0
내가 여기에 다음 지침에 따라 오전 : 장 3. Additional Features - Red Hat Customer PortalKerberos 인증 통합 원격
을 구체적으로 내가 3.3을 수행하고 원격 응용 프로그램 작업 Kerberos를 얻기 위해 노력하고 있어요.
내 standalone.xml은 문서의 예와 같습니다. 내 서비스 주체, keytab 및 사용자 작업, 이후 섹션 3.2 및 관리 인터페이스를 통해 로그인 할 수 있습니다.
<security-realm name="krbRealm">
<server-identities>
<kerberos>
<keytab principal="remote/[email protected]" path="tmfkrbrem.keytab" relative-to="jboss.server.config.dir" debug="true"/>
</kerberos>
</server-identities>
<authentication>
<kerberos remove-realm="true"/>
<properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
</authentication>
<authorization>
<properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
</authorization>
</security-realm>
<security-domain name="krb-remoting-domain">
<authentication>
<login-module code="Remoting" flag="optional">
<module-option name="password-stacking" value="useFirstPass"/>
</login-module>
<login-module code="RealmDirect" flag="required">
<module-option name="password-stacking" value="useFirstPass"/>
<module-option name="realm" value="krbRealm"/>
</login-module>
</authentication>
<mapping>
<mapping-module code="SimpleRoles" type="role">
<module-option name="testuser" value="Users"/>
</mapping-module>
</mapping>
</security-domain>
<subsystem xmlns="urn:jboss:domain:remoting:3.0">
<endpoint/>
<http-connector name="http-remoting-connector" connector-ref="default" security-realm="krbRealm"/>
</subsystem>
내가 여기에 표시된 클라이언트를 기반으로 샘플 클라이언트 코드를 사용하고 있습니다 : [JBEAP-715] EJB authentication via Kerberos does not work with wildfly-security-api - JBoss Issue Tracker
// Remoting
Context context = null;
try {
System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
System.setProperty("java.util.logging.manager", "java.util.logging.LogManager");
System.setProperty("java.util.logging.config.file", "logging.properties");
System.setProperty("java.util.logging.ConsoleHandler.level", "TRACE");
Properties props = new Properties();
props.put(Context.INITIAL_CONTEXT_FACTORY, "org.jboss.naming.remote.client.InitialContextFactory");
props.put(Context.PROVIDER_URL, "http-remoting://tmf-is3-sec.nsonet.com:8080");
props.put("jboss.naming.client.ejb.context", true);
props.put(Context.URL_PKG_PREFIXES, "org.jboss.ejb.client.naming");
props.put("remote.connection.main.connect.options.org.xnio.Options.SASL_POLICY_NOANONYMOUS","true");
props.put("remote.connection.main.connect.options.org.xnio.Options.SSL_ENABLED", "false");
props.put("remote.connection.main.connect.options.org.jboss.remoting3.RemotingOptions.SASL_PROTOCOL", "remote");
context = new InitialContext(props);
} catch (Exception e) {
e.printStackTrace();
}
tmfService tmfBean = (tmfService) context.lookup("tmf-app/com.mentor.tmf.bean//tmfBean!com.mentor.tmf.api.internal.tmfService");
tmfRequest req = new tmfRequest("First test");
req.print();
tmfResponse resp = tmfBean.firstOperation(req);
resp.print();
} 여기
하는 내 콩입니다 :
@Stateless
@Remote(tmfService.class)
@SecurityDomain("krb-remoting-domain")
@RolesAllowed("Users")
public class tmfBean implements tmfService {
public tmfBean() {
// nothing here
}
@Override
public tmfResponse firstOperation(tmfRequest req) {
System.out.println("tmfBean gets request <" + req.getMyData() + ">\n");
tmfResponse rval = new tmfResponse(req.getMyData() + " MODIFIED");
return rval;
}
}
나는 이러한 오류를 얻을 클라이언트 : (로그인 성공)
