<html>
<head>
<base href="https://docs.jboss.org/author">
<link rel="stylesheet" href="/author/s/en/2172/19/5/_/styles/combined.css?spaceKey=TEIID&forWysiwyg=true" type="text/css">
</head>
<body style="background: white;" bgcolor="white" class="email-body">
<div id="pageContent">
<div id="notificationFormat">
<div class="wiki-content">
<div class="email">
<h2><a href="https://docs.jboss.org/author/display/TEIID/Kerberos+support+through+GSSAPI">Kerberos support through GSSAPI</a></h2>
<h4>Page <b>edited</b> by <a href="https://docs.jboss.org/author/display/~rareddy">Ramesh Reddy</a>
</h4>
<br/>
<h4>Changes (4)</h4>
<div id="page-diffs">
<table class="diff" cellpadding="0" cellspacing="0">
<tr><td class="diff-snipped" >...<br></td></tr>
<tr><td class="diff-unchanged" > <br>{code:XML|title="standalone-teiid.xml"} <br></td></tr>
<tr><td class="diff-deleted-lines" style="color:#999;background-color:#fdd;text-decoration:line-through;"><security-domain name="host" cache-type="default"> <br></td></tr>
<tr><td class="diff-added-lines" style="background-color: #dfd;"><security-domain name="host"> <br></td></tr>
<tr><td class="diff-unchanged" > <authentication> <br> <login-module code="Kerberos" flag="required"> <br></td></tr>
<tr><td class="diff-snipped" >...<br></td></tr>
<tr><td class="diff-unchanged" > <br>{code:XML|title="standalone-teiid.xml"} <br></td></tr>
<tr><td class="diff-deleted-lines" style="color:#999;background-color:#fdd;text-decoration:line-through;"><security-domain name="MY_REALM" cache-type="default"> <br></td></tr>
<tr><td class="diff-added-lines" style="background-color: #dfd;"><security-domain name="MY_REALM"> <br></td></tr>
<tr><td class="diff-unchanged" > <authentication> <br> <!-- Check the username and password --> <br></td></tr>
<tr><td class="diff-snipped" >...<br></td></tr>
</table>
</div> <h4>Full Content</h4>
<div class="notificationGreySide">
<h1><a name="KerberossupportthroughGSSAPI-KerberossupportthroughGSSAPI"></a>Kerberos support through GSSAPI</h1>
<p>Teiid supports kerberos authentication using GSSAPI for single sign-on applications. This service ticket negotiation based authentication is supported through remote JDBC/ODBC drivers and LocalConnections. Client configuration is different for each client type.</p>
<h2><a name="KerberossupportthroughGSSAPI-LocalConnection"></a>LocalConnection</h2>
<p>Set the JDBC URL property <em>PassthroughAuthentication</em> as true and use <a href="http://community.jboss.org/docs/DOC-10680" class="external-link" rel="nofollow">JBoss Negotiation</a> for authentication of your web-application with kerberos. When the web application authenticates with the provided kerberos token, the same subject authenticated will be used in Teiid. For details about configuration, check the JBoss Negotiation documentation.</p>
<h2><a name="KerberossupportthroughGSSAPI-RemoteConnections%28JDBC%2FODBC%29"></a>Remote Connections (JDBC/ODBC)</h2>
<p>On the server, edit the <tt><jboss-install>/standalone/configuration/standalone-teiid.xml</tt> under "security-domains" subsystem add the following. Make necessary changes related to your configuration in terms of key tab locations, service principal etc. You need to configure two separate security domains.</p>
<h3><a name="KerberossupportthroughGSSAPI-Configureonesecuritydomaintorepresenttheidentityoftheserver."></a>Configure one security domain to represent the identity of the server. </h3>
<p>The first security domain authenticates the container itself to the directory service. It needs to use a login module which accepts some type of static login mechanism, because a real user is not involved. This example uses a static principal and references a keytab file which contains the credential.</p>
<div class="code panel" style="border-width: 1px;"><div class="codeHeader panelHeader" style="border-bottom-width: 1px;"><b>"standalone-teiid.xml"</b></div><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: xml; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<security-domain name="host">
<authentication>
<login-module code="Kerberos" flag="required">
<module-option name="storeKey" value="true"/>
<module-option name="useKeyTab" value="true"/>
<module-option name="principal" value="host/testserver@MY_REALM"/> <!-- service principal -->
<module-option name="keyTab" value="/path/to/service.keytab"/>
<module-option name="doNotPrompt" value="true"/>
<module-option name="debug" value="false"/>
</login-module>
</authentication>
</security-domain>
</pre>
</div></div>
