环境准备：
1. 安装JDK（安装目录必须无空格，默认安装Program Files目录会导致某些命令不能运行）;
2. 配置JAVA_HOME环境变量，JAVA_HOME=E:\Java\jdk1.6
服务端：
1. 进入jdk的bin目录
2. 在jdk生成keystore
执行：
keytool -genkey?-alias gzirms_tomcat?-keystore gzirms_keystore?-storepass changeit -validity 365 -keyalg RSA -keysize 576 -v
生成keystore,别名为gzirms_tomcat，keystore的名称gzirms_keystore，初始密码changeit，有效期365天，密匙算法RSA，密钥长度 576
执行后，输入相关信息
gz.restar.net为服务器名称，后续配置访问路径时需要根据服务器名称配置，如果不想用主机名，可以通过配置hosts解决
3. 生成Server的cert证书
keytool -export -file gzirms_keystore.cert -alias gzirms_tomcat -keystore gzirms_keystore
从名为gzirms_keystore的keystore中导出文件名为gzirms_keystore.cert的证书（要求输入密码，为上面定义的初始密码changeit）
4. 导入证书到tomcat中
keytool -import -keystore ../jre/lib/security/cacerts -file gzirms_keystore.cert -alias gzirms_tomcat
5. 配置tomcat的https协议
在tomcat的conf跟目录下的server.xml，查找“Define a SSL HTTP/1.1 Connector on port 8443”，找到后修改部分配置文件（绿色部分）：
<!-- Define a SSL HTTP/1.1 Connector on port 8443
This connector uses the JSSE configuration, when using APR, the?
connector should be using the OpenSSL style configuration
described in the APR documentation -->
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="E:\Java\jdk1.6\bin\gzirms_keystore"
keystorePass="changeit" />
6. 单点登录门户配置
修改web.xml文件，增加单点登录filter
<!-- 单点登录服务端配置 -->
<listener>
<listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
</listener>
<!-- 用于单点登出 -->
<filter>
<filter-name>CAS Single Sign Out Filter</filter-name>
<filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>CAS Single Sign Out Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- 门户作为客户端应用配置验证 -->
<filter>
<filter-name>CASFilter</filter-name>
<filter-class>com.boco.cas.filter.CasUrlFilter</filter-class>
<!--下面两个为验证地址，即cas server的地址，如果使用https验证，地址为https://hostname:8443字样-->
<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>
<param-value>http://LeeZw-PC:8080/cas/login</param-value>
</init-param>
<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>
<param-value>https://LeeZw-PC:8443/cas/proxyValidate</param-value>
</init-param>
<!-- 本工程的URL，被拦截的地址-->
<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.serverName</param-name>
<param-value>LeeZw-PC:8080</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>CASFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
7. cas web应用配置
1) 复制cas.war到tomcat/wabapps下
2) 修改cas\WEB-INF\deployerConfigContext.xml
a. 在beans下增加datasource配置
<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource">
<property name="driverClassName">
<value>oracle.jdbc.driver.OracleDriver</value>
</property>
<property name="url">
<value>jdbc:oracle:thin:@127.0.0.1:1521:ORCL</value>
</property>
<property name="username">
<value>gz_portal</value>
</property>
<property name="password">
<value>gz_portal</value>
</property>
</bean>
b. 在beans下增加密码加密策略配置
<bean id="passwordEncoder" class="org.jasig.cas.authentication.handler.DefaultPasswordEncoder" autowire="byName">
<constructor-arg value="MD5"/>
</bean>
c. 修改authenticationHandlers配置
屏蔽<bean class="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler" />
增加
<bean class="org.jasig.cas.adaptors.jdbc.QueryDatabaseAuthenticationHandler">
<property name="dataSource" ref="dataSource"/>
<property name="sql" value="SELECT PASSWORD FROM (SELECT OPERATOR_ID, PASSWORD FROM T_SYS_P_OPERATOR WHERE OPERATOR_ID != 'doraemon' UNION ALL SELECT 'doraemon' AS OPERATOR_ID, 'f9144ac3ae6679ea38bcc0e21e964453' AS PASSWORD FROM DUAL) WHERE OPERATOR_ID = ?"/>
<property name="passwordEncoder" ref="passwordEncoder"/>
</bean>
3）复制需要的jar包到cas\WEB-INF\lib
a. cas-server-support-jdbc-3.4.10.jar
b. commons-dbcp.jar
c. commons-pool.jar
d. ojdbc14.jar
客户端：
修改web.xml，增加单点登录filter
<filter>
<filter-name>CASFilter</filter-name>
<filter-class>edu.yale.its.tp.cas.client.filter.CASFilter</filter-class>
<!--下面两个为验证地址，即cas server的地址，如果使用https验证，地址为https://hostname:8443字样-->
<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>
<param-value>http://LeeZw-PC:8080/cas/login</param-value>
</init-param>
<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>
<param-value>https://LeeZw-PC:8443/cas/proxyValidate</param-value>
</init-param>
<!-- 本工程的URL，被拦截的地址-->
<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.serverName</param-name>
<param-value>LeeZw-PC:8080</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>CASFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>