openresty之实现SSO得客户端-yellowcong

向右看齐 2022-02-14 19:48 488阅读 0赞

## 准备 ##

[Nginx之openresty安装-yellowcong][Nginx_openresty_-yellowcong]

## sso 原理 ##

https://www.cnblogs.com/xiatian0721/p/8136305.html

https://sso.teddymobile.net/v1/tickets  
https://apereo.github.io/cas/5.2.x/protocol/CAS-Protocol-Specification.html  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70]

## luaのhttp客户端 ##

https://github.com/ledgetech/lua-resty-http

重点添加 lua\_package\_path “/usr/local/openresty/nginx/lua/lib/?.lua;;”; 这个 配置，设定依赖得目录

#user nobody;
    worker_processes  1;
    
    #error_log logs/error.log;
    #error_log logs/error.log notice;
    #error_log logs/error.log info;
    
    #pid logs/nginx.pid;
    
    
    events { 
        worker_connections  1024;
    }
    
    
    http { 
        include       mime.types;
        default_type  application/octet-stream;
    
        #log_format main '$remote_addr - $remote_user [$time_local] "$request" '
        # '$status $body_bytes_sent "$http_referer" '
        # '"$http_user_agent" "$http_x_forwarded_for"';
    
        #access_log logs/access.log main;
    
        sendfile        on;
        #tcp_nopush on;
    
        #keepalive_timeout 0;
        keepalive_timeout  65;
    
        #gzip on;
        lua_package_path "/usr/local/openresty/nginx/lua/lib/?.lua;;";
    
        server { 
            listen       80;
            server_name  ci.teddymobile.net;
    
            #charset koi8-r;
            lua_code_cache off;
            #access_log logs/host.access.log main;
    
            location / { 
                #root html;
                #index index.html index.htm;
                #配置这个才柯
                resolver 114.114.114.114; 
     	        default_type text/html ;
                content_by_lua_file  lua/login_filter.lua;
    	}
            
            location /hello{ 
                 default_type text/html ;
                 content_by_lua 'ngx.say("doubi")';
            }
    
            location /login{ 
                default_type text/html ;
                content_by_lua_file lua/login.lua ;
            }
            #error_page 404 /404.html;
    
            # redirect server error pages to the static page /50x.html
            #
            error_page   500 502 503 504  /50x.html;
            location = /50x.html { 
                root   html;
            }
    
            # proxy the PHP scripts to Apache listening on 127.0.0.1:80
            #
            #location ~ \.php$ { 
            # proxy_pass http://127.0.0.1;
            #}
    
            # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
            #
            #location ~ \.php$ { 
            # root html;
            # fastcgi_pass 127.0.0.1:9000;
            # fastcgi_index index.php;
            # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
            # include fastcgi_params;
            #}
    
            # deny access to .htaccess files, if Apache's document root
            # concurs with nginx's one
            #
            #location ~ /\.ht { 
            # deny all;
            #}
        }
    
    
        # another virtual host using mix of IP-, name-, and port-based configuration
        #
        #server { 
        # listen 8000;
        # listen somename:8080;
        # server_name somename alias another.alias;
    
        # location / { 
        # root html;
        # index index.html index.htm;
        # }
        #}
    
    
        # HTTPS server
        #
        #server { 
        # listen 443 ssl;
        # server_name localhost;
    
        # ssl_certificate cert.pem;
        # ssl_certificate_key cert.key;
    
        # ssl_session_cache shared:SSL:1m;
        # ssl_session_timeout 5m;
    
        # ssl_ciphers HIGH:!aNULL:!MD5;
        # ssl_prefer_server_ciphers on;
    
        # location / { 
        # root html;
        # index index.html index.htm;
        # }
        #}
    
    }

### 2. 添加lua得http依赖 ###

目录结构，必须时resty得目录下，不然会导致找不到依赖得问题

#到我们得依赖目录
    cd /usr/local/openresty/nginx/lua/lib/resty
    
    #下载两个依赖包
    wget https://raw.githubusercontent.com/pintsized/lua-resty-http/master/lib/resty/http_headers.lua  
    wget https://raw.githubusercontent.com/pintsized/lua-resty-http/master/lib/resty/http.lua

![在这里插入图片描述][2019042917014479.png]

## 登陆 ##

lua获取ticket参数  
https://blog.csdn.net/xiejunna/article/details/70738853  
lua请求服务  
https://jinnianshilongnian.iteye.com/blog/2187328

lua获取参数  
https://www.jianshu.com/p/a90438b2281d  
https://blog.csdn.net/u013412772/article/details/78738514

lua实现session  
https://github.com/bungle/lua-resty-session

lua操作cookie  
https://github.com/cloudflare/lua-resty-cookie

### 1 登陆 ###

重定向到目标得机器上。

-- sso地址
    local sso = 'https://sso.teddymobile.net/login'
    
    -- 服务名
    local service = 'http://ci.teddymobile.net'
    
    -- 最终请求地址 https://sso.teddymobile.net/login?service=http://ci.teddymobile.net
    local login_url = sso .. '?service=' ..service 
    
    -- ngx.say("login success");
    
    -- ngx.say(login_url)
    --
    
    --跳转到登陆界面 
    ngx.redirect(login_url)

### 2 获取用户名 ###

require("LuaXML")
 local xml = require "xml" 
 local http = require "resty.http"
 -- 获取请求方式
 local request_method = ngx.var.request_method
 
 -- 获取请求得参数
 local args = ngx.req.get_uri_args()
 
 
 -- 获取ticket
 local function getTicket()
 	-- 判断是否时get请求
 if 'GET' ~= request_method then
 return nil 
 end
 -- 获取返回得参数信息
 local uri_args = ngx.req.get_uri_args() 
 	for k, v in pairs(uri_args) do 
 -- 当时 ticket 得情况
 if k == "ticket" then 
 return v 
 end
 
 	end 
 end 
 
 -- 获取用户名称
 local function getUserName(ticket)
 -- 当ticket 存在得时候，打印ticket信息
 if(ticket) then
 -- 验证路径
 local check_url = 'https://sso.teddymobile.net/serviceValidate?service=http://ci.teddymobile.net&ticket=' .. ticket 
 ngx.say(check_url .. ' ')
 
 -- 建立一个http请求
 local httpc = http.new() 
 
 -- 请求，注意配置 ssl_verify = false 表示不验证证书 
 local resp, err = httpc:request_uri(check_url, { 
 method = "GET", 
 ssl_verify = false,
 headers = { 
 ["User-Agent"] = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36" 
 } 
 }) 
 
 -- 当没有
 if not resp then 
 return nil
 end 
 
 --获取状态码 
 local respXml = nil 
 if(resp.status == 200) then 
 respXml = resp.body
 end 
 
 -- 关闭连接
 httpc:close() 
 
 -- 返回请求信息
 return respXml
 else 
 return nil
 end
 end
 -- 切割函数(split功能)
 -- szFullString 待切割数据
 -- szSeparator 切割判断
 function split(szFullString, szSeparator)
 local nFindStartIndex = 1
 local nSplitIndex = 1
 local nSplitArray = {}
 while true do
 local nFindLastIndex = string.find(szFullString, szSeparator, nFindStartIndex)
 if not nFindLastIndex then
 nSplitArray[nSplitIndex] = string.sub(szFullString, nFindStartIndex, string.len(szFullString))
 break
 end
 nSplitArray[nSplitIndex] = string.sub(szFullString, nFindStartIndex, nFindLastIndex - 1)
 nFindStartIndex = nFindLastIndex + string.len(szSeparator)
 nSplitIndex = nSplitIndex + 1
 end
 return nSplitArray
 end
 
 -- 获取到用户得名称
 function getName(usernameXml)
 	local userInfo = xml.eval(usernameXml)
 	local items = userInfo:find('cas:user')
 	if items ~= nil then
 		local field = items[1]
 
 		ngx.say(field)
 		return field
 else
 return nil 
 	end
 
 end
 
 --获取 ticket
 local ticket = getTicket() 
 
 
 local usernameXml = getUserName(ticket)
 --ngx.say(userInfo:find('cas:user'))
 -- <cas:serviceresponse xmlns:cas="http://www.yale.edu/tp/cas">
 -- <cas:authenticationsuccess>
 -- <cas:user>huangcong</cas:user>
 -- </cas:authenticationsuccess>
 -- </cas:serviceresponse>
 
 
 local username = getName(usernameXml) 
 ngx.say(username)
 -- error
 
 --local list = split(usernameXml, '<cas:user>')
 --for i = 1, #list
 --do
 -- str = string.format("index %d: value = %s", i, list[i]);
 --- ngx.say(str);
 --end

