Kerberos authentication #104
Comments
|
HI @evial , How you initialize nfs4j? The kerberos support must be explicitly enabled: RpcLoginService loginService = (t, c) -> {
// call ldap or so
Subject s = new Subject();
return s;
};
GssSessionManager gss = GssSessionManager(loginService, "nfs/host.example.com@EXAMPLE.COM", "/etc/krb5.keytab");
OncRpcSvc svc = OncRpcSvcBuilder()
.withPort(port)
.withTCP()
.withAutoPublish()
.withWorkerThreadIoStrategy()
.withGssSessionManager(gss)
.build() |
|
Many thanks for the tip. Indeed, the GSS initialization was missing. Here is my code after fixing: I still have the same error on the client (access denied by server while mounting localhost:) but the below warning is now issued on the server:
Googling around, the message seems to be connected with the Java Cryptography Extension (JCE) not installed by default on JDK 8 and earlier but I work with JDK 11. Sorry, seems I need your help again :) Thanks |
|
Which jdk version are you using? For jdk earlier 8u161 you need to install additional package https://www.oracle.com/java/technologies/javase-jce-all-downloads.html. However, I will suggest to use latest openjdk-11. |
|
I'm using OpenJDK 11. the Java Cryptography Extension is installed by default. Anyway, I checked it with the code from https://stackoverflow.com/questions/62841553/how-can-i-configure-java-cryptography-extension-jce-in-openjdk-11 and the extension is well configured. The problem doesn't seem to be related with the JCE. |
|
What the keys that you have? |
|
Here they are: |
|
Hi @kofemann, Sorry, it's still not working for me. Any idea? Is there any extra configuration to get NFS4J working with Kerberos I could have missed ? Thanks |
|
Try to enabe krb5 debug by properly |
|
You cannot use Although there is another gotcha. When Kerberos clients (like JGSS) create an SPN, it will first lookup the IP of the hostname, then do a reverse Aside: Kerberos has numerous dependencies that have sadly limited it's utility. IMO, the only truly correct configuration is to use |
Hi,
I'm trying to get NFS4J working with Kerberos on Ubuntu 20.04. OS native NFS server with Kerberos works fine as well as NFS4J without authentication. But with both NFS4J and Kerberos, I invariably have an access denied on the client side.
This is my export file content:
/ *(sec=krb5,rw,no_root_squash)
I also followed instructions from this link:
https://dcache.org/old/manuals/Book-2.3/config/cf-nfs4-gss-fhs-comments.shtml
And this is the debug output from the server:
Must be something stupid but I'm stuck on it. What could I have missed ?
Thanks
The text was updated successfully, but these errors were encountered: