使用JAAS文件登陆kerberos（zookeeper）
Kerberos 5 Configuration
Since the SPNEGO mechanism will call JGSS, which in turns calls the Kerberos V5 login module to do real works. Kerberos 5 configurations are needed. which includes:
- Some way to provide Kerberos configurations. This can be achieved with the Java system property
java.security.krb5.conf. For example:
java -Djava.security.krb5.conf=krb5.conf \
-Djavax.security.auth.useSubjectCredsOnly=false \
ClassName
- A JAAS config file denoting what login module to use. HTTP SPNEGO codes will look for the standard entry named
com.sun.security.jgss.krb5.initiate.
For example, you can provide a file spnegoLogin.conf:
com.sun.security.jgss.krb5.initiate {
com.sun.security.auth.module.Krb5LoginModule
required useTicketCache=true;
};
and run java with:
java -Djava.security.krb5.conf=krb5.conf \
-Djava.security.auth.login.config=spnegoLogin.conf \
-Djavax.security.auth.useSubjectCredsOnly=false \
ClassName
JAAS：https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_73/rzaha/rzahajaas10.htm
ZooKeeperSaslClient
在使用带Kerberos的zookeeper时，连接前需要进行认证，但是需要通过jaas机制去登陆Kerberos，这时候需要给JVM设置jaas.conf配置文件，zookeeper源码种等登陆模块如下：
public ZooKeeperSaslClient(String serverPrincipal, ZKClientConfig clientConfig) throws LoginException {
this.saslState = ZooKeeperSaslClient.SaslState.INITIAL;
this.gotLastPacket = false;
String clientSection = clientConfig.getProperty("zookeeper.sasl.clientconfig", "Client");
this.clientConfig = clientConfig;
AppConfigurationEntry[] entries = null;
Object runtimeException = null;
try {
entries = Configuration.getConfiguration().getAppConfigurationEntry(clientSection);
} catch (SecurityException var8) {
runtimeException = var8;
} catch (IllegalArgumentException var9) {
runtimeException = var9;
}
if (entries != null) {
this.configStatus = "Will attempt to SASL-authenticate using Login Context section '" + clientSection + "'";
this.saslClient = this.createSaslClient(serverPrincipal, clientSection);
} else {
this.saslState = ZooKeeperSaslClient.SaslState.FAILED;
String explicitClientSection = clientConfig.getProperty("zookeeper.sasl.clientconfig");
if (explicitClientSection != null) {
if (runtimeException != null) {
throw new LoginException("Zookeeper client cannot authenticate using the " + explicitClientSection + " section of the supplied JAAS configuration: '" + clientConfig.getJaasConfKey() + "' because of a RuntimeException: " + runtimeException);
}
throw new LoginException("Client cannot SASL-authenticate because the specified JAAS configuration section '" + explicitClientSection + "' could not be found.");
}
String msg = "Will not attempt to authenticate using SASL ";
if (runtimeException != null) {
msg = msg + "(" + runtimeException + ")";
} else {
msg = msg + "(unknown error)";
}
this.configStatus = msg;
this.isSASLConfigured = false;
if (clientConfig.getJaasConfKey() != null) {
if (runtimeException != null) {
throw new LoginException("Zookeeper client cannot authenticate using the '" + clientConfig.getProperty("zookeeper.sasl.clientconfig", "Client") + "' section of the supplied JAAS configuration: '" + clientConfig.getJaasConfKey() + "' because of a RuntimeException: " + runtimeException);
}
throw new LoginException("No JAAS configuration section named '" + clientConfig.getProperty("zookeeper.sasl.clientconfig", "Client") + "' was found in specified JAAS configuration file: '" + clientConfig.getJaasConfKey() + "'.");
}
}
}
可以看处，默认读取的时Client模块下的配置，也会从zookeeper.sasl.clientconfig种读取。其登陆代码如下：
