cas+shiro一致注销原理解析

@Audit(            action="TICKET_GRANTING_TICKET_DESTROYED",            actionResolverName="DESTROY_TICKET_GRANTING_TICKET_RESOLVER",            resourceResolverName="DESTROY_TICKET_GRANTING_TICKET_RESOURCE_RESOLVER")    @Profiled(tag = "DESTROY_TICKET_GRANTING_TICKET", logFailuresSeparately = false)    @Transactional(readOnly = false)    @Override    public List<LogoutRequest> destroyTicketGrantingTicket(final String ticketGrantingTicketId) {        Assert.notNull(ticketGrantingTicketId);        logger.debug("Removing ticket [{}] from registry.", ticketGrantingTicketId);        final TicketGrantingTicket ticket = this.ticketRegistry.getTicket(ticketGrantingTicketId,                TicketGrantingTicket.class);        if (ticket == null) {            logger.debug("TicketGrantingTicket [{}] cannot be found in the ticket registry.", ticketGrantingTicketId);            return Collections.emptyList();        }        logger.debug("Ticket found. Processing logout requests and then deleting the ticket...");
　　　　//在这里cas server会去根据客户端带过来的ticket找到所有在cas server服务注册过的cas client server，让后对这些客户端服务发送一个http请求，客户端接受请求，删除//本身的ticket及注销session，cas server发送请求看下一段代码        final List<LogoutRequest> logoutRequests = logoutManager.performLogout(ticket);        this.ticketRegistry.deleteTicket(ticketGrantingTicketId);        return logoutRequests;    }
 @Override

public List<LogoutRequest> performLogout(final TicketGrantingTicket ticket) {        final Map<String, Service> services;        // synchronize the retrieval of the services and their cleaning for the TGT        // to avoid concurrent logout mess ups        synchronized (ticket) {            services = ticket.getServices();            ticket.removeAllServices();        }        ticket.markTicketExpired();        final List<LogoutRequest> logoutRequests = new ArrayList<LogoutRequest>();        // if SLO is not disabled        if (!disableSingleSignOut) {            // through all services

　　　　　　　　//循环遍历客户端的server            for (final String ticketId : services.keySet()) {                final Service service = services.get(ticketId);                // it's a SingleLogoutService, else ignore                if (service instanceof SingleLogoutService) {                    final SingleLogoutService singleLogoutService = (SingleLogoutService) service;                    // the logout has not performed already                    if (!singleLogoutService.isLoggedOutAlready()) {                        final LogoutRequest logoutRequest = new LogoutRequest(ticketId, singleLogoutService);                        // always add the logout request                        logoutRequests.add(logoutRequest);                        final RegisteredService registeredService = servicesManager.findServiceBy(service);                        // the service is no more defined, or the logout type is not defined or is back channel                        if (registeredService == null || registeredService.getLogoutType() == null                                || registeredService.getLogoutType() == LogoutType.BACK_CHANNEL) {                            // perform back channel logout
　　　　　　　　　　　　　　　　
　　　　　　　　　　　　　　　　//向客户端发送一个请求，                            if (performBackChannelLogout(logoutRequest)) {                                logoutRequest.setStatus(LogoutRequestStatus.SUCCESS);                            } else {                                logoutRequest.setStatus(LogoutRequestStatus.FAILURE);                                LOGGER.warn("Logout message not sent to [{}]; Continuing processing...",                                        singleLogoutService.getId());                            }                        }                    }                }            }        }        return logoutRequests;    }

public void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse, final FilterChain filterChain) throws IOException, ServletException {        final HttpServletRequest request = (HttpServletRequest) servletRequest;        //重点的两个IF判断，同时也是逻辑处理，第一是判断是不是第一次登录的时候会进入方法往cas SessionMappingStorage的添加ticket,sessionId键值对        if (handler.isTokenRequest(request)) {            LOG.warn("第{}次进来映射，sessionId={}", index++, request.getSession().getId());            handler.recordSession(request);
　　　　　　//判断是否是注销请求，如果是注销请求进入逻辑，注销session同时删除SessionMappingStorage的键值对（就是这里实现了统一注销）        } else if (handler.isLogoutRequest(request)) {            LOG.warn("第{}进来删除映射，sessionId={}", removeIndex++, request.getSession().getId());            handler.destroySession(request);            // Do not continue up filter chain            return;        } else {            log.trace("Ignoring URI " + request.getRequestURI());        }        filterChain.doFilter(servletRequest, servletResponse);    }