cas sso单点登录系列1_cas-client Filter源码解码(转)

转：http://blog.csdn.net/ae6623/article/details/8841801?utm_source=tuicool&utm_medium=referral

/*  Copyright (c) 2000-2004 Yale University. All rights reserved. 
 *  See full notice at end.
 */

package edu.yale.its.tp.cas.client.filter;

import java.io.*;
import java.net.*;
import java.util.*;
import javax.servlet.*;
import javax.servlet.http.*;
import edu.yale.its.tp.cas.client.*;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

/*
 * 
 * @author Shawn Bayern
 * @author Drew Mazurek
 * @author andrew.petro@yale.edu
 */
public class CASFilter implements Filter {

    private static Log log = LogFactory.getLog(CASFilter.class);

    // Filter initialization parameters
    //必须参数
    /**
     * loginUrl:指定 CAS 提供登录页面的 URL
     */
    public final static String LOGIN_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.loginUrl";

    /**
     * validateUrl:指定 CAS 提供 service ticket 或 proxy ticket 验证服务的 URL 
     */
    public final static String VALIDATE_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.validateUrl";

    /**
     * serviceUrl:本web项目的URL，该参数指定过后将覆盖 serverName 参数，成为登录成功过后重定向的目的地址 
     */
    public final static String SERVICE_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.serviceUrl";

    /**
     * serverName:全主机端口号，指定客户端的域名和端口，是指客户端应用所在机器而不是 CAS Server 所在机器，该参数或 serviceUrl 至少有一个必须指定
     */
    public final static String SERVERNAME_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.serverName";

    //可选参数
    /**
     * renew:如果指定为 true，那么受保护的资源每次被访问时均要求用户重新进行验证，而不管之前是否已经通过 
     */
    public final static String RENEW_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.renew";

    /**
     * authorizedProxy:用于允许当前应用从代理处获取 proxy tickets，该参数接受以空格分隔开的多个 proxy URLs，但实际使用只需要一个成功即可。当指定该参数过后，需要修改 validateUrl 到 proxyValidate，
     */
    public final static String AUTHORIZED_PROXY_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.authorizedProxy";

    /**
     * proxyCallbackUrl:用于当前应用需要作为其他服务的代理(proxy)时获取 Proxy Granting Ticket 的地址 
     */
    public final static String PROXY_CALLBACK_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.proxyCallbackUrl";

    /**
     * wrapRequest:如果指定为 true，那么 CASFilter 将重新包装 HttpRequest,并且使 getRemoteUser() 方法返回当前登录用户的用户名
     */
    public final static String WRAP_REQUESTS_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.wrapRequest";

    /**
     * gateway:这个参数很奇葩，一开始没读懂是干嘛的。。官方解释是一旦发生过CAS重定向，过滤器将不会自动重新设置登录的用户。然后你可以提供一个明确的CAS登录链接（HTTPS：/ / CAS服务器/ CAS /登录？服务= HTTP：/ /应用程序）或建立映射到不同的路径的过滤器的两个实例。一个实例将gateway实现。当你需要登录的用户，直接转到其他过滤器。
     * 是的你没有想错，这一句话着实让人不知道是要说明什么，于是万能的百度上有且仅有一个前辈说出来了这个参数其实是和renew互斥的，renew就是说无论如何都得重新验证此用户，不管你session中有没有上下文信息。而gateway则是只要检测到session中有sso上下文，就不再重新认证
     */
    public final static String GATEWAY_INIT_PARAM = "edu.yale.its.tp.cas.client.filter.gateway";

    public final static String CAS_FILTER_USER = "edu.yale.its.tp.cas.client.filter.user";

    public final static String CAS_FILTER_RECEIPT = "edu.yale.its.tp.cas.client.filter.receipt";

    private static final String CAS_FILTER_GATEWAYED = "edu.yale.its.tp.cas.client.filter.didGateway";

    // *********************************************************************
    // Configuration state


    private String casLogin;

    private String casValidate;

    private String casServiceUrl;

    private String casServerName;

    private String casProxyCallbackUrl;

    private boolean casRenew;

    private boolean wrapRequest;

    private boolean casGateway = false;

    /**
     * 对proxyticketreceptor URL授权代理在过滤器的路径的服务列表
     */
    private List authorizedProxies = new ArrayList();