<h3><a name="KerberossupportthroughGSSAPI-ConfigureasecondsecuritydomaintosecuretheTeiidapplication."></a>Configure a second security domain to secure the Teiid application.</h3>
<p>The second security domain is used to authenticate the individual user to the Kerberos server. You need at least one login module to authenticate the user, and another to search for the roles to apply to the user. The following XML code shows an example SPNEGO security domain. It includes an authorization module to map roles to individual users. You can also use a module which searches for the roles on the authentication server itself. Note the name of security-domain MUST match realm</p>
<div class="code panel" style="border-width: 1px;"><div class="codeHeader panelHeader" style="border-bottom-width: 1px;"><b>"standalone-teiid.xml"</b></div><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: xml; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<security-domain name="MY_REALM">
<authentication>
<!-- Check the username and password -->
<login-module code="SPNEGO" flag="requisite">
<module-option name="password-stacking" value="useFirstPass"/>
<module-option name="serverSecurityDomain" value="host"/>
</login-module>
<!-- Search for roles -->
<login-module code="UserRoles" flag="requisite">
<module-option name="password-stacking" value="useFirstPass" />
<module-option name="usersProperties" value="spnego-users.properties" />
<module-option name="rolesProperties" value="spnego-roles.properties" />
</login-module>
</authentication>
</security-domain>
</pre>
</div></div>
<div class='panelMacro'><table class='tipMacro'><colgroup><col width='24'><col></colgroup><tr><td valign='top'><img src="/author/images/icons/emoticons/check.gif" width="16" height="16" align="absmiddle" alt="" border="0"></td><td><b>"User Roles/Groups associations"</b><br />Kerberos does not assign any user roles to the authenticated subject, that is reason you need to configure a separate role mapping module to assign roles. As an example in the above, "UserRoles" login-module is added. User need to edit "spnego-roles.properties" file and add groups in the format of
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: java; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
user@MY_REALM=my-group
</pre>
</div></div>
<p>Check JBoss EAP documentation, as to all the available mapping modules available.</p></td></tr></table></div>
<p>SPENGO security-domain delegates the calls relating to Kerberos to Kerberos server based on "serverSecurityDomain" property. If you would like configure the choice of authenticating using Kerberos or some other security domain on the same JDBC/ODBC transport, then you need to supply property </p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: xml; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<module-option name="usernamePasswordDomain" value="{user-name-based-auth}"/>
</pre>
</div></div>
<p>under SPENGO security-domain. The process of selecting "kerberos" or "{user-name-based-auth}" domain for authentication is defined below.</p>
<p>The above configuration defined security-domains, before you can use these domains for logging into Teiid, they need to be associated with Teiid's transport configuration or VDB configuration. Paragraphs below offer both solutions.</p>
<h3><a name="KerberossupportthroughGSSAPI-Defininga%22default%22authenticationbasedonTeiidTransport"></a>Defining a "default" authentication based on Teiid Transport</h3>
<p>User can define a "default" authentication per transport as below that can be used for all the VDBs system wide. </p>
<p>For JDBC:</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: xml; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<transport name="jdbc" protocol="teiid" socket-binding="teiid-jdbc"/>
<authentication security-domain="MY_REALM" type="GSS"/>
</transport>
</pre>
</div></div>
<p>For ODBC:</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: xml; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<transport name="odbc" protocol="pg" socket-binding="teiid-odbc"/>
<authentication security-domain="MY_REALM" type="GSS"/>
</transport>
</pre>
</div></div>
<div class='panelMacro'><table class='tipMacro'><colgroup><col width='24'><col></colgroup><tr><td valign='top'><img src="/author/images/icons/emoticons/check.gif" width="16" height="16" align="absmiddle" alt="" border="0"></td><td><b>"What is the value of Type"</b><br />The "type" attribute above defines the type of authentication that needs to be enforced on the transport/vdb. The allowed values for type are
