Table of Contents

Search

  1. About the Security Guide
  2. Introduction to Informatica Security
  3. User Authentication
  4. LDAP Authentication
  5. Kerberos Authentication
  6. SAML Authentication for Informatica Web Applications
  7. Domain Security
  8. Security Management in Informatica Administrator
  9. Users and Groups
  10. Privileges and Roles
  11. Permissions
  12. Audit Reports
  13. Command Line Privileges and Permissions
  14. Custom Roles
  15. Default List of Cipher Suites

Security Guide

Security Guide

Verify the Service Principal Names and Keytab Files

Verify the Service Principal Names and Keytab Files

You can use Kerberos utilities to verify that the SPNs and the keytab files are valid. You can also use the utilities to determine the status of the Kerberos Key Distribution Center (KDC).
You can use Kerberos utilities such as
kinit
and
klist
to view and verify the SPNs and keytab files. To use the utilities, ensure that the KRB5_CONFIG environment variable contains the path and file name of the Kerberos configuration file. For more information about running the Kerberos utilities, see the Kerberos documentation.
Use the following utilities to verify the SPNs and keytab files:
kinit
You can use the
kinit
utility to request a ticket-granting ticket (TGT) from the KDC and verify that a keytab file can be used to establish a Kerberos connection. If the keytab and specified SPN are valid, the command obtains a ticket, and then caches the ticket in the specified cache.
The kinit utility is available in the following directory on an Informatica node:
<Informatica installation directory>\java\jre\bin
To request a ticket-granting ticket for an SPN, run the following command:
kinit -c <cache name> -k -t <keytab file name> <service principal name>
The following output example shows the ticket-granting ticket created in the default cache for a specified keytab file and SPN:
Cache: \temp\krb Using principal: isp/node01/InfaDomain/COMPANY.COM Using keytab: node01.keytab Authenticated to Kerberos v5
klist
You can use the
klist
utility to list the Kerberos principals and keys in a keytab file. To list the keys in the keytab file and the time stamp for the keytab entry, run the following command:
klist -k -t <keytab file name>
The following output example shows the principals in a keytab file:
Keytab name: FILE:node01.keytab KVNO Timestamp Principal ---- ----------------- -------------------------------------------------------- 3 12/31/16 19:00:00 MRS_dev/node01/InfaDomain@COMPANY.COM 3 12/31/16 19:00:00 MRS_dev/node01/InfaDomain@COMPANY.COM 3 12/31/16 19:00:00 MRS_dev/node01/InfaDomain@COMPANY.COM 3 12/31/16 19:00:00 MRS_dev/node01/InfaDomain@COMPANY.COM

0 COMMENTS

We’d like to hear from you!