Informatica PowerCenter Express (Version 9.6.0) Administrator Guide

Transcription

1 Informatica PowerCenter Express (Version 9.6.0) Administrator Guide

2 Informatica PowerCenter Express Administrator Guide Version January 2014 Copyright (c) Informatica Corporation. All rights reserved. This software and documentation contain proprietary information of Informatica Corporation and are provided under a license agreement containing restrictions on use and disclosure and are also protected by copyright law. Reverse engineering of the software is prohibited. No part of this document may be reproduced or transmitted in any form, by any means (electronic, photocopying, recording or otherwise) without prior consent of Informatica Corporation. This Software may be protected by U.S. and/or international Patents and other Patents Pending. Use, duplication, or disclosure of the Software by the U.S. Government is subject to the restrictions set forth in the applicable software license agreement and as provided in DFARS (a) and (a) (1995), DFARS (1)(ii) (OCT 1988), FAR (a) (1995), FAR , or FAR (ALT III), as applicable. The information in this product or documentation is subject to change without notice. If you find any problems in this product or documentation, please report them to us in writing. Informatica, Informatica Platform, Informatica Data Services, PowerCenter, PowerCenterRT, PowerCenter Connect, PowerCenter Data Analyzer, PowerExchange, PowerMart, Metadata Manager, Informatica Data Quality, Informatica Data Explorer, Informatica B2B Data Transformation, Informatica B2B Data Exchange Informatica On Demand, Informatica Identity Resolution, Informatica Application Information Lifecycle Management, Informatica Complex Event Processing, Ultra Messaging and Informatica Master Data Management are trademarks or registered trademarks of Informatica Corporation in the United States and in jurisdictions throughout the world. All other company and product names may be trade names or trademarks of their respective owners. Portions of this software and/or documentation are subject to copyright held by third parties, including without limitation: Copyright DataDirect Technologies. All rights reserved. Copyright Sun Microsystems. All rights reserved. Copyright RSA Security Inc. All Rights Reserved. Copyright Ordinal Technology Corp. All rights reserved.copyright Aandacht c.v. All rights reserved. Copyright Genivia, Inc. All rights reserved. Copyright Isomorphic Software. All rights reserved. Copyright Meta Integration Technology, Inc. All rights reserved. Copyright Intalio. All rights reserved. Copyright Oracle. All rights reserved. Copyright Adobe Systems Incorporated. All rights reserved. Copyright DataArt, Inc. All rights reserved. Copyright ComponentSource. All rights reserved. Copyright Microsoft Corporation. All rights reserved. Copyright Rogue Wave Software, Inc. All rights reserved. Copyright Teradata Corporation. All rights reserved. Copyright Yahoo! Inc. All rights reserved. Copyright Glyph & Cog, LLC. All rights reserved. Copyright Thinkmap, Inc. All rights reserved. Copyright Clearpace Software Limited. All rights reserved. Copyright Information Builders, Inc. All rights reserved. Copyright OSS Nokalva, Inc. All rights reserved. Copyright Edifecs, Inc. All rights reserved. Copyright Cleo Communications, Inc. All rights reserved. Copyright International Organization for Standardization All rights reserved. Copyright ejtechnologies GmbH. All rights reserved. Copyright Jaspersoft Corporation. All rights reserved. Copyright is International Business Machines Corporation. All rights reserved. Copyright yworks GmbH. All rights reserved. Copyright Lucent Technologies. All rights reserved. Copyright (c) University of Toronto. All rights reserved. Copyright Daniel Veillard. All rights reserved. Copyright Unicode, Inc. Copyright IBM Corp. All rights reserved. Copyright MicroQuill Software Publishing, Inc. All rights reserved. Copyright PassMark Software Pty Ltd. All rights reserved. Copyright LogiXML, Inc. All rights reserved. Copyright Lorenzi Davide, All rights reserved. Copyright Red Hat, Inc. All rights reserved. Copyright The Board of Trustees of the Leland Stanford Junior University. All rights reserved. Copyright EMC Corporation. All rights reserved. Copyright Flexera Software. All rights reserved. Copyright Jinfonet Software. All rights reserved. Copyright Apple Inc. All rights reserved. Copyright Telerik Inc. All rights reserved. Copyright BEA Systems. All rights reserved. Copyright PDFlib GmbH. All rights reserved. Copyright Orientation in Objects GmbH. All rights reserved. Copyright Tanuki Software, Ltd. All rights reserved. Copyright Ricebridge. All rights reserved. Copyright Sencha, Inc. All rights reserved. This product includes software developed by the Apache Software Foundation ( and/or other software which is licensed under various versions of the Apache License (the "License"). You may obtain a copy of these Licenses at Unless required by applicable law or agreed to in writing, software distributed under these Licenses is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the Licenses for the specific language governing permissions and limitations under the Licenses. This product includes software which was developed by Mozilla ( software copyright The JBoss Group, LLC, all rights reserved; software copyright by Bruno Lowagie and Paulo Soares and other software which is licensed under various versions of the GNU Lesser General Public License Agreement, which may be found at The materials are provided free of charge by Informatica, "as-is", without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability and fitness for a particular purpose. The product includes ACE(TM) and TAO(TM) software copyrighted by Douglas C. Schmidt and his research group at Washington University, University of California, Irvine, and Vanderbilt University, Copyright ( ) , all rights reserved. This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (copyright The OpenSSL Project. All Rights Reserved) and redistribution of this software is subject to terms available at and This product includes Curl software which is Copyright , Daniel Stenberg, <daniel@haxx.se>. All Rights Reserved. Permissions and limitations regarding this software are subject to terms available at Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. The product includes software copyright ( ) MetaStuff, Ltd. All Rights Reserved. Permissions and limitations regarding this software are subject to terms available at license.html. The product includes software copyright , The Dojo Foundation. All Rights Reserved. Permissions and limitations regarding this software are subject to terms available at This product includes ICU software which is copyright International Business Machines Corporation and others. All rights reserved. Permissions and limitations regarding this software are subject to terms available at This product includes software copyright Per Bothner. All rights reserved. Your right to use such materials is set forth in the license which may be found at kawa/software-license.html. This product includes OSSP UUID software which is Copyright 2002 Ralf S. Engelschall, Copyright 2002 The OSSP Project Copyright 2002 Cable & Wireless Deutschland. Permissions and limitations regarding this software are subject to terms available at This product includes software developed by Boost ( or under the Boost software license. Permissions and limitations regarding this software are subject to terms available at / This product includes software copyright University of Cambridge. Permissions and limitations regarding this software are subject to terms available at This product includes software copyright 2007 The Eclipse Foundation. All Rights Reserved. Permissions and limitations regarding this software are subject to terms available at and at This product includes software licensed under the terms at license.html, asm.ow2.org/license.html, httpunit.sourceforge.net/doc/ license.html,

