Important notes about Windows Authentication (via Kerberos) for MS SQL Server

If you use Windows Authentication (via Kerberos) for MS SQL Server, please note the following.

Prerequisites

  • You are using the Kerberos Version 5 protocol
  • Your MS SQL Server must be configured for Kerberos Authentication

To be noted for the database configuration in eperi sEcure Platform:

  • Username: <username>@<Kerberos Realm>, Example: max.mustermann@EXAMPLE.COM
    Important: The Kerberos Realm is case-sensitive! By default, it is uppercase, but it can be configured differently.

  • Password: The user's password according to Active Directory

  • Database Server: The FQDN of your MS SQL Server. The domain name must be configured in Kerberos.
    Note: By default, eperi sEcure Platform performs a DNS lookup based on the domain name, identifying, among other things, the domain name of the KDC and the Kerberos Realm.

Optionally, you can use your own Kerberos configuration file via the Java options:

Create a krb5.conf file according to the Kerberos standard. For details, see for example: https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html

Procedure, if you have installed eperi sEcure Platform via the automated installer:
  1. Place the krb5.conf file in the directory /etc/eperi/gateway/tomcat
  2. In the /etc/eperi/gateway/tomcat/javaopts file, add the following Java parameter:
    -Djava.security.krb5.conf=/etc/eperi/gateway/tomcat/krb5.conf
  3. Restart eperi sEcure Platform.

Procedure, if you have installed eperi sEcure Platform manually:

Integrate the krb5.conf file via appropriate Tomcat mechanisms (either via setenv.sh or through various init scripts that you use for service registration).