Kerberos：S4U2self 票证必须是可转发的（Containerproxy）

Question

我正在使用 ShinyProxy 为 Shiny 应用程序实施 Kerberos 身份验证，并为底层数据库提供票证委托。

所以基本上：

User -> ShinyProxy/Shiny Apps -> Database

使用 Kerberos 登录 Shiny 有效，但 ShinyProxy 无法获取模拟票证。错误是：

S4U2self ticket must be FORWARDABLE

我的 krb5.conf 已设置：

[libdefaults]
forwardable = true

ShinyProxy 的 SPN 为 http/shinyproxy，其服务帐户为 shinyproxy。

服务帐户设置了标志 TRUSTED_TO_AUTH_FOR_DELEGATION。

数据库的 SPN db/mydatabase，其服务帐户是 database

对于服务帐户 shinyproxy，在 AD 的委派选项卡中，我为 "Any authentication protocol" 启用了约束委派并添加了两个 SPN，http/shinyproxy 和 db/mydatabase。

日志输出：

Found KeyTab /etc/security/keytabs/shinyproxy-http.keytab for http/shinyproxy@MYREALM
Found KeyTab /etc/security/keytabs/shinyproxy-http.keytab for http/shinyproxy@MYREALM
Entered Krb5Context.acceptSecContext with state=STATE_NEW
Looking for keys for: http/shinyproxy@MYREALM
Added key: 1version: 2
Added key: 3version: 2
Added key: 23version: 2
Added key: 17version: 2
Added key: 18version: 2
>>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
default etypes for permitted_enctypes: 18 17 23 3 1.
>>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
MemoryCache: add 1587479092/069942/CDC00FC467F9DD904A13D2193831B707/myuser@MYREALM to myuser@MYREALM|HTTP/shinyproxy@MYREALM
>>> KrbApReq: authenticate succeed.
Krb5Context setting peerSeqNumber to: 1981624799
>>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
Krb5Context setting mySeqNumber to: 505758374
>>> Constrained deleg from GSSCaller{UNKNOWN}
DEBUG: Config isForwardable = true
DEBUG: KDCOptions isForwardable = true
DEBUG: TGT (KerberosTicket) isForwardable = true
DEBUG: TGT (Credentials) isForwardable = true
DEBUG: Requesting impersonation ticket (S4U2self) for user myuser@MYREALM
>>> CksumType: sun.security.krb5.internal.crypto.HmacMd5ArcFourCksumType
>>> Credentials serviceCredsSingle: same realm
default etypes for default_tgs_enctypes: 18 17 23 3 1.
>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
>>> CksumType: sun.security.krb5.internal.crypto.HmacSha1Aes256CksumType
>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
>>> KrbKdcReq send: kdc=myad.MYREALM TCP:88, timeout=30000, number of retries =3, #bytes=1527
>>> KDCCommunication: kdc=myad.MYREALM TCP:88, timeout=30000,Attempt =1, #bytes=1527
2020-04-21 14:24:53.137  INFO 1 --- [  XNIO-2 task-1] e.o.containerproxy.service.UserService   : User logged in [user: myuser@MYREALM]
>>>DEBUG: TCPClient reading 1756 bytes
>>> KrbKdcReq send: #bytes read=1756
>>> KdcAccessibility: remove myad.MYREALM:88
>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
>>> TGS credentials serviceCredsSingle:
>>> DEBUG: ----Credentials----
 client: myuser@MYREALM
 server: myservice@MYREALM
 ticket: sname: myservice@MYREALM
 startTime: 1587479093000
 endTime: 1587515088000
        ----Credentials end----
2020-04-21 14:24:53.159 ERROR 1 --- [pool-3-thread-1] e.o.c.a.i.k.KRBTicketRenewalManager      : Error while renewing service tickets for myuser@MYREALM

sun.security.krb5.KrbException: S4U2self ticket must be FORWARDABLE
 at sun.security.krb5.internal.CredentialsUtil.acquireS4U2selfCreds(CredentialsUtil.java:105) ~[na:1.8.0_252]
 at sun.security.krb5.Credentials.acquireS4U2selfCreds(Credentials.java:495) ~[na:1.8.0_252]
 at eu.openanalytics.containerproxy.auth.impl.kerberos.KRBUtils.obtainImpersonationTicket(KRBUtils.java:144) ~[containerproxy-0.8.3.jar!/:0.8.3]
 at eu.openanalytics.containerproxy.auth.impl.kerberos.KRBTicketRenewalManager$RenewalJob.run(KRBTicketRenewalManager.java:102) ~[containerproxy-0.8.3.jar!/:0.8.3]
 at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [na:1.8.0_252]
 at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [na:1.8.0_252]
 at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access1(ScheduledThreadPoolExecutor.java:180) [na:1.8.0_252]
 at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [na:1.8.0_252]
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_252]
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_252]
 at java.lang.Thread.run(Thread.java:748) [na:1.8.0_252]

可以看出，kerberos 票证和凭据是可转发的，但是，来自 KDC 的响应不包含可转发的票证。

知道这是为什么吗？

Answer 1

原来在我测试的用户帐户上设置了 Account is sensitive and cannot be delegated。

Kerberos：S4U2self 票证必须是可转发的（Containerproxy）

Kerberos: S4U2self ticket must be FORWARDABLE (Containerproxy)

kerberos

kerberos-delegation

shinyproxy