JASIG CAS jira+confluence sso

Question

我有三个不同的tomcat实例。Tomcat with cas server localhost:8050 Tomcat with Jira 4.3 localhost:8080，最后tomcat with confluence 3.5 localhost:8070

我需要通过连接到LDAP的cas服务器实现SSO(jira + confluence)。

好的，我使用jira和Confluence的cas客户端，就像这样的https://wiki.jasig.org/display/CASC/Configuring+Confluence+with+JASIG+CAS+Client+for+Java+3.1

现在jira和confluence都正确地将我重定向到Cas登录页面并在ldap服务器中进行身份验证，这几乎没问题( confluence注销有一些but )，但这不是SSO。如果我登录了jira，我仍然需要输入我的cretentials以进行融合，反之亦然。我认为这是因为tomcat安装的不同。当我登录jira时，给我一个服务http://localhost:8080的票证和另一个合流(http://localhost:8070)的票证。我真的被这个愚蠢的问题困住了，我希望有人能给我指引正确的方向。

我的配置: Jira。Seraph-config.xml

 <init-param>
            <param-name>login.url</param-name>
            <param-value>http://localhost:8050/cas-server-webapp-3.4.8/login?service=${originalurl}</param-value>
         </init-param>
        <init-param>
             <param-name>link.login.url</param-name>
            <param-value>http://localhost:8050/cas-server-webapp-3.4.8/login?service=${originalurl}                      </param-value>
         </init-param>
        <init-param>
            <param-name>logout.url</param-name>
            <param-value>http://localhost:8050/cas-server-webapp-3.4.8/logout</param-value>
      </init-param>

Web xml：

<filter>
   <filter-name>CasSingleSignOutFilter</filter-name>
   <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
</filter>
<filter>
  <filter-name>CasAuthenticationFilter</filter-name>
  <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
  <init-param>
    <param-name>casServerLoginUrl</param-name>
    <param-value>http://localhost:8050/cas-server-webapp-3.4.8/login</param-value>
  </init-param>
  <init-param>
    <param-name>serverName</param-name>
    <param-value>http://localhost:8080</param-value>
  </init-param>
</filter>
<filter>
    <filter-name>CasValidationFilter</filter-name>
    <filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
    <init-param>
        <param-name>casServerUrlPrefix</param-name>
        <param-value>http://localhost:8050/cas-server-webapp-3.4.8/</param-value>
    </init-param>
    <init-param>
        <param-name>serverName</param-name>
        <param-value>http://localhost:8080</param-value>
    </init-param>
    <init-param>
        <param-name>redirectAfterValidation</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>

<filter-mapping>
   <filter-name>CasSingleSignOutFilter</filter-name>
   <url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
    <filter-name>CasAuthenticationFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
    <filter-name>CasValidationFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
    <listener>
    <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
</listener>

对于合流：

seraph-config.xml：

<init-param>
        <param-name>login.url</param-name>
        <param-value>http://localhost:8050/cas-server-webapp-3.4.8/login?service=${originalurl}</param-value>
    </init-param>
    <init-param>
        <param-name>link.login.url</param-name>
        <param-value>http://localhost:8050/cas-server-webapp-3.4.8/login?service=${originalurl}</param-value>
    </init-param>

web.xml：

<filter>
   <filter-name>CasSingleSignOutFilter</filter-name>
   <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
</filter>
<filter>
  <filter-name>CasAuthenticationFilter</filter-name>
  <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
  <init-param>
    <param-name>casServerLoginUrl</param-name>
    <param-value>http://localhost:8050/cas-server-webapp-3.4.8/login</param-value>
  </init-param>
  <init-param>
    <param-name>serverName</param-name>
    <param-value>http://localhost:8070</param-value>
  </init-param>
</filter>
<filter>
    <filter-name>CasValidationFilter</filter-name>
    <filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
    <init-param>
        <param-name>casServerUrlPrefix</param-name>
        <param-value>http://localhost:8050/cas-server-webapp-3.4.8/</param-value>
    </init-param>
    <init-param>
        <param-name>serverName</param-name>
        <param-value>http://localhost:8070</param-value>
    </init-param>
    <init-param>
        <param-name>redirectAfterValidation</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>
<filter-mapping>
   <filter-name>CasSingleSignOutFilter</filter-name>
   <url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
    <filter-name>CasAuthenticationFilter</filter-name>
    <url-pattern>/login.action</url-pattern>
</filter-mapping>
<filter-mapping>
    <filter-name>CasValidationFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
    <listener>
        <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
    </listener>

Answer 1

我在上面注意到你的服务是动态的: service=${originalurl}

我认为为了让SSO起作用，你必须使用每个网站都必须使用相同的服务调用CAS，这样CAS服务器上的TGT才能知道谁在调用。否则，我认为您必须调查代理授予票证：

https://wiki.jasig.org/display/CAS/Proxy+CAS+Walkthrough

据我所知，这是一种服务的方式，等同于“没关系，另一个服务是我的朋友”。