### 3 ticket 多次验证 ###

[CAS之5.2x版本之客户端集成（传统web项目）-yellowcong][CAS_5.2x_web_-yellowcong]  
web.xml中配置了一个org.jasig.cas.client.validation.Cas30ProxyReceivingTicketValidationFilter 这个类，这个类就是做验证ticket的，每次请求都回去获取ticket，然后去验证这个ticket 是否ok

在Java中 AbstractTicketValidationFilter中的 doFilter ，访问地址 https://sso.teddymobile.net/login?service=http://ci.teddymobile.net/ 重复的获取到ticket的值xxxxxx ，然后 再请求 https://sso.teddymobile.net/serviceValidate?service=http://ci.teddymobile.net&ticket=xxxxxx 去校验ticket是否ok.  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70 1]

### 4 解析用户名 ###

https://segmentfault.com/a/1190000008426022

https://blog.csdn.net/yhangleo/article/details/8181811

### 5 session 处理 ###

https://github.com/bungle/lua-resty-session

### 6 单点登出 ###

登出原理  
https://www.cnblogs.com/xiangkejin/archive/2018/04/27/8963089.html

## 7 登陆 ##

### 7 简单登陆案例 -v1 ###

require("LuaXML")
 xml = require "xml"
 local http = require "resty.http"
 
 
 local sso = 'https://sso.teddymobile.net/login'
 local service = 'http://ci.teddymobile.net'
 local session = require "resty.session".open()
 
 
 -- 判断 session 是否存在，存在 就进行读取操作
 if session.present then
 local name = session.data.user
 if (name ~= nil) then
 ngx.say( name .. " user has login ")
 return
 end
 end
 
 --[[
 local name = session.data.user
 if (name ~= nil) then
 ngx.say(name)
 return
 end
 ]]
 
 -- session 信息
 
 --[[
 local user_session = require "resty.session".open()
 local user = user_session.data.user
 if user ~= nil then
 ngx.say(user)
 return
 else
 --ngx.say('not login')
 -- return
 end ]]
 -- 获取请求得url地址
 function getRequestUrl()
 --请求路径,包含参数，不可以修改
 local request_uri = ngx.var.request_uri
 
 -- 请求参数，可以修改
 local uri = ngx.var.uri
 
 -- https http
 local scheme = ngx.var.scheme
 
 -- 服务名称
 local server_addr = ngx.var.server_name
 
 return scheme .. '://' .. server_addr .. request_uri
 
 end
 
 -- 获取请求，没有ticket参数
 function getRequUrlWithoutTicket()
 --请求路径,包含参数，不可以修改
 local request_uri = ngx.var.request_uri
 
 -- 不带参数，可以修改
 local uri = ngx.var.uri
 
 -- https http
 local scheme = ngx.var.scheme
 
 -- 服务名称
 local server_addr = ngx.var.server_name
 
 return scheme .. '://' .. server_addr .. uri
 end
 
 function getTicketParams()
 local uri_args = ngx.req.get_uri_args()
 local reqParam = '';
 for k, v in pairs(uri_args) do
 if k ~= 'ticket' then
 reqParam = reqParam .. k .. '=' .. v .. '&'
 	end
 end
 return reqParam
 end
 
 -- 获取 登陆cas得 请求url
 local function getCasUrl(reqUrl)
 return sso .. '?service=' .. reqUrl
 end
 
