java -jar -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005 build/libs/cas-server-webapp-starter-tomcat-6.5.0-SNAPSHOT.jar

java -jar -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005 build/libs/cas-server-webapp-tomcat-6.5.0-SNAPSHOT.war

ext {
    mainClassName = "org.apereo.cas.web.CasWebApplication"
}
description = "Apereo CAS Starter with Apache Tomcat"

apply from: rootProject.file("gradle/springboot.gradle")
apply from: rootProject.file("gradle/webapp-dependencies.gradle")

dependencies {
    implementation project(":webapp:cas-server-webapp-init-tomcat")
}

implementation project(":core:cas-server-core")
    implementation project(":core:cas-server-core-audit")
    implementation project(":core:cas-server-core-authentication")
    implementation project(":core:cas-server-core-configuration")
    implementation project(":core:cas-server-core-cookie")
    implementation project(":core:cas-server-core-logout")
    implementation project(":core:cas-server-core-logging")
    implementation project(":core:cas-server-core-services")
    implementation project(":core:cas-server-core-tickets")
    implementation project(":core:cas-server-core-util")
    implementation project(":core:cas-server-core-validation")
    implementation project(":core:cas-server-core-web")
    implementation project(":core:cas-server-core-notifications")

    compileOnlyApi project(":support:cas-server-support-jpa-util")

    implementation project(":support:cas-server-support-actions")
    implementation project(":support:cas-server-support-person-directory")
    implementation project(":support:cas-server-support-themes")
    implementation project(":support:cas-server-support-validation")
    implementation project(":support:cas-server-support-thymeleaf")
    implementation project(":support:cas-server-support-pm-webflow")

    implementation project(":webapp:cas-server-webapp-config")
    implementation project(":webapp:cas-server-webapp-init")
    implementation project(":webapp:cas-server-webapp-resources")

public class CasStarterBanner extends AbstractCasBanner {
    .....
}

description = "Apereo CAS Web Application via Apache Tomcat"

dependencies {
    api libraries.springboottomcat

    implementation project(":core:cas-server-core-web-api")
    implementation project(":core:cas-server-core-util-api")
    implementation project(":webapp:cas-server-webapp-init")
}

// proxyBeanMethods = false 为了提高加载对的速度
@Configuration(value = "casEmbeddedContainerTomcatConfiguration", proxyBeanMethods = false)
//
@EnableConfigurationProperties(CasConfigurationProperties.class)
@ConditionalOnClass(value = {Tomcat.class, Http2Protocol.class})
@AutoConfigureBefore(ServletWebServerFactoryAutoConfiguration.class)
@AutoConfigureOrder(Ordered.HIGHEST_PRECEDENCE)
public class CasEmbeddedContainerTomcatConfiguration {

    //导入了spring自身的服务器定义
    @Autowired
    private ServerProperties serverProperties;

    @Autowired
    private CasConfigurationProperties casProperties;

    //系统中没有这个类，就启用这个类
    @ConditionalOnMissingBean(name = "casServletWebServerFactory")
    @Bean
    public ConfigurableServletWebServerFactory casServletWebServerFactory() {
        return new CasTomcatServletWebServerFactory(casProperties, serverProperties);
    }

    @ConditionalOnMissingBean(name = "casTomcatEmbeddedServletContainerCustomizer")
    @Bean
    public ServletWebServerFactoryCustomizer casTomcatEmbeddedServletContainerCustomizer() {
        return new CasTomcatServletWebServerFactoryCustomizer(serverProperties, casProperties);
    }
}

HTTP协议：连接器监听8080端口，负责建立HTTP连接。在通过浏览器访问Tomcat服务器的Web应用时，使用的就是这个连接器。　　
AJP协议：连接器监听8009端口，负责和其他的HTTP服务器建立连接。在把Tomcat与其他HTTP服务器集成时，就需要用到这个连接器。

给 tomcat 设置代理，这样凡是从tomcat中发出去的请求，都会通过这个代理服务器去访问。我们这里说的是http接口的代理。修改bin/catalina.sh ，增加一行设置，如下：
JAVA_OPTS=”$JAVA_OPTS -Dhttp.proxyHost=10.98.10.237 -Dhttp.proxyPort=3128”
ip和端口改成自己可用的代理服务器。

<security-constraint>
		<web-resource-collection>
			<web-resource-name>protected Resource</web-resource-name>
			<url-pattern>/BasicVerify/*</url-pattern>
		</web-resource-collection>

		<auth-constraint>
			<role-name>test100</role-name>
		</auth-constraint>
	</security-constraint>

