Db2

Db2

Where DBAs and data experts come together to stop operating and start innovating. Connect, share, and shape the AI era with us.


#Data


#Data
 View Only

An Introduction to Kerberos for Db2 and Db2 Warehouse for Red Hat OpenShift and Kubernetes

By Tara Acheson posted 02/25/26 07:18 AM

  

Db2U 12.1.2.0 introduced Kerberos support, expanding the security options available to Db2U users. This provides an alternative authentication mechanism for organizations that require single sign-on (SSO) capabilities across their systems. 

Throughout this blog, the term Db2U refers to Db2 and Db2 Warehouse on Red Hat OpenShift and Kubernetes. 

 

In this blog, we provide: 

  • A brief overview of Kerberos and its benefits 

  • An explanation of how it works 

  • A real-world case study demonstrating Kerberos configuration using Active Directory  

 

What is Kerberos? 

Developed by MIT, Kerberos is a network authentication protocol that provides strong, mutual authentication for client/server applications using secret-key cryptography. 

 Kerberos uses a ticket-based system to provide secure identification and facilitate encrypted communication between nodes on an unsecure network. It is widely used in industries such as banking, finance, and government where strong security controls are critical.  

 

3 key benefits: 

Enhanced Security 

  • Provides strong mutual authentication between clients and servers, significantly reducing the risk of credential theft or replay attacks. 

Single Sign On  

  • Enables users to securely access multiple services without repeatedly entering passwords or certificates. 

Integration with Active Directory / external LDAP  

  • Supports centralized user and group management 

 

How Kerberos Works (Brief Overview):  

Kerberos operates on a client/server model and relies on a trusted third party, known as the Key Distribution Center (KDC). 

  • The client authenticates to the KDC and receives a timestamped, encrypted Ticket Granting Ticket (TGT). 

  • The client uses the TGT to request access to a specific service from the Ticket Granting Service (TGS) - a component of the KDC, using the Service Principal Name (SPN). 

  • If the TGT is valid and the client has permission for the service, a Service Ticket (ST) and session keys are issued. 

  • The client then presents the ST to the target service (e.g., Db2 server) for secure access. 

All communications between the KDC, client and service are protected using symmetric-key cryptography. 

 

Kerberos in the Db2U Environment 

Within the Db2U environment, clients must provide their own Key Distribution Center (KDC) to enable Kerberos authentication. By providing a valid Kerberos configuration file (krb5.conf) and deploying service principal keytabs to each Db2 pod, users can securely access the database using ticket-based authentication. 

  

Service principals are registered on the KDC for each Db2 pod and are used to grant access to the corresponding database on the Db2 server. In addition, non-service users can also be registered on the KDC. These users obtain Kerberos tickets on the client side and authenticate securely to Db2 from external client machines. 

  

Prerequisites 

Before configuring Kerberos authentication in Db2U, ensure the following components are in place: 

  • A working KDC (MIT Kerberos or Active Directory) 

  • A valid krb5.conf file defining the Kerberos realm and KDC connection details 

  • Service principal keytabs, one per Db2 pod, following the naming convention:  

db2inst1/<fully-qualified-hostname>@REALM 

Where <fully-qualified-hostname> is the output of the following command run within the Db2 pod: 

hostname -f 

And “REALM” is the Kerberos realm configured for your environment (see the section krb5.conf for more information). 

  • A deployed Db2 Custom Resource (CR) in Ready State  

  • Kerberos is configured post deployment and can be applied to existing instances. 

More detail on these components can be found in the Official MIT Kerberos documentation. 

  

Case Study Setup  

A customer required Kerberos authentication for single sign-on (SSO) through a JDBC client (DBeaver), using Active Directory as their KDC. 

This section outlines their successful configuration, covering:  

  • Kerberos configuration (krb5.conf) 

  • Service principals and keytabs 

  •  Safely testing the configuration before making it permanent 

  •  Applying permanent configuration changes to the Db2U Custom Resource 

  • Common issues and troubleshooting guidance 

  • Backing out of a Kerberos configuration if required 

Environment Details Used in This Example 

The following fictional (but representative) environment is used throughout the examples below. Replace these values with those applicable to your deployment. 

