import org.jasig.cas.util.ApplicationContextProvider; //导入依赖的package包/类
@Before
public void setUp() throws Exception {
    request.addParameter("openid.identity", "http://openid.ja-sig.org/battags");
    request.addParameter("openid.return_to", "http://www.ja-sig.org/?service=fa");
    request.addParameter("openid.mode", "checkid_setup");
    sharedAssociations = mock(ServerAssociationStore.class);
    manager = new ServerManager();
    manager.setOPEndpointUrl("https://localshot:8443/cas/login");
    manager.setEnforceRpId(false);
    manager.setSharedAssociations(sharedAssociations);
    context = mock(ApplicationContext.class);
    cas = mock(CentralAuthenticationService.class);

    when(context.getBean("serverManager")).thenReturn(manager);
    when(context.getBean("centralAuthenticationService", CentralAuthenticationService.class)).thenReturn(cas);

    final ApplicationContextProvider contextProvider = new ApplicationContextProvider();
    contextProvider.setApplicationContext(context);
}
 

import org.jasig.cas.util.ApplicationContextProvider; //导入依赖的package包/类
private IPersonAttributeDao getAttributeRepository() {
    if (this.attributeRepository == null) {
        final ApplicationContext context = ApplicationContextProvider.getApplicationContext();
        if (context != null) {
            return context.getBean("attributeRepository", IPersonAttributeDao.class);
        } else {
            LOGGER.warn("No application context could be retrieved, so no attribute repository instance can be determined.");
        }
    }
    return this.attributeRepository;
}
 

import org.jasig.cas.util.ApplicationContextProvider; //导入依赖的package包/类
/**
 * Gets principal attributes. Will attempt to locate the principal
 * attribute repository from the context if one is defined to use
 * that instance to locate attributes. If none is available,
 * will use the default principal attributes.
 *
 * @param p       the principal
 * @param service the service
 * @return the principal attributes
 */
protected Map<String, Object> getPrincipalAttributes(final Principal p, final Service service) {
    final ApplicationContext context = ApplicationContextProvider.getApplicationContext();
    if (context != null) {
        LOGGER.debug("Located application context to locate the service registry entry");
        final ReloadableServicesManager servicesManager = context.getBean(ReloadableServicesManager.class);
        if (servicesManager != null) {
            final RegisteredService registeredService = servicesManager.findServiceBy(service);

            if (registeredService != null && registeredService.getAccessStrategy().isServiceAccessAllowed()) {
                LOGGER.debug("Located service {} in the registry. Attempting to resolve attributes for {}",
                        service.getId(), p.getId());

                if (registeredService.getAttributeReleasePolicy() == null) {
                    LOGGER.debug("No attribute release policy is defined for {}. Returning default principal attributes",
                            service.getId());
                    return p.getAttributes();
                }
                return registeredService.getAttributeReleasePolicy().getAttributes(p);
            }
        }

        LOGGER.debug("Could not locate service {} in the registry.", service.getId());
        throw new UnauthorizedServiceException(UnauthorizedServiceException.CODE_UNAUTHZ_SERVICE);
    }
    LOGGER.warn("No application context could be detected. Returning default principal attributes");
    return p.getAttributes();
}
 

import org.jasig.cas.util.ApplicationContextProvider; //导入依赖的package包/类
@Before
public void setUp() throws Exception {
    request.addParameter("openid.identity", "http://openid.ja-sig.org/battags");
    request.addParameter("openid.return_to", "http://www.ja-sig.org/?service=fa");
    request.addParameter("openid.mode", "checkid_setup");
    sharedAssociations = mock(ServerAssociationStore.class);
    manager = new ServerManager();
    manager.setOPEndpointUrl("https://localshot:8443/cas/login");
    manager.setEnforceRpId(false);
    manager.setSharedAssociations(sharedAssociations);
    context = mock(ApplicationContext.class);
    ApplicationContextProvider contextProvider = new ApplicationContextProvider();
    contextProvider.setApplicationContext(context);
    cas = mock(CentralAuthenticationService.class);
}
 

