Configuring Kerberos Authentication in an Informatica Domain

Back Next

Step 1. Configure and Deploy the Kerberos Configuration File

Set the properties required by Informatica in the Kerberos configuration file, and then copy the file to each node in the Informatica domain.

The configuration file is named krb5.conf. You can find a copy of the file in the following directory on a node:

<Informatica installation directory>\server\bin\javalib\msdcrm\conf

Enter the following properties in the libdefaults section of the file.

The following table describes the properties to enter:

Property	Description
default_realm	Name of the Kerberos realm to which the Informatica domain services belong. The realm name must be in uppercase. The service realm name and the user realm name must be the same.
forwardable	Allows a service to delegate client user credentials to another service. The Informatica domain requires application services to authenticate the client user credentials with other services. Set to true.
rdns	Determines whether reverse name lookup is used in addition to forward name lookup to canonicalize host names for use in service principal names. Set to false.
renew_lifetime	The default renewable lifetime for initial ticket requests.
ticket_lifetime	The default lifetime for initial ticket requests.
udp_preference_limit	Determines the protocol that Kerberos uses when it sends a message to the KDC. Set to 1 to use the TCP protocol.

Define each Kerberos realm in the realms section of the file.

[realms]
COMPANY.COM = {...}

Enter the following properties inside the brackets for each Kerberos realm in the realms section of the file.

The following table describes the properties to enter:

Property	Description
admin_server	The name or IP address of the Kerberos administration server host. You can include an optional port number, separated from the host name by a colon. Default is 749.
kdc	The name or IP address of a host running the Key Distribution Center (KDC) for the realm. You can include an optional port number, separated from the host name by a colon. Default is 88.

[realms]
COMPANY.COM = {
admin_server = KDC01.COMPANY.COM:749
kdc = KDC01.COMPANY.COM:88
}

Map the Active Directory domain to the Kerberos domain in the default_realm section of the file. The Active Directory domain name must be all lowercase. The Kerberos domain name must be all uppercase.

[default_realm]
.company.com = COMPANY.COM
company.com = COMPANY.COM

Copy the configuration file to the following directory on every node in the domain:

<Informatica installation directory>\services\shared\security

The following example shows the content of a Kerberos configuration file with the required properties:

[libdefaults]
default_realm = COMPANY.COM
forwardable = true
rdns = false
renew_lifetime = 7d
ticket_lifetime = 24h
udp_preference_limit = 1

[realms]
KERBREALM.COM = {
  admin_server = KDC01.COMPANY.COM:749
  kdc = KDC01.COMPANY.COM:88
 }

[domain_realm]
.company.com = COMPANY.COM
company.com = COMPANY.COM

Rename Saved Search

Table of Contents

Configuring Kerberos Authentication in an Informatica Domain

Configuring Kerberos Authentication in an Informatica Domain

Step 1. Configure and Deploy the Kerberos Configuration File

Step 1. Configure and Deploy the Kerberos Configuration File