Kerberos并行认证策略：票据与令牌的有效管理

import javax.security.auth.Subject;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import java.security.PrivilegedAction;
import java.util.concurrent.Callable;

public class KerberosAuthenticator {

    private static final String JAAS_CONFIG_NAME = "MyKerberosClient"; // JAAS配置文件中定义的名称

    /**
     * 执行Kerberos登录并返回Subject
     * @param principal Kerberos主体名
     * @param keytabPath Keytab文件路径
     * @return 认证成功的Subject
     * @throws LoginException 登录失败
     */
    public static Subject login(String principal, String keytabPath) throws LoginException {
        // 配置JAAS，通常通过JVM参数或jaas.config文件
        // System.setProperty("java.security.krb5.conf", "/etc/krb5.conf");
        // System.setProperty("java.security.auth.login.config", "jaas.config");

        LoginContext lc = new LoginContext(JAAS_CONFIG_NAME, new KerberosCallbackHandler(principal, keytabPath));
        lc.login();
        return lc.getSubject();
    }

    /**
     * 在指定Subject的上下文中执行操作
     * @param subject Kerberos认证主体
     * @param action 要执行的操作
     * @param <T> 返回类型
     * @return 操作结果
     */
    public static <T> T executeWithSubject(Subject subject, PrivilegedAction<T> action) {
        return Subject.doAs(subject, action);
    }

    // 示例：一个简单的CallbackHandler，实际可能更复杂
    static class KerberosCallbackHandler implements javax.security.auth.callback.CallbackHandler {
        private String principal;
        private String keytabPath;

        public KerberosCallbackHandler(String principal, String keytabPath) {
            this.principal = principal;
            this.keytabPath = keytabPath;
        }

        @Override
        public void handle(javax.security.auth.callback.Callback[] callbacks)
                throws java.io.IOException, javax.security.auth.callback.UnsupportedCallbackException {
            for (javax.security.auth.callback.Callback callback : callbacks) {
                if (callback instanceof javax.security.auth.callback.NameCallback) {
                    ((javax.security.auth.callback.NameCallback) callback).setName(principal);
                } else if (callback instanceof javax.security.auth.callback.PasswordCallback) {
                    // 如果使用keytab，通常不需要PasswordCallback
                    // ((javax.security.auth.callback.PasswordCallback) callback).setPassword("password".toCharArray());
                } else if (callback instanceof sun.security.krb5.RealmCallback) {
                    // RealmCallback可能需要设置Realm
                } else if (callback instanceof sun.security.krb5.Krb5CallbackHandler.Krb5LoginModuleCallback) {
                    // Krb5LoginModuleCallback可能需要设置keytab路径等
                    // 注意：sun.* 包是非公开API，不建议直接依赖
                }
            }
        }
    }
}

import com.github.benmanes.caffeine.cache.Cache;
import com.github.benmanes.caffeine.cache.Caffeine;
import javax.security.auth.Subject;
import javax.security.auth.login.LoginException;
import java.util.concurrent.TimeUnit;

public class KerberosSubjectCache {

    // 缓存Subject对象，根据Principal Name作为键
    private final Cache<String, Subject> subjectCache;

    public KerberosSubjectCache() {
        this.subjectCache = Caffeine.newBuilder()
                .expireAfterWrite(1, TimeUnit.HOURS) // 缓存1小时后过期，与Kerberos票据有效期匹配
                .maximumSize(100) // 最大缓存100个Subject
                .build();
    }

    /**
     * 从缓存中获取Subject，如果不存在则进行登录并缓存
     * @param principal Kerberos主体名
     * @param keytabPath Keytab文件路径
     * @return 认证成功的Subject
     * @throws LoginException 登录失败
     */
    public Subject getOrCreateSubject(String principal, String keytabPath) throws LoginException {
        Subject subject = subjectCache.getIfPresent(principal);
        if (subject == null) {
            // 如果缓存中没有，则进行登录
            subject = KerberosAuthenticator.login(principal, keytabPath);
            subjectCache.put(principal, subject);
        }
        return subject;
    }

    /**
     * 清除指定主体的缓存
     * @param principal Kerberos主体名
     */
    public void invalidateSubject(String principal) {
        subjectCache.invalidate(principal);
    }

    /**
     * 清除所有缓存
     */
    public void invalidateAll() {
        subjectCache.invalidateAll();
    }
}

import org.springframework.stereotype.Service;
import java.security.PrivilegedAction;
import java.util.ArrayList;
import java.util.List;
import java.util.concurrent.*;
import javax.security.auth.Subject;
import javax.security.auth.login.LoginException;

@Service
public class MicroserviceCaller {

    private final KerberosSubjectCache subjectCache;
    private final ExecutorService executorService;

    public MicroserviceCaller(KerberosSubjectCache subjectCache) {
        this.subjectCache = subjectCache;
        // 根据需要配置线程池
        this.executorService = Executors.newFixedThreadPool(Runtime.getRuntime().availableProcessors());
    }

    public List<String> callParallelMicroservices(String kerberosPrincipal, String keytabPath, List<String> serviceUrls)
            throws LoginException, InterruptedException, ExecutionException {

        Subject subject = subjectCache.getOrCreateSubject(kerberosPrincipal, keytabPath);

        List<Callable<String>> tasks = new ArrayList<>();
        for (String url : serviceUrls) {
            tasks.add(() -> KerberosAuthenticator.executeWithSubject(subject, (PrivilegedAction<String>) () -> {
                // 这里是实际调用微服务的逻辑，例如使用RestTemplate或WebClient
                // 确保HTTP客户端配置为使用Kerberos认证（如SPNEGO）
                System.out.println(Thread.currentThread().getName() + " - Calling service: " + url);
                // 模拟网络请求
                try {
                    Thread.sleep(1000);
                } catch (InterruptedException e) {
                    Thread.currentThread().interrupt();
                }
                return "Response from " + url;
            }));
        }

        List<Future<String>> futures = executorService.invokeAll(tasks);
        List<String> results = new ArrayList<>();
        for (Future<String> future : futures) {
            results.add(future.get()); // 获取每个并行任务的结果
        }
        return results;
    }

    // 在应用关闭时关闭线程池
    public void shutdown() {
        executorService.shutdown();
    }
}