Kerberos Authentication

Teradata Studio

Kerberos Authentication

Hi,

has anyone managed to connect to Teradata in Teradata Studio using Kerberos (KRB5) authentication successfully ? It works fine for me in BTEQ and SQL Assistant , but the result from Studio is always ping failed. I can connect from Studio using other authentcation methods , it is just KRB5 I am having problems with.

From reading the help documentation the only connection information you need to supply is

Authentication Mechanism ( select KRB5) ,

Database Server Name ( enter server name )

User Name [Domain]. I have tried the formats username@domainname, domainname\username and username[domainname] but none of them work.

The help documentation is scarce in this area. Is there anything additional I need to configure on my PC to get this to work ?

Thanks,

Rob

Tags (1)
5 REPLIES
Teradata Employee

Re: Kerberos Authentication

Rob, If using Kerberos, you need to set up the credentials. Here is a section from our Studio Help Content:

Kerberos Authentication

When using Kerberos authentication, you must provide a security configuration file (TeraJDBC.config and specify its location in a Java property. The format of the TeraJDBC.config file is specified in the Teradata JDBC Users Guide. The location of this file needs to be specified in the java.security.auth.login.configure property variable. Add this property variable to the .ini file as follows:

-Djava.security.auth.login.config=c:/TeraJDBC.config

where c:/TeraJDBC.config is the location of the TeraJDBC configuration file. The .ini file (TeradataStudioExpress.ini, TeradataStudio.ini, or eclipse.ini) is located in the same directory as the executable for Teradata Studio Express, Teradata Studio, or Eclipse. You must run knint to initialize your Kerberos credential before launching the product.

You want to check your krb5.ini file located under C:\Windows or C:\winnt.

Sample TeraJDBC.config:

com.sun.security.jgss.initiate

{

com.sun.security.auth.module.Krb5LoginModule sufficient

useTicketCache=true;

};

other

{

com.sun.security.auth.module.Krb5LoginModule required ;

};

Re: Kerberos Authentication

Hi,

I finally got this working. In addition to -Djava.security.auth.login.config=c:/TeraJDBC.config , I also had to add the following line to TeradataStudio.ini,

-Djavax.security.auth.useSubjectCredsOnly=false

thanks,

Rob

Teradata Employee

Re: Kerberos Authentication

Rob, My understanding is that the additional property is for SSO. You can also set the location of the krb5.ini file there as well:

-Djava.security.krb5.conf=C:\teradata\krb5.ini

Teradata Employee

Re: Kerberos Authentication

Hi Francine,

Where can I find the "Studio Help Content" that explained Kerberos Authentication as you described above?

I tried Teradata Studio Help Content but couldn't locate any section describing the Kerberos Authentication.

Regards,

Sudarmo

Teradata Employee

Re: Kerberos Authentication

Sudarmo, There should be a link at the bottom of the 'Creating a Teradata Connection' page, under Database Connectivity>Teradata Connection Profile. I am not seeing this in our latest release (15.11), so I will requset to get this back in.