import org.jasig.cas.util.ApplicationContextProvider; //导入依赖的package包/类
private IPersonAttributeDao getAttributeRepository() {
    if (this.attributeRepository == null) {
        final ApplicationContext context = ApplicationContextProvider.getApplicationContext();
        if (context != null) {
            return context.getBean("attributeRepository", IPersonAttributeDao.class);
        } else {
            logger.warn("No application context could be retrieved, so no attribute repository instance can be determined.");
        }
    }
    return this.attributeRepository;
}
 

import org.jasig.cas.util.ApplicationContextProvider; //导入依赖的package包/类
/**
 * Gets principal attributes. Will attempt to locate the principal
 * attribute repository from the context if one is defined to use
 * that instance to locate attributes. If none is available,
 * will use the default principal attributes.
 *
 * @param p       the principal
 * @param service the service
 * @return the principal attributes
 */
protected Map<String, Object> getPrincipalAttributes(final Principal p, final Service service) {
    final ApplicationContext context = ApplicationContextProvider.getApplicationContext();
    if (context != null) {
        logger.debug("Located application context to locate the service registry entry");
        final ReloadableServicesManager servicesManager = context.getBean(ReloadableServicesManager.class);
        if (servicesManager != null) {
            final RegisteredService registeredService = servicesManager.findServiceBy(service);

            if (registeredService != null && registeredService.getAccessStrategy().isServiceAccessAllowed()) {
                logger.debug("Located service {} in the registry. Attempting to resolve attributes for {}",
                        service.getId(), p.getId());

                if (registeredService.getAttributeReleasePolicy() == null) {
                    logger.debug("No attribute release policy is defined for {}. Returning default principal attributes",
                            service.getId());
                    return p.getAttributes();
                }
                return registeredService.getAttributeReleasePolicy().getAttributes(p);
            }
        }

        logger.debug("Could not locate service {} in the registry.", service.getId());
        throw new UnauthorizedServiceException(UnauthorizedServiceException.CODE_UNAUTHZ_SERVICE);
    }
    logger.warn("No application context could be detected. Returning default principal attributes");
    return p.getAttributes();
}
 

import org.jasig.cas.util.ApplicationContextProvider; //导入依赖的package包/类
/**
 * Construct SAML response.
 * <a href="http://bit.ly/1uI8Ggu">See this reference for more info.</a>
 * @return the SAML response
 */
private String constructSamlResponse() {
    final DateTime currentDateTime = new DateTime();
    final DateTime notBeforeIssueInstant = DateTime.parse("2003-04-17T00:46:02Z");

    final ApplicationContext context = ApplicationContextProvider.getApplicationContext();
    final ServicesManager servicesManager = context.getBean("servicesManager", ServicesManager.class);
    final RegisteredService svc = servicesManager.findServiceBy(this);
    final String userId = svc.getUsernameAttributeProvider().resolveUsername(getPrincipal(), this);

    final org.opensaml.saml.saml2.core.Response response = BUILDER.newResponse(
            BUILDER.generateSecureRandomId(),
            currentDateTime,
            getId(), this);
    response.setStatus(BUILDER.newStatus(StatusCode.SUCCESS, null));

    final AuthnStatement authnStatement = BUILDER.newAuthnStatement(
            AuthnContext.PASSWORD_AUTHN_CTX, currentDateTime);
    final Assertion assertion = BUILDER.newAssertion(authnStatement,
            "https://www.opensaml.org/IDP",
            notBeforeIssueInstant, BUILDER.generateSecureRandomId());

    final Conditions conditions = BUILDER.newConditions(notBeforeIssueInstant,
            currentDateTime.plusSeconds(this.skewAllowance), getId());
    assertion.setConditions(conditions);

