NiFi：此 NiFi 不支持 Kerberos 票证登录
NiFi: Kerberos ticket login not supported by this NiFi
我在对 NiFi 进行 Kerberising 时遇到问题。
我的设置是 Docker，其中有两个容器：apache/nifi 和 gcavalcante8808/krb5-server。 NiFi 已经使用 HTTPS 和初始管理员身份进行保护，因此我可以使用证书登录成为管理员而不会出现问题。到目前为止一切顺利。
然后，如果我在 nifi-user.log 中没有管理员证书的情况下从浏览器中拉出 NiFi UI，则会出现消息 Kerberos ticket login not supported by this NiFi（堆栈跟踪已缩短）：
2021-02-18 10:25:39,804 INFO [main] o.a.n.a.FileUserGroupProvider Users/Groups file loaded at Thu Feb 18 10:25:39 UTC 2021
2021-02-18 10:25:39,836 INFO [main] o.a.n.a.FileAccessPolicyProvider Authorizations file loaded at Thu Feb 18 10:25:39 UTC 2021
2021-02-18 10:25:41,224 WARN [main] o.a.n.w.s.o.StandardOidcIdentityProvider The OIDC provider is not configured or enabled
2021-02-18 10:35:19,976 WARN [NiFi Web Server-30] o.a.n.w.a.c.IllegalStateExceptionMapper java.lang.IllegalStateException: Kerberos ticket login not supported by this NiFi.. Returning Conflict response.
java.lang.IllegalStateException: Kerberos ticket login not supported by this NiFi.
at org.apache.nifi.web.api.AccessResource.createAccessTokenFromTicket(AccessResource.java:644)
...
2021-02-18 10:35:20,041 WARN [NiFi Web Server-28] o.a.n.w.a.c.IllegalStateExceptionMapper java.lang.IllegalStateException: OpenId Connect is not configured.. Returning Conflict response.
java.lang.IllegalStateException: OpenId Connect is not configured.
at org.apache.nifi.web.api.AccessResource.oidcExchange(AccessResource.java:301)
...
2021-02-18 10:35:20,092 INFO [NiFi Web Server-29] o.a.n.w.s.NiFiAuthenticationFilter Attempting request for (<anonymous>) GET https://<redacted>:4321/nifi-api/flow/current-user (source ip: 172.17.0.1)
2021-02-18 10:35:20,096 WARN [NiFi Web Server-29] o.a.n.w.s.NiFiAuthenticationFilter Rejecting access to web api: Anonymous authentication has not been configured.
如果我继续尝试登录，我会得到 Receive timed out（在 nifi-bootstrap.log 中）：
2021-02-18 10:39:00,695 INFO [NiFi logging handler] org.apache.nifi.StdOut Debug is true storeKey true useTicketCache false useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
2021-02-18 10:39:00,697 INFO [NiFi logging handler] org.apache.nifi.StdOut [Krb5LoginModule] user entered username: test_RW@NIFI.DEV
2021-02-18 10:39:00,697 INFO [NiFi logging handler] org.apache.nifi.StdOut
2021-02-18 10:39:00,704 INFO [NiFi logging handler] org.apache.nifi.StdOut Java config name: /etc/krb5.conf
2021-02-18 10:39:00,755 INFO [NiFi logging handler] org.apache.nifi.StdOut Loaded from Java config
2021-02-18 10:39:00,755 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KdcAccessibility: reset
2021-02-18 10:39:00,760 INFO [NiFi logging handler] org.apache.nifi.StdOut Using builtin default etypes for default_tkt_enctypes
2021-02-18 10:39:00,760 INFO [NiFi logging handler] org.apache.nifi.StdOut default etypes for default_tkt_enctypes: 18 17 16 23.
