tomcat - AWS 上的 CAS 4 集群 : Ticket not recognized

标签 tomcat amazon-web-services load-balancing cas session-replication

我正在尝试配置 CAS (4.1) 以在 amazon aws 内的集群环境中工作。 我已经为集群配置了 Tomcat 7，但是在 aws 上你不能使用多播自动发现，所以我在 tomcat 上下文中设置了数据库 session 复制。 session 复制似乎运行良好(同一集群内的其他应用程序正确使用它):

<Context path="cas" crossContext="true">
        <Manager className="org.apache.catalina.session.PersistentManager" distributable="true"  processExpiresFrequency="3" maxIdleBackup="1" >
               <Store className="org.apache.catalina.session.JDBCStore"
               driverName="org.postgresql.Driver"
               connectionURL="jdbc:postgresql://*****:5432/****"
               connectionName="*****" connectionPassword="*****"
               sessionAppCol="app_name" sessionDataCol="session_data" sessionIdCol="session_id"
               sessionLastAccessedCol="last_access" sessionMaxInactiveCol="max_inactive"
               sessionTable="persistent_sessions" sessionValidCol="valid_session" />
       </Manager>
</Context>

接下来，我在 cas 配置上配置了 jpaTicketRegistry 和 uniqueGenerators，如 cas 配置指南中所述:

<bean id="cleanerLock"
    class="org.jasig.cas.ticket.registry.support.JpaLockingStrategy"
    p:uniqueId="${host.name}" p:applicationId="cas-ticket-registry-cleaner" />

<bean id="jobDetailTicketRegistryCleaner"
    class="org.springframework.scheduling.quartz.MethodInvokingJobDetailFactoryBean"
    p:targetObject-ref="ticketRegistryCleaner" p:targetMethod="clean" />

<bean id="triggerJobDetailTicketRegistryCleaner"
    class="org.springframework.scheduling.quartz.SimpleTriggerFactoryBean"
    p:jobDetail-ref="jobDetailTicketRegistryCleaner" p:startDelay="20000"
    p:repeatInterval="5000000" />

和

<bean id="ticketGrantingTicketUniqueIdGenerator" class="org.jasig.cas.util.DefaultUniqueTicketIdGenerator"
        c:maxLength="50" c:suffix="${host.name}" />

    <bean id="serviceTicketUniqueIdGenerator" class="org.jasig.cas.util.DefaultUniqueTicketIdGenerator"
        c:maxLength="20" c:suffix="${host.name}" />

    <bean id="loginTicketUniqueIdGenerator" class="org.jasig.cas.util.DefaultUniqueTicketIdGenerator"
        c:maxLength="30" c:suffix="${host.name}" />

    <bean id="proxy20TicketUniqueIdGenerator" class="org.jasig.cas.util.DefaultUniqueTicketIdGenerator"
        c:maxLength="20" c:suffix="${host.name}" />

    <util:map id="uniqueIdGeneratorsMap">
        <entry
            key="org.jasig.cas.authentication.principal.SimpleWebApplicationServiceImpl"
            value-ref="serviceTicketUniqueIdGenerator" />
    </util:map>

和

<bean id="ticketGrantingTicketCookieGenerator" 
        class="org.jasig.cas.web.support.CookieRetrievingCookieGenerator"
        c:casCookieValueManager-ref="cookieValueManager"
        p:cookieSecure="true"
        p:cookieMaxAge="-1"
        p:cookieName="TGC"
        p:cookiePath="/cas" />

    <bean id="cookieCipherExecutor" class="org.jasig.cas.util.DefaultCipherExecutor"
        c:secretKeyEncryption="${tgc.encryption.key}"
        c:secretKeySigning="${tgc.signing.key}" />

    <bean id="cookieValueManager" class="org.jasig.cas.web.support.DefaultCasCookieValueManager"
          c:cipherExecutor-ref="cookieCipherExecutor" />

现在，应用程序正在启动并在单个节点上正常工作，但是当我启动第二个节点时，大多数时候登录票证未被识别，这导致客户端应用程序无法登录:

