• Task
  • Version · 5.2.2
  • Integration guide

Connect Liquibase with Oracle Database via Kerberos and Active Directory

Last updated: August 11, 2026

Kerberos is an authentication protocol that works based on tickets to provide strong authentication for client/server applications using secret-key cryptography. It doesn’t store passwords locally or send them over the Internet.

Kerberos authentication for an Oracle connection is typically used when Kerberos is the standard authentication mechanism your company supports for accessing resources in your organization.

Before you begin

Before using Liquibase with Kerberos and Active Directory, ensure that you:

Have the following files available:

  • The krb5.conf file.

  • The Kerberos cache file. The example provided later in the tutorial will have the cache file called kerbcache.

  • The sqlnet.ora and tnsnames.ora files. The TNS_ADMIN environment variable will reference the location of those files in the Liquibase url property. If the TNS alias is not defined in the tnsnames.ora file, then use the hostname, port, and database name within the JDBC string instead.

Procedure

1

Verify the connection to your environment.

You can confirm that you have a successful connection to your environment by making that connection with SQL*Plus:

1. Open your SQL*Plus.

2. Run the kinit command to obtain and cache Kerberos ticket-granting ticket. An example from the Oracle documentation:

kinit [-fp] [-c <cache_name>] [-k] [-t <keytab_filename>] [<principal>] [<password>] [-help]

Command Option

Description

-A

Do not include addresses.

-f

Issue a forwardable ticket.

-p

Issue a proxiable ticket.

-c <cache_name>

The cache name (FILE:d:\temp\mykrb5cc).

-k

Use keytab.

-t <keytab_filename>

The keytab name (d:\winnt\profiles\duke\krb5.keytab).

<principal>

The principal name (duke@example.com).

<password>

The principal's Kerberos password (do not specify on the command line or in a script).

-help

The option that displays instructions.

3. Run klist to see a Kerberos ticket.

4. Run sqlplus /@<alias_name> to connect to your Oracle database via Kerberos authentication.

2

Connect to an Oracle database using Liquibase.

Run a Liquibase update with the following arguments:
loading

Output

Starting Liquibase at 22:34:02 (version 4.2.2 #36 built at 2020-12-09 20:07+0000) Service ticket not found in the subject >>> Credentials acquireServiceCreds: same realm Using builtin default etypes for default_tgs_enctypes default etypes for default_tgs_enctypes: 18 17 16 23. >>> CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType >>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType >>> KdcAccessibility: reset >>> KrbKdcReq send: kdc=test.liquibase.net TCP:88, timeout=30000, number of retries =3, #bytes=1507 >>> KDCCommunication: kdc=test.liquibase.net TCP:88, timeout=30000,Attempt =1, #bytes=1507 >>>DEBUG: TCPClient reading 669 bytes >>> KrbKdcReq send: #bytes read=669 >>> KdcAccessibility: remove test.liquibase.net >>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType >>> KrbApReq: APOptions are 00000000 00000000 00000000 00000000 >>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType Krb5Context setting mySeqNumber to: xxxxxxx Krb5Context setting peerSeqNumber to: 0 Created InitSecContextToken: 0000: 01 00 6E 82 02 34 30 82 02 30 A0 03 02 01 05 A1 ..n..40..0...... 0010: 03 02 01 0E A2 07 03 05 00 00 00 00 00 A3 82 01 ................ 00E0: 98 F5 DE BC 94 88 C8 A1 8F 23 EE C8 1F 08 EF 6D .........#.....m 00F0: 12 3F EE 1E CF 07 5F FB F6 4B 52 96 C9 5B 0C 5C .?...._..KR..[.\ … Liquibase: Update has been successful.

PreviousConnect Liquibase with Oracle DatabaseNextConnect Liquibase with Oracle Autonomous Database with ATP & ADW