Setting the file. One moment.
Db2 Kerberos Test · RDS Db2 · aws/agent-toolkit-for-aws · Skills Docs
Repo No. 14 · RDS Db2
↖ Back to the coverEnd User Computing Skills
Messaging And Streaming Skills
Migration And Modernization Skills
Networking And Content Delivery Skills
Security And Identity Skills
Web And Mobile Development
132 skills · 818 min
Back to the top of the page 70
Creating Amazon Aurora Db Cluster With Instances
93
Routing Traffic With Route53 And CloudFront
Resilience Program Design
Creating API Gateway Stage
Previous
Script Db2 Driver
scripts/ db2-kerberos-test.sh
Shell · 299 lines · 11 KB
# Usage:
16 # ./run_db2_kerberos.sh [OPTIONS]
17 #
18 # Options:
19 # -h HOST Db2 server hostname or IP
20 # -d DATABASE Db2 database name
21 # -p PORT Port (used for both TCPIP and SSL when set; overrides defaults)
22 # -P TCPIP_PORT TCPIP-specific port (default: 50000)
23 # -S SSL_PORT SSL-specific port (default: 50001)
24 # -m MODE TCPIP | SSL | BOTH (default: BOTH)
25 # -c CERT_PEM Path to region-specific PEM file (e.g. us-east-1-bundle.pem)
26 # If not provided, the script downloads it automatically.
27 # -r REGION AWS region for cert download (default: us-east-1)
28 # -j DB2_JAR Path to db2jcc4.jar (default: ~/sqllib/java/db2jcc4.jar)
29 # --no-compile Skip recompilation
30 # --help Show this help
31 #
32 # Examples:
33 # # Interactive — prompts for everything missing:
34 # ./run_db2_kerberos.sh
35 #
36 # # TCPIP only:
37 # ./run_db2_kerberos.sh -h mydb2.abc123.us-east-1.rds.amazonaws.com \
38 # -d MYDB -p 50000 -m TCPIP
39 #
40 # # SSL only (auto-downloads cert for us-east-1):
41 # ./run_db2_kerberos.sh -h mydb2.abc123.us-east-1.rds.amazonaws.com \
42 # -d MYDB -S 50001 -m SSL -r us-east-1
43 #
44 # # SSL with an existing PEM file:
45 # ./run_db2_kerberos.sh -h mydb2.abc123.us-east-1.rds.amazonaws.com \
46 # -d MYDB -S 50001 -m SSL -c /home/db2inst1/us-east-1-bundle.pem
47 #
48 # # Both paths:
49 # ./run_db2_kerberos.sh -h mydb2.abc123.us-east-1.rds.amazonaws.com \
50 # -d MYDB -P 50000 -S 50001 -m BOTH -r us-east-1
51 # =============================================================================
52
53 set -euo pipefail
54
55 # ---------------------------------------------------------------------------
56 # User-configurable variables — edit these before running, or override via
57 # command-line flags.
58 # ---------------------------------------------------------------------------
59 PORT_TCPIP = "50000" # Plain TCPIP port (-P flag)
60 PORT_SSL = "50001" # SSL/TLS port (-S flag)
61 REGION = "us-east-1" # AWS region for cert download (-r flag)
62
63 # ---------------------------------------------------------------------------
64 # Defaults (not normally edited)
65 # ---------------------------------------------------------------------------
66 HOST = ""
67 DATABASE = ""
68 MODE = ""
69 CERT_PEM = ""
70 DB2_JAR = "${ HOME }/sqllib/java/db2jcc4.jar"
71 SKIP_COMPILE = false
72 SCRIPT_DIR = "$( cd "$( dirname "${ BASH_SOURCE [0]}")" && pwd )"
73 JAVA_SRC = "${ SCRIPT_DIR }/Db2KerberosConnection.java"
74 JAVA_CLASS = "Db2KerberosConnection"
75
76 # ---------------------------------------------------------------------------
77 # Colour helpers
78 # ---------------------------------------------------------------------------
79 RED = '\033[0;31m' ; GREEN = '\033[0;32m' ; YELLOW = '\033[1;33m' ; NC = '\033[0m'
80 info () { echo -e "${ GREEN }[INFO]${ NC } $* " ; }
81 warn () { echo -e "${ YELLOW }[WARN]${ NC } $* " ; }
82 error () { echo -e "${ RED }[ERROR]${ NC } $* " >&2 ; }
83 section () { echo -e "\n${ YELLOW }=== $* ===${ NC }" ; }
84
85 # ---------------------------------------------------------------------------
86 # Argument parsing
