Table of Contents

Search

  1. Preface
  2. Introduction to Data Engineering Administration
  3. Authentication
  4. Running Mappings on a Cluster with Kerberos Authentication
  5. Authorization
  6. Cluster Configuration
  7. Cloud Provisioning Configuration
  8. Data Integration Service Processing
  9. Appendix A: Connections Reference
  10. Appendix B: Monitoring REST API

Import Security Certificates from an SSL-Enabled Cluster

Import Security Certificates from an SSL-Enabled Cluster

When you use custom, special, or self-signed security certificates to secure the Hadoop cluster, Informatica services that connect to the cluster require these certificates to be present on the machines that run the application services. Use the
keytool
utility to import certificates from the cluster.
For more information about the
keytool
utility, refer to the Oracle documentation.
If a MapR cluster is SSL-enabled, you do not have to import the security certificates. Make sure that the MapR client on the Data Integration Service and Metadata Access Service machines is configured to access an SSL-enabled cluster.
If a cluster uses SSL, import security certificates from the cluster to the Data Integration Service and Metadata Access Service machines.
  1. Run the following
    keytool -exportcert
    command on the cluster to export the certificates:
    keytool -exportcert -alias <alias name> -keystore <custom.truststore file location> -file <exported certificate file location> -storepass <password>
    Where:
    • -alias
      specifies the alias name associated with the truststore file.
    • -keystore
      specifies the location of the truststore file on the cluster.
    • -file
      specifies the file name and location for the exported certificate file.
    • -storepass
      specifies the password for the keystore on the cluster.
    The
    keytool -exportcert
    command produces a certificate file associated with the alias.
  2. Run the following
    keytool -importcert
    command on one Data Integration Service machine to import the security certificates:
    keytool -importcert -trustcacerts -alias <alias name> -file <exported certificate file location> -keystore <java cacerts location> -storepass <password>
    Where:
    • -alias
      specifies the alias name associated with the certificate file.
    • -file
      specifies the file name and location of the exported certificate file.
    • -keystore
      specifies the location of the truststore file on the domain.
    • -storepass
      specifies the password for the keystore on the domain.
    Import the certificate files one time and then copy them to all machines that host the Data Integration Service and Metadata Access Service. If the Data Integration Service runs on a grid, mappings that you push to the Hadoop environment can fail with initialization errors due to inconsistent binary hex values.
    Depending on whether the Informatica domain uses SSL, you specify the keystore location as follows:
    • If the domain is SSL-enabled, import the certificate file to the following location:
      <Informatica installation directory>/services/shared/security/infa_truststore.jks
    • If the domain is not SSL-enabled, import the certificate file to the following location:
      <Informatica installation directory>/java/jre/lib/security/cacerts
    The
    keytool -importcert
    command imports the security certificates to the keystore location you specify.
Example. Import Security Certificates
The environment includes a Cloudera CDH cluster that uses SSL and an Informatica domain that does not use SSL. You export the security certificate for the user bigdata_user1 from the custom.keystore on the Cloudera CDH cluster to the file exported.cer. Then, you import the export.cer certificate file to the Informatica domain location.
  1. Run the following export command:
    keytool -exportcert -alias bigdata_user1 -keystore ~/custom.truststore -file ~/exported.cer
  2. Run the following import command on the Data Integration Service machine:
    keytool -importcert -alias bigdata_user1 -file ~/exported.cer -keystore <Informatica installation directory>/java/jre/lib/security/cacerts
  3. Copy the certificate file to all other machines that host the Data Integration Service and the Metadata Access Service.

0 COMMENTS

We’d like to hear from you!