Applications Systems

Configure DPA to use Kerberos instead of NTLM to authenticate the DPA server

This article provides instructions for configuring DPA to use Kerberos instead of NTLM. By default, DPA uses NTLM to authenticate the DPA server to monitored database instances.

First published date

10/30/2018 2:34 PM

Last published date

9/20/2022 6:54 PM

Overview

By default, DPA uses NTLM to authenticate the DPA server to monitored database instances. To configure DPA to use Kerberos instead of NTLM, complete the following tasks.

SolarWinds allows you to configure DPA to use Kerberos. However, SolarWinds Support does not provide configuration assistance.

Product section

Database Performance Analyzer

Resolution

Prerequisites

The database instance must already be registered for monitoring in DPA.
You have not set up DPA for SSO via browser.

Steps

Task 1: Set up a Kerberos configuration file on the DPA server

First determine if a Kerberos configuration file already exists on the DPA server. Look for the following are standard file names.

OPERATING SYSTEM	PATH AND FILE NAME
Solaris	`/etc/krb5/krb5.conf`
Windows	`C:\Windows\krb5.ini`
Linux	`/etc/krb5.conf`

If you do not have a Kerberos configuration file on the DPA server, complete the following steps to create one.

In a text editor, create a new file and copy the following text to use as a template:

# Set defaults
[libdefaults]
    default_realm = {REALM NAME}
    default_tkt_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
    default_tgs_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
    forwardable=true
 
# Define where to find the kerberos server for a particular realm
[realms]
{REALM NAME} = {
    kdc = {ActiveDirectoryServerName.domain.com}
    default_domain = {domain.com}
}
 
# Map subdomains and domain names to Kerberos realm names.
# Individual host names may be specified. Domain suffixes may be
# specified with a leading period and will apply to all host
# names ending in that suffix.
[domain_realm]
    {domain.com} = {REALM NAME}
    {.domain.com} = {REALM NAME}
 
[logging]
#    kdc = CONSOLE
#    kdc = SYSLOG:INFO
#    admin_server = FILE:=/var/kadm5.log

Change the values surrounded by braces: {REALM NAME}, {ActiveDirectoryServerName.domain.com}, and {domain.com}.

To determine the Realm Name, run the following command on your Active Directory server:

ksetup

A typical value for REALM.NAME is your company's domain, such as YOURCOMPANY.COM.

The Realm Name must be specified in uppercase.
Save the file with the path and file name specified in the table above.

Task 2: Create a service account

Ask your Active Directory administrator to create a service account in Active Directory. A service account is similar to a regular domain user account, but the password should be set to Never Expire, and the user is not required to change the password on the next login.

Later in this article, this user is referred to as {Service Account}.
Configure this user in SQL Server to have sufficient permissions to SQL Server permissions for DPA monitoring .

Later in this article, the computer name is referred to as {SQL Server name} and the SQL Server port is referred to as {SQL Server port}.
On the domain controller, verify that SQL server has registered itself correctly:
1. Run this command:
  
  setspn -L {SQL Server name}
2. Verify that the following are included in the SPNs:
  - MSSQLSvc/{SQL Server Name}.{Fully Qualified Domain Name}
  - MSSQLSvc/{SQL Server Name}.{Fully Qualified Domain Name}:{SQL Server port}
3. If you do not see them, add them manually by running the following commands:
  
  setspn MSSQLSvc/{SQL Server Name}.{Fully Qualified Domain Name} {SQL Server Name}
  
  setspn MSSQLSvc/{SQL Server Name}.{Fully Qualified Domain Name}:{SQL Server port} {SQL Server Name}

Task 3: Build the ignite.keytab file

Generate the keytab file that the DPA server will use to authenticate itself to the domain controller. This file contains the private key for the service account and should be protected accordingly.

Choose a {Service account} login name that can be used as the SPN (service principal name). This name cannot conflict with anything already registered in AD as an SPN.

This name will be referred to as {Service Account Login}.

To generate the file, run the following command from your Active Directory server on a single line:

ktpass /out .\ignite.keytab /mapuser {Service Account}@{Fully Qualified Domain Name} /princ {Service Account Login}@{REALM NAME} /pass {Service Account Password} /ptype KRB5_NT_PRINCIPAL /crypto ALL

Notes:

/princ The value for the /princ parameter is case-sensitive.

{encryption type}

Example values for {encryption type} are:

ALL
RC4-HMAC-NT
AES128-SHA1

If you use AES128-SHA1 encryption, be sure that "This account supports AES 128 bit encryption" is selected for the user account.

