search

OpenLiberty / open-liberty

Open Liberty is a highly composable, fast to start, dynamic application server runtime environment
https://openliberty.io
Eclipse Public License 2.0
1.16k stars 599 forks source link

Liberty support for kerberos authentication using Datasources #9008

Closed atosak closed 4 years ago

atosak commented 5 years ago

devWorks RFE 97557 When JDBC/JCA code was ported to Liberty, the code for supporting kerberos authentication on a DataSource was not completed. Traditional WAS supports this for both sqlserver and db2 JDBC drivers using two very different mechanisms (the former involves credentials being placed on the thread, the latter using typical driver properties). This feature will require work from the security squad to get the GSSCredentials into the Subject for the sqlserver driver and to potentially extend their existing kerb FAT to support this, so we'll need to consider that during prioritization. Based on requirements and feedback we've gotten, we need to support SQLServer, Db2 and Oracle on Liberty. For Liberty we'll address continuous testing with containerized envs for the 3 databases.

UFO link: https://ibm.box.com/s/tdmbjmkrtdtvt44s63bgo9r7lpvftjbm

atosak commented 4 years ago

List of Steps to complete or get approvals / sign-offs for Onboarding to the Liberty release (GM date)

Instructions:

TARGET COMPLETION DATE Before Development Starts or 8 weeks before Onboarding

cthigh commented 4 years ago

Notes from the UFO review meeting on June 16th. Mark Swatosh

Page 10 - Question - Why 5 in the name? Answer: Kerberos convention. Consistent with other Kerbersose naming. Krb5 around for a long time - no version 6.

cthigh commented 4 years ago

Recording file UFO-OL9008-Kerberos_using_datasources-20200616.mp4 added to this box folder: https://ibm.box.com/s/bhel8ue58hncxxk9qqlu1zsf32dw973y

frowe commented 4 years ago

@samwatibm May I get approvals for both accessibility and globalization? There is no user interface for this feature and the messages files are back from translation.

samwatibm commented 4 years ago

@frowe It's @steven1046 that does accessibility approvals. For globalization, can you confirm the translations were done in the prior iteration? 20.0.0.11 translations are NOT back yet.

frowe commented 4 years ago

@samwatibm Yes, message files were updated some time ago.

frowe commented 4 years ago

@hanczaryk Can I get SVT approval for this feature? Originally, we said in the UFO that we'd need SVT to execute a test on MS SQLServer since kerberos auth is performed via AD on Windows, and AD isn't available in a container that was suitable for test container env of FAT. We went ahead and set this up ourselves and executed the FATs, so we no longer need SVT to do so, and I've updated the UFO to indicate this change.

donbourne commented 4 years ago

Serviceability Approval Comment - Please answer the following questions for serviceability approval:

  1. WAD -- does the WAD identify the most likely problems customers will see and identify how the feature will enable them to diagnose and solve those problems without resorting to raising a PMR? Have these issues been addressed in the implementation?

  2. Test and Demo -- As part of the serviceability process we're asking feature teams to test and analyze common problem paths for serviceability and demo those problem paths to someone not involved in the development of the feature (eg. L2, test team, or another development team).
    a) What problem paths were tested and demonstrated? b) Who did you demo to? c) Do the people you demo'd to agree that the serviceability of the demonstrated problem scenarios is sufficient to avoid PMRs for any problems customers are likely to encounter, or that L2 should be able to quickly address those problems without need to engage L3?

  3. SVT -- SVT team is often the first team to try new features and often encounters problems setting up and using them. Note that we're not expecting SVT to do full serviceability testing -- just to sign-off on the serviceability of the problem paths they encountered. a) Who conducted SVT tests for this feature? b) Do they agree that the serviceability of the problems they encountered is sufficient to avoid PMRs, or that L2 should be able to quickly address those problems without need to engage L3?

  4. Which L2 / L3 queues will handle PMRs for this feature? Ensure they are present in the contact reference file and in the queue contact summary, and that the respective L2/L3 teams know they are supporting it. Ask Don Bourne if you need links or more info.

