[CONJ-1143] GSSAPI authentication does not work out of the box in DBeaver on Windows Created: 2023-12-28  Updated: 2024-01-25  Resolved: 2024-01-25

Status: Closed
Project: MariaDB Connector/J
Component/s: authentication
Affects Version/s: 3.0.7
Fix Version/s: N/A

Type: Bug Priority: Critical
Reporter: Vladislav Vaintroub Assignee: Diego Dupin
Resolution: Not a Bug Votes: 0
Labels: None

Attachments: PNG File add_waffle_jna.png     PNG File classloader_error.png    

 Description   

Note: original scenario involves domain users and Kerberos, here it is simplified using local Windows users on non-domain machine with gssapi.

Install MariaDB on Windows. Make sure GSSAPI authentication plugin is loaded (in 10.11+ nothing needs to be done)

Install DBeaver on the same machine.

Create a user with GSSAPI authentication

CREATE USER <name> IDENTIFIED VIA gssapi

1. Try to connect as this user using DBeaver with MariaDB JDBC driver - the error is ""Unable to obtain principal name for authentication"

2. Add waffle-jna to the list of client libraries to enable native Windows SSPI
Menu Database/Driver Manager/MariaDB, chose Edit, then Libraries, add Artifact to add com.github.waffle:waffle-jna version 1.9.1
Then Download/update
3. Try to connect again. Class loader is unhappy.

Unexpected driver error occurred while connecting to the database
 
  loader constraint violation: loader org.jkiss.dbeaver.registry.driver.DriverClassLoader @65b79332 wants to load class com.sun.jna.Pointer. A different class with the same name was previously loaded by org.eclipse.osgi.internal.loader.EquinoxClassLoader @35af1558. (com.sun.jna.Pointer is in unnamed module of loader org.eclipse.osgi.internal.loader.EquinoxClassLoader @35af1558, parent loader 'platform')

I "think" original scenario, with Kerberos and Domain env can be solved somehow, without waffle-jna, using Java-native Kerberos, but if this involves typing password in kinit.exe, this is quite a bad experience. So, it would be much more interesting to get DBeaver to use waffle SSPI support, especially since for DBeave/Postgres SSPI it might already work (https://github.com/dbeaver/dbeaver/issues/17268)

Perhaps it is not a bug, or rather not our bug, but I do not know enough to be sure. Maybe there is a workaround for class loader problems

Possibly relevant : https://bugs.openjdk.org/browse/JDK-8214079 (Native GSSAPI on Windows), seems to have been implemented in latest Java, perhaps it can be used from Connector/J



 Comments   
Comment by Michael Malgeri (Inactive) [ 2024-01-02 ]

Detailed notes for this issue can be found in support ticket for case # CS0679968 at the following link

https://cloud.mariadb.com/nav_to.do?uri=%2Fsn_customerservice_case.do%3Fsys_id%3D7cb60efe1ba2b11009665533604bcbca%26sysparm_view%3Dcase%26sysparm_record_row%3D%26sysparm_record_rows%3D0%26sysparm_record_list%3D%26sysparm_record_target%3Dsn_customerservice_case%26sysparm_template_editable%3D%26sysparm_nostack%3Dyes

The current problem is that DOT users are not approved to use HeidiSQL, so request is to fix DBeaver

Comment by Diego Dupin [ 2024-01-15 ]

In order to use GSSAPI and HeidiSQL, user must be left empty, it will just work (just tested)

Comment by Diego Dupin [ 2024-01-15 ]

reproduced the error with DBeaver 

"loader constraint violation: loader org.jkiss.dbeaver.registry.driver.DriverClassLoader @428bc816 wants to load class com.sun.jna.Pointer. A different class with the same name was previously loaded by org.eclipse.osgi.internal.loader.EquinoxClassLoader @4040ccae. (com.sun.jna.Pointer is in unnamed module of loader org.eclipse.osgi.internal.loader.EquinoxClassLoader @4040ccae, parent loader 'platform')"

Comment by Diego Dupin [ 2024-01-15 ]

The problem is in waffle-JNA dependencies, there is then a conflict in classloader, because DBeaver already includes JNA libraries.
I'll try to see if those JNA dependencies can be removed since already present.

Comment by Diego Dupin [ 2024-01-16 ]

DBeaver is not simple implementation, created https://github.com/dbeaver/dbeaver/issues/22479, because i haven't found any workaround.

Last possibility is implementing https://bugs.openjdk.org/browse/JDK-8214079, in order to get rid of waffle, to avoid those classloader issues

Comment by Diego Dupin [ 2024-01-22 ]

Using Sspi native is a pain, windows API calls are not accurate, i understand why not enable by default, there is still some work to simplify the current implementation. This actually cannot work.

After creating a ticket on DBeaver, they propose a solution here : https://github.com/dbeaver/dbeaver/pull/22505 that is not accepted for now.

Comment by Diego Dupin [ 2024-01-24 ]

https://github.com/dbeaver/dbeaver/pull/22505 merged. testing tomorrow with daily build to be done

Comment by Diego Dupin [ 2024-01-25 ]

early access (https://dbeaver.io/files/ea/) test confirm the correction

Generated at Thu Feb 08 03:20:56 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.