Java API连接Kerberos认证的HBASE

最新推荐文章于 2025-06-19 09:49:58 发布

原创

最新推荐文章于 2025-06-19 09:49:58 发布 · 6.8k 阅读

29 ·

CC 4.0 BY-SA版权

文章标签：

#hbase #kerberos #大数据

本文详细介绍了Java代码如何连接启用Kerberos认证的HBase，包括必要的配置项如java.security.krb5.conf、hadoop.security.authentication等，并通过示例代码展示了缺失配置导致的错误信息。同时提到了核心站点和HBase站点配置文件在连接中的作用，以及Kerberos票据续约的问题。

网上关于 Java 代码连接启用了Kerberos认证的HBASE资料很多，但是总感觉不够准确，总是出现各种问题。经过整合网上资料和亲自试验，得出连接成功的最小配置项如下：

java.security.krb5.conf

hadoop.security.authentication

hbase.security.authentication

hbase.regionserver.kerberos.principal

hbase.zookeeper.quorum

hbase.zookeeper.property.clientPort

试验发现，如果上述配置项缺少了任一项都会导致HBASE连接读写不成功。先放上获取连接成功的代码：

import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.hbase.HBaseConfiguration;
import org.apache.hadoop.hbase.TableName;
import org.apache.hadoop.hbase.client.Admin;
import org.apache.hadoop.hbase.client.Connection;
import org.apache.hadoop.hbase.client.ConnectionFactory;
import org.apache.hadoop.security.UserGroupInformation;

import java.io.IOException;

public class HbaseConnector {

    public static Connection getConnection(String zkQuorum, String clientPort, String keyTabPath, String krbConfPath, String principal) throws IOException {

        // krb5.conf必需
        System.setProperty("java.security.krb5.conf", krbConfPath);

        org.apache.hadoop.conf.Configuration conf = HBaseConfiguration.create();

        // 必需
        conf.set("hadoop.security.authentication", "kerberos");

        // 必需
        conf.set("hbase.security.authentication", "kerberos");
        conf.set("hbase.regionserver.kerberos.principal", "hbase/[email protected]");
        conf.set("hbase.zookeeper.quorum", zkQuorum);
        conf.set("hbase.zookeeper.property.clientPort", clientPort);
        // (非必需)
        conf.set("hbase.master.kerberos.principal", "hbase/[email protected]");

        UserGroupInformation.setConfiguration(conf);

        //登陆认证
        UserGroupInformation.loginUserFromKeytab(principal, keyTabPath);

        return ConnectionFactory.createConnection(conf);
    }

    public static void main(String[] args) throws IOException {
        Connection connection = getConnection("node101,node102,node103", "2181", "C:/Users/sysea/Desktop/tonseal.keytab", "C:/Users/sysea/Desktop/krb5.conf", "[email protected]");
        Admin admin = connection.getAdmin();
        if (admin.tableExists(TableName.valueOf("tonseal:tonseal_table"))) {
            System.out.println("表tonseal:tonseal_table存在");
        } else {
            System.err.println("表tonseal:tonseal_table不存在");
        }
        admin.close();
        connection.close();
    }
}

hbase.zookeeper.quorum和hbase.zookeeper.property.clientPort这两个配置项是必需的，无论是否开启Kerberos认证都需要进行设置的。

krb5.conf这个文件可以在主机的/etc目录下找到：

krb5.conf示例内容如下：

[libdefaults]
default_realm = HADOOP.COM
dns_lookup_kdc = false
dns_lookup_realm = false
ticket_lifetime = 86400
renew_lifetime = 604800
forwardable = true
default_tgs_enctypes = aes256-cts
default_tkt_enctypes = aes256-cts
permitted_enctypes = aes256-cts
udp_preference_limit = 1
kdc_timeout = 3000

[realms]
HADOOP.COM = {
  kdc = node101
  admin_server = node101
}
[domain_realm]

下面贴出缺少上述其他配置项的连接报错信息：

如果缺少了java.security.krb5.conf，提示无法获取realm：

23:14:29.533 [main] DEBUG org.apache.hadoop.security.authentication.util.KerberosName - Kerberos krb5 configuration not found, setting default realm to empty
Exception in thread "main" java.lang.IllegalArgumentException: Can't get Kerberos realm
	at org.apache.hadoop.security.HadoopKerberosName.setConfiguration(HadoopKerberosN