 -- 获取ticket
 local function getTicket()
 	-- 获取请求得参数
 local args = ngx.req.get_uri_args()
 
 local request_method = ngx.var.request_method
 
 -- 判断是否时get请求
 if 'GET' ~= request_method then
 return nil
 end
 -- 获取返回得参数信息
 local uri_args = ngx.req.get_uri_args()
 	for k, v in pairs(uri_args) do
 -- 当时 ticket 得情况
 if k == "ticket" then
 return v
 end
 	end
 
 end
 
 -- 获取用户名信息
 local function getUserName(ticket)
 --[[
 if ticket ~= nil then
 local check_url = "https://www.baidu.com"
 -- 建立一个http请求
 local httpc = http.new()
 local resp, err = httpc:request_uri(check_url, { 
 method = "GET",
 ssl_verify = false,
 headers = { 
 ["User-Agent"] = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
 }
 })
 return 'yellowcong'
 end]]
 -- 当ticket 存在得时候，打印ticket信息
 if ticket ~= nil then
 
 local reqUrl = getRequUrlWithoutTicket()
 -- ngx.say 会导致session 获取不到正确的数据
 -- ngx.say(reqUrl)
 --ngx.say(reqUrl .. " ");
 -- 验证路径GG
 --local check_url = 'https://sso.teddymobile.net/serviceValidate?service=http://ci.teddymobile.net&ticket=' .. ticket
 local check_url = 'https://sso.teddymobile.net/serviceValidate?service='.. reqUrl ..'&ticket=' .. ticket
 --ngx.say(check_url .. ' ')
 
 -- 建立一个http请求
 local httpc = http.new()
 
 -- 请求，注意配置 ssl_verify = false 表示不验证证书
 local resp, err = httpc:request_uri(check_url, { 
 method = "GET",
 ssl_verify = false,
 headers = { 
 ["User-Agent"] = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
 }
 })
 
 -- 当没有
 if not resp then
 return nil
 end
 
 --获取状态码
 local respXml = nil
 if(resp.status == 200) then
 respXml = resp.body
 end
 -- ngx.say(respXml)
 -- 关闭连接
 httpc:close()
 
 -- 返回请求信息
 return respXml
 else
 return nil
 end
 end
 
 -- 获取到用户得名称
 function getName(usernameXml)
 --ngx.say(usernameXml)
 local userInfo = xml.eval(usernameXml)
 local items = userInfo:find('cas:user')
 	-- ngx.say(items[1] or 'no data')
 if items ~= nil then
 		local field = items[1]
 
 		--ngx.say(field)
 		return field
 else
 return nil
 	end
 end
 
 -- 从请求中获取ticket
 local ticket = getTicket()
 if ticket == nil then
 -- 获取请求得路径
 local request_url = getRequestUrl()
 
 -- 获取登陆得地址
 local login_url = getCasUrl(request_url)
 
 --ngx.say('no login ' .. login_url)
 ngx.redirect(login_url)
 
 else
 --[[
 if not session.started then
 session:start()
 session.data.user = 'yellowcong'
 session:save()
 end
 ]]
 --[[
 local session = require "resty.session".start()
 session.data.user = 'huangcong'
 session:save()
 ]]
 -- 登陆得用户情况
 --local session = require "resty.session".open{ random = { length = 32 }}
 local usernameXml = getUserName(ticket)
 
 --ngx.say(userInfo:find('cas:user'))
 -- <cas:serviceresponse xmlns:cas="http://www.yale.edu/tp/cas">
 -- <cas:authenticationsuccess>
 -- <cas:user>huangcong</cas:user>
 -- </cas:authenticationsuccess>
 -- </cas:serviceresponse>
 
 local username = getName(usernameXml)
 ngx.log(ngx.ERR, 'cas xml: '.. usernameXml ..'\trequest result: ' .. username)
 
 --ngx.say(usernameXml)
 if username == nil then
 ngx.say('invalid ticket')
 return
 end
 
 --ngx.say(session.started )
 -- ngx.say(session.data.user or 'no user data ')
 -- 判断session 是否开启了
 
 if not session.started then
 session:start()
 session.data.user = username
 session:save()
 ngx.say('save sessioni ' .. username )
 end
 
 --if session.present then
 	 --ngx.print(session.data.uid)
 --ngx.say(' before' .. (session.data.user or 'no data'))
 -- session:start()
 --end
 -- ngx.say(' before' .. (session.data.user or 'no data'))
 -- session info
 --ngx.log(ngx.ERR, "Started -- " .. ngx.encode_base64(session.id))
 --local session = require "resty.session".start()
 --session.data.user = username
 --session.data.age = 12
 --session:save()
 