,451,515,Exception in thread "main" javax.naming.AuthenticationException: Failed to connect to any server. Servers tried: [http-remoting://tmf-is3-sec.nsonet.com:8080 (Authentication failed: all available authentication mechanisms failed:
GSSAPI: Server rejected authentication)] [Root exception is javax.security.sasl.SaslException: Authentication failed: all available authentication mechanisms failed:
GSSAPI: Server rejected authentication]
at org.jboss.naming.remote.client.HaRemoteNamingStore.failOverSequence(HaRemoteNamingStore.java:238)
at org.jboss.naming.remote.client.HaRemoteNamingStore.namingStore(HaRemoteNamingStore.java:149)
at org.jboss.naming.remote.client.HaRemoteNamingStore.namingOperation(HaRemoteNamingStore.java:130)
at org.jboss.naming.remote.client.HaRemoteNamingStore.lookup(HaRemoteNamingStore.java:272)
at org.jboss.naming.remote.client.RemoteContext.lookupInternal(RemoteContext.java:104)
at org.jboss.naming.remote.client.RemoteContext.lookup(RemoteContext.java:93)
at org.jboss.naming.remote.client.RemoteContext.lookup(RemoteContext.java:146)
at javax.naming.InitialContext.lookup(InitialContext.java:417)
at com.mentor.tmf.client.tmfTest.main(tmfTest.java:154)
Caused by: javax.security.sasl.SaslException: Authentication failed: all available authentication mechanisms failed:
GSSAPI: Server rejected authentication
at org.jboss.remoting3.remote.ClientConnectionOpenListener.allMechanismsFailed(ClientConnectionOpenListener.java:114)
at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:389)
at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:241)
나는 서버에서이 오류를 얻을 :
08:06:12,851 INFO [stdout] (default I/O-1) Debug is true storeKey true useTicketCache false useKeyTab true doNotPrompt false ticketCache is null isInitiator false KeyTab is C:\wildfly-10.0.0.Final\standalone\configuration\tmfkrbrem.keytab refreshKrb5Config is false principal is remote/[email protected] tryFirstPass is false useFirstPass is false storePass is false clearPass is false
08:06:12,853 INFO [stdout] (default I/O-1) principal is remote/[email protected]
08:06:12,853 INFO [stdout] (default I/O-1) Will use keytab
08:06:12,854 INFO [stdout] (default I/O-1) Commit Succeeded
08:06:12,854 INFO [stdout] (default I/O-1)
08:06:13,029 TRACE [org.jboss.remoting.remote.server] (default task-2) Server sending authentication rejected: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)]
at com.sun.security.sasl.gsskerb.GssKrb5Server.evaluateResponse(Unknown Source)
at org.jboss.sasl.gssapi.GssapiServer$1.run(GssapiServer.java:60)
at org.jboss.sasl.gssapi.GssapiServer$1.run(GssapiServer.java:56)
... 27 more
Caused by: KrbException: Checksum failed
at sun.security.krb5.internal.crypto.Aes128CtsHmacSha1EType.decrypt(Unknown Source)
at sun.security.krb5.internal.crypto.Aes128CtsHmacSha1EType.decrypt(Unknown Source)
at sun.security.krb5.EncryptedData.decrypt(Unknown Source)
... 19 more
Caused by: java.security.GeneralSecurityException: Checksum failed
at sun.security.krb5.internal.crypto.dk.AesDkCrypto.decryptCTS(Unknown Source)
at sun.security.krb5.internal.crypto.dk.AesDkCrypto.decrypt(Unknown Source)
at sun.security.krb5.internal.crypto.Aes128.decrypt(Unknown Source)
... 22 more
모든 지원
주시면 감사하겠습니다. Kerberos를 사용하여 클라이언트를 인증하여 EJB에 액세스하는 방법에 대한 문서는 찾을 수 없습니다.덕분에, 톰