Question

我试图从eclipse访问启用了kerberos的DSE群集。

示例连接代码是

public void connect(String node) {
  cluster = Cluster.builder().addContactPoint(node)
    .withAuthProvider(new DseAuthProvider()).build();
  Metadata metadata = cluster.getMetadata();
  Iterator<KeyspaceMetadata> in = metadata.getKeyspaces().iterator();
  while (in.hasNext()) {
   // System.out.println("Keyspaces");
   System.out.println(in.next().getName());
  }

我的dseclient文件看起来像这样

  DseClient {
        com.sun.security.auth.module.Krb5LoginModule required
          useKeyTab=true
          keyTab="/path/to/file.keytab"
          principal="user@MYDOMAIN.COM";
    };

运行代码

时出现以下异常

Exception in thread "main" java.lang.RuntimeException: javax.security.auth.login.LoginException: Cannot locate default realm
 at com.datastax.driver.core.sasl.KerberosAuthenticator.loginSubject(KerberosAuthenticator.java:113)
 at com.datastax.driver.core.sasl.KerberosAuthenticator.<init>(KerberosAuthenticator.java:94)
 at com.datastax.driver.core.sasl.DseAuthProvider.newAuthenticator(DseAuthProvider.java:52)
 at com.datastax.driver.core.Connection.initializeTransport(Connection.java:164)
 at com.datastax.driver.core.Connection.<init>(Connection.java:132)
 at com.datastax.driver.core.Connection.<init>(Connection.java:59)
 at com.datastax.driver.core.Connection$Factory.open(Connection.java:442)
 at com.datastax.driver.core.ControlConnection.tryConnect(ControlConnection.java:205)
 at com.datastax.driver.core.ControlConnection.reconnectInternal(ControlConnection.java:168)
 at com.datastax.driver.core.ControlConnection.connect(ControlConnection.java:81)
 at com.datastax.driver.core.Cluster$Manager.init(Cluster.java:662)
 at com.datastax.driver.core.Cluster$Manager.access$100(Cluster.java:604)
 at com.datastax.driver.core.Cluster.<init>(Cluster.java:69)
 at com.datastax.driver.core.Cluster.buildFrom(Cluster.java:96)
 at com.datastax.driver.core.Cluster$Builder.build(Cluster.java:585)
 at AuthenticatedClient.connect(AuthenticatedClient.java:19)
 at AuthenticatedClient.main(AuthenticatedClient.java:59)
Caused by: javax.security.auth.login.LoginException: Cannot locate default realm
 at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Unknown Source)
 at com.sun.security.auth.module.Krb5LoginModule.login(Unknown Source)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
 at java.lang.reflect.Method.invoke(Unknown Source)
 at javax.security.auth.login.LoginContext.invoke(Unknown Source)
 at javax.security.auth.login.LoginContext.access$000(Unknown Source)
 at javax.security.auth.login.LoginContext$4.run(Unknown Source)
 at javax.security.auth.login.LoginContext$4.run(Unknown Source)
 at java.security.AccessController.doPrivileged(Native Method)
 at javax.security.auth.login.LoginContext.invokePriv(Unknown Source)
 at javax.security.auth.login.LoginContext.login(Unknown Source)
 at com.datastax.driver.core.sasl.KerberosAuthenticator.loginSubject(KerberosAuthenticator.java:109)
 ... 16 more
Caused by: KrbException: Cannot locate default realm
 at sun.security.krb5.PrincipalName.<init>(Unknown Source)
 at sun.security.krb5.KrbAsReq.<init>(Unknown Source)
 at sun.security.krb5.KrbAsReqBuilder.build(Unknown Source)
 at sun.security.krb5.KrbAsReqBuilder.send(Unknown Source)
 at sun.security.krb5.KrbAsReqBuilder.action(Unknown Source)
 ... 30 more
Caused by: KrbException: Cannot locate default realm
 at sun.security.krb5.Config.getDefaultRealm(Unknown Source)
 ... 35 more
Caused by: KrbException: Generic error (description in e-text) (60) - Unable to locate Kerberos realm
 at sun.security.krb5.Config.getRealmFromDNS(Unknown Source)
 ... 36 more

使用DSE 3.2.3和java驱动程序1.0.4

Answer 1

最有可能的是，这表明客户端上的Kerberos设置丢失或配置错误。在linux上，相关文件是/etc/krb5.conf，您可能需要检查 [libdefaults]和[realms]部分。对于您正在使用的JAAS配置，我希望在krb5.conf中看到类似的内容：

[libdefaults]
default_realm = MYDOMAIN.COM
.
.
.
[realms]
MYDOMAIN.COM = {
    kdc = <address of your kdc>
    admin_server = <address of the domain admin server>
}

您还需要确保正确设置DNS名称解析。从客户端计算机，确保正向和反向分辨率正常工作，例如：

nslookup <hostname> && nslookup <host ip>

我还会根据此处的说明验证您是否可以使用cqlsh连接到群集：http://www.datastax.com/docs/datastax_enterprise3.2/security/cqlsh_setup#security-run-cqlsh

如果您在客户端计算机上运行OSX，此错误也可能与您相关：http://bugs.java.com/bugdatabase/view_bug.do?bug_id=7184815

具有kerberos安全性的Datastax Java驱动程序

1 个答案: