Kerberos http身份认证原理及例子

2021-05-14  本文已影响0人  _Kantin

相关概念说明

SPNEGO Web认证的优点

JDK中Kerberos的认证原理

Kerberos认证流程
LoginContext
#Krb5LoginModule, JndiLoginModule
org.apache.hadoop.security.SecureClientLogin. loginUserFromKeytab
org.apache.hadoop.security.SecureClientLogin.loginUserWithPassword
image.png
LoginModule
public synchronized static Subject loginUserWithPassword(String user, String password) throws IOException {
   try {
      Subject subject = new Subject();
      SecureClientLoginConfiguration loginConf = new SecureClientLoginConfiguration(false, user, password);
      LoginContext login = new LoginContext("hadoop-keytab-kerberos", subject, null, loginConf);
      subject.getPrincipals().add(new User(user, AuthenticationMethod.KERBEROS, login));
      login.logout();
      login.login();
      return login.getSubject();
   } catch (LoginException le) {
      throw new IOException("Login failure for " + user + " using password ****", le);
   }
}
综上所述:kerberos的登录流程，是由LoginContet/LoginModule完成的，成果是Subject对象。

客户端与服务端交互

kerberos http请求机制

Kerberos鉴权原理

4.特别注意！！这里请求的服务端的hostname一定要和principal的角色名一样(principal组成:用户名/角色@realm域),并配置好相关的hosts,千万不能用ip访问(切记kerberos规则都是用域名的)

从程序的角度看请求过程

package com.xxxxxx.kantlin.kerberos;
import org.apache.commons.io.IOUtils;
import org.apache.http.HttpResponse;
import java.io.InputStream;
import java.nio.charset.StandardCharsets;
import java.util.Arrays;

public class Main {
    public static void main(String[] args) {
        params();
    }
    public static void params() {
        //client principal！最好和service principal的一致
        String user = "xxxxxx/hive2@<realm>";
        //client的keytab文件，没有的话先kinit一下
        String keytab = "C:\\\\Users\\\\xxxxx\\\\Desktop\\\\keytab\\\\hive2.keytab";
        //kerberos krb5文件(ps:一般机器上都有，找不到的话执行命令:find / -name krb5.conf)
        String krb5Location = "C:\\Users\\xxxxx\\Desktop\\keytab\\krb5.conf";
        try {
            //此处的true为将kerberos设置为debug模式,将打印更多详细日志
            RequestKerberosUrlUtils restTest = new RequestKerberosUrlUtils(user, keytab, krb5Location, true);
            //此处为开启了kerberos http认证的ranger admin 为例,url中带secure表示运行在高安全模式
            //特别重要！！这里请求的hostname一定要和principal的FQDN（hive2)一样,并配置好相关的hosts,千万不能用ip(切记kerberos都是域名)
            String url_liststatus = "http://hive2:6080/service/plugins/secure/policies/download/hive2";
            HttpResponse response = restTest.callRestUrl(url_liststatus, user);
            InputStream is = response.getEntity().getContent();
            System.out.println("Status code " + response.getStatusLine().getStatusCode());
            System.out.println("message is :" + Arrays.deepToString(response.getAllHeaders()));
            System.out.println("string：\n" + new String(IOUtils.toByteArray(is), StandardCharsets.UTF_8));
        } catch (Exception exp) {
            exp.printStackTrace();
        }
    }
}


package com.xxxxxx.kantlin.kerberos;
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.serializer.SerializerFeature;
import org.apache.http.HttpResponse;
import org.apache.http.auth.AuthSchemeProvider;
import org.apache.http.auth.AuthScope;
import org.apache.http.auth.Credentials;
import org.apache.http.client.HttpClient;
import org.apache.http.client.config.AuthSchemes;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpUriRequest;
import org.apache.http.config.Lookup;
import org.apache.http.config.RegistryBuilder;
import org.apache.http.impl.auth.SPNegoSchemeFactory;
import org.apache.http.impl.client.BasicCredentialsProvider;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClientBuilder;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import javax.security.auth.Subject;
import javax.security.auth.kerberos.KerberosPrincipal;
import javax.security.auth.login.AppConfigurationEntry;
import javax.security.auth.login.Configuration;
import javax.security.auth.login.LoginContext;
import java.io.IOException;
import java.security.Principal;
import java.security.PrivilegedAction;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Set;

public class RequestKerberosUrlUtils {
    private String principal;
    private String keyTabLocation;

    public RequestKerberosUrlUtils() {
    }

    public RequestKerberosUrlUtils(String principal, String keyTabLocation) {
        super();
        this.principal = principal;
        this.keyTabLocation = keyTabLocation;
    }

    public RequestKerberosUrlUtils(String principal, String keyTabLocation, boolean isDebug) {
        this(principal, keyTabLocation);
        if (isDebug) {
            System.setProperty("sun.security.spnego.debug", "true");
            System.setProperty("sun.security.krb5.debug", "true");
        }
    }

