java - 从 Java/Windows7 使用 Kerberos 连接到 Postgres DB

Question

我到处都找过，也问过很多人，但到目前为止没有人能帮助我。我正在尝试通过 Java (8) 应用程序从我的 Windows (7) 笔记本电脑连接到远程机器上的 postgres (9.6) 数据库。我们使用 Kerberos 来保护访问，但我有一个有效的 Kerberos 帐户并且可以通过 de Ticket Manager 创建票证。我还可以登录到其他需要 Kerberos 身份验证的“服务”，虽然不是通过 java，而是通过浏览器。

但无论我怎样尝试，我的 Java 程序都无法运行。这是我得到的:

krb5.ini

[libdefaults]
default_realm = <domain>
forwardable = true
kdc_timesync = 1
ccache_type = 4
proxiable = true
dns_lookup_kdc = true
dns_lookup_realm = true

[realms]
<domain>.NET = {
    admin_server = <domain-server>
    default_domain = <domain>
}

[domain_realm]
.<domain> = <domain>
<domain>  = <domain>
.local.nl.<company>.com = <domain>
local.nl.<company>.com = <domain>
 [login]
krb4_convert = true
krb4_get_tickets = false

jaas.conf:

pgjdbc {
com.sun.security.auth.module.Krb5LoginModule required
refreshKrb5Config=true
doNotPrompt=false
useTicketCache=false
renewTGT=false
useKeyTab=true
keyTab="<location>/<filename>.keytab"
debug=true
client=true
principal="<username>@<domain>";
};

.keytab文件

public class KerberosPostgresClient {
static {
        System.setProperty("java.security.krb5.conf","c:/tmp/krb5.ini");
        System.setProperty("java.security.krb5.realm","<domain>");
        System.setProperty("java.security.krb5.kdc","<domain>");
        System.setProperty("javax.security.auth.useSubjectCredsOnly","false");
        System.setProperty("java.security.auth.login.config","c:/tmp/jaas.conf"); }

@Test
public void test() throws Exception {
    String url = "jdbc:postgresql://<hostname>:<port>/<database>";
    Properties properties = new Properties();
    properties.setProperty("JAASConfigName", "pgjdbc");
    try (Connection conn = DriverManager.getConnection(url, connInfo)) {
        conn.createStatement();
    } catch (Exception e) {
        e.printStackTrace();
    }
}
}

很简单的java代码就可以找到keytab，jaas.conf。我在另一台机器上创建了 key 表文件，但使用了相同的主体和密码。

当我运行程序时，我看到:

Debug is  true storeKey false useTicketCache false useKeyTab true doNotPrompt false ticketCache is null isInitiator true KeyTab is c:/tmp/<username>.keytab refreshKrb5Config is true principal is <username>@<domain> tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Refreshing Kerberos configuration

不久之后我得到一个异常:

[Krb5LoginModule] authentication failed 
Receive timed out
org.postgresql.util.PSQLException: GSS Authentication failed
at org.postgresql.gss.MakeGSS.authenticate(MakeGSS.java:65)
....    
Caused by: java.net.SocketTimeoutException: Receive timed out
at java.net.DualStackPlainDatagramSocketImpl.socketReceiveOrPeekData(Native Method)
at java.net.DualStackPlainDatagramSocketImpl.receive0(DualStackPlainDatagramSocketImpl.java:120)
at java.net.AbstractPlainDatagramSocketImpl.receive(AbstractPlainDatagramSocketImpl.java:144)
at java.net.DatagramSocket.receive(DatagramSocket.java:812)
at sun.security.krb5.internal.UDPClient.receive(NetClient.java:206)
at sun.security.krb5.KdcComm$KdcCommunication.run(KdcComm.java:411)
at sun.security.krb5.KdcComm$KdcCommunication.run(KdcComm.java:364)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.krb5.KdcComm.send(KdcComm.java:348)
at sun.security.krb5.KdcComm.sendIfPossible(KdcComm.java:253)
at sun.security.krb5.KdcComm.send(KdcComm.java:229)
at sun.security.krb5.KdcComm.send(KdcComm.java:200)
at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:316)
at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361)
at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:776)
... 45 more

我曾经遇到过其他异常，表明它找不到 keytab 文件，但使用上述设置似乎可以正常工作。我还可以从我的机器上 ping postgres 数据库。

我找到了:Error connecting to PostgreSQL 9.4 with MIT Kerberos via JDBC vs CLI但没有解决方案

Answer 1

我终于在我的 jaas.conf 中使用以下设置让它工作:

pgjdbc {
com.sun.security.auth.module.Krb5LoginModule required
refreshKrb5Config=true
doNotPrompt=true
useTicketCache=true
renewTGT=true
useKeyTab=true
keyTab="c:/<locationto>/<user>.keytab"
debug=true
client=true
principal="<user>@<domain>";
};

即doNotPrompt、useTicketCache、renewTGT的组合终于搞定了