原文：https://apereo.github.io/cas/4.2.x/installation/Database-Authentication.html
Database Authentication
当使用Maven WAR overlay部署的时候，数据库认证组件通过增加下面内容启用：
|
0 1 2 3 4 5 |
<dependency> <groupId>org.jasig.cas</groupId> <artifactId>cas-server-support-jdbc</artifactId> <version>${cas.version}</version> </dependency> |
连接池
所有的数据库认证组件要求一个DataSource来连接数据库，强烈建议使用数据库连接池，c3p0库是一个很好的选择。
示例：
一个名为dataSource的bean必需定义
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
<bean id="dataSource" class="com.mchange.v2.c3p0.ComboPooledDataSource" p:driverClass="${database.driverClass}" p:jdbcUrl="${database.url}" p:user="${database.user}" p:password="${database.password}" p:initialPoolSize="${database.pool.minSize}" p:minPoolSize="${database.pool.minSize}" p:maxPoolSize="${database.pool.maxSize}" p:maxIdleTimeExcessConnections="${database.pool.maxIdleTime}" p:checkoutTimeout="${database.pool.maxWait}" p:acquireIncrement="${database.pool.acquireIncrement}" p:acquireRetryAttempts="${database.pool.acquireRetryAttempts}" p:acquireRetryDelay="${database.pool.acquireRetryDelay}" p:idleConnectionTestPeriod="${database.pool.idleConnectionTestPeriod}" p:preferredTestQuery="${database.pool.connectionHealthQuery}" /> |
下面的属性可以用来配置数据库连接池
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 |
# == Basic database connection pool configuration == database.driverClass=org.postgresql.Driver database.url=jdbc:postgresql://database.example.com/cas?ssl=true database.user=somebody database.password=meaningless database.pool.minSize=6 database.pool.maxSize=18 # Maximum amount of time to wait in ms for a connection to become # available when the pool is exhausted database.pool.maxWait=10000 # Amount of time in seconds after which idle connections # in excess of minimum size are pruned. database.pool.maxIdleTime=120 # Number of connections to obtain on pool exhaustion condition. # The maximum pool size is always respected when acquiring # new connections. database.pool.acquireIncrement=6 # == Connection testing settings == # Period in s at which a health query will be issued on idle # connections to determine connection liveliness. database.pool.idleConnectionTestPeriod=30 # Query executed periodically to test health database.pool.connectionHealthQuery=select 1 # == Database recovery settings == # Number of times to retry acquiring a _new_ connection # when an error is encountered during acquisition. database.pool.acquireRetryAttempts=5 # Amount of time in ms to wait between successive aquire retry attempts. database.pool.acquireRetryDelay=2000 |
数据库组件
CAS提供了下面的组件来适配不同类型的数据库认证需求。
QueryDatabaseAuthenticationHandler
通过比较哈希过的用户密码来认证一个用户。利用设置好的数据库查询语句。
|
0 1 2 |
<alias name="queryDatabaseAuthenticationHandler" alias="primaryAuthenticationHandler" /> <alias name="dataSource" alias="queryDatabaseDataSource" /> |
下面的配置将会被使用：
|
0 1 |
# cas.jdbc.authn.query.sql=select password from users where username=? |
SearchModeSearchDatabaseAuthenticationHandler
通过用户名密码查询记录，如果能找到一个以上用户就可以认证成功
|
0 1 2 |
<alias name="searchModeSearchDatabaseAuthenticationHandler" alias="primaryAuthenticationHandler" /> <alias name="dataSource" alias="searchModeDatabaseDataSource" /> |
下面的配置将会被使用：
|
0 1 2 3 |
# cas.jdbc.authn.search.password= # cas.jdbc.authn.search.user= # cas.jdbc.authn.search.table= |
BindModeSearchDatabaseAuthenticationHandler
通过用户名和哈希过的密码尝试创建一个数据库连接来认证用户。
下面的例子没有执行任何密码加密，因为大多数JDBC驱动原生加密明文密码。注意，用用户名密码建立连接的能力是和认证等价的。这个handler是最简单的了，通常不需要配置。
|
0 1 2 |
<alias name="bindModeSearchDatabaseAuthenticationHandler" alias="primaryAuthenticationHandler" /> <alias name="dataSource" alias="bindSearchDatabaseDataSource" /> |
QueryAndEncodeDatabaseAuthenticationHandler
JDBC查询handler将会把私有salt和密码用来用户验证，用公开的salt加密密码，假设所有的东西都在一个表中。 支持多轮迭代器和私有salt的设置。
密码加密方法，结合私有salt和公开的salt为哈希密码做准备。如果用了多轮迭代，第一轮迭代的字节码在再哈希的时候不会使用salt。最终的结果将会在和数据库比较之前转为16进制。
|
0 1 2 |
<alias name="queryAndEncodeDatabaseAuthenticationHandler" alias="primaryAuthenticationHandler" /> <alias name="dataSource" alias="queryEncodeDatabaseDataSource" /> |
下面的配置将会被使用：
|
0 1 2 3 4 5 6 7 |
# cas.jdbc.authn.query.encode.sql= # cas.jdbc.authn.query.encode.alg= # cas.jdbc.authn.query.encode.salt.static= # cas.jdbc.authn.query.encode.password= # cas.jdbc.authn.query.encode.salt= # cas.jdbc.authn.query.encode.iterations.field= # cas.jdbc.authn.query.encode.iterations= |
0 Comments