其它系统与domino系统单点登录的实现方式

小程序：扫一扫查出行
【扫一扫了解最新限行尾号】
复制小程序

【背景】

随着企业中业务不断增多，用户处理不同的业务则须要频繁的切换不同的系统进行操作。而用户则须要记住各个系统的username、password，频繁的登录。假设各个系统间可以进行单点登录。无疑会大大降低用户反复输入password的困扰。

因为domino系统相对照较封闭。其它系统想相对安全的单点domino系统并不是易事。

或许有些人会说通过这个方案。通过模拟用户登录的方式就能够实现：

Names.nsf?login&username=xxx&password=xxx

可是。这样实现显然不太安全。一个须要单独记录用户的明文password（domino httppassword是不可逆算法）。

我知道两种实现方式相对安全：DSAPI和模拟LTPAToken。

本文介绍一种，通过dominoLTPAToken的生成方式实现单点登录的方法。

【实现原理】

输入參数

1.
username；

2.
登录系统时间；

3.
登录到期时间。

4. Domino密钥

输出參数

加密后的LTPAToken加密串

创建cookie

document.cookie= "LtpaToken="+ token + ";expires=" + exp.toGMTString() +";path=/;domain=.xxx.com";

token：加密token

expires：cookie到期时间

domain：单点域名，与dominoSSO配置文档同样，格式：.xxx.com

【參考代码】

java代码
import java.io.PrintWriter;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
import java.util.Properties;import lotus.domino.*;public class JavaAgent extends AgentBase { public void NotesMain() {
Session session = null;
AgentContext agentContext = null;
Document doc = null;
PrintWriter pw = null;
String token = "";
String sReturn = "false";
String sJson = "";
try {
pw = getAgentOutput();
session = getSession();
agentContext = session.getAgentContext();
doc = agentContext.getDocumentContext();
String sPara = doc.getItemValueString("query_string_decoded");
// 单点usernameloginName
String canonicalUser = sPara.substring(sPara.indexOf("sPara=")+6); // 单点起始时间
Date tokenCreation = new Date(new Date().getTime() - 60000 * 10);
String timeLimit="720";
// 单点到期时间
Date tokenExpires = new Date(tokenCreation.getTime() + Long.parseLong(timeLimit) * 60000);
// domino SSO 密钥（domino SSO配置文档的LTPA_DominoSecret域值）
String dominoSecret = "9BY2oinn1FmI42i3oNEnL3nNVPQ=";
token = LtpaToken.generate(canonicalUser, tokenCreation, tokenExpires, dominoSecret).getLtpaToken();
//System.out.println("token==ssobak==="+token);
sReturn = "true";
DominoTokenParser tokenParser = new DominoTokenParser();
System.out.println("username:"+tokenParser.parse(token,dominoSecret)); } catch(Exception e) {
e.printStackTrace();
}finally{
pw.println("Content-type: text/plain;charset=GB2312");
sJson = "{\"oResult\":\""+sReturn+"\",\"token\":\""+token+"\"}";
System.out.println("sJson="+sJson);
pw.println(sJson); //回收domino对象
fnRecycle(doc);
fnRecycle(agentContext);
fnRecycle(session); if(pw!=null){
pw.close();
}
}
} public void fnRecycle(Base object){
if(object != null){
try {
object.recycle();
} catch (NotesException e) {
// TODO 自己主动生成 catch 块
e.printStackTrace();
}
}
}
}
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Calendar;
import java.util.Date;
import java.util.Properties; /**
* Lightweight Third Party Authentication. Generates and validates ltpa tokens used in Domino single sign on
* environments. Does not work with WebSphere SSO tokens. You need a properties file named LtpaToken.properties which
* holds two properties.
*
* <pre>
* ) domino.secret=The base64 encoded secret found in the field LTPA_DominoSecret in the SSO configuration document.
* ) cookie.domain=The domain you want generated cookies to be from. e.g. '.domain.com' (Note the leading dot)
*</pre>
*
* @author $Author: rkelly $
* @version $Revision: 1.1 $
* @created $Date: 2003/04/07 18:22:14 $
*/
public final class LtpaToken {
private byte[] creation;
private Date creationDate;
private byte[] digest;
private byte[] expires;
