我们公司有一个 kerberos 域,我正在运行一些 Java/Kerberos示例。我的问题是从服务器的角度来看登录机制。运行服务器示例GssServer.java
时,我需要得到一个javax.security.auth.Subject
;在提供的代码中,这是通过一个LoginContext
因此:
// Create a LoginContext with a callback handler and login
LoginContext context = new LoginContext(name, new TextCallbackHandler());
context.login();
Subject subject = context.getSubject();
这一切都好,当我运行示例时,我看到了一个可爱的登录提示。然而,我的问题是,这并不是我的服务器将如何运行,也不是我如何被引导理解我应该如何从 kerberos 域中呈现服务。在GssServer
示例中,问题是我的服务器(读取:服务)不应该需要对自身进行身份验证KDC
以便向客户端提供其服务。访问服务器端keytab
文件应该足以做到这一点。所以对于示例配置:
//jaas-krb5.conf
server {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
keyTab="/home/myusr/my-server.keytab"
principal="myserv/mymachine.some.domain";
};
在 Java 代码中:
GSSManager manager = GSSManager.getInstance();
Oid krb5Mechanism = new Oid("1.2.840.113554.1.2.2");
GSSName gssName = manager.createName("myserv/mymachine.some.domain@THE.REALM.COM",
GSSName.NT_HOSTBASED_SERVICE);
GSSCredential serverCreds = manager.createCredential(gssName,
GSSCredential.DEFAULT_LIFETIME,
krb5Mechanism,
GSSCredential.ACCEPT_ONLY);
这样做的问题是文件中的server
信息jaas-krb5.conf
不可用,除非我通过以下行验证自己:
Jaas.loginAndAction("server", action);
我不应该通过这个身份验证!但是,如果我不验证自己的身份,我最终会得到:
Exception in thread "main" GSSException: No valid credentials provided (Mechanism level: Attempt to obtain new ACCEPT credentials failed!)
at sun.security.jgss.krb5.Krb5AcceptCredential.getKeysFromSubject(Krb5AcceptCredential.java:188)
at sun.security.jgss.krb5.Krb5AcceptCredential.getInstance(Krb5AcceptCredential.java:73)
at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:77)
at sun.security.jgss.GSSManagerImpl.getCredentialElement(GSSManagerImpl.java:149)
at sun.security.jgss.GSSCredentialImpl.add(GSSCredentialImpl.java:389)
at sun.security.jgss.GSSCredentialImpl.<init>(GSSCredentialImpl.java:45)
at sun.security.jgss.GSSManagerImpl.createCredential(GSSManagerImpl.java:102)
at gsa.hk.GssServer$GssServerAction.run(GssServer.java:79)
at gsa.hk.GssServer.main(GssServer.java:57)
Caused by: javax.security.auth.login.LoginException: No LoginModules configured for com.sun.security.jgss.accept
at javax.security.auth.login.LoginContext.init(LoginContext.java:256)
at javax.security.auth.login.LoginContext.<init>(LoginContext.java:403)
at sun.security.jgss.LoginUtility.login(LoginUtility.java:72)
at sun.security.jgss.krb5.Krb5Util.getKeysFromSubject(Krb5Util.java:205)
at sun.security.jgss.krb5.Krb5AcceptCredential$1.run(Krb5AcceptCredential.java:184)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.jgss.krb5.Krb5AcceptCredential.getKeysFromSubject(Krb5AcceptCredential.java:181)
... 8 more
有问题也就不足为奇了。毕竟,除非我掌握了这个server
主题,否则我怎么知道我在哪里keytab
,或者我在提供什么服务?
所以我的问题是:如何GSS API
在不通过代码验证自己的情况下告诉密钥表/服务?