Seamless Kerberos connection on Windows

About this task

You need to run unica_kerbKeyGenRenew.bat script to obtain the Ticket for the Kerberos principal. The purpose of this script is to run continuously and :
  1. Renew the TGT before its renewable time.
  2. Regenerate the token before expiry.
By default, it renews the ticket every 24 hours and regenerates a new ticket after 7 days. You can also override the default setting for regenerating and renewing the tickets by setting environment variables.Prerequisite for running the Script
  1. Requires MIT Kerberos to be installed and configured.
  2. Keytab file is already present for the said principal.
  3. The following environment variables are set:
    1. TGT_EXPIRY_DAYS: number of days after which this TGT will expire, and can no longer be renewed (specify value in days)
    2. TGT_RENEWAL_HOURS: number of hours within which this TGT needs to be renewed (specify value in hours)
    3. KRB5CCNAME: path to the cache file
    4. KEYTAB_FILE_PATH: path to keytab file for this principal
  4. From command line run “Where kinit" command should point MIT KerberosFor example: C:\Kerbores\Campaign\bin>where kinitC:\Program Files\MIT\Kerberos\bin\kinit.exe
  5. Copy the Keytab file to the Campaign System for the principal you want to authenticate.
Procedure to run the Script

Procedure

  1. Make sure the prerequisites are satisfied.
  2. Then run the following: <campaign_home>/bin/unica_kerbKeyGenRenew.bat <principal>For example: unica_kerbKeyGenRenew.bat impala/quickstart.cloudera@CLOUDERA
  3. The script will start running, and do the following:
    1. Generate the TGT.
    2. Check every 1 minute for renewal and regeneration of the TGT.
    3. Using the values in TGT_EXPIRY_DAYS and TGT_RENEWAL_HOURS, keep checking for renewal or expiry.
    4. Before renewal time - renew the TGT. And before expiry time - regenerate the TGT.
    Note:
    1. TGT_RENEWAL HOURS AND TGT_EXPIRY_DAYS values needs to be same as Kerberos Server configuration. Please contact the Kerberos administrator to get the values.
    2. By default Script sets 24 hours for TGT renewal and 7 days for TGT_EXPIRY.

    Possible errors:

    1. Usage

    2. Principal is incorrect

    3. Keytab file is not present for the Principal

    4. One or more of the prerequisites is not set

    5. Keytab file is not valid