  5. Does this feature add any new metrics or emit any new JSON events? If yes, have you updated the JMX metrics reference list / Metrics reference list / JSON log events reference list in the Open Liberty docs?

aguibert commented 4 years ago

  1. Yes

  2. Test And demo 2.A. What scenarios were demo'd?

    • Sceanrio 1: User configures <kerberos keytab="/does/not/exist"/> Outcome: Liberty emits the following error message: CWWKS4345E: The [keytab] attribute from the element is configured to a file that does not exist at: /does/not/exist
    • Scenario 2: User configures <kerberos configFile="/does/not/exist"/> Outcome: Liberty emits the following error message: CWWKS4345E: The [configFile] attribute from the element is configured to a file that does not exist at: /does/not/exist NOTE: For scenario 1/2, we will output an INFO level messag saying for the discovered keytab and configFile such as: CWWKS4346I: The Kerberos component is configured to use a keytab file located at /path/to/krb5.keytab CWWKS4346I: The Kerberos component is configured to use a conf file located at /path/to/krb5.conf
    • Scenario 3: User configures conflicting values for the Kerberos keytab in the element and the element 
      <kerberos configFile="/first/path.conf"/>
<spnego   krb5Config="/second/path.conf"/>

      Outcome: Liberty emits the following error message: CWWKS4323E: The [keytab] attribute from the element conflicts with the [krb5Keytab] attribute from the element. Specify a value only on either the or the element, not on both elements. It is suggested to specify the value only on the element.

    • Scenario 4: User configures conflicting values for the Kerberos conf file in the element and the element Outcome: Liberty emits the following error message: CWWKS4323E: The [configFile] attribute from the element conflicts with the [krb5Config] attribute from the element. Specify a value only on either the or the element, not on both elements. It is suggested to specify the value only on the element.
    • Scenario 5: User has misconfigured their Kerberos conf file, keytab, or backend database. Outcome: Liberty does not directly read the Kerberos conf file, keytab, or backend database configuration. Any invalid configurations in these categories will be raised by the code that is repsonsible for parsing and acting upon the configuration.
    • In the case of conf/keytab this is the Kerberos JDK APIs.
    • In the case of the backend database this would be the JDBC driver surfacing some form of SQLException, usually with a nested LoginException.
    • Scenario 6: User configures <authData> with 'user' instead of 'krb5Principal' 
      <authData user="me" password="foo"/>
<authData krb5Principal="me@EXAMPLE.COM" password="foo"/>

      Outcome A: If user has also configured 'password', then the authData would be used as a normal authData with basic user/password. Outcome B: If no 'password' is configured, then Liberty emits the following error message: CWWKS1301E: A configuration error has occurred. The attribute password must be defined.

    • Scenario 7: User configures an XA-capable datasource to use SPNEGO authentication. Since SPNEGO requires manual input from the user, XA recovery would not be able to authenticate a new connection if one was needed for an XA recovery. Outcome: Liberty emits the following warning upon obtaining a connection using SPNEGO auth on an XA-capable datasource: J2CA0695W: A connection request for XA resource jdbc/mySpnegoDS was made using SPNEGO authentication, but no recovery auth data alias was configured. The XA resource is not able to participate in automated XA recovery unless a recovery auth data alias is configured.
    • Scenario 8: User attempts to use Kerberos authentication for a DB type that is not supported (i.e. anything other than Oracle, DB2, SQLServer and PostgreSQL) Outcome: Liberty emits the following warning: DSRA9543W: The Application Server does not support Kerberos against the backend database that is being used. No user name and password will be used to get a connection.

2.B. Demo attendees: Fred Rowe, Jim Stephens, Kyle Aure, Mark Swatosh, Nathan Rauh 2.C. yes

  1. No SVT for this feature

  2. Problems with connection pooling will go to WAS L3: JCA, Connection Management. Problems related to Kerberos configuration or obtaining Kerberos tickets will go to WAS L3: Core Security.

  3. No new metrics.

KyleAure commented 4 years ago

Skills transfer (STE) document uploaded to IBM internal box folder here: https://ibm.box.com/s/t5hwxy559ibaddyxtfj8d467d8tbdac5

frowe commented 4 years ago

@jhanders34 Can we get perf approval for this feature?

aguibert commented 4 years ago

For reference here is the content we will be adding for documentation: https://github.com/OpenLiberty/docs/issues/2460

chirp1 commented 4 years ago

@frowe @aguibert Hi! The documentation update might occur after the code is released. Therefore, ensure that the blog post for the feature has enough information so that a customer can use the feature.

frowe commented 4 years ago

RFE closed.