solr添加kerberos认证及授权

来源：互联网发布：网络销售主管职责编辑：程序博客网时间：2024/05/20 10:55

solr添加kerberos认证及授权

@(OTHERS)[solr]

一、kerberos

（一）添加用户

在kdc中添加solr用户：

root@kdc:/# kadmin.localkadmin.local: addprinc HTTP/192.168.0.107kadmin.local: ktadd -k /tmp/107.keytab HTTP/192.168.0.107kadmin.local: quit

（二）创建security.json

server/scripts/cloud-scripts/zkcli.sh -zkhost localhost:2181 -cmd put/security.json '{"authentication":{"class":"org.apache.solr.security.KerberosPlugin"}}'

或者以文件的形式上传

（三）创建jaas文件

Client {    com.sun.security.auth.module.Krb5LoginModule required    useKeyTab=true    keyTab="/keytabs/107.keytab"    storeKey=true    useTicketCache=true    debug=true    principal="HTTP/192.168.0.107@EXAMPLE.COM";};

放到哪里？

（四）在solr.in.sh中添加以下内容

SOLR_AUTHENTICATION_CLIENT_CONFIGURER=org.apache.solr.client.solrj.impl.Krb5HttplientConfigurerSOLR_AUTHENTICATION_OPTS="-Djava.security.auth.login.config=/home/foo/jaas-client.conf -Dsolr.kerberos.cookie.domain=192.168.0.107 -Dsolr.kerberos.cookie.portaware=true -Dsolr.kerberos.principal=HTTP/192.168.0.107@EXAMPLE.COM -Dsolr.kerberos.keytab=/keytabs/107.keytab"

对于tomcat的启动方式也一样？

（五）启动solr

bin/solr -c -z server1:2181,server2:2181,server3:2181/solr

tomcat 不是这样子。

二、授权

（一）启用plugin

{"authentication":{"class":"solr.BasicAuthPlugin","blockUnknown": true,"credentials":{"solr":"IV0EHq1OnNrj6gvRCwvFwTrZ1+z1oBbnQdiVC3otuq0=Ndd7LKvVBAaZIF0QAVi1ekCfAJXr1GGfLtRUXhgrF8c="}},"authorization":{"class":"solr.RuleBasedAuthorizationPlugin","permissions":[{"name":"security-edit","role":"admin"}]"user-role":{"solr":"admin"}}}

（二）授权

curl --user solr:SolrRocks -H 'Content-type:application/json' -d '{"set-permission": {"name":"collection-mgr","collection": null,"path":"/admin/collections","params":{"action":[LIST, CREATE]},"before": "read","role": "admin"}}' http://localhost:8983/solr/admin/authorization

三、solrJ的认证

To use Kerberos authentication in a SolrJ application, you need the following two lines before you create a SolrClient:

System.setProperty("java.security.auth.login.config", "/home/foo/jaas-client.conf");HttpClientUtil.setConfigurer(new Krb5HttpClientConfigurer());

You need to specify a Kerberos service principal for the client and a corresponding keytab in the JAAS client configuration file above. Here’s an example:

SolrJClient {    com.sun.security.auth.module.Krb5LoginModule required    useKeyTab=true    keyTab="/keytabs/foo.keytab"    storeKey=true    useTicketCache=true    debug=true    principal="foo@EXAMPLE.COM";};

阅读全文

0 0