java程序中获取kerberos登陆hadoop

本文由作者周梁伟授权网易云社区发布。

一般我们在使用kbs登陆hadoop服务时都直接在shell中调用kinit命令来获取凭证，这种方式简单直接，只要获取一次凭证之后都可以在该会话过程中重复访问。但是这种方式一个明显的问题就是如果在本次shell中会间隔调用不同的java程序，而这些程序需要访问不同权限的问题，需要在访问前调用各自的ktab文件获得授权。这中场景下情况会变得非常复杂，这时如果把kbs认证的过程移到java程序中就会简单很多，每个java程序中获取各自的凭证，及时多个进程同时运行也不会产生相互影响。我这里介绍两种java中获取kbs凭证的方法，分别使用 org.apache.hadoop.security.SecurityUtil 和 org.apache.hadoop.security.UserGroupInformation 两个类实现。

一、    使用ktab文件简单登录方式

登录操作函数

/**       * 尝试使用kerberos认证登录hfs       *@params       *       conf: 配置，其中带有keytab相关配置属性       *       keytab_KEY: 表示conf中代表keytab文件属性的键值       *       principal_KEY: 表示conf中代表principal属性的键值       * @throws IOException       */      static void tryKerberosLogin(Configuration conf, String keytab_KEY, String principal_KEY) throws IOException {           boolean useSec = true;           LOG.info("Hadoop Security enabled: " + useSec);           if (!useSec) {                return;           }           try {                @SuppressWarnings("rawtypes")                Class c = Class.forName("org.apache.hadoop.security.SecurityUtil");                // get method login(Configuration, String, String);                @SuppressWarnings("unchecked")                Method m = c.getMethod("login", Configuration.class, String.class,                          String.class);                m.invoke(null, conf,  keytab_KEY, principal_KEY);                LOG.info("successfully authenticated with keytab");           } catch (Exception e) {                LOG.error(                          "Flume failed when attempting to authenticate with keytab "                                    + SimpleConfiguration.get().getKerberosKeytab()                                    + " and principal '"                                    + SimpleConfiguration.get().getKerberosPrincipal()                                    + "'", e);                return;           }      }

配置

...       flume.security.kerberos.principal          flume.security.kerberos.keytab     resources/flume.keytab      …

Sample

//调用例子 public  FileSystem getFileSystem(Configuration conf) {                String KEYFILE_key = "flume.security.kerberos.keytab";                String PRINCIPAL_key = "flume.security.kerberos.principal";                  try {                     // 尝试用kerberos登录                     tryKerberosLogin(conf, KEYFILE_key, PRINCIPAL_key);                     // 获取一个hdfs实例                     instance = FileSystem.get( conf);                } catch (IOException e) {                     LOG.error("try getFileSystem fail()", e);                } catch (URISyntaxException e) {                     LOG.error("try getFileSystem fail()", e);                }           }           return instance;      }

二、    通过UserGroupInformation获取代理用户方式

package com.netease.backend.bigdata.wa.jobs;   import java.io.IOException;   import org.apache.hadoop.conf.Configuration; import org.apache.hadoop.fs.Path; import org.apache.hadoop.security.UserGroupInformation; import org.apache.log4j.Logger; import org.hsqldb.lib.StringUtil;   import com.netease.backend.bigdata.wa.core.ConfKeys;   /**  * 代理用户信息认证工具  *  * @author zhouliangwei  *  */ public class ProxyUGI {        private static Logger LOG = Logger.getLogger(ProxyUGI.class);        private static UserGroupInformation instance = null;      /**       * 从Configuration中获取代理用户的相关配置，并获取UserGroupInformation       * @return       * @throws IOException       */      public synchronized static UserGroupInformation getProxyUGI(Configuration conf) {           if (instance != null)                return instance;           try {                String username = conf.get(ConfKeys.MR_USER_NAME, "");                String proxyPrincipal = conf.get(ConfKeys.WDA_PROXY_PRINCIPAL, "");                String proxyKtab = conf.get(ConfKeys.WDA_PROXY_KEYTAB, "");                if (StringUtil.isEmpty(username)                          || StringUtil.isEmpty(proxyPrincipal)                          || StringUtil.isEmpty(proxyKtab)) {                     LOG.warn("config properties: ["                               + ConfKeys.MR_USER_NAME                               + ", "                               + ConfKeys.WDA_PROXY_PRINCIPAL                               + ", "                               + ConfKeys.WDA_PROXY_KEYTAB                               + "] in config file './conf/wda-core.xml' must be set!, quite use proxy mechanism");                     return null;                }                instance = UserGroupInformation.createProxyUser(username,                          UserGroupInformation.loginUserFromKeytabAndReturnUGI(                                    proxyPrincipal, proxyKtab));           } catch (IOException ex) {                //just ignore;           }           return instance;      } }

调用方式

... public static void main(final String[] args) throws Exception {           UserGroupInformation ugi = ProxyUGI.getProxyUGI();           if (ugi != null) {                ugi.doAs(new PrivilegedExceptionAction() {                     public EventJobClient run() throws Exception {                          EventJobClient mr = new EventJobClient();                          int code = ToolRunner.run(mr, args);                          System.exit(code);                          return mr;                     }                });                System.exit(1);           } else {                int exitCode = ToolRunner.run(new EventJobClient(), args);                System.exit(exitCode);           }      } ….

相关文章：
【推荐】 创意、实现和合作：一次原创H5的尝试