单点登录(Single Sign On)设计实践

     转到Architecture Team后接手了公司的Framework, 单点登录也就落到我头上了.

 

     公司最开始使用的策略是基于Tomcat 的Realm SSO, 这种策略的缺点是所有应用都必须放在同一个Tomcat下面, 放到不同Tomcat下都必须再做一次登录.

     非常不利于HA.

 

 

     (一)转到Architecture Team后我就向SDC的头提议了CAS的SSO策略.

 

 

 

 

 

 

 

1)      The user choose to visit AMS

2)      When the user arrived, AMS will first check to see if the user is authenticated by trying to locate a service ticket. if not, the framework on which the AMS built will redirect the user to the login page

3)      Then Framework will ask the user to enter username and password which can identify herself/himself

4)      If authentication passed, the user will be redirected back to AMS

5)      The user is granted to visit AMS

6)      If at some time during the same session the user serfs the BMS’ page with a ticket

7)      BMS will first check to see if the user is authenticated by trying to locate a service ticket. And it found one, but it doesn’t know whether it’s valid, so it ask CAS to check it out

8)      Validation pass

9)      BMS is granted to visit.

 

 

    检验一种方法的好坏是看它是否满足实际需要, 这种策略扩展性很好, 但是却需要独立部署一个中央认证系统. 公司非常不希望增加一个潜在的单点故障. 所以这个策略没被采纳.

 

 

   (二) 不知什么原因, 后来SSO被外包公司负责. 他们提供了另外一种方案, 还是基于Tomcat, 利用Domain Cookie, 修改自己的Realm Authenticator, 可以提供真正的SSO体验. 最大的缺点是不同的Web Container要实现一整套不同的实现.

 

 

   (三) 我自然对方案(二)很不满意. 吸取(二)的优点, 提出了以下方案. 基于Spring Security 2.0, 提供自己的SSOTicketFilter和SSOAuthenticationFilter. SSOAuthenticationFilter负责本地用户认证, SSOTicketFilter负责跨系统用户认证. SSOAuthenticationFilter在用户通过验证后保存Ticket. 跨系统时另一个系统由于也是采用Framework, 它也就会用同样的SSOTicketFilter实现来检验用户提供的Ticket. 经过验证, 方案(三)能够提供真正的SSO体验, 公司最终采取了这个方案.

 

 

  以下样例配置:

