From ecf23e65dc2b570f942ba1df3eecb4e26552172b Mon Sep 17 00:00:00 2001 From: Ivan Brezina Date: Fri, 18 Apr 2025 19:01:31 +0200 Subject: [PATCH 1/5] Use Windows SSPI API to generate Kerberos ticket for JDBC SSO --- .../GSSAuthSSPIConnectSample.java | 135 ++++++++++++++++++ 1 file changed, 135 insertions(+) create mode 100644 java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java diff --git a/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java b/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java new file mode 100644 index 00000000..577f8472 --- /dev/null +++ b/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java @@ -0,0 +1,135 @@ +/* + Copyright (c) 2025, Oracle and/or its affiliates. + + This software is dual-licensed to you under the Universal Permissive License + (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License + 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose + either license. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +*/ + +/* + DESCRIPTION + This sample shows how to use SSO uging Kerberos in Windows. + Since WIN2019 allowtgtsessionkey registry key is not available + and the only option how to acces Kerberos TGT is via Java's SSPI bridge. + + PREREQUISITIES + - Confirure Kerberos authentication for Oracle database as describe here: + https://blog.pythian.com/part-4-implementing-oracle-database-single-sign-on-using-kerberos-active-directory-and-oracle-cmu/ + + - Create DB user identified extenally as: + CREATE USER IDENTIFIED EXTERNALLY AS '@'; + GRANT CONNECT TO ; + + - Check your Windows has generater Kerb tickets during logon + klist tgt + klist + + - Connect to database using this program. + Java's SSPI bridge(sspi_bridge.dll) should be used to renerate required Kerberos ticket for SSO. + + NOTES + Use JDK 13 and above on Windows. Check presence of sspi_bridge.dll in JDK intalation + + MODIFIED (MM/DD/YY) + ibre5041 18/04/2025 - Creation +*/ + +package kerb; + +import java.sql.ResultSet; +import java.sql.Statement; + +import java.util.Properties; + +import org.ietf.jgss.GSSCredential; +import org.ietf.jgss.GSSManager; +import org.ietf.jgss.GSSName; +import org.ietf.jgss.Oid; + +import oracle.jdbc.OracleConnection; +import oracle.jdbc.OracleConnectionBuilder; +import oracle.jdbc.pool.OracleDataSource; +import oracle.net.ano.AnoServices; + +public class GSSAuthSSPIConnectSample { + // This should return your AD LOGIN + String username = System.getProperty("user.name"); + // This should return your AD KERBEROS REALM + String domain = System.getenv("USERDNSDOMAIN"); + // Your Database JDBC URL here + String url = "jdbc:oracle:thin:@//dbhost1:1521/DBSERVICE"; + + public GSSAuthSSPIConnectSample() { + } + + public void doit() throws Exception + { + // Use env variable SSPI_BRIDGE_TRACE=1 in order to trace Java's sspi_bridge.dll plugin + // export SSPI_BRIDGE_TRACE=1 + + // Various useful tracing options + // System.setProperty("oracle.jdbc.Trace", "true"); + // System.setProperty("sun.security.krb5.debug", "true"); + // System.setProperty("sun.security.spnego.debug", "true"); + // System.setProperty("sun.security.jgss.debug", "true"); + // System.setProperty("java.security.debug", "true"); + // System.setProperty("sun.security.nativegss.debug", "true"); + + // Activate SSPI bridge, your Kerberos token will be created using Windows SSPI API + System.setProperty("sun.security.jgss.native", "true"); + System.setProperty("sun.security.jgss.lib", "sspi_bridge.dll"); + + Oid krb5Oid = new Oid("1.2.840.113554.1.2.2"); + GSSManager manager = GSSManager.getInstance(); + + GSSName srcName = manager.createName(username + "@" + domain, GSSName.NT_USER_NAME); + GSSCredential cred = manager.createCredential(srcName + , GSSCredential.DEFAULT_LIFETIME + , krb5Oid, GSSCredential.INITIATE_ONLY); + + Properties prop = new Properties(); + prop.setProperty(AnoServices.AUTHENTICATION_PROPERTY_SERVICES, "(" + AnoServices.AUTHENTICATION_KERBEROS5 + ")"); + prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_SERVICES,"( " + AnoServices.AUTHENTICATION_KERBEROS5 + " )"); + prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_KRB5_MUTUAL, "true"); + + OracleDataSource ods = new OracleDataSource(); + ods.setURL(url); + ods.setConnectionProperties(prop); + OracleConnectionBuilder builder = ods.createConnectionBuilder(); + OracleConnection conn = builder.gssCredential(cred).build(); + + String auth = ((OracleConnection)conn).getAuthenticationAdaptorName(); + System.out.println("Authentication adaptor:"+auth); + + String sql = "select user from dual"; + Statement stmt = conn.createStatement(); + ResultSet rs = stmt.executeQuery(sql); + while (rs.next()) + System.out.println("whoami: " + rs.getString(1)); + + conn.close(); + } + + public static void