In a domain configured to use Kerberos authentication, Informatica clients authenticate with nodes and application services within the domain, without requiring passwords.
In a domain that uses Kerberos authentication, services that run within the domain, including node processes, web application processes, and Informatica application services, are Kerberos
principals. The Active Directory principal database the Kerberos realm uses contains a user account for each principal.
The Kerberos authentication protocol uses
keytabs to authenticate Informatica clients with services that run within the domain. The keytab for a principal is stored on the node on which the service runs. The keytab contains the
service principal name (SPN) that identifies the service within the Kerberos realm, and the key assigned to the SPN in Active Directory.
When the KDC gives a service ticket to a client, it encrypts the ticket with the key assigned to the SPN. The requested service uses the key to decrypt the service ticket.
The following image illustrates the basic Kerberos authentication flow:
The following outline describes the basic Kerberos authentication flow:
An Informatica client user logs in to a network computer hosting an Informatica client.
The login request is directed to the
Authentication Server, a component of the
Kerberos Key Distribution Center (KDC). The KDC is a network service with access to user account information that runs on each domain controller within the Active Directory domain.
The Authentication Server verifies that the user exists in the principal database, and then creates a Kerberos token called a
ticket-granting-ticket (TGT) on the user's computer.
The user attempts to access a process or service within the Informatica domain through an Informatica client.
Informatica and the Kerberos libraries use the TGT to request a
service ticket and
session key for the requested service from the
Ticket Granting Server, which also runs within the KDC.
For example, if the user accesses a Model Repository Service from the Informatica Developer client, the TGT requests a service ticket for the node on which the requested service runs. The TGT also requests a service ticket for the Model Repository Service.
Kerberos uses the service ticket to authenticates the client with the requested service.
The service ticket is cached on the computer hosting the Informatica client, enabling the client to use the ticket while it remains valid. If the user shuts down and then restarts the Informatica client, the client reuses the same ticket to access processes and services within the Informatica domain.
