KNIME Documentation

Configure Kerberos constrained delegation ​

Configure KNIME Hub to perform Kerberos constrained delegation so that database operations run on behalf of the workflow user rather than the KNIME Executor's Kerberos ticket user.

Before you begin ​

Choose a delegation method ​

KNIME Hub supports three delegation methods. Choose based on what your database driver supports:

MethodWhen to use
Default JDBC parametersThe driver accepts a user impersonation parameter (for example, Hive, Impala).
Service ticket delegationThe driver uses the Kerberos service ticket directly (for example, PostgreSQL).
Connection initialization statementThe database accepts an impersonation SQL statement (for example, Exasol).

Configure delegation via default JDBC parameters ​

Use this method when the driver accepts a dedicated impersonation parameter.

Add the following lines to the .epf file of your customization profile, replacing <DRIVER_ID> and <IMPERSONATION_PARAM> with the values for your driver:

text
/instance/org.knime.database/drivers/<DRIVER_ID>/attributes/additional/org.knime.database.util.DerivableProperties/knime.db.connection.jdbc.properties/<IMPERSONATION_PARAM>/type=CONTEXT_PROPERTY
/instance/org.knime.database/drivers/<DRIVER_ID>/attributes/additional/org.knime.database.util.DerivableProperties/knime.db.connection.jdbc.properties/<IMPERSONATION_PARAM>/value=context.workflow.username
/instance/org.knime.database/drivers/<DRIVER_ID>/attributes/reserved/*/knime.db.connection.jdbc.properties/<IMPERSONATION_PARAM>=true

For Microsoft SQL Server, pass a delegated GSS credential instead:

text
/instance/org.knime.database/drivers/built-in-mssqlserver-9.4.0/attributes/additional/org.knime.database.util.DerivableProperties/knime.db.connection.jdbc.properties/gsscredential/type=DELEGATED_GSS_CREDENTIAL

Also set the following JDBC parameters in the Microsoft SQL Server Connector node (or as default JDBC parameters):

text
authenticationScheme=JavaKerberos
integratedSecurity=true

Configure delegation via service ticket ​

Use this method when the driver uses the Kerberos service ticket directly (for example, PostgreSQL or Oracle).

Add the following line to the .epf file of your customization profile:

text
/instance/org.knime.database/drivers/<DRIVER_ID>/attributes/additional/java.lang.String/knime.db.connection.kerberos_delegation.service/value=<SERVICE_NAME>

Replace <SERVICE_NAME> with the Kerberos service name for your database (for example, postgres for PostgreSQL, oracle for Oracle).

For dedicated connector nodes, the fully qualified hostname is extracted automatically. For the generic DB Connector, KNIME uses the regular expression .*(?:@|/)([^:;,/\\]*).* to extract it from the JDBC URL. Override this expression if needed:

text
/instance/org.knime.database/drivers/<DRIVER_ID>/attributes/additional/java.lang.String/knime.db.connection.kerberos_delegation.host_regex/value=<REGEX>

The first capture group must match the fully qualified hostname.

For PostgreSQL, you may also need to set the username explicitly. Add one of the following to specify how the username is derived:

  • Kerberos principal name including REALM: set type=GSS_PRINCIPAL_NAME
  • Kerberos principal name without REALM: set type=GSS_PRINCIPAL_NAME_WITHOUT_REALM
  • Workflow username: set type=CONTEXT_PROPERTY and value=context.workflow.username
text
/instance/org.knime.database/drivers/built-in-postgres-42.3.5/attributes/additional/org.knime.database.util.DerivableProperties/knime.db.connection.jdbc.properties/user/type=GSS_PRINCIPAL_NAME

Configure delegation via connection initialization statement ​

Use this method when the database accepts an impersonation SQL statement (for example, Exasol).

Add the following to the .epf file:

text
/instance/org.knime.database/drivers/<DRIVER_ID>/attributes/additional/java.lang.String/knime.db.connection.init_statement/value=IMPERSONATE ${context.workflow.username};

Database-specific examples ​

Apache Hive (embedded driver) ​

text
/instance/org.knime.database/drivers/hive/attributes/additional/org.knime.database.util.DerivableProperties/knime.db.connection.jdbc.properties/hive.server2.proxy.user/type=CONTEXT_PROPERTY
/instance/org.knime.database/drivers/hive/attributes/additional/org.knime.database.util.DerivableProperties/knime.db.connection.jdbc.properties/hive.server2.proxy.user/value=context.workflow.username
/instance/org.knime.database/drivers/hive/attributes/reserved/*/knime.db.connection.jdbc.properties/hive.server2.proxy.user=true

Apache Impala (Cloudera Simba driver) ​

text
/instance/org.knime.database/drivers/cloudera_impala/attributes/additional/org.knime.database.util.DerivableProperties/knime.db.connection.jdbc.properties/DelegationUID/type=CONTEXT_PROPERTY
/instance/org.knime.database/drivers/cloudera_impala/attributes/additional/org.knime.database.util.DerivableProperties/knime.db.connection.jdbc.properties/DelegationUID/value=context.workflow.username
/instance/org.knime.database/drivers/cloudera_impala/attributes/reserved/*/knime.db.connection.jdbc.properties/DelegationUID=true

PostgreSQL (embedded driver) ​

text
/instance/org.knime.database/drivers/built-in-postgres-42.3.5/attributes/additional/java.lang.String/knime.db.connection.kerberos_delegation.service/value=postgres

Oracle Database (embedded driver) ​

text
/instance/org.knime.database/drivers/built-in-oracle-19.14.0/attributes/additional/java.lang.String/knime.db.connection.kerberos_delegation.service/value=oracle

TIP

If you use a custom driver instead of a built-in one, replace the built-in driver ID with your driver's ID in all examples above.

Next steps ​