Kerberos Configuration (リビジョン #5)

How to Configure Kerberos

Configuring Kerberos for Aqua Data Studio requires passing JVM parameters for Kerberos configuration, configuring the jaas.conf file (Java Authentication and Authorization Service), and configuring the Kerberos Configuration file.

Step 1 : Pass JVM parameters for Kerberos configuration

Add the following JVM paramaters to your Aqua Data Studio datastudio.ini file for windows, to your Aqua Data Studio info.plist file in OS X,  or to your Aqua Data Studio datastudio-bundled.sh file in linux.

Java Properties :

-Dsun.security.krb5.debug=[ true | false ]
-Dsun.security.jgss.debug=[ true | false ]
-Djava.security.krb5.realm=[ example : aqua-internal.com ]
-Djava.security.krb5.kdc=[ example : kdc.aqua-internal.com ]
-Djava.security.krb5.conf=[ example: /etc/krb5.conf | c:\windows\krb5.ini ]
-Djava.security.auth.login.config=[ example : /etc/jaas.conf | c:\windows\jaas.conf ]
-Djavax.security.auth.useSubjectCredsOnly=[ true | false ]

Example datastudio.ini :

vmarg.5 = -Dsun.security.krb5.debug=[ true | false ]
vmarg.6 = -Dsun.security.jgss.debug=[ true | false ]
vmarg.7 = -Djava.security.krb5.realm=[ example : aqua-internal.com ]
vmarg.8 = -Djava.security.krb5.kdc=[ example : kdc.aqua-internal.com ]
vmarg.9 = -Djava.security.krb5.conf=[ example: /etc/krb5.conf | c:\windows\krb5.ini ]
vmarg.10 = -Djava.security.auth.login.config=[ example : /etc/jaas.conf | c:\windows\jaas.conf ]
vmarg.11 = -Djavax.security.auth.useSubjectCredsOnly=[ true | false ]

Example datastudio-bundled.sh :

$ADS_HOME/jre/bin/java 
-Djsse.enableCBCProtection=false 
-Dsun.security.krb5.debug=[ true | false ] 
-Dsun.security.jgss.debug=[ true | false ] 
-Djava.security.krb5.realm=[ example : aqua-internal.com ]
-Djava.security.krb5.kdc=[ example : kdc.aqua-internal.com ]
-Djava.security.krb5.conf=[ example: /etc/krb5.conf | c:\windows\krb5.ini ]
-Djava.security.auth.login.config=[ example : /etc/jaas.conf | c:\windows\jaas.conf ]
-Djavax.security.auth.useSubjectCredsOnly=[ true | false ]
-Xmx756M -XX:MaxPermSize=192m -cp $CLASSES com.aquafold.datastudio.DataStudio

Example OS X /Aqua Data Studio.app/Contents/Info.plist :

    <array>
        <string>-DappRoot=$APP_ROOT</string>
        <string>-Djsse.enableCBCProtection=false</string>
        <string>-Dapple.laf.useScreenMenuBar=true</string>
        <string>-Dsun.security.krb5.debug=[ true | false ]</string>
        <string>-Dsun.security.jgss.debug=[ true | false ]</string>
        <string>-Djava.security.krb5.realm=[ example : aqua-internal.com ]</string>
        <string>-Djava.security.krb5.kdc=[ example : kdc.aqua-internal.com ]</string>
        <string>-Djava.security.krb5.conf=[ example: /etc/krb5.conf | c:\windows\krb5.ini ]</string>
        <string>-Djava.security.auth.login.config=[ example : /etc/jaas.conf | c:\windows\jaas.conf ]</string>
        <string>-Djavax.security.auth.useSubjectCredsOnly=[ true | false ]</string>
        <string>-Xmx756m</string>
        <string>-XX:MaxPermSize=192m</string>
    </array>

Step 2 : Configure jaas.conf configuration file (Java Authentication and Authorization Service)

All that is required is a simple jaas.conf file with the contents :

EXAMPLE jaas.conf file (except Cloudera)

JaasClient {
com.sun.security.auth.module.Krb5LoginModule required debug=true useTicketCache = true;
}

For more on configuring the jaas.conf file see:

http://docs.oracle.com/javase/7/docs/technotes/guides/security/jgss/tutorials/LoginConfigFile.html

EXAMPLE Cloudera jaas.conf file

Client {
com.sun.security.auth.module.Krb5LoginModule required debug=true useTicketCache = true;
}

For more on configuring the jaas.conf file see section "Setting Up the JAAS Login Configuration File" in below PDF file: 

http://www.cloudera.com/content/cloudera/en/documentation/connectors/latest/PDF/Cloudera-JDBC-Driver-for-Impala-Install-Guide.pdf

Step 3 : Configure krb5.conf (or krb5.ini) file (Kerberos Configuration File)

If you do not have a Kerberos configuration file please reference example <ADS_HOM>\krb5.ini.example

For more on configuring the Kerberos Configuration file see:

http://web.mit.edu/kerberos/krb5-devel/doc/admin/conf_files/krb5_conf.html

Step 4: Install JCE Unlimited Strength for Java