Skip to content

Commit 7d4e0d8

Browse files
cyjseagullcyjseagull
committed
support specify the krb5.conf
1 parent a03f64b commit 7d4e0d8

File tree

15 files changed

+159
-23
lines changed

15 files changed

+159
-23
lines changed

‎cpp/ppc-framework/protocol/Krb5AuthConfig.h‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ struct Krb5AuthConfig
3131
std::string principal;
3232
std::string password;
3333
std::string ccachePath;
34+
std::string authConfigFilePath = "./conf/krb5.conf";
3435
void check() const
3536
{
3637
if (principal.size() == 0)
@@ -48,12 +49,19 @@ struct Krb5AuthConfig
4849
BOOST_THROW_EXCEPTION(WeDPRException() << bcos::errinfo_comment(
4950
"Invalid krb5 auth config: Must set the ccachePath!"));
5051
}
52+
if (authConfigFilePath.size() == 0)
53+
{
54+
BOOST_THROW_EXCEPTION(
55+
WeDPRException() << bcos::errinfo_comment(
56+
"Invalid krb5 auth config: Must set the authConfigFilePath!"));
57+
}
5158
}
5259

5360
inline std::string desc() const
5461
{
5562
std::stringstream oss;
56-
oss << LOG_KV("principal", principal) << LOG_KV("ccachePath", ccachePath);
63+
oss << LOG_KV("principal", principal) << LOG_KV("ccachePath", ccachePath)
64+
<< LOG_KV("authConfigFilePath", authConfigFilePath);
5765
return oss.str();
5866
}
5967
};

‎cpp/tools/build_ppc.sh‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -476,7 +476,7 @@ generate_node_config_ini() {
476476
477477
[hdfs_storage]
478478
; the hdfs configuration
479-
user = app
479+
user = root
480480
name_node = 127.0.0.1
481481
name_node_port = 9000
482482
token =
@@ -487,11 +487,13 @@ generate_node_config_ini() {
487487
; enable auth or not, default is false
488488
; enable_krb5_auth = false
489489
; the hdfs kerberos auth principal, used when enable_krb5_auth
490-
; auth_principal =
490+
; auth_principal = [email protected]
491491
; the hdfs kerberos auth password, used when enable_krb5_auth
492492
; auth_password =
493493
; the ccache path, used when enable_krb5_auth
494494
; ccache_path = /tmp/krb5cc_ppc_node
495+
; the krb5.conf path
496+
; krb5_conf_path = conf/krb5.conf
495497
496498
497499
[ra2018psi]
@@ -549,6 +551,31 @@ generate_node_config_ini() {
549551
EOF
550552
}
551553

554+
generate_krb5_file_template()
555+
{
556+
local filepath=$1
557+
mkdir -p $(dirname $filepath)
558+
cat << EOF > "${filepath}"
559+
[libdefaults]
560+
default_realm = NODE.DC1.CONSUL
561+
dns_lookup_realm = false
562+
dns_lookup_kdc = false
563+
ticket_lifetime = 24h
564+
renew_lifetime = 7d
565+
forwardable = true
566+
567+
[realms]
568+
NODE.DC1.CONSUL = {
569+
kdc =
570+
admin_server =
571+
}
572+
573+
[domain_realm]
574+
.node.dc1.consul = NODE.DC1.CONSUL
575+
node.dc1.consul = NODE.DC1.CONSUL
576+
EOF
577+
}
578+
552579
generate_script_template()
553580
{
554581
local filepath=$1
@@ -923,6 +950,7 @@ deploy_nodes()
923950
private_key=$(generate_private_key "${node_dir}/conf")
924951
node_id=$(cat "${node_dir}/conf/node.nodeid")
925952
generate_node_config_ini "${node_dir}/config.ini" "${listen_ip}" "${gateway_port}" "${listen_ip}" "${rpc_port}" "${listen_ip}" "${grpc_port}" ${agency_id} "${count}" "${node_id}"
953+
generate_krb5_file_template "${node_dir}/conf/krb5.conf"
926954
generate_p2p_connected_conf "${node_dir}/${p2p_connected_conf_name}" "${connected_nodes}" "false"
927955
set_value ${ip//./}_count $(($(get_value ${ip//./}_count) + 1))
928956
((++count))

‎cpp/tools/build_wedpr_cem.sh‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -354,7 +354,7 @@ generate_config_ini() {
354354
355355
[hdfs_storage]
356356
; the hdfs configuration
357-
user = ppc
357+
user = root
358358
name_node = 127.0.0.1
359359
name_node_port = 9900
360360
token =
@@ -365,11 +365,13 @@ generate_config_ini() {
365365
; enable auth or not, default is false
366366
; enable_krb5_auth = false
367367
; the hdfs kerberos auth principal, used when enable_krb5_auth
368-
; auth_principal =
368+
; auth_principal = [email protected]
369369
; the hdfs kerberos auth password, used when enable_krb5_auth
370370
; auth_password =
371371
; the ccache path, used when enable_krb5_auth
372372
; ccache_path = /tmp/krb5cc_ppc_node
373+
; the krb5.conf path
374+
; krb5_conf_path = conf/krb5.conf
373375
374376
[cert]
375377
; directory the certificates located in

