| 495 | } |
| 496 | |
| 497 | Status InitKerberosForServer(const std::string& raw_principal, const std::string& keytab_file, |
| 498 | const std::string& krb5ccname, bool disable_krb5_replay_cache) { |
| 499 | if (keytab_file.empty()) return Status::OK(); |
| 500 | |
| 501 | setenv("KRB5CCNAME", krb5ccname.c_str(), 1); |
| 502 | setenv("KRB5_KTNAME", keytab_file.c_str(), 1); |
| 503 | |
| 504 | if (disable_krb5_replay_cache) { |
| 505 | // KUDU-1897: disable the Kerberos replay cache. The KRPC protocol includes a |
| 506 | // per-connection server-generated nonce to protect against replay attacks |
| 507 | // when authenticating via Kerberos. The replay cache has many performance and |
| 508 | // implementation issues. |
| 509 | setenv("KRB5RCACHETYPE", "none", 1); |
| 510 | } |
| 511 | |
| 512 | g_kinit_ctx = new KinitContext(); |
| 513 | string configured_principal; |
| 514 | RETURN_NOT_OK(GetConfiguredPrincipal(raw_principal, &configured_principal)); |
| 515 | RETURN_NOT_OK_PREPEND(g_kinit_ctx->Kinit( |
| 516 | keytab_file, configured_principal), "unable to kinit"); |
| 517 | |
| 518 | return Status::OK(); |
| 519 | } |
| 520 | |
| 521 | void DestroyKerberosForServer() { |
| 522 | if (g_kinit_ctx == nullptr) return; |