17:52:48,986 ERROR [http-bio-8443-exec-11][CASFilter:83] org.jasig.cas.client.validation.TicketValidationException: _            Ticket 'ST-1-uFUEA1PDhSv4GPQ61E1T-customers01.dwssystems.com' not recognized_     [Sanitized]
org.jasig.cas.client.validation.TicketValidationException: _            Ticket 'ST-1-uFUEA1PDhSv4GPQ61E1T-customers01.mycompany.com' not recognized_     [Sanitized]
    at org.jasig.cas.client.validation.Cas20ServiceTicketValidator.parseResponseFromServer(Cas20ServiceTicketValidator.java:73)
    at org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:188)
    at com.liferay.portal.servlet.filters.sso.cas.CASFilter.processFilter(CASFilter.java:194)
    at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:59)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:204)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:109)
    at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:169)
    at com.liferay.portal.sharepoint.SharepointFilter.processFilter(SharepointFilter.java:88)
    at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:59)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:204)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:109)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:185)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
    at org.tuckey.web.filters.urlrewrite.UrlRewriteFilter.doFilter(UrlRewriteFilter.java:738)
    at com.liferay.portal.servlet.filters.urlrewrite.UrlRewriteFilter.processFilter(UrlRewriteFilter.java:57)
    at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:59)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:204)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:109)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:165)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:165)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:185)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
    at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilter.doFilter(InvokerFilter.java:119)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
    at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:219)
    at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:335)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
    at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1023)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
    at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:312)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at java.lang.Thread.run(Thread.java:745)

我正在为两个节点使用不同的主机名，如 cas 引用中所述。票据在数据库表中注册，但第二个节点似乎无法验证它。

我不确定问题是否与 session 复制、节点之间缺少自动发现或某些配置有关。

最佳答案

我已经设法通过以下修改修复它: - 配置具有静态成员资格的 tomcat 集群(因为由于 AWS 限制我无法使用多播) - 更新了两个 bean 配置:

<bean id="warnCookieGenerator" class="org.jasig.cas.web.support.CookieRetrievingCookieGenerator"
          p:cookieDomain="mycompany.com" // ---->> added this
          p:cookieSecure="true"
          p:cookieMaxAge="-1"
          p:cookieName="CASPRIVACY"
          p:cookiePath="/cas"/>

<bean id="ticketGrantingTicketCookieGenerator" 
            class="org.jasig.cas.web.support.CookieRetrievingCookieGenerator"
            c:casCookieValueManager-ref="cookieValueManager"
            p:cookieDomain="mycompany.com" // --->> added this
            p:cookieSecure="true"
            p:cookieMaxAge="-1"
            p:cookieName="TGC"
            p:cookiePath="/cas" />

关于tomcat - AWS 上的 CAS 4 集群 : Ticket not recognized，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/36969456/

上一篇：maven - 无法调用 Tomcat 管理器 : Software caused connection abort

下一篇：tomcat - 严重 : Could not contact localhost:8005. 关闭 tomcat 服务器时 Tomcat 可能没有运行错误。

相关文章：

tomcat - 如何在Java webapp中确保仅SSL访问而无需授权？

amazon-web-services - 使用 Anthos 的混合云和多云数据平台的多云解决方案

lucene.net - 如何负载平衡 Lucene.Net？

reactjs - 如何使用基于路径的路由负载均衡器为部署在 AWS ECS 上的 React.js 应用程序设置 nginx 配置

linux - 如何正确设置 EC2 负载平衡以允许实时文件同步？

java - 使 Servlet 2.5 代码与 Servlet 3.0 兼容，反之亦然

tomcat - Tomcat的JVM添加-D参数

java - Eclipse Kepler x64 Debug模式 tomcat 未启动

linux - 无法让 php mail() 在 linux ubuntu 上工作

amazon-web-services - 网络接口(interface)。并且不能在同一请求 Cloud-Formation 上指定实例级子网 ID

©2024 IT工具网  联系我们