Disclaimer #1: I’m not a ‘Kerberos Guy,’ and I’m sharing the work of others. I can however explain the mechanics and demonstrate what your rig should look like to get this working.
Disclaimer #2: This post assumes you have already successfully configured your Oracle Database to have Kerberos available for authenticating database users for making database connections. If you have not made it this far, I kindly suggest these Docs.
But it works in SQL*Plus…!
That’s cool that you have it working in SQLPlus. That means you have successfully configured the database for Kerberos authentication.
However, it doesn’t mean that you are able to connect with SQLcl or VS Code, just yet. Our Database Tools are generally developed with Java, either for the the full stack (SQLcl, ORDS, SQL Developer), or for the backend (SQL Developer Web, SQL Developer for VS Code, & various solutions and features in Oracle Cloud Infrastructure.
This means that for our tools to work with the database, this will will be happening via the JDBC driver. So we need to configure the JDBC connections such that they have all the Kerberos information required.
The two-sided JDBC coin
- Thin
- Thick aka Oracle JDBC OCI
“JDBC Thin” means that the only stack involved is what you get from the JDBC driver and associated libraries in your Java application, the JARs.
The benefit here is everything is self-contained, and not additional libraries are required to use any of the database features.
“JDBC Thick” means we’re also going to rely on resources found in an ORACLE_HOME or Oracle Client install (full or instant) to supplement the features provided by the JDBC driver. This is formally described as the JDBC Oracle Call Interface (OCI) driver.
The benefit here is obvious, more feature, but the downsides are:
- more dependencies, packaging, setup, configuration
- version conflicts – the driver doesn’t like working with clients of differing versions, sometimes even MINOR version deltas such as 23.6 vs 23.7
All of this to say…
You can absolutely use Kerberos with JDBC Thin – no client required!
In fact, our VS Code extension ONLY works with JDBC Thin. We’re using the latest 23ai JDBC driver, and this driver in fact includes ALL of the database features, so it negates any of the ‘more features’ argument that the Thick Client camp brings to the debate.
Just show us already!
Since I’m not a ‘Kerberos person,’ I normally send folks to blog posts others have written that show how to do this, OR I’ll toss them the JDBC docs, which has examples for configuring Kerberos for Java applications.
Boiling that down, I suggest folks look at the example Connection JDBC URLs used, and any of the connection properties being set.
The combination of these two sets of information, will provide the same information to the database as what would be defined in your classic Oracle Home/Client config…the stuff you used to get it working with SQL*Plus.
Now let’s look at how you would duplicate this rig in VS Code via our SQL Developer extension.
Create new connection, type: Custom JDBC
The other thing to take note here is that the user name is set to ‘/’ which basically tells the database, oh the Operating System is going to take care of that for us.
But we’re not done, not yet. We have those pesky ‘setProperty’ items above to account for, and we’re not going to ask you to mess with our Java code. In fact, we ask you NOT to mess with our Java code.
Instead, we give you an Advanced connections panel, where you can define these.
Click here, and then using the form fill out the required fields, which would look something like this:
And that’s IT. You’re good to go. Use the Test Connection button to make sure you’re ready to declare success.
And what about SQLcl?
Now, SQLcl running on its own will accomodate JDBC Thick connections, assuming your Oracle Client is compatible with the JDBC driver, but I would recommend again setting up the Thin Driver, so it will just always ‘work’ – even after upgrading SQLcl or your Client.
In SQLcl, we can put everything on the connection string itself. So let’s look at that and break it down.
sql -thin -kerberos -krb5_config C:\path\to\krb5.conf -krb5ccname C:\path\to\credentialCache /@ezconnect-string -thin : tells SQLcl to use the Thin driver
-kerberos : hey we’re in kerberos mode for auth
-krb5_config : tells SQL where it can find the local kerberos configuration information
-krb5ccname : where to find the Kerberos Credential Cache
Note we aren’t providing any username/password on the connection string, SQLcl sees the configuration settings and database you want to go to, and handles it via the Kerberos bits.
If you need help with Kerberos specific configurations…
Please open a Service Request with My Oracle Support. Our Database Tools support team has a few folks that deal with Kerberos on a regular basis and have a kerberos rig they can use internally – vs me, which I do NOT.
If you don’t have a My Oracle Support contract, then you can get help from the community via our Forums (SQL Developer | SQLcl | VS Code).
Summary
Yes, you can use Kerberos in our VS Code Extension, and all of our other tools, including SQLcl, WITHOUT setting up SQLPlus or an Oracle Client.
