0

Can any one help me in jdbc connection code for kerberos authentication ? I wrote the below code and I am not sure if miss anything important.

String filePath = System.getProperty("user.dir")+File.separator+"KerberosConfDir";
System.out.println(filePath);
String connectionUrl = "jdbc:sqlserver://mymachine;databaseName=master;integratedSecurity=true;authenticationScheme=JavaKerberos";
Properties connProperties = new Properties();
        //connProperties.put("serverSpn","MSSQLSvc/mymachine.mydomain.com:1433");
        System.out.println("connectionUrl : "+connectionUrl);

        Connection con = null;
        System.setProperty("sun.security.krb5.debug", "true");
        System.setProperty("java.security.auth.login.config", filePath+File.separator+"SQLJDBCDriver.config");
        System.setProperty("java.security.krb5.conf", filePath+File.separator+"krb5.ini");

        try {
          Class.forName("com.microsoft.sqlserver.jdbc.SQLServerDriver");
          System.out.println("Loading the Driver....");
          con = DriverManager.getConnection(connectionUrl);
          System.out.println("Establishing the connection....");
          DatabaseMetaData dbmd = con.getMetaData();

          System.out.println("dbmd:driver version = " + dbmd.getDriverVersion());
          System.out.println("dbmd:driver name = " + dbmd.getDriverName());
          System.out.println("db name = " + dbmd.getDatabaseProductName());
          System.out.println("db ver = " + dbmd.getDatabaseProductVersion());
        }
        catch (Exception e) {
          e.printStackTrace();
        }
Anna
  • 71
  • 1
  • 10
  • Nit: a Type 4 JDBC driver should not need explicit "loading", it should auto-register when the JVM builds its actyal CLASSPATH. – Samson Scharfrichter Mar 20 '19 at 08:18
  • The exact JAAS "auth login config" is what matters -- do you expect SSO based on Windows credentials (in the MS-specific LSA cache) ? SSO based on a Kerb ticket created by `kinit` (on Windows, the one shipping with Java, not the MS one) ? Automatic ticket creation based on a _keytab_ file containing the hashed pwd ? A prompt for the pwd (would require an override of default Java security settings) ? – Samson Scharfrichter Mar 20 '19 at 08:23
  • Hi Samson, Thanks for the information. I am new to kerberos. Can you please give me some detailed info on your points... – Anna Mar 20 '19 at 10:55
  • Please be more specific in your question -- which Kerberos implementation (Active Directory, MIT Kerberos, FreeIPA, etc), which OS the client will be running on (Win and/or Linux), whether the user and the database are attached to the same Kerberos realm (or AD domain), how you expect the user to enter his/her credentials (SSO, interactive mode, batch mode)... – Samson Scharfrichter Mar 20 '19 at 12:17
  • I'm not familiar with SQL Server / Microsoft peculiarities, but for the Hadoop stack, JDBC with standard Kerberos auth works like that https://stackoverflow.com/a/42506620/5162372 (in the case of batch authentication with a keytab file) – Samson Scharfrichter Mar 20 '19 at 12:25
  • Hi Samson, I am sorry, Please find the required details below. **Question** : which Kerberos implementation **Answer** : Active directory **Question** : which OS the client will be running on **Answer** : Windows (AD also in Windows) **Question** : whether the user and the database are attached to the same Kerberos realm (or AD domain) **Answer** : Yes , user and db server are attached to the same AD domain **Question** : how you expect the user to enter his/her credentials (SSO, interactive mode, batch mode) **Answer** : SSO – Anna Mar 20 '19 at 13:21
  • Thank you for Sharing the link. Additional to the previous comment I need one more clarification i.e While autheticating via JDBC - keyTab & krb5.ini file references are important? It would be a great help if you explain me about it. @Samson Scharfrichter – Anna Mar 20 '19 at 13:30
  • Keytabs are essential for scheduled jobs that have no pre-existing credentials (no SSO, no interactive prompt). `krb5.conf` or `.ini` is necessary on Linux, necessary on Windows if you don't use the default AD domain (or not only). In your case you can forget about both -- SSO based on Windows LSA cache should be used by Java, as a last resort, based on its default JAAS config. **But** on Windows Server you need to tweak the registry to grant Java access to the LSA cache. – Samson Scharfrichter Mar 20 '19 at 14:36
  • Java 8 reference on "Single Sign-on Using Kerberos in Java" -- enjoy **:-/** https://docs.oracle.com/javase/8/docs/technotes/guides/security/jgss/single-signon.html – Samson Scharfrichter Mar 20 '19 at 14:41
  • Hi Samson, Thanks for your help on this. Without krb5.ini file my code working fine and make the connection via KERBEROS. Can you please let me know in what scenario we require krb5.ini config file in JDBC connection ? – Anna Mar 25 '19 at 08:25
  • For cross-domain authentication. – Samson Scharfrichter Mar 25 '19 at 19:04
  • In previous comment you given me this terms : SSO, interactive mode, batch mode. Can you give me some heads-up on this? It will be a great help Samson – Anna Mar 26 '19 at 05:49

0 Answers0