3 license.html, license-agreement; /copyright-software ; forge.ow2.org/projects/javaservice/, license.html; protobuf.googlecode.com/svn/trunk/src/google/protobuf/descriptor.proto; current/doc/mitk5license.html. and This product includes software licensed under the Academic Free License ( the Common Development and Distribution License ( the Common Public License ( the Sun Binary Code License Agreement Supplemental License Terms, the BSD License ( the new BSD License ( licenses/bsd-3-clause), the MIT License ( the Artistic License ( and the Initial Developer s Public License Version 1.0 ( This product includes software copyright Joe WaInes, XStream Committers. All rights reserved. Permissions and limitations regarding this software are subject to terms available at This product includes software developed by the Indiana University Extreme! Lab. For further information please visit This product includes software Copyright (c) 2013 Frank Balluffi and Markus Moeller. All rights reserved. Permissions and limitations regarding this software are subject to terms of the MIT license. This Software is protected by U.S. Patent Numbers 5,794,246; 6,014,670; 6,016,501; 6,029,178; 6,032,158; 6,035,307; 6,044,374; 6,092,086; 6,208,990; 6,339,775; 6,640,226; 6,789,096; 6,823,373; 6,850,947; 6,895,471; 7,117,215; 7,162,643; 7,243,110; 7,254,590; 7,281,001; 7,421,458; 7,496,588; 7,523,121; 7,584,422; 7,676,516; 7,720,842; 7,721,270; 7,774,791; 8,065,266; 8,150,803; 8,166,048; 8,166,071; 8,200,622; 8,224,873; 8,271,477; 8,327,419; 8,386,435; 8,392,460; 8,453,159; 8,458,230; and RE44,478, International Patents and other Patents Pending. DISCLAIMER: Informatica Corporation provides this documentation "as is" without warranty of any kind, either express or implied, including, but not limited to, the implied warranties of noninfringement, merchantability, or use for a particular purpose. Informatica Corporation does not warrant that this software or documentation is error free. The information provided in this software or documentation may include technical inaccuracies or typographical errors. The information in this software and documentation is subject to change at any time without notice. NOTICES This Informatica product (the "Software") includes certain drivers (the "DataDirect Drivers") from DataDirect Technologies, an operating company of Progress Software Corporation ("DataDirect") which are subject to the following terms and conditions: 1. THE DATADIRECT DRIVERS ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. 2. IN NO EVENT WILL DATADIRECT OR ITS THIRD PARTY SUPPLIERS BE LIABLE TO THE END-USER CUSTOMER FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR OTHER DAMAGES ARISING OUT OF THE USE OF THE ODBC DRIVERS, WHETHER OR NOT INFORMED OF THE POSSIBILITIES OF DAMAGES IN ADVANCE. THESE LIMITATIONS APPLY TO ALL CAUSES OF ACTION, INCLUDING, WITHOUT LIMITATION, BREACH OF CONTRACT, BREACH OF WARRANTY, NEGLIGENCE, STRICT LIABILITY, MISREPRESENTATION AND OTHER TORTS. Part Number: PCX-ADG

