解决Kerberos并行认证票据失效问题：Spring Boot微服务实践指南

// login.conf 示例
com.sun.security.jgss.initiate {
  com.sun.security.auth.module.Krb5LoginModule required
  useKeyTab=true
  storeKey=true
  keyTab="/etc/krb5.keytab"  // 你的Keytab文件路径
  principal="HTTP/myservice.example.com@EXAMPLE.COM" // 服务主体名称
  doNotPrompt=true
  debug=true;
};

[libdefaults]
 default_realm = EXAMPLE.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 noaddresses = true

[realms]
 EXAMPLE.COM = {
  kdc = kdc.example.com
  admin_server = kdc.example.com
 }

[domain_realm]
 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM

java -Djava.security.auth.login.config=/path/to/login.conf \
     -Djava.security.krb5.conf=/path/to/krb5.conf \
     -jar your-app.jar

import javax.security.auth.Subject;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import java.security.PrivilegedAction;
import java.util.concurrent.Callable;

public class KerberosAuthTask<T> implements Callable<T> {

    private final String loginConfigName; // e.g., "com.sun.security.jgss.initiate"
    private final Callable<T> actualTask;
    private Subject subject;

    public KerberosAuthTask(String loginConfigName, Callable<T> actualTask) {
        this.loginConfigName = loginConfigName;
        this.actualTask = actualTask;
    }

    private void login() throws LoginException {
        LoginContext lc = new LoginContext(loginConfigName);
        lc.login(); // 使用JAAS配置中的Keytab进行登录
        this.subject = lc.getSubject();
    }

    private void logout() {
        if (subject != null) {
            try {
                // 登出并清理凭据，但通常在服务器端，我们可能希望保持Subject活跃
                // 具体策略取决于应用需求，若每次都新建Subject，则无需显式logout
                // lc.logout(); // 如果LoginContext是每次新建并只用于一次Subject.doAs，可以考虑logout
            } catch (Exception e) {
                System.err.println("Error during Kerberos logout: " + e.getMessage());
            }
        }
    }

    @Override
    public T call() throws Exception {
        try {
            login(); // 每个并行任务独立登录，获取独立Subject
            return Subject.doAs(subject, (PrivilegedAction<T>) () -> {
                try {
                    // 在此执行实际的微服务调用，此时当前线程与subject关联
                    System.out.println(Thread.currentThread().getName() + " - Subject principal: " + subject.getPrincipals());
                    return actualTask.call();
                } catch (Exception e) {
                    throw new RuntimeException("Error executing actual task in Kerberos context", e);
                }
            });
        } finally {
            // 根据需要决定是否登出或清理资源
            // logout(); // 如果Subject是短生命周期的，可以考虑登出
        }
    }
}

import org.apache.http.auth.AuthSchemeProvider;
import org.apache.http.client.config.AuthSchemes;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.config.Lookup;
import org.apache.http.config.RegistryBuilder;
import org.apache.http.impl.auth.SPNegoSchemeFactory;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.util.EntityUtils;
import org.springframework.stereotype.Service;

import java.io.IOException;
import java.security.PrivilegedAction;
import java.util.ArrayList;
import java.util.List;
import java.util.concurrent.*;
import javax.security.auth.Subject;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;

@Service
public class MicroserviceCaller {

    private final ExecutorService executorService = Executors.newFixedThreadPool(5); // 示例线程池

    public List<String> callMicroservicesInParallel(List<String> serviceUrls) throws InterruptedException, ExecutionException {
        List<Callable<String>> tasks = new ArrayList<>();
        for (String url : serviceUrls) {
            tasks.add(new KerberosAuthTask<>("com.sun.security.jgss.initiate", () -> {
                // 在此执行实际的HTTP调用
                return callKerberizedService(url);
            }));
        }

        List<Future<String>> futures = executorService.invokeAll(tasks);
        List<String> results = new ArrayList<>();
        for (Future<String> future : futures) {
            results.add(future.get()); // 获取每个任务的结果
        }
        return results;
    }

    private String callKerberizedService(String url) throws IOException {
        // 配置支持SPNEGO的HTTP客户端
        Lookup<AuthSchemeProvider> authSchemeRegistry = RegistryBuilder.<AuthSchemeProvider>create()
                .register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory(true)) // true表示使用Kerberos
                .build();

        try (CloseableHttpClient httpClient = HttpClients.custom()
                .setDefaultAuthSchemeRegistry(authSchemeRegistry)
                .build()) {

            HttpGet httpGet = new HttpGet(url);
            System.out.println(Thread.currentThread().getName() + " - Calling Kerberized service: " + url);
            try (CloseableHttpResponse response = httpClient.execute(httpGet)) {
                if (response.getStatusLine().getStatusCode() == 200) {
                    return EntityUtils.toString(response.getEntity());
                } else {
                    throw new IOException("Failed to call service " + url + ": " + response.getStatusLine());
                }
            }
        }
    }

    // 假设KerberosAuthTask类已定义如前文
    // ...
}