如何在Scala中实现带Kerberos认证的HTTP请求？

你的curl命令通过--negotiate参数能正常完成Kerberos认证，但原生HttpURLConnection的代码因为没有正确处理SPNEGO（Kerberos的HTTP认证协议）流程导致403错误。以下是具体解决方法：

问题分析 #

你直接设置Authorization: Negotiate头和X-JavaNet-Auth-*属性的方式是错误的——Kerberos认证需要通过Java的JAAS（Java Authentication and Authorization Service）框架完成，而非手动构造请求头。curl的--negotiate会自动处理SPNEGO的握手流程，而原生HttpURLConnection需要配置JAAS和系统属性才能触发这个流程。

解决方案一：原生Java/Scala配置JAAS实现认证 #

1. 配置Kerberos和JAAS文件 #

• krb5.conf（指定KDC和域信息，路径自定义）：

[libdefaults]
    default_realm = YOUR_REALM.COM
    dns_lookup_kdc = false
    dns_lookup_realm = false
    ticket_lifetime = 86400
    renew_lifetime = 604800
    forwardable = true
    default_tkt_enctypes = aes256-cts-hmac-sha1-96
    default_tgs_enctypes = aes256-cts-hmac-sha1-96
    permitted_enctypes = aes256-cts-hmac-sha1-96
[realms]
    YOUR_REALM.COM = {
        kdc = kdc.your-realm.com  # 替换为你的KDC地址
        admin_server = kdc.your-realm.com
    }

• jaas.conf（配置登录模块，路径自定义）：

Krb5Login {
    com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=false
    useTicketCache=false
    principal="id@YOUR_REALM.COM"  # 替换为带域的用户名
    password="your-password";
};

2. 修改Scala代码 #

在代码中设置系统属性指向配置文件，并通过Authenticator自动处理认证：

import java.net.{HttpURLConnection, URL, Authenticator, PasswordAuthentication}

// 设置Kerberos和JAAS配置路径
System.setProperty("java.security.krb5.conf", "/path/to/krb5.conf")
System.setProperty("java.security.auth.login.config", "/path/to/jaas.conf")
System.setProperty("javax.security.auth.useSubjectCredsOnly", "false")

val urlString = "http://website:port"
val url = new URL(urlString)
val username = "id@YOUR_REALM.COM"
val password = "password"

// 全局认证器，提供Kerberos凭证
Authenticator.setDefault(new Authenticator() {
  override def getPasswordAuthentication(): PasswordAuthentication = {
    new PasswordAuthentication(username, password.toCharArray)
  }
})

val connection = url.openConnection().asInstanceOf[HttpURLConnection]
connection.setRequestProperty("Content-Type", "application/json;charset=UTF-8")
connection.setConnectTimeout(5000)
connection.setReadTimeout(5000)

// 执行请求并处理响应
val responseCode = connection.getResponseCode()
val inputStream = if (responseCode < 400) connection.getInputStream() else connection.getErrorStream()
val response = scala.io.Source.fromInputStream(inputStream).mkString

connection.disconnect()

解决方案二：使用第三方库简化认证（推荐） #

原生配置繁琐，推荐使用Apache HttpClient 5，它封装了Kerberos/SPNEGO的认证逻辑：

1. 添加SBT依赖 #

libraryDependencies += "org.apache.httpcomponents.client5" % "httpclient5" % "5.2.1"
libraryDependencies += "org.apache.httpcomponents.client5" % "httpclient5-kerberos" % "5.2.1"

2. 编写认证代码 #

import org.apache.hc.client5.http.classic.methods.HttpGet
import org.apache.hc.client5.http.impl.classic.{CloseableHttpClient, HttpClients}
import org.apache.hc.client5.http.impl.auth.SPNegoSchemeFactory
import org.apache.hc.client5.http.auth.{AuthScope, Credentials, UsernamePasswordCredentials}
import org.apache.hc.core5.http.io.entity.EntityUtils

val url = "http://website:port"
val username = "id@YOUR_REALM.COM"
val password = "password"

// 配置SPNEGO认证工厂
val spnegoFactory = new SPNegoSchemeFactory(true)

// 创建带Kerberos认证的HttpClient
val httpClient: CloseableHttpClient = HttpClients.custom()
  .setDefaultCredentialsProvider(provider => {
    val creds: Credentials = new UsernamePasswordCredentials(username, password.toCharArray)
    provider.setCredentials(new AuthScope(null, -1, null), creds)
  })
  .setDefaultAuthSchemeRegistry(registry => {
    registry.register("Negotiate", spnegoFactory)
  })
  .build()

try {
  val httpGet = new HttpGet(url)
  httpGet.setHeader("Content-Type", "application/json;charset=UTF-8")
  
  val response = httpClient.execute(httpGet)
  try {
    val entity = response.getEntity
    val responseBody = EntityUtils.toString(entity)
    println(responseBody)
    EntityUtils.consume(entity)
  } finally {
    response.close()
  }
} finally {
  httpClient.close()
}

注意事项 #

• 替换配置文件中的YOUR_REALM.COM、kdc.your-realm.com为实际的Kerberos域和KDC地址；
• 如果你的环境使用Keytab而非明文密码，可修改JAAS配置中的useKeyTab=true并指定keyTab="/path/to/your.keytab"。

内容的提问来源于stack exchange，提问作者849856487764