{"id":23480721,"url":"https://github.com/mswatosh/was-kerberos-database","last_synced_at":"2025-10-30T16:13:40.865Z","repository":{"id":112673788,"uuid":"219860459","full_name":"mswatosh/was-kerberos-database","owner":"mswatosh","description":null,"archived":false,"fork":false,"pushed_at":"2021-06-10T15:37:42.000Z","size":151,"stargazers_count":3,"open_issues_count":0,"forks_count":2,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-03-28T11:39:33.424Z","etag":null,"topics":["database-access","kerberos","websphere"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mswatosh.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-11-05T22:13:21.000Z","updated_at":"2021-06-10T15:37:48.000Z","dependencies_parsed_at":"2023-06-17T20:15:53.714Z","dependency_job_id":null,"html_url":"https://github.com/mswatosh/was-kerberos-database","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mswatosh%2Fwas-kerberos-database","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mswatosh%2Fwas-kerberos-database/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mswatosh%2Fwas-kerberos-database/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mswatosh%2Fwas-kerberos-database/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mswatosh","download_url":"https://codeload.github.com/mswatosh/was-kerberos-database/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248980242,"owners_count":21193131,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["database-access","kerberos","websphere"],"created_at":"2024-12-24T20:42:35.144Z","updated_at":"2025-10-30T16:13:35.824Z","avatar_url":"https://github.com/mswatosh.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# was-kerberos-database\n\n## This is an experimentation environment for Database access on WebSphere with Kerberos. Practices demonstrated here are not necessarily recommended or secure. Use at your own risk.\n\n### Overview\n\nThe docker compose environment sets up a KDC , Database (DB2), and an application server (WebSphere traditional or Liberty) with kerberos configured in each image. \n\nMay require OpenJ9 Java 8. Tested with OpenJ9/OpenJDK 1.8.0_232\n\n### WebSphere traditional \n\nBring up the WebSphere traditional environment with:\n\n``` sh\n./gradlew libertyPackage #create app and copy database drivers\ndocker-compose build\ndocker-compose up\n```\n\n`keberos.py` is the admin script for configuring kerberos and datasources  \n`installApps.py` is the admin script for installing the application\n\n\n\nThe application can be accessed at the endpoint:  \nhttp://localhost:9080/was-kerberos-database/example  \nusername: dbuser\npassword: password\n\nAdmin Console: https://localhost:9043/ibm/console/  \nUser: wsadmin  \nPassword: password\n\nWSAdmin testing:  \n`/opt/IBM/WebSphere/AppServer/bin/wsadmin.sh -conntype NONE -lang jython`\n\nWebSphere traditional trace is available at:\n`/trace/twas`\n\n### Liberty\n\n**Liberty doesn't support accessing databases using kerberos**\n\nThe Liberty environment is in `liberty.yml`\n\n#### DB2\n\nThe compose environment for Liberty with DB2 is `liberty-db2.yml`\n\n```sh\n./gradlew libertyPackage\ndocker-compose -f liberty.yml build\ndocker-compose -f liberty.yml up\n```\n\nOnce the environment is up (db2 usually takes the longest to start) this endpoint can be used to access the database:  \nhttp://localhost:9080/was-kerberos-database/example\n\n#### SQLServer\n\nThe compose environment for Liberty with SQLServer is `liberty-mssql.yml` \nCurrently there is no kerberos configured for SQLServer\n\n```sh\n./gradlew libertyPackage\ndocker-compose -f liberty-mssql.yml build\ndocker-compose -f liberty-mssql.yml up\n```\n\nSQLServer cmd line  \n/opt/mssql-tools/bin/sqlcmd -S localhost -U SA -P P@ssw0rd\n\n```sql\nSELECT auth_scheme FROM sys.dm_exec_connections  \nGO\n```\n\nCurrently getting the following when trying to login locally without user/pass:\n```txt\n2020-03-03 21:32:10.75 Logon       Error: 18452, Severity: 14, State: 1.\n2020-03-03 21:32:10.75 Logon       Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication. [CLIENT: 10.5.0.5]\n```\n\n```txt\nError: 18452, Severity: 14, State: 1 - The login may use Windows Authentication but the login is an unrecognized Windows principal. An unrecognized Windows principal means that Windows can't verify the login. This might be because the Windows login is from an untrusted domain.\n```\n\nMy guess is this is due to the lack of Active Directory server, and that this will not be possible without one.\n\nhttps://github.com/microsoft/mssql-docker/issues/165\n\n#### Oracle\n\nThe compose environment for Liberty with Oracle is `liberty-oracle.yml`\nCurrently there is no kerberos configured for Oracle\n\n```sh\n./gradlew buildOracleBase\n./gradlew libertyPackage\ndocker-compose -f liberty-oracle.yml build\ndocker-compose -f liberty-oracle.yml up\ndocker-compose -f liberty-oracle.yml down -v #Bring down and remove volume (so oracle data is not persisted)\n```\n\n\nNote: If you see the following error when running `./gradlew buildOracleBase` you may need to increase your Disk image size under Docker Settings -\u003e Resources.