NetBackup IT Analytics System Administrator Guide

Portal Modifications

1. Create a copy of /etc/krb5.conf from KDC to Portal server /etc/krb5.conf path.
2. Copy the keytab file from KDC to Portal at /etc/v5srvtab.

   Note:

   The exported keytab file can be removed from KDC once it has been copied to portal server.

   For more information, see See Exporting service and user principal's to keytab file on KDC.

3. Modify the owner and permission of above copied two files using the following commands:

   chown <oracle user>:<oracle group> /etc/krb5.conf /etc/v5srvtab
   # chmod 444 /etc/krb5.conf /etc/v5srvtab
   

   For example: # chown aptare:dba /etc/krb5.conf /etc/v5srvtab

4. Add the following entries to /opt/aptare/oracle/network/admin/sqlnet.ora file

   • SQLNET.AUTHENTICATION_SERVICES=(BEQ,KERBEROS5)

   • SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=scdb

   • SQLNET.KERBEROS5_CONF=/etc/krb5.conf

   • SQLNET.KERBEROS5_CONF_MIT=TRUE

   • SQLNET.KERBEROS5_REALMS=/etc/krb5.conf

   • SQLNET.KERBEROS5_KEYTAB=/etc/v5srvtab

   • SQLNET.FALLBACK_AUTHENTICATION=TRUE

   • SQLNET.KERBEROS5_CC_NAME=/tmp/kcache

   • SQLNET.KERBEROS5_CLOCKSKEW=300

5. Modifications in the property file is required because when JDBC try to make multiple connections to Oracle DB, Oracle application treats this as a replay attack and errors out.

   To avoid the error, ensure that the [libdefaults] section in the Kerberos configuration file /etc/krb5.conf on KDC and client machine is configured forwardable = false.

   To update, restart kdc and admin service on KDC server using the following commands:

   systemctl restart krb5kdc.service

   systemctl restart kadmin.service

6. Create cache file for portal user.

   For example, the command to generate cache file: kinit -k -t <Key Tab File> <kerberos user@domain realm name> -c <cache file name>

   kinit -k -t <Key Tab File> <kerberos user name>@<domain realm name>
    -c <cache file name> 
   # su - aptare (login as oracle user)
   #source <INSTALL_PATH>/aptare/bin/aptare_env.sh
   # kinit -k -t /etc/v5srvtab k1portal@EXAMPLE.COM 
   -c /tmp/portal_kcache;

7. Tomcat user must have read privileges to the cache file. To ensure that the Tomcat OS user is able to make a JDBC connection to Oracle DB, use the following commands:

   .
   # chown <portal user>:<portal group> /tmp/portal_kcache;
   # chmod 444 /tmp/portal_kcache;
   

   For example: chown aptare:aptare /tmp/portal_kcache;

8. The following properties must be added or updated in /opt/aptare/portalconf/portal.properties

   • db.url=jdbc:oracle:thin:@(DESCRIPTION=

     (ADDRESS=(PROTOCOL=tcp)(HOST=localhost)

     (PORT=1521))(CONNECT_DATA=(SERVICE_NAME=scdb)))

     Host and Service name could be different here.

   • db.user=<kerberos user name>@<domain realm name>

     For example: db.user=k1portal@EXAMPLE.COM Combination of kerberos portal user name and domain realm name

   • db.auth.scheme=kerberos

     This property must be defined to enable kerberos authentication and is case-insensitive

   • db.kerberos.keytab.path=/etc/v5srvtab

     This is absolute path of keytab file

   • db.driver=oracle.jdbc.OracleDriver

   • db.kerberos.portal_kcache.path=/tmp/portal_kcache

     This is absolute path of portal user cache file

   • db.connection.max=25

   • db.connection.min=25

   • db.connection.expiration=5

9. Similar changes are required in the Data-receiver property file /opt/aptare/datarcvrconf/datrarcvrproperties.xml.

   Add or updated the bold perperties.

   <dataSource>
   <Driver> oracle.jdbc.driver.Oracle</Driver>
   <URL>jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)
   (HOST=localhost)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=scdb)))</URL>
   <UserId><kerberos user name>@<>
   <domain realm name></UserId>
   
   For example: <UserId>k1portal@EXAMPLE.COM</UserId>
   
   <Password>Z0Q5W+lQD2jreQaLBoYsviYO21WGOq5iTEo0Ad2uUj/e0GtqPkOtXFblKxCse
   KXO4VhpIQwwfrSfe59nGy156DV8lYoa7HWmL0hF+kAZXOoXfIN5YRAGfqDbCwrKQdtPY7pQh
   uTkZMPLl0d9Kzy6sLGMb/33L4hKuEl0ZZN2FG5US26JZ/uSOBF7T69ppqxGqXMleZ19QBcv
   UElLwJTn52SurL+K3RjCY7Xi0VJb4wLkax07xCkpSK9dJ6NMFJS3ybWP4jNs3rC3roudZak8
   wGqLNhAacyXgW4pMpgigVjGwNr0N8rJIgcGmXgAxSNs0qmQItuXPIyqGf+nWWEfScQ==
   </Password>
   
   <oracle_service_name>scdb</oracle_service_name>
   
   <ro_user>aptare_ro</ro_user>
   
   <ro_password>U9a7a+af94q0CUaIfzaVmYl1P1DhdQW96CQiYWgxUGSV5sfVVsxoWF5Riy
   V85MD8V0Ogy7UJo1sFmAL36KjDy8LA61pKeO4X39hRK/g8vvl/xNnG5bBYIF04/1LwD2FTz
   0lJERWopKVZ6pd6TkT0mGeKrnu2oYi97GtlW4J73tPGTFRhHyVw7yZKMmaxbs/FBwrz5aIf
   je3rT0w85m7Obtrjf2nJ2HjsaHnmToh0Ua96xlshjrE75UbaLMu0QEcF3PYF3qufYVIegn
   4VGSHcpsU/AFzurKpr0JTsU/6VqvdE4veBLv4FH5D05bRetaOA0SGKCazWA50
   xiirwocvgyw==
   </ro_password>
   
   <MaxConnections>125</MaxConnections>
   
   <MinConnections>5</MinConnections>
   
   <ConnExpirationTime>5</ConnExpirationTime>
   <authScheme>kerberos</authScheme>        
   <portalKcacheFile>/tmp/portal_kcache</portalKcacheFile>
   <kKeyTabFile>/etc/v5srvtab</kKeyTabFile>
   </dataSource>