9

is anyone aware of any embeddable Kerberos servers (KDC / KAdmin), which are written in Java and may run just within the JVM process (something like Hadoop minicluster or embedded LDAP servers)?

My goal it to let people run integ tests requiring Kerberos authentication without having to install local kerberos server/configure remote server and connection to it.

4 Answers 4

6

You can give Apache Directory Server (http://directory.apache.org/) a try. It supports LDAP and Kerberos. See this example:

http://svn.apache.org/repos/asf/directory/apacheds/trunk/kerberos-test/src/test/java/org/apache/directory/server/kerberos/kdc/SaslGssapiBindITest.java

3
  • @Michael-O this test demonstrates the functioning of the KDC which is embeddable and implemented in pure java.
    – kayyagari
    Jan 21, 2013 at 4:17
  • Yep, thanks - just got time to get back to this task, looks like it's a way to go. I will be trying that and report here if it works as expected or not and it it's causing any unexpected pain. Thanks both of you!
    – Zorkus
    Jan 24, 2013 at 19:47
  • Is this example current and still a recommended approach?
    – user1310957
    Oct 8, 2016 at 7:28
0

I was/am looking for such a thing too but this is simply not really possible because you will need a fully functional DNS server for this. A fully decoupled system is necessary. You can achieve this via the virtualization-maven-plugin and a group of virtual machines in VirtualBox with an internal network.

LDAP servers won't help you at all because they do absolutely nothing with GSS-API and Kerberos. SASL does everything by delegating auth to the next available KDC.

You need KDC and DNS server. You may try Samba 4 on one machine, setup a second one which joins the domain. Install Hadoop on it, add a third one (client), join and run tests from there.

It seems like you can have Apache DS mimic a KDC: http://directory.apache.org/apacheds/configuration/ads-2.0-configuration.html

4
  • I don't think I need DNS, I can provide IPs and use them, but I do need KDC implemented as java app and running within the test process..did't find one yet.
    – Zorkus
    Jan 19, 2013 at 5:23
  • No, this won't work. Kerberos requires DNS does not work without it unless probably you put all hosts into your /etc/hots.
    – Michael-O
    Jan 19, 2013 at 9:29
  • Which is fine, i can put all needed hosts in there, or make it always use localhost for all communications.
    – Zorkus
    Jan 19, 2013 at 13:31
  • Thanks, will try to do that and report how it goes for me
    – Zorkus
    Jan 24, 2013 at 21:12
0

I have a written an Embedded LDAP for similar purpose and also to you can use it for testing with Kerberos, spcially useful for cases like testing Hadoop Kerberos testing.

https://github.com/krishdey/EmbeddedLdapKDC

You may also look at the class for writing embedded JUnit testing https://github.com/krishdey/EmbeddedLdapKDC/blob/master/EmbeddedLdapKDC/src/test/java/com/krish/ead/server/KerberosLdapIntegrationTest.java

Might be useful for you.

0

Hadoop publishes a MiniKdc class which can be used. From the MiniKdc class doc comment:

Mini KDC based on Apache Directory Server that can be embedded in testcases or used from command line as a standalone KDC.

https://mvnrepository.com/artifact/org.apache.hadoop/hadoop-minikdc

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.