import org.jasig.cas.services.UnauthorizedSsoServiceException; //导入依赖的package包/类
@Test(expected=UnauthorizedSsoServiceException.class)
public void verifyGrantServiceTicketWithNoCredsAndSsoFalseAndSsoFalse() throws Exception {
    final Service svc = getService("TestSsoFalse");
    final AuthenticationContext ctx = TestUtils.getAuthenticationContext(getAuthenticationSystemSupport(), svc);
    
    final TicketGrantingTicket ticketGrantingTicket = getCentralAuthenticationService().createTicketGrantingTicket(ctx);
    final Service service = getService("eduPersonTest");
    getCentralAuthenticationService().grantServiceTicket(ticketGrantingTicket.getId(), service, ctx);

    getCentralAuthenticationService().grantServiceTicket(ticketGrantingTicket.getId(), svc, ctx);
}
 

import org.jasig.cas.services.UnauthorizedSsoServiceException; //导入依赖的package包/类
@Test(expected= UnauthorizedSsoServiceException.class)
public void verifyGrantServiceTicketWithNoCredsAndSsoFalse() throws Exception {
    final UsernamePasswordCredential cred =  TestUtils.getCredentialsWithSameUsernameAndPassword();
    final TicketGrantingTicket ticketGrantingTicket = getCentralAuthenticationService().createTicketGrantingTicket(cred);

    final Service svc = TestUtils.getService("TestSsoFalse");
    getCentralAuthenticationService().grantServiceTicket(ticketGrantingTicket.getId(), svc, null);
}
 

import org.jasig.cas.services.UnauthorizedSsoServiceException; //导入依赖的package包/类
@Test(expected=UnauthorizedSsoServiceException.class)
public void verifyGrantServiceTicketWithNoCredsAndSsoFalseAndTgtUsed() throws Exception {
    final UsernamePasswordCredential cred =  TestUtils.getCredentialsWithSameUsernameAndPassword();
    final TicketGrantingTicket ticketGrantingTicket = getCentralAuthenticationService().createTicketGrantingTicket(cred);
    
    final Service service = TestUtils.getService("eduPersonTest");
    getCentralAuthenticationService().grantServiceTicket(ticketGrantingTicket.getId(), service);
    final Service svc = TestUtils.getService("TestSsoFalse");
    assertNotNull(getCentralAuthenticationService().grantServiceTicket(ticketGrantingTicket.getId(), svc, null));
}
 

import org.jasig.cas.services.UnauthorizedSsoServiceException; //导入依赖的package包/类
@Audit(
    action="SERVICE_TICKET",
    actionResolverName="GRANT_SERVICE_TICKET_RESOLVER",
    resourceResolverName="GRANT_SERVICE_TICKET_RESOURCE_RESOLVER")
@Timed(name="GRANT_SERVICE_TICKET_TIMER")
@Metered(name="GRANT_SERVICE_TICKET_METER")
@Counted(name="GRANT_SERVICE_TICKET_COUNTER", monotonic=true)
@Override
public ServiceTicket grantServiceTicket(
        final String ticketGrantingTicketId,
        final Service service, final AuthenticationContext context)
        throws AuthenticationException, AbstractTicketException {

    final TicketGrantingTicket ticketGrantingTicket = getTicket(ticketGrantingTicketId, TicketGrantingTicket.class);
    final RegisteredService registeredService = this.servicesManager.findServiceBy(service);

    verifyRegisteredServiceProperties(registeredService, service);
    final Authentication currentAuthentication = evaluatePossibilityOfMixedPrincipals(context, ticketGrantingTicket);
    
    if (ticketGrantingTicket.getCountOfUses() > 0 && !registeredService.getAccessStrategy().isServiceAccessAllowedForSso()) {
        logger.warn("Service [{}] is not allowed to use SSO.", service.getId());
        throw new UnauthorizedSsoServiceException();
    }

    evaluateProxiedServiceIfNeeded(service, ticketGrantingTicket, registeredService);

