Configuring Kerberos Authentication in an Informatica Domain

Back Next

Step 4. Generate the Keytab Files

Use the Microsoft Windows Server ktpass utility to generate a keytab file for each user account you created in Active Directory.

You must generate the keytab files on a member server or on a domain controller within the Active Directory domain. You cannot generate keytab files on a workstation operating system such as Microsoft Windows 7.

To use ktpass to generate a keytab file, run the following command:

ktpass.exe -out  <KeytabFilename> -princ <ServicePrincipalName> -mapuser <UserAccount> [-pass <UserAccountPassword>]-crypto <Keys> -ptype <PrincipalType>

The following table describes the command options:

Option	Description
-out	The file name of the Kerberos keytab file to generate as shown under the KEY_TAB_NAME column in the SPNKeytabFormat.txt file.
-princ	The service principal name displayed under the SPN column in the SPNKeytabFormat.txt file.
-mapuser	The Active Directory user account to associate with the SPN.
-pass	The password set in Active Directory for the Active Directory user account, if applicable.
-crypto	Specifies the key types generated in the keytab file. Set to all to use all supported cryptographic types.
-ptype	The principal type. Set to KRB5_NT_PRINCIPAL.

When you run ktpass, you associate each node account and HTTP process account with the corresponding SPN in Active Directory. The following table shows the association between the accounts and the SPNs described in this article:

User Account	Keytab Type	SPN
nodeuser01	NODE_SPN	isp/node01/InfaDomain/COMPANY.COM
httpuser01	NODE_HTTP_SPN	HTTP/US001DEV.company.com@COMPANY.COM
nodeuser02	NODE_SPN	isp/node02/InfaDomain/COMPANY.COM
httpuser02	NODE_HTTP_SPN	HTTP/US005DEV.company.com@COMPANY.COM
nodeuser03	NODE_SPN	isp/node03/InfaDomain/COMPANY.COM

Create a keytab file for each node process user account you created.

Copy the file name from the

KEY_TAB_NAME

column in the SPNKeytabFormat.txt file.

The following example creates a keytab file for the nodeuser01 user:

ktpass.exe -out node01.keytab -princ isp/node01/InfaDomain/COMPANY.COM -mapuser nodeuser01 -pass password -crypto all -ptype KRB5_NT_PRINCIPAL

Create a keytab file for each HTTP process user account you created.

Copy the file name from the

KEY_TAB_NAME

column in the SPNKeytabFormat.txt file.

The following example creates a keytab file for the httpuser01 service principal user:

ktpass.exe -out webapp_http.keytab -princ HTTP/US001DEV.company.com@COMPANY.COM -mapuser httpuser01 -pass password -crypto all -ptype KRB5_NT_PRINCIPAL

Create a keytab for the account that is used to access and search Active Directory during LDAP synchronization.

Structure the value for the -princ option as principal_name@KERBEROS_REALM. The file name of the keytab file must be infa_ldapuser.keytab.

The following example creates a keytab file for the ldapuser account:

ktpass.exe -out infa_ldapuser.keytab -princ ldapuser@COMPANY.COM -mapuser ldapuser -pass password -crypto all -ptype KRB5_NT_PRINCIPAL

Copy each keytab file to the following directory on each node:

<Informatica installation directory>\isp\config\keys

The following table shows the node to which to copy each keytab file:

Keytab File	Location on Node
<node name>.keytab	Copy each file to the corresponding node.
webapp_http.keytab	Copy each file to the corresponding node.
ldapuser.keytab	Copy the file to each gateway node.

Rename Saved Search

Table of Contents

Configuring Kerberos Authentication in an Informatica Domain

Configuring Kerberos Authentication in an Informatica Domain

Step 4. Generate the Keytab Files

Step 4. Generate the Keytab Files