4 Table of Contents Preface.... ix Informatica Resources.... ix Informatica My Support Portal.... ix Informatica Documentation.... ix Informatica Web Site.... ix Informatica Support YouTube Channel.... ix Informatica Marketplace.... x Informatica Velocity.... x Chapter 1: Understanding Domains Understanding Domains Overview Service Manager Application Services Data Integration Service Model Repository Service Usage Collection Policy Disabling Informatica Data Usage Chapter 2: Managing Your Account Managing Your Account Overview Logging In Informatica Administrator URL Password Management Changing Your Password Editing Preferences Preferences Informatica MySupport Portal Credentials Enter Informatica MySupport Portal Credentials Searching Informatica Knowledge Base Chapter 3: Using Informatica Administrator Using Informatica Administrator Overview Domain Tab Overview Domain Tab - Services and Nodes View Domain Application Services Node Licenses Domain Tab - Connections View Logs Tab Table of Contents i

5 Monitoring Tab Security Tab Using the Search Section Using the Security Navigator Groups Users Roles Service States Process States Job States Chapter 4: Domain Management Domain Management Overview Alert Management Configuring SMTP Settings Subscribing to Alerts Viewing Alerts Domain Security Management User Security Management Application Service Management Enabling and Disabling Services and Service Processes Viewing Service Processes Configuring Restart for Service Processes Troubleshooting Application Services Node Management Configuring Node Properties Viewing Processes on the Node Domain Tasks Managing and Monitoring Application Services and Node Viewing Dependencies Domain Properties General Properties SMTP Configuration Custom Properties for the Domain Chapter 5: Domain Security Domain Security Overview Secure Communication Within the Domain Configuring Secure Communication Within the Domain User Security Encryption Authentication Authorization ii Table of Contents

6 Application Services and Ports Chapter 6: Users and Groups Users and Groups Overview Default Everyone Group Understanding User Accounts Default Administrator Domain Administrator User Managing Users Creating Users Editing General Properties of Native Users Assigning Native Users to Native Groups Enabling and Disabling User Accounts Deleting Native Users Unlocking a User Account Managing Groups Adding a Native Group Editing Properties of a Native Group Moving a Native Group to Another Native Group Deleting a Native Group Account Lockout Configuring Account Lockout Chapter 7: Privileges and Roles Privileges and Roles Overview Privileges Roles Domain Privileges Security Administration Privilege Group Domain Administration Privilege Group Monitoring Privilege Group Tools Privilege Group Data Integration Service Privileges Model Repository Service Privileges Managing Roles System-Defined Roles Managing Custom Roles Assigning Privileges and Roles to Users and Groups Inherited Privileges Steps to Assign Privileges and Roles to Users and Groups Viewing Users with Privileges for a Service Table of Contents iii

7 Chapter 8: Permissions Permissions Overview Types of Permissions Permission Search Filters Domain Object Permissions Permissions by Domain Object Permissions by User or Group Connection Permissions Types of Connection Permissions Default Connection Permissions Assigning Permissions on a Connection Viewing Permission Details on a Connection Editing Permissions on a Connection Chapter 9: Data Integration Service Data Integration Service Overview Data Integration Service Architecture Data Transformation Manager Profiling Service Module Mapping Service Module Workflow Service Module Data Object Cache Manager Deployment Manager Data Integration Service Logs Data Integration Service Properties General Properties Model Repository Properties Execution Options Server Properties Logical Data Object Cache Properties Logging Properties Modules Mapping Service Properties Profiling Warehouse Database Properties Advanced Profiling Properties Custom Properties for the Data Integration Service Data Integration Service Process Properties Data Integration Service Security Properties Advanced Properties Logging Options Execution Options Custom Properties for the Data Integration Service Process iv Table of Contents

