Tell me more ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.
up vote 0 down vote favorite

I am trying to setup Kerberos authentication for my Oracle database and I have a situation where I need to maintain different versions of sqlnet.ora for each kerberos user connection. My application is using OCI driver (a single unix process does more than one user connection to the same Oracle database). And I am not able switch sqlnet.ora between user connections using setenv(TNS_ADMIN) call programmatically. I am assuming once the contents of sqlnet.ora gets loaded to process, it remains unchanged for the rest of its life.

Is my case a practical one, has anyone encountered?

When it comes to kerberos, I am not sure why Oracle client restricts the sqlnet.ora to one principal kerberos user. Maybe Oracle does not have a clean support for kerberos as I dont see OCI API's?

Or can I just merge all the key tab files into one and maintain one version of sqlnet.ora? How will my connection string change from providing only tns_alias name? Should I also provide username when I merge all the keytab files? Please help

share|improve this question
What are you configuring in sqlnet.ora? – Colin 't Hart Apr 7 at 7:43
These are the parameters I am trying to configure. Each sqlnet.ora has different values for the following parameters. sqlnet.authentication_services=(kerberos5) sqlnet.kerberos5_conf=</somepath/krb5.conf.dev> sqlnet.kerberos5_keytab=/somepath/some.keytab sqlnet.kerberos5_conf_mit=true sqlnet.kerberos5_cc_name=/somepath/cache – Srivatsan Nallazhagappan Apr 8 at 18:42
Yes, it seems like each client can only be member of one Kerberos domain and that Oracle expects all clients and servers to be in the same domain. – Colin 't Hart Apr 9 at 7:52
If my client is using Oracle's OCI thick driver, the additional restriction to what you said) is, "each client can only be a one principal". There is a DIR cache feature present in MIT libraries that Oracle sqlnet or OCI does'nt seem to use (not mentioned anywhere in Oracle 11g documentation). – Srivatsan Nallazhagappan Apr 10 at 4:37

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.