解决Spring Boot中Kerberos并行认证的挑战与策略

// jaas.conf
com.sun.security.jgss.krb5.initiate {
  com.sun.security.auth.module.Krb5LoginModule required
  // 使用keytab文件进行非交互式认证
  useKeyTab=true
  keyTab="/path/to/your/service.keytab"
  principal="your_service_principal@YOUR.REALM"
  storeKey=true
  doNotPrompt=true
  // 确保每个LoginContext可以有独立的内存票据缓存
  // 这将防止不同Subject共享同一个默认的krb5cc文件
  useTicketCache=false
  // 如果需要，可以配置一个临时的文件缓存路径，但内存缓存更推荐
  // ticketCache="/tmp/krb5cc_temp_$$" // $$会被进程ID替换，但对于多线程需要更精细控制
  debug=false;
};

import javax.security.auth.Subject;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import java.security.PrivilegedAction;
import java.util.concurrent.Callable;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.Future;
import java.util.List;
import java.util.ArrayList;

public class ParallelKerberosClient {

    private static final String JAAS_CONFIG_NAME = "com.sun.security.jgss.krb5.initiate";
    private static final String KERBEROS_PRINCIPAL = "your_service_principal@YOUR.REALM";
    private static final String KEYTAB_PATH = "/path/to/your/service.keytab";

    static {
        // 设置JAAS配置文件路径
        System.setProperty("java.security.auth.login.config", "path/to/jaas.conf");
        // 如果需要，设置Kerberos配置路径
        // System.setProperty("java.security.krb5.conf", "path/to/krb5.conf");
    }

    // 模拟调用Kerberos认证的微服务
    private static String callKerberizedMicroservice(String serviceName) {
        // 在这里，你会使用GSSAPI或HTTP客户端（如HttpClient with SPNEGO）
        // 来连接到Kerberos认证的微服务。
        // 重要的是，这些操作必须在Subject.doAs()的PrivilegedAction中执行。
        System.out.println(Thread.currentThread().getName() + ": Calling " + serviceName + " with Kerberos credentials.");
        // 模拟网络延迟和处理时间
        try {
            Thread.sleep((long) (Math.random() * 1000));
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
        }
        return "Response from " + serviceName + " (authenticated by " + Subject.current().getPrincipals() + ")";
    }

    public static void main(String[] args) throws Exception {
        ExecutorService executor = Executors.newFixedThreadPool(5); // 5个并行线程
        List<Callable<String>> tasks = new ArrayList<>();

        for (int i = 0; i < 10; i++) {
            final String serviceName = "Microservice-" + (i + 1);
            tasks.add(() -> {
                LoginContext lc = null;
                try {
                    // 1. 为每个任务创建独立的LoginContext
                    // 注意：LoginContext构造函数第二个参数是CallbackHandler，这里可以传null
                    // 或者实现一个用于获取用户名的CallbackHandler
                    lc = new LoginContext(JAAS_CONFIG_NAME, null);
                    lc.login(); // 执行认证，获取Subject

                    Subject subject = lc.getSubject();
                    System.out.println(Thread.currentThread().getName() + ": Authenticated as " + subject.getPrincipals());

                    // 2. 在Subject.doAs()中执行Kerberos认证的微服务调用
                    return Subject.doAs(subject, (PrivilegedAction<String>) () -> {
                        return callKerberizedMicroservice(serviceName);
                    });

                } catch (LoginException e) {
                    System.err.println(Thread.currentThread().getName() + ": Kerberos Login failed for " + serviceName + ": " + e.getMessage());
                    throw new RuntimeException("Authentication failed", e);
                } finally {
                    if (lc != null) {
                        try {
                            lc.logout(); // 登出并清理凭证
                        } catch (LoginException e) {
                            System.err.println(Thread.currentThread().getName() + ": Logout failed: " + e.getMessage());
                        }
                    }
                }
            });
        }

        List<Future<String>> results = executor.invokeAll(tasks);

        for (Future<String> result : results) {
            try {
                System.out.println(result.get());
            } catch (Exception e) {
                System.err.println("Task failed: " + e.getMessage());
            }
        }

        executor.shutdown();
    }
}