使用java客户端与安全的hbase连接

5ktev3wc 于 2021-06-07 发布在 Hbase

关注(0)|答案(1)|浏览(591)

我正在尝试用kerberos连接一个安全的hbase。它是部署到hdp3集群中的hbase。确切地说，我正在尝试从集群之外的主机使用java客户机进行访问。
这是我的密码：

System.setProperty("java.security.krb5.conf","/etc/krb5.conf");
        System.setProperty("sun.security.krb5.debug", "true");
        System.setProperty("java.security.debug", "gssloginconfig,configfile,configparser,logincontext");
        System.setProperty("java.security.auth.login.config", "hbase.conf");

        Configuration conf = HBaseConfiguration.create();

        String principal="user@REALM";
        File keytab = new File("/home/user/user.keytab");

        UserGroupInformation.setConfiguration(conf);
        UserGroupInformation ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(principal, keytab.getAbsolutePath());

        ugi.doAs(new PrivilegedAction<Void>() {
            @Override
            public Void run() {

                try {

                    TableName tableName = TableName.valueOf("some_table");
                    final Connection conn = ConnectionFactory.createConnection(conf);
                    System.out.println(" go ");
                    Table table = conn.getTable(tableName);
                    Result r = table.get(new Get(Bytes.toBytes("some_key")));
                    System.out.println(r);

                } catch (IOException e) {
                    e.printStackTrace();
                }

                return null;
            }
        });

    }

这是我的jaas文件配置：

Client {
  com.sun.security.auth.module.Krb5LoginModule required
  useKeyTab=true
  useTicketCache=false
  keyTab="/home/user/user.keytab"
  principal="user@REALM";
};

所有zookeeper和其他配置都来自ambari提供的hbase-site.xml文件。
我没有收到任何错误，只是客户端进入一个无限循环，跟踪如下：
readonlyzkclient-node2:2181,node3:2181,node4:2181@0x50ad3bc1-sendthread（node4:2181）]debug org.apache.zookeeper.clientcnxn-阅读回复sessionid:0x371f62d9b230031，packet:：clientpath:/hbase secure/meta region server服务器路径：/hbase secure/meta region serverfinished:false header：141,4复制头：：141365072222881，0请求：“/hbase secure/meta region server，f响应：：#ffffffffffff000146d61737465723a313630303019fffffffffffff6ffffff864dfffffff99ffffff85151c50425546a11a56e6f64653410ffffffff947d18ffffffffb0ffffffffffffffffffffffff6ffffffff81ffffffffffffc5ffffffffff9f2e100183，s{365072220963307222074158893398227158918472,5,0,0,52,036507220963}[readonlyzkclient-node2:2181，node3:2181，node4:2181@0x50ad3bc1-sendthread（node4:2181）]debug org.apache.zookeeper.clientcnxn-阅读回复sessionid:0x371f62d9b230031，packet:：clientpath:/hbase secure/meta region server服务器路径：/hbase secure/meta region serverfinished:false header：142,4 replyheader:：142365072222881,0请求：：'/hbase secure/meta region server，f响应：#FFFFFF000146D61737465723A313603019FFFFFFFFFFF6FFFFFF864DFFFFF99FFFFFF85151C50425546A11A56E6F64653410FFFFFFFF947D18FFFFFFB0FFFFFFFFFF6FFFF81FFFFFFC5FFFFFFFF9F2E100183，s{36507222096336507222074158893398227158918472,5,0,0,52,036507220963}[readonlyzkclient-node2:2181，node3:2181，node4:2181@0x50ad3bc1-sendthread（node4:2181）]debug org.apache.zookeeper.clientcnxn-阅读回复sessionid:0x371f62d9b230031，packet:：clientpath:/hbase secure/meta region server服务器路径：/hbase secure/meta region serverfinished:false header：：143,4 replyheader:：14336507222881,0请求：：'/hbase secure/meta region server，f回复：#ffffffff000146d61737465723a313630303019fffffffffff6ffffff864dfffff99ffffff85151c50425546a11a56e6f64653410ffffffff947d18ffffffb0ffffffffffff6ffffff81ffffffffc5ffffffff9f2e100183，s{36507222096336507222074158893322718472,5,0,0,52,036507220963}
编辑
好吧，我犯了这个错误，只是我没有等很久：

