17.10 - Example: Using tdgssauth to Debug Kerberos - Advanced SQL Engine - Teradata Database

Teradata Vantage™ - Advanced SQL Engine Security Administration

Product
Advanced SQL Engine
Teradata Database
Release Number
17.10
Release Date
July 2021
Content Type
Administration
Security
Publication ID
B035-1100-171K
Language
English (United States)

The example shows how to use tdgssauth to debug a Kerberos configuration:

$ kinit jdoe
Password for jdoe@EXAMPLE.COM: 

$ tdgssauth -m KRB5 -n TERADATA/dbc1.example.com -i 10.0.1.195
                        Status: authenticated, not authorized
                 Database user: jdoe [permanent user]
         Authenticating domain: EXAMPLE.COM
     Actual mechanism employed: KRB5 [OID 1.2.840.113554.1.2.2]

 Security context capabilities: mutual authentication
                                confidentiality
                                integrity
                                protection ready
                                exportable security context

 Minimum quality of protection: none
                       Options: none

The example first uses kinit to establish a credential for user jdoe in the default domain (example.com in this case).

The next command is the tdgssauth command specifying the KRB5 mechanism (with the -m option), the service principal name consisting of the string “TERADATA/” followed by the fully qualified primary DNS name of the node being tested (-n option) and the IP address of the client (the –i option).

If you omit the –i option, you get the following output:

$ kinit jdoe
Password for jdoe@EXAMPLE.COM: 

$ tdgssauth -m KRB5 -n TERADATA/dbc1.example.com
                        Status: authenticated, not authorized
                 Database user: jdoe [permanent user]
         Authenticating domain: EXAMPLE.COM
     Actual mechanism employed: KRB5 [OID 1.2.840.113554.1.2.2]

 Security context capabilities: mutual authentication
                                confidentiality
                                integrity
                                protection ready
                                exportable security context

*** WARNING: Policy checks will not be made; IP address and/or user name was not specified.
***          Please include -i and -u options if policy checks are to be made.