JDBC MS SQL Server Kerberos身份验证

Question

I have a MS SQL Server RDBMS which uses Kerberos to authenticate the users.

From a Windows machine if I set the database URL to

jdbc:sqlserver://DB_NAME:DB_PORT;integratedSecurity=true

and add the appropriate sqljdbc_auth.dll to the path, everything works.

However I would like to use the Java Kerberos authentication, in order to be able to use the same code in *nix machines too.

So my DB URL becomes

jdbc:sqlserver://DB_NAME:DB_PORT;integratedSecurity=true;authenticationScheme=JavaKerberos

When I am running the code I am getting the following exception:

Exception in thread "main" javax.security.auth.login.LoginException: Unable to obtain Princpal Name for authentication 
    at com.sun.security.auth.module.Krb5LoginModule.promptForName(Krb5LoginModule.java:796)
    at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:667)
    at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:580)

Does anyone know why this is happening?

I have to add that I am using the default Krb5LoginModule that is provided by the JDBC driver.

Thank you in advance.

Answer 1

The MS JDBC docs states

When using authenticationScheme=JavaKerberos, you must specify the fully-qualified domain name (FQDN) in the serverName property. Otherwise, an error will occur (Server not found in Kerberos database).

So your URL becomes

jdbc:sqlserver://DB_NAME.domain.net:DB_PORT;integratedSecurity=true;authenticationScheme=JavaKerberos

Answer 2

您未能提供login.conf或该配置文件中使用Krb5LoginModule 。

Answer 3

Do you have a Kerberos subsystem (preferably the MIT Kerberos ) configured on your *NIX system? It is required in order to obtain a Ticket Granting Ticket (from a Key Distribution Centre ) to further authenticate to an SQL Server. See also Wikipedia entry on Kerberos protocol , some guide from MS .

Answer 4

Are you executing the code in a Windows system? If this is your scenario, the problem could be related to the registry entry AllowTgtSessionKey.

In this link https://msdn.microsoft.com/en-us/library/gg558122%28v=sql.110%29.aspx you can find the next intruction:

1. Set AllowTgtSessionKey to 1 in the registry for Windows. For more information, see Kerberos protocol registry entries and KDC configuration keys in Windows Server 2003.