Universal method for realizing single sign-on based on CAS

Abstract

The invention provides a universal method for realizing single sign-on based on a CAS. The universal method comprises the following steps: establishing a high-availability CAS Server cluster; the method comprises the following steps of: developing a CAS Client SDK (Software Development Kit) supporting multiple languages and multiple frameworks on the basis of an established CAS Server, and providing a simplified API (Application Program Interface) and a user-defined configuration function; the application system integrates the developed CAS Client SDK, interacts with the CAS Server through the SDK, obtains the ST, completes user identity authentication, and realizes single sign-on; on the basis of realizing single-point login, a single-point logout function provided by the CAS Client SDK is integrated, so that all application systems are guaranteed to be logged out synchronously after any application system of a user is logged out. The universal method for realizing single sign-on based on the CAS has the beneficial effects that a universal, safe, easy-to-use and extensible single sign-on solution is provided, the problems caused by independent authentication of multiple applications in an existing information system can be effectively solved, the user experience is improved, the system security is enhanced, the application integration is simplified, and the universal method has a wide application prospect.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to a general method for implementing single sign-on based on CAS. Background Art

[0002] In modern organizations or enterprises, information construction is becoming more and more in-depth. Each department usually develops and maintains its own applications, which often have independent user authentication systems. This decentralized authentication method has the following problems:

[0003] Poor user experience: Users need to remember multiple usernames and passwords and log in repeatedly when accessing different applications, which is cumbersome and inefficient.

[0004] Security risks: Multiple authentication systems increase the difficulty of security management and are prone to security vulnerabilities, leading to user information leakage;

[0005] Difficult integration: Identity information between different applications is difficult to share, making system integration and data exchange complicated. Summary of the invention

[0006] In view of this, the present invention aims to propose a general method for implementing single sign-on based on CAS, so as to solve at least one problem in the background technology.

[0007] To achieve the above object, the technical solution of the present invention is achieved as follows:

[0008] A general method for implementing single sign-on based on CAS, including:

[0009] Build a highly available CAS Server cluster;

[0010] Based on the built CAS Server, develop a CAS Client SDK that supports multiple languages ​​and multiple frameworks, and provide a simplified API interface and custom configuration functions;

[0011] The application system integrates the developed CAS Client SDK, and interacts with the CAS Server through the SDK to obtain ST and complete user identity authentication to achieve single sign-on;

[0012] On the basis of achieving single sign-on, the single sign-out function provided by CAS Client SDK is integrated to ensure that after the user signs out of any application system, all application systems are signed out synchronously;

[0013] At the same time, the HTTPS protocol is used to encrypt communication data, and a validity period and refresh mechanism are set for ST.

[0014] Furthermore, the highly available CAS Server cluster is built and supports multiple authentication methods, including:

[0015] Nginx is used to build a CAS Server cluster, and Keepalived is combined to implement active-standby switching. At the same time, Docker containerization is used to deploy CAS Server to achieve rapid deployment and elastic scaling.

[0016] Furthermore, the application system integrates the developed CAS Client SDK, and interacts with the CAS Server through the SDK to obtain ST and complete user identity authentication to achieve single sign-on, including:

[0017] Integrate CAS Client SDK on the application system login page and configure CAS Server related parameters;

[0018] When a user initiates a login request, the SDK redirects the user to the CAS Server for identity authentication;

[0019] After the user completes the authentication on the CAS Server, the CAS Server generates a ST and redirects it back to the application system;

[0020] The application system obtains ST through SDK and verifies the validity of ST with CAS Server;

[0021] After the CAS Server verifies that the ST is valid, it returns the user information to the application system;

[0022] The application system generates its own system Token or Session based on user information, and establishes a mapping relationship between ST and Token to achieve single sign-on.

[0023] Furthermore, on the basis of achieving single sign-on, the single sign-off function provided by the CAS Client SDK is integrated to ensure that after the user signs out of any application system, all application systems are signed out synchronously, including:

[0024] The application system integrates the cas.logout() method provided by the SDK to implement the single-point logout function;

[0025] When the user clicks the logout button in any application system, the SDK sends a logout request to the CAS Server;

[0026] After receiving the logout request, CAS Server clears the corresponding ST and notifies all logged-in application systems to perform the logout operation;

[0027] After receiving the logout notification, each application system clears the local Token or Session to achieve synchronous logout of the user in all application systems.

