WildFly 10x 使用 kerberos 密钥表配置数据源 Impala Db

如何解决WildFly 10x 使用 kerberos 密钥表配置数据源 Impala Db

我在使用 Kerberos 设置集成身份验证以将 Impala Db 与 Jboss wildfly 10 上的数据源连接时遇到问题。 这是我的数据源配置：

<subsystem xmlns="urn:jboss:domain:datasources:4.0">
    <datasources>
        <datasource jta="false" jndi-name="java:jboss/datasources/impalaDS" pool-name="impalaDS">
            <connection-url>
            jdbc:impala://hostname:21050/;AuthMech=1;KrbRealm=principal;KrbHostFQDN=hostname;KrbServiceName=impala
            </connection-url>
           <driver>impala</driver>
           <pool>
              <min-pool-size>1</min-pool-size>
              <max-pool-size>10</max-pool-size>
           </pool>
           <security>
              <security-domain>kerbconf</security-domain>
           </security>
           <validation>
              <check-valid-connection-sql>SELECT 1</check-valid-connection-sql>
              <validate-on-match>false</validate-on-match>
              <background-validation>true</background-validation>
              <background-validation-millis>120000</background-validation-millis>
           </validation>
           <timeout>
              <blocking-timeout-millis>300000</blocking-timeout-millis>
           </timeout>
        </datasource>

        <drivers>
           <driver name="impala" module="com.cloudera.impala">
                <driver-class>com.cloudera.impala.jdbc41.Driver</driver-class>
           </driver>
        </drivers>

我的安全域 kerbconf 是：

<security-domain name="kerbconf" cache-type="default">
    <authentication>
        <login-module code="com.sun.security.auth.module.Krb5LoginModule" flag="required" module="org.jboss.security.negotiation">
            <module-option name="storeKey" value="true"/>
            <module-option name="useKeyTab" value="true"/>
            <module-option name="keyTab" value="C:/Server/wildfly-10.0.0.Final/standalone/deployments/kerberos_conf/sptool/myPrincipal.keytab"/>
            <module-option name="principal" value="principal@principal"/>
            <module-option name="useTicketCache" value="true"/>
            <module-option name="debug" value="true"/>
        </login-module>
    </authentication>
</security-domain>

使用以前的配置启动服务器时出现此错误：

18:44:22,639 INFO  [stdout] (MSC service thread 1-6) Principal is [e-mail]

18:44:22,639 INFO  [stdout] (MSC service thread 1-6) null credentials from Ticket Cache

18:44:22,813 INFO  [stdout] (MSC service thread 1-6)        [Krb5LoginModule] authentication failed 
18:44:22,813 INFO  [stdout] (MSC service thread 1-6) ICMP Port Unreachable

18:44:22,824 ERROR [org.jboss.as.connector.subsystems.datasources.AbstractDataSourceService$AS7DataSourceDeployer] (MSC service thread 1-6) Exception during createSubject()PBOX00016: Access denied: authentication failed: java.lang.SecurityException: PBOX00016: Access denied: authentication failed
    at org.jboss.security.plugins.JBossSecuritySubjectFactory.createSubject(JBossSecuritySubjectFactory.java:84)
    at org.jboss.jca.core.security.picketbox.PicketBoxSubjectFactory.createSubject(PicketBoxSubjectFactory.java:66)
    at org.jboss.jca.deployers.common.AbstractDsDeployer$1.run(AbstractDsDeployer.java:1451)
    at org.jboss.jca.deployers.common.AbstractDsDeployer$1.run(AbstractDsDeployer.java:1446)
    at java.security.AccessController.doPrivileged(Native Method)
    at org.jboss.jca.deployers.common.AbstractDsDeployer.createSubject(AbstractDsDeployer.java:1445)
    at org.jboss.jca.deployers.common.AbstractDsDeployer.deployDataSource(AbstractDsDeployer.java:766)
    at org.jboss.jca.deployers.common.AbstractDsDeployer.createObjectsAndInjectValue(AbstractDsDeployer.java:312)
    at org.jboss.as.connector.subsystems.datasources.AbstractDataSourceService$AS7DataSourceDeployer.deploy(AbstractDataSourceService.java:364)
    at org.jboss.as.connector.subsystems.datasources.AbstractDataSourceService.start(AbstractDataSourceService.java:145)
    at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1948)
    at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1881)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)

18:44:22,826 INFO  [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-6) WFLYJCA0001: Bound data source [java:jboss/datasources/impalaDS]

我通过 Java 代码成功连接：

@InterfaceAudience.Public
  @InterfaceStability.Evolving
  public synchronized
  static void loginUserFromKeytab(String user,String path
                                  ) throws IOException {
    if (!isSecurityEnabled())
      return;

    keytabFile = path;
    keytabPrincipal = user;
    Subject subject = new Subject();
    LoginContext login; 
    long start = 0;
    try {
      login = newLoginContext(HadoopConfiguration.KEYTAB_KERBEROS_CONFIG_NAME,subject,new HadoopConfiguration());
      start = Time.now();
      login.login();
      metrics.loginSuccess.add(Time.now() - start);
      loginUser = new UserGroupInformation(subject);
      loginUser.setLogin(login);
      loginUser.setAuthenticationMethod(AuthenticationMethod.KERBEROS);
    } catch (LoginException le) {
      if (start > 0) {
        metrics.loginFailure.add(Time.now() - start);
      }
      throw new IOException("Login failure for " + user + " from keytab " + 
                            path+ ": " + le,le);
    }
    LOG.info("Login successful for user " + keytabPrincipal
        + " using keytab file " + keytabFile);
  }

如何配置与 jboss wildfly 相同的 Java 认证？