8 Environment Variables Enabling, Disabling, and Recycling the Data Integration Service Data Object Caching Pass-through Security Pass-Through Security with Data Object Caching Adding Pass-Through Security Chapter 10: Data Integration Service Processing Data Integration Service Processing Overview Run Jobs in Separate Processes Host File Configuration on UNIX DTM Process Pool Management Example of the DTM Process Pool Maintain Connection Pools Connection Pool Management Pooling Properties in Connection Objects Example of a Connection Pool Optimize Connection Performance Chapter 11: Data Integration Service Applications Data Integration Service Applications Overview Applications View Applications Application State Application Properties Deploying an Application Enabling an Application Renaming an Application Starting an Application Backing Up an Application Restoring an Application Refreshing the Applications View Logical Data Objects Mappings Workflows Workflow Properties Enabling a Workflow Starting a Workflow Chapter 12: Model Repository Service Model Repository Service Overview Model Repository Architecture Model Repository Objects Table of Contents v

9 Model Repository Service Status Enabling, Disabling, and Recycling the Model Repository Service Properties for the Model Repository Service General Properties for the Model Repository Service Search Properties for the Model Repository Service Advanced Properties for the Model Repository Service Cache Properties for the Model Repository Service Custom Properties for the Model Repository Service Properties for the Model Repository Service Process Node Properties for the Model Repository Service Process Model Repository Service Management Content Management for the Model Repository Service Model Repository Backup and Restoration Security Management for the Model Repository Service Search Management for the Model Repository Service Repository Log Management for the Model Repository Service Audit Log Management for Model Repository Service Cache Management for the Model Repository Service Chapter 13: Connections Connections Overview Tools Reference for Creating and Managing Connections Connection Management Creating a Connection Viewing a Connection Editing and Testing a Connection Deleting a Connection Configuring Pooling for a Connection Refreshing the Connections List Connection Properties Relational Database Connection Properties DataSift Connection Properties Facebook Connection Properties LinkedIn Connection Properties Twitter Connection Properties Twitter Streaming Connection Properties Web Content-Kapow Katalyst Connection Properties Pooling Properties in Connection Objects Chapter 14: License Management License Management Overview License Validation Licensing Log Events vi Table of Contents

10 Updating a License License Properties License Details Supported Platforms Chapter 15: Log Management Log Management Overview Log Location Log Management Configuration Purging Log Events Time Zone Configuring Log Management Properties Using the Logs Tab Viewing Log Events Configuring Log Columns Saving Log Events Exporting Log Events Viewing Administrator Tool Log Errors Log Events Log Event Components Domain Log Events Data Integration Service Log Events Model Repository Service Log Events User Activity Log Events Chapter 16: Monitoring Monitoring Overview Navigator in the Monitoring Tab Views in the Monitoring Tab Statistics in the Monitoring Tab Reports on the Monitoring Tab Monitoring Setup Step 1. Configure Global Settings Step 2. Configure Monitoring Preferences Monitor Data Integration Services Properties View for a Data Integration Service Reports View for a Data Integration Service Monitor Jobs Viewing Logs for a Job Canceling a Job Monitor Applications Properties View for an Application Reports View for an Application Table of Contents vii

11 Monitor Deployed Mapping Jobs Viewing Logs for a Deployed Mapping Job Reissuing a Deployed Mapping Job Canceling a Deployed Mapping Job Monitor Logical Data Objects Properties View for a Logical Data Object Cache Refresh Runs View for a Logical Data Object Viewing Logs for Data Object Cache Refresh Runs Monitor Workflows Workflow Graph View Workflow Objects Workflow States Canceling or Aborting a Workflow Workflow Logs Monitoring an Object Index viii Table of Contents

12 Preface The Informatica Administrator Guide is written for Informatica users. It contains information you need to manage the domain. The Informatica Administrator Guide assumes you have basic working knowledge of Informatica. Informatica Resources Informatica My Support Portal As an Informatica customer, you can access the Informatica My Support Portal at The site contains product information, user group information, newsletters, access to the Informatica How-To Library, the Informatica Knowledge Base, Informatica Product Documentation, and access to the Informatica user community. Informatica Documentation The Informatica Documentation team takes every effort to create accurate, usable documentation. If you have questions, comments, or ideas about this documentation, contact the Informatica Documentation team through at We will use your feedback to improve our documentation. Let us know if we can contact you regarding your comments. The Documentation team updates documentation as needed. To get the latest documentation for your product, navigate to Product Documentation from Informatica Web Site You can access the Informatica corporate web site at The site contains information about Informatica, its background, upcoming events, and sales offices. You will also find product and partner information. The services area of the site includes important information about technical support, training and education, and implementation services. Informatica Support YouTube Channel You can access the Informatica Support YouTube channel at The Informatica Support YouTube channel includes videos about solutions that guide you through performing specific tasks. If you have questions, comments, or ideas about the Informatica Support YouTube channel, ix