	<login-config>
		<auth-method>BASIC</auth-method>
		<realm-name>Default</realm-name>
	</login-config>
————————————————
<tomcat-users>
  <role rolename="test100"/>
  <user username="test123" password="test123" roles="test100"/>
</tomcat-users>

在你的webapp WEB-INF目录下创建rewrite.config的配置文件，比如说我们要将http://localhost:8080/ 映射到你的webapp 某个页面: http://localhost:8080/“yourwebname” /test.html, 我们可以这样配置

RewriteRule ^/     /yourwebname/test.html    [L]

写机制配置完成，当你在浏览器中输入http://localhost:8080/， 就可以正常访问test.html页面了。

@SpringBootTest(classes = {
    RefreshAutoConfiguration.class,
    CasEmbeddedContainerTomcatConfiguration.class,
    CasEmbeddedContainerTomcatFiltersConfiguration.class
},
    properties = {
        "server.port=8583",
        "server.ssl.enabled=false",
        "cas.server.tomcat.csrf.enabled=true",
        "cas.server.tomcat.remote-addr.enabled=true"
    },
    webEnvironment = SpringBootTest.WebEnvironment.MOCK)
@EnableConfigurationProperties({CasConfigurationProperties.class, ServerProperties.class})
@Tag("WebApp")
public class CasEmbeddedContainerTomcatFiltersConfigurationTests {
    @Autowired
    @Qualifier("tomcatCsrfPreventionFilter")
    private FilterRegistrationBean tomcatCsrfPreventionFilter;

    @Autowired
    @Qualifier("tomcatRemoteAddressFilter")
    private FilterRegistrationBean tomcatRemoteAddressFilter;

    @Test
    public void verifyOperation() {
        assertNotNull(tomcatCsrfPreventionFilter);
        assertNotNull(tomcatCsrfPreventionFilter.getFilter());
        assertNotNull(tomcatRemoteAddressFilter);
        assertNotNull(tomcatRemoteAddressFilter.getFilter());
    }
}

lombok.log.fieldName = LOGGER
lombok.log.fieldIsStatic=true

lombok.toString.doNotUseGetters=true
lombok.equalsAndHashCode.doNotUseGetters=true

lombok.addLombokGeneratedAnnotation = true

config.stopBubbling=true

LOGGER.debug("Enabling APR on connector port [{}]", c.getPort());

FunctionUtils.doIfNotNull(apr.getSslCaCertificateFile(),
                        Unchecked.consumer(f -> handler.setSSLCACertificateFile(apr.getSslCaCertificateFile().getCanonicalPath())));

/**
     * Do if not null.
     *
     * @param <T>          the type parameter
     * @param input        the input
     * @param trueFunction the true function
     */
    public static <T> void doIfNotNull(final T input,
                                       final Consumer<T> trueFunction) {
        try {
            if (input != null) {
                trueFunction.accept(input);
            }
        } catch (final Throwable e) {
            LoggingUtils.warn(LOGGER, e);
        }
    }

@ConditionalOnProperty(prefix = "cas.server.tomcat.csrf", name = "enabled", havingValue = "true")
    @RefreshScope
    @Bean
    @ConditionalOnMissingBean(name = "tomcatCsrfPreventionFilter")
    public FilterRegistrationBean tomcatCsrfPreventionFilter() {
        val bean = new FilterRegistrationBean();
        bean.setFilter(new CsrfPreventionFilter());
        bean.setUrlPatterns(CollectionUtils.wrap("/*"));
        bean.setName("tomcatCsrfPreventionFilter");
        return bean;
    }

org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
  org.apereo.cas.config.CasEmbeddedContainerTomcatConfiguration,\
  org.apereo.cas.config.CasEmbeddedContainerTomcatFiltersConfiguration

description = "Apereo CAS Web Application Initializer"
dependencies {
    implementation project(":core:cas-server-core-web-api")
    implementation project(":core:cas-server-core-util-api")
    implementation project(":core:cas-server-core-configuration")

    provided project(":webapp:cas-server-webapp-config")
}

@EnableDiscoveryClient
@SpringBootApplication(exclude = DataSourceAutoConfiguration.class, proxyBeanMethods = false)
@EnableConfigurationProperties(CasConfigurationProperties.class)
@EnableAsync
@EnableAspectJAutoProxy(proxyTargetClass = true)
@EnableTransactionManagement(proxyTargetClass = true)
@EnableScheduling
@NoArgsConstructor
@Slf4j
public class CasWebApplication {