<ul>
<li>USERPASSWORD - only allow user name/password based authentications</li>
<li>GSS - only allow GSS API based authentication (Kerberos5).</li>
</ul>
</td></tr></table></div>
<h3><a name="KerberossupportthroughGSSAPI-DefiningVDBbasedauthentication"></a>Defining VDB based authentication</h3>
<p>You can add following combination VDB properties in the vdb.xml file to select or force the security-domain and authentication type.</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: xml; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<property name="security-domain" value="MY_REALM" />
<property name="gss-pattern" value="{regex}" />
<property name="password-pattern" value="{regex}" />
<property name="authentication-type" value="GSS or USERPASSWORD" />
</pre>
</div></div>
<p>All the properties above are optional on a VDB. If you want to define VDB based security configuration "security-domain" property is required. If you want to enforce single authentication type use "authentication-type" property is required. If your security domain can support both GSS and USERPASSWORD, then you can define "gss-pattern" and "password-pattern" properties, and define a regular expression as the value. During the connection, these regular expressions are matched against the connecting user's name provided to select which authentication method user prefers. For example, if the configuration is defined as below</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: xml; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<property name="security-domain" value="MY_REALM" />
<property name="gss-pattern" value="logasgss" />
</pre>
</div></div>
<p>and if you passed the "user=logasgss" in the connection string, then GSS authentication is selected as login authentication mechanism. If the user name does not match, then default transport's authentication method is selected. Alternatively, if you want choose USERPASSWORD</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: xml; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<property name="security-domain" value="MY_REALM" />
<property name="password-pattern" value="*-simple" />
</pre>
</div></div>
<p>and if the user name is like "mike-simple", then that user will be subjected to authenticate against USERPASSWORD based authentication domain. You can configure different security-domains for different VDBS. VDB authentication will no longer be dependent upon underlying transport. If you like force "GSS" all the time then use configuration like below</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: xml; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<property name="security-domain" value="MY_REALM" />
<property name="authentication-type" value="GSS" />
</pre>
</div></div>
<h3><a name="KerberossupportthroughGSSAPI-RequiredSystemPropertiesonServer"></a>Required System Properties on Server</h3>
<p>Edit the "standalone.conf" file in the "${jboss-as}/bin" directory and add the following JVM options (changing the realm and KDC settings according to your environment) </p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: java; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
JAVA_OPTS = "$JAVA_OPTS -Djava.security.krb5.realm=EXAMPLE.COM -Djava.security.krb5.kdc=kerberos.example.com -Djavax.security.auth.useSubjectCredsOnly=false"
</pre>
</div></div>
<p>or</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: java; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
JAVA_OPTS = "$JAVA_OPTS -Djava.security.krb5.conf=/path/to/krb5.conf -Djava.security.krb5.debug=false -Djavax.security.auth.useSubjectCredsOnly=false"
</pre>
</div></div>
<p>This finishes the configuration on the server side, restart the server and make sure there are no errors during start up. </p>
<h3><a name="KerberossupportthroughGSSAPI-JDBCClientConfiguration"></a>JDBC Client Configuration</h3>
<p>Your workstation where the JDBC Client exists must have been authenticated using GSS API against Active Directory or Enterprise directory server. See this website <a href="http://spnego.sourceforge.net" class="external-link" rel="nofollow">http://spnego.sourceforge.net</a> on instructions as to how to verify your system is authenticated into enterprise directory server. Contact your company's operations team if you have any questions.</p>
<p>In you client VM the JAAS configuration for Kerberos authentication needs to be written. A sample configuration file (client.conf) is show below </p>
