• As there can only be one external authentication scheme enabled for an Autonomous Database at any given time, run the DBMS_CLOUD_ADMIN.DISABLE_EXTERNAL_AUTHENTICATION procedure to disable any external authentication scheme that is already enabled for your database.

  To run the procedure, you must be logged in as ADMIN user or have the EXECUTE privilege on DBMS_CLOUD_ADMIN.

  BEGIN
      DBMS_CLOUD_ADMIN.DISABLE_EXTERNAL_AUTHENTICATION;
  END;
  /

• Obtain the Kerberos configuration files: krb.conf and the service key table file v5srvtab. For more information on these files and steps required to obtain them, see Configuring Kerberos Authentication in Oracle Database 19c Security Guide or Oracle Database 23ai Security Guide.

• Copy the Kerberos configuration files krb.conf and v5srvtab to a bucket in your Object Store.

  Note:

  Oracle recommends that you store the Kerberos configuration files in a private bucket in your Object Store.

  If you are using Oracle Cloud Infrastructure Object Store, see Putting Data into Object Storage for details on uploading files.

• To enable Kerberos as the external authentication for your Autonomous Database, run the DBMS_CLOUD_ADMIN.ENABLE_EXTERNAL_AUTHENTICATION procedure and pass in a location URI with the params JSON argument. You must place the configuration files krb.conf and v5srvtab in the Object Storage location specified in the location_uri parameter.

  For example:

  BEGIN
      DBMS_CLOUD_ADMIN.ENABLE_EXTERNAL_AUTHENTICATION(
          type     => 'KERBEROS',
          params   => JSON_OBJECT('location_uri' value 'https://objectstorage.us-phoenix-1.oraclecloud.com/n/namespace-string/b/bucketname/o',
                                 'credential_name' value 'my_credential_name')
      );
  END;
  /

  Note:

  To provide CMU-AD Kerberos authentication for Microsoft Active Directory users, you can enable Kerberos authentication on top of CMU-AD by setting type to CMU in the above example.

  In this example, namespace-string is the Oracle Cloud Infrastructure object storage namespace and bucketname is the bucket name. See Understanding Object Storage Namespaces for more information.

  The credential_name you use in this step is the credentials for the Object Store.

  If the location_uri is a pre-authenticated URL then supplying a credential_name is not required.

  This creates a directory object named KERBEROS_DIR in your database and uses the credential to download the Kerberos configuration files from the Object Store location to the directory object.

  You can use the kerberos_service_name parameter to specify the Kerberos service name. For example:

  BEGIN
  DBMS_CLOUD_ADMIN.ENABLE_EXTERNAL_AUTHENTICATION(
     type     =>'KERBEROS',
     params   => JSON_OBJECT(
     'location_uri'          value 'https://objectstorage.us-phoenix-1.oraclecloud.com/n/namespace-string/b/bucketname/o',
     'credential_name'       value 'my_credential_name'
     'kerberos_service_name' value 'oracle' ));
  END;
  /

• After you enable Kerberos authentication, remove the configuration krb.conf and v5srvtab from Object Store. You can use local Object Store methods to remove these files or use DBMS_CLOUD.DELETE_OBJECT to delete the files from Object Store.

BEGIN
    DBMS_CLOUD_ADMIN.DISABLE_EXTERNAL_AUTHENTICATION;
END;
/