    /**
     * Main entry point of the CAS web application.
     *
     * @param args the args
     */
    public static void main(final String[] args) {
        CasEmbeddedContainerUtils.getLoggingInitialization()
            .ifPresent(init -> init.setMainArguments(args));
        val banner = CasEmbeddedContainerUtils.getCasBannerInstance();
        new SpringApplicationBuilder(CasWebApplication.class)
            .banner(banner)
            .web(WebApplicationType.SERVLET)
            .logStartupInfo(true)
            //
            .contextFactory(webApplicationType -> new CasWebApplicationContext())
            // 应用程序启动期间标记步骤，并收集有关执行上下文或其处理时间的数据。
            .applicationStartup(CasEmbeddedContainerUtils.getApplicationStartup())
            .run(args);
    }

    /**
     * Handle application ready event.
     *
     * @param event the event
     */
    @EventListener
    public void handleApplicationReadyEvent(final ApplicationReadyEvent event) {
        AsciiArtUtils.printAsciiArtReady(LOGGER, StringUtils.EMPTY);
        LOGGER.info("Ready to process requests @ [{}]", DateTimeUtils.zonedDateTimeOf(Instant.ofEpochMilli(event.getTimestamp())));
    }
}

description = "Apereo CAS Web Application Configuration"
dependencies {
    api project(":api:cas-server-core-api-webflow")
    api project(":api:cas-server-core-api-audit")

    implementation libraries.pac4jcore
    implementation libraries.springsecurityweb
    implementation libraries.springsecurityconfig
    implementation libraries.ldaptive

    implementation project(":core:cas-server-core-webflow")
    implementation project(":core:cas-server-core-webflow-mfa")
    implementation project(":core:cas-server-core-web-api")
    implementation project(":core:cas-server-core-configuration-api")
    implementation project(":core:cas-server-core-util-api")
    implementation project(":core:cas-server-core-authentication-api")

    compileOnlyApi project(":support:cas-server-support-jpa-util")

    implementation project(":support:cas-server-support-actions")
    implementation project(":support:cas-server-support-pac4j-core")
    implementation project(":support:cas-server-support-ldap-core")
}

apply from: rootProject.file("gradle/dependencies.gradle")
apply from: rootProject.file("gradle/dependencyUpdates.gradle")

ext.libraries = [
        acme                    : [
                dependencies.create("org.shredzone.acme4j:acme4j-client:$acmeClientVersion") {
                    exclude(group: "org.slf4j", module: "slf4j-api")
                    exclude(group: "org.bitbucket.b_c", module: "jose4j")
                    exclude(group: "org.bouncycastle", module: "bcpkix-jdk15on")
                    exclude(group: "org.bouncycastle", module: "bcprov-jdk15on")
                },
                dependencies.create("org.shredzone.acme4j:acme4j-utils:$acmeClientVersion") {
                    exclude(group: "org.slf4j", module: "slf4j-api")
                    exclude(group: "org.bitbucket.b_c", module: "jose4j")
                    exclude(group: "org.bouncycastle", module: "bcpkix-jdk15on")
                    exclude(group: "org.bouncycastle", module: "bcprov-jdk15on")
                }
        ],

@Service
public class FooService {
    private final FooRepository repository;
    public FooService(ObjectProvider<FooRepository> repositoryProvider) {
        this.repository = repositoryProvider.getIfUnique();
    }
}

//或者这样也是一个不错的选择

@Service
public class FooService {
    private final FooRepository repository;
    public FooService(ObjectProvider<FooRepository> repositoryProvider) {
        this.repository = repositoryProvider.orderedStream().findFirst().orElse(null);
    }
}

@Configuration
public class SecurityCorsConfiguration {

	@Bean
	public FilterRegistrationBean corsFilter() {
		UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
		CorsConfiguration config = new CorsConfiguration();
		config.setAllowCredentials(true);
		config.addAllowedOrigin("http://localhost:4200");
		config.addAllowedHeader(CorsConfiguration.ALL);
		config.addAllowedMethod(CorsConfiguration.ALL);
		source.registerCorsConfiguration("/**", config);
		FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
		bean.setOrder(Ordered.HIGHEST_PRECEDENCE);
		return bean;
	}

}

@Configuration("casWebAppSecurityConfiguration")
@EnableConfigurationProperties(CasConfigurationProperties.class)
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
public class CasWebAppSecurityConfiguration implements WebMvcConfigurer {

public interface UserService {
    List<User> findAllUsers();

    @PostAuthorize ("returnObject.type == authentication.name")
    User findById(int id);

	//  @PreAuthorize("hasRole('ADMIN')") 必须拥有 ROLE_ADMIN 角色。
    @PreAuthorize("hasRole('ROLE_ADMIN ')")
    void updateUser(User user);

