Application Service Guide > Metadata Access Service > Operating System Profiles for the Metadata Access Service
  

Operating System Profiles for the Metadata Access Service

An operating system profile is a type of security that the Metadata Access Service uses to import and preview metadata at design time. Create operating system profiles and configure the Metadata Access Service to use operating system profiles.
The operating system profile contains the operating system user name, Hadoop impersonation properties, and permissions.
To increase security, create operating system profiles to divide users into specific groups. Each group is defined by the operating system profile and the configured operating system user. The groups manage mapping runs and control access to directories by specifying permissions for the operating system user in each operating system profile. The operating system user has read and write permissions to certain controlled directories. The operating system profile configuration must adequately control the directories where users have read and write permissions in order to mitigate security attacks that can result due to directory traversal. For example, if the operating system profile does not properly assign directory permissions, certain users can access files in unassigned directories.
When you configure the Metadata Access Service to use operating system profiles, the Metadata Access Service imports and preview metadata with the permissions of the operating system user that you define in the operating system profile. The operating system user must have access to the directories you configure in the profile and the directories the Metadata Access Service accesses at design time.
By default, the Metadata Access Service process imports and preview metadata using the permissions of the operating system user that starts Informatica Services. The Metadata Access Service has access only to the directories where the operating system user has read and write permissions. The Metadata Access Service provides the object metadata to the Developer tool.

Operating System Profile Components

Configure the following components in an operating system profile:

Configuring the Metadata Access Service to Use Operating System Profiles

Configure the Metadata Access Service to import and preview metadata from Hadoop clusters.
The operating system user you define in the operating system profile must have access to the directories you configure in the operating system profile and to the directories the Metadata Access Service accesses at design time.
Complete the following steps to configure the Metadata Access Service to use operating system profiles:
    1. Configure system permissions on the files and directories that the operating system profile user needs access at design time.
    2. In the Administrator tool, enable the Metadata Access Service to use operating system profiles.
    3. On the Security page of the Administrator tool, create operating system profiles.
    For more information on creating and managing operating system profiles, see the Informatica Security Guide.

Configuring System Permissions for the Operating System Profile User

Configure system permissions on the files and directories that operating system profile users must access at design time.
    1. Make sure that the operating system user that starts the Informatica services has sudo permission.
    2. On Linux, verify that setuid is enabled on the file system that contains the Informatica installation.
    If necessary, remount the file system with setuid enabled.
    3. Make sure that all the library files in the following directory have at least 755 permissions:
    <Informatica installation directory>/services/shared/bin
    4. Make sure that the operating system profile users have 777 permissions on the $DISTempDir directory and at least 750 permissions on the $DISLogDir directory.
    5. Make sure that the operating system profile users have at least 755 permissions to the directory where the pmsuid file is located and all its parent directories.
    The pmsuid file is located in the following directory:
    <Informatica installation directory>/services/shared/bin
    6. Set the owner and group of pmsuid to root and set the permissions. Perform the following steps on each node where the Metadata Access Service runs:
    1. a. At the command prompt, switch to the following directory:
      2. <Informatica installation directory>/services/shared/bin
    2. b. Enter the following information at the command line to log in as root:
      3. su root
    3. c. Enter the following command to create a group for the administrator user:
      4. sudo groupadd <group name>
    4. d. Enter the following command to add the administrator user to the group:
      5. sudo usermod -G <group name> <Informatica administrator user>
      The administrator user is the Linux user whose permissions are used for all Informatica services.
    5. e. Enter the following command to change the owner and group of pmsuid to root and the group that you created:
      6. chown root:<group name> pmsuid
    6. f. Set the following permissions:
      7. chmod 6710 pmsuid
    7. g. Verify that the permissions for the pmsuid file appear as follows:
      8. rws--s---
    7. Set the umask value of the directories that the operating system profile accesses to 0027 or 0077 for better security.
    When you create these directories on Linux, the default umask value is set to 0222.

Enabling the Metadata Access Service to Use Operating System Profiles

After you configure system permissions for the operating system profile users, enable the Metadata Access Service to use operating system profiles.
    1. In the Administrator tool, click the Manage tab > Services and Nodes view.
    2. In the Domain Navigator, select the Metadata Access Service.
    3. In the Properties view of the Metadata Access Service, click Edit Execution Options.
    4. Select Use Operating System Profiles and Impersonation.
    A warning message appears that cache connection, the SQL Service Module, and the Web Service Module are not available when the Metadata Access Service uses operating system profiles.
    5. Restart the Metadata Access Service to apply the changes.