Table of Contents

Search

  1. About the Security Guide
  2. Introduction to Informatica Security
  3. User Authentication
  4. LDAP Security Domains
  5. Kerberos Authentication
  6. Domain Security
  7. SAML Authentication for Informatica Web Applications
  8. Security Management in Informatica Administrator
  9. Users and Groups
  10. Privileges and Roles
  11. Permissions
  12. Audit Reports
  13. Command Line Privileges and Permissions
  14. Custom Roles
  15. Default List of Cipher Suites

Security Guide

Security Guide

Generate the Service Principal Name and Keytab File Name Formats at Node Level

Generate the Service Principal Name and Keytab File Name Formats at Node Level

Generate the formats for the SPNs and keytab file names required to enable Kerberos authentication at the node level.
The Informatica domain requires SPNs and keytab files for the following processes when you enable Kerberos authentication at the node level:
Node processes
Informatica requires an SPN and keytab file for every node in the domain. Kerberos uses the same service principal name and keytab to authenticate the Informatica application services that run on the node.
HTTP processes
Informatica requires an SPN and keytab file for the web applications that run on each node in the domain. Web applications that run on a node might include the Administrator tool, Informatica Analyst and Catalog Administrator. Kerberos uses the same service principal name to authenticate all of the web applications that run on the node.
  1. On a Windows Informatica node host, go to the directory that contains the SPNFormatGenerator.bat batch file:
    <Informatica installation directory>\tools\Kerberos
    On a UNIX Informatica node host, go to the directory that contains the SPNFormatGenerator.sh shell file:
    <Informatica installation directory>/tools/Kerberos
  2. Run SPNFormatGenerator.bat or SPNFormatGenerator.sh.
  3. Click Next.
  4. Select Node Level.
  5. Click Next.
  6. Enter the properties required to generate the SPN and keytab file formats.
    The following table describes the properties:
    Prompt Description
    Domain Name Name of the Informatica domain. The name must not exceed 128 characters and must be 7-bit ASCII. It cannot contain a space or any of the following characters: ` % * + ; " ? , < > \ /
    Service Realm Name Name of the Kerberos realm. The realm name must be in uppercase.
    Node Name Name of the Informatica node.
    Node Host Name Fully qualified name of the node host. The node host name cannot contain the underscore (_) character.
    Do not use localhost. The host name must explicitly identify the host.
  7. To generate the SPN format for an additional node, click +Node and specify the node name and host name.
    The following image shows the entries for multiple nodes in the InfaDomain domain in the SPN Format Generator utility:
    The SPN Format Generator utility displays the domain name, Kerberos service realm name, and all node names and node host names that you entered.
  8. Click Next.
    The SPN Format Generator utility displays the path and file name of the file that contains the list of service principal names and keytab file names.
  9. Click Done to exit the SPN Format Generator utility.


Updated October 10, 2019


Explore Informatica Network