我有一个服务模型服务,其中我有一个用于Kerberos身份验证的密钥表。
在此模型中,我已将登录配置定义如下: -
import java.util.HashMap;
import java.util.Map;
import javax.security.auth.login.AppConfigurationEntry;
import javax.security.auth.login.Configuration;
public class GSSIbmLoginConfiguration extends Configuration {
private AppConfigurationEntry configEntry;
public GSSIbmLoginConfiguration(String principal,
String credentialCache,
String keytab,
KerberosCredentialUsage usage) {
Map<String, String> params = new HashMap<String, String>();
params.put("credsType", "both");
params.put("renewable", Boolean.TRUE.toString());
params.put("principal", principal);
if (credentialCache != null) {
params.put("useCcache", credentialCache);
}
if (keytab != null) {
params.put("useKeytab", keytab);
}
configEntry = new AppConfigurationEntry(
"com.ibm.security.auth.module.Krb5LoginModule",
AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, params);
}
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
return new AppConfigurationEntry[] {
configEntry
};
}
此登录配置可替代jaas.conf
现在我正在尝试使用LoginContext的登录方法。然后我从中获得主题。
现在使用这个主题我做了特权行动。
private static final class SubjectAction implements PrivilegedExceptionAction<GSSCredential> {
private final int credentialType;
private final int credentialLifetime;
private SubjectAction(int credType, int lifetime) {
credentialType = credType;
credentialLifetime = lifetime;
}
public GSSCredential run() throws GSSException {
GSSManager gssManager = GSSManager.getInstance()
return gssManager.createCredential(null, credentialLifetime, KRB5_MECH_ID, GSSCredential.INITIATE_AND_ACCEPT);
}
}
这失败了。相关日志(我在设置日志系统属性后挖掘出来): -
[JGSS_DBG_CRED] localhost-startStop-1 Creating mech cred for null, mech 1.2.840.113554.1.2.2, usage initiate and accept
[JGSS_DBG_PROV] localhost-startStop-1 Provider Entry: provider: IBMJGSSProvider, mechanism: 1.3.6.1.5.5.2 get Factory for mech: 1.2.840.113554.1.2.2 GSSCaller:
[JGSS_DBG_PROV] localhost-startStop-1 Provider Entry: provider: IBMJGSSProvider, mechanism: 1.2.840.113554.1.2.2 get Factory for mech: 1.2.840.113554.1.2.2 GSSCaller:
[JGSS_DBG_PROV] localhost-startStop-1 Created new (empty) factory list (size=1) for provider IBMJGSSProvider version 7.0
[JGSS_DBG_PROV] localhost-startStop-1 Loading factory
[JGSS_DBG_PROV] localhost-startStop-1 Factory class name for provider IBMJGSSProvider version 7.0 is com.ibm.security.jgss.mech.krb5.Krb5MechFactory
[JGSS_DBG_PROV] localhost-startStop-1 Prior to load
[JGSS_DBG_PROV] localhost-startStop-1 Done to load
[JGSS_DBG_PROV] localhost-startStop-1 Loaded factory for provider IBMJGSSProvider version 7.0
[JGSS_DBG_PROV] localhost-startStop-1 Loaded factory ok
[JGSS_DBG_PROV] localhost-startStop-1 getFactory: index = 1 found factory caller = com.ibm.security.jgss.GSSCaller@e7d4b6d7
[JGSS_DBG_CRED] localhost-startStop-1 usage: initiate and subject
[JGSS_DBG_CRED] localhost-startStop-1 Obtaining creds from Krb5Util.ServiceCreds for default service
[JGSS_DBG_CRED] localhost-startStop-1 Found key for isp/ISPNode1/ISPDomain@INFAKRB.INFADEV.COM(1)
[JGSS_DBG_CRED] localhost-startStop-1 Found key for isp/ISPNode1/ISPDomain@INFAKRB.INFADEV.COM(23)
[JGSS_DBG_CRED] localhost-startStop-1 Found key for isp/ISPNode1/ISPDomain@INFAKRB.INFADEV.COM(3)
[JGSS_DBG_CRED] localhost-startStop-1 Found key for isp/ISPNode1/ISPDomain@INFAKRB.INFADEV.COM(17)
[JGSS_DBG_CRED] localhost-startStop-1 acquiring creds for isp/ISPNode1/ISPDomain@INFAKRB.INFADEV.COM
现在真正令人困惑的是: -
[JGSS_DBG_CRED] localhost-startStop-1 Creating mech cred for null, mech 1.2.840.113554.1.2.2, usage initiate and accept
and then:
[JGSS_DBG_PROV] localhost-startStop-1 getFactory: index = 1 found factory caller = com.ibm.security.jgss.GSSCaller@e7d4b6d7
[JGSS_DBG_CRED] localhost-startStop-1 usage: initiate and subject
第一部分是createCredential本身。然而,第二个似乎是一些机制工厂相关的呼叫(在这种情况下为kerberos)。现在,在此基于文件的信用缓存身份验证启动之后。
[KRB_DBG_CCHE] FileCredentialsCache:localhost-startStop-1: >>>KinitOptions cache name is /export/home/ispqa95/krb5cc_ispqa95
[KRB_DBG_CCHE] FileCredentialsCache:localhost-startStop-1: >>> FileCredentialsCache default name is: /export/home/ispqa95/krb5cc_ispqa95
[KRB_DBG_CCHE] FileCredentialsCache:localhost-startStop-1: >>>FileCredentialsCache: read ccache version 0x503
[KRB_DBG_KDC] KrbDataInputStream:localhost-startStop-1: >>>KrbDataInputStream: Bytes read: 0000: 49 4e 46 41 4b 52 42 2e 49 4e 46 41 44 45 56 2e INFAKRB.INFADEV.
0010:43 4f 4d COM
[KRB_DBG_KDC] KrbDataInputStream:localhost-startStop-1: >>> CCacheInputStream: equiv string: INFAKRB.INFADEV.COM
[KRB_DBG_CCHE] CCacheInputStream:localhost-startStop-1: >>> readPrincipal: read realm INFAKRB.INFADEV.COM
[KRB_DBG_KDC] KrbDataInputStream:localhost-startStop-1: >>>KrbDataInputStream: Bytes read: 0000: 6e 61 67 61 72 6c 61 nagarla
这意味着机制工厂的价值出现了错误。
我试过反编译IBM jars(ibmjgssprovider.jar),但似乎里面的类名是乱码(用a,b,xy等代替)。
这最终会导致: - java.io.IOException:主要主体不匹配
作为专家,我很难搞清楚IBM的行为。 OpenJdk有很多帮助。
有人可以提供帮助。我的产品设置的某些系统属性是否会导致这种行为?
我正在尝试在执行时检查所有可能的系统属性。如果需要其他东西,请告诉我。
还有人能指出一些IBM JDK安全论坛吗?我也想在那里发布这个问题。
答案 0 :(得分:1)
好的,我想出了如何解决这个问题: -
系统属性:
-Djavax.security.auth.useSubjectCredsOnly=true
必须在启动期间设置,否则IBM使用的凭证是默认凭证(在AIX的情况下,它尝试从基于文件的凭证缓存中获取)