How to Set Up Kerberos Authentication to Access the EDW on macOS


Note: The EDW team cannot provide detailed technical support on using non-Windows machines to connect directly to the EDW. Mac instructions are provided as a courtesy based on feedback from users.
In order to connect to the EDW using MacOS, you will need to update (or create) your Kerberos configuration file (krb5.conf). The krb5.conf file contains Kerberos client configuration information that will be necessary to connect to the EDW. This file should be located in your /etc/ directory.

Before You Start

You'll need:

If you're off-campus: Connect to UW VPN first

Step 1: Set Up Kerberos Authentication (One-Time Setup)

What this does: Tells your Mac how to authenticate with UW's systems.

  1. Open Terminal (Applications > Utilities > Terminal)
  2. Copy and paste this code into the terminal: sudo nano /etc/krb5.conf
    • You'll be prompted for your Mac's admin password (not your UW password)
  3. Copy and paste the configuration below into the file which will be viewable in the terminal:
[libdefaults]
    default_realm = NETID.WASHINGTON.EDU
    ticket_lifetime = 24h
    forwardable = true

[realms]
    NETID.WASHINGTON.EDU = {
        admin_server = _kerberos._tcp.netid.washington.edu
        kdc = ezra.netid.washington.edu
        kdc = ahsoka.netid.washington.edu
        kdc = leia.netid.washington.edu
        kdc = kanan.netid.washington.edu
        kdc = obiwan.netid.washington.edu
        default_domain = NETID.WASHINGTON.EDU
    }

[domain_realm]
    netid.washington.edu = NETID.WASHINGTON.EDU
    .netid.washington.edu = NETID.WASHINGTON.EDU
    .s.uw.edu = NETID.WASHINGTON.EDU

4. Save the file: Press Control + O, Enter, then Control + X

5. Test your setup - make sure you can reach UW's servers: ping ezra.netid.washington.edu

Step 2: Get Your Authentication Ticket

What this does: Logs you into UW's system and creates a 24-hour access pass.

  1. Get your ticket: kinit yournetid@NETID.WASHINGTON.EDU
    • Replace yournetid with your actual UW NetID
  2. Enter your UW password when prompted
  3. Verify it worked: klist
    • You should see: Your NetID and an expiration time (usually 24 hours from authenticating)

Your Kerberos authentication is now ready! You can use it with any SQL client that supports Kerberos authentication to connect to EDW.

For Future Sessions

Before each work session:

  1. Run kinit yournetid@NETID.WASHINGTON.EDU in Terminal
  2. Enter your UW password
  3. Use your SQL client to connect to EDW

To check if your ticket is still valid: klist

To clear your ticket when finished: kdestroy

Troubleshooting First-Time Issues

Authentication Problems

Error: "KDC reply did not match expectations"

Error: "Client not found in Kerberos database"