Liferay +中科院LDAP
我正在从事一些涉及 Liferay Portal、CAS 和 Apache Directory Server 的项目。我应该为以下模型准备概念证明（或反证）。
1. Liferay与CAS集成并支持SSL（进一步使用SSO需要）。我已经做到了并且有效。
2. CAS与LDAP服务器（Apache Directory Server）通信，不仅可以执行身份验证，还可以执行授权。我想实现的情况是，当 Liferay 将其动态权限（到各种 Liferay 对象）存储在他自己的数据库中，而静态权限（例如用户角色）从 CAS 获取时，实际上 CAS 是从 LDAP 获取的。我希望它是透明的，即 Liferay 不知道 LDAP 的存在。
据我所知，现成的 CAS 仅支持身份验证。
这可能吗？安妮有什么想法吗？提示？
I am working on some project involving Liferay Portal, CAS and Apache Directory Server. I am supposed to prepare proof of concept (or disproof) for the following model.
1. Liferay is integrated with CAS and supports SSL (needed for further usage of SSO). I have already done it and it works.
2. CAS communicates with LDAP server (Apache Directory Server) in order to perform not only authentication, but also authorization. I would like to achieve situation, when Liferay stores its dynamic privileges (to various Liferay objects) in his own database and static privileges (like user roles for instance) gets from CAS, which in fact gets it from LDAP. I want it transparent, namely that Liferay is not aware of LDAP existence.
As far as I know CAS out-of-the-box does only support authentication.
Is this possible? Anny ideas? Hints?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
CAS 与中央身份验证服务一样吗？顾名思义，它是为身份验证而设计的。
正如您已经清楚知道的那样，授权是完全不同的事情。您需要一个专为授权而设计的框架 - 尝试 Spring Security。
CAS as in Central Authentication Service? It's designed for authentication, as the name implies.
Authorization is something quite different, as you clearly know already. You'll need a framework designed for authorization - try Spring Security.
我同意 David M.：CAS 仅处理身份验证。
但是您可以在身份验证过程中加载用户的所有角色（例如，通过实现您自己的 AuthenticationMetaPopulator ），并使用 serviceticket-validate 调用的后续响应将这些角色提供给服务。
I agree with David M.: CAS handles only authentication.
But you could load all the roles of a user during the authentication-process (e.g. by implementing your own
AuthenticationMetaPopulator) and provide these to a service using the later response of the serviceticket-validate call.