Question

我到处寻找并询问了很多人，但到目前为止还没有人能帮助我。我正在尝试通过Java（8）应用程序从我的windows（7）笔记本电脑连接到远程机器上的postgres（9.6）数据库。我们使用Kerberos来保护访问权限，但我有一个有效的Kerberos帐户，可以通过de Ticket Manager创建票证。我也可以登录到需要Kerberos身份验证的其他“服务”，但不是通过java而是通过浏览器。

但无论我尝试什么，我都无法让我的java程序工作。这就是我所拥有的：

krb5.ini

[libdefaults]
default_realm = <domain>
forwardable = true
kdc_timesync = 1
ccache_type = 4
proxiable = true
dns_lookup_kdc = true
dns_lookup_realm = true

[realms]
<domain>.NET = {
    admin_server = <domain-server>
    default_domain = <domain>
}

[domain_realm]
.<domain> = <domain>
<domain>  = <domain>
.local.nl.<company>.com = <domain>
local.nl.<company>.com = <domain>
 [login]
krb4_convert = true
krb4_get_tickets = false

的Jaas.conf：

pgjdbc {
com.sun.security.auth.module.Krb5LoginModule required
refreshKrb5Config=true
doNotPrompt=false
useTicketCache=false
renewTGT=false
useKeyTab=true
keyTab="<location>/<filename>.keytab"
debug=true
client=true
principal="<username>@<domain>";
};

.keytab文件

public class KerberosPostgresClient {
static {
        System.setProperty("java.security.krb5.conf","c:/tmp/krb5.ini");
        System.setProperty("java.security.krb5.realm","<domain>");
        System.setProperty("java.security.krb5.kdc","<domain>");
        System.setProperty("javax.security.auth.useSubjectCredsOnly","false");
        System.setProperty("java.security.auth.login.config","c:/tmp/jaas.conf"); }

@Test
public void test() throws Exception {
    String url = "jdbc:postgresql://<hostname>:<port>/<database>";
    Properties properties = new Properties();
    properties.setProperty("JAASConfigName", "pgjdbc");
    try (Connection conn = DriverManager.getConnection(url, connInfo)) {
        conn.createStatement();
    } catch (Exception e) {
        e.printStackTrace();
    }
}
}

非常简单的java代码可以找到keytab，jaas.conf。我在另一台计算机上创建了keytab文件，但使用相同的主体和密码。

当我运行程序时，我看到：

Debug is  true storeKey false useTicketCache false useKeyTab true doNotPrompt false ticketCache is null isInitiator true KeyTab is c:/tmp/<username>.keytab refreshKrb5Config is true principal is <username>@<domain> tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Refreshing Kerberos configuration

过了一会儿我得到了一个例外：

[Krb5LoginModule] authentication failed 
Receive timed out
org.postgresql.util.PSQLException: GSS Authentication failed
at org.postgresql.gss.MakeGSS.authenticate(MakeGSS.java:65)
....    
Caused by: java.net.SocketTimeoutException: Receive timed out
at java.net.DualStackPlainDatagramSocketImpl.socketReceiveOrPeekData(Native Method)
at java.net.DualStackPlainDatagramSocketImpl.receive0(DualStackPlainDatagramSocketImpl.java:120)
at java.net.AbstractPlainDatagramSocketImpl.receive(AbstractPlainDatagramSocketImpl.java:144)
at java.net.DatagramSocket.receive(DatagramSocket.java:812)
at sun.security.krb5.internal.UDPClient.receive(NetClient.java:206)
at sun.security.krb5.KdcComm$KdcCommunication.run(KdcComm.java:411)
at sun.security.krb5.KdcComm$KdcCommunication.run(KdcComm.java:364)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.krb5.KdcComm.send(KdcComm.java:348)
at sun.security.krb5.KdcComm.sendIfPossible(KdcComm.java:253)
at sun.security.krb5.KdcComm.send(KdcComm.java:229)
at sun.security.krb5.KdcComm.send(KdcComm.java:200)
at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:316)
at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361)
at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:776)
... 45 more

我曾经得到其他异常，表明它无法找到keytab文件但是使用上面的设置它似乎工作。我也可以从我的机器ping postgres数据库。

我发现：Error connecting to PostgreSQL 9.4 with MIT Kerberos via JDBC vs CLI但没有解决方案

Answer 1

我终于在jaas.conf中使用了以下设置：

<textarea rows=10 cols=30
    style="color: #008000; overflow: scroll;" class="form-control"
    ng-model="instructionset.payload_plain" placeholder="title">
</textarea>

};

即doNotPrompt，useTicketCache的组合，renewTGT终于搞定了

使用Java / Windows7中的Kerberos连接到Postgres DB

1 个答案: