Question

我有一个基于java的Web应用程序，它接收包含用户名和密码的Web表单的内容，并使用kerberos对基于Windows的域进行身份验证。

KDC地址显然配置为在每次查找时映射到不同的IP地址，这可以通过命令行中的ping命令来确认。

对于大多数请求，呼叫立即响应，但间歇性响应缓慢（5-10秒甚至更长）。我认为这可能是由于使用了哪个域控制器。

我尝试打开kerberos日志记录，但未显示域控制器的IP地址。如何打开更详细的日志记录来尝试识别狡猾的域控制器？

代码提取从文件系统中获取kerb.conf和kerb_context.conf。

kerb.conf是：

[libdefaults]
default_realm = EXAMPLE.COM

[realms]
CYMRU.NHS.UK = {
        kdc = example.com:88
        admin_server = example.com
        kpasswd_server = example.com
}

kerb_context.conf是：

 primaryLoginContext {
        com.sun.security.auth.module.Krb5LoginModule required
        useTicketCache=false
        refreshKrb5Config=true
        debug=true;
};

示例来源是：

static NadexUser executePerformLogin(String username, String password) throws LoginException {
            char[] passwd = password.toCharArray();
            String kerbConf = ERXFileUtilities.pathForResourceNamed("nadex/kerb.conf", "RSCorp", null);
            String kerbContextConf = ERXFileUtilities.pathURLForResourceNamed("nadex/kerb_context.conf", "RSCorp", null).toExternalForm();
            System.setProperty("java.security.krb5.conf", kerbConf);
            System.setProperty("java.security.auth.login.config", kerbContextConf);
            try {
                    LoginContext lc = new LoginContext("primaryLoginContext", new UserNamePasswordCallbackHandler(username, password));
                    lc.login();
                    return new _NadexUser(lc.getSubject());
            }
            catch (javax.security.auth.login.LoginException le) {
                    throw new LoginException("Failed to login : " + le.getLocalizedMessage(), le);
            }
    }

Answer 1

您可以通过将系统属性sun.security.krb5.debug设置为true来启用日志记录。

请参阅Oracle documentation

Answer 2

我没有办法打开这种详细的日志记录，而是决定采用不同的方法。下面的代码是一个独立的应用程序，只需要在同一目录中的jaas.conf配置文件。

显示了一个用于此简短测试应用程序的示例jaas.conf：

primaryLoginContext {
        com.sun.security.auth.module.Krb5LoginModule required
        useTicketCache=false
        refreshKrb5Config=true
        debug=false;
};

此代码小心设置系统属性sun.net.inetaddr.ttl以避免java缓存DNS查找的结果。对于我的情况，DNS查找在每个请求时都会更改。它是一段相当原始的代码，但会在网络中演示任何配置不佳或正在执行的KDC。

import java.io.BufferedReader;
import java.io.File;
import java.io.IOException;
import java.io.InputStreamReader;
import java.math.BigDecimal;
import java.math.RoundingMode;
import java.net.InetAddress;
import java.net.MalformedURLException;
import java.net.UnknownHostException;
import java.util.Date;
import java.util.HashMap;
import java.util.Set;
import java.util.Vector;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.LoginContext;

public class TestNadex {
    private static final String DEFAULT_HOST = "cymru.nhs.uk";

    public static void main(String[] args) {
        System.setProperty("sun.net.inetaddr.ttl", "0");
        String username=null;
        String password=null;
        try {
            BufferedReader br = new BufferedReader(new InputStreamReader(System.in));
            System.out.println("Enter username: ");
            username = br.readLine().trim();
            System.out.println("Enter password: ");
            password = br.readLine().trim();
            testHost(DEFAULT_HOST, username, password);
        } catch (IOException e1) {
            // TODO Auto-generated catch block
            e1.printStackTrace();
        }
    }

    static void testHost(String host, String username, String password) {
        HashMap<String, Vector<Long>> results = new HashMap<String, Vector<Long>>();
        for (int i=0; i<200; i++) {
            InetAddress ia;
            try {
                ia = InetAddress.getByName(host);
                long startTime = System.currentTimeMillis();
                executePerformLogin(ia.getHostAddress(), username, password);
                long endTime = System.currentTimeMillis();
                long duration = endTime - startTime;
                if (results.containsKey(ia.toString()) == false) {
                    Vector<Long> v = new Vector<Long>();
                    v.add(duration);
                    results.put(ia.toString(), v);
                }
                else {
                    Vector<Long> v = results.get(ia.toString());
                    v.add(duration);
                }
                Thread.sleep(1000);
            } catch (UnknownHostException e) {
                System.out.println("Unknown host: "  + host);
                System.exit(1);
            } catch (MalformedURLException e) {
                e.printStackTrace();
            } catch (InterruptedException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
        }

        Set<String> keys = results.keySet();
        for (String key : keys) {
            System.out.println("For address: " + key);
            Vector<Long> times = results.get(key);
            int count = times.size();
            long total = 0;
            for (Long t : times) {
                System.out.println(t + " milliseconds");
                total += t;
            }
            System.out.println("Mean duration: " + new BigDecimal(total).divide(new BigDecimal(count), RoundingMode.HALF_UP));
        }
    }

    static void executePerformLogin(String hostname, String username, String password) throws MalformedURLException {
        System.setProperty("java.security.krb5.realm", "CYMRU.NHS.UK");
        System.setProperty("java.security.krb5.kdc", hostname);
        File jaas = new File("jaas.conf");
        String jaasconf = jaas.toURI().toURL().toExternalForm();
        System.setProperty("java.security.auth.login.config", jaasconf);
        //      System.setProperty("java.security.krb5.realm", "cymru.nhs.uk");
        //      System.setProperty("java.security.krb5.kdc", "cymru.nhs.uk");
        try {
            System.out.println("Performing NADEX login for username: " + username + " at " + new Date() + " to server " + hostname);
            LoginContext lc = new LoginContext("primaryLoginContext", new UserNamePasswordCallbackHandler(username, password));
            lc.login();
            System.out.println("Successful login for " + lc.getSubject().toString() + " at " + new Date());
        }
        catch (javax.security.auth.login.LoginException le) {
            System.err.println("Failed to login: " + le);
        }
    }

    public static class UserNamePasswordCallbackHandler implements CallbackHandler {
        private final String _userName;
        private final String _password;

        public UserNamePasswordCallbackHandler(String userName, String password) {
            _userName = userName;
            _password = password;
        }

        public void handle(Callback[] callbacks) throws IOException,
        UnsupportedCallbackException {
            for (Callback callback : callbacks) {
                if (callback instanceof NameCallback && _userName != null) {
                    ((NameCallback) callback).setName(_userName);
                }
                else if (callback instanceof PasswordCallback && _password != null) {
                    ((PasswordCallback) callback).setPassword(_password.toCharArray());
                }
            }
        }
    }
}

在java中启用kerberos的详细日志记录

2 个答案: