将属性从 CAS 释放到 Spring security

我在客户端使用 Spring security 3.X，在服务器上使用 CAS 4.0。

当我进行 CAS+Spring 安全集成时，我能够达到票证验证成功的水平，并能够在客户端获得适当的角色。

但我在 casServiceValidationSuccess.jsp 中添加了以下几行，以迭代并发送响应中的属性，因为我的属性未正确发布：

    <cas:attributes>
<cas:user>${fn:escapeXml(assertion.primaryAuthentication.principal.id)}</cas:user>
    <c:forEach var="attr" items="${assertion.chainedAuthentications[fn:length(assertion.chainedAuthentications)-1].principal.attributes}">
         <cas:${fn:escapeXml(attr.key)}>${fn:escapeXml(attr.value)}</cas:${fn:escapeXml(attr.key)}>
    </c:forEach>
</cas:attributes>

所以想知道在CAS服务器端的deployerConfigContext.xml中是否还有其他替代更改可以释放特定的属性-“权限”（在我的例子中）并在SPRING客户端中获得相同的属性。

找到现有的deployerConfigContext.xml 尝试释放“authorities”属性的片段：

    <bean id="authenticationManager" class="org.jasig.cas.authentication.PolicyBasedAuthenticationManager">
        <constructor-arg>
            <map>
                <entry key-ref="proxyAuthenticationHandler" value-ref="proxyPrincipalResolver" />
                <entry key-ref="primaryAuthenticationHandler" value-ref="primaryPrincipalResolver" />
            </map>
        </constructor-arg>

    <bean id="primaryAuthenticationHandler" class="org.jasig.cas.adaptors.jdbc.QueryDatabaseAuthenticationHandler">
  <property name="dataSource" ref="dataSource" />
  <property name="sql" value="SELECT EMAIL FROM USER_DATA WHERE UserID = ?" />
</bean>
   <bean id="primaryPrincipalResolver"
          class="org.jasig.cas.authentication.principal.PersonDirectoryPrincipalResolver" >
        <property name="attributeRepository" ref="attributeRepository" />
    </bean>
   <bean id="attributeRepository"
    class="org.jasig.services.persondir.support.jdbc.SingleRowJdbcPersonAttributeDao">
    <constructor-arg index="0" ref="dataSource" />
    <constructor-arg index="1" value="SELECT UserID, UserROLES FROM USER_DATA WHERE {0}" />
    <property name="queryAttributeMapping">
        <map>
            <entry key="username" value="UserID" />
        </map>
    </property>
    <property name="resultAttributeMapping">
        <map>
            <entry key="UserID" value="username" />
            <entry key="UserROLES" value="UserROLES" />
        </map>
</property>     
</bean>
    <bean id="serviceRegistryDao" class="org.jasig.cas.services.InMemoryServiceRegistryDaoImpl">
        <property name="registeredServices">
            <list>
                <bean class="org.jasig.cas.services.RegisteredServiceImpl">
                    <property name="id" value="0"></property>
                    <property name="name" value="HTTP"></property>
                    <property name="description" value="Only Allows HTTP Urls"></property>
                    <property name="serviceId" value="http://**" />
                    <property name="usernameAttribute" value="username" />
                    <property name="ignoreAttributes" value="false" />
                    <property name="allowedAttributes">
                        <list>
                            <value>UserROLES</value>
                        </list>
                    </property>
                </bean>

            </list>
        </property>
    </bean>

还可以在spring客户端找到security-context.xml：

    <security:http use-expressions="true" entry-point-ref="casAuthenticationEntryPoint"
        auto-config="true">     
        <security:custom-filter position="CAS_FILTER"
            ref="casAuthenticationFilter"></security:custom-filter>
        <security:intercept-url pattern="/home" access="hasRole('ROLE_TEST')"></security:intercept-url>
        <security:intercept-url pattern="/**" access="hasRole('ROLE_ANONYMOUS')"></security:intercept-url>
    </security:http>

    <security:authentication-manager alias="authenticationManager">
        <security:authentication-provider
            ref="casAuthenticationProvider"></security:authentication-provider>
    </security:authentication-manager>

    <bean id="serviceProperties" class="org.springframework.security.cas.ServiceProperties">
        <property name="service"
            value="http://localhost:7080/test/j_spring_cas_security_check"></property>
        <property name="sendRenew" value="false"></property>
    </bean>

    <bean id="casAuthenticationFilter"
        class="org.springframework.security.cas.web.CasAuthenticationFilter">
        <property name="authenticationManager" ref="authenticationManager"></property>
        <property name="authenticationFailureHandler">
        <bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
            <property name="defaultFailureUrl" value="http://localhost:8090/cas-server-webapp-4.0.0/login"/>
        </bean>
    </property>
    <property name="authenticationSuccessHandler">
        <bean class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
            <property name="defaultTargetUrl" value="/home.jsp"/>
        </bean>
    </property>
    </bean>

    <bean id="casAuthenticationEntryPoint"
        class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
        <property name="loginUrl"
            value="http://localhost:8090/cas-server-webapp-4.0.0/login"></property>
        <property name="serviceProperties" ref="serviceProperties"></property>
    </bean>

    <!-- Handles the CAS ticket processing. -->
    <bean id="casAuthenticationProvider"
        class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
        <!-- <property name="userDetailsService" ref="userService"></property>  -->
    <property name="authenticationUserDetailsService" ref="authenticationUserDetailsService" />
        <property name="serviceProperties" ref="serviceProperties"></property>
        <property name="ticketValidator">
            <bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
                <constructor-arg index="0"
                    value="http://localhost:8090/cas-server-webapp-4.0.0">
                </constructor-arg>
            </bean>
        </property>
        <property name="key" value="cas"></property>
    </bean>

    <bean id="authenticationUserDetailsService"
        class="org.springframework.security.cas.userdetails.GrantedAuthorityFromAssertionAttributesUserDetailsService">
        <constructor-arg>
            <list>
                <value>UserROLES</value>
            </list>
        </constructor-arg>
    </bean>
</beans>

免责声明：我是 CAS 主席，也是 CAS 云创始人（https://www.casinthecloud.com https://www.casinthecloud.com).

您的身份验证处理程序是否引用了您的属性 person DAO？如果没有 Spring security 进行手动服务票证验证，它是否可以工作？