CAS认证之数据库认证

原文：https://apereo.github.io/cas/4.2.x/installation/Database-Authentication.html

Database Authentication

当使用Maven WAR overlay部署的时候，数据库认证组件通过增加下面内容启用：

XHTML

<dependency> <groupId>org.jasig.cas</groupId> <artifactId>cas-server-support-jdbc</artifactId> <version>${cas.version}</version> </dependency>

0
1
2
3
4
5

<dependency>
    <groupId>org.jasig.cas</groupId>
    <artifactId>cas-server-support-jdbc</artifactId>
    <version>${cas.version}</version>
</dependency>

连接池

所有的数据库认证组件要求一个DataSource来连接数据库，强烈建议使用数据库连接池，c3p0库是一个很好的选择。

示例：
一个名为dataSource的bean必需定义

XHTML

<bean id="dataSource" class="com.mchange.v2.c3p0.ComboPooledDataSource" p:driverClass="${database.driverClass}" p:jdbcUrl="${database.url}" p:user="${database.user}" p:password="${database.password}" p:initialPoolSize="${database.pool.minSize}" p:minPoolSize="${database.pool.minSize}" p:maxPoolSize="${database.pool.maxSize}" p:maxIdleTimeExcessConnections="${database.pool.maxIdleTime}" p:checkoutTimeout="${database.pool.maxWait}" p:acquireIncrement="${database.pool.acquireIncrement}" p:acquireRetryAttempts="${database.pool.acquireRetryAttempts}" p:acquireRetryDelay="${database.pool.acquireRetryDelay}" p:idleConnectionTestPeriod="${database.pool.idleConnectionTestPeriod}" p:preferredTestQuery="${database.pool.connectionHealthQuery}" />

0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

<bean id="dataSource"
  class="com.mchange.v2.c3p0.ComboPooledDataSource"
  p:driverClass="${database.driverClass}"
  p:jdbcUrl="${database.url}"
  p:user="${database.user}"
  p:password="${database.password}"
  p:initialPoolSize="${database.pool.minSize}"
  p:minPoolSize="${database.pool.minSize}"
  p:maxPoolSize="${database.pool.maxSize}"
  p:maxIdleTimeExcessConnections="${database.pool.maxIdleTime}"
  p:checkoutTimeout="${database.pool.maxWait}"
  p:acquireIncrement="${database.pool.acquireIncrement}"
  p:acquireRetryAttempts="${database.pool.acquireRetryAttempts}"
  p:acquireRetryDelay="${database.pool.acquireRetryDelay}"
  p:idleConnectionTestPeriod="${database.pool.idleConnectionTestPeriod}"
  p:preferredTestQuery="${database.pool.connectionHealthQuery}" />

下面的属性可以用来配置数据库连接池

XHTML

# == Basic database connection pool configuration == database.driverClass=org.postgresql.Driver database.url=jdbc:postgresql://database.example.com/cas?ssl=true database.user=somebody database.password=meaningless database.pool.minSize=6 database.pool.maxSize=18 # Maximum amount of time to wait in ms for a connection to become # available when the pool is exhausted database.pool.maxWait=10000 # Amount of time in seconds after which idle connections # in excess of minimum size are pruned. database.pool.maxIdleTime=120 # Number of connections to obtain on pool exhaustion condition. # The maximum pool size is always respected when acquiring # new connections. database.pool.acquireIncrement=6 # == Connection testing settings == # Period in s at which a health query will be issued on idle # connections to determine connection liveliness. database.pool.idleConnectionTestPeriod=30 # Query executed periodically to test health database.pool.connectionHealthQuery=select 1 # == Database recovery settings == # Number of times to retry acquiring a _new_ connection # when an error is encountered during acquisition. database.pool.acquireRetryAttempts=5 # Amount of time in ms to wait between successive aquire retry attempts. database.pool.acquireRetryDelay=2000

0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# == Basic database connection pool configuration ==
database.driverClass=org.postgresql.Driver
database.url=jdbc:postgresql://database.example.com/cas?ssl=true
database.user=somebody
database.password=meaningless
database.pool.minSize=6
database.pool.maxSize=18

