Kerberos并行认证在Spring Boot微服务中的实现策略

import javax.security.auth.Subject;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import java.security.PrivilegedAction;
import java.util.concurrent.Callable;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.Future;

public class KerberosParallelExecutor {

    // 假设这是一个预认证的Subject池
    private static final ThreadLocal<Subject> currentSubject = new ThreadLocal<>();

    // 模拟Kerberos认证方法
    private static Subject authenticate(String principal, String keytabPath) throws LoginException {
        // 实际应用中，这里会配置Krb5LoginModule
        // 例如：System.setProperty("java.security.krb5.conf", "/etc/krb5.conf");
        // LoginContext lc = new LoginContext("com.sun.security.auth.module.Krb5LoginModule", new CallbackHandler() { ... });
        // lc.login();
        // return lc.getSubject();
        System.out.println(Thread.currentThread().getName() + " - Authenticating for principal: " + principal);
        return new Subject(); // 简化示例，返回一个空Subject
    }

    public static void main(String[] args) throws Exception {
        ExecutorService executor = Executors.newFixedThreadPool(5);
        String principal = "service_user@REALM.COM";
        String keytab = "/path/to/service_user.keytab";

        // 模拟多个并行任务
        for (int i = 0; i < 10; i++) {
            final int taskId = i;
            Callable<String> task = () -> {
                try {
                    // 每个任务尝试获取或使用一个Subject
                    Subject subject = currentSubject.get();
                    if (subject == null) {
                        // 首次在此线程执行，进行认证或从池中获取
                        subject = authenticate(principal, keytab);
                        currentSubject.set(subject); // 存储到线程局部变量
                    }

                    // 在Subject的上下文中执行特权操作
                    return Subject.doAs(subject, (PrivilegedAction<String>) () -> {
                        System.out.println(Thread.currentThread().getName() + " - Task " + taskId + " executing with Kerberos Subject.");
                        // 实际这里会发起Kerberos认证的微服务调用
                        return "Task " + taskId + " completed successfully.";
                    });
                } catch (LoginException e) {
                    System.err.println(Thread.currentThread().getName() + " - Task " + taskId + " authentication failed: " + e.getMessage());
                    return "Task " + taskId + " failed due to authentication.";
                } finally {
                    // 如果Subject是线程独有的且不再复用，可以在这里清理
                    // currentSubject.remove();
                }
            };
            Future<String> future = executor.submit(task);
            System.out.println(future.get()); // 获取任务结果
        }

        executor.shutdown();
    }
}

import org.apache.http.auth.AuthScope;
import org.apache.http.auth.Credentials;
import org.apache.http.client.CredentialsProvider;
import org.apache.http.client.config.AuthSchemes;
import org.apache.http.impl.client.BasicCredentialsProvider;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
import org.springframework.boot.web.client.RestTemplateBuilder;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.web.client.RestTemplate;

import javax.security.auth.Subject;
import javax.security.auth.kerberos.KerberosPrincipal;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import java.security.PrivilegedAction;
import java.util.Collections;
import java.util.Set;

@Configuration
public class KerberosRestTemplateConfig {

    // 假设服务主体和keytab路径
    private static final String SERVICE_PRINCIPAL = "HTTP/myservice.example.com@EXAMPLE.COM";
    private static final String KEYTAB_PATH = "/etc/krb5.keytab"; // 你的keytab文件路径

    @Bean
    public RestTemplate kerberosRestTemplate(RestTemplateBuilder builder) throws LoginException {
        // 1. 配置Kerberos认证（使用Keytab）
        // 这部分通常通过JAAS配置完成，这里简化为直接构建Subject
        // 实际应用中，应通过JAAS配置Krb5LoginModule
        // System.setProperty("java.security.auth.login.config", "classpath:jaas.conf");
        // LoginContext lc = new LoginContext("Client"); // Client是jaas.conf中定义的一个配置项
        // lc.login();
        // Subject kerberosSubject = lc.getSubject();

        // 简化示例：直接创建一个Subject，实际需要通过JAAS认证
        Subject kerberosSubject = new Subject(true,
                Collections.singleton(new KerberosPrincipal("service_user@EXAMPLE.COM")),
                Collections.emptySet(),
                Collections.emptySet());

        // 2. 配置HttpClient的CredentialsProvider以支持SPNEGO
        CredentialsProvider credentialsProvider = new BasicCredentialsProvider();
        credentialsProvider.setCredentials(
                new AuthScope(null, -1, null, AuthSchemes.SPNEGO), // SPNEGO认证范围
                new Credentials() {
                    @Override
                    public String getPassword() { return null; } // Keytab认证不需要密码
                    @Override
                    public java.security.Principal getUserPrincipal() {
                        return kerberosSubject.getPrincipals(KerberosPrincipal.class).iterator().next();
                    }
                }
        );

        // 3. 配置连接池
        PoolingHttpClientConnectionManager connectionManager = new PoolingHttpClientConnectionManager();
        connectionManager.setMaxTotal(200); // 最大连接数
        connectionManager.setDefaultMaxPerRoute(20); // 每个路由的最大连接数

        CloseableHttpClient httpClient = HttpClientBuilder.create()
                .setConnectionManager(connectionManager)
                .setDefaultCredentialsProvider(credentialsProvider)
                // 确保HttpClient能够处理Kerberos认证上下文
                .build();

        HttpComponentsClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory(httpClient);
        requestFactory.setReadTimeout(5000);
        requestFactory.setConnectTimeout(5000);

        // 4. 将认证逻辑包装到RestTemplate
        return builder
                .requestFactory(() -> requestFactory)
                .build();
    }
}