wicket-auth-roles和spring-security-cas-client之间的身份验证集成问题

Question

I have an issue on one of my Wicket projects. The version of wicket I use is the 1.5.7 release, with wicket-auth-roles (same version).

I'm trying to get a CAS server integration; for that, I'm trying to use the spring-security-cas-client (3.0.7.RELEASE) but the CAS authentication isn't working at all. On this project, I am already using spring-security-core (3.1.0.RELEASE), spring-security-config, & spring-security-ldap and that works fine.

The issue I'm getting is when I first access a Wicket page. Usually I must have a CAS interrogation; but despite that, the method "getSignInPageClass" (wicket-auth-roles) of my custom authenticatedWebApplication is called and I'm automatically forwarded to my login page (and I'm not getting any CAS call at all).

Has someone already met this type of issue?

Answer 1

I just went through the same issue. To get it working, I let Wicket do the redirection to CAS and then the CasAuthenticationFilter validate the token and handle authentication. I dont know if it is the best solution, but I used a RequestMapper to handle the AuthenticatedWebSession sign-in.

Spring Security Configuration

<!-- https://cwiki.apache.org/WICKET/spring-security-and-wicket-auth-roles.html -->
<http use-expressions="true" auto-config="true" entry-point-ref="casEntryPoint">
    <intercept-url pattern="/**" />

    <custom-filter ref="casFilter" position="CAS_FILTER"/>
</http>

Override restartResponseAtSignInPage in your AuthenticatedApplication

/**
 * Stores original Url and redirects to CAS login for authentication. CAS will redirect back to this
 * service using the service parameter. 
 */
@Override
public void restartResponseAtSignInPage() {
    Session.get().setAttribute("originalUrl", RequestCycle.get().getRequest().getOriginalUrl());
    // This will be the URL back to the Spring CAS filter
    String service = "service=https%3A%2F%2F" + casServiceHost + "%2Fapp%2Flogin";
    throw new RedirectToUrlException("https://" + casServerHost + "/cas/login?" + service);
}

Make a IRequestMapper to handle the AuthenticatedWebSession sign in and redirection.

@Override
public IRequestHandler mapRequest(Request request) {
    logger.info("CasAuthMapper mapping {}", request.getUrl());
    // The authentication will have been handled by Spring's CasAuthenticationFilter
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    // ... Do whatever you need to do here. I added a simple method to my web session to delegate to signIn(boolean).