I have an aws lambda function(nodejs) right now that writes some data to a test kafka cluster. The one thats in production use's kerberos for auth so I was wondering if there was a way to setup my lambda function to authenticate with kerberos. I wasn't able to find much online regarding this...
You can use Kerberos to authenticate users when they connect to your DB instance running PostgreSQL. To do so, you configure your DB instance to use AWS Directory Service for Microsoft Active Directory for Kerberos authentication.
Kerberos authentication Kerberos is a network authentication protocol that uses tickets and symmetric-key cryptography to eliminate the need to transmit passwords over the network. Kerberos has been built into Active Directory and is designed to authenticate users to network resources, such as databases.
A keytab is a file containing pairs of Kerberos principals and encrypted keys that are derived from the Kerberos password. You can use this file to log on to Kerberos without being prompted for a password.
There are two ways to handle this.
Call out to CLI utilities
This requires that you supply the contents of the krb5-workstation
and its dependency, libkadm5
, in your deployment package or via a Layer.
sudo yum update
sudo yum install krb5-workstation
mkdir bin lib
rpm -ql krb5-workstation | grep bin | xargs -I %% cp -a %% bin
rpm -ql libkadm5 | xargs -I %% cp -a %% lib
zip -r9 krb5-workstation-layer.zip bin lib
/opt/bin/kinit
from inside your function.Do it natively
It turns out that if your code calls gss_acquire_cred
, which most code does, usually through bindings and an abstraction layer, you don't need the CLI utilities.
KRB5_CLIENT_KTNAME
environment variable to the location of the keytab file.Requested addendum
In either case, if you find you have a need to specify additional Kerberos configuration, see the krb5.conf
docs for details. If /etc
is off the table, then "Multiple colon-separated filenames may be specified in [the] KRB5_CONFIG [environment variable]; all files which are present will be read."
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With