身份验证失败：用户的凭据已过期。 CAS v4.2

Question

我有一个不知道如何解决的问题。 我在 tomcat 8 端口 8443 上配置了 CAS v4.2。 我拥有的 spring-security 配置，它正确地重定向到 cas，当我在 cas 中进行身份验证时，在日志中很明显身份验证和票证生成是正确的。 如文档中所示，我已配置票证的持续时间为 2 周。我已将 web.xml 中的 cas 会话从 5 个增加到 15 个，因为它们在按下的可能错误中表明了这一点，但这一切都导致了相同的结果。 在对自己进行身份验证后，我没有将自己重定向到客户端应用程序的主页，但它显示一条消息“身份验证失败：用户的凭据已过期”

我不知道根据 4.2 版在 cas.properties 中配置属性可能做错了什么或可能缺少什么。 如果您能告诉我这个问题可能是什么以便继续，我将不胜感激。 提前致谢。

JDK8. 春天 4.2.6。 CAS v4.2。 Tomcat8.

Spring-security.xml

    <security:http entry-point-ref="casEntryPoint" auto-config="true" use-expressions="true">
    <security:csrf disabled="false"/>
    <security:custom-filter position="FIRST" ref="ajaxSessionFilter"/>

    <!-- ACCESO SIN RESTRICCIONES -->
    <security:intercept-url pattern="/static/**" access="permitAll"/>
    <security:intercept-url pattern="/WEB-INF/views/**" access="permitAll"/>

    <security:custom-filter ref="casAuthenticationFilter" after="CAS_FILTER"/>

    <security:intercept-url pattern="/**" access="isAuthenticated()" />
</security:http>


<bean id="casServiceProperties" class="org.springframework.security.cas.ServiceProperties"
    p:service="http://localhost:8080/aap/j_spring_cas_security_check"
    p:sendRenew="false" p:authenticateAllArtifacts="true" />

<bean id="casEntryPoint"
    class="org.springframework.security.cas.web.CasAuthenticationEntryPoint"
    p:serviceProperties-ref="casServiceProperties" p:loginUrl="https://cas:8443/cas/login" />

<bean id="ajaxSessionFilter" class="com.xxxx.auth.web.filters.ajax.SessionFilter">  
    <property name="homePage" value="https://cas:8443/cas/login"/>
</bean>

<bean id="casAuthenticationFilter" class="org.springframework.security.cas.web.CasAuthenticationFilter">
    <property name="serviceProperties" ref="casServiceProperties"/>
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="authenticationFailureHandler">
        <bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
            <property name="defaultFailureUrl" value="/casfailed"/>
        </bean>
    </property>
    <!-- -->
    <property name="authenticationSuccessHandler">
        <bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler">
            <property name="defaultTargetUrl" value="/"/>
        </bean>
    </property>

    <property name="proxyGrantingTicketStorage" ref="proxyGrantingTicketStorage" />
</bean>

<bean id="proxyGrantingTicketStorage" class="org.jasig.cas.client.proxy.ProxyGrantingTicketStorageImpl" />

<bean id="passwordEncoder" class="org.springframework.security.authentication.encoding.ShaPasswordEncoder"/>

<!-- This filter redirects to the CAS Server to signal Single Logout should be performed -->
<bean id="requestSingleLogoutFilter"
    class="org.springframework.security.web.authentication.logout.LogoutFilter"
    p:filterProcessesUrl="/j_spring_cas_security_logout">
    <constructor-arg value="https://cas:8443/cas/logout" />
    <constructor-arg >
        <bean
            class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
    </constructor-arg>
</bean>

<!-- This filter handles a Single Logout Request from the CAS Server -->
<bean id="singleLogoutFilter" class="org.jasig.cas.client.session.SingleSignOutFilter"/>

<security:authentication-manager alias="authenticationManager">
    <security:authentication-provider ref="casAuthenticationProvider"/>
</security:authentication-manager>

