English
PowerCenter All Products

Table of Contents

Search

  1. About the Security Guide
  2. Introduction to Informatica Security
  3. User Authentication
  4. LDAP Security Domains
  5. Kerberos Authentication
  6. Domain Security
  7. SAML Authentication for Informatica Web Applications
  8. Security Management in Informatica Administrator
  9. Users and Groups
  10. Privileges and Roles
  11. Permissions
  12. Audit Reports
  13. Command Line Privileges and Permissions
  14. Custom Roles
  15. Default List of Cipher Suites

Security Guide

Security Guide

Back Next

How Kerberos Works in an Informatica Domain

How Kerberos Works in an Informatica Domain

In a domain configured to use Kerberos authentication, Informatica clients authenticate with Informatica nodes, web applications, and application services within the domain, without requiring passwords.
The Kerberos authentication protocol uses keytab files to authenticate Informatica clients with services that run within the domain, including node processes, web application processes, and Informatica application services. A
keytab
 contains the
service principal name (SPN)
 that identifies the service within the Kerberos realm. The keytab also contains the encrypted key assigned to the SPN in Active Directory.
When the KDC gives a service ticket to a client, it encrypts the ticket with the key assigned to the SPN. The same key is stored in a keytab file on the node on which the service runs. The requested service uses the key to decrypt the service ticket.
The following image illustrates the basic Kerberos authentication flow:
Kerberos authentication uses tickets to enable users to authenticate with services in an Informatica domain.
The following outline describes the basic Kerberos authentication flow:
  1. An Informatica client user logs in to a network computer hosting an Informatica client.
  2. The login request is directed to the
    Authentication Server
    , a component of the
    Kerberos Key Distribution Center (KDC)
    . The KDC is a network service with access to user account information that runs on each domain controller within the Active Directory domain.
  3. The Authentication Server verifies that the user exists in the principal database, and then creates a Kerberos token called a
    ticket-granting-ticket (TGT)
     on the user's computer.
  4. The user attempts to access a process or service within the Informatica domain through an Informatica client.
  5. Informatica and the Kerberos libraries use the TGT to request a
    service ticket
     and
    session key
     for the requested service from the
    Ticket Granting Server
    , which also runs within the KDC.
    For example, if the user accesses a Model Repository Service from the Informatica Developer client, the TGT requests a service ticket for the node on which the requested service runs. The TGT also requests a service ticket for the Model Repository Service.
  6. Kerberos uses the service ticket to authenticates the client with the requested service.
    The service ticket is cached on the computer hosting the Informatica client, enabling the client to use the ticket while it remains valid. If the user shuts down and then restarts the Informatica client, the client reuses the same ticket to access processes and services within the Informatica domain.

Updated April 29, 2019

Download Guide
Send Feedback
Explore Informatica Network
Communities
Knowledge Base
Success Portal