【kerberos】hadoop集群使用keytab认证的逻辑

一、背景：

haoop的kerberos认证核心是org.apache.hadoop.security.UserGroupInformation类。
UserGroupInformation一般有两种：（1）apache原生的（2）cdh hdp改良过的，即cloudera改良过的。
由此衍生出两个验证方法。
kerberos是有MIT研发出来的，mit也为kerberos开发了客户端。

MIT官网为kerberos规定的常用环境变量有如下：

KRB5CCNAME
Default name for the credentials cache file, in the form TYPE:residual. The type of the default cache may determine the availability of a cache collection. FILE is not a collection type; KEYRING, DIR, and KCM are.
If not set, the value of default_ccache_name from configuration files (see KRB5_CONFIG) will be used. If that is also not set, the default type is FILE, and the residual is the path /tmp/krb5cc_uid, where uid is the decimal user ID of the user.

KRB5_KTNAME
Specifies the location of the default keytab file, in the form TYPE:residual. If no type is present, the FILE type is assumed and residual is the pathname of the keytab file. If unset, DEFKTNAME will be used.

KRB5_CONFIG
Specifies the location of the Kerberos configuration file. The default is SYSCONFDIR/krb5.conf. Multiple filenames can be specified, separated by a colon; all files which are present will be read.

KRB5_KDC_PROFILE
Specifies the location of the KDC configuration file, which contains additional configuration directives for the Key Distribution Center daemon and associated programs. The default is LOCALSTATEDIR/krb5kdc/kdc.conf.

KRB5RCACHENAME
(New in release 1.18) Specifies the location of the default replay cache, in the form type:residual. The file2 type with a pathname residual specifies a replay cache file in the version-2 format in the specified location. The none type (residual is ignored) disables the replay cache. The dfl type (residual is ignored) indicates the default, which uses a file2 replay cache in a temporary directory. The default is dfl:.

KRB5RCACHETYPE
Specifies the type of the default replay cache, if KRB5RCACHENAME is unspecified. No residual can be specified, so none and dfl are the only useful types.

KRB5RCACHEDIR
Specifies the directory used by the dfl replay cache type. The default is the value of the TMPDIR environment variable, or /var/tmp if TMPDIR is not set.

KRB5_TRACE
Specifies a filename to write trace log output to. Trace logs can help illuminate decisions made internally by the Kerberos libraries. For example, env KRB5_TRACE=/dev/stderr kinit would send tracing information for kinit to /dev/stderr. The default is not to write trace log output anywhere.

KRB5_CLIENT_KTNAME
Default client keytab file name. If unset, DEFCKTNAME will be used).

KPROP_PORT
kprop port to use. Defaults to 754.

GSS_MECH_CONFIG
Specifies a filename containing GSSAPI mechanism module configuration. The default is to read SYSCONFDIR/gss/mech and files with a .conf suffix within the directory SYSCONFDIR/gss/mech.d.

以上环境变量常用的有
KRB5_CONFIG ：krb5.conf或krb5.ini文件路径
KRB5CCNAME：kerberos cache文件路径（注：此文件可由MIT kerberos客户端生成）

二、具体认证步骤

1、krb5.conf信息配置

注意：UserGroupInformation中设置KRB5_CONFIG是没有用的，必须要设置java.security.krb5.conf

如下方法都可以：
（1）项目启动指定java vm变量：-Djava.security.krb5.conf=D:/xxx/xxx/krb5.conf
（2）程序中指定：System.setProperty("java.security.krb5.conf", "D:/xxx/xxx/krb5.conf")

如果不指定程序会找不到kdc，报异常，如下：

org.apache.hadoop.security.KerberosAuthException: failure to login: for principal: xxx@HADOOP.COM from keytab D:\xxx\xxx\xxx.keytab javax.security.auth.login.LoginException: null