NetBackup IT Analytics System Administrator Guide

Portal Modifications

1. Create a copy of /etc/krb5.conf from KDC to Portal server /etc/krb5.conf path.
2. Copy the keytab file from KDC to Portal at /etc/v5srvtab.

   Note:

   The exported keytab file can be removed from KDC once it has been copied to portal server.

   Note:

   For more information, see See Exporting service and user principal's to keytab file on KDC.

3. Modify the owner and permission of above copied two files using the following commands:

   chown <oracle user>:<oracle group> /etc/krb5.conf /etc/v5srvtab
   # chmod 444 /etc/krb5.conf /etc/v5srvtab
   

   For example: # chown aptare:dba /etc/krb5.conf /etc/v5srvtab

4. Add the following entries to /opt/aptare/oracle/network/admin/sqlnet.ora file

   • SQLNET.AUTHENTICATION_SERVICES=(BEQ,KERBEROS5)

   • SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=scdb

   • SQLNET.KERBEROS5_CONF=/etc/krb5.conf

   • SQLNET.KERBEROS5_CONF_MIT=TRUE

   • SQLNET.KERBEROS5_REALMS=/etc/krb5.conf

   • SQLNET.KERBEROS5_KEYTAB=/etc/v5srvtab

   • SQLNET.FALLBACK_AUTHENTICATION=TRUE

   • SQLNET.KERBEROS5_CC_NAME=/tmp/kcache

   • SQLNET.KERBEROS5_CLOCKSKEW=300

5. Modifications in the property file is required because when JDBC try to make multiple connections to Oracle DB, Oracle application treats this as a replay attack and errors out.

   To avoid the error, ensure that the [libdefaults] section in the Kerberos configuration file /etc/krb5.conf on KDC and client machine is configured forwardable = false.

   To update, restart kdc and admin service on KDC server using the following commands:

   systemctl restart krb5kdc.service

   systemctl restart kadmin.service

6. Create cache file for portal user.

   For example, the command to generate cache file: kinit -k -t <Key Tab File> <kerberos user@domain realm name> -c <cache file name>

   kinit -k -t <Key Tab File> <kerberos user name>@<domain realm name>
    -c <cache file name> 
   # su - aptare (login as oracle user)
   #source <INSTALL_PATH>/aptare/bin/aptare_env.sh
   # kinit -k -t /etc/v5srvtab k1portal@EXAMPLE.COM 
   -c /tmp/portal_kcache;

7. Tomcat user must have read privileges to the cache file. To ensure that the Tomcat OS user is able to make a JDBC connection to Oracle DB, use the following commands:

   .
   # chown <portal user>:<portal group> /tmp/portal_kcache;
   # chmod 444 /tmp/portal_kcache;
   

   For example: chown aptare:aptare /tmp/portal_kcache;

8. The following properties must be added or updated in /opt/aptare/portalconf/portal.properties

   • db.url=jdbc:oracle:thin:@(DESCRIPTION=

     (ADDRESS=(PROTOCOL=tcp)(HOST=localhost)

     (PORT=1521))(CONNECT_DATA=(SERVICE_NAME=scdb)))

     Host and Service name could be different here.

   • db.user=<kerberos user name>@<domain realm name>

     For example: db.user=k1portal@EXAMPLE.COM Combination of kerberos portal user name and domain realm name

   • db.auth.scheme=kerberos

     This property must be defined to enable kerberos authentication and is case-insensitive

   • db.kerberos.keytab.path=/etc/v5srvtab

     This is absolute path of keytab file

   • db.driver=oracle.jdbc.OracleDriver

   • db.kerberos.portal_kcache.path=/tmp/portal_kcache

     This is absolute path of portal user cache file

   • db.connection.max=25

   • db.connection.min=25

   • db.connection.expiration=5

9. Similar changes are required in the Data-receiver property file /opt/aptare/datarcvrconf/datrarcvrproperties.xml.

   Add or updated the bold perperties.

   <dataSource>
   <Driver> oracle.jdbc.driver.Oracle</Driver>
   <URL>jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)
   (HOST=localhost)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=scdb)))</URL>
   <UserId><kerberos user name>@<>
   <domain realm name></UserId>
   
   For example: <UserId>k1portal@EXAMPLE.COM</UserId>
   
   <Password>Z0Q5W+lQD2jreQaLBoYsviYO21WGOq5iTEo0Ad2uUj/e0GtqPkOtXFblKxCse
   KXO4VhpIQwwfrSfe59nGy156DV8lYoa7HWmL0hF+kAZXOoXfIN5YRAGfqDbCwrKQdtPY7pQh
   uTkZMPLl0d9Kzy6sLGMb/33L4hKuEl0ZZN2FG5US26JZ/uSOBF7T69ppqxGqXMleZ19QBcv
   UElLwJTn52SurL+K3RjCY7Xi0VJb4wLkax07xCkpSK9dJ6NMFJS3ybWP4jNs3rC3roudZak8
   wGqLNhAacyXgW4pMpgigVjGwNr0N8rJIgcGmXgAxSNs0qmQItuXPIyqGf+nWWEfScQ==
   </Password>
   
   <oracle_service_name>scdb</oracle_service_name>
   
   <ro_user>aptare_ro</ro_user>
   
   <ro_password>U9a7a+af94q0CUaIfzaVmYl1P1DhdQW96CQiYWgxUGSV5sfVVsxoWF5Riy
   V85MD8V0Ogy7UJo1sFmAL36KjDy8LA61pKeO4X39hRK/g8vvl/xNnG5bBYIF04/1LwD2FTz
   0lJERWopKVZ6pd6TkT0mGeKrnu2oYi97GtlW4J73tPGTFRhHyVw7yZKMmaxbs/FBwrz5aIf
   je3rT0w85m7Obtrjf2nJ2HjsaHnmToh0Ua96xlshjrE75UbaLMu0QEcF3PYF3qufYVIegn
   4VGSHcpsU/AFzurKpr0JTsU/6VqvdE4veBLv4FH5D05bRetaOA0SGKCazWA50
   xiirwocvgyw==
   </ro_password>
   
   <MaxConnections>125</MaxConnections>
   
   <MinConnections>5</MinConnections>
   
   <ConnExpirationTime>5</ConnExpirationTime>
   <authScheme>kerberos</authScheme>        
   <portalKcacheFile>/tmp/portal_kcache</portalKcacheFile>
   <kKeyTabFile>/etc/v5srvtab</kKeyTabFile>
   </dataSource>