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.1.xsd">
                        
                        
	<beans:bean id="springSecurityFilterChain"
		class="org.springframework.security.util.FilterChainProxy">
		<beans:property name="filterChainMap">
			<beans:map>
				<beans:entry key="/**">
					<beans:list>
						<beans:ref local="httpSessionContextIntegrationFilter" />
						<beans:ref local="logoutFilter" />
						<beans:ref local="ssoTicketProcessingFilter" />
						<beans:ref local="ssoAuthenticationProcessingFilter" />
						<beans:ref local="exceptionTranslationFilter" />
						<beans:ref local="filterSecurityInterceptor" />
					</beans:list>
				</beans:entry>
			</beans:map>
		</beans:property>
	</beans:bean>
	<beans:bean id="httpSessionContextIntegrationFilter"
		class="org.springframework.security.context.HttpSessionContextIntegrationFilter">
	</beans:bean>
	<beans:bean id="exceptionTranslationFilter"
		class="org.springframework.security.ui.ExceptionTranslationFilter">
		<beans:property name="authenticationEntryPoint"
			ref="authenticationProcessingFilterEntryPoint">
		</beans:property>
	</beans:bean>
	<beans:bean id="ssoAuthenticationProcessingFilter"
		class="sso.SsoAuthenticationProcessingFilter">
		<beans:property name="authenticationManager" ref="authenticationManager"></beans:property>
		<beans:property name="defaultTargetUrl" value="/index.jsp"></beans:property>
		<beans:property name="authenticationFailureUrl" value="/login.jsp"></beans:property>
		<beans:property name="invalidateSessionOnSuccessfulAuthentication">
			<beans:value>true</beans:value>
		</beans:property>
	</beans:bean>
	<beans:bean id="authenticationProcessingFilterEntryPoint"
		class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
		<beans:property name="loginFormUrl" value="/login.jsp"></beans:property>
	</beans:bean>
	<beans:bean id="filterSecurityInterceptor"
		class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
		<beans:property name="authenticationManager" ref="authenticationManager" />
		<beans:property name="accessDecisionManager" ref="accessDecisionManager"></beans:property>
		<beans:property name="objectDefinitionSource">
			<!-- <filter-invocation-definition-source>
				<intercept-url pattern="/secure/super/**" access="ROLE_WE_DONT_HAVE" />
				<intercept-url pattern="/secure/**"
					access="ROLE_SUPERVISOR,ROLE_TELLER" />
			</filter-invocation-definition-source>
			 -->
			<beans:value>
		        CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
                /auth/login.action=ROLE_ANONYMOUS,ROLE_SUPERVISOR,ROLE_TELLER
                /**/*.action=ROLE_SUPERVISOR,ROLE_TELLER
                /**=ROLE_ANONYMOUS,ROLE_SUPERVISOR,ROLE_TELLER
		    </beans:value>
		</beans:property>
	</beans:bean>
	<beans:bean id="accessDecisionManager"
		class="org.springframework.security.vote.AffirmativeBased">
		<beans:property name="decisionVoters">
			<beans:list>
				<beans:ref local="voter"></beans:ref>
				<beans:bean class="org.springframework.security.vote.AuthenticatedVoter" />
			</beans:list>
		</beans:property>
	</beans:bean>
	<beans:bean id="voter" class="org.springframework.security.vote.RoleVoter">
	</beans:bean>
	<beans:bean id="ssoTicketProcessingFilter" class="sso.SsoTicketProcessingFilter">
		<custom-filter after="CAS_PROCESSING_FILTER" />
		<beans:property name="authenticationManager" ref="authenticationManager" />
		<beans:property name="defaultTargetUrl" value="/index.jsp"></beans:property>
		<beans:property name="authenticationFailureUrl" value="/j_spring_security_check"></beans:property>
		<beans:property name="invalidateSessionOnSuccessfulAuthentication">
			<beans:value>true</beans:value>
		</beans:property>
	</beans:bean>
	<beans:bean id="logoutFilter"
		class="org.springframework.security.ui.logout.LogoutFilter">
		<beans:constructor-arg>
			<beans:value>/login.jsp</beans:value>
		</beans:constructor-arg>
		<beans:constructor-arg>
			<beans:list>
				<beans:bean
					class="org.springframework.security.ui.logout.SecurityContextLogoutHandler"></beans:bean>
				<beans:bean class="sso.CleanTicketLogoutHandler"></beans:bean>
			</beans:list>
		</beans:constructor-arg>
	</beans:bean>
	<authentication-manager alias="authenticationManager" />
	<beans:bean id="casAuthenticationProvider" class="sso.SsoAuthenticationProvider">
		<custom-authentication-provider />
		<beans:property name="userDetailsService" ref="userDetailsService" />
	</beans:bean>
	<user-service id="userDetailsService">
		<user name="rod" password="rod"
			authorities="ROLE_SUPERVISOR, ROLE_USER, ROLE_TELLER" />
		<user name="dianne" password="dianne" authorities="ROLE_USER,ROLE_TELLER" />
		<user name="scott" password="scott" authorities="ROLE_USER" />
		<user name="peter" password="peter" authorities="ROLE_USER" />
	</user-service>
</beans:beans>

 

 

 

 

评论

4 楼 alloyer 2009-04-12  

good artical

3 楼 yangbeisi 2008-12-30  

你好，现在在做这个，相关代码可以共享下吗，谢谢！邮箱是[e-mail]

2 楼 sillycat 2008-12-01  

hi,你好。能有相关的代码吗？我的邮箱是[e-mail]

1 楼 ginge 2008-08-12  

这两天想到,为何不模仿CAS, 将Service和Ticket放到url中呢? 这样就摆脱了Cookie Domain的限制了.

另外, 应用一次性的Ticket策略提高系统的安全性. 以下是正式描述:

1) Adopted one-time ticket authentication strategy instead of cookie strategy
and get rid of cookie domain constraints.

It uses one-time ticket to strengthen the security of the authentication. The unique ticket will be renewed after the operator

passes the authentication, including normal login authentication and SSO login authentication. The unique ticket will be

invalidated after the operator logs out