Search <book_title>...

NetBackup IT Analytics Help

Last Published: 2024-09-04

Product(s): NetBackup IT Analytics (11.3)

Modifications for Portal

Following are the steps to perform the portal related modifications:

Portal Modifications

Create a copy of /etc/krb5.conf from KDC to Portal server /etc/krb5.conf path.
Copy the keytab file from KDC to Portal at /etc/v5srvtab.
Note:
The exported keytab file can be removed from KDC once it has been copied to portal server.
Note:
For more information, see See Exporting service and user principal's to keytab file on KDC.
Modify the owner and permission of above copied two files using the following commands:
```
chown <oracle user>:<oracle group> /etc/krb5.conf /etc/v5srvtab
# chmod 444 /etc/krb5.conf /etc/v5srvtab
```
For example: # chown aptare:dba /etc/krb5.conf /etc/v5srvtab
Add the following entries to /opt/aptare/oracle/network/admin/sqlnet.ora file
- SQLNET.AUTHENTICATION_SERVICES=(BEQ,KERBEROS5)
- SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=scdb
- SQLNET.KERBEROS5_CONF=/etc/krb5.conf
- SQLNET.KERBEROS5_CONF_MIT=TRUE
- SQLNET.KERBEROS5_REALMS=/etc/krb5.conf
- SQLNET.KERBEROS5_KEYTAB=/etc/v5srvtab
- SQLNET.FALLBACK_AUTHENTICATION=TRUE
- SQLNET.KERBEROS5_CC_NAME=/tmp/kcache
- SQLNET.KERBEROS5_CLOCKSKEW=300
Modifications in the property file is required because when JDBC try to make multiple connections to Oracle DB, Oracle application treats this as a replay attack and errors out.
To avoid the error, ensure that the [libdefaults] section in the Kerberos configuration file /etc/krb5.conf on KDC and client machine is configured forwardable = false.
To update, restart kdc and admin service on KDC server using the following commands:
systemctl restart krb5kdc.service
systemctl restart kadmin.service

Create cache file for portal user.

For example, the command to generate cache file: kinit -k -t <Key Tab File> <kerberos user@domain realm name> -c <cache file name>

kinit -k -t <Key Tab File> <kerberos user name>@<domain realm name>
 -c <cache file name> 
# su - aptare (login as oracle user)
# kinit -k -t /etc/v5srvtab k1portal@EXAMPLE.COM 
-c /tmp/portal_kcache;

Tomcat user must have read privileges to the cache file. To ensure that the Tomcat OS user is able to make a JDBC connection to Oracle DB, use the following commands:
```
.
# chown <portal user>:<portal group> /tmp/portal_kcache;
# chmod 444 /tmp/portal_kcache;
```
For example: chown aptare:aptare /tmp/portal_kcache;
The following properties must be added or updated in /opt/aptare/portalconf/portal.properties
- db.url=jdbc:oracle:thin:@(DESCRIPTION=
  (ADDRESS=(PROTOCOL=tcp)(HOST=localhost)
  (PORT=1521))(CONNECT_DATA=(SERVICE_NAME=scdb)))
  Host and Service name could be different here.
- db.user=<kerberos user name>@<domain realm name>
  For example: db.user=k1portal@EXAMPLE.COM Combination of kerberos portal user name and domain realm name
- db.auth.scheme=kerberos
  This property must be defined to enable kerberos authentication and is case-insensitive
- db.kerberos.keytab.path=/etc/v5srvtab
  This is absolute path of keytab file
- db.driver=oracle.jdbc.OracleDriver
- db.kerberos.portal_kcache.path=/tmp/portal_kcache
  This is absolute path of portal user cache file
- db.connection.max=25
- db.connection.min=25
- db.connection.expiration=5

Similar changes are required in the Data-receiver property file /opt/aptare/datarcvrconf/datrarcvrproperties.xml.

Add or updated the bold perperties.