    // Perform security policy check by getting the authentication that satisfies the configured policy
    // This throws if no suitable policy is found
    getAuthenticationSatisfiedByPolicy(ticketGrantingTicket.getRoot(), new ServiceContext(service, registeredService));

    final List<Authentication> authentications = ticketGrantingTicket.getChainedAuthentications();
    final Principal principal = authentications.get(authentications.size() - 1).getPrincipal();

    final RegisteredServiceAttributeReleasePolicy releasePolicy = registeredService.getAttributeReleasePolicy();
    final Map<String, Object> principalAttrs;
    if (releasePolicy != null) {
        principalAttrs = releasePolicy.getAttributes(principal);
    } else {
        principalAttrs = new HashMap<>();
    }

    if (!registeredService.getAccessStrategy().doPrincipalAttributesAllowServiceAccess(principal.getId(), principalAttrs)) {
        logger.warn("Cannot grant service ticket because Service [{}] is not authorized for use by [{}].",
                service.getId(), principal);
        throw new UnauthorizedServiceForPrincipalException();
    }

    final ServiceTicketFactory factory = this.ticketFactory.get(ServiceTicket.class);
    final ServiceTicket serviceTicket = factory.create(ticketGrantingTicket, service, currentAuthentication != null);
    this.ticketRegistry.addTicket(serviceTicket);

    logger.info("Granted ticket [{}] for service [{}] and principal [{}]",
            serviceTicket.getId(), service.getId(), principal.getId());

    doPublishEvent(new CasServiceTicketGrantedEvent(this, ticketGrantingTicket, serviceTicket));

    return serviceTicket;
}
 

import org.jasig.cas.services.UnauthorizedSsoServiceException; //导入依赖的package包/类
@Audit(
        action="PROXY_TICKET",
        actionResolverName="GRANT_PROXY_TICKET_RESOLVER",
        resourceResolverName="GRANT_PROXY_TICKET_RESOURCE_RESOLVER")
@Timed(name="GRANT_PROXY_TICKET_TIMER")
@Metered(name="GRANT_PROXY_TICKET_METER")
@Counted(name="GRANT_PROXY_TICKET_COUNTER", monotonic=true)
@Override
public ProxyTicket grantProxyTicket(final String proxyGrantingTicket, final Service service)
        throws AbstractTicketException {

    final ProxyGrantingTicket proxyGrantingTicketObject = getTicket(proxyGrantingTicket, ProxyGrantingTicket.class);
    final RegisteredService registeredService = this.servicesManager.findServiceBy(service);

    verifyRegisteredServiceProperties(registeredService, service);

    if (!registeredService.getAccessStrategy().isServiceAccessAllowedForSso()) {
        logger.warn("Service [{}] is not allowed to use SSO.", service.getId());
        throw new UnauthorizedSsoServiceException();
    }

    evaluateProxiedServiceIfNeeded(service, proxyGrantingTicketObject, registeredService);

    // Perform security policy check by getting the authentication that satisfies the configured policy
    // This throws if no suitable policy is found
    getAuthenticationSatisfiedByPolicy(proxyGrantingTicketObject.getRoot(), new ServiceContext(service, registeredService));

    final List<Authentication> authentications = proxyGrantingTicketObject.getChainedAuthentications();
    final Principal principal = authentications.get(authentications.size() - 1).getPrincipal();

    final RegisteredServiceAttributeReleasePolicy releasePolicy = registeredService.getAttributeReleasePolicy();
    final Map<String, Object> principalAttrs;
    if (releasePolicy != null) {
        principalAttrs = releasePolicy.getAttributes(principal);
    } else {
        principalAttrs = new HashMap<>();
    }

    if (!registeredService.getAccessStrategy().doPrincipalAttributesAllowServiceAccess(principal.getId(), principalAttrs)) {
        logger.warn("Cannot grant proxy ticket because Service [{}] is not authorized for use by [{}].",
                service.getId(), principal);
        throw new UnauthorizedServiceForPrincipalException();
    }

    final ProxyTicketFactory factory = this.ticketFactory.get(ProxyTicket.class);
    final ProxyTicket proxyTicket = factory.create(proxyGrantingTicketObject, service);
    this.ticketRegistry.addTicket(proxyTicket);

    logger.info("Granted ticket [{}] for service [{}] for user [{}]",
            proxyTicket.getId(), service.getId(), principal.getId());

    doPublishEvent(new CasProxyTicketGrantedEvent(this, proxyGrantingTicketObject, proxyTicket));
    return proxyTicket;
}