1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

public void doFilterInternal(final ServletRequest servletRequest, final ServletResponse servletResponse, final FilterChain filterChain) throws IOException, ServletException {
       final HttpServletRequest request = (HttpServletRequest) servletRequest;
       if (handler.isTokenRequest(request)) {
           handler.recordSession(request);		// 登錄，記錄session SingleSignOutFilter做的事情
           super.doFilterInternal(servletRequest, servletResponse, filterChain);	// 記錄完了之后，就調(diào)用CasFilter自己的doFilterInternal
           return;
       } else if (handler.isLogoutRequest(request)) {		// 如果是登出
		// 一堆的代碼，就是為了獲取SimplePrincipalCollection，設(shè)置到Subject里邊去，并在最后調(diào)用subject.logout()
           final String logoutMessage = CommonUtils.safeGetParameter(request, "logoutRequest");
           final String token = XmlUtils.getTextForElement(logoutMessage, "SessionIndex");
           if (CommonUtils.isNotBlank(token)) {
               HttpSession session = null;
               try {
                   Field msField = handler.getSessionMappingStorage().getClass().getDeclaredField("MANAGED_SESSIONS");
                   msField.setAccessible(true);
                   Map<String,HttpSession> MANAGED_SESSIONS = (Map)msField.get(handler.getSessionMappingStorage());
                   session = MANAGED_SESSIONS.get(token);
               } catch (Exception e) {
               }
               if (session != null) {
                   Subject subject = getSubject(servletRequest, servletResponse);
                   ShiroUser shiroUser = (ShiroUser)(((SimplePrincipalCollection)(session.getAttribute("org.apache.shiro.subject.support.DefaultSubjectContext_PRINCIPALS_SESSION_KEY"))).getPrimaryPrincipal());
                   SimplePrincipalCollection pc = new SimplePrincipalCollection(shiroUser, shiroUser.getName());
                   try {
                       Field principalsField = subject.getClass().getSuperclass().getDeclaredField("principals");
                       principalsField.setAccessible(true);
                       principalsField.set(subject, pc);
                   } catch (Exception e) {
                   }
                   try {
                       subject.logout();
                   } catch (SessionException ise) {
                   }
               }
           }
		// logout之后，還要銷毀session  SingleSignOutFilter做的事情
           handler.destroySession(request);
           return;
       } else {
           log.trace("Ignoring URI " + request.getRequestURI());
       }
       filterChain.doFilter(servletRequest, servletResponse);
   }

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

<bean id="casFilter" class="com.simpletour.sso.shiro.STSingleSignOutFilter">
	<property name="failureUrl" value="${sso.cas.client}${sso.cas.client.home}"/>
</bean>
<bean id="shiroFilter" class="com.simpletour.sso.shiro.STShiroFilterFactoryBean" init-method="init">
	<property name="securityManager" ref="securityManager" />
	<property name="loginUrl" value="${sso.cas.server}?service=${sso.cas.client}/cas/login" />
	<property name="successUrl" value="${sso.cas.client.home}" />
	<property name="filters">
		<map>
			<entry key="cas" value-ref="casFilter"/>
               <entry key="logout" value-ref="logoutFilter"/>
		</map>
	</property>
	<property name="filterChainDefinitions">
		<value>
			/static/** = anon
			/config_* = anon
			/cas/* = cas		<!--這里，cas/login, cas/logout 都走我們剛剛寫的filter-->
			/logout = logout
			/** = user
		</value>
	</property>
</bean>