8.4. Kerberos Support: JDBC Client Configuration

Procedure 8.3. Setup Kerberos for JDBC Client

1. Set JAAS configuration

   In the client VM the JAAS configuration for kerberos authentication needs to be written. Here is sample configuration file (client.conf):

   			Client {
       com.sun.security.auth.module.Krb5LoginModule required
       useTicketCache=true
       storeKey=true
       useKeyTab=true 
       keyTab="/path/to/krb5.keytab" 
       doNotPrompt=false 
       debug=false
       principal="user@EXAMPLE.COM";
   };

   Copy to Clipboard Toggle word wrap

2. Set JVM configuration

   Add the following JVM options to your client's startup script. Change realm and kdc settings according to your environment:

   -Djava.security.krb5.realm=EXAMPLE.COM
   -Djava.security.krb5.kdc=kerberos.example.com
   -Djavax.security.auth.useSubjectCredsOnly=false
   -Dsun.security.krb5.debug=false
   -Djava.security.auth.login.config=/path/to/client.conf

   Copy to Clipboard Toggle word wrap
   Or if you want to control the kdc and realm system wide, use below instead.

   -Djava.security.krb5.conf=/path/to/krb5.conf (on Linux /etc/krb5.conf)
   -Djava.security.auth.login.config=/path/to/client.conf
   -Djavax.security.auth.useSubjectCredsOnly=false
   -Dsun.security.krb5.debug=false
   

   Copy to Clipboard Toggle word wrap

3. Set URL connection properties

   Add the following URL connection properties to the JBoss Data Virtualization JDBC connection string:

   authenticationType=KRB5;jaasName=Client;kerberosServicePrincipleName=dv/my.host.com@EXAMPLE.COM

   Copy to Clipboard Toggle word wrap