CAS Most SSOs now use CAS solutions. You can research it.
SSO flow chart SSO uses cookie 来实现的。简单来说就是登录之后将认证信息存放在 cookie 中。当有app请求时可以先在自己的应用中校验是否登录。如果未登录将跳转至认证系统,此时认证系统检测cookieinformation. If there is login information, jump back to the request system.
Thanks to @kevinz for his advice, here’s how I do it now:
Each APP uses Tomcat JDBCRealm for authentication (Authentication), but uses Spring Security for authorization. Both are based on the same user information database.
Open SSO in Tomcat -- this is very important, otherwise when accessing other webapps in the same domain, cookies will not be brought and authentication will not be possible
In each webapp, configure Web.xml to use Tomcat for authentication -- if Spring is used for authentication, Tomcat's SSO will not work
In each webapp, configure spring and use J2eePreAuthenticatedProcessingFilter for permission control (Authorization)
CAS Most SSOs now use CAS solutions. You can research it.
SSO flow chart
SSO uses
cookie
来实现的。简单来说就是登录之后将认证信息存放在cookie
中。当有app
请求时可以先在自己的应用中校验是否登录。如果未登录将跳转至认证系统,此时认证系统检测cookie
information. If there is login information, jump back to the request system.Thanks to @kevinz for his advice, here’s how I do it now:
Each APP uses Tomcat JDBCRealm for authentication (Authentication), but uses Spring Security for authorization. Both are based on the same user information database.
Open SSO in Tomcat -- this is very important, otherwise when accessing other webapps in the same domain, cookies will not be brought and authentication will not be possible
In each webapp, configure Web.xml to use Tomcat for authentication -- if Spring is used for authentication, Tomcat's SSO will not work
In each webapp, configure spring and use J2eePreAuthenticatedProcessingFilter for permission control (Authorization)
Configuration in spring.xml