feat(security): init kerberos #585

levy5307 · 2020-08-06T10:23:25Z

If the config of enable_auth is true, we should init kerberos.
Here is the detail procedure:

set envs which are used in kerberos, like KRB5CCNAME, KRB5_CONFIG and so on.
create a kerberos context.
convert a string principal name to a krb5_principal structure. principal and username that logged in as, this determines "who I am"
get a handle for a key table. key table is the file to store principals and it's correponding key.
acquire credential cache handle and initialize credential cache. The credential cache is used for storing credentials.
allocate a new initial credential options structure, the options are used for getting credentials.
get and schedule to renew credentials from KDC and store it into _ccache

New configuration added

[security]
+ krb5_keytab =
+ krb5_config =
+ krb5_principal =

include/dsn/utility/time_utils.h

acelyc111 · 2020-08-07T02:06:58Z

src/runtime/CMakeLists.txt

@@ -30,5 +30,5 @@ add_library(dsn_runtime STATIC
        tracer.cpp
        zlocks.cpp
        )
-target_link_libraries(dsn_runtime dsn_utils)
+target_link_libraries(dsn_runtime dsn_utils sasl2 gssapi_krb5 krb5)


So don't forget to update docs

Which docs do you mean?

http://pegasus.apache.org/overview/compilation & https://github.com/XiaoMi/pegasus/blob/master/docs/installation.md

src/runtime/security/kerberos_utils.cpp

src/runtime/security/kerberos_utils.h

src/runtime/security/kerberos_utils.cpp

acelyc111 · 2020-08-07T02:44:58Z

src/runtime/security/kerberos_utils.cpp

+    _timer->expires_from_now(boost::posix_time::seconds(renew_gap));
+    _timer->async_wait([this](const boost::system::error_code &err) {
+        if (!err.failed()) {
+            get_credentials();


Will you try to find credential in krb5_ccache in other PRs?

It's not internal
https://web.mit.edu/kerberos/krb5-1.12/doc/basic/ccache_def.html

I have read some docs of kerberos. It says
The credential cache file holds Kerberos protocol credentials (for example, tickets, session keys, and other identifying information) in semipermanent storage. The Kerberos protocol reads credentials from the cache as they are required and stores new credentials in the cache as they are obtained. This relieves the application of the responsibility for managing the credentials itself. in https://www.ibm.com/support/knowledgecenter/en/SSGSMK_7.1.0/management_sym/sym_kerberos_configuring_credential_cache_file.html

And I have read the corresponding code in kudu, there are no code trying to find credentials in krb5_ccache. It only put credentials into krb5_ccache.

so you mean krb5_cc_ funcs are useless? You should read more. It's not for internal. I didn't say we need to use it.

The Kerberos protocol reads credentials from the cache as they are required and stores new credentials in the cache as they are obtained. I didn't say they are useless

So what the credential cache is used for in your opinion? @vagetablechicken

What I said is the basic conceptive problem. krb5_ccache is not for krb internal. The owner can use it to avoid unnecessary connections.
There's no need to optimize prematurely.

acelyc111 · 2020-08-07T02:51:38Z

Take a look at https://github.com/apache/kudu/blob/master/src/kudu/security/init.cc may help.

…s-init

include/dsn/utility/error_code.h

src/runtime/service_api_c.cpp

src/runtime/security/kinit_context.cpp

src/runtime/CMakeLists.txt

src/runtime/security/kinit_context.h

src/runtime/security/init.cpp

src/runtime/security/kinit_context.cpp

…s-init

neverchanje · 2020-08-21T02:14:51Z

src/runtime/security/init.h

+namespace dsn {
+namespace security {
+// init security(kerberos and sasl)
+bool init(bool is_server);


Suggested change

bool init(bool is_server);

extern bool init_server();

extern bool init_client();

I think there is no need to split the function into two functions. Because they are almost same

