2

I'm testing an API using Fast API and Docker. When I load up the webpage it attempts to run a query using an AS400 connection that is setup with pyodbc.

I started with the error: pyodbc.InterfaceError: ('28000', '[28000] [IBM][System i Access ODBC Driver]Communication link failure. comm rc=8051 - CWBSY1011 - Kerberos client credentials not found

So I installed krb5 and created a ticket. Then re-loaded the webpage and the new error I am stuck at is pyodbc.InterfaceError: ('28000', '[28000] [IBM][System i Access ODBC Driver]Communication link failure. comm rc=8052 - CWBSY1012 - Kerberos service principal not found for system SYSTEM where SYSTEM is my AS400 system's name.

Has anyone else run into this before? It seems like AS400 is requiring me to use Kerberos on connecting but then I set it up and the system does not have a Kerberos service principal.

Do I possibly need to join the domain fully using the instructions found here? I started this process however I run into an error: Failed to join domain: Not enough storage is available to process this command. when trying to run net ads join which I am assuming is due to the Docker image being so small; so I assume this is not possible.

Here is my ODBC.ini config file:

[QDSN_ASW]
Description=ASW
Driver=iSeries Access ODBC Driver
System=192.168.100.1
UserID=user
Password=pass
Naming=0
DefaultLibraries=QGPL
Database=1492BFDD
ConnectionType=2
CommitMode=2
ExtendedDynamic=0
DefaultPkgLibrary=QGPL
DefaultPackage=A/DEFAULT(IBM),2,0,1,0,512
AllowDataCompression=1
LibraryView=0
AllowUnsupportedChar=0
ForceTranslation=0
Trace=0
Trusted_Connection=no
AuthenticationType=No Authentication
Nick Green
  • 101
  • 1
  • 9
  • 1
    Never messed with IBM360 / AS400 / iSeries _but_ I don't think you need to "join" an Active Directory domain -- Kerberos auth to a non-Microsoft system does not require all the Microsoft bloatware and "features". You will need a proper Kerberos client conf in `/etc/krb5.conf` instead. Especially if your user principal (UPN) is not in the same _realm_ as the service principal (SPN). – Samson Scharfrichter May 19 '21 at 08:09

1 Answers1

2

I was able to solve the issue thanks to this post on stackoverflow.

Basically, it appears my original construction of the database connection (shown below) was too convoluted and unnecessary.

 class CommitMode:
     NONE = 0  # Commit immediate (*NONE)  --> QSQCLIPKGN
     CS = 1  # Read committed (*CS)        --> QSQCLIPKGS
     CHG = 2  # Read uncommitted (*CHG)    --> QSQCLIPKGC
     ALL = 3  # Repeatable read (*ALL)     --> QSQCLIPKGA
     RR = 4  # Serializable (*RR)          --> QSQCLIPKGL


 class ConnectionType:
     ReadWrite = 0  # Read/Write (all SQL statements allowed)
     ReadCall = 1  # Read/Call (SELECT and CALL statements allowed)
     Readonly = 2  # Read-only (SELECT statements only)


 def connstr(system, commitmode=None, connectiontype=ConnectionType.Readonly):
     _connstr =  'DRIVER=iSeries Access ODBC Driver;'+ \
                 'SYSTEM='+system+';'+\
                 'SIGNON=4;CCSID=1208;TRANSLATE=1;'
     if commitmode is not None:
         _connstr = _connstr + 'CommitMode=' + str(commitmode) + ';'
     if connectiontype is not None:
         _connstr = _connstr +'ConnectionType=' + str(connectiontype) + ';'

     return _connstr

and I was able to simplify it to:

system = f"SYSTEM=AS400;DRIVER=iSeries Access ODBC Driver;SERVER=192.168.100.0;PORT=446;DATABASE=AS400;UID={user};PWD={pw}"

Now when I build the Docker image and load the web page, it instantly queries the database with no Kerberos authentication required.

Nick Green
  • 101
  • 1
  • 9