All Forums Teradata Studio
rob_watson 3 posts Joined 04/16
28 Apr 2016
Kerberos Authentication

Hi,
has anyone managed to connect to Teradata in Teradata Studio using Kerberos (KRB5) authentication successfully ? It works fine for me in BTEQ and SQL Assistant , but the result from Studio is always ping failed. I can connect from Studio using other authentcation methods , it is just KRB5 I am having problems with.
From reading the help documentation the only connection information you need to supply is
Authentication Mechanism ( select KRB5) ,
Database Server Name ( enter server name )
User Name [Domain]. I have tried the formats username@domainname, domainname\username and username[domainname] but none of them work.
The help documentation is scarce in this area. Is there anything additional I need to configure on my PC to get this to work ?
Thanks,
Rob

Tags:
fgrimmer 553 posts Joined 04/09
28 Apr 2016

Rob, If using Kerberos, you need to set up the credentials. Here is a section from our Studio Help Content:
Kerberos Authentication
When using Kerberos authentication, you must provide a security configuration file (TeraJDBC.config and specify its location in a Java property. The format of the TeraJDBC.config file is specified in the Teradata JDBC Users Guide. The location of this file needs to be specified in the java.security.auth.login.configure property variable. Add this property variable to the .ini file as follows:
-Djava.security.auth.login.config=c:/TeraJDBC.config
where c:/TeraJDBC.config is the location of the TeraJDBC configuration file. The .ini file (TeradataStudioExpress.ini, TeradataStudio.ini, or eclipse.ini) is located in the same directory as the executable for Teradata Studio Express, Teradata Studio, or Eclipse. You must run knint to initialize your Kerberos credential before launching the product.
You want to check your krb5.ini file located under C:\Windows or C:\winnt.
Sample TeraJDBC.config:

com.sun.security.jgss.initiate

{

com.sun.security.auth.module.Krb5LoginModule sufficient

useTicketCache=true;

};

 

 

other

{

com.sun.security.auth.module.Krb5LoginModule required ;

};

rob_watson 3 posts Joined 04/16
26 May 2016

Hi,
I finally got this working. In addition to -Djava.security.auth.login.config=c:/TeraJDBC.config , I also had to add the following line to TeradataStudio.ini,
-Djavax.security.auth.useSubjectCredsOnly=false
 
thanks,
Rob
 
 

fgrimmer 553 posts Joined 04/09
26 May 2016

Rob, My understanding is that the additional property is for SSO. You can also set the location of the krb5.ini file there as well:
-Djava.security.krb5.conf=C:\teradata\krb5.ini

sudarmo 1 post Joined 05/11
19 Jul 2016

Hi Francine,
Where can I find the "Studio Help Content" that explained Kerberos Authentication as you described above?
I tried Teradata Studio Help Content but couldn't locate any section describing the Kerberos Authentication.
 
Regards,
Sudarmo

8SS8

fgrimmer 553 posts Joined 04/09
24 Jul 2016

Sudarmo, There should be a link at the bottom of the 'Creating a Teradata Connection' page, under Database Connectivity>Teradata Connection Profile. I am not seeing this in our latest release (15.11), so I will requset to get this back in.

You must sign in to leave a comment.