="serviceproperties"/>property>
bean>
<bean id="authenticationmanager" class="org.acegisecurity.providers.providermanager">
<property name="providers">
<list>
<ref local="casauthenticationprovider"/>
list>
property>
bean>
<bean id="casauthenticationprovider" class="org.acegisecurity.providers.cas.casauthenticationprovider">
<property name="casauthoritiespopulator"><ref bean="casauthoritiespopulator"/>property>
<property name="casproxydecider"><ref local="casproxydecider"/>property>
<property name="ticketvalidator"><ref local="casproxyticketvalidator"/>property>
<property name="statelessticketcache"><ref local="statelessticketcache"/>property>
<property name="key"><value>my_password_for_this_auth_provider_onlyvalue>property>
bean>
<bean id="casproxyticketvalidator" class="org.acegisecurity.providers.cas.ticketvalidator.casproxyticketvalidator">
<property name="casvalidate"><value>https://sourcesite:8443/cas/proxyvalidatevalue>property>
<property name="serviceproperties"><ref local="serviceproperties"/>property>
bean>
<bean id="casproxydecider" class="org.acegisecurity.providers.cas.proxy.rejectproxytickets" />
<bean id="serviceproperties" class="org.acegisecurity.ui.cas.serviceproperties">
<property name="service">
<value>http://gzug:8080/springside/j_acegi_cas_security_checkvalue>
property>
<property name="sendrenew">
<value>falsevalue>
property>
bean>
<bean id="statelessticketcache" class="org.acegisecurity.providers.cas.cache.ehcachebasedticketcache">
<property name="cache">
<bean class="org.springframework.cache.ehcache.ehcachefactorybean">
<property name="cachemanager">
<bean class="org.springframework.cache.ehcache.ehcachemanagerfactorybean"/>
property>
<property name="cachename" value="usercache"/>
bean>
property>
bean>
<bean id="casauthoritiespopulator" class="org.acegisecurity.providers.cas.populator.daocasauthoritiespopulator">
<property name="userdetailsservice"><ref local="jdbcdaoimpl"/>property>
bean>
<bean id="casprocessingfilter" class="org.acegisecurity.ui.cas.casprocessingfilter">
<property name="authenticationmanager"><ref local="authenticationmanager"/>property>
<property name="authenticationfailureurl"><value>/casfailed.jspvalue>property>
<property name="defaulttargeturl"><value>/value>property>
<property name="filterprocessesurl"><value>/j_acegi_cas_security_checkvalue>property>
bean>
casprocessingfilterentrypoint is very critical,
loginurl is the cas server's /login url, you should set up your cas server(2.0 or 3.0) and config for
those jks keystore after enable ssl in tomcat(tomcat 5.5/conf/server.xml) and place the cacerts that
have the cas server's public cert to acegi client's /jre/lib/security/
check
serviceproperties to make sure that service url is config as /j_acegi_cas_security_check
because yale cas use ticket cache for sso impl, so we should config for
statelessticketcachejust use springframework's
ehcache for
cachemanager. use jdbcdaoimpl which perform database authentication. so i am very happy to use it
as
casauthoritiespopulator , which will set use detail for the user. and these info are very useful for
application authorization.
<bean id="jdbcdaoimpl"
class="org.acegisecurity.userdetails.jdbc.jdbcdaoimpl">
<property name="datasource" ref="datasource"/>
<property name="usersbyusernamequery">
<value>
select loginid,passwd,1 from ss_users where status='1' and loginid = ?
value>
property>
<property name="authoritiesbyusernamequery">
<value>
select u.loginid,p.name from ss_users u,ss_roles r,ss_permissions
p,ss_user_role ur,ss_role_permis rp where u.id=ur.user_id and
r.id=ur.role_id and p.id=rp.permis_id and
r.id=rp.role_id and p.status='1' and u.loginid=?
value>
property>
bean>
there is little difference between casclient 2.0.12 and acegi, right?
note that in my env, gzug:8080/springside is bookstore webapp
and sourcesite:8443 is the cas 3 server.
hope for suggestion.....