topic Re: DB2 LUW Extension throwing error: Security mechanism not supported in Extensions

DB2 LUW Extension throwing error: Security mechanism not supported

sruthisattiraju — Wed, 25 Sep 2024 06:37:28 GMT

Hello Team,

We are trying to monitor DB2 database using an DB2 LUW extension but its throwing below error:

Exception occured: [jcc][t4][201][11237][4.31.10] Connection authorization failure occurred. Reason: Security mechanism not supported. ERRORCODE=-4214, SQLSTATE=28000.

According to Dynatrace Support team Security Mechanism (set at DB end is 13) is not supported.

Did anyone tried with SecurityMechanism as 13 using a DB2 extension? Is there a way to change default SecurityMechanism at extension level? Any suggestions please.

Thanks

Re: DB2 LUW Extension throwing error: Security mechanism not supported

JamesKitson — Thu, 15 Jun 2023 19:23:48 GMT

This will be the same information that was provided by support but I would like to note it here for if others come across it. The DB2 data source (which is what this extension is based on) does not supportin connections using the DATA_ENCRYPT option. The data source is responsible for the actual connection and so there is no way to support this in the extension while the data source does not support it.

IBM themselves recommend switching to SSL/TLS for encryption as it is considered deprecated: https://www.ibm.com/docs/en/db2/11.5?topic=sequences-data-encrypt

SSL support is added for DB2 extensions starting with ActiveGate 1.269.

Re: DB2 LUW Extension throwing error: Security mechanism not supported

fiona_ta — Tue, 24 Sep 2024 18:03:02 GMT

Hi James,
We get the same error when migrate IBM DB2 for LUW from V1 to V2.
The DB2 team said the Database Manager is using SERVER_ENCRYPT for authentication; and the server has SSL / TLS certificate set up.

Question: In this case is the Dynatrace DB2 extension V2 supported SERVER_ENCRYPT?
Thanks and regards,

Fiona.

Re: DB2 LUW Extension throwing error: Security mechanism not supported

JamesKitson — Tue, 24 Sep 2024 18:44:33 GMT

No, that is part of the same deprecated DB2 feature as the earlier post. Only the TLS options are supported for the data source.

https://www.ibm.com/docs/en/db2/11.5?topic=parameters-authentication-authentication-type