使用Kerberos连接到Golang PQ时，如何指定Keytab文件？
我目前正在使用Golang PQ库来连接Postgres数据库。我正在成功使用Kerberos Principal连接，但是我无法弄清楚可以在哪里指定键盘文件。在源代码中，它使用一些第三方库神奇地发生。它实际上有效，但是我需要确定它如何知道我的键盘存储在哪里，以便请求初始票。
I am currently using golang pq library to connect to postgres database. I am successfully connecting using kerberos principal, but i can't figure out where can i specify keytab file to use to. In the source code it kinda happens magically, using some third-party library. It actually works, but i need to know for sure how does it know where my keytab is stored, so it can request initial ticket.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
通常，Kerberos客户不直接使用Keytab；他们希望已经获得并在环境中获得了初始票。也就是说，您期望您在运行程序之前
kinit，然后客户的GSSAPI库寻找krb5ccname环境变量，该变量指向包含票务缓存的文件由Kinit留下。（通常与MIT Kerberos或Heimdal一起使用，除了文件以外，还有许多其他事情...但是“ PQ”库使用非常 minimal pure-go kerberos 仅接受传统的基于文件的ccache。设置以使用“ dir”或“键盘”或“ kcm”缓存类型，这些类型将在这里工作。）
如果初始票证不在事实，如果
krb5_client_ktname环境变量指向一个，则自动使用keytab来获取机票。不幸的是，“ PQ”库不使用System Kerberos库，因此在这里也无法使用。 （但是，如果您的操作系统使用Heimdal Kerberos；这也不起作用；这是MIT特定的扩展。）因此，将始终始终工作的方法是将KRB5CCNAME设置为临时路径，然后使用两者
KINIT或k5start在运行程序之前，要从keytab获取机票。 （K5START工具还将在机票到期之前自动更新或重新获得票证，而无需使用Cron。如果他们可以在Windows上调用本地SSPI，那么他们肯定可以在Linux上致电本机GSSAPI ...
Usually Kerberos clients do not directly use a keytab; they expect the initial ticket to be already acquired and present in the environment. That is, you're expected to
kinitbefore running the program, and afterwards the client's GSSAPI library looks for theKRB5CCNAMEenvironment variable, which points at a file containing the ticket cache left by kinit.(Normally with MIT Kerberos or Heimdal it could be many other things besides a file... but the 'pq' library uses a very minimal pure-Go Kerberos implementation which only accepts a traditional file-based ccache. So be careful if Krb5 on your distro was set up to use 'DIR' or 'KEYRING' or 'KCM' cache types, those aren't going to work here.)
If the initial ticket isn't present, the MIT Krb5 implementation will in fact automatically use a keytab to acquire the ticket if the
KRB5_CLIENT_KTNAMEenvironment variable is pointing to one. Unfortunately, the 'pq' library doesn't use the system Kerberos library, so that won't work here either. (But it also wouldn't work if your OS was using Heimdal Kerberos; it's a MIT-specific extension.)So the approach that will always work is to set KRB5CCNAME to a temporary path, then use either
kinitork5startto acquire a ticket from the keytab, before running your program. (The k5start tool will also keep automatically renewing or re-acquiring the ticket before it expires, without needing to use cron.)Really, the whole
krb_unix.gofile is disappointing. If they can call the native SSPI on Windows, surely they could call the native GSSAPI on Linux...