13 contact the Support YouTube team through at or send a tweet Informatica Marketplace The Informatica Marketplace is a forum where developers and partners can share solutions that augment, extend, or enhance data integration implementations. By leveraging any of the hundreds of solutions available on the Marketplace, you can improve your productivity and speed up time to implementation on your projects. You can access Informatica Marketplace at Informatica Velocity You can access Informatica Velocity at Developed from the real-world experience of hundreds of data management projects, Informatica Velocity represents the collective knowledge of our consultants who have worked with organizations from around the world to plan, develop, deploy, and maintain successful data management solutions. If you have questions, comments, or ideas about Informatica Velocity, contact Informatica Professional Services at ips@informatica.com. x Preface

14 C H A P T E R 1 Understanding Domains This chapter includes the following topics: Understanding Domains Overview, 1 Service Manager, 2 Application Services, 3 Usage Collection Policy, 3 Understanding Domains Overview The Informatica domain is the fundamental administrative unit in Informatica. The domain supports the administration of the distributed services. A domain contains a node and services. A node is the logical representation of a machine in a domain. The node acts as a gateway to receive service requests from clients and route them to the appropriate service. Services and processes run on the node in a domain. The availability of a service or process on a node depends on how you configure the service and the node. Services for the domain include the Service Manager and a set of application services: Service Manager. A service that manages all domain operations. It runs the application services and performs domain functions on each node in the domain. Some domain functions include authentication, authorization, and logging. Application Services. Services that represent server-based functionality, such as the Model Repository Service and the Data Integration Service. The application services that run on a node depend on the way you configure the services. The Service Manager and application services control security. The Service Manager manages users and groups that can log in to application clients and authenticates the users who log in to the application clients. The Service Manager and application services authorize user requests from application clients. Informatica Administrator (the Administrator tool), consolidates the administrative tasks for domain objects. You manage the domain and the security of the domain through the Administrator tool. 1

15 Service Manager The Service Manager is a service that manages all domain operations. It runs within Informatica services. It runs as a service on Windows and as a daemon on UNIX. When you start Informatica services, you start the Service Manager. If the machine where you install PowerCenter Express Personal Edition goes into sleep or hibernate mode, the Service Manager restarts the services after the machine wakes up. If the machine where you install PowerCenter Express Professional Edition goes into sleep or hibernate mode, you must restart the Informatica services after the machine wakes up. To start the Informatica services from the Windows start menu, click Programs > Informatica PowerCenter Express > Start Informatica Services. On Linux, run infaservice.sh to start the Informatica daemon. By default, infaservice.sh is installed in the following directory: <PowerCenterExpressInstallationDir>/tomcat/bin Run the following command from the directory where infaservice.sh is located: infaservice.sh startup The following table describes the domain functions that the Service Manager performs: Function Alerts Authentication Authorization Domain Configuration Node Configuration Licensing Logging The Service Manager sends alerts to subscribed users. The Service Manager authenticates users who log in to application clients. Authentication occurs on the master gateway node. The Service Manager authorizes user requests for domain objects based on the privileges, roles, and permissions assigned to the user. The Service Manager manages the domain configuration metadata. The Service Manager manages node configuration metadata in the domain. The Service Manager registers license information and verifies license information when you run application services. The Service Manager provides accumulated log events from each service in the domain and for workflows. To perform the logging function, the Service Manager runs a Log Manager and a Log Agent. 2 Chapter 1: Understanding Domains

16 Function User Management Monitoring The Service Manager manages the users and groups that can log in to application clients. It also manages the creation of roles and the assignment of roles and privileges to users and groups. The Service Manager persists, updates, retrieves, and publishes run-time statistics for integration objects in the Model repository. The Service Manager stores the monitoring configuration in the domain configuration repository. Application Services Application services represent server-based functionality. Application services include the following services: Data Integration Service Model Repository Service The service process is the runtime representation of a service running on a node. The service type determines how many service processes can run at a time. Data Integration Service The Data Integration Service is an application service that performs data integration tasks for Informatica Developer. Data integration tasks include previewing data and running profiles and mappings. Model Repository Service The Model Repository Service is an application service that manages the Model repository. The Model repository is a relational database that stores the metadata for projects created in Informatica Developer. The Model repository also stores run-time and configuration information for applications that are deployed to a Data Integration Service. Usage Collection Policy PowerCenter Express sends routine reports on data usage and system statistics to Informatica. PowerCenter Express reports the following data to Informatica: Operating system details CPU information Informatica license key serial number Number of rows processed by the Informatica domain per day Number of projects, mappings, transformations, and task types Application Services 3

