2

I followed the instructions from the following datastax post - Accessing secure DSE clusters

This is my code snippet -

public static void main(String[] args) {
KerberosAuthenticatedClient client = new KerberosAuthenticatedClient();     
System.setProperty("java.security.krb5.conf","C:/Users/ADMIN/Desktop/krb5.config");
System.setProperty("java.security.auth.login.config","C:/Users/ADMIN/Desktop/DseClient.config");    
cluster = Cluster.builder().addContactPoint(node).withAuthProvider(new DseAuthProvider()).build();
session = cluster.connect();

This is my DseClient File - 

DseClient {
    com.sun.security.auth.module.Krb5LoginModule required
     useKeyTab=true
   doNotPrompt=true
     keyTab="C:/Users/ADMIN/Desktop/dse.keytab"
     principal="rock@MY.COM";
};

And This is my krb5.conf -

[libdefaults]
default_realm = MY.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true

[realms]
MY.COM = {
kdc = x.x.x.x
admin_server = x.x.x.x
}

[domain_realm]
.my.com = MY.COM
my.com = MY.COM

I have installed kerberos on my client machine and also on the servers too. But when I run I get the following error :-

Exception in thread "main" java.lang.RuntimeException: javax.security.auth.login.LoginException: Unable to obtain password from user

at com.datastax.driver.core.sasl.KerberosAuthenticator.loginSubject(KerberosAuthenticator.java:113)
at com.datastax.driver.core.sasl.KerberosAuthenticator.<init>(KerberosAuthenticator.java:94)
at com.datastax.driver.core.sasl.DseAuthProvider.newAuthenticator(DseAuthProvider.java:52)
at com.datastax.driver.core.Connection.initializeTransport(Connection.java:163)
at com.datastax.driver.core.Connection.<init>(Connection.java:131)
at com.datastax.driver.core.Connection.<init>(Connection.java:59)
at com.datastax.driver.core.Connection$Factory.open(Connection.java:444)
at com.datastax.driver.core.ControlConnection.tryConnect(ControlConnection.java:205)
at com.datastax.driver.core.ControlConnection.reconnectInternal(ControlConnection.java:168)
at com.datastax.driver.core.ControlConnection.connect(ControlConnection.java:81)
at com.datastax.driver.core.Cluster$Manager.init(Cluster.java:812)
at com.datastax.driver.core.Cluster$Manager.access$100(Cluster.java:739)
at com.datastax.driver.core.Cluster.<init>(Cluster.java:82)
at com.datastax.driver.core.Cluster.<init>(Cluster.java:67)
at com.datastax.driver.core.Cluster$Builder.build(Cluster.java:708)
at KerberosAuthenticatedClient.connect(KerberosAuthenticatedClient.java:19)
at KerberosAuthenticatedClient.main(KerberosAuthenticatedClient.java:45)
Caused by: javax.security.auth.login.LoginException: Unable to obtain password from user

at com.sun.security.auth.module.Krb5LoginModule.promptForPass(Unknown Source)
at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Unknown Source)
at com.sun.security.auth.module.Krb5LoginModule.login(Unknown Source)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at javax.security.auth.login.LoginContext.invoke(Unknown Source)
at javax.security.auth.login.LoginContext.access$000(Unknown Source)
at javax.security.auth.login.LoginContext$4.run(Unknown Source)
at javax.security.auth.login.LoginContext$4.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.login.LoginContext.invokePriv(Unknown Source)
at javax.security.auth.login.LoginContext.login(Unknown Source)
at com.datastax.driver.core.sasl.KerberosAuthenticator.loginSubject(KerberosAuthenticator.java:109)
... 16 more
4

2 回答 2

2

堆栈跟踪中的错误抱怨它无法为执行请求的操作系统用户找到任何凭据。这通常是由以下三种情况之一引起的：

  1. 没有正确设置 JAAS 配置的位置（这导致我们回退到使用 TGT 缓存的默认设置并且通常导致 2。）
  2. 一个空的本地票证缓存（不使用 keytab 时）
  3. keytab 中缺少指定主体的凭据

我要检查的第一件事是您是否已将java.security.auth.login.config系统属性正确设置为您的 JAAS 配置文件（DseClient 文件）的位置？如果您有并且仍然看到错误，您可以检查 keytab 的内容klist -e -t -k /path/to/keytab

另一个有用的调试技巧是设置-Dsun.security.krb5.debug=true将大量详细信息转储到标准输出。

于 2014-02-11T09:08:43.883 回答
0

我将服务原则从 cassandra/hostname@REALM 更改为 dse/hostname@REALM 并且它起作用了。我不确定为什么我从 Windows 机器上运行的 java 程序将服务原则作为 dse/hostname 而不是 cassandra/hostname

于 2014-02-13T02:16:49.643 回答