Exception in thread "main" java.net.SocketTimeoutException: callTimeout=1200000, callDuration=2350283: Failed after attempts=36, exceptions:
Mon May 11 13:53:42 CEST 2020, null, java.net.SocketTimeoutException: callTimeout=60000, callDuration=70631: Call to slave-5.cluster/172.10.96.43:16020 failed on local exception: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)] row 'tome_table,some_key,99999999999999' on table 'hbase:meta' at region=hbase:meta,,1.1588230740, hostname=slave-5.cluster/172.10.96.43:16020,16020,1588595144765, seqNum=-1
 row 'row_key' on table 'some_table' at null
    at org.apache.hadoop.hbase.client.RpcRetryingCallerImpl.callWithRetries(RpcRetryingCallerImpl.java:159)
    at org.apache.hadoop.hbase.client.HTable.get(HTable.java:386)
    at org.apache.hadoop.hbase.client.HTable.get(HTable.java:360)
    at internal.holly.devoptools.hbase.HBaseCli.main(HBaseCli.java:77)
Caused by: org.apache.hadoop.hbase.client.RetriesExhaustedException: Failed after attempts=36, exceptions:
Mon May 11 13:53:42 CEST 2020, null, java.net.SocketTimeoutException: callTimeout=60000, callDuration=70631: Call to slave-5.cluster/172.10.96.43:16020 failed on local exception: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)] row 'some_table,some_key,99999999999999' on table 'hbase:meta' at region=hbase:meta,,1.1588230740, hostname=slave-5.cluster,16020,1588595144765, seqNum=-1

    at org.apache.hadoop.hbase.client.RpcRetryingCallerWithReadReplicas.throwEnrichedException(RpcRetryingCallerWithReadReplicas.java:298)
    at org.apache.hadoop.hbase.client.ScannerCallableWithReplicas.call(ScannerCallableWithReplicas.java:242)
    at org.apache.hadoop.hbase.client.ScannerCallableWithReplicas.call(ScannerCallableWithReplicas.java:58)
    at org.apache.hadoop.hbase.client.RpcRetryingCallerImpl.callWithoutRetries(RpcRetryingCallerImpl.java:192)
    at org.apache.hadoop.hbase.client.ClientScanner.call(ClientScanner.java:269)
    at org.apache.hadoop.hbase.client.ClientScanner.loadCache(ClientScanner.java:437)
    at org.apache.hadoop.hbase.client.ClientScanner.nextWithSyncCache(ClientScanner.java:312)
    at org.apache.hadoop.hbase.client.ClientScanner.next(ClientScanner.java:597)
    at org.apache.hadoop.hbase.client.ConnectionImplementation.locateRegionInMeta(ConnectionImplementation.java:856)
    at org.apache.hadoop.hbase.client.ConnectionImplementation.locateRegion(ConnectionImplementation.java:759)
    at org.apache.hadoop.hbase.client.ConnectionImplementation.locateRegion(ConnectionImplementation.java:745)
    at org.apache.hadoop.hbase.client.ConnectionImplementation.locateRegion(ConnectionImplementation.java:716)
    at org.apache.hadoop.hbase.client.ConnectionImplementation.getRegionLocation(ConnectionImplementation.java:594)
    at org.apache.hadoop.hbase.client.HRegionLocator.getRegionLocation(HRegionLocator.java:72)
    at org.apache.hadoop.hbase.client.RegionServerCallable.prepare(RegionServerCallable.java:223)
    at org.apache.hadoop.hbase.client.RpcRetryingCallerImpl.callWithRetries(RpcRetryingCallerImpl.java:105)
    ... 3 more

谢谢。

Java hbase kerberos Connection Client

来源：https://stackoverflow.com/questions/61709466/connect-with-a-secured-hbase-using-a-java-client

1条答案

按热度按时间

bbmckpt71#

最后加上这个道具它成功了：

conf.set("hadoop.security.authentication", "kerberos");

这是我最后的密码：

public static void main(String[] args) throws IOException, InterruptedException {
        System.setProperty("java.security.krb5.conf", "/etc/krb5.conf");

        Configuration conf = HBaseConfiguration.create();
        conf.set("hadoop.security.authentication", "kerberos");

        String principal = "user@REALM";

        UserGroupInformation.setConfiguration(conf);
        UserGroupInformation ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(principal, "/home/user/principal.keytab");

        Connection conn = ugi.doAs(new PrivilegedExceptionAction<Connection>() {
            @Override
            public Connection run() throws Exception {
                return ConnectionFactory.createConnection(conf);
            }
        });

        TableName tableName = TableName.valueOf("some_table");
        Table table = conn.getTable(tableName);
        Result r = table.get(new Get(Bytes.toBytes("some_key")));

        System.out.println("result: " + r);

    }

赞(0）回复(0）举报 2021-06-07

我来回答

使用java客户端与安全的hbase连接

1条答案

相关问题

热门标签

最新问答