17 The Informatica domain uploads data to Informatica 10 minutes after you install and configure PowerCenter Express. Thereafter, the domain sends the data every 30 days. Data collection and upload is enabled by default. You can choose to opt out of sharing data. Disabling Informatica Data Usage You can disable the upload of usage data from the Informatica domain in the Administrator tool. 1. In the Administrator tool, click Help > About. 2. Click Data Usage Policy. 3. Clear Agree to Informatica Data Usage Policy. 4. Click OK. 4 Chapter 1: Understanding Domains

18 C H A P T E R 2 Managing Your Account This chapter includes the following topics: Managing Your Account Overview, 5 Logging In, 5 Password Management, 6 Editing Preferences, 6 Preferences, 7 Informatica MySupport Portal Credentials, 7 Managing Your Account Overview Manage your account to change your password or edit user preferences. If you have a native user account, you can change your password at any time with the Change Password application. If someone else created your user account, change your password the first time you log in to the Administrator tool. User preferences control the options that appear in the Administrator tool when you log in. User preferences do not affect the options that appear when another user logs in to the Administrator tool. You can configure Informatica MySupport Portal credentials for your account so that you can access the Informatica Knowledge Base from the Administrator tool. Logging In To log in to the Administrator tool, you must have a user account and the Access Informatica Administrator domain privilege. 1. Open Microsoft Internet Explorer or Google Chrome. 2. In the Address field, enter the URL for the Administrator tool login page. Enter the following URL for PowerCenter Express Personal Edition: Enter the following URL for PowerCenter Express Professional Edition: 5

19 The Administrator tool login page appears. 3. Enter the user name and password. 4. Click Log In. Informatica Administrator URL In the Administrator tool URL, <host>:<port> represents the host name of the master gateway node and the Administrator tool port number. You configure the Administrator tool port when you define the domain. You can define the domain during installation or by running the infasetup DefineDomain command line program. If you enter the domain port instead of the Administrator tool port in the URL, the browser is directed to the Administrator tool port. If you do not use the Internet Explorer Enhanced Security Configuration, you can enter the following URL, and the browser is directed to the full URL for the login page: Password Management You can change the password through the Change Password application. You can open the Change Password application from the Administrator tool or with the following URL: Changing Your Password Change the password for a native user account at any time. For a user account created by someone else, change the password the first time you log in to the Administrator tool. 1. In the Administrator tool header area, click Manage > Change Password. The Change Password application opens in a new browser window. 2. Enter the current password in the Password box, and the new password in the New Password and Confirm Password boxes. 3. Click Update. Editing Preferences Edit your preferences to determine the options that appear in the Administrator tool when you log in. 1. In the Administrator tool header area, click Manage > Preferences. The Preferences window appears. 2. Click Edit. The Edit Preferences dialog box appears. 6 Chapter 2: Managing Your Account

20 Preferences Your preferences determine the options that appear in the Administrator tool when you log in. Your preferences do not affect the options that appear when another user logs in to the Administrator tool. The following table describes the options that you can configure for your preferences: Option Subscribe for Alerts Show Custom Properties Subscribes you to domain and service alerts. You must have a valid address configured for your user account. Default is No. Displays custom properties in the contents panel when you click an object in the Navigator. You use custom properties to configure Informatica behavior for special cases or to increase performance. Hide the custom properties to avoid inadvertently changing the values. Use custom properties only if Informatica Global Customer Support instructs you to. Informatica MySupport Portal Credentials You can enter your Informatica MySupport Portal credentials in the Administrator tool to access the Informatica Knowledge Base from the Administrator tool. You can also view the search results for an error message in the Informatica Knowledge Base by clicking the error message code in the Administrator tool. Enter Informatica MySupport Portal Credentials Enter your Informatica MySupport Portal credentials to access the Informatica Knowledge Base from the Administrator tool. 1. Click Manage > Support Portal Credentials. The Edit Informatica MySupport Portal Login Credentials window appears. 2. Enter your Informatica MySupport Portal credentials and the customer project ID. 3. Click OK. Searching Informatica Knowledge Base You can search for terms in the Informatica Knowledge Base directly from the Administrator tool. 1. Click Help > Search Knowledge Base. The Search Knowledge Base window appears. 2. Enter the term that you want to search in the text box. 3. Click OK. The search results appear in a different browser window. Preferences 7

