Learning Visually with Examples [Electronic resources] نسخه متنی

10.2. Authentication

Authentication is the process of validating a supplied user ID and password against a security facility. This authentication occurs when you try to connect to a database or attach to an instance. The security facility is external to DB2; user IDs and passwords are not stored in a DB2 server. Authentication can occur at any of the following:

• At a DB2 server ( Figure 10.1, Instance 1)

• At a DB2 client (Figure 10.1, Instance 2)

• Using a customized loadable library via Generic Security Service (GSS) (Figure 10.1, Instance 3)

• At a Kerberos security service (Figure 10.1, Instance 4)

The authentication process also determines which operating system groups the user belongs to. Group membership lookup is essential because it lets users inherit certain authorities or privileges through groups.

The following sections describe how to configure the authentication type by using configuration parameters at the DB2 server and at the client respectively. The combination of the client and server authentication configuration determines where and how the authentication will take place (the authentication method).

10.2.1. Configuring the Authentication Type at a DB2 Server

To configure the authentication type at a DB2 server, you use the Database Manager (DBM) Configuration parameter AUTHENTICATION. If you are not already familiar with DBM Configuration parameters, refer to Chapter 5, Understanding the DB2 Environment, DB2 Instances, and Databases. For completeness, we are including the command here to display the current DBM parameter settings:

get dbm cfg 

From the output, locate the following line where the authentication type is specified:

Database manager authentication        (AUTHENTICATION) = SERVER

SERVER is the default authentication type of an instance. Figure 10.2 shows this authentication type.

To change the value to the KERBEROS authentication type, for example, use this DB2 command:

update dbm cfg using authentication KERBEROS 

Alternatively, you can use the Control Center to make this change. Chapter 4, Using the DB2 Tools, describes the Control Center in detail.

Table 10.1 summarizes the values the AUTHENTICATION parameter accepts.

The output of the

get dbm cfg command includes another authentication-related parameter, called server connection authentication (SRVCON_AUTH):

Server Connection Authentication          (SRVCON_AUTH) = NOT_SPECIFIED

This parameter sets the authentication type at the DB2 server for incoming database connections. Note that only database connections evaluate the value of this parameter. Explicit instance attachment and operations that require implicit instance attachment still use AUTHENTICATION to resolve the authentication type.

These examples show how to implicitly attach to an instance:

update dbm cfg 
create database SAMPLE 

By default, SRVCON_AUTH has a value of NOT_SPECIFIED. In this case, the value of AUTHENTICATION is used instead.

10.2.2. Configuring the Authentication Type at a DB2 Client

When a client is configured to connect to a database, you need to catalog the node and the database. The

catalog database command has an option called AUTHENTICATION that allows you to indicate the authentication type to be used when connecting to the specified database from a DB2 client as shown in Figure 10.3.

Figure 10.4 illustrates the syntax of the

catalog database command.

Figure 10.4. Syntax of the CATALOG DATABASE command

>>-CATALOG--+-DATABASE-+--database-name--+-----------+---------->
'-DB-------'                 '-AS--alias-'
>--+-------------------+---------------------------------------->
+-ON--+-path--+-----+
|     '-drive-'     |
'-AT NODE--nodename-'
>--+--------------------------------------------------------------+-->
'-AUTHENTICATION--+-SERVER-----------------------------------+-'
+-CLIENT-----------------------------------+
+-SERVER_ENCRYPT---------------------------+
+-KERBEROS TARGET PRINCIPAL--principalname-+
+-SQL_AUTHENTICATION_DATAENC---------------+
+-SQL_AUTHENTICATION_DATAENC_CMP-----------+
'-GSSPLUGIN--------------------------------'
>--+------------------------+----------------------------------><
'-WITH--"comment-string"-'

The authentication type SERVER is the default. To change this setting, explicitly specify the AUTHENTICATION keyword along with one of the supported values shown in Table 10.2. The following is an example of using GSSPLUGIN authentication.

catalog db sample at node dbsrv authentication gssplugin 

10.2.3. Authenticating Users at the DB2 Server

As mentioned earlier, authenticating a user and the associated password at the DB2 server is the default behavior. The DBM configuration parameter at the server and the authentication option in the database directory entry are both set to SERVER. DB2 does not maintain any user and password information. This implies that the user ID and password pair must be defined in the security facility built in the operating system of the server. Figure 10.5 demonstrates a few scenarios of server authentication.

NOTE

As long as the database server authentication type is set to SERVER, authentication will always take place at the server.

In Scenario A, A1 issues a

CONNECT statement to connect to the SAMPLE database that is remotely located in the

dbsrv DB2 server. The user ID

bob and the password

bobpass are also provided. This pair of information is validated by the DB2 server security facility at A2. Once validated,

bob is connected to SAMPLE in A3 provided that he has the appropriate CONNECT privilege (privileges are discussed later in this chapter).

Scenario B uses the same environment except that no user ID and password are provided in the

CONNECT statement. When a remote database connection is requested, it is mandatory to supply a user ID and password. Therefore, the

CONNECT statement specified in B1 fails.

Scenarios A and B are both remote requests. It is also very common to make local database connections from the DB2 server itself. Scenario C demonstrates such a request. Since you must have already logged into the server console with a valid user ID and password, it is not necessary to supply a user ID and password in the

CONNECT statement at C1. If you choose to connect to the database with a different user ID, then you need to issue the

CONNECT statement with the user ID and password you wish as shown in A1.

The SERVER_ENCRYPT authentication type behaves exactly the same as SERVER authentication except that both the user ID and password are encrypted.

10.2.4. Authenticating Users with the Kerberos Security Service

Kerberos is a network authentication protocol that employs secret-key cryptography to provide strong authentication for client/server applications. By using an encrypted key, Kerberos makes single sign-on to a remote DB2 server possible. Refer to Figure 10.6 to see how Kerberos authentication works with DB2.

update dbm cfg using group_plugin mygrplib