Geek Answers Handbook

When using --negotiate with curl, is the keytab file required?

The documentation that describes how to connect to a Kerberos secure endpoint shows the following:

curl -i --negotiate -u : "http://<HOST>:<PORT>/webhdfs/v1/<PATH>?op=..."

The -u flag should be provided, but curl is ignored.

Does the --negotiate option --negotiate curl to search for a key string that was created in advance using the kinit , or will it cause credentials to freeze?

If it searches for a keytab file, what file name will it look for in the command?

+7
curl hadoop kerberos webhdfs keytab
source share
2 answers

Be sent while curl contributor in this area. Here is what you need to know:

curl(1) itself knows nothing about Kerberos and will not interact with either your credential cache or your keytab file. He will delegate all calls to the GSS-API implementation that will make you magic. What magic depends on the library, Heimdal and MIT Kerberos.

Based on your question, I assume that you have little knowledge about Kerberos and you just want to automate API calls to REST endpoints protected by SPNEGO.

Here is what you need to do:

  • Unix-like OS
  • Install at least MIT Kerberos 1.11
  • Install at least curl 7.38.0 in MIT Kerberos
  • Confirm this with curl --version , which mentions the GSS-API and SPNEGO and ldd associated with your version of MIT Kerberos.
  • Create a keytab client key for a service principal using ktutil or mskutil
  • Try to get TGT using the keytab client kinit -k -t <path-to-keytab> <principal-from-keytab>
  • Confirm with klist that you have a cache cache

Now the environment is ready to go:

  1. Export KRB5CCNAME=<some-non-default-path>
  2. Export KRB5_CLIENT_KTNAME=<path-to-keytab>
  3. Call curl --negotiate -u : <URL>

MIT Kerberos will detect that both environment variables are set, check them, automatically get TGT with keytab, request a service ticket and go to curl . You are done.

Note : this will not work with Heimdal.

+16
source share

  • Check curl version

    $ curl -V - It must support the "GSS-Negotiate" function

  • Sign in with kinit

    $ kinit <user-id>

  • Use curl

    $ curl --negotiate -u : -b ~/cookiejar.txt -c ~/cookiejar.txt http://localhost:14000/webhdfs/v1/?op=liststatus

    "- reconcile" allows SPNEGO

    "- u" is required but ignored (the principle specified during kinit is used)

    "- b" and "-c" are used to store and send http cookies.

+3
source share

More articles:


All Articles