CasAuthenticationFilter

Class Overview

Processes a CAS service ticket, obtains proxy granting tickets, and processes proxy tickets.

Service Tickets

A service ticket consists of an opaque ticket string. It arrives at this filter by the user's browser successfully authenticating using CAS, and then receiving a HTTP redirect to a service. The opaque ticket string is presented in the ticket request parameter.

This filter monitors the service URL so it can receive the service ticket and process it. By default this filter processes the URL /j_spring_cas_security_check. When processing this URL, the value of getService() is used as the service when validating the ticket. This means that it is important that getService() specifies the same value as the filterProcessesUrl.

Processing the service ticket involves creating a UsernamePasswordAuthenticationToken which uses CAS_STATEFUL_IDENTIFIER for the principal and the opaque ticket string as the credentials.

Obtaining Proxy Granting Tickets

If specified, the filter can also monitor the proxyReceptorUrl. The filter will respond to requests matching this url so that the CAS Server can provide a PGT to the filter. Note that in addition to the proxyReceptorUrl a non-null proxyGrantingTicketStorage must be provided in order for the filter to respond to proxy receptor requests. By configuring a shared ProxyGrantingTicketStorage between the TicketValidator and the CasAuthenticationFilter one can have the CasAuthenticationFilter handle the proxying requirements for CAS.

Proxy Tickets

The filter can process tickets present on any url. This is useful when wanting to process proxy tickets. In order for proxy tickets to get processed isAuthenticateAllArtifacts() must return true. Additionally, if the request is already authenticated, authentication will not occur. Last, buildDetails(Object) must return a ServiceAuthenticationDetails. This can be accomplished using the ServiceAuthenticationDetailsSource. In this case getServiceUrl() will be used for the service url.

Processing the proxy ticket involves creating a UsernamePasswordAuthenticationToken which uses CAS_STATELESS_IDENTIFIER for the principal and the opaque ticket string as the credentials. When a proxy ticket is successfully authenticated, the FilterChain continues and the authenticationSuccessHandler is not used.

Notes about the AuthenticationManager

The configured AuthenticationManager is expected to provide a provider that can recognise UsernamePasswordAuthenticationTokens containing this special principal name, and process them accordingly by validation with the CAS server. Additionally, it should be capable of using the result of getServiceUrl() as the service when validating the ticket.

Example Configuration

An example configuration that supports service tickets, obtaining proxy granting tickets, and proxy tickets is illustrated below:

 <b:bean id="serviceProperties"
     class="org.springframework.security.cas.ServiceProperties"
     p:service="https://service.example.com/cas-sample/j_spring_cas_security_check"
     p:authenticateAllArtifacts="true"/>
 <b:bean id="casEntryPoint"
     class="org.springframework.security.cas.web.CasAuthenticationEntryPoint"
     p:serviceProperties-ref="serviceProperties" p:loginUrl="https://login.example.org/cas/login" />
 <b:bean id="casFilter"
     class="org.springframework.security.cas.web.CasAuthenticationFilter"
     p:authenticationManager-ref="authManager"
     p:serviceProperties-ref="serviceProperties"
     p:proxyGrantingTicketStorage-ref="pgtStorage"
     p:proxyReceptorUrl="/j_spring_cas_security_proxyreceptor">
     <b:property name="authenticationDetailsSource">
         <b:bean class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource"/>
     </b:property>
     <b:property name="authenticationFailureHandler">
         <b:bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"
             p:defaultFailureUrl="/casfailed.jsp"/>
     </b:property>
 </b:bean>
 <!--
     NOTE: In a real application you should not use an in memory implementation. You will also want
           to ensure to clean up expired tickets by calling ProxyGrantingTicketStorage.cleanup()
  -->
 <b:bean id="pgtStorage" class="org.jasig.cas.client.proxy.ProxyGrantingTicketStorageImpl"/>
 <b:bean id="casAuthProvider" class="org.springframework.security.cas.authentication.CasAuthenticationProvider"
     p:serviceProperties-ref="serviceProperties"
     p:key="casAuthProviderKey">
     <b:property name="authenticationUserDetailsService">
         <b:bean
             class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
             <b:constructor-arg ref="userService" />
         </b:bean>
     </b:property>
     <b:property name="ticketValidator">
         <b:bean
             class="org.jasig.cas.client.validation.Cas20ProxyTicketValidator"
             p:acceptAnyProxy="true"
             p:proxyCallbackUrl="https://service.example.com/cas-sample/j_spring_cas_security_proxyreceptor"
             p:proxyGrantingTicketStorage-ref="pgtStorage">
             <b:constructor-arg value="https://login.example.org/cas" />
         </b:bean>
     </b:property>
     <b:property name="statelessTicketCache">
         <b:bean class="org.springframework.security.cas.authentication.EhCacheBasedTicketCache">
             <b:property name="cache">
                 <b:bean class="net.sf.ehcache.Cache"
                   init-method="initialise"
                   destroy-method="dispose">
                     <b:constructor-arg value="casTickets"/>
                     <b:constructor-arg value="50"/>
                     <b:constructor-arg value="true"/>
                     <b:constructor-arg value="false"/>
                     <b:constructor-arg value="3600"/>
                     <b:constructor-arg value="900"/>
                 </b:bean>
             </b:property>
         </b:bean>
     </b:property>
 </b:bean>
 