2021-02-18 10:39:00,760 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KrbAsReq creating message
2021-02-18 10:39:00,771 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KrbKdcReq send: kdc=<redacted> UDP:8088, timeout=30000, number of retries =3, #bytes=174
2021-02-18 10:39:00,771 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KDCCommunication: kdc=<redacted> UDP:8088, timeout=30000,Attempt =1, #bytes=174
2021-02-18 10:39:30,889 INFO [NiFi logging handler] org.apache.nifi.StdOut SocketTimeOutException with attempt: 1
2021-02-18 10:39:30,890 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KDCCommunication: kdc=<redacted> UDP:8088, timeout=30000,Attempt =2, #bytes=174
2021-02-18 10:40:00,927 INFO [NiFi logging handler] org.apache.nifi.StdOut SocketTimeOutException with attempt: 2
2021-02-18 10:40:00,927 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KDCCommunication: kdc=<redacted> UDP:8088, timeout=30000,Attempt =3, #bytes=174
2021-02-18 10:40:30,966 INFO [NiFi logging handler] org.apache.nifi.StdOut SocketTimeOutException with attempt: 3
2021-02-18 10:40:30,966 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KrbKdcReq send: error trying <redacted>:8088
2021-02-18 10:40:30,967 INFO [NiFi logging handler] org.apache.nifi.StdOut java.net.SocketTimeoutException: Receive timed out
2021-02-18 10:40:30,969 INFO [NiFi logging handler] org.apache.nifi.StdOut at java.net.PlainDatagramSocketImpl.receive0(Native Method)
...
2021-02-18 10:40:30,984 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KdcAccessibility: add <redacted>:8088
2021-02-18 10:40:30,984 INFO [NiFi logging handler] org.apache.nifi.StdOut [Krb5LoginModule] authentication failed
2021-02-18 10:40:30,984 INFO [NiFi logging handler] org.apache.nifi.StdOut Receive timed out
这一切都以 NiFi 中的空白弹出窗口结束。
我完全没有想法，请有人知道 check/set/edit/...？在我看来，NiFi 似乎配置有误，但据我所知，所有部分都是正确的。更让我困惑的是，尽管不支持 Kerberos 票证，但它会尝试并以某种方式失败。
我在 nifi.properties 中的设置：
# kerberos #
nifi.kerberos.krb5.file=/etc/krb5.conf
nifi.kerberos.service.principal=app_nifi_svc/admin@NIFI.DEV
nifi.kerberos.keytab.location=/opt/app_nifi_svc.keytab
登录身份-provider.xml:
<provider>
<identifier>kerberos-provider</identifier>
<class>org.apache.nifi.kerberos.KerberosProvider</class>
<property name="Default Realm">NIFI.DEV</property>
<property name="Kerberos Config File">/etc/krb5.conf</property>
<property name="Authentication Expiration">12 hours</property>
</provider>
krb5.conf:
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_realm = NIFI.DEV
[realms]
NIFI.DEV = {
kdc = <redacted>:8088
admin_server = <redacted>:8088
}
检查 NiFi 容器中的所有权和模式：
~> dc exec -it nifi_https ls -l /opt/app_nifi_svc.keytab
-rw-------. 1 nifi nifi 158 Feb 17 15:46 /opt/app_nifi_svc.keytab
~> dc exec -it nifi_https ls -l /etc/krb5.conf
-rwxrwxrwx. 1 nifi nifi 229 Feb 17 15:49 /etc/krb5.conf
已检查 keytab 在 Kerberos 容器中是否有效：
/ # kinit -kt /opt/app_nifi_svc.keytab app_nifi_svc/admin@NIFI.DEV
/ # klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: app_nifi_svc/admin@NIFI.DEV
Valid starting Expires Service principal
02/18/21 09:59:44 02/18/21 21:59:44 krbtgt/NIFI.DEV@NIFI.DEV
renew until 02/25/21 09:59:42
防火墙已打开，telnet 从 NiFi 容器连接到 Kerberos 容器（“hi”是我的查询）：
root@<nifi_container>:/opt/nifi/nifi-current# telnet <redacted> 8088
Trying <ipadress of redacted>...
Connected to <redacted>.
Escape character is '^]'.
hi
X~V0T▒▒▒20210218105711Z▒ EӦ=▒ IFI.DEV▒0▒0rbtgIFI.DEVConnection closed by foreign host.
