USER MANUALS

Providing a Krb5 File for Kerberos Authentication

To enable Kerberos authentication on a component of the Denodo server, you need to obtain a Kerberos configuration file (krb5 file) when one or more of these conditions is met:

  • The host where the Denodo server runs does not belong to a Windows domain.

  • The Denodo server runs on Linux.

  • The user account in Active Directory used by the Denodo server components has the option constrained delegation enabled.

For Design Studio and the administration tool of Virtual DataPort, you need the Kerberos configuration file when Active Directory does not return “forwardable” tickets by default.

If any of these conditions are met, check if there is a krb5 file in the default path of the operating system (see table Default location of the krb5 file depending on the operating system).

Default location of the krb5 file depending on the operating system

Operating System

Default Path for the krb5 file

Windows

<Windows directory>\krb5.ini (the system directory usually is C:\Windows).

Note that in Windows, the name of the file is krb5.ini and not krb5.conf.

Linux

/etc/krb5.conf

Solaris

/etc/krb5/krb5.conf

If this file is not present in the specified location, the VirtualDataPort server must be started with this JVM option: -Djava.security.krb5.conf=<REPLACE_WITH_PATH_TO_KRB5_FILE>.

If the file exists, make sure it has the property forwardable = true in the [libdefaults] section of the file.

If the file does not exist, create it in the default path. The figure Sample krb5 file is an example of a krb5 file.

Sample krb5 file
[libdefaults]
    default_realm = CONTOSO.COM
    forwardable = true

[realms]
CONTOSO.COM = {
    kdc = dc-01.contoso.com
    default_domain = CONTOSO.COM
}

[domain_realm]
    .contoso.com = CONTOSO.COM

With the property forwardable = true, the system will request “forwardable” tickets to the Kerberos server. These tickets can be used by the other applications (in this case, the Virtual DataPort server) to request service tickets on behalf of the user. These service tickets will be used to perform Kerberos requests to other services (e.g. databases) on behalf of the Virtual DataPort client (i.e. Design Studio, JDBC clients and ODBC clients).

Note

Virtual DataPort validates the Kerberos configuration resources (krb5 and keytab files) based on the following hierarchy of configuration properties:

  • com.denodo.vdb.security.KerberosAuthenticator.configurationResourceValidationEnabled

  • com.denodo.vdb.security.KerberosAuthenticator.configurationResourceValidationEnabled.<database>

  • com.denodo.vdb.security.KerberosAuthenticator.configurationResourceValidationEnabled.<database>.<datasource>

These properties control whether Kerberos configuration validation is enabled globally, at the database level, or at the individual data source level. Validation is enabled by default at all levels.

Hierarchy of restrictiveness

Each level overrides the behavior of its broader scope:

  • If validation is set to false at the data source level, the Kerberos configuration resources for that specific data source will not be validated.

  • If validation is set to false at the database level, the Kerberos configuration resources for all data sources in that database will not be validated.

  • If validation is set to false at the global level, the system Kerberos configuration, as well as the resources of all databases and all data sources, will not be validated.

Override examples

  • If validation is set to false at the global level, but is set to true for a specific database (e.g., example_db), the Kerberos configuration resources will be validated only for the elements within that database.

  • If validation is set to false at the global level, is set to true for the database example_db, and is set to false for a specific data source within that database (e.g., datasource_1), Kerberos validation will apply only to the elements in example_db except for datasource_1.

Add feedback