    final Subject subject = BUILDER.newSubject(NameID.EMAIL, userId,
            getId(), currentDateTime.plusSeconds(this.skewAllowance), this.requestId);
    assertion.setSubject(subject);

    response.getAssertions().add(assertion);

    final StringWriter writer = new StringWriter();
    BUILDER.marshalSamlXmlObject(response, writer);

    final String result = writer.toString();
    logger.debug("Generated Google SAML response: {}", result);
    return result;
}
 

import org.jasig.cas.util.ApplicationContextProvider; //导入依赖的package包/类
/**
 * Construct SAML response.
 * <a href="http://bit.ly/1uI8Ggu">See this reference for more info.</a>
 * @param service the service
 * @return the SAML response
 */
protected String constructSamlResponse(final GoogleAccountsService service) {
    final DateTime currentDateTime = new DateTime();
    final DateTime notBeforeIssueInstant = DateTime.parse("2003-04-17T00:46:02Z");

    /*
     * Must be looked up directly from the context
     * because the services manager is not serializable
     * and cannot be class field.
     */
    final ApplicationContext context = ApplicationContextProvider.getApplicationContext();
    final ServicesManager servicesManager = context.getBean("servicesManager", ServicesManager.class);
    final RegisteredService registeredService = servicesManager.findServiceBy(service);
    if (registeredService == null || !registeredService.getAccessStrategy().isServiceAccessAllowed()) {
        throw new UnauthorizedServiceException(UnauthorizedServiceException.CODE_UNAUTHZ_SERVICE);
    }
    final String userId = registeredService.getUsernameAttributeProvider()
                .resolveUsername(service.getPrincipal(), service);

    final org.opensaml.saml.saml2.core.Response response = samlObjectBuilder.newResponse(
        samlObjectBuilder.generateSecureRandomId(), currentDateTime, service.getId(), service);
    response.setStatus(samlObjectBuilder.newStatus(StatusCode.SUCCESS, null));

    final AuthnStatement authnStatement = samlObjectBuilder.newAuthnStatement(
        AuthnContext.PASSWORD_AUTHN_CTX, currentDateTime);
    final Assertion assertion = samlObjectBuilder.newAssertion(authnStatement,
        "https://www.opensaml.org/IDP",
        notBeforeIssueInstant, samlObjectBuilder.generateSecureRandomId());

    final Conditions conditions = samlObjectBuilder.newConditions(notBeforeIssueInstant,
            currentDateTime.plusSeconds(this.skewAllowance), service.getId());
    assertion.setConditions(conditions);

    final Subject subject = samlObjectBuilder.newSubject(NameID.EMAIL, userId,
        service.getId(), currentDateTime.plusSeconds(this.skewAllowance), service.getRequestId());
    assertion.setSubject(subject);

    response.getAssertions().add(assertion);

    final StringWriter writer = new StringWriter();
    samlObjectBuilder.marshalSamlXmlObject(response, writer);

    final String result = writer.toString();
    LOGGER.debug("Generated Google SAML response: {}", result);
    return result;
}
 

import org.jasig.cas.util.ApplicationContextProvider; //导入依赖的package包/类
/**
 * Generates an Openid response.
 * If no ticketId is found, response is negative.
 * If we have a ticket id, then we check if we have an association.
 * If so, we ask OpenId server manager to generate the answer according with the existing association.
 * If not, we send back an answer with the ticket id as association handle.
 * This will force the consumer to ask a verification, which will validate the service ticket.
 *
 * @param ticketId the service ticket to provide to the service.
 * @param webApplicationService web application service
 * @return the generated authentication answer
 */
@Override
public Response build(final WebApplicationService webApplicationService, final String ticketId) {
    final ServerManager serverManager = ApplicationContextProvider.getApplicationContext()
            .getBean("serverManager", ServerManager.class);
    final CentralAuthenticationService centralAuthenticationService = ApplicationContextProvider
            .getApplicationContext().getBean("centralAuthenticationService",
            CentralAuthenticationService.class);

    final OpenIdService service = (OpenIdService) webApplicationService;

    final Map<String, String> parameters = new HashMap<>();

    if (StringUtils.isBlank(ticketId)) {
        parameters.put(OpenIdProtocolConstants.OPENID_MODE, OpenIdProtocolConstants.CANCEL);
        return buildRedirect(service, parameters);
    }

    final Association association = getAssociation(serverManager);
    final boolean associated = association != null;
    final boolean associationValid = isAssociationValid(association);
    boolean successFullAuthentication = true;