21 C H A P T E R 3 Using Informatica Administrator This chapter includes the following topics: Using Informatica Administrator Overview, 8 Domain Tab Overview, 9 Domain Tab - Services and Nodes View, 9 Domain Tab - Connections View, 12 Logs Tab, 12 Monitoring Tab, 13 Security Tab, 13 Service States, 16 Process States, 16 Job States, 18 Using Informatica Administrator Overview Informatica Administrator is the administration tool that you use to administer the Informatica domain and Informatica security. Use the Administrator tool to complete the following types of tasks: Domain administrative tasks Manage logs, domain objects, and user permissions. Monitor jobs and applications that run on the Data Integration Service. Security administrative tasks Manage users, groups, roles, and privileges. The Administrator tool has the following tabs: Domain Logs View and edit the properties of the domain and objects within the domain. View log events for the domain and services within the domain. Monitoring View the status of profile jobs, preview jobs, mapping jobs, and workflows for the Data Integration Service. 8

22 Security Manage users, groups, roles, and privileges. If you have PowerCenter Express Personal Edition, you do not have access to the Security tab. The Administrator tool has the following header items: Log out Manage Help Log out of the Administrator tool. Manage your account. Access help for the current tab, determine the Informatica version, and configure the data usage policy. Domain Tab Overview On the Domain tab, you can view information about the domain and view and manage objects in the domain. The contents that appear and the tasks you can complete on the Domain tab vary based on the view that you select. You can select the following views: Services and Nodes. View and manage application services and the node. Connections. View and manage connections. You can configure the appearance of these views. Domain Tab - Services and Nodes View The Services and Nodes view shows all application services and the node defined in the domain. The Services and Nodes view has the following components: Navigator Appears in the left pane of the Domain tab. The Navigator displays the following types of objects: Domain. You can view one domain, which is the highest object in the Navigator hierarchy. Application services. An application service represents server-based functionality. Select an application service to view information about the service and its processes. Node. A node represents a machine in the domain. You assign resources to a node and configure service processes to run on the node. License. View the license and the services assigned to the license. Contents panel Appears in the right pane of the Domain tab and displays information about the domain or domain object that you select in the Navigator. Actions menu in the Navigator When you select a domain object in the Navigator, you can refresh the object. Domain Tab Overview 9

23 Actions menu on the Domain tab When you select the domain in the Navigator, you can view logs for the domain. When you select a service in the Navigator, you can recycle or disable the service, view back up files in or back up the repository contents, manage the repository domain, notify users, and view logs. When you select a license in the Navigator, you can add an incremental key to the license. Domain You can view one domain in the Services and Nodes view on the Domain tab. It is the highest object in the Navigator hierarchy. When you select the domain in the Navigator, the contents panel shows the following views and buttons, which enable you to complete the following tasks: Overview view. View all domain objects, organized by object type. You can view statuses of application services and node. You can also view properties about domain objects. You can also recycle application services. Click an application service to see its name, version, status, and the statuses of its individual processes. Click a node to see the name, status and the number of service processes running on the node. The statuses are available, disabled, and unavailable. By default, the Overview view shows an abbreviation of each domain object's name. Click the Show Details button to show the full names of the objects. Click the Hide Details button to show abbreviations of the object names. Click an application service to see its name, description, status, and the statuses of its individual processes. Click a node to see the name, status and the number of service processes running on the node. By default, the Overview view shows an abbreviation of each domain object's name. Click the Show Details button to show the full names of the objects. Click the Hide Details button to show abbreviations of the object names. Properties view. View or edit domain resilience properties. Resources view. View available resources. Permissions view. View or edit group and user permissions on the domain. Plug-ins view. View plug-ins registered in the domain. View Logs for Domain button. View logs for the domain and services within the domain. In the Actions menu on the Domain tab, you can view logs or access help on the current view. Application Services Application services are a group of services that represent Informatica server-based functionality. In the Services and Nodes view on the Domain tab, you can create and manage the following application services: Data Integration Service Completes data integration tasks for Informatica Developer. When you preview or run mappings in Informatica Developer, the application sends requests to the Data Integration Service to perform the data 10 Chapter 3: Using Informatica Administrator

