NiFi:该NiFi不支持Kerberos票据登录

Question

我在使用NiFi的kerberos服务时遇到问题。

我的设置是这样的，我有Docker和它的两个容器:apache/nifi和gcavalcante8808/krb5-server。NiFi已经用HTTPS和初始管理员身份保护，所以我可以用证书登录，成为管理员，没有问题。到目前为止一切顺利。

然后，如果我在nifi-user.log中没有管理证书从浏览器中拉出NiFi UI，则出现消息Kerberos ticket login not supported by this NiFi(stacktrace被缩短):

2021-02-18 10:25:39,804 INFO [main] o.a.n.a.FileUserGroupProvider Users/Groups file loaded at Thu Feb 18 10:25:39 UTC 2021
2021-02-18 10:25:39,836 INFO [main] o.a.n.a.FileAccessPolicyProvider Authorizations file loaded at Thu Feb 18 10:25:39 UTC 2021
2021-02-18 10:25:41,224 WARN [main] o.a.n.w.s.o.StandardOidcIdentityProvider The OIDC provider is not configured or enabled
2021-02-18 10:35:19,976 WARN [NiFi Web Server-30] o.a.n.w.a.c.IllegalStateExceptionMapper java.lang.IllegalStateException: Kerberos ticket login not supported by this NiFi.. Returning Conflict response.
java.lang.IllegalStateException: Kerberos ticket login not supported by this NiFi.
at org.apache.nifi.web.api.AccessResource.createAccessTokenFromTicket(AccessResource.java:644)
...
2021-02-18 10:35:20,041 WARN [NiFi Web Server-28] o.a.n.w.a.c.IllegalStateExceptionMapper java.lang.IllegalStateException: OpenId Connect is not configured.. Returning Conflict response.
java.lang.IllegalStateException: OpenId Connect is not configured.
at org.apache.nifi.web.api.AccessResource.oidcExchange(AccessResource.java:301)
...
2021-02-18 10:35:20,092 INFO [NiFi Web Server-29] o.a.n.w.s.NiFiAuthenticationFilter Attempting request for (<anonymous>) GET https://<redacted>:4321/nifi-api/flow/current-user (source ip: 172.17.0.1)
2021-02-18 10:35:20,096 WARN [NiFi Web Server-29] o.a.n.w.s.NiFiAuthenticationFilter Rejecting access to web api: Anonymous authentication has not been configured.

如果我继续尝试登录，我得到Receive timed out(在nifi-bootstrap.log):

2021-02-18 10:39:00,695 INFO [NiFi logging handler] org.apache.nifi.StdOut Debug is  true storeKey true useTicketCache false useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
2021-02-18 10:39:00,697 INFO [NiFi logging handler] org.apache.nifi.StdOut      [Krb5LoginModule] user entered username: [e-mail]
2021-02-18 10:39:00,697 INFO [NiFi logging handler] org.apache.nifi.StdOut 
2021-02-18 10:39:00,704 INFO [NiFi logging handler] org.apache.nifi.StdOut Java config name: /etc/krb5.conf
2021-02-18 10:39:00,755 INFO [NiFi logging handler] org.apache.nifi.StdOut Loaded from Java config
2021-02-18 10:39:00,755 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KdcAccessibility: reset
2021-02-18 10:39:00,760 INFO [NiFi logging handler] org.apache.nifi.StdOut Using builtin default etypes for default_tkt_enctypes
2021-02-18 10:39:00,760 INFO [NiFi logging handler] org.apache.nifi.StdOut default etypes for default_tkt_enctypes: 18 17 16 23.
2021-02-18 10:39:00,760 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KrbAsReq creating message
2021-02-18 10:39:00,771 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KrbKdcReq send: kdc=<redacted> UDP:8088, timeout=30000, number of retries =3, #bytes=174
2021-02-18 10:39:00,771 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KDCCommunication: kdc=<redacted> UDP:8088, timeout=30000,Attempt =1, #bytes=174
2021-02-18 10:39:30,889 INFO [NiFi logging handler] org.apache.nifi.StdOut SocketTimeOutException with attempt: 1
2021-02-18 10:39:30,890 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KDCCommunication: kdc=<redacted> UDP:8088, timeout=30000,Attempt =2, #bytes=174
2021-02-18 10:40:00,927 INFO [NiFi logging handler] org.apache.nifi.StdOut SocketTimeOutException with attempt: 2
2021-02-18 10:40:00,927 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KDCCommunication: kdc=<redacted> UDP:8088, timeout=30000,Attempt =3, #bytes=174
2021-02-18 10:40:30,966 INFO [NiFi logging handler] org.apache.nifi.StdOut SocketTimeOutException with attempt: 3
2021-02-18 10:40:30,966 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KrbKdcReq send: error trying <redacted>:8088
2021-02-18 10:40:30,967 INFO [NiFi logging handler] org.apache.nifi.StdOut java.net.SocketTimeoutException: Receive timed out
2021-02-18 10:40:30,969 INFO [NiFi logging handler] org.apache.nifi.StdOut  at java.net.PlainDatagramSocketImpl.receive0(Native Method)
...
2021-02-18 10:40:30,984 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KdcAccessibility: add <redacted>:8088
2021-02-18 10:40:30,984 INFO [NiFi logging handler] org.apache.nifi.StdOut      [Krb5LoginModule] authentication failed 
2021-02-18 10:40:30,984 INFO [NiFi logging handler] org.apache.nifi.StdOut Receive timed out

