java 如何使用 Spring 和 Active Directory 实现单点登录
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/17973579/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to implement Single Sign On using Spring and Active Directory
提问by Lawrence Tierney
I have a Spring based Web App which I would like to implement a Single Sign On solution on.
我有一个基于 Spring 的 Web 应用程序，我想在它上面实现单点登录解决方案。
The basic flow would be:
基本流程是：
1) User logs in into Windows Workstation/Desktop PC (authenticating against organisation's Active Directory)
1) 用户登录到 Windows Workstation/Desktop PC（根据组织的 Active Directory 进行身份验证）
2) User opens browser and navigates to Spring Web App.
2) 用户打开浏览器并导航到 Spring Web App。
3) Spring Web App somehowconfirms that the user is already authenticated against AD and seamlessly lets them in. i.e. no challenge for username and password. Infact, the Spring web app would NEVER show a login form.
3) Spring Web App以某种方式确认用户已经通过 AD 身份验证并无缝地让他们进入。即没有对用户名和密码的挑战。事实上，Spring Web 应用程序永远不会显示登录表单。
Obviously it's step 3 I am having trouble with.
显然，这是我遇到的问题的第 3 步。
I have looked at Spring Security, Kerberos, SPNEGO but I think I've just confused myself.
我看过 Spring Security、Kerberos、SPNEGO，但我想我只是把自己弄糊涂了。
If it makes a difference I am using Java 6, running on Jetty with Spring 3. The Jetty instance will be running on a *Nix machine.
如果它有所不同，我将使用 Java 6，在 Spring 3 的 Jetty 上运行。Jetty 实例将在 *Nix 机器上运行。
回答by ManojP
I have implemented the same thing for my client. We are using spring-saml in our spring based web application (acts as Service Provider) and ADFS as Identity Provider(IDP).
我已经为我的客户实现了同样的事情。我们在基于 spring 的 Web 应用程序（充当服务提供者）和 ADFS 中使用 spring-saml 作为身份提供者（IDP）。
You can take help from this linkfor configuration part. I will help you out if you face any problem related to implementation or setup issue.
您可以从此链接获取配置部分的帮助。如果您遇到与实施或设置问题相关的任何问题，我会帮助您。
Basically your web-app will act as SP and ADFS will be treated as IDP. You need to exchange both metadata file which is nothing but a certificate for communication.
基本上，您的网络应用程序将充当 SP，而 ADFS 将被视为 IDP。您需要交换这两个元数据文件，这只是用于通信的证书。
