Question

我在对 NiFi 进行 Kerbering 时遇到问题。

我的设置是这样的，我有 Docker，其中有两个容器：apache/nifi 和 gcavalcante8808/krb5-server。 NiFi 已经通过 HTTPS 和初始管理员身份进行保护，因此我可以使用证书登录成为管理员，没有问题。到目前为止一切顺利。

然后，如果我在 nifi-user.log 中没有管理员证书的情况下从浏览器中拉出 NiFi UI，则会出现消息 Kerberos ticket login not supported by this NiFi（堆栈跟踪已缩短）：

2021-02-18 10:25:39,804 INFO [main] o.a.n.a.FileUserGroupProvider Users/Groups file loaded at Thu Feb 18 10:25:39 UTC 2021
2021-02-18 10:25:39,836 INFO [main] o.a.n.a.FileAccessPolicyProvider Authorizations file loaded at Thu Feb 18 10:25:39 UTC 2021
2021-02-18 10:25:41,224 WARN [main] o.a.n.w.s.o.StandardOidcIdentityProvider The OIDC provider is not configured or enabled
2021-02-18 10:35:19,976 WARN [NiFi Web Server-30] o.a.n.w.a.c.IllegalStateExceptionMapper java.lang.IllegalStateException: Kerberos ticket login not supported by this NiFi.. Returning Conflict response.
java.lang.IllegalStateException: Kerberos ticket login not supported by this NiFi.
    at org.apache.nifi.web.api.AccessResource.createAccessTokenFromTicket(AccessResource.java:644)
...
2021-02-18 10:35:20,041 WARN [NiFi Web Server-28] o.a.n.w.a.c.IllegalStateExceptionMapper java.lang.IllegalStateException: OpenId Connect is not configured.. Returning Conflict response.
java.lang.IllegalStateException: OpenId Connect is not configured.
    at org.apache.nifi.web.api.AccessResource.oidcExchange(AccessResource.java:301)
...
2021-02-18 10:35:20,092 INFO [NiFi Web Server-29] o.a.n.w.s.NiFiAuthenticationFilter Attempting request for (<anonymous>) GET https://<redacted>:4321/nifi-api/flow/current-user (source ip: 172.17.0.1)
2021-02-18 10:35:20,096 WARN [NiFi Web Server-29] o.a.n.w.s.NiFiAuthenticationFilter Rejecting access to web api: Anonymous authentication has not been configured.

如果我继续尝试登录，我会得到 Receive timed out（在 nifi-bootstrap.log 中）：

2021-02-18 10:39:00,695 INFO [NiFi logging handler] org.apache.nifi.StdOut Debug is  true storeKey true useTicketCache false useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
2021-02-18 10:39:00,697 INFO [NiFi logging handler] org.apache.nifi.StdOut      [Krb5LoginModule] user entered username: test_RW@NIFI.DEV
2021-02-18 10:39:00,697 INFO [NiFi logging handler] org.apache.nifi.StdOut 
2021-02-18 10:39:00,704 INFO [NiFi logging handler] org.apache.nifi.StdOut Java config name: /etc/krb5.conf
2021-02-18 10:39:00,755 INFO [NiFi logging handler] org.apache.nifi.StdOut Loaded from Java config
2021-02-18 10:39:00,755 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KdcAccessibility: reset
2021-02-18 10:39:00,760 INFO [NiFi logging handler] org.apache.nifi.StdOut Using builtin default etypes for default_tkt_enctypes
2021-02-18 10:39:00,760 INFO [NiFi logging handler] org.apache.nifi.StdOut default etypes for default_tkt_enctypes: 18 17 16 23.
2021-02-18 10:39:00,760 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KrbAsReq creating message
2021-02-18 10:39:00,771 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KrbKdcReq send: kdc=<redacted> UDP:8088, timeout=30000, number of retries =3, #bytes=174
2021-02-18 10:39:00,771 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KDCCommunication: kdc=<redacted> UDP:8088, timeout=30000,Attempt =1, #bytes=174
2021-02-18 10:39:30,889 INFO [NiFi logging handler] org.apache.nifi.StdOut SocketTimeOutException with attempt: 1
2021-02-18 10:39:30,890 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KDCCommunication: kdc=<redacted> UDP:8088, timeout=30000,Attempt =2, #bytes=174
2021-02-18 10:40:00,927 INFO [NiFi logging handler] org.apache.nifi.StdOut SocketTimeOutException with attempt: 2
2021-02-18 10:40:00,927 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KDCCommunication: kdc=<redacted> UDP:8088, timeout=30000,Attempt =3, #bytes=174
2021-02-18 10:40:30,966 INFO [NiFi logging handler] org.apache.nifi.StdOut SocketTimeOutException with attempt: 3
2021-02-18 10:40:30,966 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KrbKdcReq send: error trying <redacted>:8088
2021-02-18 10:40:30,967 INFO [NiFi logging handler] org.apache.nifi.StdOut java.net.SocketTimeoutException: Receive timed out
2021-02-18 10:40:30,969 INFO [NiFi logging handler] org.apache.nifi.StdOut  at java.net.PlainDatagramSocketImpl.receive0(Native Method)
...
2021-02-18 10:40:30,984 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KdcAccessibility: add <redacted>:8088
2021-02-18 10:40:30,984 INFO [NiFi logging handler] org.apache.nifi.StdOut      [Krb5LoginModule] authentication failed 
2021-02-18 10:40:30,984 INFO [NiFi logging handler] org.apache.nifi.StdOut Receive timed out