[0028] Furthermore, on the basis of achieving single sign-on, the single sign-off function provided by the CAS Client SDK is integrated to ensure that after the user signs out of any application system, all application systems are signed out synchronously, including:

[0029] Front-end logout: SDK provides JavaScript function. After the user clicks the logout button, SDK automatically sends a logout request to CASServer.

[0030] Backend logout: SDK supports backend logout mode. The application system implements single-point logout by calling the API interface provided by SDK.

[0031] Logout callback: Use CAS Server to configure the logout callback address. After the user completes the logout, CAS Server sends a logout notification to all registered application systems to ensure that all application systems are logged out synchronously.

[0032] Furthermore, the HTTPS protocol is used to encrypt communication data, and a validity period and a refresh mechanism are set for ST, including:

[0033] All communications with the CAS Server are encrypted using the HTTPS protocol, including user login, ST acquisition, ST verification, and single-point logout.

[0034] Set a validity period and a refresh mechanism for ST. After the validity period, the ST will automatically become invalid. At the same time, a ST refresh mechanism is provided to allow users to refresh the ST before it expires.

[0035] Furthermore, the setting of validity period and refresh mechanism for ST specifically includes:

[0036] Sliding window mechanism: Set an initial validity period and sliding window for each ST. When the user performs any operation within the sliding window, the validity period of the ST is automatically refreshed and reset to the initial validity period. If the user does not have any activity within the sliding window, the ST will expire after the initial validity period.

[0037] Dynamic refresh mechanism: CAS Server is used to conduct risk assessment based on user behavior and environmental factors. Based on the risk assessment results, the validity period and sliding window size of ST are dynamically adjusted. For low-risk users, the validity period and sliding window of ST are extended; for high-risk users, the validity period and sliding window of ST are shortened or users are forced to log in again.

[0038] Refresh process: When a user accesses a protected resource, the CAS Client sends the ST to the CAS Server for verification. The CAS Server checks the validity period of the ST and the user's activity status. If the ST is still within the validity period and the user is active within the sliding window, the validity period of the ST is refreshed and a successful verification result is returned. If the ST has expired or the user is not active within the sliding window, a failed verification result is returned. The CAS Client redirects the user to the CAS Server for re-login. After the user re-logins, the CAS Server generates a new ST and sends it to the CAS Client.

[0039] Furthermore, the present solution discloses an electronic device, including a processor and a memory connected to the processor for storing instructions executable by the processor, wherein the processor is used to execute a general method for implementing single sign-on based on CAS.

[0040] Furthermore, the present solution discloses a server, comprising at least one processor, and a memory communicatively connected to the processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the processor so that the at least one processor executes a general method for implementing single sign-on based on CAS.

[0041] Furthermore, the present solution discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, a general method for implementing single sign-on based on CAS is implemented.

[0042] Compared with the prior art, the general method for implementing single sign-on based on CAS described in the present invention has the following beneficial effects:

[0043] The general method for implementing single sign-on based on CAS described in the present invention provides a general, secure, easy-to-use and scalable single sign-on solution, which can effectively solve the problems caused by independent authentication of multiple applications in existing information systems, improve user experience, enhance system security, simplify application integration, and has broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

[0045] Figure 1 This is a schematic diagram of a simple flow chart of SSO authentication according to an embodiment of the present invention;

[0046] Figure 2The figure is a schematic diagram of a specific service calling process described in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0048] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0049] This solution discloses a general method for implementing single sign-on based on CAS. In one embodiment, the specific solution is as follows:

[0050] include:

[0051] Build a highly available CAS Server cluster;

[0052] Based on the built CAS Server, develop a CAS Client SDK that supports multiple languages ​​and multiple frameworks, and provide a simplified API interface and custom configuration functions;

[0053] The application system integrates the developed CAS Client SDK, and interacts with the CAS Server through the SDK to obtain ST and complete user identity authentication to achieve single sign-on;

[0054] On the basis of achieving single sign-on, the single sign-out function provided by CAS Client SDK is integrated to ensure that after the user signs out of any application system, all application systems are signed out synchronously;

[0055] At the same time, the HTTPS protocol is used to encrypt communication data, and a validity period and refresh mechanism are set for ST.

[0056] Furthermore, the highly available CAS Server cluster is built and supports multiple authentication methods, including:

[0057] Nginx is used to build a CAS Server cluster, and Keepalived is combined to implement active-standby switching. At the same time, Docker containerization is used to deploy CAS Server to achieve rapid deployment and elastic scaling.

[0058] Furthermore, the application system integrates the developed CAS Client SDK, and interacts with the CAS Server through the SDK to obtain ST and complete user identity authentication to achieve single sign-on, including:

[0059] Integrate CAS Client SDK on the application system login page and configure CAS Server related parameters;

[0060] When a user initiates a login request, the SDK redirects the user to the CAS Server for identity authentication;

[0061] After the user completes the authentication on the CAS Server, the CAS Server generates a ST and redirects it back to the application system;

[0062] The application system obtains ST through SDK and verifies the validity of ST with CAS Server;

[0063] After the CAS Server verifies that the ST is valid, it returns the user information to the application system;

[0064] The application system generates its own system Token or Session based on user information, and establishes a mapping relationship between ST and Token to achieve single sign-on.

[0065] Furthermore, on the basis of achieving single sign-on, the single sign-off function provided by the CAS Client SDK is integrated to ensure that after the user signs out of any application system, all application systems are signed out synchronously, including:

[0066] The application system integrates the cas.logout() method provided by the SDK to implement the single-point logout function;

[0067] When the user clicks the logout button in any application system, the SDK sends a logout request to the CAS Server;

[0068] After receiving the logout request, CAS Server clears the corresponding ST and notifies all logged-in application systems to perform the logout operation;

[0069] After receiving the logout notification, each application system clears the local Token or Session to achieve synchronous logout of the user in all application systems.

[0070] Furthermore, on the basis of achieving single sign-on, the single sign-off function provided by the CAS Client SDK is integrated to ensure that after the user signs out of any application system, all application systems are signed out synchronously, including:

[0071] Front-end logout: SDK provides JavaScript function. After the user clicks the logout button, SDK automatically sends a logout request to CASServer.

[0072] Backend logout: SDK supports backend logout mode. The application system implements single-point logout by calling the API interface provided by SDK.

[0073] Logout callback: Use CAS Server to configure the logout callback address. After the user completes the logout, CAS Server sends a logout notification to all registered application systems to ensure that all application systems are logged out synchronously.

[0074] Furthermore, the HTTPS protocol is used to encrypt communication data, and a validity period and a refresh mechanism are set for ST, including:

[0075] All communications with the CAS Server are encrypted using the HTTPS protocol, including user login, ST acquisition, ST verification, and single-point logout.

[0076] Set a validity period and a refresh mechanism for ST. After the validity period, the ST will automatically become invalid. At the same time, a ST refresh mechanism is provided to allow users to refresh the ST before it expires.

[0077] Furthermore, the setting of validity period and refresh mechanism for ST specifically includes:

[0078] Sliding window mechanism: Set an initial validity period and sliding window for each ST. When the user performs any operation within the sliding window, the validity period of the ST is automatically refreshed and reset to the initial validity period. If the user does not have any activity within the sliding window, the ST will expire after the initial validity period.

[0079] Dynamic refresh mechanism: CAS Server is used to conduct risk assessment based on user behavior and environmental factors. Based on the risk assessment results, the validity period and sliding window size of ST are dynamically adjusted. For low-risk users, the validity period and sliding window of ST are extended; for high-risk users, the validity period and sliding window of ST are shortened or users are forced to log in again.

[0080] Refresh process: When a user accesses a protected resource, the CAS Client sends the ST to the CAS Server for verification. The CAS Server checks the validity period of the ST and the user's activity status. If the ST is still within the validity period and the user is active within the sliding window, the validity period of the ST is refreshed and a successful verification result is returned. If the ST has expired or the user is not active within the sliding window, a failed verification result is returned. The CAS Client redirects the user to the CAS Server for re-login. After the user re-logins, the CAS Server generates a new ST and sends it to the CAS Client.

[0081] In another embodiment, if Figure 1 and Figure 2As shown, the present invention authenticates user credentials, issues tickets and other related tasks based on CAS Server, and the project simulates and implements CAS Client functions.

[0082] The background configuration determines whether to enable the CAS single sign-on authentication switch. When the browser accesses the relevant address, the interface returns the relevant configuration information according to the background configuration. The browser determines whether the CAS single sign-on authentication has been enabled based on the returned information. If the switch is turned on, the route jumps to the CAS Server login authentication page, and the correct CAS authentication account is used to log in to the CAS Server. The CAS Server will save the cookie in the browser and return the ST credential. The browser carries the ST to jump back to the original access address before jumping to the CAS Server. Use the Kong gateway, configure the gateway plug-in, intercept through the gateway, and use the ST carried by the browser as the background interface input parameter. Then, the background carries the ST to the CAS Server for ST verification. If the CAS Server authentication is successful, the token of the self-developed system is generated and returned to the browser, and the first login can be completed. When accessing other systems, the browser carries the cookie to the CAS Server for verification, and there is no need to log in again. At this point, by simulating the CAS Client, the unified single sign-on general solution for the entire system is completed to the CAS Server. The main idea is to simulate the CAS Client, authenticate the ST, and then exchange the token of each service through the ST.

[0083] By using the present invention, the specific effects include the following points:

[0084] 1. Reduce user burden and improve user experience: CAS SSO allows users to access multiple applications or services with just one login, without having to repeatedly enter credentials. This reduces the number of usernames and passwords that users need to remember and manage, improving user convenience and experience.

[0085] 2. Improved security: CAS SSO performs identity authentication and authorization based on the ticket mechanism, reducing the risk of passing credentials directly between applications. Users only need to provide credentials to the CAS server instead of passing credentials to each application. This reduces the risk of password leakage and man-in-the-middle attacks and improves the security of the system.

[0086] 3. Simplify application integration: CAS SSO provides a unified identity authentication and ticket management mechanism, which simplifies the integration of application authentication and authorization. By configuring the application to use the CAS server as the identity authentication provider, integration with the CAS server can be achieved without having to implement and maintain the authentication function of each application separately.

[0087] 4. Support cross-domain single sign-on: CAS SSO supports cross-domain single sign-on, allowing users to log in in one domain and automatically log in in other domains. This allows users to access different applications or services in multiple domains without re-entering credentials. Cross-domain single sign-on provides a wider range of application scenarios and flexibility.

[0088] 5.Support single sign-out: CAS SSO supports single sign-out. When a user signs out of an application, all other logged-in applications will be automatically signed out, improving security.

[0089] 6. Improve management and maintenance efficiency: CAS SSO provides centralized identity authentication and user management, simplifying the creation, update and deletion of user accounts. By centrally managing user credentials and access rights, management and maintenance efficiency can be improved and manpower and resource costs can be reduced.

[0090] In summary, by using the invention, the burden on users is reduced, user experience is improved, security is improved, application integration is simplified, cross-domain single sign-on and single sign-off are supported, and management and maintenance efficiency is improved. These reasons make the invention widely popularized and used.

[0091] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0092] In the several embodiments provided in the present application, it should be understood that the disclosed methods and systems can be implemented in other ways. For example, the division of the units described above is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. The above-mentioned units may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention.

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

[0094] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A general method for implementing single sign-on based on CAS, characterized in that: include: Build a highly available CAS Server cluster; Based on the built CAS Server, develop a CAS Client SDK that supports multiple languages ​​and multiple frameworks, and provide a simplified API interface and custom configuration functions; The application system integrates the developed CAS Client SDK, and interacts with the CAS Server through the SDK to obtain ST and complete user identity authentication to achieve single sign-on; On the basis of achieving single sign-on, the single sign-out function provided by CAS Client SDK is integrated to ensure that after the user signs out of any application system, all application systems are signed out synchronously; At the same time, the HTTPS protocol is used to encrypt communication data, and a validity period and refresh mechanism are set for ST.

2. According to claim 1, a general method for implementing single sign-on based on CAS is characterized in that: The described construction of a highly available CAS Server cluster supports multiple authentication methods, including: Nginx is used to build a CAS Server cluster, and Keepalived is combined to implement active-standby switching. At the same time, Docker containerization is used to deploy CAS Server to achieve rapid deployment and elastic scaling.