private Date expiresDate;
private byte[] hash;
private byte[] header;
private String ltpaToken;
private Properties properties = null;
private byte[] rawToken;
private byte[] user; /**
* Constructor for the LtpaToken object
*
* @param token
* Description of the Parameter
*/
public LtpaToken(String token) {
init();
ltpaToken = token;
rawToken = Base64.decode(token);
user = new byte[(rawToken.length) - 40];
for (int i = 0; i < 4; i++) {
header[i] = rawToken[i];
}
for (int i = 4; i < 12; i++) {
creation[i - 4] = rawToken[i];
}
for (int i = 12; i < 20; i++) {
expires[i - 12] = rawToken[i];
}
for (int i = 20; i < (rawToken.length - 20); i++) {
user[i - 20] = rawToken[i];
}
for (int i = (rawToken.length - 20); i < rawToken.length; i++) {
digest[i - (rawToken.length - 20)] = rawToken[i];
}
creationDate = new Date(Long.parseLong(new String(creation), 16) * 1000);
expiresDate = new Date(Long.parseLong(new String(expires), 16) * 1000);
} /**
* Constructor for the LtpaToken object
*/
private LtpaToken() {
init();
} /**
* Gets the creationDate attribute of the LtpaToken object
*
* @return The creationDate value
*/
public Date getCreationDate() {
return creationDate;
} /**
* Gets the expiresDate attribute of the LtpaToken object
*
* @return The expiresDate value
*/
public Date getExpiresDate() {
return expiresDate;
} /**
* Gets the user attribute of the LtpaToken object
*
* @return The user value
*/
public String getCanonicalUser() {
return new String(user);
} public String getUser(String prefix, String suffix) {
String userName = new String(user);
if (prefix !=null && !prefix.equals("")) {
userName = userName.substring(userName.indexOf(prefix) + prefix.length());
}
if (suffix ==null || suffix.equals("")) {
suffix = "/";
}
return userName.substring(0, userName.indexOf("/"));
} public String getUser() {
return new String(user);
} /**
* Validates the SHA-1 digest of the token with the Domino secret key.
*
* @return Returns true if valid.
*/
public boolean isValid(LtpaTokenConfig config) {
boolean validDigest = false;
boolean validDateRange = false;
byte[] newDigest;
byte[] bytes = null;
Date now = new Date(); MessageDigest md = getDigest(); bytes = concatenate(bytes, header); bytes = concatenate(bytes, creation); bytes = concatenate(bytes, expires); bytes = concatenate(bytes, user); bytes = concatenate(bytes, Base64.decode(config.getDominoSecret())); newDigest = md.digest(bytes); validDigest = MessageDigest.isEqual(digest, newDigest); validDateRange = now.after(creationDate) && now.before(expiresDate); return validDigest & validDateRange;
} /**
* String representation of LtpaToken object.
*
* @return Returns token String suitable for cookie value.
*/
public String toString() {
return ltpaToken;
} /**
* Creates a new SHA-1 <code>MessageDigest</code> instance.
*
* @return The instance.
*/
private MessageDigest getDigest() {
try {
return MessageDigest.getInstance("SHA-1");
} catch (NoSuchAlgorithmException nsae) {
nsae.printStackTrace();
}
return null;
} /**
* Description of the Method
*/
private void init() { creation = new byte[8];
digest = new byte[20];
expires = new byte[8];
hash = new byte[20];
header = new byte[4]; } /**
* Validates the SHA-1 digest of the token with the Domino secret key.
*
* @param ltpaToken
* Description of the Parameter
* @return The valid value
