Using Two-Factor Authentication to Connect to a Kerberos-enabled Informatica Domain

Back Next

How It Works

The Informatica two-factor authentication implementation uses Kerberos tickets to authenticate Informatica client users on assets such as nodes and services within the Informatica domain.

The following outline describes the basic Kerberos authentication flow:

An Informatica client user logs in to a network computer hosting an Informatica client using a device such as a smart card or a USB token.

The login request is directed to the Authentication Server
, a component of the Kerberos Key Distribution Center (KDC)
. The KDC is a network service with access to user account information that runs on each domain controller within the Active Directory domain.

The Authentication Server creates a Kerberos token called a Ticket-Granting-Ticket (TGT)
on the user's computer.

The user attempts to access an asset within the Informatica domain through an Informatica client.

Informatica and the Kerberos libraries use the TGT to request a service ticket
and session key
for the requested domain asset from the Ticket Granting Server
, which also runs within the KDC.

For example, if the user accesses a PowerCenter Repository Service from the PowerCenter Client, the TGT requests a service ticket for the node the PowerCenter Repository Service is running on. The TGT also requests a service ticket for the PowerCenter Repository Service.

The service ticket is cached on the computer hosting the Informatica client, enabling the client to use the ticket as long as it remains valid. If the user shuts down and then restarts the Informatica client, the client reuses the same ticket to access assets within the Informatica domain.

Forwardable and Renewable Tickets

The Ticket Flags field notes any Kerberos ticket flags set on the ticket. If a TGT or service ticket is flagged as renewable
, the Informatica client can renew ticket at any point during the login session, without requiring the user to provide login credentials.

If a ticket is flagged as forwardable
, Kerberos can use it to authenticate the user on a remote server, and enable the user to run an Informatica client on that server. For example, if the user wants to use the Secure Socket Shell (SSH) protocol to run the pmcmd command-line client on a remote server, Kerberos requests a service ticket for the remote server on the user's computer. Kerberos also forwards the original TGT to the remote server, so new service tickets can be created on the remote server.

The user is therefore able to access Informatica domain assets from the Informatica client running on the remote server, without having to log in on the remote server.

The following image shows the output of the Windows

klist

command, which lists details for the Kerberos tickets cached on an Informatica client user's computer. The krbtgt in the service name identifies the ticket shown as a TGT. The Ticket Flags field indicates that the ticket is both forwardable and renewable.

Using Two-Factor Authentication to Connect to a Kerberos-enabled Informatica Domain

Rename Saved Search

Table of Contents

Using Two-Factor Authentication to Connect to a Kerberos-enabled Informatica Domain

Using Two-Factor Authentication to Connect to a Kerberos-enabled Informatica Domain

How It Works

How It Works

Forwardable and Renewable Tickets