Prepare for authentication

Prepare for Kerberos authentication

• •You can't use the Hosted Agent or serverless runtime environment.
• •Ensure that the Secure Agent and database server that you use are registered in the KDC server.
• •Consider the following guidelines when you use credential cache files:
• - On Linux, you can use the credential cache file of multiple Kerberos principal users within a connection without restarting the Data Integration Server. However, you can use only one Kerberos principal user within a mapping.
• - On Windows, you can use only one Kerberos principal user within a connection.

Configuring Kerberos authentication

1. 1To configure the Java Authentication and Authorization Service configuration file (JAAS), perform the following tasks:
1. aCreate a JAAS configuration file on the Secure Agent machine.
2. bAdd the following entries to the JAAS configuration file:
JDBC_DRIVER_01 {
com.sun.security.auth.module.Krb5LoginModule required
useTicketCache=true
};
Note: Ensure that you specify each key-value pair on a separate line. You can update the values of the given configuration or add additional configuration details according to your requirements.
2. 2To configure the krb5.conf file, perform the following tasks:
1. aCreate a krb5.conf file on the Secure Agent machine.
2. bAdd the details of the Key Distribution Center (KDC) and admin server to the krb5.conf file in the following format:
[libdefaults]
default_realm = <Realm name>
forwardable = true
ticket_lifetime = 24h

[realms]
<REALM NAME> = {
kdc = <Location where KDC is installed>
admin_server = <Location where KDC is installed>
}
[domain_realm]
<domain name or host name> = <Domain name or host name of Kerberos>
<domain name or host name> = <Domain name or host name of Kerberos>
Note: Ensure that you don’t set user-specific values in any key-value pair. You can update the values of the given configuration or add additional configuration details according to your requirements.
3. 3To generate the credential cache file on the Secure Agent machine, perform the following tasks:
1. aOn the Secure Agent machine, run the following command and specify the Microsoft SQL Server user name and realm name:
kinit <user name>@<realm_name>
2. bWhen prompted, enter the password for the Kerberos principal user.
3. cOptionally, when you connect to a Microsoft SQL Server database on Linux, you can run the following command to generate the credential cache file with the specified file name and directory on the Secure Agent machine:
kinit -c <Directory and file name where you want to create the credential cache> <user name>@<realm_name>
4. 4Add the KRB5_CONFIG, KRB5CCNAME, and JAASCONFIG properties in the Metadata Advanced Connection Properties field in the Microsoft SQL Server connection.
For example, add the properties in the following format:
KRB5_CONFIG=<Absolute path of the Kerberos configuration file>\krb5.conf;KRB5CCNAME=<Absolute path of the credential cache file>/<File name>;JAASCONFIG=<Absolute path of the JAAS config file>\<File name>.conf
Note: Ensure that you separate each key-value pair with a semicolon.
5. 5Add the KRB5_CONFIG and KRB5CCNAME properties in the Runtime Advanced Connection Properties field in the Microsoft SQL Server connection.
For example, add the properties in the following format:
KRB5_CONFIG=<Absolute path of the Kerberos configuration file>\krb5.conf;KRB5CCNAME=<Absolute path of the credential cache file>/<File name>
Note: Ensure that you separate each key-value pair with a semicolon.
6. 6Optionally, set the environment variables on the Secure Agent machine.
Note: If you set the environment variables, you can't use more than one Kerberos principal user in a connection.
1. aSet the following environment variables:
• ▪ setenv KRB5CCNAME <Absolute path and file name of the credentials cache file>
• ▪ setenv KRB5_CONFIG <Absolute path of the Kerberos configuration file>\krb5.conf
• ▪ setenv JAASCONFIG <Absolute path of the JAAS config file>\<File name>.conf
2. bRestart the Secure Agent.
7. 7Ensure that the user who runs the mapping has read access to the files related to Kerberos authentication on the Secure Agent.