Table of Contents

  1. About the Security Guide
  2. Introduction to Informatica Security
  3. User Authentication
  4. LDAP Security Domains
  5. Kerberos Authentication
  6. Domain Security
  7. SAML Authentication for Informatica Web Applications
  8. Security Management in Informatica Administrator
  9. Users and Groups
  10. Privileges and Roles
  11. Permissions
  12. Audit Reports
  13. Command Line Privileges and Permissions
  14. Custom Roles
  15. Default List of Cipher Suites

Security Guide

Security Guide

Step 1. Set Up the Connection to the LDAP Server

Step 1. Set Up the Connection to the LDAP Server

Configure the connection to the LDAP server that contains the directory service from which you want to import the user accounts for the Informatica domain.
When you configure the connection to the LDAP server, indicate that the Service Manager must ignore the case-sensitivity of the distinguished name attributes of the LDAP user accounts when it assigns users to groups in the Informatica domain. If the Service Manager does not ignore case sensitivity, the Service Manager might not assign all the users that belong to a group.
If the LDAP server uses SSL, you must import the certificate into the cacerts truststore file on every gateway node within the Informatica domain. See Using a Self-Signed SSL Certificate for details.
To set up a connection to the LDAP directory service, perform the following tasks:
  1. In the Administrator tool, click the Security tab.
  2. Click the Actions menu and select LDAP Configuration.
  3. In the LDAP Configuration dialog box, click the LDAP Connectivity tab.
  4. Configure the connection properties for the LDAP server.
    You might need to consult the LDAP administrator to get the information about the LDAP server.
    The following table describes the LDAP server configuration properties:
    Property
    Description
    Server name
    Host name or IP address of the machine hosting the LDAP directory service.
    Port
    Listening port for the LDAP server. This is the port number to communicate with the LDAP directory service. Typically, the LDAP server port number is 389. If the LDAP server uses SSL, the LDAP server port number is 636. The maximum port number is 65535.
    LDAP Directory Service
    Type of LDAP directory service.
    If you use Kerberos authentication, you must select Microsoft Active Directory.
    Name
    Distinguished name (DN) for the principal user. The user name often consists of a common name (CN), an organization (O), and a country (C). The principal user name is an administrative user with access to the directory. Specify a user that has permission to read other user entries in the LDAP directory service. Leave blank for anonymous login. For more information, see the documentation for the LDAP directory service.
    Password
    Password for the principal user. Leave blank for anonymous login.
    Not available if you use Kerberos authentication.
    Use SSL Certificate
    Indicates that the LDAP server uses the Secure Socket Layer (SSL) protocol.
    Trust LDAP Certificate
    Determines whether the Service Manager can trust the SSL certificate of the LDAP server. If selected, the Service Manager connects to the LDAP server without verifying the SSL certificate. If not selected, the Service Manager verifies that the SSL certificate is signed by a certificate authority before connecting to the LDAP server.
    To enable the Service Manager to recognize a self-signed certificate as valid, specify the truststore file and password to use.
    Not Case Sensitive
    Indicates that the Service Manager must ignore case sensitivity for distinguished name attributes when assigning users to groups. Enable this option.
    Group Membership Attribute
    Name of the attribute that contains group membership information for a user. This is the attribute in the LDAP group object that contains the DNs of the users or groups who are members of a group. For example, member or memberof.
    Maximum Size
    Maximum number of user accounts to import into a security domain. For example, if the value is set to 100, you can import a maximum of100 user accounts into the security domain.
    If the number of user to be imported exceeds the value for this property, the Service Manager generates an error message and does not import any user. Set this property to a higher value if you have many users to import.
    Default is 1000.
  5. Click Test Connection to verify that the connection to the LDAP server is valid.

Updated July 24, 2019


Explore Informatica Network