    Assertion assertion = null;
    try {
        if (associated && associationValid) {
            assertion = centralAuthenticationService.validateServiceTicket(ticketId, service);
            LOGGER.debug("Validated openid ticket {} for {}", ticketId, service);
        } else {
            LOGGER.warn("Association does not exist or is not valid");
            successFullAuthentication = false;
        }
    } catch (final AbstractTicketException te) {
        LOGGER.error("Could not validate ticket : {}", te.getMessage(), te);
        successFullAuthentication = false;
    }

    final String id = determineIdentity(service, assertion);

    return buildAuthenticationResponse(serverManager, ticketId, service, parameters, associated,
        successFullAuthentication, id);
}
 

import org.jasig.cas.util.ApplicationContextProvider; //导入依赖的package包/类
/**
 * Generates an Openid response.
 * If no ticketId is found, response is negative.
 * If we have a ticket id, then we check if we have an association.
 * If so, we ask OpenId server manager to generate the answer according with the existing association.
 * If not, we send back an answer with the ticket id as association handle.
 * This will force the consumer to ask a verification, which will validate the service ticket.
 * @param ticketId the service ticket to provide to the service.
 * @return the generated authentication answer
 */
@Override
public Response getResponse(final String ticketId) {
    final Map<String, String> parameters = new HashMap<>();
    if (ticketId != null) {

        final ServerManager manager = (ServerManager) ApplicationContextProvider.getApplicationContext().getBean("serverManager");
        final CentralAuthenticationService cas = ApplicationContextProvider.getApplicationContext()
                                            .getBean("centralAuthenticationService", CentralAuthenticationService.class);
        boolean associated = false;
        boolean associationValid = true;
        try {
            final AuthRequest authReq = AuthRequest.createAuthRequest(requestParameters, manager.getRealmVerifier());
            final Map parameterMap = authReq.getParameterMap();
            if (parameterMap != null && parameterMap.size() > 0) {
                final String assocHandle = (String) parameterMap.get(OpenIdConstants.OPENID_ASSOCHANDLE);
                if (assocHandle != null) {
                    final Association association = manager.getSharedAssociations().load(assocHandle);
                    if (association != null) {
                        associated = true;
                        if (association.hasExpired()) {
                            associationValid = false;
                        }
                    }

                }
            }
        } catch (final MessageException me) {
            LOGGER.error("Message exception : {}", me.getMessage(), me);
        }

        boolean successFullAuthentication = true;
        Assertion assertion = null;
        try {
            if (associated) {
                if (associationValid) {
                    assertion = cas.validateServiceTicket(ticketId, this);
                    LOGGER.info("Validated openid ticket");
                } else {
                    successFullAuthentication = false;
                }
            }
        } catch (final TicketException te) {
            LOGGER.error("Could not validate ticket : {}", te.getMessage(), te);
            successFullAuthentication = false;
        }

        final String id;
        if (assertion != null && OpenIdConstants.OPENID_IDENTIFIERSELECT.equals(this.identity)) {
            id = this.openIdPrefixUrl + '/' + assertion.getPrimaryAuthentication().getPrincipal().getId();
        } else {
            id = this.identity;
        }
        // We sign directly (final 'true') because we don't add extensions
        // response message can be either a DirectError or an AuthSuccess here.
        // Anyway, handling is the same : send the response message
        final Message response = manager.authResponse(requestParameters,
                id,
                id,
                successFullAuthentication,
                true);
        parameters.putAll(response.getParameterMap());
        if (!associated) {
            parameters.put(OpenIdConstants.OPENID_ASSOCHANDLE, ticketId);
        }
    } else {
        parameters.put(OpenIdConstants.OPENID_MODE, OpenIdConstants.CANCEL);
    }
    return DefaultResponse.getRedirectResponse(getOriginalUrl(), parameters);
}
 

