Secure Connections to a Web Application Service
To protect data that is transmitted between a web application service and the browser, secure the connection between the web application service and the browser.
You can secure the following connections:
- Connections to the Administrator tool
- You can secure the connection between the Administrator tool and the browser.
- Connections to web application services
- You can secure the connection between the following web application services and the browser:
- - Analyst Service
- - Metadata Manager Service
- - Test Data Manager Service
- - Web Services Hub Console Service
Requirements for Secure Connections to Web Application Services
Before you secure the connection to a web application service, ensure that the following requirements are met:
- You created a certificate signing request (CSR) and private key.
- You can use keytool or OpenSSL to create the CSR and private key.
- If you use RSA encryption, you must use more than 512 bits.
- You have a signed SSL certificate.
- The certificate can be self-signed or CA signed. Informatica recommends a CA signed certificate.
- You imported the certificate into a keystore in JKS format.
- A keystore must contain only one certificate. If you use a unique certificate for each web application service, create a separate keystore for each certificate. Alternatively, you can use a shared certificate and keystore.
- If you use the installer-generated SSL certificate for the Administrator tool, you do not need to import the certificate into a keystore in JKS format.
- The keystore is in an accessible directory.
- The keystore must be in a directory that is accessible to the Administrator tool and the command line programs.
Enabling Secure Connections to the Administrator Tool
After installation, you can configure secure connections to the Administrator tool from the command line.
You must update the gateway nodes in the domain with the properties for a secure connection between the browser and the Informatica Administrator service.
To update the gateway node with secure connection properties, run the following command: infasetup UpdateGatewayNode
Include the following options:
Option | Argument | Description |
|---|
-HttpsPort -hs | AdminConsole_https_port | Port number to use for a secure connection to the Informatica Administrator service. |
-KeystoreFile -kf | AdminConsole_Keystore_File | Path and file name of the keystore file to use for the HTTPS connection to the Informatica Administrator service. |
-KeystorePass -kp | AdminConsole_Keystore_Password | Password for the keystore file. |
If you have multiple gateway nodes in the domain, run the command on each gateway node.
Informatica Web Application Services
Configure a secure connection for a web application service when you create or configure it. Each application service has specific properties for the secure HTTPS connection.
Security for the Analyst Tool
When you create the Analyst Service, you can configure the secure HTTPS properties for the Analyst tool.
To secure the connection between the browser and the Analyst Service, configure the following Analyst Service properties:
Property | Description |
|---|
Enable Secure Communication | Select to enable a secure connection between the Analyst tool and the Analyst Service. |
HTTPS Port | Port number that the Informatica Analyst web application runs on when you enable the Transport Layer Security (TLS) protocol. Use a different port number than the HTTP port number. |
Keystore File | Directory where the keystore file that contains the digital certificates is stored. |
Keystore Password | Plain-text password for the keystore file. If this property is not set, the Analyst Service uses the default password changeit. |
SSL Protocol | Informatica recommends that you leave this field blank. The version of TLS enabled depends on the value. A blank field enables the highest version of TLS available. If you enter a value, earlier versions of TLS might be enabled. The behavior is based on the Java version for your environment. For more information, see the documentation for your Java version. |
Security for the Web Services Hub Console
When you create the Web Services Hub Service, you can configure the secure HTTPS properties for the Web Services Hub console.
To secure the connection between the browser and the Web Services Hub Service, configure the following Web Services Hub Service properties:
Property | Description |
|---|
URLScheme | Indicates the security protocol that you configure for the Web Services Hub: - - HTTP. Run the Web Services Hub on HTTP only.
- - HTTPS. Run the Web Services Hub on HTTPS only.
- - HTTP and HTTPS. Run the Web Services Hub in HTTP and HTTPS modes.
|
HubPortNumber (https) | Port number for the Web Services Hub on HTTPS. Appears when the URL scheme selected includes HTTPS. Required if you choose to run the Web Services Hub on HTTPS. Default is 7343. |
Keystore File | Path and file name of the keystore file that contains the keys and certificates that are required for an HTTPS connection. |
Keystore Password | Password for the keystore file. If this property is not set, the Web Services Hub uses the default password changeit. |
Security for Metadata Manager
When you create the Metadata Manager Service, you can configure the secure HTTPS properties for the Metadata Manager web application.
To secure the connection between the browser and the Metadata Manager Service, configure the following Metadata Manager Service properties:
Property | Description |
|---|
Enable Secure Sockets Layer | Indicates that you want to configure a secure connection for the Metadata Manager web application. Note: This property is displayed when you create a Metadata Manager Service. To secure the connection for an existing Metadata Manager Service, set the URL Scheme configuration property to HTTPS. |
Port Number | Port number that the Metadata Manager application runs on. Default is 10250. |
Keystore File | Keystore file that contains the keys and certificates required if you configure a secure connection for the Metadata Manager web application. Note: The Metadata Manager Service uses RSA encryption. Therefore, Informatica recommends that you use a security certificate that was generated with the RSA algorithm. |
Keystore Password | Password for the keystore file. |