使用 Spring Security 和 CAS 单点注销

Posted 2023-02-27

【中文标题】使用 Spring Security 和 CAS 单点注销

【英文标题】：Single Sign Out with Spring Security and CAS

【发布时间】：2015-05-07 15:17:18

【问题描述】：

使用纯 Spring Java Config 我无法让 Spring 和 CAS 执行单点注销。我使用以下配置进行单点登录。我使用一个简单的 JSP 页面对 url https://nginx.shane.com/app/logout 进行表单 POST，并将 CSRF 值包含在 POST 数据中。这一切似乎都没有错误，但是当我进入安全页面时，它只会让我重新进入而无需登录。有任何想法吗？

@Configuration
@EnableWebSecurity
public class SecurityWebAppConfig extends WebSecurityConfigurerAdapter 

@Bean
protected ServiceProperties serviceProperties() 
    ServiceProperties serviceProperties = new ServiceProperties();
    serviceProperties.setService("https://nginx.shane.com/app/j_spring_cas_security_check");
    serviceProperties.setSendRenew(false);
    return serviceProperties;


@Bean
public CasAuthenticationProvider casAuthenticationProvider() 
    CasAuthenticationProvider casAuthenticationProvider = new CasAuthenticationProvider();
    casAuthenticationProvider.setAuthenticationUserDetailsService(authenticationUserDetailsService());
    casAuthenticationProvider.setServiceProperties(serviceProperties());
    casAuthenticationProvider.setTicketValidator(cas20ServiceTicketValidator());
    casAuthenticationProvider.setKey("an_id_for_this_auth_provider_only");
    return casAuthenticationProvider;


@Bean
public AuthenticationUserDetailsService<CasAssertionAuthenticationToken> authenticationUserDetailsService() 
    return new TestCasAuthenticationUserDetailsService();


@Bean
public Cas20ServiceTicketValidator cas20ServiceTicketValidator() 
    return new Cas20ServiceTicketValidator("https://nginx.shane.com/cas");


@Bean
public CasAuthenticationFilter casAuthenticationFilter() throws Exception 
    CasAuthenticationFilter casAuthenticationFilter = new CasAuthenticationFilter();
    casAuthenticationFilter.setAuthenticationManager(authenticationManager());
    return casAuthenticationFilter;


@Bean
public CasAuthenticationEntryPoint casAuthenticationEntryPoint() 
    CasAuthenticationEntryPoint casAuthenticationEntryPoint = new CasAuthenticationEntryPoint();
    casAuthenticationEntryPoint.setLoginUrl("https://nginx.shane.com/cas/login");
    casAuthenticationEntryPoint.setServiceProperties(serviceProperties());

    return casAuthenticationEntryPoint;


@Bean
public SingleSignOutFilter singleSignOutFilter() 
    // This filter handles a Single Logout Request from the CAS Server
    return new SingleSignOutFilter();


@Bean
public LogoutFilter requestLogoutFilter() 
    // This filter redirects to the CAS Server to signal Single Logout should be performed
    SecurityContextLogoutHandler handler = new SecurityContextLogoutHandler();
    handler.setClearAuthentication(true);
    handler.setInvalidateHttpSession(true);

    LogoutFilter logoutFilter = new LogoutFilter("https://nginx.shane.com/", handler);
    return logoutFilter;


@Override
protected void configure(HttpSecurity http) throws Exception 
    http.addFilter(casAuthenticationFilter());
    http.addFilterBefore(requestLogoutFilter(), LogoutFilter.class);
    http.addFilterBefore(singleSignOutFilter(), CasAuthenticationFilter.class);

    http.exceptionHandling()
        .authenticationEntryPoint(casAuthenticationEntryPoint());

    http.authorizeRequests()
        .antMatchers("/admin/**").access("hasRole('ROLE_ADMIN')")
        .antMatchers("/dba/**").access("hasRole('ROLE_ADMIN') or hasRole('ROLE_DBA')");

    http.logout()
        .addLogoutHandler(handler)
        .deleteCookies("remove")
        .invalidateHttpSession(true)
        .logoutUrl("/logout")
        .logoutSuccessUrl("/");


@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception 
    auth.authenticationProvider(casAuthenticationProvider());

