Apache NIFI 1.9.2 Connecting to Oracle Using Kerberos

1
votes

Please bear with me - its a bit complicated.

The high level goal is to connect NIFI to an Oracle db service - but can only use Kerberos for authentication.

We are running Apache NIFI 1.9.2 and trying to connect to Oracle (using driver version 12.1) via a DBCPConnectionPool controller service. I have configured a KeytabCredentialService controller service and reference it in my DBCP controller service.

I am setting the Oracle driver class name to be "oracle.jdbc.driver.OracleDriver". Full configuration settings here.

When we enable the associated ExecuteSQL processor - we get an Oracle authentication error message.

ORA-01017 - invalid username/password; logon denied.

Full error here.

After some troubleshooting - it seems that the Oracle driver wrapped within NIFI's DBCP service is not even trying to use Kerberos at all.

Outside of NIFI, programmatically we would normally need to add in driver property CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_SERVICES to "turn on" the kerberos authentication feature, but there is no such option available to us when using NIFI's DBCP Controller service.

Does anyone have any ideas on how we might be able to properly enable Kerberos authentication on the Oracle driver via NIFI's DBCP controller service?

Any help or direction given will be greatly appreciated?

1
oracleapache-nifikerberos
Can you try adding that driver property in the JDBC URL you configure within the DBCPConnectionPool? Another option is to define a dynamic property on the controller service with the property name and value. These dynamic properties are evaluated at configuration time and injected into the connection by NiFi. - Andy
Thank you for responding. I've tried to add the properties in the JDBC url and adding it as a dynamic property and no luck. I think it has something to do with the fact that in the Oracle driver requires "more" in order to connect via Kerberos. Ive been looking at this link for the OracleConnection interface doc - and I don't think currently the DBCP service can handle the way Oracle handles Kerberos. - Tommy T
You can file a feature request Jira for the project here. I'm not 100% confident this can't be done right now through configuration, but we can definitely evaluate and make it easier. Oracle is harder to develop for/test with than the open source databases. - Andy

1 Answers

1
votes

I was able to figure how to "enable" Kerberos on the Oracle driver.

I set the dynamic properties below.

oracle.net.authentication_services = (KERBEROS5)

oracle.net.kerberos5_mutual_authentication = true

Thank you to those that responded.