HttpClient请求开启Kerberos的HTTP服务

小灰灰 2022-11-17 05:24 306阅读 0赞

# 内容来自 [社会我帅神][Link 1] #

# 方案一. #

import org.apache.http.HttpResponse;
    import org.apache.http.auth.AuthSchemeProvider;
    import org.apache.http.auth.AuthScope;
    import org.apache.http.auth.Credentials;
    import org.apache.http.client.HttpClient;
    import org.apache.http.client.config.AuthSchemes;
    import org.apache.http.client.methods.HttpGet;
    import org.apache.http.client.methods.HttpUriRequest;
    import org.apache.http.config.Lookup;
    import org.apache.http.config.RegistryBuilder;
    import org.apache.http.impl.auth.SPNegoSchemeFactory;
    import org.apache.http.impl.client.BasicCredentialsProvider;
    import org.apache.http.impl.client.CloseableHttpClient;
    import org.apache.http.impl.client.HttpClientBuilder;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    
    import javax.security.auth.Subject;
    import javax.security.auth.kerberos.KerberosPrincipal;
    import javax.security.auth.login.AppConfigurationEntry;
    import javax.security.auth.login.Configuration;
    import javax.security.auth.login.LoginContext;
    import java.io.IOException;
    import java.security.Principal;
    import java.security.PrivilegedAction;
    import java.util.HashMap;
    import java.util.HashSet;
    import java.util.Set;
    
    public class RequestKerberosUrlUtils { 
        public static Logger logger = LoggerFactory.getLogger(RequestKerberosUrlUtils.class);
        private String principal;
        private String keyTabLocation;
    
        public RequestKerberosUrlUtils() { 
        }
    
        public RequestKerberosUrlUtils(String principal, String keyTabLocation) { 
            super();
            this.principal = principal;
            this.keyTabLocation = keyTabLocation;
        }
    
        public RequestKerberosUrlUtils(String principal, String keyTabLocation, boolean isDebug) { 
            this(principal, keyTabLocation);
            if (isDebug) { 
                System.setProperty("sun.security.spnego.debug", "true");
                System.setProperty("sun.security.krb5.debug", "true");
            }
        }
    
        public RequestKerberosUrlUtils(String principal, String keyTabLocation, String krb5Location, boolean isDebug) { 
            this(principal, keyTabLocation, isDebug);
            System.setProperty("java.security.krb5.conf", krb5Location);
        }
    
        //模拟curl使用kerberos认证
        private static HttpClient buildSpengoHttpClient() { 
            HttpClientBuilder builder = HttpClientBuilder.create();
            Lookup<AuthSchemeProvider> authSchemeRegistry = RegistryBuilder.<AuthSchemeProvider>create().
                    register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory(true)).build();
            builder.setDefaultAuthSchemeRegistry(authSchemeRegistry);
            BasicCredentialsProvider credentialsProvider = new BasicCredentialsProvider();
            credentialsProvider.setCredentials(new AuthScope(null, -1, null), new Credentials() { 
                @Override
                public Principal getUserPrincipal() { 
                    return null;
                }
    
                @Override
                public String getPassword() { 
                    return null;
                }
            });
            builder.setDefaultCredentialsProvider(credentialsProvider);
            CloseableHttpClient httpClient = builder.build();
            return httpClient;
        }
    
        public HttpResponse callRestUrl(final String url, final String userId) { 
            logger.warn(String.format("Calling KerberosHttpClient %s %s %s", this.principal, this.keyTabLocation, url));
            Configuration config = new Configuration() { 
                @SuppressWarnings("serial")
                @Override
                public AppConfigurationEntry[] getAppConfigurationEntry(String name) { 
                    return new AppConfigurationEntry[]{ new AppConfigurationEntry("com.sun.security.auth.module.Krb5LoginModule",
                            AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, new HashMap<String, Object>() { 
                        { 
                            put("useTicketCache", "false");
                            put("useKeyTab", "true");
                            put("keyTab", keyTabLocation);
                            //Krb5 in GSS API needs to be refreshed so it does not throw the error
                            //Specified version of key is not available
                            put("refreshKrb5Config", "true");
                            put("principal", principal);
                            put("storeKey", "true");
                            put("doNotPrompt", "true");
                            put("isInitiator", "true");
                            put("debug", "true");
                        }
                    })};
                }
            };
            Set<Principal> princ = new HashSet<Principal>(1);
            princ.add(new KerberosPrincipal(userId));
            Subject sub = new Subject(false, princ, new HashSet<Object>(), new HashSet<Object>());
            try { 
                //认证模块：Krb5Login
                LoginContext lc = new LoginContext("Krb5Login", sub, null, config);
                lc.login();
                Subject serviceSubject = lc.getSubject();
                return Subject.doAs(serviceSubject, new PrivilegedAction<HttpResponse>() { 
                    HttpResponse httpResponse = null;
    
