Query Manipulation Server 26.2
Query Manipulation Server Help

# GSSPrincipals

A comma-separated list of Kerberos GSS principals that have authorization for the functions included in this role. You can include Wildcard values in the GSS principal names.

The Kerberos principal name consists of:

- The Kerberos primary. This value might be the user name or service name (for example, `KNOWLEDGEDISCOVERY/`).
- The instance name. The instance is the fully qualified host name; for example, `myserver.example.com`. This value is optional, and users do not usually have an instance.
- The Kerberos realm. This value is normally the domain name in uppercase; for example, `@EXAMPLE.COM`.

To use GSS principals for permissions, you must set up Kerberos/GSS in your system (for example, you must set RequireGSSAuth).

You define the permissions that a particular role has by using StandardRoles, or by specifying the Actions and ServiceActions that you want the role to be able to use. You define the users that belong to a particular role by using Clients, GSSPrincipals, and SSLIdentities. If a connection matches one of the allowed clients, principals, or SSL identities, they have permission to perform the operations allowed by the role.

Type: | String
Default: |
Required: | No
Configuration Section: | MyAuthorizationRole
Example: | `GSSPrincipals=KNOWLEDGEDISCOVERY01/admin.example.com@EXAMPLE.COM,KNOWLEDGEDISCOVERY02/userserver.example.com@EXAMPLE.COM`
See Also: | Clients SSLIdentities

Copyright 2026 Open Text
Version 26.2 | Last updated April 2026

Send documentation feedback

Close

Send documentation feedback

To send feedback using your default email client, open an email window.

Otherwise, send your feedback and the information below to MFI-swpdl.idoldocsfeedback@opentext.com.

We appreciate your feedback!

Product: Knowledge Discovery Query Manipulation Server 26.2

Topic Title: GSSPrincipals