Search <book_title>...

NetBackup IT Analytics Help

Last Published: 2024-02-22

Product(s): NetBackup IT Analytics (11.2)

Configure Kerberos-based authentication for Oracle

This documentation assumes the following. User will have to make corresponding changes to adjust to the organizational requirements and configuration.

Kerberos distribution center is already configured
TESTDOMAIN.COM is the realm configured on key distribution center (KDC).
Itanalyticsportal.testdomain.com is the system on which IT Analytics Portal is deployed.

The following additional steps are required on KDC for configuring NetBackup IT Analytics.

Ensure Kerberos configuration file (/etc/krb5.conf) on KDC machine and on the portal machine has the forwardable set to false (by default, it is set to false).
```
forwardable = false
```
After update, restart KDC and admin service on KDC server.
```
#systemctl restart krb5kdc.service 
#systemctl restart kadmin.service
```
Create service principal for Oracle service on KDC. Here scdb is the Oracle service name in Oracle
```
# kadmin.local 
addprinc -randkey 
scdb/itanalyticsportal.testdomain.com@TESTDOMAIN.COM
```

Add Kerberos Service Principal to a Keytab.

# kadmin.local
ktadd -k /tmp/keytab 
scdb/itanalyticsportal.testdomain.com@TESTDOMAIN.COM

Create a user principal name (for example kportal) that corresponds to portal user on database.
```
# kadmin.local
addprinc kportal
```
Create a user principal name (for example kaptare_ro) that corresponds to aptare_ro user on database.
```
# kadmin.local
addprinc kaptare_ro
```
Verify the keytab. It should show details of all the principals added.
```
# klist -k -t /tmp/keytab
```

On the NetBackup IT Analytics Portal, perform the following steps:

Install Kerberos client packages.

# yum install -y krb5-libs krb5-workstation

Copy /etc/krb5.conf from KDC 1 and install Kerberos client packages.
```
# yum install -y krb5-libs krb5-workstation
```
Copy /etc/krb5.conf from KDC to Oracle server on the same path.
Copy keytab file from KDC to Oracle server (for example, at /etc/v5srvtab).

Add the following entries to /opt/aptare/oracle/network/admin/sqlnet.ora file:

SQLNET.AUTHENTICATION_SERVICES=(BEQ,KERBEROS5) 
SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=scdb 
SQLNET.KERBEROS5_CONF=/etc/krb5.conf 
SQLNET.KERBEROS5_CONF_MIT=TRUE 
SQLNET.KERBEROS5_REALMS=/etc/krb5.conf 
SQLNET.KERBEROS5_KEYTAB=/etc/v5srvtab
SQLNET.FALLBACK_AUTHENTICATION=TRUE 
SQLNET.KERBEROS5_CC_NAME=/var/tmp/kcache

The NetBackup IT Analytics Portal server and KDC must have same time and time zone settings. If there is a time mismatch, adjust the below entry on sqlnet.ora to cover the time mismatch. For example, within 20 mins. The default value is 300.

SQLNET.KERBEROS5_CLOCKSKEW=1200

Provide appropriate permissions to files and directories so that Oracle service can read those files or directories mentioned in sqlnet.ora.
```
# chown aptare:dba /etc/krb5.conf /etc/v5srvtab /var/tmp/kcache
```

On database server, execute the below commands to create a user in Oracle to be used with Kerberos. We created kportal and kaptare_ro user principal in KDC.

# su - aptare

sqlplus / as sysdba 
SQL>alter session set container=scdb; 
SQL> CREATE USER kportal PROFILE DEFAULT IDENTIFIED EXTERNALLY AS 'kportal@TESTDOMAIN.COM' DEFAULT TABLESPACE APTARE_TBS_DATA_1M TEMPORARY TABLESPACE APTARE_TEMP_TBS;

SQL> CREATE USER kaptare_ro PROFILE DEFAULT IDENTIFIED EXTERNALLY AS 'kaptare_ro@TESTDOMAIN.COM' DEFAULT TABLESPACE APTARE_TBS_DATA_1M TEMPORARY TABLESPACE APTARE_TEMP_TBS;

In the /opt/aptare/oracle/dbs/initscdb.ora file (initialization file for the service) add the following entry.
```
OS_AUTHENT_PREFIX=""
```
Restart Oracle service.
```
/opt/aptare/bin/oracle restart
```
On database server, execute the below commands to verify and to fetch initial TGT for kportal user login as Oracle service user.
```
# su - aptare
# oklist -k -t /etc/v5srvtab
# okinit -k -t /etc/v5srvtab kportal
```
Connect to Oracle DB to verify.
```
# sqlplus /@scdb
```

Create trigger for the Kerberos users corresponds to portal and aptar_ro to alter the session which will set current schema as PORTAL.

