SQLNET.AUTHENTICATION_SERVICES= (NTS) and ASP.NET

I'm trying to access an oracle database using

using System.Data.OracleClient;

from a console application, accessing the database is fine. however from an ASP.NET web site i get the error:

ORA-12640: Authentication adapter initialization failed

I've googled around and found that changing sqlnet.ora file would solve the issue

//before
SQLNET.AUTHENTICATION_SERVICES= (NTS)
//after
SQLNET.AUTHENTICATION_SERVICES= (NONE)

Later I found another application on the same server, that uses other database of Oracle as well, is requiring the value of SQLNET.AUTHENTICATION_SERVICES to be "NTS". This would cause my web site to fail accessing the database with the error ORA-12640. I have tried "ALL" as value but still it didn't work.

How can I configure my website to access the oracle database while sqlnet.ora is configured as "SQLNET.AUTHENTICATION_SERVICES= (NTS)" ?

P.S. the website uses Windows Authentication and impersonate as follow:

<aut开发者_如何转开发hentication mode="Windows"/>
<identity impersonate="true"/>

---

This looks like the multi-hop impersonation issue to me.

If it's an option for you, I suggest having your application run under a single identity when accessing the database (this should also allow connection pooling to occur as a beneficial side-effect).

To do this, you would need to configure an app pool to run under an account that has access to Oracle. Once the application is running under that app pool, turn impersonation off in your application so that the database calls occur using the app pool identity.

If you have to impersonate the calling users over the network, the method used will depend on your environment. For more information, see How to Use Impersonation and Delegation in ASP.NET 2.0.

---

I was also facing the same issue, but finally got it working. Created a service account(named kerb_user in the active directory) and changed the app pool authentication to run as "kerb_user". First I tried with this, but it was failed. Please check the request log in oracle database, where you can verify the OS_USERNAME carefully. In my case it shows kerb_user, where as for other kerberos user requested OS_USERNAME was suffixed with domain name, which was missing in my case. Then I did two changes.

1. Modified the app pool identity with domain name: kerb_user@xyz.com
2. Modified the sqlnet.ora file on app server and changed authentication to "ALL"

//before - not working

SQLNET.AUTHENTICATION_SERVICES= (NONE)

//after - worked

SQLNET.AUTHENTICATION_SERVICES= (ALL)

Debugging

1. Check the oracle log, if requested OS_USERNAME is suffixed with domain name(here kerb_user@xyz.com) or not. If suffixed, will work for sure.

2. Please verify service user on both side(app- AD User and db- Service User) server, user should have same name.

3. Verify the service user access at db server and ensure, user must have kerberos access to that database.

4. Check the SPN settings

Ref: https://www.codeproject.com/Articles/27554/Authentication-in-web-services-using-C-and-Kerbero