Kerberos Authentication Realm

A Kerberos realm performs Kerberos SSO authentication against one or more Kerberos KDCs. Unlike other realm types, Kerberos realm types are limited by the JVM to be singletons, because the JRE's Kerberos implementation uses JVM system properties for configuration. A given node engine can therefore use only one Kerberos realm. If there are multiple engines on a node, each engine can use a different Kerberos realm.

A Kerberos realm configuration is specified in the KerberosAuthenticationRealm root object of the security configuration type.

The JRE's Kerberos implementation uses file-based configuration. The various Kerberos file properties must exist on the node's file system or the Kerberos configuration does not activate.

Kerberos is only supported via the HTTP SPNEGO protocol; non-HTTP communication is not supported. Kerberos only supports authentication, not authorization. To support authorization a fallback realm must be specified to provide authorization services. Each Kerberos realm configuration must specify a fallback realm that is used for all authorization and for authentication from clients that are not using SPNEGO over HTTP. That fallback realm must exist when the Kerberos realm is activated or activation fails.

The following Kerberos Key Distribution Centers (KDC) are supported:

The following Kerberos clients are supported:

The KerberosAuthenticationRealm root configuration object defines Kerberos authentication for a node. There can only be a single KerberosAuthenticationRealm defined on a node.

name = "my.application"
version = "1.0.0"
type = "com.tibco.ep.dtm.configuration.node"
configuration =
{
    NodeDeploy =
    {
        nodes = 
        {
            "A.X" =
            {
                communication =
                {
                    administration =
                    {
                        address = "myhost.com" // FQDN
                        webServiceBindings =
                        {
                            admin =
                            {
                                authenticationRealmName = "kerberos-realm"
                            }
                        }
                    }
                }
            } 
        }
    }
}

Figure 1, “KerberosAuthenticationRealm relationships” shows the relationships to other configuration objects.

KerberosAuthenticationRealm relationships

A detailed description of the configuration object properties is in KerberosAuthenticationRealm object properties and a snippet for these properties is in Example 1, “KerberosAuthenticationRealm object snippet”.

name = "kerberos-authentication-realm"
version = "1.0.0"
type = "com.tibco.ep.dtm.configuration.security"
configuration =
{
    KerberosAuthenticationRealm =
    {
        name = "my-kerberos-authentication-realm"
        requireTrustedHostMembership = false
        fallbackAuthenticationRealmName = "my-local-realm"
        internalClientLoginConfigurationFile = "/opt/kerberos/client-configuration"
        internalClientKeytabFile = "/opt/kerberos/keytab/client"
        internalClientPrincipalName = "client-principal@ACME.COM"
        jaasDebug = false
        kerberosConfigurationFile = "/opt/kerberos/kerberos-configuration"
        serverKeytabFile = "/opt/kerberos/keytab/server"
        serverPrincipalName = "HTTP/my.host.com@ACME.COM"
        ticketCacheFile = "/opt/kerberos/ticket/cache/file"
    }
}