# okinit -k -t /etc/v5srvtab kportal; 
login to db 
# sqlplus /@scdb 
create below trigger 
CREATE OR REPLACE TRIGGER set_portal_schema 

after logon on kportal.schema 
begin 
execute immediate 'alter session set current_schema=PORTAL'; 

end; 

/ 

#okinit -k -t /etc/v5srvtab kaptare_ro; 

login to db 
sqlplus /@scdb 

create trigger 
CREATE OR REPLACE TRIGGER set_ro_schema 

after logon on kaptare_ro.schema 

begin 

execute immediate 'alter session set current_schema=APTARE_RO'; 

end; 

/

On database server, execute the below commands to give permission to kaptare_ro to execute RTD package of portal schema.

su - aptare 
sqlplus "/ as sysdba" 

SQL> alter session set container=scdb; 
SQL> GRANT EXECUTE ON portal.rtd TO kaptare_ro; 
SQL> exit;

Create two separate cache files - one for portal user and other for aptare_ro user.

#su - aptare

#kinit -k -t /etc/v5srvtab kportal@TESTDOMAIN.COM -c /tmp/portal_kcache; 
#kinit -k -t /etc/v5srvtab kaptare_ro@TESTDOMAIN.COM -c /tmp/ro_kcache;

root and tomcat user must have read privileges to the cache files. 
#chmod 440 /tmp/portal_kcache; 
#chmod 440 /tmp/ro_kcache;

On the portal server, update portal configuration file with updated configurations for Kerberos.

These properties must be defined or updated in /opt/aptare/portalconf/portal.properties.

db.url=jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)
(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=scdb))) (This is db url in which host and service name is db host name and oracle service name respectively)
db.user=kportal@TESTDOMAIN.COM (It will be a combination of the portal user principal name and domain realm name)
db.ro_user=kaptare_ro@TESTDOMAIN.COM (It will be a combination of the ro user principal name and domain realm name)
db.auth.scheme=kerberos (this property must be defined to enable kerberos authentication)
db.kerberos.keytab.path=/etc/v5srvtab (this is keytab file path location)
db.driver=oracle.jdbc.OracleDriver (We are using this driver for kerberos auth.)
db.kerberos.portal_kcache.path=/tmp/portal_kcache (It will be portal user cache file)
db.kerberos.ro_kcache.path=/tmp/ro_kcache (It will be ro user cache file)
db.connection.max=25
db.connection.min=25
db.connection.expiration=5

On the portal server, update Data Receiver configuration file with updated configurations for Kerberos in /opt/aptare/datarcvrconf/datrarcvrproperties.xml.

<dataSource> 
<Driver>oracle.jdbc.driver.OracleDriver</Driver> 
<URL>jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=localhost)
(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=scdb)))</URL> 
<UserId>kportal@TESTDOMAIN.COM</UserId> 
<Password>Z0Q5W+lQD2jreQaLBoYsviYO21WGOq5iTEo0Ad2uUj/
e0GtqPkOtXFblKxCseKXO4VhpIQwwfrSfe59nGy156DV8lYoa7HWmL0hF+
kAZXOoXfIN5YRAGfqDbCwrKQdtPY7pQhuTkZMPLl0d9Kzy6sLGMb/
33L4hKuEl0ZZN2FG5US26JZ/uSOBF7T69ppqxGqXMleZ19QBcvUElLwJTn
52SurL+K3RjCY7Xi0VJb4wLkax07xCkpSK9dJ6NMFJS3ybWP4jNs3rC3roud
Zak8wGqLNhAacyXgW4pMpgigVjGwNr0N8rJIgcGmXgAxSNs0qmQItu
XPIyqGf+nWWEfScQ==</Password> 
<oracle_service_name>scdb</oracle_service_name>

<ro_user>kaptare_ro@TESTDOMAIN.COM</ro_user> 
<ro_password>U9a7a+af94q0CUaIfzaVmYl1P1DhdQW96CQiYWgxUGSV5sf
VVsxoWF5RiyV85MD8V0Ogy7UJo1sFmAL36KjDy8LA61pKeO4X39hRK/g8vvl/
xNnG5bBYIF04/1LwD2FTz0lJERWopKVZ6pd6TkT0mGeKrnu2oYi97GtlW4J73t
PGTFRhHyVw7yZKMmaxbs/FBwrz5aIfje3rT0w85m7Obtrjf2nJ2HjsaHnm
Toh0Ua96xlshjrE75UbaLMu0QEcF3PYF3qufYVIegn4VGSHcpsU/AFzurKpr0
JTsU/6VqvdE4veBLv4FH5D05bRetaOA0SGKCazWA50xiirwocvgyw==</ro_password>

<MaxConnections>125</MaxConnections> 
<MinConnections>5</MinConnections> 
<ConnExpirationTime>5</ConnExpirationTime> 
<authScheme>kerberos</authScheme> 
<portalKcacheFile>/tmp/portal_kcache</portalKcacheFile> 
<roKcacheFile>/tmp/ro_kcache</roKcacheFile> 
<kKeyTabFile>/etc/v5srvtab</kKeyTabFile> 
</dataSource>