Security Guide

Back Next

Generate the Service Principal Name and Keytab File Name Formats at Node Level

Generate the formats for the SPNs and keytab file names required to enable Kerberos authentication at the node level.

The Informatica domain requires SPNs and keytab files for the following processes when you enable Kerberos authentication at the node level:

Node processes: Informatica requires an SPN and keytab file for every node in the domain. Kerberos uses the same service principal name and keytab to authenticate the Informatica application services that run on the node.
HTTP processes: Informatica requires an SPN and keytab file for the web applications that run on each node in the domain. Web applications that run on a node might include the Administrator tool, Informatica Analyst and Catalog Administrator. Kerberos uses the same service principal name to authenticate all of the web applications that run on the node.

On a Windows Informatica node host, go to the directory that contains the SPNFormatGenerator.bat batch file:

<Informatica installation directory>\tools\Kerberos

On a UNIX Informatica node host, go to the directory that contains the SPNFormatGenerator.sh shell file:

<Informatica installation directory>/tools/Kerberos

Run SPNFormatGenerator.bat or SPNFormatGenerator.sh.

Click

Select

Node Level

Click

Enter the properties required to generate the SPN and keytab file formats.

The following table describes the properties:

Prompt	Description
Domain Name	Name of the Informatica domain. The name must not exceed 128 characters and must be 7-bit ASCII. It cannot contain a space or any of the following characters: ` % * + ; " ? , < > \ /
Service Realm Name	Name of the Kerberos realm. The realm name must be in uppercase.
Node Name	Name of the Informatica node.
Node Host Name	Fully qualified name of the node host. The node host name cannot contain the underscore (_) character. Do not use localhost . The host name must explicitly identify the host.