创建证书
证书是单点登录认证系统中很重要的一把钥匙，客户端于服务器的交互安全靠的就是证书；由于是学习所以就用JDK自带的keytool工具生成证书；如果以后真正在产品环境中使用肯定要去证书提供商去购买，证书认证一般都是由VeriSign认证，中文官方网站：http://www.verisign.com/cn/

用JDK自带的keytool工具生成证书：

keytool -genkey -alias tomcat -keyalg RSA -keystore d:/keys/keystore

讯享网

由于我们所写的域名是不存在的,所以需要在C:\Windows\System32\drivers\etc\hosts hosts文件中添加域名

导出证书

讯享网D:\keys>keytool -export -file d:/keys/tomcat.crt -alias tomcat -keystore d:/keys/keystore

为客户端的JVM导入证书

D:\keys>keytool -export -file d:/keys/tomcat.crt -alias tomcat -keystore d:/keys/keystore

C:\tool\JDK\jdk1.7.0.80\jre\lib\security – 是jre的目录；密码还是刚刚输入的密码。至此证书的创建、导出、导入到客户端JVM都已完成，下面开始使用证书到Web服务器中
注意:
如果提示：

讯享网keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect

那么输入密码：changeit

应用证书到Web服务器-Tomcat
说是应用起始做的事情就是启用Web服务器(Tomcat)的SSL，也就是HTTPS加密协议，为什么加密(我也不知道)…… 准备好一个干净的tomcat，本教程使用的apache-tomcat-7.0.77 打开tomcat目录的conf/server.xml文件，开启83和87行的注释代码，并设置keystoreFile、keystorePass修改结果如下：
tomcat7

<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreFile="D:/keys/keystore" keystorePass="000000" />

tomcat6

讯享网protocol="HTTP/1.1" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreFile="D:/keys/keystore" keystorePass="000000" />

keystoreFile：在第一步创建的key存放位置 keystorePass：创建证书时的密码

现在可以启动tomcat试一下了,如果显示如下页面:

点击高级—继续前往—如果进入Tomcat目录了，那么又向成功迈进了一步。

CAS服务器部署
下载CAS服务
下载完成后将cas-server-3.4.3.1.zip解压，解压cas-server-3.4.3/modules/cas-server-webapp-3.4.3.1.war，改名为cas，然后复制cas目录到tomcat/webapp目录下

现在可以访问CAS应用了，当然要使用HTTPS加密协议访问，地址：https://www.taotao.com:8443/cas/login ，现在打开了CAS服务器的页面输入admin/admin点击登录（CAS默认的验证规则只要用户名和密码相同就通过）所以如果你看到下面的这张图片你就成功了

登录成功页面

CAS配置数据库连接
上面的初体验仅仅是简单的身份验证，实际应用中肯定是要读取数据库的数据，下面我们来进一步配置CAS服务器怎么读取数据库的信息进行身份验证。 首先打开

讯享网C:\tool\tomcat\apache-tomcat-7.0.77\webapps\cas\WEB-INF\deployerConfigContext.xml

找到第92行处，注释掉：SimpleTestUsernamePasswordAuthenticationHandler这个验证Handler，这个是比较简单的，只是判断用户名和密码相同即可通过，这个肯定不能在实际应用中使用！

注释掉92行后在下面添加下面的代码：

 <bean class="org.jasig.cas.adaptors.jdbc.QueryDatabaseAuthenticationHandler"> <property name="dataSource" ref="dataSource" /> <property name="sql" value="select password from user where userName=?" /> <property name="passwordEncoder" ref="MD5PasswordEncoder" /> </bean>

在文件的末尾之前加入如下代码：

讯享网<bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource"> <property name="driverClassName"><value>com.mysql.jdbc.Driver</value></property> <property name="url"><value>jdbc:mysql:///test_01</value></property> <property name="username"><value>root</value></property> <property name="password"><value>root</value></property> </bean> <bean id="MD5PasswordEncoder" class="org.jasig.cas.authentication.handler.DefaultPasswordEncoder"> <constructor-arg index="0"> <value>MD5</value> </constructor-arg> </bean>

复制cas-server-3.4.3.1\modules\cas-server-support-jdbc-3.4.3.1.jar和MySQL驱动jar包到tomcat/webapp/cas/WEB-INF/lib目录

参数说明:
QueryDatabaseAuthenticationHandler，是cas-server-support-jdbc提供的查询接口其中一个，QueryDatabaseAuthenticationHandler是通过配置一个 SQL 语句查出密码，与所给密码匹配

dataSource,我就不用解释了吧，就是使用JDBC查询时的数据源

dataSource,使用JDBC查询时的数据源

sql，语句就是查询哪一张表，CAS会匹配用户输入的密码，如果匹配则通过；

CAS客户端配置
添加cas-client的

<groupid>org.jasig.cas.client</groupid> <artifactid>cas-client-core</artifactid> <version>3.1.12</version> 

包，有两种方式：

使用jar包
解压cas-client-3.3.3-release.zip,在modules文件夹中有需要的jar包，请根据自己的项目情况选择使用 ,然后从target目录中复制cas-client-core-3.2.1.jar到应用的WEB-INF/lib目录中（Pom中添加了即可省略）

maven
导入依赖

讯享网<dependency> <groupid>org.jasig.cas.client</groupid> <artifactid>cas-client-core</artifactid> <version>3.1.12</version> </dependency>

