Power BI gateway - Kerberos Constraint delegation config with on-prem Linux based Oracle db

[intgd]

We are trying to configure on-prem Power bi gateway to integrate PBI service reports/dashboards with on-prem Oracle 19c data sources, using MSFT doc link - Configure Kerberos-Based SSO from Power BI Service to On-Premises Data Sources - Power BI | Microsof...

PBI Gateway server - WIndows server

Oracle db server - Linux 8

We were able to make Oracle db auth using kerberos work OK, however, we are unable to make Kerberos Constraint delegation wotk for Oracle db on Linux.

My question - is Constraint delegation even supported if on-prem Oracle db server is Linux and client (PBI gateway server) is Windows ? If yes, can anyone help us with working config steps ?

[v-agajavelly · Accepted solution]

Hi @intgd ,

Just to clarify Kerberos Constrained Delegation (KCD) doesn’t work end-to-end if your Oracle DB is on a Linux server. Even with proper AD and gateway config, delegation stops at the gateway since Linux can’t process delegated Kerberos tickets. So full KCD isn't supported in this setup.

Regards,
Akhil.

[v-agajavelly]

Hi @intgd ,

As per my understanding. Kerberos Constrained Delegation (KCD) does not work end-to-end if your Oracle DB is on a Linux server. KCD is a Windows-native feature. While you can get Kerberos authentication to work between a windows-based power BI Gateway and a linux-hosted oracle DB (which you’ve already achieved), true constrained delegation is not supported when the backend system (oracle in this case) is on Linux. That’s because the Linux server doesn’t understand or accept delegated kerberos tickets the same way a Windows service would.

In other words, even if you configure delegation in active directory and set everything up correctly on the gateway, the delegation won’t continue to the oracle server on linux it just stops at the gateway. Microsoft’s documentation is accurate, but it assumes the backend can participate in KCD, which isn’t possible on non-windows platforms in this context.

So if you're looking for full end-to-end Kerberos Constrained Delegation to a Linux-based Oracle server it's not supported. Hope this helps clarify things.

Regards,
Akhil.

[intgd]

Thanks for the reponse. We got similar reponse from Oracle corp too. It all makes sense now.

[GilbertQ]

Hi @intgd 

I'm certainly not a Kerberos. Expert, but from our understanding this is only available on Windows Servers and PCS and this could be why you are encounting this error.