HTTPClient login from keytab to access hadoop jobhistory service - security

Question

I'm writing a java program to access hadoop jobhistory service to retrieve some information.
I'm using HTTPClient to make the HttpGet call. I need to login from a keytab file (I have the file on my ~/.ssh/ folder) instead of type in user name and password.
My question is: How to login from keytab in HTTPClient?
Here is how I set up my HTTPClient
System.setProperty("java.security.krb5.conf", "krb5.conf");
System.setProperty("sun.security.krb5.debug", "true");
System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
System.setProperty("java.security.krb5.realm", prop.getProperty("krb5.realm"));
System.setProperty("java.security.krb5.kdc", prop.getProperty("krb5.kdc"));
PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager();
cm.setMaxTotal(200);
cm.setDefaultMaxPerRoute(100);
//TODO login from keytab ?
CredentialsProvider credsProvider = new BasicCredentialsProvider();
credsProvider.setCredentials(AuthScope.ANY, new UsernamePasswordCredentials("DUMMY", null));
Lookup<AuthSchemeProvider> authRegistry = RegistryBuilder.<AuthSchemeProvider>create()
.register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory())
.build();
httpClient = HttpClients.custom().setDefaultCredentialsProvider(credsProvider)
.setDefaultAuthSchemeRegistry(authRegistry)
.setConnectionManager(cm)
.build();
HttpResponse response = httpClient.execute(request);
One interesting is this code can run successfully in my IntelliJ. But After I build and run it from command line, it will show up the info to ask me for username and password.
I'm new to authentication, hope somebody can help. Thanks a lot.

Answer 1

HttpClientBuilder builder = HttpClientBuilder.create();
Lookup<AuthSchemeProvider> authSchemeRegistry = RegistryBuilder.<AuthSchemeProvider>create()
.register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory(true)).build();
builder.setDefaultAuthSchemeRegistry(authSchemeRegistry);
BasicCredentialsProvider credentialsProvider = new BasicCredentialsProvider();
credentialsProvider.setCredentials(new AuthScope(null, -1, null), new Credentials() {
#Override
public Principal getUserPrincipal() {
return null;
}
#Override
public String getPassword() {
return null;
}
});
builder.setDefaultCredentialsProvider(credentialsProvider);
final HttpClient httpClient = builder.build();
final Subject subj = new Subject();
Krb5LoginModule krb5 = new Krb5LoginModule();
Map<String, String> options = new HashMap<>();
options.put("doNotPrompt", "true");
options.put("storeKey", "true");
options.put("useKeyTab", "true");
options.put("useTicketCache", "true");
options.put("keyTab", keytabFilePath); //Path to keytab file
options.put("principal", principal); //Principal name
options.put("debug", "true");
krb5.initialize(subj, null, null, options);
krb5.login();
krb5.commit();
HttpResponse response = Subject.doAs(subj, new PrivilegedExceptionAction<HttpResponse>() {
#Override
public HttpResponse run() throws Exception {
return httpClient.execute(request);
}
});