levy5307 added 14 commits August 5, 2020 12:08

init kerberos

0b99fdb

add krb5/sasl to thirdparty/CMakeLists.txt

371453d

change makelist

8e2e392

krb5_call_to_errors

6e8b03c

refactor

0f46110

refactor

fb99365

fix

dbae3e1

fix

9625159

Merge branch 'master' into kerberos-init

48f9d0e

fix

8c240c7

fix

bbd0f28

fix

102f8e9

fix

dd6a2ae

fix

fa1285c

acelyc111 reviewed Aug 7, 2020

View reviewed changes

levy5307 marked this pull request as draft August 7, 2020 02:57

levy5307 added 11 commits August 7, 2020 15:58

Merge branch 'master' into kerberos-init

66c44d8

refactor kerberos utils

3052fd9

fix

bbcb249

Merge branch 'kerberos-init' of github.com:levy5307/rdsn into kerbero…

2d70d13

…s-init

change sleep_after_init to is_server

6a3b1af

fix

bc898b4

fix

7c6d38d

fix

1b1f12d

fix

da94b16

fix

5767e5e

Merge branch 'master' into kerberos-init

a41bbe8

levy5307 marked this pull request as ready for review August 14, 2020 02:12

Merge branch 'master' into kerberos-init

b4fa990

hycdong reviewed Aug 14, 2020

View reviewed changes

neverchanje reviewed Aug 14, 2020

View reviewed changes

src/runtime/security/kinit_context.h Outdated Show resolved Hide resolved

levy5307 added 5 commits August 14, 2020 18:40

fix

ac54c07

fix

e6c7f75

refactor

d18f370

Merge branch 'master' into kerberos-init

ce71a2a

add get_next_renew_interval

ea0f5bf

acelyc111 reviewed Aug 19, 2020

View reviewed changes

src/runtime/security/init.cpp Outdated Show resolved Hide resolved

src/runtime/security/init.cpp Outdated Show resolved Hide resolved

src/runtime/security/kinit_context.cpp Outdated Show resolved Hide resolved

src/runtime/security/kinit_context.cpp Show resolved Hide resolved

levy5307 added 3 commits August 19, 2020 16:10

Merge remote-tracking branch 'origin/master' into kerberos-init

8d584da

refactor

f4f1d5d

refactor

ee19b83

acelyc111 previously approved these changes Aug 19, 2020

View reviewed changes

levy5307 added 2 commits August 19, 2020 17:46

delete the wrong comment

c55ab09

Merge branch 'kerberos-init' of github.com:levy5307/rdsn into kerbero…

6e60cc3

…s-init

levy5307 dismissed acelyc111’s stale review via 6e60cc3 August 19, 2020 09:46

acelyc111 previously approved these changes Aug 20, 2020

View reviewed changes

neverchanje reviewed Aug 21, 2020

View reviewed changes

hycdong previously approved these changes Aug 21, 2020

View reviewed changes

Merge remote-tracking branch 'origin/master' into kerberos-init

5b96be6

levy5307 dismissed stale reviews from hycdong and acelyc111 via 5b96be6 August 21, 2020 06:47

acelyc111 approved these changes Aug 21, 2020

View reviewed changes

hycdong approved these changes Aug 21, 2020

View reviewed changes

levy5307 merged commit 38095a4 into XiaoMi:master Aug 21, 2020

levy5307 deleted the kerberos-init branch August 21, 2020 07:29

levy5307 added the component/security label Sep 8, 2020

levy5307 added the type/config-change PR that made modification on configs, which should be noted in release note. label Oct 30, 2020

levy5307 added a commit to levy5307/rdsn that referenced this pull request Dec 21, 2020

feat(security): init kerberos (XiaoMi#585)

cf38428

neverchanje mentioned this pull request Mar 1, 2021

Release 2.2.0 apache/incubator-pegasus#696

Closed

neverchanje added the 2.1.0 label Mar 2, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(security): init kerberos #585

feat(security): init kerberos #585

levy5307 commented Aug 6, 2020 •

edited by neverchanje

Loading

acelyc111 Aug 7, 2020

levy5307 Aug 7, 2020

neverchanje Aug 14, 2020

acelyc111 Aug 7, 2020

vagetablechicken Aug 7, 2020 •

edited

Loading

levy5307 Aug 14, 2020 •

edited

Loading

vagetablechicken Aug 14, 2020

levy5307 Aug 14, 2020

levy5307 Aug 14, 2020

vagetablechicken Aug 14, 2020

acelyc111 commented Aug 7, 2020

neverchanje Aug 21, 2020

levy5307 Aug 21, 2020

-bool init(bool is_server);
+extern bool init_server();
+extern bool init_client();

feat(security): init kerberos #585

feat(security): init kerberos #585

Conversation

levy5307 commented Aug 6, 2020 • edited by neverchanje Loading

New configuration added

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vagetablechicken Aug 7, 2020 • edited Loading

Choose a reason for hiding this comment

levy5307 Aug 14, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

acelyc111 commented Aug 7, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

levy5307 commented Aug 6, 2020 •

edited by neverchanje

Loading

vagetablechicken Aug 7, 2020 •

edited

Loading

levy5307 Aug 14, 2020 •

edited

Loading