java - KDC - 我们从哪里获得服务器？

Question

我正在尝试使用 java 执行 kerberos 身份验证。

我启用了调试。

当尝试使用 tgt 连接到 LDAP 时，我得到(服务器名称已更改):

getRealmFromDNS: trying srv1.myserver.com
getRealmFromDNS: trying srv2.myserver.com
getRealmFromDNS: trying srv1.myserver.com
getRealmFromDNS: trying srv2.myserver.com
Found ticket for <a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="7b0e081e093b282e39553622283e292d3e2955383436" rel="noreferrer noopener nofollow">[email protected]</a> to go to krbtgt/<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="396a6c7b1774606a7c6b6f7c6b177a7674796a6c7b1774606a7c6b6f7c6b177a7674" rel="noreferrer noopener nofollow">[email protected]</a> expiring on Sat Dec 01 02:11:14
Entered Krb5Context.initSecContext with state=STATE_NEW
Service ticket not found in the subject
getRealmFromDNS: trying srv1.myserver.com
getRealmFromDNS: trying srv2.myserver.com
>>> Credentials acquireServiceCreds: same realm
default etypes for default_tgs_enctypes: 16 3 1.
>>> CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType
>>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
>>> KdcAccessibility: reset
getKDCFromDNS using UDP
>>> KrbKdcReq send: kdc=server123.myserver.com. UDP:88, timeout=30000, number of retries =3, #bytes=1542
>>> KDCCommunication: kdc=server123.myserver.com. UDP:88, timeout=30000,Attempt=1, #bytes=1542
SocketTimeOutException with attempt: 1
>>> KDCCommunication: kdc=server123.myserver.com. UDP:88, timeout=30000,Attempt=2, #bytes=1542
SocketTimeOutException with attempt: 2
>>> KDCCommunication: kdc=server123.myserver.com. UDP:88, timeout=30000,Attempt=3, #bytes=1542
SocketTimeOutException with attempt: 3
>>> KrbKdcReq send: error trying server123.myserver.com.
java.net.SocketTimeoutException: Receive timed out
        at java.net.DualStackPlainDatagramSocketImpl.socketReceiveOrPeekData(Native Method)
        at java.net.DualStackPlainDatagramSocketImpl.receive0(Unknown Source)
        at java.net.AbstractPlainDatagramSocketImpl.receive(Unknown Source)
        at java.net.DatagramSocket.receive(Unknown Source)
        at sun.security.krb5.internal.UDPClient.receive(Unknown Source)
        at sun.security.krb5.KdcComm$KdcCommunication.run(Unknown Source)
        at sun.security.krb5.KdcComm$KdcCommunication.run(Unknown Source)
        at java.security.AccessController.doPrivileged(Native Method)
        at sun.security.krb5.KdcComm.send(Unknown Source)
        at sun.security.krb5.KdcComm.send(Unknown Source)
        at sun.security.krb5.KdcComm.send(Unknown Source)
        at sun.security.krb5.KrbTgsReq.send(Unknown Source)
        at sun.security.krb5.KrbTgsReq.sendAndGetCreds(Unknown Source)
        at sun.security.krb5.internal.CredentialsUtil.serviceCreds(Unknown Source)
        at sun.security.krb5.internal.CredentialsUtil.acquireServiceCreds(Unknown Source)
        at sun.security.krb5.Credentials.acquireServiceCreds(Unknown Source)
        at sun.security.jgss.krb5.Krb5Context.initSecContext(Unknown Source)
        at sun.security.jgss.GSSContextImpl.initSecContext(Unknown Source)
        at sun.security.jgss.GSSContextImpl.initSecContext(Unknown Source)
        at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(Unknown Source)
        at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(Unknown Source)
        at com.sun.jndi.ldap.LdapClient.authenticate(Unknown Source)
        at com.sun.jndi.ldap.LdapCtx.connect(Unknown Source)
        at com.sun.jndi.ldap.LdapCtx.<init>(Unknown Source)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(Unknown Source)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(Unknown Source)
        at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(Unknown Source)
        at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(Unknown Source)
        at javax.naming.spi.NamingManager.getInitialContext(Unknown Source)
        at javax.naming.InitialContext.getDefaultInitCtx(Unknown Source)
        at javax.naming.InitialContext.init(Unknown Source)
        at javax.naming.ldap.InitialLdapContext.<init>(Unknown Source)
        at myApp.JndiAction.performJndiOperation(MyTest.java:577)
        at myApp.JndiAction.run(MyTest.java:551)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.security.auth.Subject.doAs(Unknown Source)
        at myApp.MyTest.main(MyTest.java:489)
>>> KdcAccessibility: add server123.myserver.com.

我的答案是:

1. 从哪里获取 kdc 服务器 (server123.myserver.com)？

2. 我可以更改它吗？

谢谢。

Answer 1

如果您不在 Windows 平台上，请搜索 krb5.conf 文件。有一个 [realms] 部分，其中提供了域和关联的 KDC。

[realms]
        YOURDOMAIN.com = {
                kdc = dc1.yourdomain.com
        }

正如 Michael-O 所指出的，在 Windows 平台上，存在特定的 DNS 记录。