Configuring Kerberos Authentication in an Informatica Domain

Back Next

Kerberos Overview

Kerberos is a computer network authentication protocol that enables Informatica nodes communicating over a network to connect to one another in a secure manner. Kerberos authentication eliminates Informatica native accounts and removes the need for the domain to pass user credentials to LDAP servers. After you enable Kerberos authentication in a domain, Informatica clients use the Kerberos tickets created during the Windows authentication process to log in to the Informatica services running in the domain.

The Kerberos protocol uses a Key Distribution Center (KDC) to validate the identities of users and services and to grant tickets to authenticated user and service accounts. In the Kerberos protocol, users, processes, and services are known as principals. The KDC has a database of principals and their associated secret keys that are used as proof of identity. Informatica can run on a network that uses Kerberos authentication with Microsoft Active Directory Domain Services (AD DS) as the principal database.

The Kerberos authentication protocol uses keytab files to authenticate Informatica clients with services that run within the domain, including node processes, web application processes, and Informatica application services. A keytab
contains the service principal name (SPN)
that identifies the service within the Kerberos realm. The keytab also contains the encrypted key assigned to the SPN in Active Directory.

When the KDC gives a service ticket to a client, it encrypts the ticket with the key assigned to the SPN. The same key is stored in a keytab file on the node on which the service runs. The requested service uses the key to decrypt the service ticket.

Rename Saved Search

Table of Contents

Configuring Kerberos Authentication in an Informatica Domain

Configuring Kerberos Authentication in an Informatica Domain

Kerberos Overview

Kerberos Overview