CAS & AD 配置

 这里我们基于LDAP协议连接AD

1. 切换到cas-server源代码目录， 在cas-server-webapp\pom.xml文件中增加ldap支持

 <dependency> 
    <groupId>org.jasig.cas</groupId>
            <artifactId>cas-server-support-ldap</artifactId>
            <version>${project.version}</version>
 </dependency>

2. 命令行， 执行mvn package install ，在cas-server-webapp\taget 下生成了 cas.war 包文件 ，把cas.war 文件copy到 tomcat的webapps下

3. 修改cas server的deployerConfigContext.xml

    找到如下节点

  <bean id="authenticationManager" class="org.jasig.cas.authentication.AuthenticationManagerImpl"></bean>

    在<property name="authenticationHandlers">中添加注释掉如下内容SimpleTestUsernamePasswordAuthenticationHandler，修改后如下

 1         <property name="authenticationHandlers">

 2             <list>

 3                 <!--

 4                     | This is the authentication handler that authenticates services by means of callback via SSL, thereby validating

 5                     | a server side SSL certificate.

 6                     +-->

 7                 <bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler"

 8                     p:httpClient-ref="httpClient" />

 9                 <!--

                     | This is the authentication handler declaration that every CAS deployer will need to change before deploying CAS 

                     | into production.  The default SimpleTestUsernamePasswordAuthenticationHandler authenticates UsernamePasswordCredentials

                     | where the username equals the password.  You will need to replace this with an AuthenticationHandler that implements your

                     | local authentication strategy.  You might accomplish this by coding a new such handler and declaring

                     | edu.someschool.its.cas.MySpecialHandler here, or you might use one of the handlers provided in the adaptors modules.

                     

                 <bean

                     class="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler" />

                     +-->

                     

                     

                 <bean class="org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHandler"

                   p:filter="sAMAccountName=%u"

                   p:searchBase="ou=yourOU,dc=microsoft,dc=com"

                   p:contextSource-ref="contextSource"

                   p:ignorePartialResultException="true" />

             </list>

         </property>

然后在<bean id="authenticationManager" >的下面添加contextSource bean

 1 <bean id="contextSource" class="org.springframework.ldap.core.support.LdapContextSource">
 2   <!-- DO NOT enable JNDI pooling for context sources that perform LDAP bind operations. -->
 3   <property name="pooled" value="false"/>
 4  
 5   <!--
 6     Although multiple URLs may defined, it's strongly recommended to avoid this configuration
 7     since the implementation attempts hosts in sequence and requires a connection timeout
 8     prior to attempting the next host, which incurs unacceptable latency on node failure.
 9     A proper HA setup for LDAP directories should use a single virtual host that maps to multiple
10     real hosts using a hardware load balancer.
11   -->
12   <property name="url" value="LDAP://ADServer.microsoft.com" />
13  
14   <!--
15     Manager credentials are only required if your directory does not support anonymous searches.
16     Never provide these credentials for FastBindLdapAuthenticationHandler since the user's
17     credentials are used for the bind operation.
18   -->
19   <property name="userDn" value="yourADUser"/>
20   <property name="password" value="yourpassword"/>
21  
22   <!-- Place JNDI environment properties here. -->
23   <property name="baseEnvironmentProperties">
24     <map>
25       <!-- Three seconds is an eternity to users. -->
26       <entry key="com.sun.jndi.ldap.connect.timeout" value="3000" />
27       <entry key="com.sun.jndi.ldap.read.timeout" value="3000" />
28  
29       <!-- Explained at http://download.oracle.com/javase/1.3/docs/api/javax/naming/Context.html#SECURITY_AUTHENTICATION -->
30       <entry key="java.naming.security.authentication" value="simple" />
31     </map>
32   </property>

33 </bean>