这一切都以 NiFi 中的空白弹出窗口结束。

我完全没有想法，请有人知道要检查/设置/编辑/...的内容吗？对我来说，似乎 NiFi 配置错误，但据我所知，所有部分都是正确的。更让我困惑的是，尽管不支持 Kerberos 票证，但它尝试了它并且以某种方式失败了。

我在 nifi.properties 中的设置：

# kerberos #
nifi.kerberos.krb5.file=/etc/krb5.conf
nifi.kerberos.service.principal=app_nifi_svc/admin@NIFI.DEV
nifi.kerberos.keytab.location=/opt/app_nifi_svc.keytab

在 login-identity-provider.xml 中：

<provider>
    <identifier>kerberos-provider</identifier>
    <class>org.apache.nifi.kerberos.KerberosProvider</class>
    <property name="Default Realm">NIFI.DEV</property>
    <property name="Kerberos Config File">/etc/krb5.conf</property>
    <property name="Authentication Expiration">12 hours</property>
</provider>

krb5.conf:

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 default_realm = NIFI.DEV

 [realms]
 NIFI.DEV = {
    kdc = <redacted>:8088
    admin_server = <redacted>:8088
 }

检查 NiFi 容器中的所有权和模式：

~> dc exec -it nifi_https ls -l /opt/app_nifi_svc.keytab
-rw-------. 1 nifi nifi 158 Feb 17 15:46 /opt/app_nifi_svc.keytab
~> dc exec -it nifi_https ls -l /etc/krb5.conf
-rwxrwxrwx. 1 nifi nifi 229 Feb 17 15:49 /etc/krb5.conf

检查密钥表是否在 Kerberos 容器中工作：

/ # kinit -kt /opt/app_nifi_svc.keytab app_nifi_svc/admin@NIFI.DEV
/ # klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: app_nifi_svc/admin@NIFI.DEV

Valid starting     Expires            Service principal
02/18/21 09:59:44  02/18/21 21:59:44  krbtgt/NIFI.DEV@NIFI.DEV
        renew until 02/25/21 09:59:42

防火墙已打开并且 telnet 从 NiFi 容器到 Kerberos 容器连接（“hi”是我的查询）：

root@<nifi_container>:/opt/nifi/nifi-current# telnet <redacted> 8088
Trying <ipadress of redacted>...
Connected to <redacted>.
Escape character is '^]'.
hi
X~V0T▒▒▒20210218105711Z▒        EӦ=▒                                                                      IFI.DEV▒0▒0rbtgIFI.DEVConnection closed by foreign host.

EDIT：在 krb5.conf 中发现一个可能的配置错误：admin_server = <redacted>:8088。但更改为 admin_server = <redacted>:8749 也无济于事。

Answer 1

真正的原因不知何故被隐藏了。问题是，默认配置中的 Kerberos 尝试使用 UDP 协议进行通信。另一方面，Docker 默认为 TCP 协议公开端口。因此解决方案很简单 - 启动 Kerberos 容器，并为 TCP 和 UDP 协议公开端口：

docker run 
-p 8088:8088/tcp \
-p 8749:8749/tcp \
-p 8088:8088/udp \
-p 8749:8749/udp \
gcavalcante8808/krb5-server

NiFi：此 NiFi 不支持 Kerberos 票证登录

1 个答案: