Jetty 12 HttpClient配置SPNEGO代理Kerberos认证问题求助

使用Jetty 12.x时，尝试为HttpClient配置代理并启用Kerberos认证，但查阅官方文档及测试示例后，未找到相关配置指引。

我的代理信息如下：

String realm = "CAPVANLAB.COM";
String kdc = "capvanlab.com";

String proxyUser = "svc.bcaaa@CAPVANLAB.COM";
String proxyPassword = "Pass@123";
String serviceName = "VanBluecoatS200.capvanlab.com"; // 这是Bluecoat代理本身

String proxyHost = "192.168.72.8";
int proxyPort = 8080;

我有两个疑问：

• 创建SPNEGOAuthentication对象时，传入的URI应取什么正确值？
• 为SPNEGOAuthentication对象设置的serviceName应取什么正确值？

当前实际生成的Sname错误附加了目标站点主机名，而预期的Sname应与HttpUrlConnection生成的一致。查看SPNEGOAuthentication.initGSSContext()代码发现，其从HttpRequest提取主机名并附加到服务名生成SPN，这似乎不正确。

以下是我尝试的示例代码：

package com.example.caching;

import org.apache.catalina.authenticator.SpnegoAuthenticator;
import org.eclipse.jetty.client.*;
import org.eclipse.jetty.util.component.LifeCycle;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.http.client.reactive.*;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

import lombok.extern.slf4j.Slf4j;
import org.springframework.web.reactive.function.client.WebClient;
import reactor.core.publisher.Mono;

import javax.security.auth.Subject;
import javax.security.auth.login.AppConfigurationEntry;
import javax.security.auth.login.Configuration;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import java.net.*;
import java.util.HashMap;
import java.util.Set;

@RestController
@Slf4j
public class CustomerController {

    public String uri = "http://example.com";

    String serviceType = "HTTP";
    String serviceName = "VanBluecoatS200.capvanlab.com";
    String scheme = "http";

    String nameStr ="Capvanlabdc.Capvanlab.com";

    String realm = "CAPVANLAB.COM";
    String kdc = "capvanlab.com";

    String clientName ="svc.bcaaa";
    String proxyUser = "svc.bcaaa@CAPVANLAB.COM";
    String proxyPassword = "Pass@123";

    String proxyHost = "192.168.72.8";
    int proxyPort = 8080;


    @GetMapping("/jet")
    public String jetHttp() {
        log.info(">>> checking kerberos httpClient");
        setSystemProperties();
        HttpClient  httpClient;
        try {httpClient = getJettyClient();
        httpClient.start();
        log.info(">>> httpClient.start() httpClient called");
        ContentResponse res = httpClient.GET(uri);
        log.info("res.getStatus()  {}", res.getStatus());
        String result = res.getContentAsString();
        new Thread(() -> LifeCycle.stop(httpClient)).start();
        return result;
        } catch(Exception e){
            log.warn(">>> Exception " + e);
            return "Exception occurred";
        }
    }



    public void setSystemProperties() {
        log.info("Setting Kerberos Realm and KDC");
        System.setProperty("java.security.krb5.realm", realm);
        System.setProperty("java.security.krb5.kdc", kdc);
        System.setProperty("sun.security.krb5.debug", "true");
        Configuration.setConfiguration(setJaasConfigParams());
        log.info("Kerberos Realm and KDC are succesfull set to the perf qualification ");
    }

    private Configuration setJaasConfigParams() {
        log.info("calling setJaasConfigParams");
        return new Configuration() {

            public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
                HashMap<String, Object> options = new HashMap<>();
                options.put("useTicketCache", "false");
                AppConfigurationEntry appConfigurationEntry = new AppConfigurationEntry(
                        "com.sun.security.auth.module.Krb5LoginModule",
                        AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, options);
                return new AppConfigurationEntry[]{appConfigurationEntry};
            }
        };
    }


    private HttpClient getJettyClient() throws URISyntaxException {
        HttpClient httpClient = new HttpClient();
        configProxyJettyClient(httpClient);
        return  httpClient;
    }

    private void configProxyJettyClient(HttpClient httpClient) throws URISyntaxException {
        log.info("configProxyJettyClient start");
        URI spnegoURI =  URI.create("http://" + proxyHost + ":" +proxyPort);
        SPNEGOAuthentication spnegoAuth = new SPNEGOAuthentication(spnegoURI);
        spnegoAuth.setUserName(clientName + "@" + realm); // Or use Kerberos principal
        spnegoAuth.setUserPassword(proxyPassword); // Not required if using keytab
        spnegoAuth.setServiceName(serviceName);
        AuthenticationStore auth = httpClient.getAuthenticationStore();
        auth.addAuthentication(spnegoAuth);
        HttpProxy proxy = new HttpProxy(proxyHost, proxyPort);
        ProxyConfiguration proxyConfig = httpClient.getProxyConfiguration();
        proxyConfig.addProxy(proxy);
        log.info("configProxyJettyClient end");
    }

}

内容的提问来源于stack exchange，提问作者Kamal