设置过滤器
在web.xml文件中加入下面这段代码

<!-- 用于单点退出，该过滤器用于实现单点登出功能，可选配置--> <listener> <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class> </listener> <!-- 该过滤器用于实现单点登出功能，可选配置。 --> <filter> <filter-name>CAS Single Sign Out Filter</filter-name> <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class> </filter> <filter-mapping> <filter-name>CAS Single Sign Out Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 该过滤器负责用户的认证工作，必须启用它 --> <filter> <filter-name>CASFilter</filter-name> <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class> <init-param> <param-name>casServerLoginUrl</param-name> <param-value>https://www.taotao.com:8443/cas/login</param-value> <!--这里的server是服务端的IP--> </init-param> <init-param> <param-name>serverName</param-name> <param-value>http://localhost:10000</param-value> </init-param> </filter> <filter-mapping> <filter-name>CASFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 该过滤器负责对Ticket的校验工作，必须启用它 --> <filter> <filter-name>CAS Validation Filter</filter-name> <filter-class> org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class> <init-param> <param-name>casServerUrlPrefix</param-name> <param-value>https://www.taotao.com:8443/cas</param-value> </init-param> <init-param> <param-name>serverName</param-name> <param-value>http://localhost:10000</param-value> </init-param> </filter> <filter-mapping> <filter-name>CAS Validation Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 该过滤器负责实现HttpServletRequest请求的包裹， 比如允许开发者通过HttpServletRequest的getRemoteUser()方法获得SSO登录用户的登录名，可选配置。 --> <filter> <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> <filter-class> org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class> </filter> <filter-mapping> <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 该过滤器使得开发者可以通过org.jasig.cas.client.util.AssertionHolder来获取用户的登录名。 比如AssertionHolder.getAssertion().getPrincipal().getName()。 --> <filter> <filter-name>CAS Assertion Thread Local Filter</filter-name> <filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class> </filter> <filter-mapping> <filter-name>CAS Assertion Thread Local Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 自动根据单点登录的结果设置本系统的用户信息 --> <filter> <display-name>AutoSetUserAdapterFilter</display-name> <filter-name>AutoSetUserAdapterFilter</filter-name> <filter-class>com.wsria.demo.filter.AutoSetUserAdapterFilter</filter-class> </filter> <filter-mapping> <filter-name>AutoSetUserAdapterFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- ======================== 单点登录结束 ======================== -->

AutoSetUserAdapterFilter的作用和原理:

讯享网利用AutoSetUserAdapterFilter自动根据CAS信息设置Session的用户信息

主要是通过CAS的const_cas_assertion获取从CAS服务器登陆的用户名，然后再根据系统内部的用户工具（UserUtil.java）来判断是否已经登录过，如果没有登录根据登录名从数据库查询用户信息，最后使用设置把用户信息设置到当前session中。 这样就把用户信息保存到了Sessino中，我们就可以通过UserUtil工具来获取当前登录的用户了

单点退出

把你的退出链接设置为：https://www.taotao.com:8443/cas/logout

CAS服务器界面
CAS服务端(cas-server)的界面只能在测试的时候用一下，真正项目上肯定需要开发自己的页面，就像网易和CSDN的统一认证平台一样，所有子系统的认证都通过此平台来转接，大家可以根据他们的页面自己定制出适合所属应用或者公司的界面；简单介绍一下吧，复制 cas\WEB-INF\view\jsp\default\ui的一些JSP文件，每一个文件的用途文件名已经区分了，自己修改了替换一下就可以了。 例如：

登录界面：casLoginView.jsp
登录成功：casGenericSuccess.jsp
登出界面：casLogoutView.jsp

疑难问题
错误:

讯享网javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching casserver found

由于创建证书的域名和在应用中配置的cas服务域名不一致导致以下错误，详细请参考：

由于创建证书的域名和在应用中配置的cas服务域名不一致导致以下错误： SEVERE: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching casserver found javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching casserver found at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1731) at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241) at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235) at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206) at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136) at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593) at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:925) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1170) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1197) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1181) at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434) at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166) at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1172) at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:234) at org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:35) at org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:178) at org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:132) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.jasig.cas.client.authentication.AuthenticationFilter.doFilter(AuthenticationFilter.java:111) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.jasig.cas.client.session.SingleSignOutFilter.doFilter(SingleSignOutFilter.java:99) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588) at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) at java.lang.Thread.run(Thread.java:662) Caused by: java.security.cert.CertificateException: No name matching casserver found at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:210) at sun.security.util.HostnameChecker.match(HostnameChecker.java:77) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:264) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:250) at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1185) ... 32 more Feb 1, 2012 10:01:28 PM org.jasig.cas.client.validation.AbstractTicketValidationFilter doFilter WARNING: org.jasig.cas.client.validation.TicketValidationException: The CAS server returned no response. org.jasig.cas.client.validation.TicketValidationException: The CAS server returned no response. at org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:181) at org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:132) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.jasig.cas.client.authentication.AuthenticationFilter.doFilter(AuthenticationFilter.java:111) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.jasig.cas.client.session.SingleSignOutFilter.doFilter(SingleSignOutFilter.java:99) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588) at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) at java.lang.Thread.run(Thread.java:662)