Configuring the Multi-Domain forest feature

The default behavior of the JDBC driver with SSO is to pass only username and strip off the domain part. For example, if the ticket is generated for ‘user1@domain1.com’, while connecting to Netezza PDA, the JDBC driver only sends ‘user1’ and removes the part after the ‘@’ symbol. Netezza PDA supports multi-domain forest feature since 7.2.1.3-P1. This feature needs full username (user1@domain1.com in the above example) to be passed from application code.

If the following conditions hold true, then the user must enable enableUserDomain option:
  • Netezza PDA is running in Kerberos authentication mode
  • Domain forest feature is enabled (enable_username_domain is set true)
  • User is using single sign-on through JDBC application (krbSSODelegation option in connection URL or “Kerberos SSO Delegation” in DSN)
Methods to set this option are:
  • In DSN: select User Domain Forest checkbox under SSL options. This option takes effect only if option Kerberos SSO Delegation is checked.
  • In JAVA application code: Set enableUserDomain=true in connection URL.