  • Active Directory KDC: ads-fictional-server.ads.ibm.blog.ie
  • Db2U namespace/project: db2 
  • Db2uInstance Custom Resource: db2u-cr  
  • Pod naming convention: c-db2u-cr-db2u- (i.e. primary/catalog Db2 pod/ pod 0 is: c-db2u-cr-db2u-0) 
  • Database name: BLUDB 

All commands and configuration examples assume this environment. 

 

krb5.conf  

Below is the configuration file used in the setup. Realm names are fictional but follow standard Kerberos and Active Directory conventions. 

[logging]  
default = FILE:/var/log/krb5libs.log  
kdc = FILE:/var/log/krb5kdc.log  
admin_server = FILE:/var/log/kadmind.log  
[libdefaults]  
default_realm = ADS.IBM.BLOG.IE 
dns_lookup_realm = true  
dns_lookup_kdc = true  
ticket_lifetime = 24h 
renew_lifetime = 7d  
forwardable = yes  
ignore_acceptor_hostname = true  
[realms]  
ADS.IBM.BLOG.IE = {  
  kdc = ads-fictional-server.ads.ibm.blog.ie:88 
  admin_server = ads-fictional-server.ads.ibm.blog.ie 
  default_domain = ads.ibm.blog.ie 
}  
[domain_realm]  
.blog.ie = ADS.IBM.BLOG.IE 
blog.ie = ADS.IBM.BLOG.IE 
.local = ADS.IBM.BLOG.IE 
local = ADS.IBM.BLOG.IE 

  

Configuration Breakdown 

Logging 

  • Defines log file locations for the Kerberos client libraries, KDC, and admin server. 

Libdefaults 

  • Defines global Kerberos client behavior. 
  • The default_realm specifies which Kerberos realm to use for authentication (e.g., ADS.IBM.BLOG.IE). This realm name must match a realm defined in the [realms] section below.

Realms  

  • Maps each Kerberos realm to its KDC and admin servers. Each realm represents a separate authentication domain. 
  • The default port for Kerberos communication is 88.  

Domain_realm 

  • Maps hostnames or domains to Kerberos realms. This ensures clients in certain DNS domains use the correct realm for authentication. 
  • .local (which is the internal domain name of the db2 pods) mapping is required here when connecting via a JDBC client. 

 

Creating the krb5 ConfigMap 

In the project/namespace where the db2uinstance CR is deployed, use the krb5.conf file to create a configmap: 

oc project db2 
oc create configmap db2u-krb5-config-cm --from-file=/etc/krb5.conf 

 

Service Principals & keytabs  

Each Db2 pod must have its own service principal (SP) and keytab. The keytab should include the fully qualified hostname, following the below format: 

db2inst1/$(hostname -f)@REALM 

For the primary pod in this example, the resulting SPN is: 

db2inst1/c-db2u-cr-db2u-0.c-db2u-cr-db2u-internal.db2.svc.cluster.local@ADS.IBM.BLOG.IE 

  

Active Directory–Specific Considerations 

The client in this case study uses Active Directory as their KDC server.  

  • Windows systems use krb5.ini, this file must be renamed “krb5.conf” before use with a Db2 deployment. 

  • Ensure all service principals and users exist in Active Directory before generating keytabs. 

  • Active Directory usernames cannot contain / or @, so a mapped username must be used for Kerberos service principals. 

 

Verify the target user exists on Active Directory: 

Get-ADUser -Filter {UserPrincipalName -eq "USERNAME@DOMAIN.COM"} 

 

To create the principal and keytab for a given user, following this example template:  

ktpass /princ USERNAME@DOMAIN.COM /pass /mapuser /ptype KRB5_NT_PRINCIPAL /out

In this case study, our AD user for pod-0 is  db2inst1_c-db2u-cr-db2u-0

This username is intentionally kept as close as possible to the SPN while remaining compliant with Active Directory naming restrictions and length limitations. 

 

Verify the user exists: 

Get-ADUser -Filter {UserPrincipalName -eq "db2inst1_c-db2u-cr-db2u-0@ads.ibm.blog.ie"} 

 

Create the service principal and keytab: 

ktpass /princ db2inst1/c-db2u-cr-db2u-0.c-db2u-cr-db2u-internal.db2.svc.cluster.local@ADS.IBM.BLOG.IE /mapuser db2inst1_c-db2u-cr-db2u-0@ads.ibm.blog.ie /pass /ptype KRB5_NT_PRINCIPAL /out db2inst1-pod0.keytab /crypto AES256-SHA1  

This command generates a keytab file named: “db2inst1-pod0.keytab”.  