<bean id="casAuthenticationProvider"
    class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
    <property name="authenticationUserDetailsService">
        <bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
            <constructor-arg ref="userDetailService" />
        </bean>
    </property>
    <property name="serviceProperties" ref="casServiceProperties" />
    <property name="ticketValidator">
        <bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
            <constructor-arg index="0" value="https://cas:8443/cas" />
            <property name="proxyGrantingTicketStorage" ref="proxyGrantingTicketStorage" />
        </bean>
    </property>
    <property name="key" value="CAS"/>
</bean>

<bean id="userDetailService" class="com.xxx.services.security.userdetails.PSOUserDetailsService"/>

cas.properties

# Decides whether SSO cookie should be created only under secure connections.
 tgc.secure=true

# The expiration value of the SSO cookie
 tgc.maxAge=1209600

# The name of the SSO cookie
 tgc.name=TGC

# The path to which the SSO cookie will be scoped
 tgc.path=/cas

# The expiration value of the SSO cookie for long-term authentications
 tgc.remember.me.maxAge=1209600

# Decides whether SSO Warning cookie should be created only under secure connections.
 warn.cookie.secure=true

# The expiration value of the SSO Warning cookie
 warn.cookie.maxAge=1209600

# The name of the SSO Warning cookie
 warn.cookie.name=CASPRIVACY

# The path to which the SSO Warning cookie will be scoped
 warn.cookie.path=/cas
##
# Single Sign-On Session TGT Timeouts
#
# Inactivity Timeout Policy
 tgt.timeout.maxTimeToLiveInSeconds=1209600

# Default Expiration Policy
 tgt.maxTimeToLiveInSeconds=28800
 tgt.timeToKillInSeconds=7200

##
# Service Ticket Timeout
#
 st.timeToKillInSeconds=28800
 st.numberOfUses=1

 tgc.remember.me.maxAge=1209600

Cookie

"CASPRIVACY=""; 
Expires=Thu, 01-Jan-1970 00:00:10 GMT; 
Path=/cas; 
SecureTGC=eyJhbGciOiJIUzUxMiJ9.WlhsS2FHSkhZMmxQYVVwcllWaEphVXhEU214aWJVMXBUMmxLUWsxVVNUUlJNRXBFVEZWb1ZFMXFWVEpKYmpBdUxqRnNSVEl5T1U5SFdsQTRVWFpUTFc5VWIzRmpNRUV1T0Vac2J6QnRaMjl5ZVRWRk9XRnFNR3AwVFZKcFNIQklTVGt5YjJGelNWZE9XR0pEU2swM2VrMUJRekJYVUVjd1UwSnRaRGRaTTFwVlJHNVROekpNTjA5aWNsZGtjMEo2TkVGVVZYQkJWMGxPVEhKQkxWSmxVWEozZUdWRlpFaGxOV2xEYkhZdFgxUnRWbXBYY0hJeFZEWlpXQzFRVG1kcFdtNUJRa2RuTW5CdlRHOUxaRzB3VFMxQk56ZFNWelZ4YVdORVQxQXRVekEzTVVVNGNFSmxWVFJ2UkZwZmVFTTNWRzVFVlRWRmMyeFJRVXR3Y2tOMFlXMVhTVVJGT0ZoQ00xQlNaV0pMVTJGcVJrMVdPV1ZEVmxkU1ozaEtkeTVQYTJwSFEzTmhWRmxRVkdwSE0xZG5UVnBVZUVKQg.H2P1nCulIj3BtS-wOJr3PtOVGi1hT6y0PDP0MVSQerwv3khVB-lFQe2BdKNElUYzJhURtW-zwyZK3PuBh6p_eQ; 
Expires=Wed, 18-Jan-2017 15:00:18 GMT; 
Path=/cas; 
Secure"

Answer 1

我会回应自己，以防万一有人碰巧是一样的。 问题在于 PSOUserDetails，它没有覆盖凭证未过期的方法。

谢谢