In a domain configured to use Kerberos authentication, Informatica clients authenticate with Informatica nodes, web applications, and application services within the domain, without requiring passwords.
The Kerberos authentication protocol uses keytab files to authenticate Informatica clients with services that run within the domain, including node processes, web application processes, and Informatica application services. A
keytab
contains the
service principal name (SPN)
that identifies the service within the Kerberos realm. The keytab also contains the encrypted key assigned to the SPN in Active Directory.
When the KDC gives a service ticket to a client, it encrypts the ticket with the key assigned to the SPN. The same key is stored in a keytab file on the node on which the service runs. The requested service uses the key to decrypt the service ticket.
The following image illustrates the basic Kerberos authentication flow:
The following outline describes the basic Kerberos authentication flow:
An Informatica client user logs in to a network computer hosting an Informatica client.
The login request is directed to the
Authentication Server
, a component of the
Kerberos Key Distribution Center (KDC)
. The KDC is a network service with access to user account information that runs on each domain controller within the Active Directory domain.
The Authentication Server verifies that the user exists in the principal database, and then creates a Kerberos token called a
ticket-granting-ticket (TGT)
on the user's computer.
The user attempts to access a process or service within the Informatica domain through an Informatica client.
Informatica and the Kerberos libraries use the TGT to request a
service ticket
and
session key
for the requested service from the
Ticket Granting Server
, which also runs within the KDC.
For example, if the user accesses a Model Repository Service from the Informatica Developer client, the TGT requests a service ticket for the node on which the requested service runs. The TGT also requests a service ticket for the Model Repository Service.
Kerberos uses the service ticket to authenticates the client with the requested service.
The service ticket is cached on the computer hosting the Informatica client, enabling the client to use the ticket while it remains valid. If the user shuts down and then restarts the Informatica client, the client reuses the same ticket to access processes and services within the Informatica domain.
