CAS应用端异常解决
说明：因为当在浏览器的URL行输入要访问应用的URL后跟无效的ticket时，原有的CAS应用端过滤器会抛出异常，所以加入以下红色部分的代码。
?
package edu.yale.its.tp.cas.client.filter;
import java.io.*;
import java.net.*;
import java.util.*;
import javax.servlet.*;
import javax.servlet.http.*;
import edu.yale.its.tp.cas.client.*;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
?
public class CASFilter implements Filter {
??? private static Log log = LogFactory.getLog(CASFilter.class);
??? // Filter initialization parameters
????
???public final static String LOGIN_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.loginUrl";????
???
?? public final static String VALIDATE_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.validateUrl";????
??
?? public final static String SERVICE_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.serviceUrl";????
???
?? public final static String SERVERNAME_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.serverName";
????
?? public final static String RENEW_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.renew";????
??
?? public final static String AUTHORIZED_PROXY_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.authorizedProxy";
????
?? public final static String PROXY_CALLBACK_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.proxyCallbackUrl";????
???
?? public final static String WRAP_REQUESTS_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.wrapRequest";
????
?? public final static String GATEWAY_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.gateway";
???
??? // Session attributes used by this filter
??? /** <p>Session attribute in which the username is stored.</p> */
??? public final static String CAS_FILTER_USER =
??????? "edu.yale.its.tp.cas.client.filter.user";
???
??? /**
???? * Session attribute in which the CASReceipt is stored.
???? */
??? public final static String CAS_FILTER_RECEIPT =
??????? "edu.yale.its.tp.cas.client.filter.receipt";
???
??? /**
???? * Session attribute in which internally used gateway
???? * attribute is stored.
???? */
??? private static final String CAS_FILTER_GATEWAYED =
??????? "edu.yale.its.tp.cas.client.filter.didGateway";
???????
??? //*********************************************************************
??? // Configuration state
??? /** Secure URL whereat CAS offers its login service. */
??? private String casLogin;
??? /** Secure URL whereat CAS offers its CAS 2.0 validate service */
??? private String casValidate;
??? /** Filtered service URL for use as service parameter to login and validate */
??? private String casServiceUrl;
??? /** Name of server, for use in assembling service URL for use as service parameter to login and validate. */
??? private String casServerName;
??? /** Secure URL whereto this filter should ask CAS to send Proxy Granting Tickets. */
??? private String casProxyCallbackUrl;
???
??? /** True if renew parameter should be set on login and validate */
??? private boolean casRenew;
???
??? /** True if this filter should wrap requests to expose authenticated user as getRemoteUser(); */
??? private boolean wrapRequest;
???
??? /** True if this filter should set gateway=true on login redirect */
??? private boolean casGateway = false;
???
??? /**
???? * List of ProxyTicketReceptor URLs of services authorized to proxy to the path
???? * behind this filter.
???? */
??? private List authorizedProxies = new ArrayList();
??? //*********************************************************************
??? // Initialization
??? public void init(FilterConfig config) throws ServletException {
??????? casLogin =
??????????? config.getInitParameter(
??????????????? LOGIN_INIT_PARAM);
??????? casValidate =
??????????? config.getInitParameter(
??????????????? VALIDATE_INIT_PARAM);
??????? casServiceUrl =
??????????? config.getInitParameter(
??????????????? SERVICE_INIT_PARAM);
??????? String casAuthorizedProxy =
??????????? config.getInitParameter(
??????????????? AUTHORIZED_PROXY_INIT_PARAM);
??????? casRenew =
??????????? Boolean.valueOf(config.getInitParameter(RENEW_INIT_PARAM)).booleanValue();
??????? casServerName =
??????????? config.getInitParameter(
??????????????? SERVERNAME_INIT_PARAM);
??????? casProxyCallbackUrl =
??????????? config.getInitParameter(
??????????????? PROXY_CALLBACK_INIT_PARAM);
??????? wrapRequest =
??????????? Boolean
??????????????? .valueOf(
??????????????????? config.getInitParameter(
??????????????????????? WRAP_REQUESTS_INIT_PARAM))
??????????????? .booleanValue();
??????? casGateway =
??????????? Boolean
??????????????? .valueOf(
??????????????????? config.getInitParameter(
??????????????????????? GATEWAY_INIT_PARAM))
??????????????? .booleanValue();
??????? if (casGateway && Boolean.valueOf(casRenew).booleanValue()) {
??????????? throw new ServletException("gateway and renew cannot both be true in filter configuration");
??????? }
??????? if (casServerName != null && casServiceUrl != null) {
??????????? throw new ServletException("serverName and serviceUrl cannot both be set: choose one.");
??????? }
??????? if (casServerName == null && casServiceUrl == null) {
??????????? throw new ServletException("one of serverName or serviceUrl must be set.");
??????? }
??????? if (casServiceUrl != null){
??????????? if (! (casServiceUrl.startsWith("https://")|| (casServiceUrl.startsWith("http://") ))){
??????????????? throw new ServletException("service URL must start with http:// or https://; its current value is [" + casServiceUrl + "]");
??????????? }
??????? }
???????