    // *********************************************************************
    // Initialization

    public void init(FilterConfig config) throws ServletException {
        //拿到参数
        casLogin = config.getInitParameter(LOGIN_INIT_PARAM);
        casValidate = config.getInitParameter(VALIDATE_INIT_PARAM);
        casServiceUrl = config.getInitParameter(SERVICE_INIT_PARAM);
        String casAuthorizedProxy = config.getInitParameter(AUTHORIZED_PROXY_INIT_PARAM);
        casRenew = Boolean.valueOf(config.getInitParameter(RENEW_INIT_PARAM)).booleanValue();
        casServerName = config.getInitParameter(SERVERNAME_INIT_PARAM);
        casProxyCallbackUrl = config.getInitParameter(PROXY_CALLBACK_INIT_PARAM);
        wrapRequest = Boolean.valueOf(config.getInitParameter(WRAP_REQUESTS_INIT_PARAM)).booleanValue();
        casGateway = Boolean.valueOf(config.getInitParameter(GATEWAY_INIT_PARAM)).booleanValue();

        if (casGateway && Boolean.valueOf(casRenew).booleanValue()) {
            //这俩参数不能一起设置为true
            throw new ServletException("gateway and renew cannot both be true in filter configuration");
        }
        if (casServerName != null && casServiceUrl != null) {
            //这俩参数也不能一起设置
            throw new ServletException("serverName and serviceUrl cannot both be set: choose one.");
        }
        if (casServerName == null && casServiceUrl == null) {
            //这俩参数也不能一起为null
            throw new ServletException("one of serverName or serviceUrl must be set.");
        }
        if (casServiceUrl != null) {
            //检测uri前缀
            if (!(casServiceUrl.startsWith("https://") || (casServiceUrl.startsWith("http://")))) {
                throw new ServletException("service URL must start with http:// or https://; its current value is [" + casServiceUrl + "]");
            }
        }

        if (casValidate == null) {
            //cas验证用户的网址不能为空
            throw new ServletException("validateUrl parameter must be set.");
        }
        if (!casValidate.startsWith("https://")) {
            //如果cas认证网址不是以https开头，就报错。。如果你是用http请求，可以屏蔽掉这个判断语句
            throw new ServletException("validateUrl must start with https://, its current value is [" + casValidate + "]");
        }
        //代理是否为空
        if (casAuthorizedProxy != null) {

            // parse and remember authorized proxies
            StringTokenizer casProxies = new StringTokenizer(casAuthorizedProxy);
            while (casProxies.hasMoreTokens()) {
                //授权的标记
                String anAuthorizedProxy = casProxies.nextToken();
                //https前缀检测
                if (!anAuthorizedProxy.startsWith("https://")) {
                    throw new ServletException("CASFilter initialization parameter for authorized proxies " + "must be a whitespace delimited list of authorized proxies.  " + "Authorized proxies must be secure (https) addresses.  This one wasn't: [" + anAuthorizedProxy + "]");
                }
                //将所有授权的代理添加到list中（唉，着实不知道是干什么的，也许几年后回来读读应该能知道答案，2013年4月22日14:56:37）
                this.authorizedProxies.add(anAuthorizedProxy);
            }
        }

        if (log.isDebugEnabled()) {
            log.debug(("CASFilter initialized as: [" + toString() + "]"));
        }
    }

    // *********************************************************************
    // Filter processing
    // 过滤器处理
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain fc) throws ServletException, IOException {
        
        //核心思想：首先检查session中有无凭证receipt，如果有，那么就要去下个过滤器链进行处理，如果无，则获取传参ticket，如果有ticket，就经过getAuthenticatedUser()方法去拿到receipt凭证，如果无（这中间会有一些对renew或者gateway的处理），就立即进入cas服务端进行登录
        if (log.isTraceEnabled()) {
            log.trace("entering doFilter()");
        }

        // make sure we've got an HTTP request
        if (!(request instanceof HttpServletRequest) || !(response instanceof HttpServletResponse)) {
            log.error("doFilter() called on a request or response that was not an HttpServletRequest or response.");
            throw new ServletException("CASFilter protects only HTTP resources");
        }

        // Is this a request for the proxy callback listener? If so, pass
        // it through
        if (casProxyCallbackUrl != null && casProxyCallbackUrl.endsWith(((HttpServletRequest) request).getRequestURI()) && request.getParameter("pgtId") != null && request.getParameter("pgtIou") != null) {
            log.trace("passing through what we hope is CAS's request for proxy ticket receptor.");
            fc.doFilter(request, response);
            return;
        }

        // Wrap the request if desired
        if (wrapRequest) {
            log.trace("Wrapping request with CASFilterRequestWrapper.");
            request = new CASFilterRequestWrapper((HttpServletRequest) request);
        }
        // 1.从当前web应用中拿到session
        HttpSession session = ((HttpServletRequest) request).getSession();