    public RequestKerberosUrlUtils(String principal, String keyTabLocation, String krb5Location, boolean isDebug) {
        this(principal, keyTabLocation, isDebug);
        System.setProperty("java.security.krb5.conf", krb5Location);
    }

    private static HttpClient buildSpengoHttpClient() {
        HttpClientBuilder builder = HttpClientBuilder.create();
        Lookup<AuthSchemeProvider> authSchemeRegistry = RegistryBuilder.<AuthSchemeProvider>create().
                register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory(true)).build();
        builder.setDefaultAuthSchemeRegistry(authSchemeRegistry);
        BasicCredentialsProvider credentialsProvider = new BasicCredentialsProvider();
        credentialsProvider.setCredentials(new AuthScope(null, -1, null), new Credentials() {
            @Override
            public Principal getUserPrincipal() {
                return null;
            }
            @Override
            public String getPassword() {
                return null;
            }
        });
        builder.setDefaultCredentialsProvider(credentialsProvider);
        CloseableHttpClient httpClient = builder.build();
        return httpClient;
    }

    public HttpResponse callRestUrl(final String url, final String userId) {
        System.out.println(String.format("Calling KerberosHttpClient %s %s %s", this.principal, this.keyTabLocation, url));
        Configuration config = new Configuration() {
            @SuppressWarnings("serial")
            @Override
            public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
                return new AppConfigurationEntry[]{new AppConfigurationEntry("com.sun.security.auth.module.Krb5LoginModule",
                        AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, new HashMap<String, Object>() {
                    {
                        //Krb5 in GSS API needs to be refreshed so it does not throw the error
                        //Specified version of key is not available
                        put("useTicketCache", "false");
                        put("useKeyTab", "true");
                        put("keyTab", keyTabLocation);
                        put("refreshKrb5Config", "true");
                        put("principal", principal);
                        put("storeKey", "true");
                        put("doNotPrompt", "true");
                        put("isInitiator", "true");
                        put("debug", "true");
                    }
                })};
            }
        };
        Set<Principal> princ = new HashSet<Principal>(1);
        princ.add(new KerberosPrincipal(userId));
        Subject sub = new Subject(false, princ, new HashSet<Object>(), new HashSet<Object>());
        try {
            //指定认证模块为Krb5Login
            LoginContext lc = new LoginContext("Krb5Login", sub, null, config);
            //请求kdc进行client身份认证，如果能通过的话，则可以从TGT获取ticker作为后面二次访问时Authorization: Negotiate的基础
            lc.login();
           //无报错则表示client身份认证通过，此时可以在Subject对象中看到已经获取了kerberos的ticker
            Subject serviceSubject = lc.getSubject();
            return Subject.doAs(serviceSubject, new PrivilegedAction<HttpResponse>() {
                HttpResponse httpResponse = null;
                @Override
                public HttpResponse run() {
                    try {
                        HttpUriRequest request = new HttpGet(url);
                        //根据刚刚获取的kerberos的ticker构建Spengo请求，会经历一次401后再带上Negotiate二次请求
                        HttpClient spnegoHttpClient = buildSpengoHttpClient();
                       //返回的为二次响应后的结果
                        httpResponse = spnegoHttpClient.execute(request);
                        return httpResponse;
                    } catch (IOException ioe) {
                        ioe.printStackTrace();
                    }
                    return httpResponse;
                }
            });
        } catch (Exception le) {
            le.printStackTrace();
        }
        return null;
    }
}
程序运行结果

从抓请求包的角度看请求过程

---->第一次请求
GET /service/plugins/secure/policies/download/hive2 HTTP/1.1
Host: hive2:6080
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.12 (Java/1.8.0_144)
Accept-Encoding: gzip,deflate

<----第一次响应
<....HTTP/1.1 401 Unauthorized
Server: Apache-Coyote/1.1
Set-Cookie: RANGERADMINSESSIONID=B1E066D23C9862535612AFD3C9B0A9B9; Path=/; HttpOnly
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-XSS-Protection: 1; mode=block
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
#head包含WWW-Authenticate则表示是spnego请求
WWW-Authenticate: Negotiate
Set-Cookie: hadoop.auth=; Path=/; Domain=hive2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; HttpOnly
Content-Length: 0
Date: Fri, 21 May 2021 07:57:37 GMT


---->第二次请求
GET /service/plugins/secure/policies/download/hive2 HTTP/1.1
Host: hive2:6080
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.12 (Java/1.8.0_144)
Accept-Encoding: gzip,deflate
#第二次带上请求头
Authorization: Negotiate YIICoAYGxxxxxxxxxxx


---->第二次响应
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: RANGERADMINSESSIONID=030939FDEAF93D5E218C6561DD8F1CDA; Path=/; HttpOnly
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-XSS-Protection: 1; mode=block
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
WWW-Authenticate: Negotiate oYH5MIH2oAMKAQChCwYxxxxxxxxxxx
Set-Cookie: hadoop.auth=xxxxxxxxxxxxxxxxx
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type:xxxxxxxxxxxxxxxxxxxxxxxxxx
上一篇 下一篇

猜你喜欢

热点阅读