??????? if (casValidate == null){
??????????? throw new ServletException("validateUrl parameter must be set.");
??????? }
??????? if (! casValidate.startsWith("https://")){
??????????? throw new ServletException("validateUrl must start with https://, its current value is [" + casValidate + "]");
??????? }
???????
??????? if (casAuthorizedProxy != null){
???????????
??????????? // parse and remember authorized proxies
??????????? StringTokenizer casProxies =
??????????????? new StringTokenizer(casAuthorizedProxy);
??????????? while (casProxies.hasMoreTokens()) {
??????????????? String anAuthorizedProxy = casProxies.nextToken();
??????????????? if (!anAuthorizedProxy.startsWith("https://")){
??????????????????? throw new ServletException("CASFilter initialization parameter for authorized proxies " +
??????????????????????????? "must be a whitespace delimited list of authorized proxies.? " +
??????????????????????????? "Authorized proxies must be secure (https) addresses.? This one wasn't: [" + anAuthorizedProxy + "]");
??????????????? }
??????????????? this.authorizedProxies.add(anAuthorizedProxy);
??????????? }
??????? }
???????
??????? if (log.isDebugEnabled()){
?????log.debug(("CASFilter initialized as: [" + toString() + "]"));
??????? }
??? }
??? //*********************************************************************
??? // Filter processing
??? public void doFilter(
??????? ServletRequest request,
??????? ServletResponse response,
??????? FilterChain fc)
??????? throws ServletException, IOException {
????if (log.isTraceEnabled()){
?????log.trace("entering doFilter()");
????}
??????? // make sure we've got an HTTP request
??????? if (!(request instanceof HttpServletRequest)
??????????? || !(response instanceof HttpServletResponse)) {
??????????? ?log.error("doFilter() called on a request or response that was not an HttpServletRequest or response.");
???????throw new ServletException("CASFilter protects only HTTP resources");
??????????? }
???????????
??????? // Is this a request for the proxy callback listener?? If so, pass
??????? // it through
??????? if (casProxyCallbackUrl != null
??????????? && casProxyCallbackUrl.endsWith(
??????????????? ((HttpServletRequest) request).getRequestURI())
??????????? && request.getParameter("pgtId") != null
??????????? && request.getParameter("pgtIou") != null) {
??????????? ?log.trace("passing through what we hope is CAS's request for proxy ticket receptor.");
??????????? fc.doFilter(request, response);
??????????? return;
??????? }
??????? // Wrap the request if desired
??????? if (wrapRequest) {
??????? ??log.trace("Wrapping request with CASFilterRequestWrapper.");
??????????? request = new CASFilterRequestWrapper((HttpServletRequest) request);
??????? }
??????? HttpSession session = ((HttpServletRequest) request).getSession();
??????? // if our attribute's already present and valid, pass through the filter chain
??????? CASReceipt receipt = (CASReceipt) session.getAttribute(CAS_FILTER_RECEIPT);
??????? if (receipt != null && isReceiptAcceptable(receipt)) {
??????? ??log.trace("CAS_FILTER_RECEIPT attribute was present and acceptable - passing? request through filter..");
??????????? fc.doFilter(request, response);
??????????? return;
??????? }
??????? // otherwise, we need to authenticate via CAS
??????? String ticket = request.getParameter("ticket");
??????? // no ticket?? abort request processing and redirect
??????? if (ticket == null || ticket.equals("")) {
??????log.trace("CAS ticket was not present on request.");
??????????? // did we go through the gateway already?
