English
  • PowerCenter 10.2 HotFix 2
  • All Products

Table of Contents

Search

  1. About the Security Guide
  2. Introduction to Informatica Security
  3. User Authentication
  4. LDAP Security Domains
  5. Kerberos Authentication
  6. Domain Security
  7. SAML Authentication for Informatica Web Applications
  8. Security Management in Informatica Administrator
  9. Users and Groups
  10. Privileges and Roles
  11. Permissions
  12. Audit Reports
  13. Command Line Privileges and Permissions
  14. Custom Roles
  15. Default List of Cipher Suites

Security Guide

Security Guide

Back Next

How Kerberos Works in an Informatica Domain

How Kerberos Works in an Informatica Domain

In a domain configured to use Kerberos authentication, Informatica clients authenticate with nodes and application services within the domain, without requiring passwords.
In a domain that uses Kerberos authentication, services that run within the domain, including node processes, web application processes, and Informatica application services, are Kerberos
principals
. The Active Directory principal database the Kerberos realm uses contains a user account for each principal.
The Kerberos authentication protocol uses
keytabs
 to authenticate Informatica clients with services that run within the domain. The keytab for a principal is stored on the node on which the service runs. The keytab contains the
service principal name (SPN)
 that identifies the service within the Kerberos realm, and the key assigned to the SPN in Active Directory.
When the KDC gives a service ticket to a client, it encrypts the ticket with the key assigned to the SPN. The requested service uses the key to decrypt the service ticket.
The following image illustrates the basic Kerberos authentication flow:
Kerberos authentication uses tickets to enable users to authenticate with services in an Informatica domain.
The following outline describes the basic Kerberos authentication flow:
  1. An Informatica client user logs in to a network computer hosting an Informatica client.
  2. The login request is directed to the
    Authentication Server
    , a component of the
    Kerberos Key Distribution Center (KDC)
    . The KDC is a network service with access to user account information that runs on each domain controller within the Active Directory domain.
  3. The Authentication Server verifies that the user exists in the principal database, and then creates a Kerberos token called a
    ticket-granting-ticket (TGT)
     on the user's computer.
  4. The user attempts to access a process or service within the Informatica domain through an Informatica client.
  5. Informatica and the Kerberos libraries use the TGT to request a
    service ticket
     and
    session key
     for the requested service from the
    Ticket Granting Server
    , which also runs within the KDC.
    For example, if the user accesses a Model Repository Service from the Informatica Developer client, the TGT requests a service ticket for the node on which the requested service runs. The TGT also requests a service ticket for the Model Repository Service.
  6. Kerberos uses the service ticket to authenticates the client with the requested service.
    The service ticket is cached on the computer hosting the Informatica client, enabling the client to use the ticket while it remains valid. If the user shuts down and then restarts the Informatica client, the client reuses the same ticket to access processes and services within the Informatica domain.