JDBC的Kerberos甲骨文认证

使用这个例子中，几乎让我的连接如工作JDBC的Kerberos甲骨文认证

http://blogs.nologin.es/rickyepoderi/index.php?/archives/105-Oracle-Driver-and-Kerberos.html

但后启用Kerberos缓存和调试它正确地让我的委托人名称和凭据成功的有与车票相关的错误。

票券与okinit（从Oracle甲骨文12使用kinit）

 
Exception in thread "main" java.sql.SQLRecoverableException: Error de E/S: The service in process is not supported. Failure unspecified at GSS-API level (Mechanism level: Generic error (description in e-text) (60) - ASN.1 unexpected field number) 
    at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:743) 
    at oracle.jdbc.driver.PhysicalConnection.connect(PhysicalConnection.java:666) 
    at oracle.jdbc.driver.T4CDriverExtension.getConnection(T4CDriverExtension.java:32) 
    at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java:566) 
    at java.sql.DriverManager.getConnection(DriverManager.java:571) 
    at java.sql.DriverManager.getConnection(DriverManager.java:187) 
    at JdbcThin.main(JdbcThin.java:39) 
Caused by: oracle.net.ns.NetException: The service in process is not supported. Failure unspecified at GSS-API level (Mechanism level: Generic error (description in e-text) (60) - ASN.1 unexpected field number) 
    at oracle.net.ano.AuthenticationService.run(Unknown Source) 
    at java.security.AccessController.doPrivileged(Native Method) 
    at javax.security.auth.Subject.doAs(Subject.java:415) 
    at oracle.net.ano.AuthenticationService.e(Unknown Source) 
    at oracle.net.ano.Ano.negotiation(Unknown Source) 
    at oracle.net.ns.NSProtocol.connect(NSProtocol.java:293) 
    at oracle.jdbc.driver.T4CConnection.connect(T4CConnection.java:1452) 
    at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:496) 
    ... 6 more 
Caused by: GSSException: Failure unspecified at GSS-API level (Mechanism level: Generic error (description in e-text) (60) - ASN.1 unexpected field number) 
    at sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:710) 
    at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:248) 
    at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179) 
    ... 14 more 
Caused by: KrbException: Generic error (description in e-text) (60) - ASN.1 unexpected field number 
    at sun.security.krb5.KrbApRep.(KrbApRep.java:126) 
    at sun.security.krb5.KrbApRep.(KrbApRep.java:102) 
    at sun.security.krb5.KrbApRep.(KrbApRep.java:75) 
    at sun.security.jgss.krb5.AcceptSecContextToken.(AcceptSecContextToken.java:89) 
    at sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:696) 
    ... 16 more 
Caused by: KrbException: Identifier doesn't match expected value (906) 
    at sun.security.krb5.internal.APRep.init(APRep.java:92) 
    at sun.security.krb5.internal.APRep.(APRep.java:75) 
    at sun.security.krb5.KrbApRep.(KrbApRep.java:116) 
    ... 20 more

我使用的是Java 7的，但有一个在使用上没有问题另外一个产生。有没有办法用jvm正确读取票证（请参阅jdk的kinit，也不要创建正确的票证）

来源

2017-02-23 albfan

我分享这段代码一直在为我工作。你有没有设置kerberos缓存文件的位置？

OracleDriver driver = new OracleDriver(); 
Properties prop = new Properties(); 

prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_SERVICES, 
    "("+AnoServices.AUTHENTICATION_KERBEROS5+")"); 
prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_KRB5_MUTUAL, 
    "true");  

/* If you get the following error [Unable to obtain Principal Name for 
* authentication] although you know that you have the right TGT in your 
* credential cache, then it's probably because the JVM can't locate your 
* cache. 
* For example, here my credential cache is 
*  C:\Documents and Settings\Jean de Lavarene\krb5cc 
* because when I run klist I get the following: 
* > ./klist 
* Ticket cache: FILE:C:\Documents and Settings\Jean de Lavarene\krb5cc 
* Default principal: [email protected] 
* 
* Valid starting  Expires   Service principal 
* 06/21/16 13:23:02 06/21/16 23:23:02 krbtgt/[email protected] 
* renew until 06/21/16 13:23:02 
* This isn't the default location, so I need to provide the location. Note 
* that the default location on windows is "C:\Documents and Settings\krb5cc_username". 
*/ 
prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_KRB5_CC_NAME, 
    "C:\\Documents and Settings\\Jean de Lavarene\\krb5cc"); 
Connection conn = driver.connect(url,prop); 
String auth = ((OracleConnection)conn).getAuthenticationAdaptorName(); 
System.out.println("Authentication adaptor="+auth);

来源

2017-02-23 19:30:49

我有缓存添加（正如我说的，它从它读取凭据正确）您是否使用此代码对甲骨文11或更低？ oracle 12需要自己实现kinit（okinit） – albfan

这是11.2版本的Oracle数据库。我会尝试使用12。 –

JDBC的Kerberos甲骨文认证

回答

相关问题