        // if our attribute's already present and valid, pass through the filter chain

        // 1.1.如果存在一个票据（令牌，凭证），就要跳到下一个过滤器链（去验证此票据的真实性，因为此票据的真实性是未知的）
        CASReceipt receipt = (CASReceipt) session.getAttribute(CAS_FILTER_RECEIPT);
        if (receipt != null && isReceiptAcceptable(receipt)) {
            log.trace("CAS_FILTER_RECEIPT attribute was present and acceptable - passing  request through filter..");
            fc.doFilter(request, response);
            return;
        }
     
        // otherwise, we need to authenticate via CAS
        // 1.2.如果receipt(令牌)不存在就先拿到ticket，我们要去cas验证用户进行登录
        String ticket = request.getParameter("ticket");
        // no ticket? abort request processing and redirect
        //如果ticket为空
        if (ticket == null || ticket.equals("")) {
            log.trace("CAS ticket was not present on request.");

            // 4.1判断是否经过网关参数（didGateway这个参数否已经经过网关的一个标记参数，表示不再进行认证）
            // did we go through the gateway already?
            boolean didGateway = Boolean.valueOf((String) session.getAttribute(CAS_FILTER_GATEWAYED)).booleanValue();
            // 4.1.1没有casLogin的配置信息下的异常处理
            if (casLogin == null) {
                // TODO: casLogin should probably be ensured to not be null at filter initialization. -awp9
                log.fatal("casLogin was not set, so filter cannot redirect request for authentication.");
                throw new ServletException("When CASFilter protects pages that do not receive a 'ticket' " + "parameter, it needs a edu.yale.its.tp.cas.client.filter.loginUrl " + "filter parameter");
            }
            // 4.2如果网关标记为false，设置CAS_FILTER_GATEWAYED属性为true，并跳转到cas服务端进行验证
            if (!didGateway) {
                log.trace("Did not previously gateway.  Setting session attribute to true.");
                session.setAttribute(CAS_FILTER_GATEWAYED, "true");
                redirectToCAS((HttpServletRequest) request, (HttpServletResponse) response);
                // abort chain
                return;
            } else {
                log.trace("Previously gatewayed.");
                // 4.3 如果有网关参数（之前已经通过了网关），就不再进行验证，从而进入下一个过滤器处理即可。
                // if we should be logged in, make sure validation succeeded
                if (casGateway || session.getAttribute(CAS_FILTER_USER) != null) {
                    //已经通过了验证和授权。。
                    log.trace("casGateway was true and CAS_FILTER_USER set: passing request along filter chain.");
                    // continue processing the request 交给下一个过滤器
                    fc.doFilter(request, response);
                    return;
                } else {
                    // 其他情况下，跳往cas服务端
                    // unknown state... redirect to CAS
                    //将经过网关的参数didGateway设置为true
                    session.setAttribute(CAS_FILTER_GATEWAYED, "true");
                    redirectToCAS((HttpServletRequest) request, (HttpServletResponse) response);
                    
                    // abort chain
                    return;
                }
            }
        }
    
        try {
            // ticket存在，就经过getAuthenticatedUser()方法去拿到receipt，初步判断此方法是为根据request中的ticket参数组装了一个数据发送给了cas服务端进行判断此ticket是否是正确的合法的（它可能是使用代理类进行的实现）
            receipt = getAuthenticatedUser((HttpServletRequest) request);
        } catch (CASAuthenticationException e) {
            log.error(e);
            throw new ServletException(e);
        }

        if (!isReceiptAcceptable(receipt)) {
            //检测授权不被认可，就是非法的。
            throw new ServletException("Authentication was technically successful but rejected as a matter of policy. [" + receipt + "]");
        }
        //既然拿到了凭证，就去拿到session中是否有相关信息，并写入CASFilter.CAS_FILTER_RECEIPT
        // Store the authenticated user in the session
        if (session != null) { // probably unnecessary
            //将username（用户名）信息放入session中
            session.setAttribute(CAS_FILTER_USER, receipt.getUserName());
            //放入票据
            session.setAttribute(CASFilter.CAS_FILTER_RECEIPT, receipt);
            // don't store extra unnecessary session state
            //不要储存额外的不必要的会话状态
            session.removeAttribute(CAS_FILTER_GATEWAYED);
        }
        if (log.isTraceEnabled()) {
            log.trace("validated ticket to get authenticated receipt [" + receipt + "], now passing request along filter chain.");
        }

        // continue processing the request
        //进入下一个过滤器进行处理
        fc.doFilter(request, response);
        log.trace("returning from doFilter()");
    }