我还添加了一个 WebListener 来处理会话销毁事件：

@WebListener
public class SecurityWebListener implements HttpSessionListener 

private SingleSignOutHttpSessionListener listener = new SingleSignOutHttpSessionListener();

@Override
public void sessionCreated(HttpSessionEvent se) 
    listener.sessionCreated(se);


@Override
public void sessionDestroyed(HttpSessionEvent se) 
    listener.sessionDestroyed(se);

这是日志输出

[org.springframework.security.web.FilterChainProxy] [/logout at position 6 of 14 in additional filter chain; firing Filter: 'LogoutFilter'] []
[org.springframework.security.web.util.matcher.AntPathRequestMatcher] [Checking match of request : '/logout'; against '/logout'] []
[org.springframework.security.web.authentication.logout.LogoutFilter] [Logging out user 'org.springframework.security.cas.authentication.CasAuthenticationToken@836ad34b: Principal: org.springframework.security.core.userdetails.User@586034f: Username: admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffdaa08: RemoteIpAddress: 127.0.0.1; SessionId: FA880C15EF09C033E1CA0C8E4785905F; Granted Authorities: ROLE_ADMIN Assertion: org.jasig.cas.client.validation.AssertionImpl@fcd38ec Credentials (Service/Proxy Ticket): ST-23-1UandqRxBcG6HCTx0Pdd-cas01.example.org' and transferring to logout destination] []
[org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler] [Invalidating session: FA880C15EF09C033E1CA0C8E4785905F] []
[org.jasig.cas.client.session.HashMapBackedSessionMappingStorage] [Attempting to remove Session=[FA880C15EF09C033E1CA0C8E4785905F]] []
[org.jasig.cas.client.session.HashMapBackedSessionMappingStorage] [Found mapping for session.  Session Removed.] []
[org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler] [Using default Url: /] []
[org.springframework.security.web.DefaultRedirectStrategy] [Redirecting to '/app/'] []

【参考方案1】：

（不）幸运的是，我遇到了类似的问题；）当 CAS 尝试调用您的应用程序以注销时会发生这种情况。一方面 CAS 尝试传递 sessionId 来执行注销，另一方面 SpringSecurity 期望获得 CSRF 令牌，该令牌不是由 CAS 发送的，因为它只发送 GET 请求。 CsrfFilter 找不到 csrf 令牌并中断过滤器链。用户不知道这一点，因为 CAS 隐式调用注销请求。请求直接从 CAS 服务器发送到应用程序服务器，而不是通过在 Web 浏览器中重定向用户。

为了使其正常工作，您需要将 HttpSecurity 配置为排除/不包含 LogoutFilter filterProcessesUrl（在您的情况下为 j_spring_security_logout，因为您使用默认值）。

假设您在尝试创建新管理员时要检查CSRF，为此，您需要配置如下：

@Override
protected void configure(HttpSecurity http) throws Exception 
    http.addFilter(casAuthenticationFilter());
    http.addFilterBefore(requestLogoutFilter(), LogoutFilter.class);
    http.addFilterBefore(singleSignOutFilter(), CasAuthenticationFilter.class);

    http.exceptionHandling()
        .authenticationEntryPoint(casAuthenticationEntryPoint());

    http.authorizeRequests()
        .antMatchers("/admin/**").access("hasRole('ROLE_ADMIN')")
        .antMatchers("/dba/**").access("hasRole('ROLE_ADMIN') or hasRole('ROLE_DBA')");

    http.csrf()
        .requireCsrfProtectionMatcher(new AntPathRequestMatcher("/admin/create"));

    http.logout()
        .addLogoutHandler(handler)
        .deleteCookies("remove")
        .invalidateHttpSession(true)
        .logoutUrl("/logout")
        .logoutSuccessUrl("/");

只是为了说明，我已经添加了

http.csrf().requireCsrfProtectionMatcher(new AntPathRequestMatcher("/admin/create"));.

请注意，您不能使用匹配所有模式 (/admin/**)，因为您可能还想调用一些 get 请求，而 CSRF 过滤器会期望它们随后发送令牌。

Spring Security 3.2.x 之前的版本不会出现此类问题，因为那里引入了跨站点请求伪造 (CSRF) 支持。

希望这些帮助:)