                    @Override
                    public HttpResponse run() { 
                        try { 
                            HttpUriRequest request = new HttpGet(url);
                            HttpClient spnegoHttpClient = buildSpengoHttpClient();
                            httpResponse = spnegoHttpClient.execute(request);
                            return httpResponse;
                        } catch (IOException ioe) { 
                            ioe.printStackTrace();
                        }
                        return httpResponse;
                    }
                });
            } catch (Exception le) { 
                le.printStackTrace();
            }
            return null;
        }
    }

# 方案二 #

package com.post;
    
    import org.apache.http.HttpResponse;
    import org.apache.http.auth.AuthSchemeProvider;
    import org.apache.http.auth.AuthScope;
    import org.apache.http.auth.Credentials;
    import org.apache.http.client.HttpClient;
    import org.apache.http.client.config.AuthSchemes;
    import org.apache.http.client.methods.HttpGet;
    import org.apache.http.client.methods.HttpPost;
    import org.apache.http.client.methods.HttpUriRequest;
    import org.apache.http.config.Lookup;
    import org.apache.http.config.RegistryBuilder;
    import org.apache.http.entity.ContentType;
    import org.apache.http.entity.StringEntity;
    import org.apache.http.impl.auth.SPNegoSchemeFactory;
    import org.apache.http.impl.client.BasicCredentialsProvider;
    import org.apache.http.impl.client.CloseableHttpClient;
    import org.apache.http.impl.client.HttpClientBuilder;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    
    import javax.security.auth.Subject;
    import javax.security.auth.login.Configuration;
    import javax.security.auth.login.LoginContext;
    import javax.security.auth.login.LoginException;
    import java.io.IOException;
    import java.security.Principal;
    import java.security.PrivilegedAction;
    
    public class RequestKerberosUrlUtilsClassPath { 
        public static Logger logger = LoggerFactory.getLogger(RequestKerberosUrlUtilsClassPath.class);
    
        public RequestKerberosUrlUtilsClassPath() { 
        }
    
        public RequestKerberosUrlUtilsClassPath(boolean isDebug) { 
            if (isDebug) { 
                System.setProperty("sun.security.spnego.debug", "true");
                System.setProperty("sun.security.krb5.debug", "true");
            }
        }
    
        public RequestKerberosUrlUtilsClassPath(String krb5Location, boolean isDebug) { 
            System.setProperty("java.security.krb5.conf", krb5Location);
        }
    
        //模拟curl使用kerberos认证
        private static HttpClient buildSpengoHttpClient() { 
            HttpClientBuilder builder = HttpClientBuilder.create();
            Lookup<AuthSchemeProvider> authSchemeRegistry = RegistryBuilder.<AuthSchemeProvider>create().
                    register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory(true)).build();
            builder.setDefaultAuthSchemeRegistry(authSchemeRegistry);
            BasicCredentialsProvider credentialsProvider = new BasicCredentialsProvider();
            credentialsProvider.setCredentials(new AuthScope(null, -1, null), new Credentials() { 
                @Override
                public Principal getUserPrincipal() { 
                    return null;
                }
    
                @Override
                public String getPassword() { 
                    return null;
                }
            });
            builder.setDefaultCredentialsProvider(credentialsProvider);
            CloseableHttpClient httpClient = builder.build();
            return httpClient;
        }
    
        public HttpResponse get(final String url) { 
            try { 
    
                Subject serviceSubject = getSubject();
                return Subject.doAs(serviceSubject, new PrivilegedAction<HttpResponse>() { 
                    HttpResponse httpResponse = null;
    
                    @Override
                    public HttpResponse run() { 
                        try { 
                            HttpUriRequest request = new HttpGet(url);
                            HttpClient spnegoHttpClient = buildSpengoHttpClient();
                            httpResponse = spnegoHttpClient.execute(request);
                            return httpResponse;
                        } catch (IOException ioe) { 
                            ioe.printStackTrace();
                        }
                        return httpResponse;
                    }
                });
            } catch (Exception le) { 
                le.printStackTrace();
            }
            return null;
        }
    
        public HttpResponse post(final String url, final String params) { 
            try { 
    
                Subject serviceSubject = getSubject();
                return Subject.doAs(serviceSubject, new PrivilegedAction<HttpResponse>() { 
                    HttpResponse httpResponse = null;
    
                    @Override
                    public HttpResponse run() { 
                        try { 
                            HttpPost httpPost = new HttpPost();
                            httpPost.setEntity(new StringEntity(params, ContentType.APPLICATION_JSON));
                            HttpClient spnegoHttpClient = buildSpengoHttpClient();
                            httpResponse = spnegoHttpClient.execute(httpPost);
                            return httpResponse;
                        } catch (IOException ioe) { 
                            ioe.printStackTrace();
                        }
                        return httpResponse;
                    }
                });
            } catch (Exception le) { 
                le.printStackTrace();
            }
            return null;
        }
    
        private Subject getSubject() throws LoginException { 
            String property = System.getProperty("java.security.auth.login.config");
            if (null != property) { 
                Configuration configuration = Configuration.getConfiguration();
                //认证模块：Krb5Login
                LoginContext lc = new LoginContext("Krb5Login", null, null, configuration);
                lc.login();
                return lc.getSubject();
            }
            return new Subject();
        }
    }

# 验证 #

package com.post;
    
    
    import org.apache.commons.io.IOUtils;
    import org.apache.http.HttpResponse;
    
    import java.io.InputStream;
    import java.nio.charset.StandardCharsets;
    import java.util.Arrays;
    
    public class RequestKerberosUrlUtilsTest { 
    
    
        public static void main(String[] args) { 
            params();
            classPath();
        }
    
        public static void params() { 
            String user = "ws@HENGHE.COM";
            String keytab = "D:\\ysstest\\post\\src\\main\\resources\\ws.keytab";
            String krb5Location = "D:\\ysstest\\post\\src\\main\\resources\\krb5.conf";
            try { 
                RequestKerberosUrlUtils restTest = new RequestKerberosUrlUtils(user, keytab, krb5Location, false);
                // refer to https://hadoop.apache.org/docs/stable/hadoop-project-dist/hadoop-hdfs/WebHDFS.html#Open_and_Read_a_File
                String url_liststatus = "http://localhost:8083/offset/test";
                // location
                HttpResponse response = restTest.callRestUrl(url_liststatus, user);
                InputStream is = response.getEntity().getContent();
                System.out.println("Status code " + response.getStatusLine().getStatusCode());
                System.out.println("message is :" + Arrays.deepToString(response.getAllHeaders()));
                System.out.println("string：\n" + new String(IOUtils.toByteArray(is), StandardCharsets.UTF_8));
    
            } catch (Exception exp) { 
                exp.printStackTrace();
            }
    
        }
    
        public static void classPath() { 
            String krb5Location = "D:\\ysstest\\post\\src\\main\\resources\\krb5.conf";
            System.setProperty("java.security.auth.login.config", "D:\\ysstest\\post\\src\\main\\resources\\http.conf");
            System.setProperty("java.security.krb5.conf", "D:\\ysstest\\post\\src\\main\\resources\\krb5.conf");
            try { 
                RequestKerberosUrlUtilsClassPath restTest = new RequestKerberosUrlUtilsClassPath();
                // refer to https://hadoop.apache.org/docs/stable/hadoop-project-dist/hadoop-hdfs/WebHDFS.html#Open_and_Read_a_File
                String url_liststatus = "http://localhost:8083/offset/test";
                // location
                HttpResponse response = restTest.get(url_liststatus);
                InputStream is = response.getEntity().getContent();
                System.out.println("Status code " + response.getStatusLine().getStatusCode());
                System.out.println("message is :" + Arrays.deepToString(response.getAllHeaders()));
                System.out.println("string：\n" + new String(IOUtils.toByteArray(is), StandardCharsets.UTF_8));
    
            } catch (Exception exp) { 
                exp.printStackTrace();
            }
    
        }
    }

[Link 1]: https://blog.csdn.net/weixin_41609807/article/details/115304325?utm_source=app&app_version=4.5.3