使用Keytab文件进行Session安全认证

• 在Manager界面，选择“集群 > 服务 > IoTDB > 实例”，查看待连接的IoTDBServer所在的节点IP。
• RPC端口可通过登录FusionInsight Manager，选择“集群 > 服务 > IoTDB > 配置 > 全部配置”，搜索参数“IOTDB_SERVER_RPC_PORT”获得。
• 安全模式下，登录IoTDBServer所在节点的用户名和密码由FusionInsight Manager统一控制，参考准备MRS应用开发用户，确保该用户具有操作IoTDB服务的角色权限。
• 本端域可以在Manager界面，选择“系统 > 域与互信 > 本端域 ”中查看。

package com.huawei.bigdata.iotdb;

import org.apache.iotdb.rpc.IoTDBConnectionException;
import org.apache.iotdb.rpc.StatementExecutionException;
import org.apache.iotdb.rpc.TSStatusCode;
import org.apache.iotdb.session.Session;
import org.apache.iotdb.tsfile.file.metadata.enums.CompressionType;
import org.apache.iotdb.tsfile.file.metadata.enums.TSDataType;
import org.apache.iotdb.tsfile.file.metadata.enums.TSEncoding;
import org.ietf.jgss.GSSException;
import java.util.Base64;
import javax.security.auth.login.LoginException;

public class SessionbyKerberosExample{
    private static Session session;
    private static final String ROOT_SG1_D1_S1 = "root.sg1.d1.s1";
    private static final String ROOT_SG1_D1_S2 = "root.sg1.d1.s2";
    private static final String ROOT_SG1_D1_S3 = "root.sg1.d1.s3";
    private static final String HOST = "127.0.0.1";
    private static final String PORT = "22260";

/**
 * 安全模式下，“SSL_ENABLE”默认为“true”，需要导入truststore.jks文件。
 * 安全模式下，也可登录FusionInsight Manager，选择“集群 > 服务 > IoTDB > 配置”，在搜索框中搜索“SSL”，修改“SSL_ENABLE”参数值为“false”；保存配置后需重启IoTDB服务使配置生效。并修改客户端“客户端安装目录/IoTDB/iotdb/conf”目录下的“iotdb-client.env”文件中的配置：iotdb_ssl_enable="false"。
 */
    private static final String IOTDB_SSL_ENABLE = "true"; //该值为“SSL_ENABLE”参数值。

    private static final String JAVA_KRB5_CONF = "java.security.krb5.conf";
    /**
     * Location of krb5.conf file
     */
    private static final String KRB5_CONF_DEST = "下载的认证凭据中“krb5.conf”文件的位置";
    /**
     * Location of keytab file
     */
    private static final String KEY_TAB_DEST = "下载的认证凭据中“user.keytab”文件的位置";
    /**
     * User principal
     */

    private static final String CLIENT_PRINCIPAL = "用户的Principal（通常为“用户名@本端域”，例如：iotdb_admin@HADOOP.COM）";
   /** 
    * Server principal, 'iotdb_server_kerberos_principal' in iotdb-datanode.properties
    */
    private static final String SERVER_PRINCIPAL = "iotdb/hadoop.hadoop.com@HADOOP.COM";//该参数值可在任意安装了IoTDB服务的节点的“/opt/huawei/Bigdata/FusionInsight_IoTDB_*/*_*_IoTDBServer/etc/iotdb-datanode.properties”中搜索“iotdb_server_kerberos_principal”获取。

    /**
     * Get kerberos token as password
     * @return kerberos token
     * @throws LoginException loginException
     * @throws GSSException GSSException
     */
    public static String getAuthToken() throws LoginException, GSSException {
        IoTDBClientKerberosFactory kerberosHandler = IoTDBClientKerberosFactory.getInstance();
        System.setProperty(JAVA_KRB5_CONF, KRB5_CONF_DEST);
        kerberosHandler.loginSubjectFromKeytab(PRINCIPAL, KEY_TAB_DEST);
        byte[] tokens = kerberosHandler.generateServiceToken(PRINCIPAL);
        return Base64.getEncoder().encodeToString(tokens);
    }

    public static void main(String[] args)
	throws IoTDBConnectionException, StatementExecutionException, GSSException, LoginException {
	// set iotdb_ssl_enable
	System.setProperty("iotdb_ssl_enable", IOTDB_SSL_ENABLE);
	if ("true".equals(IOTDB_SSL_ENABLE)) {
		// set truststore.jks path
		System.setProperty("iotdb_ssl_truststore", "truststore文件路径");
	}

	session = new Session(HOST, PORT,"认证用户名称", getAuthToken());
	session.open(false);

	// set session fetchSize
	session.setFetchSize(10000);

	try {
		session.setStorageGroup("root.sg1");
	} catch (StatementExecutionException e) {
		if (e.getStatusCode() != TSStatusCode.PATH_ALREADY_EXIST_ERROR.getStatusCode()) {
			throw e;
		}
	}
	createTimeseries();
    }

    private static void createTimeseries() throws IoTDBConnectionException, StatementExecutionException {
	if (!session.checkTimeseriesExists(ROOT_SG1_D1_S1)) {
		session.createTimeseries(
			ROOT_SG1_D1_S1, TSDataType.INT64, TSEncoding.RLE, CompressionType.SNAPPY);
	}
	if (!session.checkTimeseriesExists(ROOT_SG1_D1_S2)) {
		session.createTimeseries(
			ROOT_SG1_D1_S2, TSDataType.INT64, TSEncoding.RLE, CompressionType.SNAPPY);
	}
	if (!session.checkTimeseriesExists(ROOT_SG1_D1_S3)) {
		session.createTimeseries(
			ROOT_SG1_D1_S3, TSDataType.INT64, TSEncoding.RLE, CompressionType.SNAPPY);
	}
    }
}