By default, the files bundled in the Java JRE enforce a restriction that limits the maximum key length to 128 bits. To use AES256 encryption, you must install the JCE Unlimited Strength Jurisdiction Policy Files.

Move the keytab file to the DPA server.
- Do not put the file in a directory inside of the DPA installation directory structure, so you will not have to change paths if you move the DPA installation directory.
- If your server already has a keytab file, you may want to merge the ignite.keytab file with the existing one.
- For UNIX, keytab files are typically stored in /etc/krb5.keytab.

Task 4: Create the login.conf file

In a text editor, create a file with the following content:

com.sun.security.jgss.krb5.initiate {
   com.sun.security.auth.module.Krb5LoginModule required
   useTicketCache=false
   doNotPrompt=true
   useKeyTab=true
   keyTab="{Path to ignite.keytab}"
   principal="{Service Account Login}@{REALM NAME}"
   storeKey=true
   debug=false;
};

Save the file with the following name and location:

<DPA_install_directory>/iwc/tomcat/ignite_config/login.conf

Task 5: Edit the system.properties file

Add the following lines to your system.properties file:

javax.security.auth.useSubjectCredsOnly=false
java.security.auth.login.config={Path to login.conf}
com.confio.ws.ldap.sso.krbConfLocation={Path to krb5.conf}

Task 6: Restart DPA

Restart DPA to apply the changes in the configuration files.

On Windows, stop and restart the Ignite PI Server service.
On Linux, run the following commands from the DPA directory:
- shutdown.sh
- startup.sh

Task 7: Update connection information

In DPA, update the connection information for each monitored database instance that you want to authenticate using Kerberos.

Click Options > Update Connection Info.
Select a database instance and click Next.
In Connection Properties, enter the following:

integratedSecurity=true;useKerberos=true

You may leave the Monitoring User and Password values as they are, or set them to anything non-empty. These values will not be used for authentication.
Click Next, and then click Update Connection.

Common issues

The computer name is not properly resolved to the IP address

Use nslookup to ensure that both the computer name and its IP address are resolved correctly.

While building the ignite.keytab file, an error is returned

Verify that no error was returned during keytab generation, and that the SPN was set correctly.

The following is an example of ktpass output with errors:

C:\Users\Administrator>ktpass /out .\DPA_user.keytab /mapuser DPA_user@ignite.local /princ MSSQLSvc/JJ-W-NINER.ignite.local@IGNITE.LOCAL /pass Confio123 /ptype KRB5 _NT_PRINCIPAL /crypto ALL
DsCrackNames returned 0x5 in the name entry for DPA_user@ignite.local.
ktpass:failed getting target domain for specified user.

The following is an example of correct ktpass output:

C:\Users\Administrator>ktpass /out .\DPA_user.keytab /mapuser DPA_user@ignite.local /princ dpa/kerberos@IGNITE.LOCAL /pass Confio123 /ptype KRB5_NT_PRINCIPAL /crypto ALL
Targeting domain controller: {ActiveDirectoryServerName.domain.com}
Successfully mapped dpa/kerberos to DPA_user.
Password successfully set!
Key created.
Key created.
Key created.
Key created.
Key created.
Output keytab to .\DPA_user.keytab:
Keytab version: 0x502
keysize 52 dpa/kerberos@IGNITE.LOCAL ptype 1 (KRB5_NT_PRINCIPAL) vno 20 etype 0x1 (DES-CBC-CRC) keylength 8 (0xc808a145ea01731c)
keysize 52 dpa/kerberos@IGNITE.LOCAL ptype 1 (KRB5_NT_PRINCIPAL) vno 20 etype 0x3 (DES-CBC-MD5) keylength 8 (0xc808a145ea01731c)
keysize 60 dpa/kerberos@IGNITE.LOCAL ptype 1 (KRB5_NT_PRINCIPAL) vno 20 etype 0x17 (RC4-HMAC) keylength 16 (0xdeeb603a6c4d7bf8a30e485abfc6155c)
keysize 76 dpa/kerberos@IGNITE.LOCAL ptype 1 (KRB5_NT_PRINCIPAL) vno 20 etype 0x12 (AES256-SHA1) keylength 32 (0xdb8cf130ca48925b4b1fb26f982429d720f1d6665cf431a6ae1c4d8fe4029440)
keysize 60 dpa/kerberos@IGNITE.LOCAL ptype 1 (KRB5_NT_PRINCIPAL) vno 20 etype 0x11 (AES128-SHA1) keylength 16 (0x39fbfbbb4a11a126eea073da8d3eb627)

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.