在前后端分离项目中应用CAS

CAS在前后端不分离项目中可以轻松对接，但是在分离项目中我们需要进行一些改造才能完成，本文以Springboot项目为例进行讲解

后端配置

1. 引入依赖

        <dependency>
            <groupId>org.jasig.cas.client</groupId>
            <artifactId>cas-client-support-springboot</artifactId>
            <version>3.6.4</version>
        </dependency>

2. 配置

cas:
  server-url-prefix: https://sso.xxx.com/cas # sso服务前缀
  server-login-url: https://sso.xxx.com/cas/login # sso服务登陆地址
  client-host-url: http://xxx.com # 对接sso登陆的前端域名
  validation-type: CAS3 # cas校验版本
  authentication-url-patterns:
    - /policy/* # 需要验证登陆的地址，如果配置了context-path，忽略context-path

3. 重写redirect逻辑
   cas-client的filter默认实现为未登录后端302跳转到sso登录页面，但是在sso单独部署的场景下，前端会出现跨域问题，所以需要重写逻辑

实现AuthenticationRedirectStrategy

import com.alibaba.fastjson.JSONObject;
import lombok.extern.slf4j.Slf4j;
import org.jasig.cas.client.authentication.AuthenticationRedirectStrategy;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Component;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;

@Component
public class CustomAuthRedirectStrategy implements AuthenticationRedirectStrategy {

    @Override
    public void redirect(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, String s) throws IOException {
        httpServletResponse.setStatus(HttpStatus.UNAUTHORIZED.value());
        httpServletResponse.setHeader("content-type", "text/html;charset=UTF-8");
        httpServletResponse.setCharacterEncoding("UTF-8");
        PrintWriter out = httpServletResponse.getWriter();
        JSONObject jsonObject = new JSONObject();
        jsonObject.put("status", HttpStatus.UNAUTHORIZED.value());
        jsonObject.put("message", "未登录");
        String res = jsonObject.toJSONString();
        out.write(res);
    }
}

实现CasClientConfigurer

import org.jasig.cas.client.boot.configuration.CasClientConfigurer;
import org.jasig.cas.client.boot.configuration.EnableCasClient;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Configuration;

@Configuration
@EnableCasClient // 开启cas-client
public class CasAuthConfig implements CasClientConfigurer {

    @Override
    public void configureAuthenticationFilter(FilterRegistrationBean authenticationFilter) {
        // 源码中使用反射初始化authenticationRedirectStrategyClass, 用自定义的跳转类覆盖默认的authenticationRedirectStrategyClass
        authenticationFilter.getInitParameters().put("authenticationRedirectStrategyClass", CustomAuthRedirectStrategy.class.getName());
    }
}

4. 编写cas相关接口

为了避免ticket丢失问题，需要将回调地址设置为后端接口，再redirect到前端首页

import lombok.SneakyThrows;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import javax.servlet.http.HttpServletResponse;

@Controller
@RequestMapping("/cas/v1")
public class CasController {

    @Value("${cas.client-host-url}")
    private String clientUrl;

    /**
     * 用于前端登陆后回调，跳转回前端首页
     **/
    @SneakyThrows
    @GetMapping
    public void casRedirect(HttpServletResponse response) {
        response.sendRedirect(clientUrl);
    }
}

前端配置

以axios为例

axios.interceptors.response.use(function (response) {
          if (response.status === 401) {
              location.href = 'https://sso.xxx.com/cas/login?service=' + encodeURIComponent(window.location.origin + '/auth/api/auth/cas/v1');
          }
          return response;
        });

nginx配置

如果出现了跨多个nginx或者部署多台的情况，需要特殊配置

worker_processes  1;

events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    keepalive_timeout  65;

    upstream authBe {
        server server1:10010;
        server server2:10010;
        iphash; # cas使用session模式，避免多台出现session丢失的问题
    }

    upstream authFe {
        server server1:10020;
    }

    server {
        listen       10000;
        server_name  localhost;

        location ^~ /api {
            proxy_pass   http://authBe;
                # 当出现多nginx路由或者修改path时，会出现cookie丢失的  情况，需要进行以下配置
                proxy_cookie_path /api/ /;
                proxy_cookie_path /api /;
                proxy_set_header Cookie $http_cookie
        }

        location / {
            proxy_pass   http://authFe;
        }

    }

    include servers/*;
}

经过以上步骤就完成了cas-client与sso服务的对接～