 --ngx.say(' ' ..( session.data.user or 'no data'))
 -- ngx.say(' ' ..( session.data.age or 'no data'))
 end
 
 
 
 -- ngx.header['Set-Cookie'] = { 'x_webauth_user =yellow' , 'x_webauth_token = test'}

### 7 简单登陆案例 -v2 ###

模块化sso的功能

镜像

#镜像地址
    docker push  registry.cn-beijing.aliyuncs.com/yellowlu/openresty_cas 
    
    #这个例子需要注意的是cas sever名称和server 名称都是写死在nginx.conf的配置文件中的
    #后台启动容器
    docker run -p80:80 -d registry.cn-beijing.aliyuncs.com/yellowlu/openresty_cas

这个是基于lua实现的单点登陆效果  
![在这里插入图片描述][20190504150442798.gif]

### 代码 ###

代码地址  
https://gitee.com/yellowcong/cas\_prod/tree/master/nginx/lua  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70 2]

## 常见问题 ##

### 1. module ‘resty.http’ not found: ###

导致这个问题得原因时导入得http模块得目录不正确，把依赖都丢到 /usr/local/openresty/nginx/lua/lib/resty/ 这个目录即可。

/usr/local/openresty/nginx/lua/login_filter.lua: in function </usr/local/openresty/nginx/lua/login_filter.lua:1>, client: 192.168.156.52, server: localhost, request: "GET /?ticket=ST-2687-cdI8iz0M3cgOqmZz8iL0dv7LUUo-gerrit HTTP/1.1", host: "ci.teddymobile.net"
 2019/04/29 16:57:31 [error] 9117#0: *124 lua entry thread aborted: runtime error: /usr/local/openresty/nginx/lua/login_filter.lua:1: module 'resty.http' not found:
 	no field package.preload['resty.http']
 	no file '/usr/local/openresty/nginx/lua/lib/resty/http.lua'
 	no file '/usr/local/openresty/site/lualib/resty/http.ljbc'
 	no file '/usr/local/openresty/site/lualib/resty/http/init.ljbc'
 	no file '/usr/local/openresty/lualib/resty/http.ljbc'
 	no file '/usr/local/openresty/lualib/resty/http/init.ljbc'
 	no file '/usr/local/openresty/site/lualib/resty/http.lua'
 	no file '/usr/local/openresty/site/lualib/resty/http/init.lua'
 	no file '/usr/local/openresty/lualib/resty/http.lua'
 	no file '/usr/local/openresty/lualib/resty/http/init.lua'
 	no file './resty/http.lua'
 	no file '/usr/local/openresty/luajit/share/luajit-2.1.0-beta3/resty/http.lua'
 	no file '/usr/local/share/lua/5.1/resty/http.lua'
 	no file '/usr/local/share/lua/5.1/resty/http/init.lua'
 	no file '/usr/local/openresty/luajit/share/lua/5.1/resty/http.lua'
 	no file '/usr/local/openresty/luajit/share/lua/5.1/resty/http/init.lua'
 	no file '/usr/local/openresty/site/lualib/resty/http.so'
 	no file '/usr/local/openresty/lualib/resty/http.so'

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70 3]  
多谢大神得文章 https://www.jianshu.com/p/9e6a397e7941

## 参考文章 ##

https://www.annhe.net/article-3551.html

[Nginx_openresty_-yellowcong]: https://blog.csdn.net/yelllowcong/article/details/84979000
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70]: /images/20220214/dd535ab9601d48658ead1390bdd9049d.png
[2019042917014479.png]: /images/20220214/a074d329da3b433fa3af88ca5d479a6d.png
[CAS_5.2x_web_-yellowcong]: https://blog.csdn.net/yelllowcong/article/details/79241772
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70 1]: /images/20220214/ad9c1b01e9a14fdeaca1121de2fab18a.png
[20190504150442798.gif]: /images/20220214/564bef1ef50745c4a748a632ada83e66.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70 2]: /images/20220214/ad9cf540b75f41baaf2002bd2248f7d9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70 3]: /images/20220214/19f6ef92c9b7483b83e3af0df111ecb9.png