【kerberos】hadoop集群使用keytab认证的逻辑

本文详细介绍了ApacheHadoop中使用kerberos进行身份验证的过程,包括环境变量配置如KRB5_CONFIG、KRB5_CCNAME等,以及两种UserGroupInformation认证方法:原生和Cloudera改良版本,强调了core-site.xml配置的重要性。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

一、背景:

haoop的kerberos认证核心是org.apache.hadoop.security.UserGroupInformation类。
UserGroupInformation一般有两种:(1)apache原生的(2)cdh hdp改良过的,即cloudera改良过的。
由此衍生出两个验证方法。
kerberos是有MIT研发出来的,mit也为kerberos开发了客户端。

MIT官网为kerberos规定的常用环境变量有如下:

KRB5CCNAME
Default name for the credentials cache file, in the form TYPE:residual. The type of the default cache may determine the availability of a cache collection. FILE is not a collection type; KEYRING, DIR, and KCM are.
If not set, the value of default_ccache_name from configuration files (see KRB5_CONFIG) will be used. If that is also not set, the default type is FILE, and the residual is the path /tmp/krb5cc_uid, where uid is the decimal user ID of the user.

KRB5_KTNAME
Specifies the location of the default keytab file, in the form TYPE:residual. If no type is present, the FILE type is assumed and residual is the pathname of the keytab file. If unset, DEFKTNAME will be used.

KRB5_CONFIG
Specifies the location of the Kerberos configuration file. The default is SYSCONFDIR/krb5.conf. Multiple filenames can be specified, separated by a colon; all files which are present will be read.

KRB5_KDC_PROFILE
Specifies the location of the KDC configuration file, which contains additional configuration directives for the Key Distribution Center daemon and associated programs. The default is LOCALSTATEDIR/krb5kdc/kdc.conf.

KRB5RCACHENAME
(New in release 1.18) Specifies the location of the default replay cache, in the form type:residual. The file2 type with a pathname residual specifies a replay cache file in the version-2 format in the specified location. The none type (residual is ignored) disables the replay cache. The dfl type (residual is ignored) indicates the default, which uses a file2 replay cache in a temporary directory. The default is dfl:.

KRB5RCACHETYPE
Specifies the type of the default replay cache, if KRB5RCACHENAME is unspecified. No residual can be specified, so none and dfl are the only useful types.

KRB5RCACHEDIR
Specifies the directory used by the dfl replay cache type. The default is the value of the TMPDIR environment variable, or /var/tmp if TMPDIR is not set.

KRB5_TRACE
Specifies a filename to write trace log output to. Trace logs can help illuminate decisions made internally by the Kerberos libraries. For example, env KRB5_TRACE=/dev/stderr kinit would send tracing information for kinit to /dev/stderr. The default is not to write trace log output anywhere.

KRB5_CLIENT_KTNAME
Default client keytab file name. If unset, DEFCKTNAME will be used).

KPROP_PORT
kprop port to use. Defaults to 754.

GSS_MECH_CONFIG
Specifies a filename containing GSSAPI mechanism module configuration. The default is to read SYSCONFDIR/gss/mech and files with a .conf suffix within the directory SYSCONFDIR/gss/mech.d.

以上环境变量常用的有
KRB5_CONFIG :krb5.conf或krb5.ini文件路径
KRB5CCNAME:kerberos cache文件路径(注:此文件可由MIT kerberos客户端生成)

二、具体认证步骤

1、krb5.conf信息配置

注意:UserGroupInformation中设置KRB5_CONFIG是没有用的,必须要设置java.security.krb5.conf

如下方法都可以:
(1)项目启动指定java vm变量:-Djava.security.krb5.conf=D:/xxx/xxx/krb5.conf
(2)程序中指定:System.setProperty("java.security.krb5.conf", "D:/xxx/xxx/krb5.conf")

如果不指定程序会找不到kdc,报异常,如下:

org.apache.hadoop.security.KerberosAuthException: failu
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值