    /**
     * Is this receipt acceptable as evidence of authentication by credentials that would have been acceptable to this path? Current implementation checks whether from renew and whether proxy was authorized.
     * 
     * @param receipt 票据
     * @return true if acceptable, false otherwise
     */
    private boolean isReceiptAcceptable(CASReceipt receipt) {
        if (receipt == null)
            throw new IllegalArgumentException("Cannot evaluate a null receipt.");
        if (this.casRenew && !receipt.isPrimaryAuthentication()) {
            return false;
        }
        if (receipt.isProxied()) {
            if (!this.authorizedProxies.contains(receipt.getProxyingService())) {
                return false;
            }
        }
        return true;
    }

    // *********************************************************************
    // Utility methods

    /**
     * Converts a ticket parameter to a CASReceipt, taking into account an optionally configured trusted proxy in the tier immediately in front of us.
     * 
     * @throws ServletException -
     *             when unable to get service for request
     * @throws CASAuthenticationException -
     *             on authentication failure
     */
    private CASReceipt getAuthenticatedUser(HttpServletRequest request) throws ServletException, CASAuthenticationException {
        log.trace("entering getAuthenticatedUser()");
        ProxyTicketValidator pv = null;

        pv = new ProxyTicketValidator();
        pv.setCasValidateUrl(casValidate);
        pv.setServiceTicket(request.getParameter("ticket"));
        pv.setService(getService(request));
        pv.setRenew(Boolean.valueOf(casRenew).booleanValue());
        if (casProxyCallbackUrl != null) {
            pv.setProxyCallbackUrl(casProxyCallbackUrl);
        }
        if (log.isDebugEnabled()) {
            log.debug("about to validate ProxyTicketValidator: [" + pv + "]");
        }

        return CASReceipt.getReceipt(pv);

    }

    /**
     * Returns either the configured service or figures it out for the current request. The returned service is URL-encoded.
     */
    private String getService(HttpServletRequest request) throws ServletException {

        log.trace("entering getService()");
        String serviceString;

        // ensure we have a server name or service name
        if (casServerName == null && casServiceUrl == null)
            throw new ServletException("need one of the following configuration " + "parameters: edu.yale.its.tp.cas.client.filter.serviceUrl or " + "edu.yale.its.tp.cas.client.filter.serverName");

        // use the given string if it's provided
        if (casServiceUrl != null)
            serviceString = URLEncoder.encode(casServiceUrl);
        else
            // otherwise, return our best guess at the service
            serviceString = Util.getService(request, casServerName);
        if (log.isTraceEnabled()) {
            log.trace("returning from getService() with service [" + serviceString + "]");
        }
        return serviceString;
    }

    /**
     * Redirects the user to CAS, determining the service from the request.
     */
    private void redirectToCAS(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
        if (log.isTraceEnabled()) {
            log.trace("entering redirectToCAS()");
        }

        String casLoginString = casLogin + "?service=" + getService((HttpServletRequest) request) + ((casRenew) ? "&renew=true" : "") + (casGateway ? "&gateway=true" : "");

        if (log.isDebugEnabled()) {
            log.debug("Redirecting browser to [" + casLoginString + ")");
        }
        ((HttpServletResponse) response).sendRedirect(casLoginString);

        if (log.isTraceEnabled()) {
            log.trace("returning from redirectToCAS()");
        }
    }

    public String toString() {
        StringBuffer sb = new StringBuffer();
        sb.append("[CASFilter:");
        sb.append(" casGateway=");
        sb.append(this.casGateway);
        sb.append(" wrapRequest=");
        sb.append(this.wrapRequest);

        sb.append(" casAuthorizedProxies=[");
        sb.append(this.authorizedProxies);
        sb.append("]");

        if (this.casLogin != null) {
            sb.append(" casLogin=[");
            sb.append(this.casLogin);
            sb.append("]");
        } else {
            sb.append(" casLogin=NULL!!!!!");
        }

        if (this.casProxyCallbackUrl != null) {
            sb.append(" casProxyCallbackUrl=[");
            sb.append(casProxyCallbackUrl);
            sb.append("]");
        }

        if (this.casRenew) {
            sb.append(" casRenew=true");
        }

        if (this.casServerName != null) {
            sb.append(" casServerName=[");
            sb.append(casServerName);
            sb.append("]");
        }

        if (this.casServiceUrl != null) {
            sb.append(" casServiceUrl=[");
            sb.append(casServiceUrl);
            sb.append("]");
        }

        if (this.casValidate != null) {
            sb.append(" casValidate=[");
            sb.append(casValidate);
            sb.append("]");
        } else {
            sb.append(" casValidate=NULL!!!");
        }

        return sb.toString();
    }

    /* (non-Javadoc)
     * @see javax.servlet.Filter#destroy()
     */
    public void destroy() {
        // TODO Auto-generated method stub

    }
}