3. According to a general method for implementing single sign-on based on CAS according to claim 1, it is characterized in that: The application system integrates the developed CAS Client SDK, and interacts with the CAS Server through the SDK to obtain ST and complete user identity authentication to achieve single sign-on, including: Integrate CAS Client SDK on the application system login page and configure CAS Server related parameters; When a user initiates a login request, the SDK redirects the user to the CAS Server for identity authentication; After the user completes the authentication on the CAS Server, the CAS Server generates a ST and redirects it back to the application system; The application system obtains ST through SDK and verifies the validity of ST with CAS Server; After the CAS Server verifies that the ST is valid, it returns the user information to the application system; The application system generates its own system Token or Session based on user information, and establishes a mapping relationship between ST and Token to achieve single sign-on.

4. According to the general method for implementing single sign-on based on CAS in claim 1, it is characterized in that: On the basis of achieving single sign-on, the single sign-off function provided by CAS Client SDK is integrated to ensure that after the user signs out of any application system, all application systems are signed out synchronously, including: The application system integrates the cas.logout() method provided by the SDK to implement the single-point logout function; When the user clicks the logout button in any application system, the SDK sends a logout request to the CAS Server; After receiving the logout request, CAS Server clears the corresponding ST and notifies all logged-in application systems to perform the logout operation; After receiving the logout notification, each application system clears the local Token or Session to achieve synchronous logout of the user in all application systems.

5. According to the general method for implementing single sign-on based on CAS in claim 1, it is characterized in that: On the basis of achieving single sign-on, the single sign-off function provided by CAS Client SDK is integrated to ensure that after the user signs out of any application system, all application systems are signed out synchronously, including: Front-end logout: SDK provides JavaScript function. When the user clicks the logout button, SDK automatically sends a logout request to CAS Server. Backend logout: SDK supports backend logout mode. The application system implements single-point logout by calling the API interface provided by SDK. Logout callback: Use CAS Server to configure the logout callback address. After the user completes the logout, CAS Server sends a logout notification to all registered application systems to ensure that all application systems are logged out synchronously.

6. A general method for implementing single sign-on based on CAS according to claim 1, characterized in that: The HTTPS protocol is used to encrypt communication data, and the validity period and refresh mechanism are set for ST, including: All communications with the CAS Server are encrypted using the HTTPS protocol, including user login, ST acquisition, ST verification, and single-point logout. Set a validity period and a refresh mechanism for ST. After the validity period, ST will automatically become invalid. At the same time, a ST refresh mechanism is provided to allow users to refresh ST before it expires.

7. A general method for implementing single sign-on based on CAS according to claim 1, characterized in that: The setting of validity period and refresh mechanism for ST specifically includes: Sliding window mechanism: Set an initial validity period and sliding window for each ST. When the user performs any operation within the sliding window, the validity period of the ST is automatically refreshed and reset to the initial validity period. If the user does not have any activity within the sliding window, the ST will expire after the initial validity period. Dynamic refresh mechanism: CAS Server is used to conduct risk assessment based on user behavior and environmental factors. Based on the risk assessment results, the validity period and sliding window size of ST are dynamically adjusted. For low-risk users, the validity period and sliding window of ST are extended; for high-risk users, the validity period and sliding window of ST are shortened or users are forced to log in again. Refresh process: When a user accesses a protected resource, the CAS Client sends the ST to the CAS Server for verification. The CAS Server checks the validity period of the ST and the user's activity status. If the ST is still within the validity period and the user is active within the sliding window, the validity period of the ST is refreshed and a successful verification result is returned. If the ST has expired or the user is not active within the sliding window, a failed verification result is returned. The CAS Client redirects the user to the CAS Server for re-login. After the user re-logins, the CAS Server generates a new ST and sends it to the CAS Client.

8. An electronic device, comprising a processor and a memory connected to the processor for storing instructions executable by the processor, characterized in that: The processor is used to execute a general method for implementing single sign-on based on CAS as described in any one of claims 1 to 7 above.

9. A server, characterized in that: It includes at least one processor and a memory in communication with the processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the processor so that the at least one processor executes a general method for implementing single sign-on based on CAS as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the general method for implementing single sign-on based on CAS as described in any one of claims 1 to 7 is implemented.

Images