Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

feat(auth): support standard CAS 2.0/3.0 SSO protocol

Open
  • Is something wrong?
#456 6 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

  • #464 by @dongmucat — closed without merging

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Quiet
Tech stack
java, spring
Domain
api, authentication, backend

Research direction

Read the existing IdentityBindingService, OAuthLoginRedirectSupport, and RouteSecurityPolicyRegistry, then trace the current OAuth login flow and the closed PRs #444 and #464. The issue lists the planned CAS properties, ticket validator, controller, claims adapter, runtime config, tests, and deployment documentation. Done means standard CAS 3.0 JSON login works with CAS 2.0 XML fallback, identity binding and return URL handling are reused, and the feature is disabled by default.

Written by the indexing model from the issue text.

Description

effort/l enhancement priority/p2 risk/high triage/core

背景

在 #444 的 review 中，我们决定不合并基于私有协议的 SSO 实现，转而支持标准 CAS 2.0/3.0 协议，使 OSS 用户可以对接 Apereo CAS Server、Keycloak CAS adapter 等主流实现。

关联 PR：#444（已关闭）

目标

实现标准 CAS 2.0/3.0 协议的 SSO 登录集成，复用现有 IdentityBindingService 身份映射抽象。

设计要点

协议支持
  • CAS 2.0：GET /serviceValidate?ticket=...&service=... → XML 响应
  • CAS 3.0：GET /p3/serviceValidate?ticket=...&service=...&format=JSON → JSON 响应
  • 优先实现 3.0 JSON 模式，兼容 2.0 XML fallback
架构原则
  1. 复用 IdentityBindingService：将 CAS attributes 适配为通用 IdentityClaims（需先将 IdentityBindingService.bindOrCreate 的入参从 OAuthClaims 抽象为 provider-neutral 接口）
  2. 复用 OAuthLoginRedirectSupport.sanitizeReturnTo()：防止 open redirect
  3. HTTPS 强校验：@PostConstruct 校验 CAS server URL 必须为 HTTPS（或提供显式 escape hatch 用于开发环境）
  4. Feature flag：默认 disabled，通过 skillhub.auth.cas.enabled=true 启用
配置项（初步）
skillhub:
  auth:
    cas:
      enabled: false
      server-url: https://cas.example.com  # CAS server base URL
      service-url: https://skillhub.example.com/api/v1/auth/cas/callback
      protocol-version: 3.0  # 2.0 | 3.0
      attributes:
        username: uid          # CAS attribute → platform username
        display-name: cn       # CAS attribute → display name
        email: mail            # CAS attribute → email (optional)
前端
  • 登录页新增"CAS 登录"按钮，由 runtime config authCasEnabled 控制显隐
  • 复用 #444 中 SsoLoginEntry 的 UI 模式

实现步骤

  • 重构：将 IdentityBindingService.bindOrCreate(OAuthClaims) 抽象为 IdentityClaims 接口，OAuth 和 CAS 各自实现
  • 后端：CasProperties 配置类 + @PostConstruct 校验
  • 后端：CasTicketValidator（GET serviceValidate，解析 XML/JSON）
  • 后端：CasLoginController（/login 重定向 + /callback 票据验证）
  • 后端：CasIdentityClaims 适配器，调用 IdentityBindingService
  • 后端：RouteSecurityPolicyRegistry 放行 /api/v1/auth/cas/**
  • 前端：CasLoginEntry 组件 + runtime config
  • 前端：30-runtime-config.sh 添加 SKILLHUB_WEB_AUTH_CAS_ENABLED
  • 测试：CasTicketValidator 单测（mock XML/JSON 响应）
  • 测试：CasLoginController 单测（redirect / callback / error）
  • 文档：部署文档补充 CAS 配置说明

参考

备注

  • 如果内部部署需要对接非标准 CAS 协议（如讯飞内部 SSO 网关），建议作为独立私有模块维护，不进 OSS 主干
  • 可考虑直接使用 spring-security-cas 模块，但需评估与现有 PlatformSessionService 的集成成本
Dominant language
Java
Stars
5.2k
Forks
841
Avg merge
1d 4h
Merged PRs (30d)
77

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from iflytek/skillhub

All issues in iflytek/skillhub

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.