dbeaver / dbeaver/dbeaver

Support Kerberos for Db2-LUW

Open
#6,232 1 comment 0 reactions 0 assignees View on GitHub
PRO x:db2 xf:connection xf:kerberos
Dominant language
Java
Stars
51.8k
Forks
4.4k
Avg merge
3d 8h
Merged PRs (30d)
188

Description

#### System information:
ubuntu 16.04.06 x64

- DBeaver version
Dbeaver-ce 6.1.1

#### Connection specification:
- Db2-LUW version 11.1.4.4

#### Describe your question:

My Db2-instance uses kerberos authentication which works fine for various applications.

With Dbeaver, I am able to use kerberos authentication to Db2-LUW only if I specify a kerberos-userid/password with driver property securityMechanism=11.

But I want to use the cached ticket (from kinit or java Kinit) instead of the kerberos userid/password (i.e. i want that single sign on cabability, without being forced to re-enter or store the kerberos-credentials in the app storage).

But Dbeaver-ce 6.1.1 forces use of userid/password each time, instead of offering to use the non-expired cached Ticket.

I can get the ticket-granting-ticket either with the linux kinit, or with IBM's java Kinit tool that comes with Db2.

I am able to use cached ticket from my java programs with kerberos authentication with Db2-LUW (v11.1+), and IBM's CLPplus java program can also use the cached ticket to avoid having to re-enter userid/password for kerberos authentication. To do this I've got $HOME/jaas.conf configured from the relevant java.security (IBM's jre that comes with Db2-LUW in this case).

Is there some configuration method to persuade Dbeaver-ce to use a cached ticket-granting-ticket , insead of userid/password, when connecting to Db2-LUW?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.