solr添加kerberos認證及授權(quán)

@(OTHERS)[solr]

一、kerberos

（一）添加用戶

在kdc中添加solr用戶：

root@kdc:/# kadmin.local kadmin.local: addprinc HTTP/192.168.0.107 kadmin.local: ktadd -k /tmp/107.keytab HTTP/192.168.0.107 kadmin.local: quit

（二）創(chuàng)建security.json

server/scripts/cloud-scripts/zkcli.sh -zkhost localhost:2181 -cmd put /security.json '{"authentication":{"class": "org.apache.solr.security.KerberosPlugin"}}'

或者以文件的形式上傳

（三）創(chuàng)建jaas文件

Client {com.sun.security.auth.module.Krb5LoginModule requireduseKeyTab=truekeyTab="/keytabs/107.keytab"storeKey=trueuseTicketCache=truedebug=trueprincipal="HTTP/192.168.0.107@EXAMPLE.COM"; };

放到哪里？

（四）在solr.in.sh中添加以下內(nèi)容

SOLR_AUTHENTICATION_CLIENT_CONFIGURER=org.apache.solr.client.solrj.impl.Krb5HttplientConfigurer SOLR_AUTHENTICATION_OPTS="-Djava.security.auth.login.config=/home/foo/jaas-client.co nf -Dsolr.kerberos.cookie.domain=192.168.0.107 -Dsolr.kerberos.cookie.portaware=true -Dsolr.kerberos.principal=HTTP/192.168.0.107@EXAMPLE.COM -Dsolr.kerberos.keytab=/keytabs/107.keytab"

對于tomcat的啟動方式也一樣？

（五）啟動solr

bin/solr -c -z server1:2181,server2:2181,server3:2181/solr

tomcat 不是這樣子。

二、授權(quán)

（一）啟用plugin

{ "authentication":{ "class":"solr.BasicAuthPlugin", "blockUnknown": true, "credentials":{"solr":"IV0EHq1OnNrj6gvRCwvFwTrZ1+z1oBbnQdiVC3otuq0= Ndd7LKvVBAaZIF0QAVi1ekCfAJXr1GGfLtRUXhgrF8c="} }, "authorization":{ "class":"solr.RuleBasedAuthorizationPlugin", "permissions":[{"name":"security-edit", "role":"admin"}] "user-role":{"solr":"admin"} }}

（二）授權(quán)

curl --user solr:SolrRocks -H 'Content-type:application/json' -d '{ "set-permission": {"name":"collection-mgr", "collection": null, "path":"/admin/collections", "params":{"action":[LIST, CREATE]}, "before": "read", "role": "admin"} }' http://localhost:8983/solr/admin/authorization

三、solrJ的認證

To use Kerberos authentication in a SolrJ application, you need the following two lines before you create a SolrClient:

System.setProperty("java.security.auth.login.config", "/home/foo/jaas-client.conf"); HttpClientUtil.setConfigurer(new Krb5HttpClientConfigurer());

You need to specify a Kerberos service principal for the client and a corresponding keytab in the JAAS client configuration file above. Here’s an example:

SolrJClient {com.sun.security.auth.module.Krb5LoginModule requireduseKeyTab=truekeyTab="/keytabs/foo.keytab"storeKey=trueuseTicketCache=truedebug=trueprincipal="foo@EXAMPLE.COM"; };

總結(jié)

以上是生活随笔為你收集整理的solr添加kerberos认证及授权的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。