jboss版本: jboss-eap-6.4-CVE-2015-7501
jdk版本: 1.7.0_79
cas版本: cas4.1.3
参考来源:
JBoss7.1.1版本和CAS3的集成(未完)
CAS 4.1.1 - JDBC authentication, failed to deploy
Securing JBoss EAP 6 - Implementing SSL
JBoss eap 6.4 mutual (two way) ssl configuration
Tomcat (1) —— Mac下配置Tomcat Https/SSL
配置cas server到jboss eap 6.4需要做以下准备:
可以参照下面两篇文章,进行准备和配置:
CAS (1) —— Mac下配置CAS到Tomcat(服务端)
CAS 4.x (7) —— Mac下配置CAS集群及JPATicketRegistry(服务端)
配置jboss eap比较简单,直接去官网注册后就能 下载 了。
下载后也无需编译,如果再Mac或linux下可以直接运行命令启动jboss eap
Standalone模式:
:node6-a Richard$ ./bin/standalone.sh
Domain模式:
:node6-a Richard$ ./bin/domain.sh
新的EAP提供了两种部署方式,官方推荐产品上使用Domain模式,关于Domain模式和Standalone模式有何区别,再次不赘述,weblogic也有类似特性,可以去官网上查找。
如果能正常启动,最后几行的console输出可能是:
09:05:34,206 INFO [org.springframework.web.servlet.DispatcherServlet] (ServerService Thread Pool -- 69) FrameworkServlet 'cas': initialization completed in 820 ms 09:05:34,251 INFO [org.jboss.as.server] (Controller Boot Thread) JBAS015859: 已部署的 "cas.war"(runtime-name: "cas.war") 09:05:34,256 INFO [org.jboss.as] (Controller Boot Thread) JBAS015961: 侦听 http://127.0.0.1:9990/management 的 HTTP 管理接口 09:05:34,257 INFO [org.jboss.as] (Controller Boot Thread) JBAS015951: 管理控制台侦听于 http://127.0.0.1:9990 09:05:34,257 INFO [org.jboss.as] (Controller Boot Thread) JBAS015874: JBoss EAP 6.4.0.GA (AS 7.5.0.Final-redhat-21) started in 9651ms - Started 551 of 588 services (60 services are lazy, passive or on-demand)
默认情况下,本地后台服务管理的入口是 http://127.0.0.1:9990/console 。
这个版本的SSL的配置过程与Tomcat有些许差异,主要是因为jboss eap提供了Standalone与Domain两种模式以及对配置文件范式的修改。至于从哪个版本起做的改变,在此不考证。
SSL密钥和证书生成过程与Tomcat SSL一致,在此不赘述。
standalone.xml里面有关键配置(Line 295~):
<subsystem xmlns="urn:jboss:domain:web:2.2" default-virtual-server="default-host" native="false"> <connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"/> <connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true"> <ssl name="https" password="Hoau123" certificate-key-file="/Users/Richard/Documents/Dev/servers/cluster/keys/hoaukey"/> </connector> <virtual-server name="default-host" enable-welcome-root="true"> <alias name="localhost"/> <alias name="sso.hoau.com"/> </virtual-server> </subsystem>
为subsystem添加了https connector以及为ssl指定certificate-key-file的路径。
通过后台console界面来部署比较方便
(1)选择“Create Deployment”
(2)选择“Add”
(3)点击“Browse”并选择编译好的war
部署后可能会出现错误:
查看server.log(../servers/cluster/jboss/node6-a/standalone/log)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'supportsTrustStoreSslSocketFactoryHttpClient': FactoryBean threw exception on object creation; nested exception is java.lang.NoSuchMethodError: org.apache.http.impl.client.HttpClientBuilder.setSSLHostnameVerifier(Ljavax/net/ssl/HostnameVerifier;)L org/apache/http/impl/client/HttpClientBuilder; at org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:175) [spring-beans-4.1.8.RELEASE.jar:4.1.8.RELEASE] at org.springframework.beans.factory.support.FactoryBeanRegistrySupport.getObjectFromFactoryBean(FactoryBeanRegistrySupport.java:127) [spring-beans-4.1.8.RELEASE.jar:4.1.8.RELEASE] at org.springframework.beans.factory.support.AbstractBeanFactory.getObjectForBeanInstance(AbstractBeanFactory.java:1523) [spring-beans-4.1.8.RELEASE.jar:4.1.8.RELEASE] at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:314) [spring-beans-4.1.8.RELEASE.jar:4.1.8.RELEASE] at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194) [spring-beans-4.1.8.RELEASE.jar:4.1.8.RELEASE] at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:351) [spring-beans-4.1.8.RELEASE.jar:4.1.8.RELEASE] ... 64 more
