Infrastructure Security
Infrastructure security includes user and service authentication, secure communication within the domain, and secure data storage.
Authentication
The Service Manager authenticates the services that run in the domain and the users who log in to the Informatica client tools.
You can configure the Informatica domain to use the following types of authentication:
- Native Authentication
- Native authentication is a mode of authentication available only for user accounts in the Informatica domain. When the Informatica domain uses native authentication, the Service Manager stores user credentials and privileges in the domain configuration repository and performs all user authentication within the Informatica domain.
If the Informatica domain uses native authentication, by default, the domain has a Native security domain and all user accounts belong to the Native security domain.
- Informatica uses user name and passwords to authenticate users and services in the Informatica domain.
- Lightweight Directory Access Protocol (LDAP) Authentication
- LDAP is a software protocol for accessing users and resources on a network. If the Informatica domain uses LDAP authentication, the user accounts and credentials are stored in the LDAP directory service. The user privileges and permissions are stored in the domain configuration repository. You must periodically synchronize the user accounts in the domain configuration repository with the user accounts in the LDAP directory service.
- Informatica uses user name and passwords to authenticate informatica users and services in the Informatica domain.
- Kerberos Authentication
- Kerberos is a network authentication protocol which uses tickets to authenticate users and services in a network. When the Informatica domain uses Kerberos authentication, the user accounts and credentials are stored in the Kerberos principal database, which can be an LDAP directory service. The user privileges and permissions are stored in the domain configuration repository. You must periodically synchronize the user accounts in the domain configuration repository with the user accounts in the Kerberos principal database.
- Informatica uses the Kerberos tickets to authenticate Informatica users and services in the Informatica domain.
Secure Domain Communication
The Informatica domain has various options to secure the data and metadata that are transmitted between the Service Manager and services in the domain and the client applications. Informatica uses the TCP/IP and HTTP protocols to communicate between components in the domain and uses SSL certificates to secure the communication between services and the Service Manager in the domain.
The SSL/TLS protocol uses public key cryptography to encrypt and decrypt network traffic. The public key used to encrypt and decrypt traffic is stored in an SSL certificate that can be self-signed or signed. A self-signed certificate is signed by the creator of the certificate. Because the identity of the signer is not verified, a self-signed certificate is less secure than a signed certificate. A signed certificate is an SSL certificate that has the identity of the person who requested the certificate verified by a certificate authority (CA). Informatica recommends CA signed certificates for a higher level of security.
A keystore contains private keys and certificates. It is used to provide a credential. A truststore contains the certificate of trusted SSL/TLS servers. It is used to verify a credential.
To secure connections in the domain, Informatica requires keystores and truststores in PEM and JKS formats. You can use the following programs to create the required files:
- keytool
- Use keytool to create an SSL certificate or a Certificate Signing Request (CSR) as well as keystores and truststores in JKS format.
- For more information about keytool, see the documentation on the following website:
- http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html
- OpenSSL
- You can use OpenSSL to create an SSL certificate or CSR as well as convert a keystore in JKS format to PEM format.
- For more information about OpenSSL, see the documentation on the following website:
- https://www.openssl.org/docs/
The type of connection that you secure determines the files required.
Secure Data Storage
Informatica encrypts sensitive data, such as passwords and secure connection parameters, before it stores the data in the domain configuration repository. Informatica also saves sensitive files, such as configuration files, in a secure directory.