学习笔记:微服务-6.spring zuul + spring security + cas client 实现微服务sso登录

关注

原创最新推荐文章于 2026-07-16 14:39:55 发布 6.6k 阅读 AI 写同款· GEO 优化 ›

java教程之Spring Security系列教程之实现CAS单点登录下篇-搭建CAS客户端一. 搭建CAS客户端 1. 创建新项目我们在之前的Spring Security项目中，创建一个新的module模块，作为CAS Client项目，如下图。 2. 引入依赖然后在这个模块的pom.xml文件中，引入相关依赖。 <dependencies> <dependency> <groupId>org.springframework.boot</groupId> &l... 阅读详情

上节架构了spring zuul实现微服务的网页路由，因为zuul是微服务群的统一入口，非常适合在zuul服务上进行统一登录认证，本节实验结合spring zuul +spring security +Apereo cas实现微服务群的统一登录认证

spring security是一个spring的权限认证系统，cas是单位中央认证系统，从中央认证系统认证后，获取一个中央认证系统的身份（本测试中认证用户名linbin），spring security对这个用户名进行映射，比如这里映射为spring security的登录用户admin(可以通过数据库查询映射关系)，并设置admin用户的权限，从而实现统一登录认证到本spring boot微服务的本地系统用户和权限的转换，而因zuul的统一api入口地位，这个登录可以作为整个微服务群的统一登录

1. 新建spring boot 微服务项目 Eureka-Client-zuul

pom.xml 全文

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<parent>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-parent</artifactId>
		<version>2.1.1.RELEASE</version>
		<relativePath/> <!-- lookup parent from repository -->
	</parent>
	<groupId>com.linbin</groupId>
	<artifactId>Eureda-Client-zuul</artifactId>
	<version>0.0.1-SNAPSHOT</version>
	<name>Eureda-Client-zuul</name>
	<description>Demo project for Spring Boot</description>
	<properties>
		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
		<java.version>1.8</java.version>
		<spring-cloud.version>Greenwich.M3</spring-cloud.version><!-- Finchley.M8 -->
	</properties>
	<dependencies>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-web</artifactId>
		</dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-netflix-zuul</artifactId>
        </dependency>
      <dependency> 
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-config</artifactId>
       </dependency>
      <dependency>
        <groupId>org.springframework.boot</groupId>
		  <artifactId>spring-boot-starter-security</artifactId> 
		 </dependency> 
   <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-cas</artifactId>
    </dependency>

		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-test</artifactId>
			<scope>test</scope>
		</dependency>
	</dependencies>
	<dependencyManagement>
		<dependencies>
			<dependency>
				<groupId>org.springframework.cloud</groupId>
				<artifactId>spring-cloud-dependencies</artifactId>
				<version>${spring-cloud.version}</version>
				<type>pom</type>
				<scope>import</scope>
			</dependency>
		</dependencies>
	</dependencyManagement>
		<repositories>
		<repository>
			<id>spring-milestones</id>
			<name>Spring Milestones</name>
			<url>https://repo.spring.io/milestone</url>
			<snapshots>
				<enabled>false</enabled>
			</snapshots>
		</repository>
	</repositories>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
			</plugin>
		</plugins>
	</build>
</project>

关键依赖：

<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-cas</artifactId>
</dependency>

2. application.properties 配置

server.port=8000
eureka.client.serviceUrl.defaultZone=http://admin:123@centos7:8888/eureka/
spring.application.name=Euredaclientzuul
zuul.routes.euredaclient1.path=/c1/**
zuul.routes.euredaclient1.serviceId=Euredaclient1
zuul.routes.springdemo.path=/sd/**
zuul.routes.springdemo.serviceId=SpringDemo
spring.session.store-type=none

3. java文件目录

4. 启动类EuredaClientZuulApplication

@EnableZuulProxy
@SpringBootApplication
public class EuredaClientZuulApplication {

   public static void main(String[] args) {
       SpringApplication.run(EuredaClientZuulApplication.class, args);
   }