此处怀疑jboss容器自带的库可能和Tomcat(8.x)有所差异,此处报错的“org.apache.http.impl.client.HttpClientBuilder”属于 httpclient 包下。
查看文件module.xml (路径“../servers/cluster/jboss/node6-a/modules/system/layers/base/org/apache/httpcomponents/main”),发现jboss这个版本的jar是依赖与redhat自己打包的"httpclient-4.3.6.redhat-1.jar"和“httpcore-4.3.3.redhat-1.jar”。
暂且不考虑影响和更好的解决方案,一个可行方案是修改这个配置,将这两个jar替换成httpclient的更高版本(此处为4.4.1)
maven
<dependency> <groupId>org.apache.httpcomponents</groupId> <artifactId>httpclient</artifactId> <version>4.4.1</version> </dependency>
module.xml
<?xml version="1.0" encoding="UTF-8"?> <module xmlns="urn:jboss:module:1.1" name="org.apache.httpcomponents"> <properties> <property name="jboss.api" value="private"/> </properties> <resources> <!-- redhat original --> <!-- <resource-root path="httpclient-4.3.6.redhat-1.jar"/> <resource-root path="httpcore-4.3.3.redhat-1.jar"/> <resource-root path="httpmime-4.3.6.redhat-1.jar"/> --> <!-- redhat original --> <!-- Richard Modify --> <resource-root path="httpclient-4.4.1.jar"/> <resource-root path="httpcore-4.4.1.jar"/> <resource-root path="httpmime-4.3.6.redhat-1.jar"/> <!-- Richard Modify --> <!-- Insert resources here --> </resources> <dependencies> <module name="javax.api"/> <module name="org.apache.commons.codec"/> <module name="org.apache.commons.logging"/> <module name="org.apache.james.mime4j"/> </dependencies> </module>
尝试访问
https://sso.hoau.com:8453/cas
并使用我们在数据库里面预埋的数据"casuser/Mellon"登陆
参照数据库用户验证和JpaTicketRegistry的方式,重新发布cas.war。这时可能会遇到另一个错误:
查看server.log
10:28:09,762 ERROR [org.springframework.web.context.ContextLoader] (ServerService Thread Pool -- 216) Context initialization failed: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'entityManagerFactory' defined in ServletContext resource [/WEB-INF/spring-configuration/ticketRegistry.xml]: Invocation of init method failed; nested exception is java.lang.NoSuchMethodError: javax.persistence.Table.indexes()[Ljavax/persistence/Index; at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1572) [spring-beans-4.1.8.RELEASE.jar:4.1.8.RELEASE at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:539) [spring-beans-4.1.8.RELEASE.jar:4.1.8.RELEASE] at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476) [spring-beans-4.1.8.RELEASE.jar:4.1.8.RELEASE] at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:303) [spring-beans-4.1.8.RELEASE.jar:4.1.8.RELEASE]
这主要还是因为jboss EAP 6.4这个版本自带jar包的问题。
修改hibernate-jpa-api的jar包版本,路径:
/Users/Richard/Documents/Dev/servers/cluster/jboss/node6-a/modules/system/layers/base/javax/persistence/api/main
module.xml
<module xmlns="urn:jboss:module:1.1" name="javax.persistence.api">
<resources> <!-- original --> <!-- <resource-root path="hibernate-jpa-2.0-api-1.0.1.Final-redhat-3.jar"/> --> <!-- orginal --> <!-- Richard modify --> <resource-root path="hibernate-jpa-2.1-api-1.0.0.Final.jar"/> <!-- Richard modify --> <!-- Insert resources here --> </resources> </module>