使用APACHE KNOX作为proxy访问web，同时开启SSO功能

创建topologies

cd /usr/hdp/current/knox-servertouch conf/topologies/haha.xml

haha.xml

<?xml version="1.0" encoding="utf-8"?><topology>    <gateway>        <provider>            <role>authentication</role>            <name>ShiroProvider</name>            <enabled>false</enabled>            <param>                <name>main.ldapRealm</name>                <value>org.apache.hadoop.gateway.shirorealm.KnoxLdapRealm</value>            </param>            <param>                <name>main.ldapContextFactory</name>                <value>org.apache.hadoop.gateway.shirorealm.KnoxLdapContextFactory</value>            </param>            <param>                <name>main.ldapRealm.contextFactory</name>                <value>$ldapContextFactory</value>            </param>            <param>                <name>main.ldapRealm.contextFactory.url</name>                <value>ldap://fsmanager</value>            </param>            <param>                <name>main.ldapRealm.contextFactory.authenticationMechanism</name>                <value>simple</value>            </param>            <param>                <name>main.ldapRealm.userDnTemplate</name>                <value>uid={0},ou=people,dc=hadoop,dc=apache,dc=org</value>            </param>            <param>                <name>urls./**</name>                <value>authcBasic</value>            </param>        </provider>        <provider>            <role>identity-assertion</role>            <name>Default</name>            <enabled>true</enabled>        </provider>        <provider>            <role>hostmap</role>            <name>static</name>            <enabled>true</enabled>            <param>                <name>localhost</name>                <value>sandbox,sandbox.hortonworks.com,fsmanager</value>            </param>        </provider>        <provider>            <role>federation</role>            <name>SSOCookieProvider</name>            <enabled>true</enabled>            <param>                <name>sso.authentication.provider.url</name>                <value>https://fsmanager:8443/gateway/knoxsso/api/v1/websso</value>            </param>        </provider>    </gateway>    <service>        <role>HAHAUIIII</role>        <url>http://fsmanager:5000</url>    </service></topology>

创建Server

mkdir -p /data/services/hahauiiii/2.4.0touch {service, rewrite}.xml

service.xml

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><service role="HAHAUIIII" name="hahauiiii" version="2.4.0">    <routes>        <!-- https://fsmanager:8443/gateway/haha/hahauiiii -->        <route path="/hahauiiii/?**">            <rewrite apply="HAHAUIIII/hahauiiii/inbound" to="request.url"/>        </route>        <!-- https://fsmanager:8443/gateway/haha/hahauiiii/v1/?op=LISTSTATUS -->        <route path="/hahauiiii/v1/?**">            <rewrite apply="HAHAUIIII/hahauiiii/inbound/version" to="request.url"/>        </route>    </routes><service>

rewrite.xml

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><rules>    <rule dir="IN" name="HAHAUIIII/hahauiiii/inbound" pattern="*://*:*/**/hahauiiii">        <rewrite template="{$serviceUrl[HAHAUIIII]}"/>    </rule>    <rule dir="IN" name="HAHAUIIII/hahauiiii/inbound/version" pattern="*://*:*/**/hahauiiii/{version}/?{**}">        <rewrite template="{$serviceUrl[HAHAUIIII]}/{version}/?{**}"/>    </rule></rules>

重新部署cluster

bin/knoxcli.sh redeploy --cluster haha

重新启动KNOX

bin/gataway.sh stopbin/gateway.sh start

---

Server文件内容简介

Server 目录结构

data└── services    └── hahauiiii        └── 2.4.0            ├── rewrite.xml            └── service.xml

service.xml

<service role="HAHAUIIII" name="hahauiiii" version="2.4.0">    <routes>        <route path="/hahauiiii/?**"></route>    </routes></service>

<service role="HAHAUIIII">

• 这里的role需要匹配 topology 文件中的 <topology><service><role> 属性

<service name="hahauiiii">

• 这里的name需要匹配 <GATEWAY_HOME>/data/services 中相应的目录名称，这里是指hahauiiii这个目录名称

<service version="2.4.0">

• 假如存在多个版本的server实现，version必须对应于相应的版本，及 <GATEWAY_HOME>/data/services, 这里是指2.4.0这个目录名称

<route path="/hahauiiii/?**"></route>

• path指明了URL的基本形式，这里的形式为 https://fsmanager:8443/gateway/haha/hahauiiii

rewrite.xml

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><rules>    <rule dir="IN" name="HAHAUIIII/hahauiiii/inbound" pattern="*://*:*/**/hahauiiii">        <rewrite template="{$serviceUrl[HAHAUIIII]}"/>    </rule>

<rule dir="IN">
<rule name="HAHAUIIII/hahauiiii/inbound">

• 表明该条规则是应用于来自客户端的requests还是应用于gateway于对客户端response

<rule pattern="*://*:*/**/hahauiiii">

• 匹配指定的URL，类似于正则表达式

<rewrite template="{$serviceUrl[HAHAUIIII]}"/>

{$serviceUrl[HAHAUIIII]} 会去寻找topologies中的指定ROLE中定义的URL， 这里指的是haha.xml 中ROLE为HAHAUIIII中定义的URL<url>http://fsmanager:5000</url>

---

常见错误

500： rewrite.xml内容可能有问题，特别是partern可能有误
404：service.xml内容有问题，特别是path可能有误

---

Refenerce

Understanding Rewrite Rules for Apache Knox
Adding a service to Apache Knox
Knox SSO Integration for UIs

---

Appendix

创建临时可用的web服务代码，基于flask

from flask import Flask, requestapp = Flask(__name__)@app.route("/")def hello():    return "<h1>Hello World!</h1>"@app.route("/v1/")def version():    return "<h1>Hello Stranger -> {0}</h1>".format(request.args.get("op"))if __name__ == "__main__":    app.run(host="0.0.0.0")