编辑：在 krb5.conf 中发现可能的配置错误：admin_server = <redacted>:8088。但是更改为 admin_server = <redacted>:8749 也没有帮助。
真正的原因不知何故被隐藏了。问题是，默认配置中的 Kerberos 尝试使用 UDP 协议进行通信。 Docker 另一方面，默认情况下公开 TCP 协议的端口。因此解决方案很简单 - 启动 Kerberos 容器，并为 TCP 和 UDP 协议公开端口：
docker run
-p 8088:8088/tcp \
-p 8749:8749/tcp \
-p 8088:8088/udp \
-p 8749:8749/udp \
gcavalcante8808/krb5-server
我在对 NiFi 进行 Kerberising 时遇到问题。
我的设置是 Docker，其中有两个容器：apache/nifi 和 gcavalcante8808/krb5-server。 NiFi 已经使用 HTTPS 和初始管理员身份进行保护，因此我可以使用证书登录成为管理员而不会出现问题。到目前为止一切顺利。
然后，如果我在 nifi-user.log 中没有管理员证书的情况下从浏览器中拉出 NiFi UI，则会出现消息 Kerberos ticket login not supported by this NiFi（堆栈跟踪已缩短）：
2021-02-18 10:25:39,804 INFO [main] o.a.n.a.FileUserGroupProvider Users/Groups file loaded at Thu Feb 18 10:25:39 UTC 2021
2021-02-18 10:25:39,836 INFO [main] o.a.n.a.FileAccessPolicyProvider Authorizations file loaded at Thu Feb 18 10:25:39 UTC 2021
2021-02-18 10:25:41,224 WARN [main] o.a.n.w.s.o.StandardOidcIdentityProvider The OIDC provider is not configured or enabled
2021-02-18 10:35:19,976 WARN [NiFi Web Server-30] o.a.n.w.a.c.IllegalStateExceptionMapper java.lang.IllegalStateException: Kerberos ticket login not supported by this NiFi.. Returning Conflict response.
java.lang.IllegalStateException: Kerberos ticket login not supported by this NiFi.
at org.apache.nifi.web.api.AccessResource.createAccessTokenFromTicket(AccessResource.java:644)
...
2021-02-18 10:35:20,041 WARN [NiFi Web Server-28] o.a.n.w.a.c.IllegalStateExceptionMapper java.lang.IllegalStateException: OpenId Connect is not configured.. Returning Conflict response.
java.lang.IllegalStateException: OpenId Connect is not configured.
at org.apache.nifi.web.api.AccessResource.oidcExchange(AccessResource.java:301)
...
2021-02-18 10:35:20,092 INFO [NiFi Web Server-29] o.a.n.w.s.NiFiAuthenticationFilter Attempting request for (<anonymous>) GET https://<redacted>:4321/nifi-api/flow/current-user (source ip: 172.17.0.1)
2021-02-18 10:35:20,096 WARN [NiFi Web Server-29] o.a.n.w.s.NiFiAuthenticationFilter Rejecting access to web api: Anonymous authentication has not been configured.
如果我继续尝试登录，我会得到 Receive timed out（在 nifi-bootstrap.log 中）：
2021-02-18 10:39:00,695 INFO [NiFi logging handler] org.apache.nifi.StdOut Debug is true storeKey true useTicketCache false useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
2021-02-18 10:39:00,697 INFO [NiFi logging handler] org.apache.nifi.StdOut [Krb5LoginModule] user entered username: test_RW@NIFI.DEV
2021-02-18 10:39:00,697 INFO [NiFi logging handler] org.apache.nifi.StdOut
2021-02-18 10:39:00,704 INFO [NiFi logging handler] org.apache.nifi.StdOut Java config name: /etc/krb5.conf
2021-02-18 10:39:00,755 INFO [NiFi logging handler] org.apache.nifi.StdOut Loaded from Java config
2021-02-18 10:39:00,755 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KdcAccessibility: reset
2021-02-18 10:39:00,760 INFO [NiFi logging handler] org.apache.nifi.StdOut Using builtin default etypes for default_tkt_enctypes
2021-02-18 10:39:00,760 INFO [NiFi logging handler] org.apache.nifi.StdOut default etypes for default_tkt_enctypes: 18 17 16 23.