87 # ---------------------------------------------------------------------------
88 usage () {
89 sed -n '/^# Usage:/,/^# =====/p' " $0 " | sed 's/^# \?//'
90 exit 0
91 }
92
93 while [[ $# -gt 0 ]]; do
94 case " $1 " in
95 -h ) HOST = " $2 " ; shift 2 ;;
96 -d ) DATABASE = " $2 " ; shift 2 ;;
97 -p ) PORT_TCPIP = " $2 " ; PORT_SSL = " $2 " ; shift 2 ;;
98 -P ) PORT_TCPIP = " $2 " ; shift 2 ;;
99 -S ) PORT_SSL = " $2 " ; shift 2 ;;
100 -m ) MODE = " ${2 ^^ } " ; shift 2 ;;
101 -c ) CERT_PEM = " $2 " ; shift 2 ;;
102 -r ) REGION = " $2 " ; shift 2 ;;
103 -j ) DB2_JAR = " $2 " ; shift 2 ;;
104 --no-compile ) SKIP_COMPILE = true ; shift ;;
105 --help ) usage ;;
106 *) error "Unknown option: $1 " ; usage ;;
107 esac
108 done
109
110 # ---------------------------------------------------------------------------
111 # Interactive prompts for missing required values
112 # ---------------------------------------------------------------------------
113 prompt () {
114 local var_name = " $1 " prompt_text = " $2 " default = " $3 "
115 local current
116 current = $( eval echo " \$ $var_name " )
117 if [[ -z " $current " ]]; then
118 read -rp "${ prompt_text } [${ default }]: " input
119 eval " $var_name = \" ${ input :- $default } \" "
120 fi
121 }
122
123 prompt_required () {
124 # Always prompts. Shows current/default value in brackets.
125 # Accepts Enter to keep the existing value; rejects empty when no default.
126 local var_name = " $1 " prompt_text = " $2 "
127 local current
128 current = $( eval echo " \$ $var_name " )
129 if [[ -n " $current " ]]; then
130 read -rp "${ prompt_text } [${ current }]: " input
131 eval " $var_name = \" ${ input :- $current } \" "
132 else
133 read -rp "${ prompt_text }: " input
134 if [[ -z " $input " ]]; then
135 error "${ var_name } is required."
136 exit 1
137 fi
138 eval " $var_name = \" $input \" "
139 fi
140 }
141
142 section "Db2 Kerberos Connection — Parameter Collection"
143
144 prompt_required HOST "Db2 server hostname or IP"
145 prompt_required DATABASE "Db2 database name"
146
147 if [[ -z " $MODE " ]]; then
148 echo "Connection mode options:"
149 echo " 1) TCPIP — plain TCP (no encryption)"
150 echo " 2) SSL — TLS encrypted, PEM certificate (no KeyStore/keytool)"
151 echo " 3) BOTH — run TCPIP first, then SSL"
152 read -rp "Choose mode [1/2/3, default=3]: " mode_choice
153 case "${ mode_choice :- 3 }" in
154 1 ) MODE = "TCPIP" ;;
155 2 ) MODE = "SSL" ;;
156 3 ) MODE = "BOTH" ;;
157 *) error "Invalid choice" ; exit 1 ;;
158 esac
159 fi
160
161 if [[ " $MODE " == "TCPIP" || " $MODE " == "BOTH" ]]; then
162 prompt_required PORT_TCPIP "TCPIP port"
163 fi
164
165 if [[ " $MODE " == "SSL" || " $MODE " == "BOTH" ]]; then
166 prompt_required PORT_SSL "SSL port"
167 prompt_required REGION "AWS region (for cert download)"
168 fi
169
170 prompt DB2_JAR "Path to db2jcc4.jar" "${ HOME }/sqllib/java/db2jcc4.jar"
171
172 # ---------------------------------------------------------------------------
173 # Validate prerequisites
174 # ---------------------------------------------------------------------------
175 section "Validating Prerequisites"
176
177 if [[ ! -f " $DB2_JAR " ]]; then
178 error "db2jcc4.jar not found at: $DB2_JAR "
179 error "Copy it from your Db2 client: ~/sqllib/java/db2jcc4.jar"
180 exit 1
181 fi
182 info "DB2 JAR : $DB2_JAR "
183
184 if ! command -v javac & > /dev/null; then
185 error "javac not found. Install a JDK (Java 8+)."
186 exit 1
187 fi
188 if ! command -v java & > /dev/null; then
189 error "java not found. Install a JRE/JDK (Java 8+)."
190 exit 1
191 fi
192 info "Java : $( java -version 2>&1 | head -1 )"
193
194 # Check Kerberos ticket
195 if command -v klist & > /dev/null; then
196 if klist -s 2> /dev/null ; then
197 info "Kerberos ticket cache is valid."