*/
public static boolean isValid(String ltpaToken,LtpaTokenConfig config) {
LtpaToken ltpa = new LtpaToken(ltpaToken);
return ltpa.isValid(config);
} /**
* Generates a new LtpaToken with given parameters.
*
* @param canonicalUser
* User name in canonical form. e.g. 'CN=Robert Kelly/OU=MIS/O=EBIMED'.
* @param tokenCreation
* Token creation date.
* @param tokenExpires
* Token expiration date.
* @return The generated token.
*/
public static LtpaToken generate(String canonicalUser, Date tokenCreation, Date tokenExpires,String secret) {
LtpaToken ltpa = new LtpaToken();
System.out.println("Generating token for " + canonicalUser);
Calendar calendar = Calendar.getInstance();
MessageDigest md = ltpa.getDigest();
ltpa.header = new byte[] { 0, 1, 2, 3 };
byte[] token = null;
calendar.setTime(tokenCreation);
ltpa.creation = Long.toHexString(calendar.getTimeInMillis() / 1000).toUpperCase().getBytes();
calendar.setTime(tokenExpires);
ltpa.expires = Long.toHexString(calendar.getTimeInMillis() / 1000).toUpperCase().getBytes();
//try {
//canonicalUser = new String(canonicalUser.getBytes(), "GB2312");
//} catch (UnsupportedEncodingException e) {
// TODO 自己主动生成 catch 块
//e.printStackTrace();
//}
ltpa.user = canonicalUser.getBytes();
//ltpa.user = canonicalUser.getBytes(Charset.forName("GB18030")); token = concatenate(token, ltpa.header);
token = concatenate(token, ltpa.creation);
token = concatenate(token, ltpa.expires);
token = concatenate(token, ltpa.user);
md.update(token);
ltpa.digest = md.digest(Base64.decode(secret));
token = concatenate(token, ltpa.digest); return new LtpaToken(new String(Base64.encodeBytes(token,Base64.DONT_BREAK_LINES)));
} /**
* Helper method to concatenate a byte array.
*
* @param a
* Byte array a.
* @param b
* Byte array b.
* @return a + b.
*/
private static byte[] concatenate(byte[] a, byte[] b) {
if (a == null) {
return b;
} else {
byte[] bytes = new byte[a.length + b.length]; System.arraycopy(a, 0, bytes, 0, a.length);
System.arraycopy(b, 0, bytes, a.length, b.length);
return bytes;
}
} public String getLtpaToken() {
return ltpaToken;
} public void setLtpaToken(String ltpaToken) {
this.ltpaToken = ltpaToken;
}
}
js代码
function fnSSO(){
if(document.getElementById("username").value==""){
alert("请输入登录名！");
document.getElementById("username").focus();
return false;
}
var objHTTP= new ActiveXObject("Microsoft.XMLHTTP");
var sDbPath = document.getElementById("DbFilePath").value;
var sPara = document.getElementById("username").value;
var vurl = "/"+sDbPath+"/"+"ajaxSSO" + "?openagent&sPara=" + sPara;
objHTTP.open("GET", vurl, false, "", "");
objHTTP.setRequestHeader("If-Modified-Since","0");
objHTTP.send(false);
var getOptions = objHTTP.responseText;
getOptions = getOptions.replace(/\n/ig,"");
var oOptions = eval("(" + getOptions + ")");
var sReturn = "";
if(oOptions && oOptions.oResult=="true"){
var Days = 30;
var exp = new Date();
exp.setTime(exp.getTime() + Days*24*60*60*1000);
var token = oOptions.token;
if(token!=""){
// 创建单点cookie
document.cookie = "LtpaToken="+ token + ";expires=" + exp.toGMTString() + ";path=/;domain=.xxx.com";
}
sReturn = sPara + "：单点登录成功！"
}else{
sReturn = sPara + "：单点失败。"
}document.getElementById("ssoinfo").innerHTML = "<font color='red'>" + sReturn + "</font>";
// 页面跳转
location.href = "http://xxx.com/xxx.nsf/xxx?openform";
}