Table of Contents

  1. About the Security Guide
  2. Introduction to Informatica Security
  3. User Authentication
  4. LDAP Security Domains
  5. Kerberos Authentication
  6. Domain Security
  7. SAML Authentication for Informatica Web Applications
  8. Security Management in Informatica Administrator
  9. Users and Groups
  10. Privileges and Roles
  11. Permissions
  12. Audit Reports
  13. Command Line Privileges and Permissions
  14. Custom Roles
  15. Default List of Cipher Suites

Security Guide

Security Guide

Configuring the Informatica Client Applications to Work with a Secure Domain

Configuring the Informatica Client Applications to Work with a Secure Domain

When you enable secure communication within the domain, you also secure connections between the domain and Informatica client applications, such as the Developer tool. You might need to specify the location and password for the truststore files that you use to secure the domain in environment variables. You set the environment variables on machines hosting client applications that access services within the domain.
SSL certificates that are used to secure an Informatica domain are contained in truststore files named infa_truststore.jks and infa_truststore.pem. The truststore files must be available on each client host.
You might need to set the following environment variables on each client host:
INFA_TRUSTSTORE
Set this variable to the directory that contains the infa_truststore.jks and infa_truststore.pem truststore files.
INFA_TRUSTSTORE_PASSWORD
Set this variable to the password for the truststore. The password must be encrypted. Use the command line program pmpasswd to encrypt the password.
Informatica provides an SSL certificate in default truststore files that you can use to secure the domain. When you install the Informatica clients, the installer sets the environment variables and installs the truststore files in the following directory by default: <Informatica installation directory>\clients\shared\security
If you use the default Informatica SSL certificate, and the infa_truststore.jks and infa_truststore.pem files are in the default directory, you do not need to set the INFA_TRUSTSTORE or INFA_TRUSTSTORE_PASSWORD environment variables.
You must set the INFA_TRUSTSTORE and INFA_TRUSTSTORE_PASSWORD environment variables on each client host in the following scenarios:
You use a custom SSL certificate to secure the domain.
If you provide an SSL certificate to use to secure the domain, import the certificate into truststore files named infa_truststore.jks and infa_truststore.pem, and then copy the truststore files to each client host. You must specify the location of the files and the truststore password.
Important: If you push processing to a compute cluster and the Data Integration Service runs on a grid, import the certificates one time and then copy them to each Data Integration Service on the grid. Each time you import a certificate, the contents of the certificate are identical, but the hex values are different. As a result, concurrent mappings that run on the grid fail with initialization errors.
You replace the default Informatica truststore files with your own truststore files in the default directory.
If you replace the default the infa_truststore.jks and infa_truststore.pem truststore files with your own truststore files in the default Informatica directory, you must specify the truststore password. The truststore files must have the same filenames as the default truststore files.
You use the default Informatica SSL certificate, but the truststore files are not in the default Informatica directory.
If you use the default Informatica SSL certificate, but the default infa_truststore.jks and infa_truststore.pem truststore files are not in the default directory, you must specify the location of the files and the truststore password.

Updated May 17, 2019


Explore Informatica Network