0

我有一个 linux\java6 客户端，它将使用 KERBEROS 对 sharepoint2010 进行身份验证，然后使用 Apache Commons HttpClient 4.2 发送 HTTP REST Web 服务

如果我在连接客户端之前从命令行运行，"kinit myuser@mydomain"则运行顺畅。

我的问题是，如果我不运行 kinit ，则会提示我输入用户名。

如何在不提示输入用户名且无需运行命令行程序的情况下以编程方式进行身份验证？

（我创建和 keytab 并在 login.conf 中定义它，以便处理密码提示而不是用户提示）

public static void main(String[] args) throws Exception {

    System.setProperty("java.security.auth.login.config", "login.conf");
    System.setProperty("java.security.krb5.conf", "krb5.conf");
    System.setProperty("sun.security.krb5.debug", "true");
    System.setProperty("javax.security.auth.useSubjectCredsOnly","false");

    DefaultHttpClient httpclient = new DefaultHttpClient();
    try {
        httpclient.getAuthSchemes().register(AuthPolicy.SPNEGO, new SPNegoSchemeFactory());

        Credentials use_jaas_creds = new Credentials() {

            public String getPassword() {
                return null;
            }

            public Principal getUserPrincipal() {
                return null;
            }

        };

        httpclient.getCredentialsProvider().setCredentials(
                new AuthScope(null, -1, null),
                use_jaas_creds);

        HttpUriRequest request = new HttpGet("http://kerberoshost/");
        HttpResponse response = httpclient.execute(request);
        HttpEntity entity = response.getEntity();

        System.out.println("----------------------------------------");
        System.out.println(response.getStatusLine());
        System.out.println("----------------------------------------");
        if (entity != null) {
            System.out.println(EntityUtils.toString(entity));
        }
        System.out.println("----------------------------------------");

        // This ensures the connection gets released back to the manager
        EntityUtils.consume(entity);

    } finally {
        // When HttpClient instance is no longer needed,
        // shut down the connection manager to ensure
        // immediate deallocation of all system resources
        httpclient.getConnectionManager().shutdown();
    }
}
4

1 回答 1

3

除了 keytab 文件之外，您还必须提供主体名称才能获得完全透明的客户端 Kerberos 身份验证 (kinit)：

 client {
   com.sun.security.auth.module.Krb5LoginModule required
     useKeyTab=true
     storeKey=true
     keyTab=/path/to/userKeytab
     principal="userName";
 };
于 2012-06-19T12:13:51.590 回答