2021-02-18 10:39:00,760 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KrbAsReq creating message
2021-02-18 10:39:00,771 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KrbKdcReq send: kdc=<redacted> UDP:8088, timeout=30000, number of retries =3, #bytes=174
2021-02-18 10:39:00,771 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KDCCommunication: kdc=<redacted> UDP:8088, timeout=30000,Attempt =1, #bytes=174
2021-02-18 10:39:30,889 INFO [NiFi logging handler] org.apache.nifi.StdOut SocketTimeOutException with attempt: 1
2021-02-18 10:39:30,890 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KDCCommunication: kdc=<redacted> UDP:8088, timeout=30000,Attempt =2, #bytes=174
2021-02-18 10:40:00,927 INFO [NiFi logging handler] org.apache.nifi.StdOut SocketTimeOutException with attempt: 2
2021-02-18 10:40:00,927 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KDCCommunication: kdc=<redacted> UDP:8088, timeout=30000,Attempt =3, #bytes=174
2021-02-18 10:40:30,966 INFO [NiFi logging handler] org.apache.nifi.StdOut SocketTimeOutException with attempt: 3
2021-02-18 10:40:30,966 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KrbKdcReq send: error trying <redacted>:8088
2021-02-18 10:40:30,967 INFO [NiFi logging handler] org.apache.nifi.StdOut java.net.SocketTimeoutException: Receive timed out
2021-02-18 10:40:30,969 INFO [NiFi logging handler] org.apache.nifi.StdOut at java.net.PlainDatagramSocketImpl.receive0(Native Method)
...
2021-02-18 10:40:30,984 INFO [NiFi logging handler] org.apache.nifi.StdOut >>> KdcAccessibility: add <redacted>:8088
2021-02-18 10:40:30,984 INFO [NiFi logging handler] org.apache.nifi.StdOut [Krb5LoginModule] authentication failed
2021-02-18 10:40:30,984 INFO [NiFi logging handler] org.apache.nifi.StdOut Receive timed out
这一切都以 NiFi 中的空白弹出窗口结束。
我完全没有想法，请有人知道 check/set/edit/...？在我看来，NiFi 似乎配置有误，但据我所知，所有部分都是正确的。更让我困惑的是，尽管不支持 Kerberos 票证，但它会尝试并以某种方式失败。
我在 nifi.properties 中的设置：
# kerberos #
nifi.kerberos.krb5.file=/etc/krb5.conf
nifi.kerberos.service.principal=app_nifi_svc/admin@NIFI.DEV
nifi.kerberos.keytab.location=/opt/app_nifi_svc.keytab
登录身份-provider.xml:
<provider>
<identifier>kerberos-provider</identifier>
<class>org.apache.nifi.kerberos.KerberosProvider</class>
<property name="Default Realm">NIFI.DEV</property>
<property name="Kerberos Config File">/etc/krb5.conf</property>
<property name="Authentication Expiration">12 hours</property>
</provider>
krb5.conf:
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_realm = NIFI.DEV
[realms]
NIFI.DEV = {
kdc = <redacted>:8088
admin_server = <redacted>:8088
}
检查 NiFi 容器中的所有权和模式：
~> dc exec -it nifi_https ls -l /opt/app_nifi_svc.keytab
-rw-------. 1 nifi nifi 158 Feb 17 15:46 /opt/app_nifi_svc.keytab
~> dc exec -it nifi_https ls -l /etc/krb5.conf
-rwxrwxrwx. 1 nifi nifi 229 Feb 17 15:49 /etc/krb5.conf
已检查 keytab 在 Kerberos 容器中是否有效：
/ # kinit -kt /opt/app_nifi_svc.keytab app_nifi_svc/admin@NIFI.DEV
/ # klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: app_nifi_svc/admin@NIFI.DEV
Valid starting Expires Service principal
02/18/21 09:59:44 02/18/21 21:59:44 krbtgt/NIFI.DEV@NIFI.DEV
renew until 02/25/21 09:59:42
防火墙已打开，telnet 从 NiFi 容器连接到 Kerberos 容器（“hi”是我的查询）：
root@<nifi_container>:/opt/nifi/nifi-current# telnet <redacted> 8088
Trying <ipadress of redacted>...
Connected to <redacted>.
Escape character is '^]'.
hi
X~V0T▒▒▒20210218105711Z▒ EӦ=▒ IFI.DEV▒0▒0rbtgIFI.DEVConnection closed by foreign host.
编辑：在 krb5.conf 中发现可能的配置错误：admin_server = <redacted>:8088。但是更改为 admin_server = <redacted>:8749 也没有帮助。
真正的原因不知何故被隐藏了。问题是，默认配置中的 Kerberos 尝试使用 UDP 协议进行通信。 Docker 另一方面，默认情况下公开 TCP 协议的端口。因此解决方案很简单 - 启动 Kerberos 容器，并为 TCP 和 UDP 协议公开端口：
docker run
-p 8088:8088/tcp \
-p 8749:8749/tcp \
-p 8088:8088/udp \
-p 8749:8749/udp \
gcavalcante8808/krb5-server