import org.jasig.cas.util.ApplicationContextProvider; //导入依赖的package包/类
/**
 * Generates an Openid response.
 * If no ticketId is found, response is negative.
 * If we have a ticket id, then we check if we have an association.
 * If so, we ask OpenId server manager to generate the answer according with the existing association.
 * If not, we send back an answer with the ticket id as association handle.
 * This will force the consumer to ask a verification, which will validate the service ticket.
 * @param ticketId the service ticket to provide to the service.
 * @return the generated authentication answer
 */
@Override
public Response getResponse(final String ticketId) {
    final Map<String, String> parameters = new HashMap<String, String>();
    if (ticketId != null) {

        ServerManager manager = (ServerManager) ApplicationContextProvider.getApplicationContext().getBean("serverManager");
        CentralAuthenticationService cas = (CentralAuthenticationService) ApplicationContextProvider.getApplicationContext()
                                            .getBean("centralAuthenticationService");
        boolean associated = false;
        boolean associationValid = true;
        try {
            AuthRequest authReq = AuthRequest.createAuthRequest(requestParameters, manager.getRealmVerifier());
            Map parameterMap = authReq.getParameterMap();
            if (parameterMap != null && parameterMap.size() > 0) {
                String assocHandle = (String) parameterMap.get("openid.assoc_handle");
                if (assocHandle != null) {
                    Association association = manager.getSharedAssociations().load(assocHandle);
                    if (association != null) {
                        associated = true;
                        if (association.hasExpired()) {
                            associationValid = false;
                        }
                    }

                }
            }
        } catch (final MessageException me) {
            LOGGER.error("Message exception : {}", me.getMessage(), me);
        }

        boolean successFullAuthentication = true;
        try {
            if (associated) {
                if (associationValid) {
                    cas.validateServiceTicket(ticketId, this);
                    LOGGER.info("Validated openid ticket");
                } else {
                    successFullAuthentication = false;
                }
            }
        } catch (final TicketException te) {
            LOGGER.error("Could not validate ticket : {}", te.getMessage(), te);
            successFullAuthentication = false;
        }

        // We sign directly (final 'true') because we don't add extensions
        // response message can be either a DirectError or an AuthSuccess here.
        // Anyway, handling is the same : send the response message
        Message response = manager.authResponse(requestParameters,
                this.identity,
                this.identity,
                successFullAuthentication,
                true);
        parameters.putAll(response.getParameterMap());
        if (!associated) {
            parameters.put("openid.assoc_handle", ticketId);
        }
    } else {
        parameters.put("openid.mode", "cancel");
    }
    return Response.getRedirectResponse(getOriginalUrl(), parameters);
}
 

import org.jasig.cas.util.ApplicationContextProvider; //导入依赖的package包/类
/**
 * Construct SAML response.
 * <a href="http://bit.ly/1uI8Ggu">See this reference for more info.</a>
 * @param service the service
 * @return the SAML response
 */
protected String constructSamlResponse(final GoogleAccountsService service) {
    final DateTime currentDateTime = new DateTime();
    final DateTime notBeforeIssueInstant = DateTime.parse("2003-04-17T00:46:02Z");