??????????? boolean didGateway =
??????????????? Boolean
??????????????????? .valueOf(
??????????????????????? (String) session.getAttribute(
??????????????????????????? CAS_FILTER_GATEWAYED))
??????????????????? .booleanValue();
??????????? if (casLogin == null) {
??????????? ??//TODO: casLogin should probably be ensured to not be null at filter initialization. -awp9
??????????? ??log.fatal("casLogin was not set, so filter cannot redirect request for authentication.");
??????????????? throw new ServletException(
??????????????????? "When CASFilter protects pages that do not receive a 'ticket' "
??????????????????????? + "parameter, it needs a edu.yale.its.tp.cas.client.filter.loginUrl "
??????????????????????? + "filter parameter");
??????????? }
??????????? if (!didGateway) {
??????????? ??log.trace("Did not previously gateway.? Setting session attribute to true.");
??????????????? session.setAttribute(
??????????????????? CAS_FILTER_GATEWAYED,
??????????????????? "true");
??????????????? redirectToCAS(
??????????????????? (HttpServletRequest) request,
??????????????????? (HttpServletResponse) response);
??????????????? // abort chain
??????????????? return;
??????????? } else {
??????????? ??log.trace("Previously gatewayed.");
??????????????? // if we should be logged in, make sure validation succeeded
??????????????? if (casGateway
??????????????????? || session.getAttribute(CAS_FILTER_USER) != null) {
??????????????????? ?log.trace("casGateway was true and CAS_FILTER_USER set: passing request along filter chain.");
??????????????????? // continue processing the request
??????????????????? fc.doFilter(request, response);
??????????????????? return;
??????????????? } else {
??????????????????? // unknown state... redirect to CAS
??????????????????? session.setAttribute(
??????????????????????? CAS_FILTER_GATEWAYED,
??????????????????????? "true");
??????????????????? redirectToCAS(
??????????????????????? (HttpServletRequest) request,
??????????????????????? (HttpServletResponse) response);
??????????????????? // abort chain
??????????????????? return;
??????????????? }
??????????? }
??????? }
???????
??????? HttpServletRequest req = (HttpServletRequest) request;
??????? HttpServletResponse rsp = (HttpServletResponse) response;
???????
??????? try {
??????????? receipt = getAuthenticatedUser((HttpServletRequest) request);
??????? } catch (CASAuthenticationException e) {
??????????? log.error(e);???????????
??????????? String casLoginURL=getCasLoginURL(req);
??????????? //当ticket无效时，转向登录页面；否则，显示异常信息
??????????? if (e.getMessage().indexOf("INVALID_TICKET") > 0) {??????????? ?
??????????????? rsp.sendRedirect(casLoginURL);
??????????? } else {??????????? ?
??????????????? sendPageInfo(rsp);
??????????? }
??????????? return;
??????? }
??????? if (! isReceiptAcceptable(receipt)){
??????????? throw new ServletException("Authentication was technically successful but rejected as a matter of policy. [" + receipt + "]");
??????? }
???????
??????? // Store the authenticated user in the session
??????? if (session != null) { // probably unnecessary
??????????? session.setAttribute(CAS_FILTER_USER, receipt.getUserName());
??????????? session.setAttribute(CASFilter.CAS_FILTER_RECEIPT, receipt);
??????????? // don't store extra unnecessary session state
??????????? session.removeAttribute(
??????????????? CAS_FILTER_GATEWAYED);
??????? }
??????? if (log.isTraceEnabled()){
?????log.trace("validated ticket to get authenticated receipt [" + receipt + "], now passing request along filter chain.");
??????? }
???????
??????? // continue processing the request
??????? fc.doFilter(request, response);
??????? log.trace("returning from doFilter()");
??? }
??
??? private boolean isReceiptAcceptable(CASReceipt receipt) {
??????? if (receipt == null)
??????????? throw new IllegalArgumentException("Cannot evaluate a null receipt.");??????? ?
??????? if (this.casRenew && !receipt.isPrimaryAuthentication()){
??????????? return false;
??????? }
??????? if (receipt.isProxied()){
??????????? if (! this.authorizedProxies.contains(receipt.getProxyingService())){
??????????????? return false;
??????????? }
??????? }
??????? return true;
??? }
?
??? private CASReceipt getAuthenticatedUser(HttpServletRequest request)
??????? throws ServletException, CASAuthenticationException {
??????? log.trace("entering getAuthenticatedUser()");
??????? ProxyTicketValidator pv = null;
???????
??????????? pv = new ProxyTicketValidator();
??????????? pv.setCasValidateUrl(casValidate);
??????????? pv.setServiceTicket(request.getParameter("ticket"));
??????????? pv.setService(getService(request));
??????????? pv.setRenew(Boolean.valueOf(casRenew).booleanValue());
??????????? if (casProxyCallbackUrl != null) {
??????????????? pv.setProxyCallbackUrl(casProxyCallbackUrl);
??????????? }
??????????? if (log.isDebugEnabled()) {
??????????????? log.debug(
??????????????????? "about to validate ProxyTicketValidator: [" + pv + "]");
??????????? }
???????????
??????????? return CASReceipt.getReceipt(pv);
???????
??? }
??
