基于LDAP的单点登录方案的设计与实现(最终版)

大连理工大学本科毕业设计（论文）基于LDAPLDAPLDAPLDAP的单点登录方案的设计与实现TheTheTheThedesigndesigndesigndesignandandandandimplementationimplementationimplementationimplementationofofofofSSOSSOSSOSSOschemeschemeschemeschemebasedbasedbasedbasedononononLDAPLDAPLDAPLDAP学院（系）：专业：学生姓名：学号：指导教师：评阅教师：完成日期：大连理工大学DalianUniversityofTechnology基于LDAP的单点登录方案的设计与实现-I-摘要随着信息化建设的不断深入，学校或企业等公共场所的内部有很多信息管理系统，用户使用这些系统时需要进行身份认证。传统的认证机制是基于用户名和密码的，每一个系统都建立有自己的用户信息数据库，用来验证用户的身份。对于一个要访问不同系统的用户，每进入一个系统就要登录一次，这无疑会耗费大量的时间，同时用户也需要记忆大量的账号信息。单点登录系统就是为了解决这样问题而产生的，它统一管理各个应用系统用户的身份验证，并能够将验证信息安全、高效地传递给各个系统。这样，用户只需要参与一次身份认证过程，获得身份验证系统授权的身份标识。以后用户登录别的应用系统时，可以用这个身份标识去通过单点身份验证系统的认证，从而使用户可以高效地访问各个系统中的资源，提高工作效率。由于所有的用户的认证都归身份管理系统管理，所以它的用户信息的存储控制就显得极为重要。基于LDAP的目录服务，能够为网络身份管理系统提供高可靠的数据存储和高性能的数据查询能力，同时它是跨平台的标准协议，应用程序不用为LDAP目录放在什么样的服务器上操心。所以目前，有大量的应用系统都开始采用LDAP目录服务器作为用户身份信息认证管理的服务器。本文给出了J2EE平台下，基于LDAP目录服务的单点登录在校园身份管理系统中的实现方案。关键词：关键词：关键词：关键词：LDAPLDAPLDAPLDAP；轻量级目录访问协议；；轻量级目录访问协议；；轻量级目录访问协议；；轻量级目录访问协议；WebWebWebWebSSOSSOSSOSSO；单点登录；单点登录；单点登录；单点登录；；；；身份认证系统身份认证系统身份认证系统身份认证系统基于LDAP的单点登录方案的设计与实现-II-TheTheTheThedesigndesigndesigndesignandandandandimplementationimplementationimplementationimplementationofofofofSSOSSOSSOSSOschemeschemeschemeschemebasedbasedbasedbasedononononLDAPLDAPLDAPLDAPAbstractWiththedevelpmentofinformation,manyschoolsandcorporationshavedevelopedkindsofinformationmanagementsystems.Usersneedtoauthenticateidentitywhentheyusethesesystems.Thetraditionalauthenticationmechanismisbasedontheusernameandpassword,andeverysystemhasestablishedauserinformationdatabase,toauthenticatetheidentityoftheuser.Whenanuserwantstoaccessdifferentsystems,hemustinputdifferentaccountinformationtoentercorrespondingsystems.Thismechanismwastesuser'stimeandmakeuserrememberalargenumberofaccountinformation.SingleSignOnisintroducedtoresolvethisproblem.Itunifiedlymanageseveryuser'sidentityauthenticationofvariousapplications,andauthenticationinformationcanbesafelyandefficientlytransferedtothevarioussystems.Inthisway,usersonlyneedtoparticipateinoneauthenticationprocess,andgettheidentifierofauthenticationsystem.Afterusersloginotherapplications,theycanusethisidentifiertoadopttheauthenticationofidentitymanagementsystem,sothatuserscanefficientlyaccessthevarioussystemsandenhanceefficiency.Becauseidentitymanagementsystemmanagesalltheuser'sidentityauthentication,itscontrolonthestorageofuser'informationisextremelyimportant.LDAP-baseddirectoryservice,isabletoprovidehighlyreliabledatastorageandhigh-performancedatasearchforidentitymanagementsystemonnetwork.Atthesametime,itisastandardcross-platformprotocols,applicationsdonothavetoknowwhatkindofserverisLDAPdirectorydeployed.Therefore,atpresent,alargenumberofapplicationsarebeginningtouseLDAPdirectoryserverasauseridentityauthenticationmanagementserver.Inmypaper,IexplaintheimplementationoftheSSOschemeinthecampusidentitymanagementsystembasedonLDAPdirectoryservices,undertheJ2EEplatform.KeyKeyKeyKeyWordsWordsWordsWords：LDAPLDAPLDAPLDAP；LightweightLightweightLightweightLightweightDirectoryDirectoryDirectoryDirectoryAccessAccessAccessAccessProtocolProtocolProtocolProtocol；；；；SingleSingleSingleSingleSignSignSignSignOnOnOnOn；；；；WebWebWebWebSSSSSSSSOOOO；；；；IdentityIdentityIdentityIdentityAuthenticationAuthenticationAuthenticationAuthenticationSystemSystemSystemSystem基于LDAP的单点登录方案的设计与实现-III-目录摘要.....................................................................................................................................IAbstract......................................................................................................................................II1绪论..........................................................................................................................................11.1项目背景......................................................................................................................11.2单点登录系统介绍......................................................................................................11.3本文的组织与结构......................................................................................................22单点登录模型研究..................................................................................................................42.1身份管理的内容和发展...............................................................................................42.2传统的用户登录模式..................................................................................................52.3单点登录模式..............................................................................................................63LDAP目录访问协议..............................................................................................................83.1目录访问协议..............................................................................................................83.1.1目录服务概述...................................................................................................83.1.2X.500目录访问协议.........................................................................................83.1.3LDAP目录访问协议......