单点登录实现（spring session+redis完成session共享）

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.alibaba.fastjson.JSONObject;
import com.hjz.sso.utils.RestTemplateUtil;

public class SSOFilter implements Filter{

    public static Logger logger = LoggerFactory.getLogger(SSOFilter.class);
    
    private String SSO_SERVER_URL;
    private String SSO_SERVER_VERIFY_URL;
    
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        SSO_SERVER_URL = filterConfig.getInitParameter("SSO_SERVER_URL");
        SSO_SERVER_VERIFY_URL = filterConfig.getInitParameter("SSO_SERVER_VERIFY_URL");
        if(SSO_SERVER_URL == null) logger.error("SSO_SERVER_URL is null.");
        if(SSO_SERVER_VERIFY_URL == null) logger.error("SSO_SERVER_VERIFY_URL is null.");
    }
    
    @Override
    public void doFilter(ServletRequest req, ServletResponse res,
            FilterChain chain) throws IOException, ServletException {
         HttpServletRequest request = (HttpServletRequest) req;
         HttpServletResponse response = (HttpServletResponse) res;
         //请求中带有token，去sso-server验证token是否有效
         String authority = null;
         if(request.getParameter("token") != null) {
            boolean verifyResult = this.verify(request, SSO_SERVER_VERIFY_URL, request.getParameter("token"));
            if (verifyResult) {
                chain.doFilter(req, res);
                return;
            } else {
                authority = "token->" + request.getParameter("token") + " is invalidate.";
            }
         }
         
         HttpSession session = request.getSession();
         if (session.getAttribute("login") != null && (boolean)session.getAttribute("login") == true) {
            chain.doFilter(req, res);
            return;
         }
         //跳转至sso认证中心
         String callbackURL = request.getRequestURL().toString();
         StringBuilder url = new StringBuilder();
         url.append(SSO_SERVER_URL).append("?callbackURL=").append(callbackURL);
         if(authority != null) {
             url.append("&authority=").append(authority);
         }
         response.sendRedirect(url.toString());
    }
    
    private boolean verify(HttpServletRequest request, String verifyUrl, String token) {
        String result = RestTemplateUtil.get(request, verifyUrl + "?token=" + token, null);
        JSONObject ret = JSONObject.parseObject(result);
        if("success".equals(ret.getString("code"))) {
            return true;
        }
        logger.error(request.getRequestURL().toString() + " : " + ret.getString("msg"));
        return false;
    }

    @Override
    public void destroy() {
    }

}

import java.util.UUID;

import javax.servlet.http.HttpSession;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;

@Controller
@RequestMapping("sso")
public class LoginController {
    private Logger logger = LoggerFactory.getLogger(LoginController.class);
    
    @RequestMapping(value="login", method={RequestMethod.GET, RequestMethod.POST})
    public String login(HttpSession session, Model model,
            @RequestParam(value="name", required=false) String name,
            @RequestParam(value="password", required=false) String password) {
        if(name == null && password == null) return "login";
        if("admin".equals(name) && "admin".equals(password)) {
            String token = UUID.randomUUID().toString();
            session.setAttribute("login", true);
            session.setAttribute("token", token);
            return "index";
        } else {
            model.addAttribute("error", true);
            model.addAttribute("message", "用户名或密码错误。");
            return "login";
        }
    }
}

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;

import com.alibaba.fastjson.JSONObject;

@Controller
@RequestMapping("sso")
public class ValidateController {
    
    @RequestMapping("verify")
    @ResponseBody
    public JSONObject verify(HttpServletRequest request, @RequestParam String token) {
        HttpSession session = request.getSession();
        JSONObject result = new JSONObject();
        if(session.getAttribute("token") != null && token.equals(session.getAttribute("token"))) {
            result.put("code", "success");
            result.put("msg", "认证成功");
        } else {
            result.put("code", "failure");
            result.put("msg", "token已失效，请重新登录！");
        }
        return result;
    }
    
}

<filter>
    <filter-name>ssoFilter</filter-name>
    <filter-class>com.hjz.sso.filter.SSOFilter</filter-class>
    <init-param>
        <param-name>SSO_SERVER_URL</param-name>
        <param-value>http://localhost:8088/sso-server/sso/login</param-value>
    </init-param>
    <init-param>
        <param-name>SSO_SERVER_VERIFY_URL</param-name>
        <param-value>http://localhost:8088/sso-server/sso/verify</param-value>
    </init-param>
</filter>

<filter-mapping>
    <filter-name>ssoFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>