\n```txt\ncheckSpace.sh: ERROR - There is not enough space available in the docker container.\n```\n\nAccess oracle using sqlplus:\n```sh\n# Access oracle using default (BEQ) authentication\ndocker exec -it --user oracle was-kerberos-database_oracle_1 /bin/sh -c 'sqlplus / as sysdba'\n\n# Access oracle using Kerberos Authentication\ndocker exec -it --user oracle was-kerberos-database_oracle_1 /bin/sh -c 'sqlplus /@XE'\n\n# Interactive access to oracle using Kerberos Authentciation \n$ docker exec -it oracle was-kerberos-database_oracle_1\nsh-4.2$ su oracle\n[oracle@oracle /]$ sqlplus /@XE\n```\n\nAccess oracle container:\n`docker exec -it was-kerberos-database_oracle_1 /bin/sh`\n\n#### Current Status\nWhen trying to authenticate with Kerberos using `sqlplus /@XE` sqlplus returns the error:\n```txt\nERROR:\nORA-01017: invalid username/password; logon denied\n```\n\nLooking at the kerberos logs we see the authentication transaction take place:\n```sh\n# Oracle user was authenticated and a the AS_REQ was issued\nMar 23 21:35:22 99364b92d0d9 krb5kdc[28](info): AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.5.0.11: NEEDED_PREAUTH: XE/oracle@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM, Additional pre-authentication required\nMar 23 21:35:22 99364b92d0d9 krb5kdc[28](info): AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.5.0.11: ISSUE: authtime 1584999322, etypes {rep=18 tkt=18 ses=18}, XE/oracle@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM\n# A request for the TGS came through, and was issued\nMar 23 21:35:40 99364b92d0d9 krb5kdc[28](info): TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.5.0.11: ISSUE: authtime 1584999322, etypes {rep=18 tkt=18 ses=18}, XE/oracle@EXAMPLE.COM for XE/oracle@EXAMPLE.COM\nMar 23 21:35:40 99364b92d0d9 krb5kdc[28](info): TGS_REQ (1 etypes {18}) 10.5.0.11: ISSUE: authtime 1584999322, etypes {rep=18 tkt=18 ses=18}, XE/oracle@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM\n```\n\nThen on the oracle side we get the following error output (After 2 minutes):\n```sh\noracle_1    | ***********************************************************************\noracle_1    |\noracle_1    | Fatal NI connect error 12170.\noracle_1    |\noracle_1    |   VERSION INFORMATION:\noracle_1    | \tTNS for Linux: Version 18.0.0.0.0 - Production\noracle_1    | \tOracle Bequeath NT Protocol Adapter for Linux: Version 18.0.0.0.0 - Production\noracle_1    | \tTCP/IP NT Protocol Adapter for Linux: Version 18.0.0.0.0 - Production\noracle_1    |   Version 18.4.0.0.0\noracle_1    |   Time: 23-MAR-2020 21:37:40\noracle_1    |   Tracing not turned on.\noracle_1    |   Tns error struct:\noracle_1    |     ns main err code: 12535\noracle_1    |\noracle_1    | TNS-12535: TNS:operation timed out\noracle_1    |     ns secondary err code: 12606\noracle_1    |     nt main err code: 0\noracle_1    |     nt secondary err code: 0\noracle_1    |     nt OS err code: 0\noracle_1    |   Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=127.0.0.1)(PORT=35334))\noracle_1    | 2020-03-23T21:37:40.003997+00:00\noracle_1    | WARNING: inbound connection timed out (ORA-3136)\n```\n### Kerberos\n\nAccess Kerberos admin tooling\n```sh\ndocker exec -it was-kerberos-database_kerberos_1 /bin/sh -c kadmin.local\n```\n\nRealm: EXAMPLE.COM  \nUser: dbuser@EXAMPLE.COM  \nUser: wsadmin@EXAMPLE.COM  \nWAS Service: wassrvc/websphere@EXAMPLE.COM\nDB2 Service: db2srvc@EXAMPLE.COM  \nDB2 User: db2inst1@EXAMPLE.COM  \n\n\n### DB2\nThe Dockerfile installs kerberos libs, and copies `docker-entrypoint.sh` and `createschema.sh` into the image.  \n`docker-entrypoint.sh` creates the krb5.conf and starts the database.  \n`createschema.sh` updates the database configuration for kerberos, runs kinit with the user, and starts db2 admin.\n\nThe db2 user account is db2inst1@EXAMPLE.COM \nThe db2 kerberos service is db2srvc@EXAMPLE.COM\n\nWe call kinit before db2start because db2 looks for credentials in the ccache.\n\nDB2 Logs: /database/config/db2user/sqllib/db2dump/DIAG0000/\n\n### Links\n[Configure Kerberos in WAS](https://www.ibm.com/support/knowledgecenter/en/SSEQTP_9.0.5/com.ibm.websphere.base.doc/ae/tsec_kerb_setup.html)  \n[Configure Kerberos in DB2](https://www.ibm.com/support/knowledgecenter/en/SSEPGG_11.1.0/com.ibm.db2.luw.admin.sec.doc/doc/c0058525.html)\n[Configure Kerberos in Oracle](https://docs.oracle.com/en/database/oracle/oracle-database/20/dbseg/configuring-kerberos-authentication.html#GUID-39A6604D-35DD-40E5-A71E-079EE7C9DF15)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmswatosh%2Fwas-kerberos-database","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmswatosh%2Fwas-kerberos-database","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmswatosh%2Fwas-kerberos-database/lists"}