提供完整的实现springboot security在cas校验前另外加入新的校验方式，校验通过就跳过cas校验，没有通过才进入cas验证的demo代码

以下是一个基于Spring Boot和Spring Security的示例代码，它演示了如何在CAS认证之前添加自定义身份验证。

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomAuthenticationProvider customAuthenticationProvider;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/public/**").permitAll()
                .antMatchers("/private/**").authenticated()
                .and()
                .apply(new CasAuthenticationConfigurer<>())
                .casLoginUrl("https://your-cas-server.com/login")
                .casService("https://your-app.com/login/cas")
                .and()
                .addFilterBefore(new CustomAuthenticationFilter(), CasAuthenticationFilter.class);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthenticationProvider);
    }
}

首先，我们需要创建一个自定义的身份验证提供者(CustomAuthenticationProvider)，该提供者将执行我们的自定义身份验证逻辑。接下来，我们需要创建一个自定义的过滤器(CustomAuthenticationFilter)，它将在CAS认证之前执行我们的自定义身份验证。

public class CustomAuthenticationProvider implements AuthenticationProvider {

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        String username = authentication.getName();
        String password = authentication.getCredentials().toString();

        // 执行自定义身份验证逻辑

        if (customAuthenticationSucceeds) {
            List<GrantedAuthority> authorities = new ArrayList<>();
            authorities.add(new SimpleGrantedAuthority("ROLE_USER"));
            return new UsernamePasswordAuthenticationToken(username, password, authorities);
        } else {
            throw new BadCredentialsException("Custom authentication failed");
        }
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
}

CustomAuthenticationFilter将在CAS认证之前执行我们的自定义身份验证逻辑。如果自定义身份验证通过，它将设置一个authenticated标志，并将身份验证对象保存在SecurityContext中。

public class CustomAuthenticationFilter extends OncePerRequestFilter {

    private static final String AUTHENTICATED_FLAG = "CUSTOM_AUTHENTICATED";

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        if (request.getAttribute(AUTHENTICATED_FLAG) != null) {
            filterChain.doFilter(request, response);
            return;
        }

        String username = request.getParameter("username");
        String password = request.getParameter("password");

        // 执行自定义身份验证逻辑

        if (customAuthenticationSucceeds) {
            request.setAttribute(AUTHENTICATED_FLAG, true);
            Authentication authentication = new UsernamePasswordAuthenticationToken(username, password);
            SecurityContextHolder.getContext().setAuthentication(authentication);
            filterChain.doFilter(request, response);
        } else {
            response.sendRedirect("/login/cas");
        }
    }
}

最后，我们需要在SecurityConfig中添加CustomAuthenticationFilter，并将其放在CasAuthenticationFilter之前。

这样，当用户尝试访问需要身份验证的资源时，CustomAuthenticationFilter将首先执行自定义身份验证逻辑。如果自定义身份验证通过，用户将被授权并跳过CAS认证。否则，用户将被重定向到CAS登录页面。