How to use routing with CAS authentication, or is angular just not used?

My application usually uses the following for routing:

http://angularapp.com/#/page=bannanas

However, if the user is not authenticated, the user is redirected to the CAS login page, and then after logging in, the user is redirected back to:

http://angularapp.com/

Note that after redirecting, CAS completely removes the anchor / route "# /", since the anchor tag is not supported. https://issues.jasig.org/browse/CAS-1338

What is the best way to do this? Is there a way to do something like this:

http://angularapp.com/?page=bannanas

This causes the same routing: http://angularapp.com/#/page=bannanas

So how will CAS save request parameters (not anchors) when redirecting? Or is there a better way to handle this?

+5
source share
1 answer

You will need a URL to the URL before redirecting to your CAS service. When a call returns from a service, you must decode it and redirect it in your application.

If you use Java or .NET or something similar, you can handle all this outside of your angular application with a filter / servlet.

But here is the main idea. In your example, your angular application is located at http://angularapp.com/ .

  • User request page http://angularapp.com/#/page=bannanas , which must be redirected to the CAS server to log in. You must encode this URL and pass it as a request parameter, for example http://your-cas-site/login?returnUrl=http%3A%2F%2Fangularapp.com%2F%23%2Fpage%3Dbannanas

  • CAS handles authentication and redirects your application back.

  • In your application, write a $http interceptor that monitors the returnUrl request returnUrl . When you find it, decode returnUrl=http%3A%2F%2Fangularapp.com%2F%23%2Fpage%3Dbannanas and redirect to it: http://angularapp.com/#/page=bannanas

It can also be processed externally by a filter if your application server supports this. (I did this in Java for my application, but .NET and most other servers support the same thing.)

-

Adding this sample code as requested. Here is my auth filter that handles redirects to the login page.

 import java.io.IOException; import java.net.URLEncoder; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; public class LoginRedirect implements Filter { @Override public void destroy() { } @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest httpServletRequest = (HttpServletRequest) request; HttpServletResponse httpServletResponse = (HttpServletResponse) response; // See if user has an active session. User currentUser = UserService.getCurrentUser(httpServletRequest.getSession()); if (currentUser == null) { // No active session, need to error or redirect. if (httpServletRequest.getRequestURI().indexOf(httpServletRequest.getContextPath() + "/api/") == 0) { // For API requests, return an UNATHORIZED http response. httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED); } else { // For all other requests, forward the user to the login page. StringBuilder returnTo = new StringBuilder(); returnTo.append(httpServletRequest.getRequestURI()); if (httpServletRequest.getQueryString() != null) { returnTo.append("?"); returnTo.append(httpServletRequest.getQueryString()); } httpServletResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED); httpServletResponse.sendRedirect(httpServletRequest.getContextPath() + "/login?returnTo=" + URLEncoder.encode(returnTo.toString(), "UTF-8")); } } else if (currentUser.isDeleted() || currentUser.isLocked() || (!currentUser.isRoleAdmin() && !currentUser.isRoleStaff())) { httpServletResponse.sendError(HttpServletResponse.SC_FORBIDDEN); } else { chain.doFilter(httpServletRequest, httpServletResponse); } } @Override public void init(FilterConfig filterConfig) throws ServletException { } } 
+5
source

Source: https://habr.com/ru/post/1212621/


All Articles