}
5.WebSecurityConfig 类是 spring security 配置实例

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, jsr250Enabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
	 @Autowired 
	 private AuthenticationEntryPoint authenticationEntryPoint; 
	 @Autowired 
	 private AuthenticationProvider authenticationProvider; 
	 @Autowired 
	 private SingleSignOutFilter singleSignOutFilter; 
	 @Autowired 
	 private LogoutFilter logoutFilter; 
	 @Override 
	 protected void configure(HttpSecurity http) throws Exception { 
		 //所有都需要认证才能访问 //由于设置了验证filter访问为，/login/cas，所以必须通过验证，否则出现死循环 
		 http
		 .authorizeRequests()
		 .antMatchers("/login/cas")
		 .permitAll()
		 .and()
		 .authorizeRequests()
		 .anyRequest()
		 .authenticated()
		 .and()
		 .httpBasic()
		 .authenticationEntryPoint(authenticationEntryPoint)
		 .and()
		 .logout()
		 .logoutSuccessUrl("/logout")
		 .and()
		 .addFilterBefore(singleSignOutFilter, CasAuthenticationFilter.class)
		 .addFilterBefore(logoutFilter, LogoutFilter.class);
		 } 
	 @Override 
	 protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
		 auth.authenticationProvider(authenticationProvider); 
		 } 
	 @Override 
	 protected AuthenticationManager authenticationManager() throws Exception { 
		 //设置cas认证提供 
		 return new ProviderManager( Arrays.asList(authenticationProvider)); 
		 } 
	 @Bean 
	 public CasAuthenticationFilter casAuthenticationFilter(ServiceProperties sp) throws Exception { 
		 //cas认证过滤器，当触发本filter时，对ticket进行认证 
		 CasAuthenticationFilter filter = new CasAuthenticationFilter(); 
		 filter.setServiceProperties(sp); 
		 filter.setAuthenticationManager(authenticationManager()); return filter; } 
	 @Override public void configure(WebSecurity web) throws Exception { super.configure(web); 
	 }
}

6. CasSecurityConfig 实现与cas的接口配置

@Configuration
public class CasSecurityConfig {
	//cas服务 
	@Value("${cas.server.url:https://author.linbsoft.com/cas}") 
	private String casServerUrl; 
	@Bean 
	public ServiceProperties serviceProperties() { 
		ServiceProperties serviceProperties = new ServiceProperties(); 
		//本机服务，访问/login/cas时进行校验登录 
		serviceProperties.setService("http://springcloud.linbsoft.com:8000/login/cas"); 
		serviceProperties.setSendRenew(false); 
		return serviceProperties; 
		} 
	
	@Bean 
	@Primary 
	public AuthenticationEntryPoint authenticationEntryPoint( ServiceProperties sP) { 
		CasAuthenticationEntryPoint entryPoint = new CasAuthenticationEntryPoint(); 
		//cas登录服务 
		entryPoint.setLoginUrl(casServerUrl + "/login"); 
		entryPoint.setServiceProperties(sP); 
		return entryPoint; 
		} 
	@Bean 
	public TicketValidator ticketValidator() { 
		//指定cas校验器 
		return new Cas30ServiceTicketValidator( casServerUrl); 
		} 
	//cas认证 
	@Bean 
	public CasAuthenticationProvider casAuthenticationProvider() { 
		CasAuthenticationProvider provider = new CasAuthenticationProvider(); 
		provider.setServiceProperties(serviceProperties()); 
		provider.setTicketValidator(ticketValidator()); 
		provider.setUserDetailsService(customUserDetailsService()); 
		provider.setKey("CAS_PROVIDER_LOCALHOST_8000"); 
		return provider; 
		} 
	@Bean 
    public UserDetailsService customUserDetailsService(){ 
        return new CustomUserDetailsService(); 
    }
	@Bean 
	public SecurityContextLogoutHandler securityContextLogoutHandler() { 
		return new SecurityContextLogoutHandler(); 
		} 
	@Bean 
	public LogoutFilter logoutFilter() { 
		//退出后转发路径 
		LogoutFilter logoutFilter = new LogoutFilter( casServerUrl + "/logout", securityContextLogoutHandler()); 
		//cas退出 
		logoutFilter.setFilterProcessesUrl("/logout/cas"); 
		return logoutFilter; 
		} 
	@Bean 
	public SingleSignOutFilter singleSignOutFilter() { 
		//单点退出 
		SingleSignOutFilter singleSignOutFilter = new SingleSignOutFilter(); 
		singleSignOutFilter.setCasServerUrlPrefix(casServerUrl); 
		singleSignOutFilter.setIgnoreInitConfiguration(true); 
		return singleSignOutFilter; 
		} 
	//设置退出监听 
	@EventListener 
	public SingleSignOutHttpSessionListener singleSignOutHttpSessionListener( HttpSessionEvent event) { 
		return new SingleSignOutHttpSessionListener(); 
		}
	