 

Note: The “/crypto AES256-SHA1" option enforces AES 256-bit encryption for the keytab and is recommended for Db2U Kerberos authentication. Ensure the associated Active Directory user account is configured to support Kerberos AES 256-bit encryption; otherwise, Active Directory may not generate or accept AES256 keys even when explicitly requested. 

 

Active Directory maps the user: 

db2inst1_c-db2u-cr-db2u-0@ads.ibm.blog.ie 

to the Kerberos service principal referenced in the keytab: 

db2inst1/c-db2u-cr-db2u-0.c-db2u-cr-db2u-internal.db2.svc.cluster.local@ADS.IBM.BLOG.IE 

Important: When using the /pass option, the password specified must exactly match the Active Directory user password. 

 

Once you have created keytabs for each service principal (i.e. one for each pod), you can proceed with deploying them to the pods and completing the Kerberos configuration. 

 

Placing Keytabs on Pod  

Each keytab must be placed on its corresponding Db2 pod. This is a multi-step process and should be performed carefully, as copying a keytab to the wrong pod will result in Kerberos authentication failures. 

 

Step 1: Copy Keytabs to Shared Storage 

First, copy each keytab file to the shared mount point on the head pod (here c-db2u-cr-db2u-0). This directory exists outside the containers and is shared across the Db2 deployment. 

At this stage, ensure each keytab has a unique, pod-specific filename (for example, -pod0, -pod1) to prevent accidental mix-ups. 

oc cp db2inst1-pod0.keytab c-db2u-cr-db2u-0:/mnt/blumeta0/db2inst1-pod0.keytab 

 

Step 2: Move the Keytab into the Correct Pod

Exec into the target pod and move the appropriate keytab from the shared directory into the pod-specific Kerberos directory. 

The correct destination path inside the pod is: 

${SYSCFGDIR}/kerberos/${POD_NAME} 

Both ${SYSCFGDIR} and ${POD_NAME} are predefined environment variables within the pod. 

oc exec -it c-db2u-cr-db2u-0 -- /bin/bash 

su – db2inst1 

sudo cp /mnt/blumeta0/db2inst1-pod0.keytab ${SYSCFGDIR}/kerberos/${POD_NAME}/db2inst1.keytab 

Important: Each keytab must be renamed to db2inst1.keytab once in the respective directory, as this filename is required by the Db2 Kerberos configuration. 

 

Avoiding Errors 

Before proceeding to the next pod or step, confirm that: 

  • The keytab is present in the correct directory 

  • The filename is db2inst1.keytab 

  • Each pod contains only its own keytab 

This can be done by following “Testing before making Permanent Changes”. This validation helps prevent subtle configuration issues later during Kerberos authentication testing. 

 

Testing before making Permanent Changes  

The following steps allow you to validate the krb5.conf file and service keytabs before applying permanent configuration changes.  

Although these steps are not strictly necessary, this validation is strongly recommended, as once registry values, dbmConfig settings, and ConfigMaps are applied via the Db2U Custom Resource, the configuration becomes persistent and more difficult to roll back. This is particularly important for large clusters with many pods.  

This should be done before "Patching the Custom Resource".

 

Preparation 

  1. Place the krb5.conf at /etc/krb5.conf on the head pod. This temporarily overrides the default example configuration and allows you to test Kerberos behavior without making permanent changes. This is not persistent and will return to default if the pod restarts.  

  1. Place the keytab for this pod in the correct location by following the steps in the section "Placing Keytabs on Pod". 

 

Validation Steps 

Log in to the pod as the db2inst1 user and perform the following checks to confirm that: 

  • The KDC is reachable 

  • The correct Service Principal Name (SPN) is used 

  • The keytab contains the expected principal 

  • A valid Kerberos ticket can be obtained 

 

1. Verify the Keytab Contents 

klist -kt ${SYSCFGDIR}/kerberos/c-db2u-cr-db2u-0/db2inst1.keytab 

Example output: 

Keytab name: FILE:db2inst1.keytab 
KVNO Timestamp      Principal 
---- ------------------- ------------------------------------------------------ 
12 01/01/1970 00:00:00 db2inst1/c-db2u-cr-db2u-0.c-db2u-cr-db2u.internal.db2.svc.cluster.local@ADS.IBM.BLOG.IE 

Confirm that the principal listed exactly matches the expected SPN for the pod. 

