1. 參考
   • https://knox.apache.org/books/knox-1-0-0/user-guide.html#KnoxSSO+Setup+and+Configuration
   • https://knox.apache.org/books/knox-1-0-0/user-guide.html#KnoxSSO+Setup+and+Configuration
   • https://svn.apache.org/repos/asf/knox/site/books/knox-1-1-0/knoxsso_integration.html
2. 配置 knoxsso-topology啟用Knox SSO

<?xml version="1.0" encoding="UTF-8"?>
<topology>
   <uri>https://bigdata-master:8443/gateway/knoxsso</uri>
   <name>knoxsso</name>
   <timestamp>1553153609000</timestamp>
   <generated>true</generated>
   <gateway>
      <provider>
         <role>webappsec</role>
         <name>WebAppSec</name>
         <enabled>true</enabled>
         <param>
            <name>xframe.options.enabled</name>
            <value>true</value>
         </param>
      </provider>
      <provider>
         <role>authentication</role>
         <name>ShiroProvider</name>
         <enabled>true</enabled>
         <param>
            <name>sessionTimeout</name>
            <value>30</value>
         </param>
         <param>
            <name>redirectToUrl</name>
            <value>/gateway/knoxsso/knoxauth/login.html</value>
         </param>
         <param>
            <name>restrictedCookies</name>
            <value>rememberme,WWW-Authenticate</value>
         </param>
         <param>
            <name>main.ldapRealm</name>
            <value>org.apache.hadoop.gateway.shirorealm.KnoxLdapRealm</value>
         </param>
         <param>
            <name>main.ldapContextFactory</name>
            <value>org.apache.hadoop.gateway.shirorealm.KnoxLdapContextFactory</value>
         </param>
         <param>
            <name>main.ldapRealm.contextFactory</name>
            <value>$ldapContextFactory</value>
         </param>
         <param>
            <name>main.ldapRealm.userDnTemplate</name>
            <value>uid={0},ou=people,dc=example,dc=com</value>
         </param>
         <param>
            <name>main.ldapRealm.contextFactory.url</name>
            <value>ldap://bigdata-common:389</value>
         </param>
         <param>
            <name>main.ldapRealm.authenticationCachingEnabled</name>
            <value>false</value>
         </param>
         <param>
            <name>main.ldapRealm.contextFactory.authenticationMechanism</name>
            <value>simple</value>
         </param>
         <param>
            <name>urls./**</name>
            <value>authcBasic</value>
         </param>
      </provider>
      <provider>
         <role>identity-assertion</role>
         <name>Default</name>
         <enabled>true</enabled>
      </provider>
   </gateway>
   <service>
      <role>KNOXSSO</role>
      <param>
         <name>knoxsso.cookie.secure.only</name>
         <value>false</value>
      </param>
      <param>
         <name>knoxsso.token.ttl</name>
         <value>300000</value>
      </param>
   </service>
   <application>
      <name>knoxauth</name>
   </application>
</topology>

2. 在自定義topology配置SSOCookieProvider使用Knox SSO認證

<?xml version="1.0" encoding="UTF-8"?>
<topology>
   <uri>https://bigdata-master:8443/gateway/hdp_ui</uri>
   <name>hdp_ui</name>
   <timestamp>1553222547000</timestamp>
   <generated>true</generated>
   <gateway>
      <provider>
         <role>identity-assertion</role>
         <name>Default</name>
         <enabled>true</enabled>
      </provider>
      <provider>
         <role>federation</role>
         <name>SSOCookieProvider</name>
         <enabled>true</enabled>
         <param>
            <name>sso.authentication.provider.url</name>
            <value>https://bigdata-master:8443/gateway/knoxsso/api/v1/websso</value>
         </param>
      </provider>
   </gateway>
   <service>
      <role>OOZIE</role>
      <url>http://bigdata-master:11000/oozie</url>
   </service>
   <service>
      <role>WEBHDFS</role>
      <url>http://bigdata-master:50070/webhdfs</url>
   </service>
</topology>

3. Knox SSO對于http請求的處理流程
   以在瀏覽器中請求https://bigdata-master:8443/gateway/hdp_ui/webhdfs/v1/tmp?op=LISTSTATUS為例
   • SSOCookieProvider負責(zé)從http請求的cookie中讀取hadoop-jwt，如果cookie中不存在hadoop-jwt，會重定向http請求至sso.authentication.provider.url（即https://bigdata-master:8443/gateway/knoxsso/api/v1/websso，將匹配到knoxsso-topology中的KNOXSSO服務(wù)）
   • 執(zhí)行knoxsso-topology的shiro認證，如果http請求中沒有提供有效的認證信息（例如Basic Auth的username/password），會將瀏覽器也重定向頁面至redirectToUrl（即gateway/knoxsso/knoxauth/login.html）
   • 輸入username和password將使用shiro配置的ldap服務(wù)進行認證，如果認證通過將在cookie中生成hadoop-jwt
   • 將http請求重定向至最初請求的地址，此時cookie中已經(jīng)存在hadoop-jwt，此后所有的操作不在需要認證