	}

7. CustomUserDetailsService 实现UserDetailsService接口

public class CustomUserDetailsService    implements UserDetailsService {
   @Override
   public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
       System.out.println("当前的用户名是："+username);
       //这里为了方便测试，就直接返回一个用户信息，实际当中这里修改为查询数据库或者调用服务什么的来获取用户信息
       UserInfo userInfo = new UserInfo();
       userInfo.setId(104566569938L);
       userInfo.setUsername("admin");
       userInfo.setName("admin");
       Set<AuthorityInfo> authorities = new HashSet<AuthorityInfo>();
       AuthorityInfo authorityInfo = new AuthorityInfo("TEST-Roll");
       authorities.add(authorityInfo);
       authorityInfo = new AuthorityInfo("write-table-roll");
       authorities.add(authorityInfo);
       userInfo.setAuthorities(authorities);
       return userInfo;
   }

}

8. UserInfo 保存登录用户信息的类，CustomUserDetailsService 需要调用

public class UserInfo implements UserDetails {
	private static final long serialVersionUID = -1041327031937199938L;
	private Long id;
	private String name;
 	private String username;
	private String password;
	private boolean isAccountNonExpired = true;
	private boolean isAccountNonLocked = true;
	private boolean isCredentialsNonExpired = true;
	private boolean isEnabled = true;
	private Set<AuthorityInfo> authorities = new HashSet<AuthorityInfo>();
	@Override
	public Collection<? extends GrantedAuthority> getAuthorities() {
		return	authorities;
	}

	@Override
	public String getPassword() {
		return password;
	}

	@Override
	public String getUsername() {
		return username;
	}

	@Override
	public boolean isAccountNonExpired() {
		return this.isAccountNonExpired;
	}

	@Override
	public boolean isAccountNonLocked() {
		return this.isAccountNonLocked;
	}

	@Override
	public boolean isCredentialsNonExpired() {
		return this.isCredentialsNonExpired;
	}

	@Override
	public boolean isEnabled() {
		return this.isEnabled;
	}

	public void setUsername(String string) {
		this.username=string;
  }

	public void setName(String string) {
		this.name=string;
		
	}
	public String getName() {
		return this.name;
		
	}

	public void setAuthorities(Set<AuthorityInfo> authorities2) {
		authorities=authorities2;
	}
	
	public Long getId() {
		return id;
	}

	public void setId(Long id) {
		this.id = id;
	}

	public void setAccountNonExpired(boolean isAccountNonExpired) {
		this.isAccountNonExpired = isAccountNonExpired;
	}

9. AuthorityInfo 是保存权限信息的类，UserInfo类需要使用

public class AuthorityInfo implements GrantedAuthority{
   private static final long serialVersionUID = -175781100474818800L;
/**
   * 权限CODE
   */
   private String authority;
public AuthorityInfo(String authority) {
       this.authority = authority;
   }
@Override
   public String getAuthority() {
       return authority;
   }
public void setAuthority(String authority) {
       this.authority = authority;
   }

}

10. 创建一个showuser类用来测试显示登录认证后的本地用户及权限

@RestController
public class showuser {
@RequestMapping("/user")
public String showloginuser() {
   UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext()
           .getAuthentication()
           .getPrincipal();
   String user= "登陆用户:"+ userDetails.getUsername() +"<br>登陆权限:";
   for (GrantedAuthority grantedAuthority : userDetails.getAuthorities()) {
       user += ("<br>Authority:" + grantedAuthority.getAuthority());
   }
return user;
}
}

11. 全部类及配置介绍完毕，启动Eureda server微服务，再启动本例 Eureka-Client-zuul 服务

浏览器 http://springcloud.linbsoft.com:8000 本案例地址

会自动条转到 cas登录界面，登录后在eclipse控制台可以看见cas登录用户