??? private String getService(HttpServletRequest request)
??????? throws ServletException {
??????? log.trace("entering getService()");
??????? String serviceString;
??????? // ensure we have a server name or service name
??????? if (casServerName == null && casServiceUrl == null)
??????????? throw new ServletException(
??????????????? "need one of the following configuration "
??????????????????? + "parameters: edu.yale.its.tp.cas.client.filter.serviceUrl or "
??????????????????? + "edu.yale.its.tp.cas.client.filter.serverName");
??????? // use the given string if it's provided
??????? if (casServiceUrl != null)
??????????? serviceString = URLEncoder.encode(casServiceUrl);
??????? else
??????????? // otherwise, return our best guess at the service
??????????? serviceString = Util.getService(request, casServerName);
??????? if (log.isTraceEnabled()) {
??????????? log.trace(
??????????????? "returning from getService() with service ["
??????????????????? + serviceString
??????????????????? + "]");
??????? }
??????? return serviceString;
??? }
??? /**
???? * Redirects the user to CAS, determining the service from the request.
???? */
??? private void redirectToCAS(
??????? HttpServletRequest request,
??????? HttpServletResponse response)
??????? throws IOException, ServletException {
??????? if (log.isTraceEnabled()) {
??????????? log.trace("entering redirectToCAS()");
??????? }
??????? String casLoginString =
??????????? casLogin
??????????????? + "?service="
??????????????? + getService((HttpServletRequest) request)
??????????????? + ((casRenew)
??????????????????? ? "&renew=true"
??????????????????? : "")
??????????????? + (casGateway ? "&gateway=true" : "");
??????? if (log.isDebugEnabled()) {
??????????? log.debug("Redirecting browser to [" + casLoginString + ")");
??????? }
??????? ((HttpServletResponse) response).sendRedirect(casLoginString);
??????? if (log.isTraceEnabled()) {
??????????? log.trace("returning from redirectToCAS()");
??????? }
??? }
??? public String toString() {
??????? StringBuffer sb = new StringBuffer();
??????? sb.append("[CASFilter:");
??????? sb.append(" casGateway=");
??????? sb.append(this.casGateway);
??????? sb.append(" wrapRequest=");
??????? sb.append(this.wrapRequest);
???????
??????? sb.append(" casAuthorizedProxies=[");
??????? sb.append(this.authorizedProxies);
??????? sb.append("]");
???????
??????? if (this.casLogin != null) {
??????????? sb.append(" casLogin=[");
??????????? sb.append(this.casLogin);
??????????? sb.append("]");
??????? } else {
??????????? sb.append(" casLogin=NULL!!!!!");
??????? }
???????
??????? if (this.casProxyCallbackUrl != null) {
??????????? sb.append(" casProxyCallbackUrl=[");
??????????? sb.append(casProxyCallbackUrl);
??????????? sb.append("]");
??????? }
???????
??????? if (this.casRenew) {
??????????? sb.append(" casRenew=true");
??????? }
???????
??????? if (this.casServerName != null) {
??????????? sb.append(" casServerName=[");
??????????? sb.append(casServerName);
??????????? sb.append("]");
??????? }
???????
??????? if (this.casServiceUrl != null) {
??????????? sb.append(" casServiceUrl=[");
??????????? sb.append(casServiceUrl);
??????????? sb.append("]");
??????? }
???????
??????? if (this.casValidate != null) {
??????????? sb.append(" casValidate=[");
??????????? sb.append(casValidate);
??????????? sb.append("]");
??????? } else {
??????????? sb.append(" casValidate=NULL!!!");
??????? }
???????
??????? return sb.toString();
??? }
??? /* (non-Javadoc)
???? * @see javax.servlet.Filter#destroy()
???? */
??? public void destroy() {
??????? // TODO Auto-generated method stub
???????
??? }
???
??? /***
???? * 返回单点登录URL和访问的应用系统URL
???? * @param request
???? * @return String
???? * @throws ServletException
???? */
??? private String getCasLoginURL(HttpServletRequest request) throws ServletException {
??????? StringBuilder sb = new StringBuilder();
??????? sb.append(casLogin).append("?service=").append(getService(request));
??????? return sb.toString();
??? }
???
??? /***
???? * 显示异常信息
???? * @param rsp
???? * @param content
???? * @throws IOException
???? */???
??? private void sendPageInfo(HttpServletResponse rsp) throws IOException {
??????? PrintWriter out = rsp.getWriter();
??????? try {?????? ?
??????? ?out.print("<body style='background-color: WhiteSmoke'>");
??????????? out.print("<div style='font: 20;'>Not Found</div>");??????????????????????
??????????? out.print("<hr/>");
??????????? out.print("<div style='font: 20;'>Sorry,Error!</div>");
??????????? out.print("</body>");???????????
??????? } finally {
??????????? out.close();
??????? }
??? }
???
}
