Configuring Big Data Management® to Access an SSL Enabled Hadoop Cluster

Back Next

Creating and Configuring Security Certificates and Truststore Files

When you use custom, special, or self-signed security certificates to secure the Hadoop cluster, Informatica clients that connect to the cluster require these certificates to be present in the client machine truststore.

Import Security Certificates

To connect to the Hadoop cluster to develop a mapping, the Developer tool requires security certificate aliases on the machine that hosts the Developer tool. To run a mapping, the machine that hosts the Data Integration Service requires these same certificate alias files.

Perform the following steps from the Developer tool host machine and from the Data Integration Service host machine:

Run the following command to export the certificates from the cluster:

keytool -export -alias <alias name> -keystore <custom.truststore file location> -file <exported certificate file location> -storepass <password>

For example:

<java home>/jre/bin/keytool -export -alias <alias name> -keystore ~/custom.truststore -file ~/exported.cer

The command produces a certificate file.

Choose to import security certificates to an SSL-enabled domain or a domain that is not SSL-enabled.

If the domain is SSL-enabled, import the certificate file to the following location:

<Informatica installation directory>/services/shared/security/infa_truststore.jks

If the domain is not SSL-enabled, import the certificate file to the following location:

<Informatica installation directory>/java/jre/lib/security/cacerts

Configure the Data Integration Service to Use Truststore File Paths

To enable the Data Integration Service to access truststore files on the Hadoop cluster, perform the following steps to configure Data Integration Service properties with truststore file paths:

Get the location of truststore files from the cluster manager administration web page.

If you do not have access to the cluster manager, ask the cluster administrator for the path to the truststore files for the resources you want to access.

To enable access to Hive sources in Native mode, copy the truststore files to the corresponding location in the Hadoop distribution directory of the Informatica domain machine.

For example, if the truststore file is located at

/etc/security/serverKeys/all.jks

on the cluster, copy the file to the same location in the Hadoop distribution directory on the domain machine:

/etc/security/serverKeys/all.jks

. Create the directory if it does not exist.

In the Administrator tool, select the Data Integration Service in the

Domain Navigator

. Click the

Properties

tab to display Data Integration Service properties.

Click the

Edit

icon for Custom Properties.

The

Edit Custom Properties

dialog box appears.

Enter the following name for the custom property: JVMOption.

If a JVMOption custom property exists, then increment the name with an integer like JVMOption1.

In the

Value

pane for the property, type the following value:

-Djavax.net.ssl.trustStore=<path to the truststore file on the cluster>

For example:

-Djavax.net.ssl.trustStore=/etc/security/serverKeys/all.jks

Click

To access additional resources that use truststore files in different locations, repeat steps 4-7. Increment the custom property name with an integer.

The following image shows custom properties that allow the Data Integration Service to access truststore files in two different locations:

The Data Integration service converts the name of custom properties to add the "ExecutionContextOptions." prefix when you recycle the service.

Recycle the Data Integration Service.

If you have ever run a mapping on the Blaze engine, you must stop the Grid Manager application on the Data Integration Service host machine.

Run the following command to list existing YARN applications:

yarn application -list

In the list of YARN applications, identify the application ID for the Blaze Grid Manager.

Run the following command to stop the Grid Manager application:

yarn application -kill <application ID>

Now you can run the mapping from the Developer tool. The Data Integration System imports the truststore certificates at run time.

Rename Saved Search

Table of Contents

Configuring Big Data Management® to Access an SSL Enabled Hadoop Cluster

Configuring Big Data Management® to Access an SSL Enabled Hadoop Cluster

Creating and Configuring Security Certificates and Truststore Files

Creating and Configuring Security Certificates and Truststore Files

Import Security Certificates

Configure the Data Integration Service to Use Truststore File Paths