GSSException:未提供有效凭据(机制级别:无法找到任何Kerberos tgt)

Question

我是MOngoDB + Java配置的新手.我试图从远程mongodb服务器到Java应用程序的连接.我想使用GSSAPI机制来连接mongotemplate.下面的代码已成功执行.下面的代码来自我的配置文件.

List<ServerAddress> serverAddresses = new ArrayList<ServerAddress>();
    ServerAddress address = new ServerAddress(host, port);
    serverAddresses.add(address);
    List<MongoCredential> credentials = new ArrayList<MongoCredential>();

    MongoCredential credential = MongoCredential.createGSSAPICredential(userName);

    credential.withMechanismProperty("SERVICE_NAME", gssapiServiceName);
    credential.withMechanismProperty("CANONICALIZE_HOST_NAME", true);
    credentials.add(credential);

    return new MongoClient(serverAddresses, credentials);

但是当我尝试执行下面的代码时,我会遇到异常

DB db = mongoTemplate.getDb();
Set<String> dbCollections1 = db.getCollectionNames();

例外:

GSSException:没有提供有效凭据(机制级别:无法找到任何Kerberos tgt)sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:147)sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory) .java:122)sun.security.jgss.GSSManagerImpl.getCredentialElement(GSSManagerImpl.java:193)at sun.security.jgss.GSSCredentialImpl.add(GSSCredentialImpl.java:427)at sun.security.jgss.GSSCredentialImpl.(GSSCredentialImpl .java:62)在sun.security.jgss.GSSManagerImpl.createCredential(GSSManagerImpl.java:154)com.mongodb.DBPort $ GSSAPIAuthenticator.getGSSCredential(DBPort.java:622)com.mongodb.DBPort $ GSSAPIAuthenticator.createSaslClient( DBPort.java:593)com.mongodb.DBPort $ SaslAuthenticator.authenticate(DBPort.java:895)at com.mongodb.DBPort.authenticate(DBPort.java:432)at com.mongodb.DBPort.checkAuth(DBPort.java) :443)com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:289)at com.mongodb.DBTCPConnector.call(DBTCPConn)ector.java:269)com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84)at com.mongodb.DB.command(DB.java:320)at com.mongodb.DB.command(DB.java:299) )com.mongodb.DB.command(DB.java:388)com.mongodb.DBApiLayer.getCollectionNames(DBApiLayer.java:152)

Answer 1

百万感谢所有回复的人,并回顾我的问题.

添加一些系统属性和一个新的conf文件后,最后我能够与MongoDB服务器连接.这里有更新的代码 -

try {
        System.setProperty("java.security.krb5.conf","C:/mongodb/UnixKeytab/krb5.conf");
        System.setProperty("java.security.krb5.realm","EXAMPLE.COM");
        System.setProperty("java.security.krb5.kdc","example.com");
        System.setProperty("javax.security.auth.useSubjectCredsOnly","false");
        System.setProperty("java.security.auth.login.config","C:/mongodb/UnixKeytab/gss-jaas.conf");


        List<ServerAddress> serverAddresses = new ArrayList<ServerAddress>();
        ServerAddress address = new ServerAddress(host, port);
        serverAddresses.add(address);
        List<MongoCredential> credentials = new ArrayList<MongoCredential>();
        MongoCredential credential = MongoCredential.createGSSAPICredential(username);
        credentials.add(credential);
        MongoClient mongoClient1 = new MongoClient(serverAddresses, credentials);
        DB db = mongoClient1.getDB(database);

    } catch (UnknownHostException e) {
        e.printStackTrace();
    }

我的krb5.conf文件如下所示 -

[libdefaults]
     default_realm = EXAMPLE.COM
     default_tkt_enctypes = des-cbc-md5 rc4-hmac
     default_tgs_enctypes = des-cbc-md5 rc4-hmac
     default_keytab_name = <keytab file path>
[realms]
EXAMPLE.COM = {
    kdc = example.com
    master_kdc = example.com
    default_domain = EXAMPLE.COM
}
INTRANET = {
    kdc = example.com
    master_kdc = example.com
    default_domain = example.com
}

我的gss-jaas.conf如下所示 -

com.sun.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
useTicketCache=false
principal="my-account@MY_REALM"
doNotPrompt=true
keyTab="path-to-my-keytab-file"
debug=true;};

我发布的代码对我有用.希望这对其他人有用.

Answer 2

在这篇文章中添加一些信息，因为它已经非常有用了。

如果Sasl/createSaslClient未在Subject:doAs从 检索的方法内运行LoginContext，则不会从文件中获取凭据krb5.conf。即，GSS代码查看当前线程的安全管理器以查找通过该方法注册的主题Subject:doAs，然后使用来自该主题的凭据。这Subject应该是通过jaas它依次读取正确的jaas和krb5.conf凭据来获得的，但是如果您不在方法内运行sasl和方法，那么所有这些都无关紧要。saslclientSubject:doAs

您可以通过设置来绕过它javax.security.auth.useSubjectCredsOnly=false，这意味着如果找不到凭据，将在 jaas 文件中搜索一些默认名称，请参见LoginConfigImpl.java#92，其中一个是com.sun.security.jgss.initiate.

例如

com.sun.security.jgss.initiate{
   com.sun.security.auth.module.Krb5LoginModule required
   doNotPrompt=true
   useTicketCache=true
   useKeyTab=true
   keyTab="mykeytab"
   principal="service/host@REALM";
 };