开源的CAS已经很多牛人分析过了，最近在看源码，也总结一下
AuthenticationFilter.java主要代码
/**
* 这里用到了责任链模式，filterChain里面包含了web.xml里面配置的所有Filter，每次执行filterChain的doFilter()时，会执行下一个Filter的doFilter方法
* 可以查看ApplicationFilterChain的源码http://javapolo.iteye.com/blog/1287747
*/
public final void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse, final FilterChain filterChain) throws IOException, ServletException {
final HttpServletRequest request = (HttpServletRequest) servletRequest;
final HttpServletResponse response = (HttpServletResponse) servletResponse;
final HttpSession session = request.getSession(false);
//assertion的值会一直为空，因为一直都执行不到this.gatewayStorage.storeGatewayInformation(request, serviceUrl)
//只有在web.xml里面配置了gateway属性为ture，才会执行到
//什么时候才要配置gateway为true?
final Assertion assertion = session != null ? (Assertion) session.getAttribute(CONST_CAS_ASSERTION) : null;
if (assertion != null) {
filterChain.doFilter(request, response);
return;
}
//从request中构造服务URL
final String serviceUrl = constructServiceUrl(request, response);
/**
* getArtifactParameterName()的值是在AbstractCasFilter初始化时执行setArtifactParameterName()时赋的值，我们在web.xml中没有配置，所以默认是“ticket”
* safeGetParameter(request,getArtifactParameterName())会从request的请求链接中返回参数“ticket”的值
*/
final String ticket = CommonUtils.safeGetParameter(request,getArtifactParameterName());
//判断request的session里面是否有CONST_CAS_GATEWAY属性，如果有，则从session里面清除这个属性，并return true;
//这段代码的作用？
final boolean wasGatewayed = this.gatewayStorage.hasGatewayedAlready(request, serviceUrl);
if (CommonUtils.isNotBlank(ticket) || wasGatewayed) {
filterChain.doFilter(request, response);
return;
}
final String modifiedServiceUrl;
log.debug("no ticket and no assertion found");
//这个值在web.xml中没有配置，所以为false
if (this.gateway) {
log.debug("setting gateway attribute in session");
modifiedServiceUrl = this.gatewayStorage.storeGatewayInformation(request, serviceUrl);
} else {
modifiedServiceUrl = serviceUrl;
}
if (log.isDebugEnabled()) {
log.debug("Constructed service url: " + modifiedServiceUrl);
}
//根据参数构造重定向URL，URL为登陆界面，并把当前访问的路径作为参数拼加到URL之后
final String urlToRedirectTo = CommonUtils.constructRedirectUrl(this.casServerLoginUrl, getServiceParameterName(), modifiedServiceUrl, this.renew, this.gateway);
if (log.isDebugEnabled()) {
log.debug("redirecting to \"" + urlToRedirectTo + "\"");
}
//重定向到服务器端
response.sendRedirect(urlToRedirectTo);
}