Configuring Interoperability with Microsoft Windows Server Domain Controller KDC

You can configure Oracle Database to interoperate with a Microsoft Windows Server domain controller key distribution center (KDC).

About Configuring Interoperability with a Microsoft Windows Server Domain Controller KDC

Oracle Database complies with MIT Kerberos.

This enables Oracle Database to interoperate with tickets that are issued by a Kerberos Key Distribution Center (KDC) on a Microsoft Windows Server domain controller. This process enables Kerberos authentication with an Oracle database.

Step 1: Configure Oracle Kerberos Client for Microsoft Windows Server Domain Controller

You can configure the Oracle Kerberos client to interoperate with a Microsoft Windows Server Domain Controller KDC.

Step 1A: Create the Client Kerberos Configuration Files

You must configure a set of client Kerberos configuration files that refer to the Windows 2008 domain controller as the Kerberos KDC.

Create the krb.conf and krb5.realms files. Oracle Database provides a default krb5.conf file, which you must modify for your site. The krb5.conf file is located in the location indicated by the SQLNET.KERBEROS_CONF parameter. For example, assuming that the Windows 2008 domain controller is running on a node named sales3854.us.example.com:

Step 1B: Specify the Oracle Configuration Parameters in the sqlnet.ora File

Configuring an Oracle client to interoperate with a Microsoft Windows Server Domain Controller Kerberos Key Distribution Center (KDC) uses the same sqlnet.ora file parameters that are used for configuring Kerberos on the client and on the database server.

Set the following parameters in the sqlnet.ora file on the client:

<pre class="copy"><code>SQLNET.KERBEROS5_CONF=pathname_to_Kerberos_configuration_file SQLNET.KERBEROS5_CONF_MIT=TRUE SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=Kerberos_service_name SQLNET.AUTHENTICATION_SERVICES=(BEQ,KERBEROS5)</code></pre>

Note the following:

Related Topics

Step 1C: Optionally, Specify Additional Kerberos Principals Using tnsnames.ora

You can configure additional Kerberos principal users to connect from an Oracle Database client.

Add the KERBEROS5_CC_NAME and KERBEROS5_PRINCIPAL settings to the tnsnames.ora connect string.

KERBEROS5_CC_NAME is mandatory for all additional Kerberos users and principals, but the KERBEROS5_PRINCIPAL setting is optional. KERBEROS5_CC_NAME supports multiple principals and the storage of credentials that are returned by the Key Distribution Center (KDC) in encrypted form. KERBEROS5_PRINCIPAL can be specified in the sqlnet.ora file as well as tnsnames.ora. Oracle Database checks KERBEROS5_PRINCIPAL against the value that is retrieved from the credential cache. If the two values do not match, then the user is not authenticated.

For example:

krbuser1 =
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=hostname)(PORT=port_number))
(CONNECT_DATA=(SERVICE_NAME=db.example.com))
(SECURITY=(KERBEROS5_CC_NAME = /tmp/krbuser1/krb.cc)
          (KERBEROS5_PRINCIPAL = krbprinc1@example.com)))
krbuser2 =
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=hostname)(PORT=port_number))
(CONNECT_DATA=(SERVICE_NAME=db.example.com))
(SECURITY=(KERBEROS5_CC_NAME = /tmp/krbuser2/krb.cc)
          (KERBEROS5_PRINCIPAL = krbprinc2@example.com)))

Related Topics

Step 1D: Specify the Listening Port Number

The Microsoft Windows Server domain controller KDC listens on UDP/TCP port 88.

  1. Ensure that the system file entry for kerberos5 is set to UDP/TCP port 88.

2. Note: This step is only required when using the KERBEROS5PRE adapter. This step can be skipped when using the KERBEROS5 adapter. The use of the KERBEROS5PRE adapter is deprecated with Oracle Database 21c. Oracle recommends that you use the KERBEROS5 adapter instead.

For the UNIX environment, ensure that the first `kerberos5` entry in the `/etc/services` file is set to  88.

