Supporting configuration files

The gateway package bundles supporting configuration files to hold properties for secure JDBC connection modes, such as SSL, Kerberos, and data integrity.

Table 1. Supporting configuration files 
Configuration file Purpose

jdbc_conn.properties

JDBC connection properties for the database connection.

Configure the path to this file using the Gate.Jdbc.JdbcPropsFile property.

jdbc_javasys.properties

Java system properties working in conjunction with other JDBC connection parameters to establish a database connection.

Configure the path to this file using the Gate.Jdbc.JavaSystemPropsFile property.

File format

The supporting configuration files should be in key-value pair format, namely: key=value

The gateway ignores lines starting with #.

Date security

The gateway can process value field in the form of encrypted data.

Use nco_aes_crypt with AES_FIPS algorithm to encrypt configuration value. When deployed, ConfigCryptoAlg and ConfigKeyFile must contain AES_FIPS and the key file respectively.

Environment Variables

The gateway can expand defined environment variables in value fields.

Properties for the various database connection modes

Table 2. Oracle database 
Mode JDBC Properties Java System properties

SSL

 
oracle.net.authentication_services
 
javax.net.ssl.keyStore
javax.net.ssl.keyStoreType
javax.net.ssl.keyStorePassword
javax.net.ssl.trustStore
javax.net.ssl.trustStoreType
javax.net.ssl.trustStorePassword

oracle.net.ssl_server_dn_match
oracle.net.ssl_cipher_suites
oracle.net.tns_admin

Kerberos

 
oracle.net.authentication_services
oracle.net.kerberos5_cc_name
oracle.net.kerberos5_mutual_authentication

java.security.krb5.conf

Data Integrity

 
oracle.net.crypto_checksum_client
oracle.net.crypto_checksum_types_client
oracle.net.encryption_client
oracle.net.encryption_types_client

None
Note: For Kerberos-SSL-combined connections, oracle.net.authentication_services must contain SSL and KERBEROS5, for example:

oracle.net.authentication_services=(KERBEROS5, SSL)

Table 3. IBM DB2
Mode JDBC connection properties Java System properties

Kerberos

 
kerberosServerPrincipal
securityMechanism=11
 
java.security.auth.login.config

SSL

None

 
javax.net.ssl.trustStore
javax.net.ssl.trustStoreType
javax.net.ssl.trustStorePassword

Configure the following parameters to enable IBM DB2 Kerberos-authenticated connections:

java.security.auth.login.config=$OMNIHOME/gates/jdbc/jaas.conf

kerberosServerPrincipal=<serverPrincipal>@<REALM>

securityMechanism=11 (11 is the value for Kerberos security).

Notes:

kerberosServerPrincipal must be the server principal in KRB5_KTNAME.

securityMechanism=11 denotes using Kerberos authentication.

A sample of Java Authentication and Authorization Service (JAAS) Client configuration is available in the $OMNIHOME/gates/jdbc/jaas.conf file.

Configurations for passing credentials from the gateway to the DB2 Kerberos service

There are two ways in which the gateway can pass credentials to the DB2 Kerberos service:

  • Using the Kerberos cache file
  • Not using the Kerberos cache file

Configurations for both methods are described in the following table.

Table 4. Configurations for passing credentials to the DB2 Kerberos service
Using Kerberos Cache Files Not Using Kerberos Cache Files 
JaasClient{         
      com.ibm.security.auth.module.Krb5LoginModule required
      principal=<kerberos_principal>
      credsType=initiator
      useCcache=<kerberos_cache_file>
     debug=true
};

Configure the principal and useCache fields accordingly.

As the login credentials are obtained from Kerberos cache, the corresponding gateway properties must be empty. Namely:

Gate.Jdbc.Username: ''
Gate.Jdbc.Password: ''
 
JaasClient{
      com.ibm.security.auth.module.Krb5LoginModule required
      debug=true
      useDefaultCcache=false;
};

The absence of the Kerberos cache requires the gateway properties to have the login credentials specified in the following properties:

Gate.Jdbc.Username: '<principal>'
Gate.Jdbc.Password: '<password>'

Deploying the gateway with non-IBM Java

On secure connections, some vendor JDBC drivers may require certain class packages tied to specific brand and version of Java.

For example, in Kerberos mode, the Oracle JDBC driver invokes the methods from the sun.security.krb5.* classes, which are available only in Oracle Java.

Consult the driver user guide or the vendor support to ascertain the Java requirement.

To run the gateway using non-IBM Java, perform the steps accordingly.

UNIX:

Update the NCO_GATEWAY_JRE environment variable with the Java home directory.

Note: NCO_GATEWAY_JRE is referenced in nco_g_jdbc.env.