Setting Up Kerberos Authentication

Enable Kerberos Authentication for a Mount Target 🔗

• Console
• CLI
• API

• 1. Open the navigation menu  and select Storage. Under File Storage, select Mount Targets.
  2. In the List scope section, under Compartment, select a compartment.
  3. Find the mount target that you're interested in, click the Actions menu (), and then click View details.
  4. Click the NFS tab to view or edit the existing NFS settings for the mount target.
  5. Next to Kerberos, click Manage.

  6. In the Manage Kerberos window, provide the following details:

     • Kerberos realm: Enter the Kerberos realm that this mount target joins.
     • In Keytab information section, provide the following details:
       • Select the Vault that contains the keytab secret you want to use.
       • Select the Keytab Secret.
       • Select the Current keytab Secret version and the Backup keytab Secret version.
       Caution
       
       Be sure to back up your vaults and keys. Deleting a vault and key otherwise means losing the ability to decrypt any resource or data that the key was used to encrypt. For more information, see Backing Up and Restoring Vaults and Keys.

  7. Click Validate keytab before enabling Kerberos to inspect the contents of the keytab.

     Caution
     
     An improperly configured keytab can cause NFS clients to lose access to file systems.
  8. Enable Kerberos: Enable this option to use Kerberos. See Using Kerberos Authentication for more information.
  9. Click Save.

• Use the oci fs mount-target create command with the --kerberos, --idmap-type, and --ldap-idmap options to create a mount target and provide Kerberos and LDAP details.

  Command

  CopyTry It

  oci fs mount-target create --availability-domain <availability_domain> --compartment-id <compartment_id> --subnet-id <subnet_id> --kerberos <file://krb.json> --ldap-idmap <file://ldap.json>

  Use the oci fs mount-target update command with the --kerberos, --idmap-type, and --ldap-idmap options to update an existing mount target with Kerberos and LDAP details.

  Command

  CopyTry It

  oci fs mount-target update --mount-target-id <mount_target_id> --kerberos <file://krb.json> --ldap-idmap <file://ldap.json>

  An example krb.json file follows:

  {
    "currentKeyTabSecretVersion": 1,
    "isKerberosEnabled": true,
    "kerberosRealm": "EXAMPLE.COM",
    "keyTabSecretId": "ocid1.vaultsecret.oc1.eu-frankfurt-1.exampleuniqueID"
  }

  An example ldap.json file follows:

  {
    "cacheLifetimeSeconds": 300,
    "cacheRefreshIntervalSeconds": 300,
    "groupSearchBase": "cn=accounts,dc=example,dc=com",
    "negativeCacheLifetimeSeconds": 300,
    "outboundConnector1Id": "ocid1.outboundconnector.oc1.exampleuniqueID",
    "outboundConnector2Id": "ocid1.outboundconnector.oc1.exampleuniqueID",
    "userSearchBase": "cn=accounts,dc=example,dc=com",
    "schemaType": "RFC2307"
  }

  Use the oci fs mount-target validate-key-tabs command to test the Kerberos keytab that the outbound connector associated with the mount target uses.

  Command

  CopyTry It

  oci fs mount-target validate-key-tabs --mount-target-id <mount_target_id>

  For a complete list of parameters and values for CLI commands, see the CLI Command Reference.

• Use CreateMountTarget or UpdateMountTarget with the kerberos, idMapType, and ldapIdmap options to create or update a mount target with LDAP and Kerberos details.

  Use ValidateKeyTabs to validate the Kerberos keytab associated with the mount target.

  For information about using the API and signing requests, see REST API documentation and Security Credentials. For information about SDKs, see SDKs and the CLI.