<dataSource>
<Driver> oracle.jdbc.driver.Oracle</Driver>
<URL>jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)
(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=scdb)))</URL>
<UserId><kerberos user name>@<>
<domain realm name></UserId>

For example: <UserId>k1portal@EXAMPLE.COM</UserId>

<Password>Z0Q5W+lQD2jreQaLBoYsviYO21WGOq5iTEo0Ad2uUj/e0GtqPkOtXFblKxCse
KXO4VhpIQwwfrSfe59nGy156DV8lYoa7HWmL0hF+kAZXOoXfIN5YRAGfqDbCwrKQdtPY7pQh
uTkZMPLl0d9Kzy6sLGMb/33L4hKuEl0ZZN2FG5US26JZ/uSOBF7T69ppqxGqXMleZ19QBcv
UElLwJTn52SurL+K3RjCY7Xi0VJb4wLkax07xCkpSK9dJ6NMFJS3ybWP4jNs3rC3roudZak8
wGqLNhAacyXgW4pMpgigVjGwNr0N8rJIgcGmXgAxSNs0qmQItuXPIyqGf+nWWEfScQ==
</Password>

<oracle_service_name>scdb</oracle_service_name>

<ro_user>aptare_ro</ro_user>

<ro_password>U9a7a+af94q0CUaIfzaVmYl1P1DhdQW96CQiYWgxUGSV5sfVVsxoWF5Riy
V85MD8V0Ogy7UJo1sFmAL36KjDy8LA61pKeO4X39hRK/g8vvl/xNnG5bBYIF04/1LwD2FTz
0lJERWopKVZ6pd6TkT0mGeKrnu2oYi97GtlW4J73tPGTFRhHyVw7yZKMmaxbs/FBwrz5aIf
je3rT0w85m7Obtrjf2nJ2HjsaHnmToh0Ua96xlshjrE75UbaLMu0QEcF3PYF3qufYVIegn
4VGSHcpsU/AFzurKpr0JTsU/6VqvdE4veBLv4FH5D05bRetaOA0SGKCazWA50
xiirwocvgyw==
</ro_password>

<MaxConnections>125</MaxConnections>

<MinConnections>5</MinConnections>

<ConnExpirationTime>5</ConnExpirationTime>
<authScheme>kerberos</authScheme>        
<portalKcacheFile>/tmp/portal_kcache</portalKcacheFile>
<kKeyTabFile>/etc/v5srvtab</kKeyTabFile>
</dataSource>

Before the upgrade

The following are the steps to be performed before the upgrade.

Provide dba grant to Kerberos portal user.

# su - aptare ( login as Oracle service user)

# sqlplus / as sysdba

SQL> alter session set container=scdb;
SQL> GRANT DBA TO k1portal;
SQL> GRANT EXECUTE ON SYS.DBMS_JOB TO k1portal;
SQL> GRANT EXECUTE ON SYS.DBMS_LOB TO k1portal;
SQL> GRANT EXECUTE ON SYS.DBMS_SCHEDULER TO k1portal;

Ensure portal cache file is valid and Tomcat user must have read permission.
```
# chmod 444 /tmp/portal_kcache;
chown <portal user>:<portal group> /tmp/portal_kcache
```
For example:# chown aptare:aptare /tmp/portal_kcache

Post upgrade

The following are the steps to be performed after the upgrade.

Revoke DBA role and grant a specific list of privileges to Kerberos users after a successful upgrade. k1portal is the Kerberos username here. It can be varied from environment to environment.
Under sys user performs below revoke tasks:
```
# su - aptare (login as oracle user)
# su - aptare
# sqlplus "/ as sysdba"

SQL> alter session set container=scdb;
Session altered.

SQL> REVOKE DBA FROM k1portal;
Revoke succeeded.
```
Again under sys user runs individual PLSQL scripts to grant a list of required privileges to Kerberos-enabled users for the normal functioning of ITA application.

Ensure that the correct Kerberos username is given as arguments to the script.

su - aptare
sqlplus "/ as sysdba"

SQL> alter session set container=scdb;
SQL> @/opt/aptare/database/ora_scripts/kerberos_grants_portal.plb;
Enter value for db_object_schema: portal
Enter value for kerberos_schema: k1portal
SQL> @/opt/aptare/database/ora_scripts/
metadata_grants_to_kerberos_user.plb
Enter value for kerberos_user_name: k1portal
SQL> exit;

Restart tomcat-portal and tomcat-agent and verify NBU ITA portal.

/opt/aptare/bin/tomcat-portal restart

/opt/aptare/bin/tomcat-agent restart

Note:

Kerberos cache file should not be expired, Tomcat and Aptare users must have access to the cache file, for this add a script in crontab to re-generate cache file as below :

# cat krb_cache_refresh.sh
su  -  aptare (login as oracle user)
okinit -k -t /etc/v5srvtab k1portal
kinit -k -t /etc/v5srvtab k1portal@EXAMPLE.COM
 -c /tmp/portal_kcache
chmod 444 /tmp/portal_kcache;
chown <portal user>:<portal group> /tmp/portal_kcache

For example: chown aptare:aptare /tmp/portal_kcache