    /*
     * Must be looked up directly from the context
     * because the services manager is not serializable
     * and cannot be class field.
     */
    final ApplicationContext context = ApplicationContextProvider.getApplicationContext();
    final ServicesManager servicesManager = context.getBean("servicesManager", ServicesManager.class);
    final RegisteredService registeredService = servicesManager.findServiceBy(service);
    if (registeredService == null || !registeredService.getAccessStrategy().isServiceAccessAllowed()) {
        throw new UnauthorizedServiceException(UnauthorizedServiceException.CODE_UNAUTHZ_SERVICE);
    }
    final String userId = registeredService.getUsernameAttributeProvider()
                .resolveUsername(service.getPrincipal(), service);

    final org.opensaml.saml.saml2.core.Response response = samlObjectBuilder.newResponse(
        samlObjectBuilder.generateSecureRandomId(), currentDateTime, service.getId(), service);
    response.setStatus(samlObjectBuilder.newStatus(StatusCode.SUCCESS, null));

    final AuthnStatement authnStatement = samlObjectBuilder.newAuthnStatement(
        AuthnContext.PASSWORD_AUTHN_CTX, currentDateTime);
    final Assertion assertion = samlObjectBuilder.newAssertion(authnStatement,
        "https://www.opensaml.org/IDP",
        notBeforeIssueInstant, samlObjectBuilder.generateSecureRandomId());

    final Conditions conditions = samlObjectBuilder.newConditions(notBeforeIssueInstant,
            currentDateTime.plusSeconds(this.skewAllowance), service.getId());
    assertion.setConditions(conditions);

    final Subject subject = samlObjectBuilder.newSubject(NameID.EMAIL, userId,
        service.getId(), currentDateTime.plusSeconds(this.skewAllowance), service.getRequestId());
    assertion.setSubject(subject);

    response.getAssertions().add(assertion);

    final StringWriter writer = new StringWriter();
    samlObjectBuilder.marshalSamlXmlObject(response, writer);

    final String result = writer.toString();
    logger.debug("Generated Google SAML response: {}", result);
    return result;
}
 

import org.jasig.cas.util.ApplicationContextProvider; //导入依赖的package包/类
/**
 * Generates an Openid response.
 * If no ticketId is found, response is negative.
 * If we have a ticket id, then we check if we have an association.
 * If so, we ask OpenId server manager to generate the answer according with the existing association.
 * If not, we send back an answer with the ticket id as association handle.
 * This will force the consumer to ask a verification, which will validate the service ticket.
 *
 * @param ticketId the service ticket to provide to the service.
 * @param webApplicationService web application service
 * @return the generated authentication answer
 */
@Override
public Response build(final WebApplicationService webApplicationService, final String ticketId) {
    final ServerManager serverManager = ApplicationContextProvider.getApplicationContext()
            .getBean("serverManager", ServerManager.class);
    final CentralAuthenticationService centralAuthenticationService = ApplicationContextProvider
            .getApplicationContext().getBean("centralAuthenticationService",
            CentralAuthenticationService.class);

    final OpenIdService service = (OpenIdService) webApplicationService;

    final Map<String, String> parameters = new HashMap<>();

    if (StringUtils.isBlank(ticketId)) {
        parameters.put(OpenIdProtocolConstants.OPENID_MODE, OpenIdProtocolConstants.CANCEL);
        return buildRedirect(service, parameters);
    }

    final Association association = getAssociation(serverManager);
    final boolean associated = association != null;
    final boolean associationValid = isAssociationValid(association);
    boolean successFullAuthentication = true;

    Assertion assertion = null;
    try {
        if (associated && associationValid) {
            assertion = centralAuthenticationService.validateServiceTicket(ticketId, service);
            logger.debug("Validated openid ticket {} for {}", ticketId, service);
        } else {
            logger.warn("Association does not exist or is not valid");
            successFullAuthentication = false;
        }
    } catch (final AbstractTicketException te) {
        logger.error("Could not validate ticket : {}", te.getMessage(), te);
        successFullAuthentication = false;
    }

    final String id = determineIdentity(service, assertion);

    return buildAuthenticationResponse(serverManager, ticketId, service, parameters, associated,
        successFullAuthentication, id);
}