 

2. Obtain a Kerberos Ticket Using the Keytab 

kinit -kt ${SYSCFGDIR}/kerberos/c-db2u-cr-db2u-0/db2inst1.keytab  db2inst1/c-db2u-cr-db2u-0.c-db2u-cr-db2u.internal.db2.svc.cluster.local@ADS.IBM.BLOG.IE 

If successful, no output is displayed.  

 

3. Verify the Ticket Cache 

klist 

Example output: 

Ticket cache: FILE:/tmp/krb5cc_500 
Default principal: db2inst1/c-db2u-cr-db2u-0.c-db2u-cr-db2u.internal.db2.svc.cluster.local@ADS.IBM.BLOG.IE 
Valid starting       Expires              Service principal 
08/25/2025 09:04:57  08/25/2025 19:04:57  krbtgt/ ADS.IBM.BLOG.IE@ADS.IBM.BLOG.IE 
renew until 08/26/2025 09:04:57 

This confirms that the KDC has issued a valid Ticket Granting Ticket (TGT). 

Repeat steps 1–3 for each pod-specific keytab. 

 

Common Errors During Testing 

Failures at this stage typically indicate issues with authentication, SPN naming, or Kerberos configuration. 

 

SPN Naming Mismatch 

The most common issue is that the hostname used in the SPN does not match the pod’s fully qualified hostname.  

Verify the hostname inside the pod: 

hostname -f 

Ensure this value exactly matches the hostname used in: 

  • The service principal 

  • The keytab 

  • The kinit command 

 

Keytab Mapping Issues 

  • Each keytab must contain exactly one service principal 

  • Each Db2 pod must have its own keytab 

  • Keytabs must not be reused or shared across pods 

 

Patching the Custom Resource  

Apply the Custom Resource (CR) patch only after all of the following are true: 

  • Service keytabs have been placed in the correct pods 

  • The krb5.conf file has been validated 

  • Kerberos authentication succeeds using the manual validation steps 

Important: Once applied, these changes make the Kerberos configuration persistent. 

 

Creating the Patch File 

Save the following as “patch_configurations.json” on the Red Hat OpenShift client/bastion node: 

{"spec": { 
"environment": { 
  "instance": { 
    "registry": { 
      "DB2AUTH": "OSAUTHDB,ALLOW_LOCAL_FALLBACK", 
      "DB2ENVLIST": "KRB5_KTNAME" 
    }, 
    "dbmConfig": { 
      "SRVCON_GSSPLUGIN_LIST": "IBMkrb5", 
      "SRVCON_AUTH": "KRB_SERVER_ENCRYPT", 
      "CLNT_KRB_PLUGIN": "IBMkrb5", 
      "AUTHENTICATION": "SERVER_ENCRYPT" 
    } 
  } 
}, 
"volumeSources": [ 
  { 
    "visibility": [ 
      "db2u" 
    ], 
    "volumeSource": { 
      "configMap": { 
        "name": "db2u-krb5-config-cm" 
      } 
    } 
  } 
] 
} } 

 

Applying the Patch 

Apply the patch to the deployed Db2uInstance Custom Resource: 

oc patch db2 db2u-cr --type=merge --patch "$(cat patch_configurations.json)" 

This operation first applies the instance configuration changes (which take a minute or two) and then causes all the pods to be restarted. 

Kerberos configuration is complete once all pods return to a “Ready” state. 

 

Common Issues After Applying the Patch 

Pods Repeatedly Restarting or Stuck in Not Ready 

This behavior usually indicates an error in one or more permanent configuration values, such as: 

  • Incorrect registry parameters 

  • Invalid dbmConfig entries 

  • Incorrect volumeSources configuration or ConfigMap reference 

If manual Kerberos testing was successful prior to patching, the problem is typically in the CR patch itself. Compare the applied Custom Resource with patch_configurations.json and correct any discrepancies. 

