我们可以在传统的 Web 应用程序和非基于 Web 的应用程序(如 RESTful Web 服务)之间实现 SSO。此示例显示了用于在 Web 应用程序和 RESTful Web 服务之间实现 SSO 的示例代码。以下是spring-security.xml
文件中的配置
<security:http create-session="never" use-expressions="true"
auto-config="false"
entry-point-ref="preAuthenticatedProcessingFilterEntryPoint" >
<security:intercept-url pattern="/**" access="permitAll"/>
<security:intercept-url pattern="/admin/**" access="hasRole('tomcat')"/>
<security:intercept-url pattern="/**" access="hasRole('tomcat')"/>
<security:custom-filter position="PRE_AUTH_FILTER" ref="preAuthFilter"/>
<!-- Required for Tomcat, will prompt for username / password twice otherwise -->
<security:session-management session-fixation-protection="none"/>
</security:http>
<bean id="preAuthenticatedProcessingFilterEntryPoint"
class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/>
<bean id="preAuthFilter"
class="org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter">
<property name="authenticationManager" ref="appControlAuthenticationManager"/>
<property name="authenticationDetailsSource"
ref="j2eeBasedPreAuthenticatedWebAuthenticationDetailsSource"/>
</bean>
<security:authentication-manager alias="appControlAuthenticationManager">
<security:authentication-provider ref="preAuthenticatedAuthenticationProvider"/>
</security:authentication-manager>
<bean id="preAuthenticatedAuthenticationProvider"
class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
<property name="preAuthenticatedUserDetailsService" ref="inMemoryAuthenticationUserDetailsService"/>
</bean>
<bean id="j2eeBasedPreAuthenticatedWebAuthenticationDetailsSource"
class="org.springframework.security.web.authentication.preauth.j2ee.J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource">
<property name="mappableRolesRetriever" ref="webXmlMappableAttributesRetriever"/>
<property name="userRoles2GrantedAuthoritiesMapper" ref="simpleAttributes2GrantedAuthoritiesMapper"/>
</bean>
<bean id="webXmlMappableAttributesRetriever"
class="org.springframework.security.web.authentication.preauth.j2ee.WebXmlMappableAttributesRetriever"/>
<bean id="simpleAttributes2GrantedAuthoritiesMapper"
class="org.springframework.security.core.authority.mapping.SimpleAttributes2GrantedAuthoritiesMapper">
<property name="attributePrefix" value=""/>
</bean>
<bean id="inMemoryAuthenticationUserDetailsService"
class="com.org.InMemoryAuthenticationUserDetailsService"/>
上面的代码在 Web 应用程序中。同样的代码也可以在 REST 项目的 spring security xml 文件中。将以下代码添加到web.xml
文件中:
<security-constraint>
<web-resource-collection>
<web-resource-name>Wildcard means whole app requires authentication</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>tomcat</role-name>
</auth-constraint>
<user-data-constraint>
<!-- transport-guarantee can be CONFIDENTIAL, INTEGRAL, or NONE -->
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/error.jsp</form-error-page>
</form-login-config>
</login-config>
上面的代码应该只存在于普通的 Web 应用程序中。server.xml
然后在 tomcat 的文件中启用 SSO 阀。Tomcat 使用基于 cookie 的 SSO 登录。会话 ID 存储在 cookie 中。如果您的浏览器禁用了 cookie,则 SSO 将不起作用。
希望这个解释有所帮助。