‎cpp/tools/build_wedpr_mpc.sh‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -358,7 +358,7 @@ generate_config_ini() {
358358
359359
[hdfs_storage]
360360
; the hdfs configuration
361-
user = ppc
361+
user = root
362362
name_node = 127.0.0.1
363363
name_node_port = 9900
364364
token =
@@ -369,11 +369,13 @@ generate_config_ini() {
369369
; enable auth or not, default is false
370370
; enable_krb5_auth = false
371371
; the hdfs kerberos auth principal, used when enable_krb5_auth
372-
; auth_principal =
372+
; auth_principal = [email protected]
373373
; the hdfs kerberos auth password, used when enable_krb5_auth
374374
; auth_password =
375375
; the ccache path, used when enable_krb5_auth
376376
; ccache_path = /tmp/krb5cc_ppc_node
377+
; the krb5.conf path
378+
; krb5_conf_path = conf/krb5.conf
377379
378380
[transport]
379381
; the endpoint information
@@ -404,6 +406,31 @@ generate_config_ini() {
404406
EOF
405407
}
406408

409+
generate_krb5_file_template()
410+
{
411+
local filepath=$1
412+
mkdir -p $(dirname $filepath)
413+
cat << EOF > "${filepath}"
414+
[libdefaults]
415+
default_realm = NODE.DC1.CONSUL
416+
dns_lookup_realm = false
417+
dns_lookup_kdc = false
418+
ticket_lifetime = 24h
419+
renew_lifetime = 7d
420+
forwardable = true
421+
422+
[realms]
423+
NODE.DC1.CONSUL = {
424+
kdc =
425+
admin_server =
426+
}
427+
428+
[domain_realm]
429+
.node.dc1.consul = NODE.DC1.CONSUL
430+
node.dc1.consul = NODE.DC1.CONSUL
431+
EOF
432+
}
433+
407434
generate_script_template()
408435
{
409436
local filepath=$1
@@ -731,6 +758,7 @@ deploy_nodes()
731758
private_key=$(generate_private_key "${output_dir}/conf")
732759
node_id=$(cat "${output_dir}/conf/node.nodeid")
733760
generate_config_ini "${output_dir}/config.ini" "${listen_ip}" "${rpc_port}" "${agency_info}" ${agency_id} "${listen_ip}" "${grpc_port}" "${node_id}"
761+
generate_krb5_file_template "{output_dir}/conf/krb5.conf"
734762
print_result
735763
}
736764

‎cpp/tools/ppc-builder/conf/config-example.toml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -90,19 +90,20 @@ holding_msg_minutes = 30
9090
database = ""
9191
# the hdfs storage config
9292
[agency.node.hdfs_storage]
93-
user = ""
93+
user = "root"
9494
name_node = "127.0.0.1"
9595
name_node_port = 9000
9696
token = ""
9797
# enable auth or not, default is false
9898
enable_krb5_auth = false
9999
# the hdfs kerberos auth principal, used when enable_krb5_auth
100-
auth_principal = ""
100+
auth_principal = "[email protected]"
101101
# the hdfs kerberos auth password, used when enable_krb5_auth
102102
auth_password = ""
103103
# the ccache path, used when enable_krb5_auth
104104
ccache_path = "/tmp/krb5cc_ppc_node"
105-
105+
# the krb5 conf path
106+
krb5_conf_path = "conf/krb5.conf"
106107
# the gateway config
107108
[agency.node.gateway]
108109
gateway_grpc_target = ["127.0.0.1:40600", "127.0.0.1:40601"]
@@ -184,18 +185,21 @@ holding_msg_minutes = 30
184185
database = ""
185186
# the hdfs storage config
186187
[agency.node.hdfs_storage]
187-
user = ""
188+
user = "root"
188189
name_node = "127.0.0.1"
189190
name_node_port = 9000
190191
token = ""
191192
# enable auth or not, default is false
192193
enable_krb5_auth = false
193194
# the hdfs kerberos auth principal, used when enable_krb5_auth
194-
auth_principal = ""
195+
auth_principal = "[email protected]"
195196
# the hdfs kerberos auth password, used when enable_krb5_auth
196197
auth_password = ""
197198
# the ccache path, used when enable_krb5_auth
198199
ccache_path = "/tmp/krb5cc_ppc_node"
200+
# the krb5 conf path
201+
krb5_conf_path = "conf/krb5.conf"
202+
199203
# the gateway config
200204
[agency.node.gateway]
201205
gateway_grpc_target = ["127.0.0.1:40620", "127.0.0.1:40621"]

‎cpp/tools/ppc-builder/src/common/utilities.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,8 @@ class ConfigInfo:
2929
pwd_path, tpl_abs_path, "config.ini.node")
3030
gateway_config_tpl_path = os.path.join(
3131
pwd_path, tpl_abs_path, "config.ini.gateway")
32+
krb5_config_tpl_path = os.path.join(
33+
pwd_path, tpl_abs_path, "krb5.conf")
3234