Summary

[Expand] Inherited Constants
From class org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter String SPRING_SECURITY_LAST_EXCEPTION_KEY This constant is deprecated. Use the value in WebAttributes directly.

[Expand] Inherited Fields
From class org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter protected AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource protected ApplicationEventPublisher eventPublisher protected MessageSourceAccessor messages
From class org.springframework.web.filter.GenericFilterBean protected final Log logger

[Expand] Inherited Methods
From class org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter void afterPropertiesSet() abstract Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) Performs actual authentication. void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) Invokes the requiresAuthentication method to determine whether the request is for authentication and should be handled by this filter. boolean getAllowSessionCreation() AuthenticationManager getAuthenticationManager() AuthenticationFailureHandler getFailureHandler() String getFilterProcessesUrl() RememberMeServices getRememberMeServices() AuthenticationSuccessHandler getSuccessHandler() boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) Indicates whether this filter should attempt to process a login request for the current invocation. void setAllowSessionCreation(boolean allowSessionCreation) void setApplicationEventPublisher(ApplicationEventPublisher eventPublisher) void setAuthenticationDetailsSource(AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource) void setAuthenticationFailureHandler(AuthenticationFailureHandler failureHandler) void setAuthenticationManager(AuthenticationManager authenticationManager) void setAuthenticationSuccessHandler(AuthenticationSuccessHandler successHandler) Sets the strategy used to handle a successful authentication. void setContinueChainBeforeSuccessfulAuthentication(boolean continueChainBeforeSuccessfulAuthentication) Indicates if the filter chain should be continued prior to delegation to successfulAuthentication(HttpServletRequest, HttpServletResponse, Authentication), which may be useful in certain environment (such as Tapestry applications). void setFilterProcessesUrl(String filterProcessesUrl) void setMessageSource(MessageSource messageSource) void setRememberMeServices(RememberMeServices rememberMeServices) void setSessionAuthenticationStrategy(SessionAuthenticationStrategy sessionStrategy) The session handling strategy which will be invoked immediately after an authentication request is successfully processed by the AuthenticationManager. void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) Default behaviour for successful authentication. void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authResult) This method is deprecated. since 3.1. Use successfulAuthentication(HttpServletRequest, HttpServletResponse, FilterChain, Authentication) instead. void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) Default behaviour for unsuccessful authentication.
From class org.springframework.web.filter.GenericFilterBean final void addRequiredProperty(String arg0) void afterPropertiesSet() void destroy() final FilterConfig getFilterConfig() final String getFilterName() final ServletContext getServletContext() final void init(FilterConfig arg0) void initBeanWrapper(BeanWrapper arg0) void initFilterBean() final void setBeanName(String arg0) final void setFilterConfig(FilterConfig arg0) final void setServletContext(ServletContext arg0)
From class java.lang.Object Object clone() boolean equals(Object arg0) void finalize() final Class<?> getClass() int hashCode() final void notify() final void notifyAll() String toString() final void wait() final void wait(long arg0, int arg1) final void wait(long arg0)
From interface javax.servlet.Filter abstract void destroy() abstract void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2) abstract void init(FilterConfig arg0)
From interface org.springframework.beans.factory.BeanNameAware abstract void setBeanName(String arg0)
From interface org.springframework.beans.factory.DisposableBean abstract void destroy()
From interface org.springframework.beans.factory.InitializingBean abstract void afterPropertiesSet()
From interface org.springframework.context.ApplicationEventPublisherAware abstract void setApplicationEventPublisher(ApplicationEventPublisher arg0)
From interface org.springframework.context.MessageSourceAware abstract void setMessageSource(MessageSource arg0)
From interface org.springframework.web.context.ServletContextAware abstract void setServletContext(ServletContext arg0)