并且在NiFi中以空白弹出结束。

我完全没有主意了，请问有人知道要检查/设置/编辑什么吗?对我来说，似乎NiFi在某种程度上配置错误，但据我所知，所有的部分都是正确的。更让我困惑的是，尽管Kerberos票务不受支持，它还是尝试了，但不知何故失败了。

---

我的设置在nifi.properties:

# kerberos #
nifi.kerberos.krb5.file=/etc/krb5.conf
nifi.kerberos.service.principal=app_nifi_svc/[e-mail]
nifi.kerberos.keytab.location=/opt/app_nifi_svc.keytab

在login-identity-provider.xml:

<provider>
<identifier>kerberos-provider</identifier>
<class>org.apache.nifi.kerberos.KerberosProvider</class>
<property name="Default Realm">NIFI.DEV</property>
<property name="Kerberos Config File">/etc/krb5.conf</property>
<property name="Authentication Expiration">12 hours</property>
</provider>

krb5 . conf:

[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_realm = NIFI.DEV
[realms]
NIFI.DEV = {
kdc = <redacted>:8088
admin_server = <redacted>:8088
}

检查NiFi容器的所有权和模式:

~> dc exec -it nifi_https ls -l /opt/app_nifi_svc.keytab
-rw-------. 1 nifi nifi 158 Feb 17 15:46 /opt/app_nifi_svc.keytab
~> dc exec -it nifi_https ls -l /etc/krb5.conf
-rwxrwxrwx. 1 nifi nifi 229 Feb 17 15:49 /etc/krb5.conf

检查keytab是否在Kerberos容器中工作:

/ # kinit -kt /opt/app_nifi_svc.keytab app_nifi_svc/[e-mail]
/ # klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: app_nifi_svc/[e-mail]
Valid starting     Expires            Service principal
02/18/21 09:59:44  02/18/21 21:59:44  krbtgt/[e-mail]
renew until 02/25/21 09:59:42

防火墙打开，从NiFi容器到Kerberos容器的telnet连接("hi"是我的查询):

root@<nifi_container>:/opt/nifi/nifi-current# telnet <redacted> 8088
Trying <ipadress of redacted>...
Connected to <redacted>.
Escape character is '^]'.
hi
X~V0T▒▒▒20210218105711Z▒        EӦ=▒                                                                      IFI.DEV▒0▒0rbtgIFI.DEVConnection closed by foreign host.

---

编辑在krb5.conf:admin_server = <redacted>:8088中发现了一个可能的错误配置。但是改成admin_server = <redacted>:8749也没用。

Answer 1

真正的原因不知何故被隐藏了。问题是，默认配置中的Kerberos尝试使用UDP协议进行通信。另一方面，Docker默认公开TCP协议的端口。因此，解决方案很简单——启动Kerberos容器，同时公开TCP和UDP协议的端口:

docker run 
-p 8088:8088/tcp 
-p 8749:8749/tcp 
-p 8088:8088/udp 
-p 8749:8749/udp 
gcavalcante8808/krb5-server