Table of Contents

  1. About the Security Guide
  2. Introduction to Informatica Security
  3. User Authentication
  4. LDAP Security Domains
  5. Kerberos Authentication
  6. Domain Security
  7. SAML Authentication for Informatica Web Applications
  8. Security Management in Informatica Administrator
  9. Users and Groups
  10. Privileges and Roles
  11. Permissions
  12. Audit Reports
  13. Command Line Privileges and Permissions
  14. Custom Roles
  15. Default List of Cipher Suites

Security Guide

Security Guide

Configure the Informatica Domain with a New Effective List of Cipher Suites

Configure the Informatica Domain with a New Effective List of Cipher Suites

To configure the cipher suites that the Informatica domain uses, you must update the Informatica domain, all gateway nodes, and all worker nodes with the same whitelist and blacklist.
Changes to the blacklist, whitelist, and effective list are not cumulative. Informatica creates a new effective list based on the blacklist, default list, and whitelist when you run the command. The new effective list overwrites the previous list.
To configure an existing Informatica domain with a new effective list of cipher suites, perform the following steps:
  1. Shutdown the Informatica domain.
  2. Optionally, run the infasetup listDomainCiphers command to view the lists of cipher suites that a domain or node supports or blocks.
    For example, run the following command to view all the cipher suite lists:
    infasetup listDomainCiphers -l ALL -dc true
  3. Run the infasetup updateDomainCiphers command on a gateway node and specify a whitelist, blacklist, or both.
    For example, run the following command to add one cipher suite to the effective list and remove two cipher suites from the effective list:
    infasetup updateDomainCiphers -cwl TLS_DHE_DSS_WITH_AES_128_CBC_SHA -cbl TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA  
  4. Run the infasetup updateGatewayNode command on each gateway node and specify a whitelist, blacklist, or both.
    Use the same whitelist and blacklist as the domain.
    For example, run the following command:
    infasetup updateGatewayNode -cwl TLS_DHE_DSS_WITH_AES_128_CBC_SHA -cbl TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA  
  5. Update each worker node with the same set of cipher suites as the Informatica domain.
    Use the same whitelist and blacklist as the domain.
    For example, run the following command:
    infasetup updateWorkerNode -cwl TLS_DHE_DSS_WITH_AES_128_CBC_SHA -cbl TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA  
  6. Start the Informatica domain.
  7. Optionally, run the infacmd isp listDomainCiphers command to view the lists of cipher suites that a domain or node uses.
    For example, run the following command to view the effective list of cipher suites that the domain uses:
    infacmd isp listDomainCiphers -l EFFECTIVE

Updated July 24, 2019


Explore Informatica Network