The Ultimate Guide to High Availability with MariaDB

Comments - Howto use kerberos (gssapi) authentication modules in free version of maxscale

5 years, 8 months ago Markus Mäkelä
Re: Howto use kerberos (gssapi) authentication modules in free version of maxscale

Try adding authenticator=GSSAPIAuth to the listeners and authenticator=GSSAPIBackendAuth to backend servers. Then follow the following document: https://mariadb.com/kb/en/mariadb-enterprise/mariadb-maxscale-22-gssapi-client-authenticator/

 
5 years, 8 months ago Christian Schmitt
Re: Howto use kerberos (gssapi) authentication modules in free version of maxscale

Thanks Markus for this comment, this was really helpful. After struggeling with some other issues related to IPv6 in maxscale, this almost works. Opening a connection a with a mysql-client, I now get a prompt, but receive some strange GSSAPI Errors in the MaxScale log:

error  : (14) GSSAPI Major Error: Unspecified GSS failure.  Minor code may provide more information
error  : (14) GSSAPI Minor Error: No Kerberos credentials available (default cache: KEYRING:session:maxscale)
error  : [mariadbbackend] Unable to write to backend 'server1' due to authentication failure. Server in state RUNNING SLAVE.
error  : (14) GSSAPI Major Error: Unspecified GSS failure.  Minor code may provide more information
error  : (14) GSSAPI Minor Error: No Kerberos credentials available (default cache: KEYRING:session:maxscale)
info   : Stopped Read-Write_Service client session [14]

Sending any command (i.e. show databases) in the client, I receive

ERROR 2003 (HY000): Authentication with backend failed. Session will be closed.

Is there anything I need to additionally configure on the maxscale?

Thanks, Christian

 
5 years, 8 months ago Markus Mäkelä
Re: Howto use kerberos (gssapi) authentication modules in free version of maxscale [Answer]

That is likely caused by an unconfigured Kerberos or a lack of a valid and active credentials (as stated in the error message). The steps described here should work: https://mariadb.com/kb/en/mariadb-enterprise/mariadb-maxscale-22-gssapi-client-authenticator/#preparing-the-gssapi-system

 
Content reproduced on this site is the property of its respective owners, and this content is not reviewed in advance by MariaDB. The views, information and opinions expressed by this content do not necessarily represent those of MariaDB or any other party.