 

Pods Ready but Kerberos Authentication Fails 

If pods are running but Kerberos authentication does not work, check the following: 

  • Keytabs are correct and unique for each pod 

  • Keytab filenames and locations are correct 

  • The keytab contains the correct service principal 

  • Realm and domain mappings in krb5.conf are accurate 

Verify each pod independently, as keytab or SPN issues may affect only a subset of pods. 

 

Backing Out of Kerberos Configuration 

Kerberos authentication can be disabled on an existing deployment by updating the Custom Resource and reverting the Kerberos-related database manager and registry settings. 

 

Step 1: Update the Database Manager Configuration 

Edit the Db2U Custom Resource and update the following properties under the instance.dbmConfig block: 

instance:  
  dbmConfig:  
    AUTHENTICATION: "SERVER_ENCRYPT" 
    CLNT_KRB_PLUGIN: "NULL"  
    SRVCON_AUTH: "NOT_SPECIFIED"  
    SRVCON_GSSPLUGIN_LIST: "NULL" 

These settings remove Kerberos-based authentication from the server-side connection configuration, ensuring that incoming connections are no longer authenticated using Kerberos. 

 

Step 2: Remove Kerberos Registry Settings 

Under the instance.registry block, delete the following properties: 

DB2AUTH: OSAUTHDB,ALLOW_LOCAL_FALLBACK  
DB2ENVLIST: KRB5_KTNAME 

 

Step 3: Save and Apply the Changes 

Save the updated Custom Resource. 

During this process: 

  • The Db2U instance transitions to a “NotReady” state 

  • The pods are restarted 

  • The instance then returns to a “Ready” state 

Once the instance is Ready again, Kerberos authentication is fully disabled, and Db2U reverts to non-Kerberos authentication behavior. 

Important: Do not remove the volumeSource for the db2u-krb5-config-cm ConfigMap when disabling Kerberos.  

Optionally, keytabs can be removed from under /mnt/blumeta0/SystemConfig/kerberos. 

 

Key Terms 

Service Principal (SP) 

An identity representing a specific Db2 service. In this blog, the database pod running on the Db2U server is treated as the service principal. Each service principal must be registered with the KDC and associated with a unique keytab. 

Service Principal Name (SPN) 

A Kerberos-formatted string that uniquely identifies a service instance. In Db2U, the SPN includes the Db2 instance name and the fully qualified hostname of the pod. 

Key Distribution Center (KDC) 

A trusted authentication service that issues Kerberos tickets and validates user and service credentials. Examples include MIT Kerberos and Active Directory. 

Ticket Granting Ticket (TGT) 

A timestamped, encrypted Kerberos ticket issued by the KDC after initial authentication. The TGT is used by clients to request service tickets. 

Client / User 

The entity (a person, application, or service) requesting access to network resources. In a Db2U environment, this may be a database user, a JDBC application, or another service connecting to Db2. 

Realm 

An administrative domain under which Kerberos authentication is managed. A realm defines the scope of trust and typically maps to an organization or DNS domain (for example, an Active Directory domain). 

Keytab File 

A secure file containing one or more Kerberos principals and their encrypted secret keys. Keytabs allow services, such as Db2 pods, to authenticate to the KDC without manual password entry. 

For more detailed information, refer to MIT Kerberos Documentation.

About the Authors


Tara Acheson is a Software Developer in Hybrid Data Management at IBM’s Ireland Lab,
focusing on containerized Db2 offerings. She holds two master’s degrees from University
College Dublin in Computer Science and Scientific Research. Tara can be reached at
tara.acheson@ibm.com

 
John Bell is a Distinguished Engineer and Data Warehouse Architect at IBM, with over 25 years
of experience in data warehousing and analytics. He has played a pivotal role in developing
IBM's data warehouse solutions, including IBM’s Power10 Private Cloud Rack reference
architecture. He can be reached at john.bell@ibm.com.

 
Austin Clifford is a Senior Technical Staff Member in Hybrid Data Management based in the
Ireland Lab. He has worked with database, data lake and warehousing technologies for more
than two decades. In 2012, Austin led the team to achieve a Guinness World Record for the
Largest Data Warehouse, a record that IBM held for two years. Austin has authored numerous
papers and patents, advises clients on data warehouse, analytics and containerization best
practices and is a regular speaker at technical conferences. He can be reached at
acliffor@ie.ibm.com.

 

0 comments
62 views

Permalink