Step 2: Configure a Microsoft Windows Server Domain Controller KDC for the Oracle Client

Next, you are ready to configure a Microsoft Windows Server Domain Controller KDC to interoperate with an Oracle Client.

Step 2A: Create the User Account

You must create a user account for the Microsoft Windows Server Domain Controller KDC.

Step 2B: Create the Oracle Database Principal User Account and Keytab

After you create the user account, you are ready to create the Oracle Database principal user account.

After you create this account on the Windows Server domain controller, you must use the okcreate utility to register it with the principal keytab. You can run this utilty on the same KDC to create all the service keytabs rather than creating them individually, or you can run okcreate from a service endpoint that connects to the KDC, run the ncessary commands, and then copy the resulting keytab back to the service endpoint.

  1. Create a new user account for the Oracle database in Microsoft Active Directory.

    For example, if the Oracle database runs on the host sales3854.us.example.com, then use Active Directory to create a user with the user name sales3854.us.example.com.

    Do not create a user as host/hostname.dns.com, such as oracle/sales3854.us.example.com, in Active Directory. Microsoft’s KDC does not support multipart names like an MIT KDC does. An MIT KDC allows multipart names to be used for service principals because it treats all principals as user names. However, Microsoft’s KDC does not.

  2. Run the okcreate command to create a keytab that will use this user account. The syntax is as follows:

    okcreate (-s [-u KDCuser@KDCmachine] | -k)
  [-name service_name] [-hosts path_to_host_list]
  [-out path_to_output] [-r realm] [-p principal]
  [-q query] [-d dbname] [-e enc:salt...] [-m]
  [-x db_args]

    For example:

    okcreate -s -u kdcuser1@kdcmachine1 -name oracle

  -hosts sales3854.us.example.com

  -out /OSsecured/keytablocation

  3. Copy the extracted keytab file to the host computer where the Oracle database is installed.

    For example, the keytab that was created in the previous step can be copied to /krb5/v5svrtab.

Step 3: Configure Oracle Database for a Microsoft Windows Server Domain Controller KDC

You must configure the Oracle database for the domain controller on the host computer where the Oracle database is installed.

Step 3A: Set Configuration Parameters in the sqlnet.ora File

You must first set configuration parameters for the database.

Specify values for the following parameters in the sqlnet.ora file for the database server:

SQLNET.KERBEROS5_CONF=pathname_to_Kerberos_configuration_file
SQLNET.KERBEROS5_KEYTAB=pathname_to_Kerberos_principal/key_table
SQLNET.KERBEROS5_CONF_MIT=TRUE
SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=Kerberos_service_name
SQLNET.AUTHENTICATION_SERVICES=(BEQ,KERBEROS5)

Note:

Step 3B: Create an Externally Authenticated Oracle User

After you set the configuration parameters, you are ready to create an externally authenticated Oracle user.

Follow the procedure underStep 8: Create an Externally Authenticated Oracle User to create an externally authenticated Oracle user.

Ensure that you create the username in all uppercase characters (for example, ORAKRB@SALES.US.EXAMPLE.COM).

See Also: Step 6: Configure Kerberos Authentication for information about setting the sqlnet.ora file parameters.

Step 4: Obtain an Initial Ticket for the Kerberos/Oracle User

Before a client can connect to the database, the client must request an initial ticket.

  1. To request an initial ticket, follow the task information for Step 9: Get an Initial Ticket for the Kerberos/Oracle User.

    The user does not need to explicitly request for an initial ticket, using the okinit command, when using the Windows native cache.

    If the Oracle client is running on Microsoft Windows Server or later, then the Kerberos ticket is automatically retrieved when the user logs in to Windows.

    See also the Microsoft documentation for details about the Kerbtray.exe utility, which can be used to display Kerberos ticket information for a system.

  2. For each Kerberos principal user that you have added to tnsnames.ora, run the okinit command in the client.

    For example:

    okinit krbprinc1@example.com