<div class="code panel" style="border-width: 1px;"><div class="codeHeader panelHeader" style="border-bottom-width: 1px;"><b>"client.conf"</b></div><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: java; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
Client {
com.sun.security.auth.module.Krb5LoginModule required
useTicketCache=true
storeKey=true
useKeyTab=true
keyTab="/path/to/krb5.keytab"
doNotPrompt=true
debug=false
principal="user@EXAMPLE.COM";
};
</pre>
</div></div>
<p>Make sure you have configured the "keytab" properly, you can check this website for utilities and instructions to check your access to KDC server and to create keytab especially on windows environments <a href="http://spnego.sourceforge.net" class="external-link" rel="nofollow">http://spnego.sourceforge.net</a>. For Redhat Linux see <a href="https://access.redhat.com/site/solutions/208173" class="external-link" rel="nofollow">https://access.redhat.com/site/solutions/208173</a></p>
<p>Add the following JVM options to your client's startup script - change Realm and KDC settings according to your environment </p>
<div class="code panel" style="border-width: 1px;"><div class="codeHeader panelHeader" style="border-bottom-width: 1px;"><b>"Based on krb5.conf file"</b></div><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: java; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
-Djava.security.krb5.conf=/path/to/krb5.conf (on Linux /etc/krb5.conf)
-Djava.security.auth.login.config=/path/to/client.conf
-Djavax.security.auth.useSubjectCredsOnly=false
-Dsun.security.krb5.debug=false
</pre>
</div></div>
<p>or</p>
<div class="code panel" style="border-width: 1px;"><div class="codeHeader panelHeader" style="border-bottom-width: 1px;"><b>"Based on KDC and Realm file"</b></div><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: java; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
-Djava.security.krb5.realm=EXAMPLE.COM
-Djava.security.krb5.kdc=kerberos.example.com
-Djavax.security.auth.useSubjectCredsOnly=false
-Dsun.security.krb5.debug=false
-Djava.security.auth.login.config=/path/to/client.conf
</pre>
</div></div>
<p>Add the following additional URL connection properties to Teiid JDBC connection string along with URL property. Note that when configured with Kerberos, in order to participate in Kerberos based authentication you need to configure "user" property as required by "gss-pattern" or define the "authentication-type" property on the VDB or transport. However, after successful login into security-domain, the user name from GSS login context will be used for representing the session in the Teiid.</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: java; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
jaasName=Client;user={pattern};kerberosServicePrincipleName=host/testserver@MY_REALM
</pre>
</div></div>
<h3><a name="KerberossupportthroughGSSAPI-ODBCClientConfiguration"></a>ODBC Client Configuration</h3>
<p>Create a DSN for the VDB on the client machine to the VDB that you would like to connect using PostgreSQL ODBC driver. In order to participate in Kerberos based authentication you need to configure "user" property as required by "gss-pattern" or define the "authentication-type" property on the VDB or transport.</p>
<p>No additional configuration is needed as part of this, except that your workstation where the ODBC DSN exists must have been authenticated using GSS API against Active Directory or Enterprise directory server. See this website <a href="http://spnego.sourceforge.net" class="external-link" rel="nofollow">http://spnego.sourceforge.net</a> on instructions as to how to verify your system is authenticated into enterprise directory server. Contact your company's operations team if you have any questions.</p>
</div>
<div id="commentsSection" class="wiki-content pageSection">
<div style="float: right;" class="grey">
<a href="https://docs.jboss.org/author/users/removespacenotification.action?spaceKey=TEIID">Stop watching space</a>
<span style="padding: 0px 5px;">|</span>
<a href="https://docs.jboss.org/author/users/editmyemailsettings.action">Change email notification preferences</a>
</div>
<a href="https://docs.jboss.org/author/display/TEIID/Kerberos+support+through+GSSAPI">View Online</a>
|
<a href="https://docs.jboss.org/author/pages/diffpagesbyversion.action?pageId=51806542&revisedVersion=11&originalVersion=10">View Changes</a>
|
<a href="https://docs.jboss.org/author/display/TEIID/Kerberos+support+through+GSSAPI?showComments=true&showCommentArea=true#addcomment">Add Comment</a>
</div>
</div>
</div>
</div>
</div>
</body>
</html>