198 else
199 warn "No valid Kerberos ticket found. Run 'kinit' before connecting."
200 fi
201 else
202 warn "klist not found — cannot verify Kerberos ticket."
203 fi
204
205 # ---------------------------------------------------------------------------
206 # Download PEM certificate (SSL paths only)
207 # ---------------------------------------------------------------------------
208 if [[ " $MODE " == "SSL" || " $MODE " == "BOTH" ]]; then
209 section "SSL Certificate (PEM)"
210
211 # Default cert path if not supplied
212 if [[ -z " $CERT_PEM " ]]; then
213 CERT_PEM = "${ SCRIPT_DIR }/${ REGION }-bundle.pem"
214 fi
215
216 if [[ -f " $CERT_PEM " ]]; then
217 info "Certificate already exists: $CERT_PEM "
218 else
219 CERT_URL = "https://truststore.pki.rds.amazonaws.com/${ REGION }/${ REGION }-bundle.pem"
220 info "Downloading certificate from: $CERT_URL "
221 if ! curl -fsSL " $CERT_URL " -o " $CERT_PEM " ; then
222 error "Failed to download certificate. Check region name and network access."
223 exit 1
224 fi
225 info "Certificate saved to: $CERT_PEM "
226 fi
227
228 # Remind about the global-bundle limitation
229 if [[ " $CERT_PEM " == * "global-bundle" * ]]; then
230 warn "global-bundle.pem is NOT supported by the IBM JDBC driver's sslCertLocation."
231 warn "Use a region-specific bundle, e.g. ${ REGION }-bundle.pem"
232 exit 1
233 fi
234 fi
235
236 # ---------------------------------------------------------------------------
237 # Compile
238 # ---------------------------------------------------------------------------
239 section "Compiling ${ JAVA_CLASS }.java"
240
241 CLASS_FILE = "${ SCRIPT_DIR }/${ JAVA_CLASS }.class"
242
243 if [[ " $SKIP_COMPILE " == false ]]; then
244 javac -cp "${ DB2_JAR }" "${ JAVA_SRC }" -d "${ SCRIPT_DIR }"
245 info "Compilation successful."
246 else
247 if [[ ! -f " $CLASS_FILE " ]]; then
248 error "Class file not found and --no-compile was set. Run without --no-compile first."
249 exit 1
250 fi
251 info "Skipping compilation (--no-compile)."
252 fi
253
254 # ---------------------------------------------------------------------------
255 # Run helper
256 # ---------------------------------------------------------------------------
257 run_connection () {
258 local label = " $1 " ; shift
259 section "Running $label Connection"
260 info "java -cp \" ${ SCRIPT_DIR }:${ DB2_JAR } \" ${ JAVA_CLASS } $* "
261 echo "---"
262 # Uncomment the line below to enable SSL handshake debug output:
263 # export JAVA_OPTS="-Djavax.net.debug=ssl:handshake:verbose"
264 if java ${JAVA_OPTS :- } -cp "${ SCRIPT_DIR }:${ DB2_JAR }" "${ JAVA_CLASS }" " $@ " ; then
265 info " $label connection: SUCCESS"
266 return 0
267 else
268 error " $label connection: FAILED (exit code $? )"
269 return 1
270 fi
271 }
272
273 # ---------------------------------------------------------------------------
274 # Execute connection path(s)
275 # ---------------------------------------------------------------------------
276 TCPIP_OK = true
277 SSL_OK = true
278
279 if [[ " $MODE " == "TCPIP" || " $MODE " == "BOTH" ]]; then
280 run_connection "TCPIP" " $HOST " " $DATABASE " " $PORT_TCPIP " "TCPIP" || TCPIP_OK = false
281 fi
282
283 if [[ " $MODE " == "SSL" || " $MODE " == "BOTH" ]]; then
284 run_connection "SSL" " $HOST " " $DATABASE " " $PORT_SSL " "SSL" " $CERT_PEM " || SSL_OK = false
285 fi
286
287 # ---------------------------------------------------------------------------
288 # Summary
289 # ---------------------------------------------------------------------------
290 section "Summary"
291 [[ " $MODE " == "TCPIP" || " $MODE " == "BOTH" ]] && {
292 $TCPIP_OK && info "TCPIP : PASSED" || error "TCPIP : FAILED"
293 }
294 [[ " $MODE " == "SSL" || " $MODE " == "BOTH" ]] && {
295 $SSL_OK && info "SSL : PASSED" || error "SSL : FAILED"
296 }
297
298 # Exit non-zero if either selected path failed
299 $TCPIP_OK && $SSL_OK