3335
ppc_gateway_binary_name = "ppc-gateway-service"
3436
ppc_node_binary_name = "ppc-pro-node"

‎cpp/tools/ppc-builder/src/config/ppc_deploy_config.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,10 @@ def __init__(self, config, config_section, must_exist):
134134
self.ccache_path = utilities.get_item_value(
135135
self.config, "ccache_path",
136136
"", enable_krb5_auth, config_section)
137+
# the krb5.conf
138+
self.krb5_conf_path = utilities.get_item_value(
139+
self.config, "krb5_conf_path",
140+
"conf/krb5.conf", enable_krb5_auth, config_section)
137141

138142

139143
class RA2018PSIConfig:

‎cpp/tools/ppc-builder/src/config/ppc_node_config_generator.py‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -109,8 +109,8 @@ def __generate_single_node_inner_config__(self, tpl_config_path, node_path, priv
109109
self.__generate_storage_config__(
110110
config_content, node_config.storage_config)
111111
# load the hdfs_storage_config
112-
self.__generate_hdfs_storage_config__(
113-
config_content, node_config.hdfs_storage_config)
112+
self.__generate_hdfs_storage_config__(node_path, utilities.ConfigInfo.krb5_config_tpl_path,
113+
config_content, node_config.hdfs_storage_config)
114114
# load the ra2018psi config
115115
self.__generate_ra2018psi_config__(
116116
config_content, node_config.ra2018psi_config)
@@ -182,7 +182,7 @@ def __generate_storage_config__(self, config_content, storage_config):
182182
config_content[section_name]["password"] = storage_config.password
183183
config_content[section_name]["database"] = storage_config.database
184184

185-
def __generate_hdfs_storage_config__(self, config_content, hdfs_storage_config):
185+
def __generate_hdfs_storage_config__(self, node_path, krb5_tpl_file_path, config_content, hdfs_storage_config):
186186
if hdfs_storage_config is None:
187187
return
188188
section_name = "hdfs_storage"
@@ -195,6 +195,18 @@ def __generate_hdfs_storage_config__(self, config_content, hdfs_storage_config):
195195
config_content[section_name]["auth_principal"] = hdfs_storage_config.auth_principal
196196
config_content[section_name]["auth_password"] = hdfs_storage_config.auth_password
197197
config_content[section_name]["ccache_path"] = hdfs_storage_config.ccache_path
198+
config_content[section_name]["krb5_conf_path"] = hdfs_storage_config.krb5_conf_path
199+
# copy krb5.conf to krb5_conf_path specified path
200+
dst_path = os.path.join(node_path, hdfs_storage_config.krb5_conf_path)
201+
if hdfs_storage_config.krb5_conf_path.startswith("/"):
202+
dst_path = hdfs_storage_config.krb5_conf_path
203+
command = "cp %s %s" % (krb5_tpl_file_path, dst_path)
204+
(ret, output) = utilities.execute_command_and_getoutput(command)
205+
if ret is False:
206+
utilities.log_error("copy krb5 configuration from %s to %s failed, error: %s") % (
207+
krb5_tpl_file_path, dst_path, output)
208+
return False
209+
return True
198210

199211
def __generate_transport_config__(self, config_content,
200212
node_config, node_id,

‎cpp/tools/ppc-builder/src/tpl/config.ini.node‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353

5454
[hdfs_storage]
5555
; the hdfs configuration
56-
user = app
56+
user = root
5757
name_node = 127.0.0.1
5858
name_node_port = 9000
5959
token =
@@ -64,11 +64,13 @@
6464
; enable auth or not, default is false
6565
; enable_krb5_auth = false
6666
; the hdfs kerberos auth principal, used when enable_krb5_auth
67-
; auth_principal =
67+
; auth_principal = [email protected]
6868
; the hdfs kerberos auth password, used when enable_krb5_auth
6969
; auth_password =
7070
; the ccache path, used when enable_krb5_auth
7171
; ccache_path = /tmp/krb5cc_ppc_node
72+
; the krb5.conf path
73+
; krb5_conf_path = conf/krb5.conf
7274

7375
[ra2018psi]
7476
; The database used to store cuckoo-filter

‎cpp/tools/ppc-builder/src/tpl/krb5.conf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
[libdefaults]
2+
default_realm = NODE.DC1.CONSUL
3+
dns_lookup_realm = false
4+
dns_lookup_kdc = false
5+
ticket_lifetime = 24h
6+
renew_lifetime = 7d
7+
forwardable = true
8+
9+
[realms]
10+
NODE.DC1.CONSUL = {
11+
kdc =
12+
admin_server =
13+
}
14+
15+
[domain_realm]
16+
.node.dc1.consul = NODE.DC1.CONSUL
17+
node.dc1.consul = NODE.DC1.CONSUL

0 commit comments

Comments
 (0)