Security Guide

Back Next

Configuring a Secure Domain Configuration Repository Database

After installation, you can change the domain configuration repository to a secure database. You can use a secure domain configuration repository database only if you enable secure communication for the domain.

You must shut down the domain before you change the domain configuration repository database. Use the infasetup command to back up the domain configuration repository database and to restore it in a secure database. When you restore the domain configuration repository in the secure database, specify the security parameters for the secure database. Then update the gateway node with the domain configuration repository information.

To back up and restore the repository database and update the gateway node, use the following commands:

infasetup BackupDomain: Use the BackupDomain option to back up data from the domain configuration repository database.
infasetup RestoreDomain: Use the RestoreDomain option to restore domain configuration repository data to a secure database.
infasetup UpdateGatewayNode: Use the UpdateGatewayNode option update the domain configuration repository settings in the gateway nodes of the domain.

To change the domain configuration repository to a secure database, complete the following steps:

Verify that secure communication is enabled for the domain.

The domain must be secure before you can use a secure database for the domain configuration repository.

Shut down the domain.

Run the infasetup BackupDomain command and specify the database connection information.

When you run the BackupDomain command, infasetup backs up most of the domain configuration database tables to the file name you specify.

If the infasetup backup or restore command fails with a Java memory error, increase the system memory available for infasetup. To increase system memory, set the -Xmx value in the INFA_JAVA_CMD_OPTS environment variable.

Use the database backup utility to manually back up additional repository tables that the infasetup command does not back up.

Back up the contents of the following table:

ISP_RUN_LOG

To restore the domain configuration repository in the secure database, run the infasetup RestoreDomain command and specify the database connection information.

In addition to the connection information, specify the following options required for the secure database:

Option	Argument	Description
-DatabaseTlsEnabled -dbtls	database_tls_enabled	Required. Indicates whether the database into which the domain configuration repository will be restored is a secure database. Set this option to True.
-DatabaseTruststoreLocation -dbtl	database_truststore_location	Required. Path and file name of the truststore file that contains the SSL certificate for the database.
-DatabaseTruststorePassword -dbtp	database_truststore_password	Required. Password for the database truststore file for the secure database.

In the connection string, include the following security parameters:

EncryptionMethod: Required. Indicates whether data is encrypted when transmitted over the network. This parameter must be set to
SSL
.
ValidateServerCertificate: Optional. Indicates whether Informatica validates the certificate that the database server sends.
If this parameter is set to True, Informatica validates the certificate that the database server sends. If you specify the HostNameInCertificate parameter, Informatica also validates the host name in the certificate.
If this parameter is set to False, Informatica does not validate the certificate that the database server sends. Informatica ignores any truststore information that you specify.
Default is True.
HostNameInCertificate: Optional. Host name of the machine that hosts the secure database. If you specify a host name, Informatica validates the host name included in the connection string against the host name in the SSL certificate.
cryptoProtocolVersion: Required. Specifies the cryptographic protocol to use to connect to a secure database. You can set the parameter to
cryptoProtocolVersion=TLSv1.1
or
cryptoProtocolVersion=TLSv1.2
based on the cryptographic protocol used by the database server.

Use the database restore utility to restore the repository tables that you manually backed up.

Restore the following table:

ISP_RUN_LOG

To update the nodes in the domain with information about the secure domain configuration repository, run the infasetup UpdateGatewayNode command and specify the secure database connection information.

In addition to the node options, specify the following options required for the secure database:

Option	Argument	Description
-DatabaseTlsEnabled -dbtls	database_tls_enabled	Required. Indicates the database used for the domain configuration repository is a secure database. Set this option to True.
-DatabaseConnectionString -cs	database_connection_string	Required. Connection string to use to connect to the secure database. The connection string must include the security parameters that you included in the connection string when you ran the infasetup RestoreDomain command in step 5
-DatabaseTruststorePassword -dbtp	database_truststore_password	Required. Password for the database truststore file for the secure database.

If you have multiple gateway nodes in the domain, run infasetup UpdateGatewayNode on each gateway node.

Rename Saved Search

Table of Contents

Security Guide

Security Guide

Configuring a Secure Domain Configuration Repository Database

Configuring a Secure Domain Configuration Repository Database