|DB2 Universal Database currently supports the Kerberos security protocol as |a means to authenticate users in the non-DRDA environment. Since |DB2/390 V7.1 will start to support Kerberos security, DB2 Connect will |add DRDA AR functionality to allow the use of Kerberos authentication to |connect to DB2/390.
|The Kerberos authentication layer which handles the ticketing system is |integrated into the Win2K Active Directory mechanism. The client and |server sides of an application communicate with the Kerberos SSP (Security |Support Provider) client and server modules respectively. The Security |Support Provider Interface (SSPI) provides a high level interface to the |Kerberos SSP and other security protocols
|Communication protocol support
|For SNA connection, you must use SECURITY=NONE when cataloging the APPC |node
|Typical setup
|The procedure to configure DB2 to use Kerberos authentication involves |setting up the following: |
|In the simplest scenario, there is at least one KDC trust relationship to |configure, that is, the one between the KDC controlling the client |workstation, and the OS/390 system. OS/390 R10 provides Kerberos ticket |processing through its RACF facility which allows the host to act as an UNIX |KDC.
|DB2 Connect provides as usual the router functionality in the 3-tier |setting. It does not assume any role in authentication when Kerberos |security is used. Instead, it merely passes the client's security |token to DB2/390. Thus there is no need for the DB2 Connect gateway to |be a member of the client or the host's Kerberos realm.
|To use Kerberos, both the DB2 Connect gateway must catalog its connection |with authentication type KERBEROS. The client can either catalog with |authentication NOT_SPEC or Kerberos. Any other combinations of |authentication types on the client and the gateway results in sqlcode -1401 |(Authentication type mismatch).
|Downlevel compatibility
|DB2 requirements for Kerberos support: |
|DB2/390 also have a requirement to be run on OS/390 Version 2 Release 10 |or later. There are additional implied requirements on downlevel |DB2/390 systems when connecting from DB2 Connect Version 7.1 |clients. Although these DB2/390 systems do not support Kerberos, they |do not respond properly to unsupported DRDA SECMECs. To solve this |problem, apply the proper PTF: |