Table of Contents

Search

  1. About the Security Guide
  2. Introduction to Informatica Security
  3. User Authentication
  4. LDAP Security Domains
  5. Kerberos Authentication
  6. Domain Security
  7. SAML Authentication for Informatica Web Applications
  8. Security Management in Informatica Administrator
  9. Users and Groups
  10. Privileges and Roles
  11. Permissions
  12. Audit Reports
  13. Command Line Privileges and Permissions
  14. Custom Roles
  15. Default List of Cipher Suites

Security Guide

Security Guide

Configuring a Secure Domain Configuration Repository Database

Configuring a Secure Domain Configuration Repository Database

After installation, you can change the domain configuration repository to a secure database. You can use a secure domain configuration repository database only if you enable secure communication for the domain.
You must shut down the domain before you change the domain configuration repository database. Use the infasetup command to back up the domain configuration repository database and to restore it in a secure database. When you restore the domain configuration repository in the secure database, specify the security parameters for the secure database. Then update the gateway node with the domain configuration repository information.
To back up and restore the repository database and update the gateway node, use the following commands:
infasetup BackupDomain
Use the BackupDomain option to back up data from the domain configuration repository database.
infasetup RestoreDomain
Use the RestoreDomain option to restore domain configuration repository data to a secure database.
infasetup UpdateGatewayNode
Use the UpdateGatewayNode option update the domain configuration repository settings in the gateway nodes of the domain.
To change the domain configuration repository to a secure database, complete the following steps:
  1. Verify that secure communication is enabled for the domain.
    The domain must be secure before you can use a secure database for the domain configuration repository.
  2. Shut down the domain.
  3. Run the infasetup BackupDomain command and specify the database connection information.
    When you run the BackupDomain command, infasetup backs up most of the domain configuration database tables to the file name you specify.
    If the infasetup backup or restore command fails with a Java memory error, increase the system memory available for infasetup. To increase system memory, set the -Xmx value in the INFA_JAVA_CMD_OPTS environment variable.
  4. Use the database backup utility to manually back up additional repository tables that the infasetup command does not back up.
    Back up the contents of the following table:
    • ISP_RUN_LOG
  5. To restore the domain configuration repository in the secure database, run the infasetup RestoreDomain command and specify the database connection information.
    In addition to the connection information, specify the following options required for the secure database:
    Option Argument Description
    -DatabaseTlsEnabled
    -dbtls
    database_tls_enabled Required. Indicates whether the database into which the domain configuration repository will be restored is a secure database. Set this option to True.
    -DatabaseTruststoreLocation
    -dbtl
    database_truststore_location Required. Path and file name of the truststore file that contains the SSL certificate for the database.
    -DatabaseTruststorePassword
    -dbtp
    database_truststore_password Required. Password for the database truststore file for the secure database.
    In the connection string, include the following security parameters:
    EncryptionMethod
    Required. Indicates whether data is encrypted when transmitted over the network. This parameter must be set to SSL.
    ValidateServerCertificate
    Optional. Indicates whether Informatica validates the certificate that the database server sends.
    If this parameter is set to True, Informatica validates the certificate that the database server sends. If you specify the HostNameInCertificate parameter, Informatica also validates the host name in the certificate.
    If this parameter is set to False, Informatica does not validate the certificate that the database server sends. Informatica ignores any truststore information that you specify.
    Default is True.
    HostNameInCertificate
    Optional. Host name of the machine that hosts the secure database. If you specify a host name, Informatica validates the host name included in the connection string against the host name in the SSL certificate.
    cryptoProtocolVersion
    Required. Specifies the cryptographic protocol to use to connect to a secure database. You can set the parameter to cryptoProtocolVersion=TLSv1.1 or cryptoProtocolVersion=TLSv1.2 based on the cryptographic protocol used by the database server.
  6. Use the database restore utility to restore the repository tables that you manually backed up.
    Restore the following table:
    • ISP_RUN_LOG
  7. To update the nodes in the domain with information about the secure domain configuration repository, run the infasetup UpdateGatewayNode command and specify the secure database connection information.
    In addition to the node options, specify the following options required for the secure database:
    Option Argument Description
    -DatabaseTlsEnabled
    -dbtls
    database_tls_enabled Required. Indicates the database used for the domain configuration repository is a secure database. Set this option to True.
    -DatabaseConnectionString
    -cs
    database_connection_string Required. Connection string to use to connect to the secure database. The connection string must include the security parameters that you included in the connection string when you ran the infasetup RestoreDomain command in step 5
    -DatabaseTruststorePassword
    -dbtp
    database_truststore_password Required. Password for the database truststore file for the secure database.
    If you have multiple gateway nodes in the domain, run infasetup UpdateGatewayNode on each gateway node.
  8. Restart the domain.


Updated October 10, 2019


Explore Informatica Network