private SaslClient createSaslClient(String servicePrincipal, String loginContext) throws LoginException {
try {
if (!this.initializedLogin) {
synchronized(this) {
if (this.login == null) {
if (LOG.isDebugEnabled()) {
LOG.debug("JAAS loginContext is: " + loginContext);
}
this.login = new Login(loginContext, new ZooKeeperSaslClient.ClientCallbackHandler((String)null), this.clientConfig);
this.login.startThreadIfNeeded();
this.initializedLogin = true;
}
}
}
Subject subject = this.login.getSubject();
SaslClient saslClient;
if (subject.getPrincipals().isEmpty()) {
LOG.info("Client will use DIGEST-MD5 as SASL mechanism.");
String[] mechs = new String[]{"DIGEST-MD5"};
String username = (String)((String)subject.getPublicCredentials().toArray()[0]);
String password = (String)((String)subject.getPrivateCredentials().toArray()[0]);
saslClient = Sasl.createSaslClient(mechs, username, "zookeeper", "zk-sasl-md5", (Map)null, new ZooKeeperSaslClient.ClientCallbackHandler(password));
return saslClient;
} else {
boolean usingNativeJgss = this.clientConfig.getBoolean("sun.security.jgss.native");
if (usingNativeJgss) {
try {
GSSManager manager = GSSManager.getInstance();
Oid krb5Mechanism = new Oid("1.2.840.113554.1.2.2");
GSSCredential cred = manager.createCredential((GSSName)null, 0, krb5Mechanism, 1);
subject.getPrivateCredentials().add(cred);
} catch (GSSException var16) {
LOG.warn("Cannot add private credential to subject; authentication at the server may fail", var16);
}
}
Object[] principals = subject.getPrincipals().toArray();
Principal clientPrincipal = (Principal)principals[0];
KerberosName clientKerberosName = new KerberosName(clientPrincipal.getName());
String serverRealm = this.clientConfig.getProperty("zookeeper.server.realm", clientKerberosName.getRealm());
KerberosName serviceKerberosName = new KerberosName(servicePrincipal + "@" + serverRealm);
final String serviceName = serviceKerberosName.getServiceName();
final String serviceHostname = serviceKerberosName.getHostName();
final String clientPrincipalName = clientKerberosName.toString();
try {
saslClient = (SaslClient)Subject.doAs(subject, new PrivilegedExceptionAction<SaslClient>() {
public SaslClient run() throws SaslException {
ZooKeeperSaslClient.LOG.info("Client will use GSSAPI as SASL mechanism.");
String[] mechs = new String[]{"GSSAPI"};
ZooKeeperSaslClient.LOG.debug("creating sasl client: client=" + clientPrincipalName + ";service=" + serviceName + ";serviceHostname=" + serviceHostname);
SaslClient saslClient = Sasl.createSaslClient(mechs, clientPrincipalName, serviceName, serviceHostname, (Map)null, new ZooKeeperSaslClient.ClientCallbackHandler((String)null));
return saslClient;
}
});
return saslClient;
} catch (Exception var15) {
LOG.error("Exception while trying to create SASL client", var15);
var15.printStackTrace();
return null;
}
}
} catch (LoginException var18) {
throw var18;
} catch (Exception var19) {
LOG.error("Exception while trying to create SASL client: " + var19);
return null;
}
}
This is jaas.conf:
Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
doNotPrompt=true
useTicketCache=true
principal="test"
keyTab="/home/keytab/user.keytab";
};
Then set Java Options like :
--Djava.security.auth.login.config=/data/disk1/conf/jaas.conf -Djavax.security.auth.useSubjectCredsOnly=false
其他情况下，会使用com.sun.security.jgss.krb5.initiate来登陆，所以jaas.conf的配置如下：
com.sun.security.jgss.krb5.initiate {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
keyTab="/data/disk1/conf/test.keytab"
principal="test"
doNotPrompt=true;
};
