Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I have the Kerberos autentication on lunix working well but I can't configure the database to authenticate the users with Kerberos 5. I followed the official instructions on Configuring Kerberos Authentication. However I'm struck with this error.

The okinit and oklist work. But when I try to connect with "sqlplus /@orcl" it gives me this error:

ERROR:
ORA-12638: Credential retrieval failed

Can anyone help me?

Environment information:

  • Oracle Database 12c: with multitenent support.
  • Red Hat Enterprise Linux Server release 6.4 (Santiago) - Kernel: 2.6.32-358.18.1.el6.x86_64. The log in is made with Kerberos.

The content of relevant files are here:

sql.ora

# sqlnet.ora Network Configuration File: ../network/admin/sqlnet.ora
# Generated by Oracle configuration tools.

SQLNET.AUTHENTICATION_SERVICES= (BEQ, KERBEROS5)

SQLNET.KERBEROS5_KEYTAB = /etc/oracle.keytab.03.27.14
SQLNET.KERBEROS5_REALMS = /etc/krb5.realms
SQLNET.KERBEROS5_CC_NAME = /tmp/krb5cc
SQLNET.KERBEROS5_CONF = /etc/krb5.conf
SQLNET.KERBEROS5_CONF_MIT = TRUE
SQLNET.AUTHENTICATION_KERBEROS5_SERVICE = orcl.my-machine.my-domain
SQLNET.KERBEROS5_CLOCKSKEW=6000

NAMES.DIRECTORY_PATH= (TNSNAMES,EZCONNECT)

TRACE_LEVEL_SERVER = ADMIN
TRACE_LEVEL_CLIENT = ADMIN
TRACE_LEVEL_LISTENER = ADMIN

krb5.conf

#File modified by ipa-client-install

includedir /var/lib/sss/pubconf/krb5.include.d/

[libdefaults]
  default_realm = MY-DOMAIN
  dns_lookup_realm = false
  dns_lookup_kdc = false
  rdns = false
  ticket_lifetime = 24h
  forwardable = yes

[realms]
  MY.DOMAIN = {
    kdc = kdc-server.my-domain:88
    master_kdc = kdc-server.my-domain:88
    admin_server = kdc-server.my-domain:749
    default_domain = my-domain
    pkinit_anchors = FILE:/etc/ipa/ca.crt
  }

[domain_realm]
  .my-domain = MY-DOMAIN
  my-domain = MY-DOMAIN

krb5.realms
my-domain MY-DOMAIN

tnsnames.ora

# tnsnames.ora Network Configuration File: ../network/admin/tnsnames.ora
# Generated by Oracle configuration tools.
ORCL =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = my-machine.my-domain)(PORT = 1521))
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = orcl.my-domain)
    )
  )

In addition, I saw in the kerberos KDC log that the request of sqlplus /@orcl was very strange:

Mar 27 15:15:43 kdc-server.my-domain krb5kdc[2715](info): TGS_REQ (4 etypes {18 17 16 23}) 128.122.72.166: PROCESS_TGS: authtime 0,  <unknown client> for <unknown server>, Incorrect net address
Mar 27 15:15:43 kdc-server.my-domain krb5kdc[2714](info): TGS_REQ (4 etypes {18 17 16 23}) 128.122.72.166: PROCESS_TGS: authtime 0,  <unknown client> for <unknown server>, Incorrect net address
share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.