如何在Tomcat中获取JNDIRealm以使用Kerberos身份验证?

问题描述

我正在尝试使用Kerberos进行身份验证(authentication ="GSSAPI")来运行tomcat JNDIRealm.

I am trying to run a tomcat JNDIRealm using using Kerberos for authentication (authentication="GSSAPI").

但是，我得到了:

SEVERE: Catalina.start:
LifecycleException:  Exception opening directory server connection:
javax.naming.AuthenticationException: GSSAPI
[Root exception is javax.security.sasl.SaslException: GSS initiate failed
 [Caused by GSSException: No valid credentials provided
 (Mechanism level: Attempt to obtain new INITIATE credentials failed! (null))
]]

我在server.xml中有这个文件:

I have this in server.xml:

 <Realm className="org.apache.catalina.realm.JNDIRealm"
                        authentication="GSSAPI"
                        connectionName="CN=XXX User,OU=XXXGenericAccounts,\
                                                   DC=xxx,DC=com"
                        connectionPassword="blah"
                        connectionURL="ldap://blah.xxx.com:389"
                        alternateURL="ldap://blah.xxx.com:389"
                        roleBase="OU=XXXGroups,DC=xxx,DC=com"
                        roleName="cn"
                        roleSearch="member={0}"
                        roleSubtree="true"
                        userBase="OU=XXXUsers,DC=xxx,DC=com"
                        userSearch="sAMAccountName={0}"
                        userSubtree="true"/>

知道我在这里缺少什么吗?

any idea what I am missing here?

推荐答案

您将需要通过系统属性进行传递:

You will need to pass via system properties:

• krb5.conf/ini的路径
• login.conf的路径具有默认的Sun名称，并配置了如何获取凭据的Krb5Module.

这篇关于如何在Tomcat中获取JNDIRealm以使用Kerberos身份验证?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！