    @PreAuthorize("hasRole('ADMIN') AND hasRole('DBA')")
    void deleteUser(int id);

    // @PreAuthorize("principal.username.startsWith('Felordcn')") 用户名开头为 Felordcn 的用户才能访问。
    // @PreAuthorize("#id.equals(principal.username)") 入参 id 必须同当前的用户名相同。
    // @PreAuthorize("#id < 10") 限制只能查询 id 小于 10 的用户

}

@Secured({"ROLE_user"})
void updateUser(User user);

@Secured({"ROLE_admin", "ROLE_user1"})
void updateUser();

@Autowired
    private ConfigurableApplicationContext applicationContext;

    @Autowired
    private CasConfigurationProperties casProperties;

    @Autowired
    private ObjectProvider<SecurityProperties> securityProperties;

    @Autowired
    private ObjectProvider<PathMappedEndpoints> pathMappedEndpoints;

@Bean
public InitializingBean securityContextHolderInitialization() {
   return () -> SecurityContextHolder.setStrategyName(SecurityContextHolder.MODE_GLOBAL);
}

@Override
    public void addViewControllers(final ViewControllerRegistry registry) {
        registry.addViewController("/adminlogin")
            .setViewName("admin/casAdminLoginView");
        registry.setOrder(Ordered.HIGHEST_PRECEDENCE);
    }

@Override
    public void configure(final WebSecurity web) {
     //输出被忽略的URL
    }

    @Override
    protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
     //如果启动了JASS，java自己的认证框架，那么就初始化configureJaasAuthenticationProvider
     //如果使用了LDAP框架，那么就初始化configureLdapAuthenticationProvider
     //如果没有被配置过，那么就执行父类的配置
    }

    @Override
    protected void configure(final HttpSecurity http) throws Exception {
        http
            .csrf().disable() //关闭csrf防御
            .headers().disable() //关闭Spring向response中追加的header
            .logout().disable()//关闭logout
            //下面三行是为了进行https检测的
            .requiresChannel()
            .requestMatchers(r -> r.getHeader("X-Forwarded-Proto") != null)
            .requiresSecure();

        //换成自己的ExpressionInterceptUrlRegistry
        val requests = http.authorizeRequests()
            .expressionHandler(casWebSecurityExpressionHandler);

        val endpoints = casProperties.getMonitor()
            .getEndpoints().getEndpoint();
        endpoints.forEach(Unchecked.biConsumer((k, v) -> {
            val endpoint = EndpointRequest.to(k);
            v.getAccess().forEach(Unchecked.consumer(
                access -> configureEndpointAccess(http, requests, access, v, endpoint)));
        }));
        configureEndpointAccessToDenyUndefined(http, requests);
        configureEndpointAccessForStaticResources(requests);

        val beans = getApplicationContext()
            .getBeansOfType(ProtocolEndpointWebSecurityConfigurer.class
                            , false, true).values();
        beans.forEach(cfg -> cfg.configure(http));
    }

http.requiresChannel().requiresSecure();

.requiresChannel()
.requestMatchers(r -> r.getHeader("X-Forwarded-Proto") != null)
.requiresSecure();

List<Integer> integers = Arrays.asList(3, 9, 7, 6, 10, 20);
integers.forEach(i -> System.out.println(50 / i));
//通常的做法是通过try…catch来处理异常，防止系统崩溃。

List<Integer> integers = Arrays.asList(3, 9, 7, 0, 10, 20);
integers.forEach(i -> {
    try {
        System.out.println(50 / i);
    } catch (ArithmeticException e) {
        System.err.println(
          "Arithmetic Exception occured : " + e.getMessage());
    }
});

static Consumer<Integer> lambdaWrapper(Consumer<Integer> consumer) {
    return i -> {
        try {
            consumer.accept(i);
        } catch (ArithmeticException e) {
            System.err.println(
              "Arithmetic Exception occured : " + e.getMessage());
        }
    };
}

List<Integer> integers = Arrays.asList(3, 9, 7, 0, 10, 20);
integers.forEach(lambdaWrapper(i -> System.out.println(50 / i)));

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .inMemoryAuthentication()
            .withUser("admin").password("admin").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/resources/**", "/signup", "/about").permitAll()
                .antMatchers("/admin/**").hasRole("ADMIN")
                .antMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')")
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .usernameParameter("username")
                .passwordParameter("password")
                .failureForwardUrl("/login?error")
                .loginPage("/login")
                .permitAll()
                .and()
            .logout()
                .logoutUrl("/logout")
                .logoutSuccessUrl("/index")
                .permitAll()
                .and()
            .httpBasic()
                .disable();
    }