# Maximum amount of time to wait in ms for a connection to become
# available when the pool is exhausted
database.pool.maxWait=10000

# Amount of time in seconds after which idle connections
# in excess of minimum size are pruned.
database.pool.maxIdleTime=120

# Number of connections to obtain on pool exhaustion condition.
# The maximum pool size is always respected when acquiring
# new connections.
database.pool.acquireIncrement=6

# == Connection testing settings ==

# Period in s at which a health query will be issued on idle
# connections to determine connection liveliness.
database.pool.idleConnectionTestPeriod=30

# Query executed periodically to test health
database.pool.connectionHealthQuery=select 1

# == Database recovery settings ==

# Number of times to retry acquiring a _new_ connection
# when an error is encountered during acquisition.
database.pool.acquireRetryAttempts=5

# Amount of time in ms to wait between successive aquire retry attempts.
database.pool.acquireRetryDelay=2000

数据库组件

CAS提供了下面的组件来适配不同类型的数据库认证需求。

QueryDatabaseAuthenticationHandler

通过比较哈希过的用户密码来认证一个用户。利用设置好的数据库查询语句。


<alias name="queryDatabaseAuthenticationHandler" alias="primaryAuthenticationHandler" />
<alias name="dataSource" alias="queryDatabaseDataSource" />

下面的配置将会被使用：


# cas.jdbc.authn.query.sql=select password from users where username=?

0 1	# cas.jdbc.authn.query.sql=select password from users where username=?

SearchModeSearchDatabaseAuthenticationHandler
通过用户名密码查询记录，如果能找到一个以上用户就可以认证成功


<alias name="searchModeSearchDatabaseAuthenticationHandler" alias="primaryAuthenticationHandler" />
<alias name="dataSource" alias="searchModeDatabaseDataSource" />

下面的配置将会被使用：


# cas.jdbc.authn.search.password=
# cas.jdbc.authn.search.user=
# cas.jdbc.authn.search.table=

# cas.jdbc.authn.search.password=

# cas.jdbc.authn.search.user=

# cas.jdbc.authn.search.table=

BindModeSearchDatabaseAuthenticationHandler
通过用户名和哈希过的密码尝试创建一个数据库连接来认证用户。

下面的例子没有执行任何密码加密，因为大多数JDBC驱动原生加密明文密码。注意，用用户名密码建立连接的能力是和认证等价的。这个handler是最简单的了，通常不需要配置。


<alias name="bindModeSearchDatabaseAuthenticationHandler" alias="primaryAuthenticationHandler" />
<alias name="dataSource" alias="bindSearchDatabaseDataSource" />

QueryAndEncodeDatabaseAuthenticationHandler

JDBC查询handler将会把私有salt和密码用来用户验证，用公开的salt加密密码，假设所有的东西都在一个表中。支持多轮迭代器和私有salt的设置。

密码加密方法，结合私有salt和公开的salt为哈希密码做准备。如果用了多轮迭代，第一轮迭代的字节码在再哈希的时候不会使用salt。最终的结果将会在和数据库比较之前转为16进制。


<alias name="queryAndEncodeDatabaseAuthenticationHandler" alias="primaryAuthenticationHandler" />
<alias name="dataSource" alias="queryEncodeDatabaseDataSource" />

下面的配置将会被使用：


# cas.jdbc.authn.query.encode.sql=
# cas.jdbc.authn.query.encode.alg=
# cas.jdbc.authn.query.encode.salt.static=
# cas.jdbc.authn.query.encode.password=
# cas.jdbc.authn.query.encode.salt=
# cas.jdbc.authn.query.encode.iterations.field=
# cas.jdbc.authn.query.encode.iterations=

# cas.jdbc.authn.query.encode.sql=

# cas.jdbc.authn.query.encode.alg=

# cas.jdbc.authn.query.encode.salt.static=

# cas.jdbc.authn.query.encode.password=

# cas.jdbc.authn.query.encode.salt=

# cas.jdbc.authn.query.encode.iterations.field=

# cas.jdbc.authn.query.encode.iterations=

HYL Studio – 个人学习笔记