Big Data Management Administrator Guide

Back Next

Step 1. Set Up the Kerberos Configuration File

Set the configuration properties for the Kerberos realm that the Hadoop cluster uses to krb5.conf on the machine on which the Data Integration Service runs.

If the Informatica domain does not use Kerberos authentication, set the properties for the MIT realm. If the Informatica domain uses Kerberos authentication, set the properties for the Active Directory realm and MIT realm.

krb5.conf

is located in the

<Informatica Installation Directory>/java/jre/lib/security

directory.

Back up

krb5

.conf before you make any changes.

Edit

krb5.conf

In the libdefaults section, set the following properties:

default_realm. Name of the service realm for the Informatica domain. If the Informatica domain does not use Kerberos authentication, then the default realm must be the name of the AD service.

udp_preference_limit. Determines the protocol that Kerberos uses when it sends a message to the KDC. Set to 1 to use the TCP protocol.

The following example shows the value if the Informatica domain does not use Kerberos authentication:

[libdefaults]
default_realm = HADOOP-AD-REALM
udp_preference_limit=1

The following example shows the value if the Informatica domain uses Kerberos authentication:

[libdefaults]
default_realm = INFA-AD-REALM
udp_preference_limit=1

In the realms section, set or add the properties required by Informatica.

The following table lists the values to which you must set properties in the realms section:

Parameter	Value
kdc	Name of the host running a KDC server for that realm.
admin_server	Name of the Kerberos administration server.

The following example shows the parameters for the Hadoop realm if the Informatica domain does not use Kerberos authentication:

[realms]
HADOOP-AD-REALM = {
		kdc = l23abcd134.hadoop-AD-realm.com
		admin_server = 123abcd124.hadoop-AD-realm.com
 }

The following example shows the parameters for the Hadoop realm if the Informatica domain uses Kerberos authentication:

[realms]
INFA-AD-REALM = {
                kdc = abc123.infa-ad-realm.com
                admin_server = abc123.infa-ad-realm.com
														}
HADOOP-MIT-REALM = {
                kdc = def456.hadoop-mit-realm.com
                admin_server = def456.hadoop-mit-realm.com
														}

In the domain_realms section, map the domain name or host name to a Kerberos realm name. The domain name is prefixed by a period (.).

The following example shows the parameters for the Hadoop domain_realm if the Informatica domain does not use Kerberos authentication:

[domain_realm]
 .hadoop_ad_realm.com = HADOOP-AD-REALM
  hadoop_ad_realm.com = HADOOP-AD-REALM

The following example shows the parameters for the Hadoop domain_realm if the Informatica domain uses Kerberos authentication:

[domain_realm]
.infa_ad_realm.com = INFA-AD-REALM
  infa_ad_realm.com = INFA-AD-REALM
.hadoop_mit_realm.com = HADOOP-MIT-REALM
  hadoop_mit_realm.com = HADOOP-MIT-REALM

Copy the

krb5.conf

file to the following locations on the machine that hosts the Data Integration Service:

<Informatica installation directory>/services/shared/security/

<Informatica installation directory>/java/jre/lib/security

The following example shows the content of

krb5.conf

with the required properties for an Informatica domain that does not use Kerberos authentications:

[libdefaults]
default_realm = HADOOP-AD-REALM
udp_preference_limit=1

[realms]
HADOOP-AD-REALM = {
		kdc = l23abcd134.hadoop-ad-realm.com
		admin_server = 123abcd124.hadoop-ad-realm.com
 }

[domain_realm]
 .hadoop_ad_realm.com = HADOOP-AD-REALM
  hadoop_ad_realm.com = HADOOP-AD-REALM

The following example shows the content of

krb5.conf

with the required properties for an Informatica domain that uses Kerberos authentication:

[libdefaults]
default_realm = INFA-AD-REALM
udp_preference_limit=1

[realms]
INFA-AD-REALM = {
                kdc = abc123.infa-ad-realm.com
                admin_server = abc123.infa-ad-realm.com
														}
HADOOP-MIT-REALM = {
                kdc = def456.hadoop-mit-realm.com
                admin_server = def456.hadoop-mit-realm.com
														}

[domain_realm]
.infa_ad_realm.com = INFA-AD-REALM
  infa_ad_realm.com = INFA-AD-REALM
.hadoop_mit_realm.com = HADOOP-MIT-REALM
  hadoop_mit_realm.com = HADOOP-MIT-REALM

Rename Saved Search

Table of Contents

Big Data Management Administrator Guide

Big Data Management Administrator Guide

Step 1. Set Up the Kerberos Configuration File

Step 1. Set Up the Kerberos Configuration File