main(String[] args) { + GSSAuthSSPIConnectSample test = new GSSAuthSSPIConnectSample(); + try { + test.doit(); + System.out.println("Done"); + } catch (Exception e) { + e.printStackTrace(); + } + } +} From 892a113475d8d9b3d3136bcebc1f6f181d2ad925 Mon Sep 17 00:00:00 2001 From: Ivan Brezina Date: Wed, 30 Apr 2025 13:12:07 +0200 Subject: [PATCH 2/5] Use 2 space characters for indentation --- .../GSSAuthSSPIConnectSample.java | 134 +++++++++--------- 1 file changed, 67 insertions(+), 67 deletions(-) diff --git a/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java b/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java index 577f8472..d437f84b 100644 --- a/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java +++ b/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java @@ -43,8 +43,8 @@ NOTES Use JDK 13 and above on Windows. Check presence of sspi_bridge.dll in JDK intalation - MODIFIED (MM/DD/YY) - ibre5041 18/04/2025 - Creation + MODIFIED (MM/DD/YY) + ibre5041 18/04/2025 - Creation */ package kerb; @@ -65,71 +65,71 @@ import oracle.net.ano.AnoServices; public class GSSAuthSSPIConnectSample { - // This should return your AD LOGIN - String username = System.getProperty("user.name"); - // This should return your AD KERBEROS REALM - String domain = System.getenv("USERDNSDOMAIN"); - // Your Database JDBC URL here - String url = "jdbc:oracle:thin:@//dbhost1:1521/DBSERVICE"; - - public GSSAuthSSPIConnectSample() { - } - - public void doit() throws Exception - { - // Use env variable SSPI_BRIDGE_TRACE=1 in order to trace Java's sspi_bridge.dll plugin - // export SSPI_BRIDGE_TRACE=1 - - // Various useful tracing options - // System.setProperty("oracle.jdbc.Trace", "true"); - // System.setProperty("sun.security.krb5.debug", "true"); - // System.setProperty("sun.security.spnego.debug", "true"); - // System.setProperty("sun.security.jgss.debug", "true"); - // System.setProperty("java.security.debug", "true"); - // System.setProperty("sun.security.nativegss.debug", "true"); - - // Activate SSPI bridge, your Kerberos token will be created using Windows SSPI API - System.setProperty("sun.security.jgss.native", "true"); - System.setProperty("sun.security.jgss.lib", "sspi_bridge.dll"); - - Oid krb5Oid = new Oid("1.2.840.113554.1.2.2"); - GSSManager manager = GSSManager.getInstance(); - - GSSName srcName = manager.createName(username + "@" + domain, GSSName.NT_USER_NAME); - GSSCredential cred = manager.createCredential(srcName - , GSSCredential.DEFAULT_LIFETIME - , krb5Oid, GSSCredential.INITIATE_ONLY); - - Properties prop = new Properties(); - prop.setProperty(AnoServices.AUTHENTICATION_PROPERTY_SERVICES, "(" + AnoServices.AUTHENTICATION_KERBEROS5 + ")"); - prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_SERVICES,"( " + AnoServices.AUTHENTICATION_KERBEROS5 + " )"); - prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_KRB5_MUTUAL, "true"); - - OracleDataSource ods = new OracleDataSource(); - ods.setURL(url); - ods.setConnectionProperties(prop); - OracleConnectionBuilder builder = ods.createConnectionBuilder(); - OracleConnection conn = builder.gssCredential(cred).build(); + // This should return your AD LOGIN + String username = System.getProperty("user.name"); + // This should return your AD KERBEROS REALM + String domain = System.getenv("USERDNSDOMAIN"); + // Your Database JDBC URL here + String url = "jdbc:oracle:thin:@//dbhost1:1521/DBSERVICE"; + + public GSSAuthSSPIConnectSample() { + } + + public void doit() throws Exception + { + // Use env variable SSPI_BRIDGE_TRACE=1 in order to trace Java's sspi_bridge.dll plugin + // export SSPI_BRIDGE_TRACE=1 + + // Various useful tracing options + // System.setProperty("oracle.jdbc.Trace", "true"); + // System.setProperty("sun.security.krb5.debug", "true"); + // System.setProperty("sun.security.spnego.debug", "true"); + // System.setProperty("sun.security.jgss.debug", "true"); + // System.setProperty("java.security.debug", "true"); + // System.setProperty("sun.security.nativegss.debug", "true"); + + // Activate SSPI bridge, your Kerberos token will be created using Windows SSPI API + System.setProperty("sun.security.jgss.native", "true"); + System.setProperty("sun.security.jgss.lib", "sspi_bridge.dll"); + + Oid krb5Oid = new Oid("1.2.840.113554.1.2.2"); + GSSManager manager = GSSManager.getInstance(); + + GSSName srcName = manager.createName(username + "@" + domain, GSSName.NT_USER_NAME); + GSSCredential cred = manager.createCredential(srcName + , GSSCredential.DEFAULT_LIFETIME + , krb5Oid, GSSCredential.INITIATE_ONLY); + + Properties prop = new Properties(); + prop.setProperty(AnoServices.AUTHENTICATION_PROPERTY_SERVICES, "(" + AnoServices.AUTHENTICATION_KERBEROS5 + ")"); + prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_SERVICES,"( " + AnoServices.AUTHENTICATION_KERBEROS5 + " )"); + prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_KRB5_MUTUAL, "true"); + + OracleDataSource ods = new OracleDataSource(); + ods.setURL(url); + ods.setConnectionProperties(prop); + OracleConnectionBuilder builder = ods.createConnectionBuilder(); + OracleConnection conn = builder.gssCredential(cred).build(); - String auth = ((OracleConnection)conn).getAuthenticationAdaptorName(); - System.out.println("Authentication adaptor:"+auth); - - String sql = "select user from dual"; - Statement stmt = conn.createStatement(); - ResultSet rs = stmt.executeQuery(sql); - while (rs.next()) - System.out.println("whoami: " + rs.getString(1)); - - conn.close(); - } - - public static void main(String[] args) { - GSSAuthSSPIConnectSample test = new GSSAuthSSPIConnectSample(); - try { - test.doit(); - System.out.println("Done"); - } catch (Exception e) { - e.printStackTrace(); - } + String auth = ((OracleConnection)conn).getAuthenticationAdaptorName(); + System.out.println("Authentication adaptor:"+auth); + + String sql = "select user from dual"; + Statement stmt = conn.createStatement(); + ResultSet rs = stmt.executeQuery(sql); + while (rs.next()) + System.out.println("whoami: " + rs.getString(1)); + + conn.close(); + } + + public static void main(String[] args) { + GSSAuthSSPIConnectSample test = new GSSAuthSSPIConnectSample(); + try { + test.doit(); + System.out.println("Done"); + } catch (Exception e) { + e.printStackTrace(); } + } } From 8a1ee91402fe67038ed18a85f42f08421e328b72 Mon Sep 17 00:00:00 2001 From: Ivan Brezina Date: Wed, 30 Apr 2025 13:18:09 +0200 Subject: [PATCH 3/5] Comment out setting sun.security.jgss.lib property, it is not needed anymore --- java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java b/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java index d437f84b..8e0c00ce 100644 --- a/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java +++ b/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java @@ -90,7 +90,8 @@ public void doit() throws Exception // Activate SSPI bridge, your Kerberos token will be created using Windows SSPI API System.setProperty("sun.security.jgss.native", "true"); - System.setProperty("sun.security.jgss.lib", "sspi_bridge.dll"); + // Uncomment this this line for JDK 11, for newer JDK versions this value should be default + // System.setProperty("sun.security.jgss.lib", "sspi_bridge.dll"); Oid krb5Oid = new Oid("1.2.840.113554.1.2.2"); GSSManager manager = GSSManager.getInstance(); From e476375ce0bc53b9a7b6d75f97cbfb8acc9e95af Mon Sep 17 00:00:00 2001 From: Ivan Brezina Date: Wed, 30 Apr 2025 13:20:23 +0200 Subject: [PATCH 4/5] Use set insted of export on Windows --- java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java b/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java index 8e0c00ce..08e13ad3 100644 --- a/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java +++ b/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java @@ -78,7 +78,7 @@ public GSSAuthSSPIConnectSample() { public void doit() throws Exception { // Use env variable SSPI_BRIDGE_TRACE=1 in order to trace Java's sspi_bridge.dll plugin - // export SSPI_BRIDGE_TRACE=1 + // set SSPI_BRIDGE_TRACE=1 // Various useful tracing options // System.setProperty("oracle.jdbc.Trace", "true"); From f9230c85d58c1b4a391ac4f63ec2de756db199d4 Mon Sep 17 00:00:00 2001 From: Ivan Brezina Date: Thu, 1 May 2025 23:27:44 +0200 Subject: [PATCH 5/5] Typo fixes --- java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java b/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java index 08e13ad3..328685cf 100644 --- a/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java +++ b/java/jdbc/ConnectionSamples/GSSAuthSSPIConnectSample.java @@ -21,12 +21,12 @@ /* DESCRIPTION - This sample shows how to use SSO uging Kerberos in Windows. + This sample shows how to use SSO uging Kerberos on Windows. Since WIN2019 allowtgtsessionkey registry key is not available and the only option how to acces Kerberos TGT is via Java's SSPI bridge. PREREQUISITIES - - Confirure Kerberos authentication for Oracle database as describe here: + - Configure Kerberos authentication for Oracle database as described here: https://blog.pythian.com/part-4-implementing-oracle-database-single-sign-on-using-kerberos-active-directory-and-oracle-cmu/ - Create DB user identified extenally as: @@ -41,7 +41,7 @@ Java's SSPI bridge(sspi_bridge.dll) should be used to renerate required Kerberos ticket for SSO. NOTES - Use JDK 13 and above on Windows. Check presence of sspi_bridge.dll in JDK intalation + Use JDK 13 and above on Windows. Check presence of sspi_bridge.dll in JDK intalation. MODIFIED (MM/DD/YY) ibre5041 18/04/2025 - Creation