Kerberos Authentication with Oracle

Overview

This section describes how to enable Kerberos authentication for an Oracle database connection in XDM.

To use Kerberos authentication, several configuration files and credentials must be provided to the XDM runtime environment. This includes the Kerberos KeyTab file, the Kerberos configuration, the JAAS configuration, and optionally trusted root CA certificates.

The required files are mounted into the XDM pods by using Kubernetes Secrets and ConfigMaps. The Java runtime is then configured to use these files for Kerberos authentication.

Prerequisites

Before proceeding, make sure the following components are available:

  • A valid Kerberos KeyTab file for database access.

  • A correctly configured krb5.conf file.

  • A correctly configured jaas.conf file referencing the KeyTab.

  • A JDBC driver that supports Kerberos authentication, for example the Oracle JDBC driver.

  • Root CA certificates, if required by your environment.

  • Helm deployment access to the XDM application.

  • Access to modify the values.yaml configuration file.

  • Kubernetes access to create Secrets and ConfigMaps.

Steps

Step 1: Mount the Kerberos KeyTab File

The Kerberos KeyTab file must be provided to the required XDM pods by using a Kubernetes Secret.

A KeyTab file stores encrypted credentials for Kerberos authentication. It allows automated services to authenticate with the Kerberos Key Distribution Center without user interaction.

Update the values.yaml file to mount the KeyTab file.

core:
  volumes:
    - name: kerberos-keytab
      secret:
        secretName: kerberos-keytab-secret
  volumeMounts:
    - name: kerberos-keytab
      mountPath: /etc/security/keytabs
      readOnly: true

deployer:
  configuration:
    volumes:
      - name: kerberos-keytab
        secret:
          secretName: kerberos-keytab-secret
    volumeMounts:
      - name: kerberos-keytab
        mountPath: /etc/security/keytabs
        readOnly: true

Step 2: Add krb5.conf and jaas.conf

The Kerberos configuration files must also be available inside the pods.

krb5.conf

The krb5.conf file defines the Kerberos configuration, including realms, KDCs, and defaults.

Example:

[libdefaults]
  default_realm = EXAMPLE.COM

[realms]
  EXAMPLE.COM = {
    kdc = kdc.example.com
    admin_server = kdc.example.com
  }

[domain_realm]
  .example.com = EXAMPLE.COM
  example.com = EXAMPLE.COM

jaas.conf

The jaas.conf file defines the Java Authentication and Authorization Service login module configuration.

Example:

com.sun.security.jgss.krb5.initiate {
  com.sun.security.auth.module.Krb5LoginModule required
  useKeyTab=true
  keyTab="/etc/security/keytabs/your.keytab"
  principal="your_principal@EXAMPLE.COM"
  storeKey=true
  useTicketCache=false;
};

Make sure that:

  • keyTab points to the mounted KeyTab file.

  • principal matches the Kerberos principal used for database access.

Mount both files into the pods by using a ConfigMap.

core:
  volumes:
    - name: kerberos-conf
      configMap:
        name: kerberos-config
  volumeMounts:
    - name: kerberos-conf
      mountPath: /etc/krb5
      readOnly: true

deployer:
  configuration:
    volumes:
      - name: kerberos-conf
        configMap:
          name: kerberos-config
    volumeMounts:
      - name: kerberos-conf
        mountPath: /etc/krb5
        readOnly: true

Step 3: Set Java Environment Variables

Configure the Java runtime so that it can find the Kerberos configuration files.

Set the _JAVA_OPTIONS environment variable.

core:
  environment:
    - name: "_JAVA_OPTIONS"
      value: "-Djava.security.krb5.conf=/etc/krb5/krb5.conf -Djava.security.auth.login.config=/etc/krb5/jaas.conf"

deployer:
  configuration:
    environmentVariables:
      _JAVA_OPTIONS: "-Djava.security.krb5.conf=/etc/krb5/krb5.conf -Djava.security.auth.login.config=/etc/krb5/jaas.conf"

Adjust the paths if your files are mounted to different locations.

Step 4: Add Root CA Certificates

If the Oracle database requires trusted root certificates, store the CA files in Kubernetes Secrets.

XDM checks all files in the /xdm/certs directory at startup and imports the certificates into the Java keystore.chroy

Register the certificate secrets in the Helm configuration:

xdm:
  certificates:
    - <certificate-secret-name-1>
    - <certificate-secret-name-2>
After changing the Helm configuration, redeploy the Helm chart to apply the changes.

Step 5: Update the JDBC Connection URL

In the XDM web interface, create or update the Oracle database connection.

To enable Kerberos authentication, add the following properties to the JDBC URL:

?oracle.net.kerberos5_mutual_authentication=true&oracle.net.authentication_services=(KERBEROS5)

Example:

jdbc:oracle:thin:@//db.example.com:1521/ORCL?oracle.net.kerberos5_mutual_authentication=true&oracle.net.authentication_services=(KERBEROS5)