24 integration tasks. When you start a command from the command line or an external client to run mappings in an application, the command sends the request to the Data Integration Service. Service and service process status. View the status of the service and the service process for each node. Properties view. Manage general, model repository, logging, logical data object cache, profiling, data object cache, and custom properties. Set the default deployment option. Processes view. View and edit service process properties on each assigned node. Applications view. Start, stop, and back up applications. Manage application properties. Actions menu. Manage the service and repository contents. Model Repository Service Manages the Model repository. The Model repository stores metadata created by Informatica Developer, Data Integration Service, and Informatica Administrator. The Model repository enables collaboration among the products. When you select a Model Repository Service in the Navigator, the contents panel displays the following information: Service and service process status. View the status of the service and the service process for each node. Properties view. Manage general, repository database, search, and custom properties. Processes view. View and edit service process properties on each assigned node. Actions menu. Manage the service and repository contents. Node A node is a logical representation of a physical machine in the domain. When you select a node in the Navigator, the contents panel displays the following information: Node status. View the status of the node. Properties view. View or edit node properties, such as the repository backup directory or range of port numbers for the processes that run on the node. Processes view. View the status of processes configured to run on the node. Resources view. View or edit resources assigned to the node. Permissions view. View or edit group and user permissions on the node. In the Actions menu in the Navigator, you can refresh the contents on the Domain tab or access help on the current tab. Licenses When you select a license in the Navigator, the contents panel displays the following information: Properties view. View license properties, such as supported platforms, repositories, and licensed options. You can also edit the license description. Assigned Services view. View or edit the services assigned to the license. Options view. View the licensed PowerCenter options. Permissions view. View or edit user permissions on the license. Domain Tab - Services and Nodes View 11

25 In the Actions menu in the Navigator, you can refresh the contents on the Domain tab or access help on the current tab. In the Actions menu on the Domain tab, you can add an incremental key to a license. Domain Tab - Connections View The Connections view shows the domain and all connections in the domain. The Connections view has the following components: Navigator Appears in the left pane of the Domain tab and displays the domain and the connections in the domain. Contents panel Appears in the right pane of the Domain tab and displays information about the domain or the connection that you select in the Navigator. When you select the domain in the Navigator, the contents panel shows all connections in the domain. In the contents panel, you can filter or sort connections, or search for specific connections. When you select a connection in the Navigator, the contents panel displays information about the connection and lets you complete tasks for the connection, depending on which of the following views you select: Properties view. View or edit connection properties. Pooling view. View or edit pooling properties for the connection. Permissions view. View or edit group or user permissions on the connection. Also, the Actions menu lets you test a connection. Actions menu in the Navigator When you select the domain in the Navigator, you can create a connection. When you select a connection in the Navigator, you can delete the connection. Actions menu on the Domain tab When you select a connection in the Navigator, you can edit direct permissions or assign permissions to the connection. Logs Tab The Logs tab shows logs. On the Logs tab, you can view the following types of logs: Domain log. Domain log events are log events generated from the domain functions that the Service Manager performs. Service log. Service log events are log events generated by each application service. User Activity log. User Activity log events monitor user activity in the domain. 12 Chapter 3: Using Informatica Administrator

26 The Logs tab displays the following components for each type of log: Filter. Configure filter options for the logs. Log viewer. Displays log events based on the filter criteria. Reset filter. Reset the filter criteria. Copy rows. Copy the log text of the selected rows. Actions menu. Contains options to save, purge, and manage logs. It also contains filter options. Monitoring Tab On the Monitoring tab, you can monitor Data Integration Services and integration objects that run on the Data Integration Service. Integration objects include jobs, applications, deployed mappings, logical data objects, and workflows. The Monitoring tab displays properties, run-time statistics, and run-time reports about the integration objects. The Monitoring tab contains the following components: Navigator. Appears in the left pane of the Monitoring tab and displays jobs, applications, and application components. Application components include deployed mappings, logical data objects, and workflows. Contents panel. Appears in the right pane of the Monitoring tab. It contains information about the object that is selected in the Navigator. If you select an application component in the Navigator, multiple views of information about the object appear in the contents panel. Details panel. Appears below the contents panel in some cases. The details panel allows you to view details about the object that is selected in the contents panel. Actions menu. Appears on the Monitoring tab. Allows you to view context, reset search filters, abort a selected job, and view logs for a selected object. Security Tab You administer Informatica security on the Security tab of the Administrator tool. The Security tab has the following components: Search section. Search for users, groups, or roles by name. Navigator. The Navigator appears in the left pane and display groups, users, and roles. Contents panel. The contents panel displays properties and options based on the object selected in the Navigator and the tab selected in the contents panel. Security Actions menu. Contains options to create or delete a group, user, or role. Note: If you have PowerCenter Express Personal Edition, you do not have access to the Security tab Monitoring Tab 13

27 Using the Search Section Use the Search section to search for users, groups, and roles by name. Search is not case sensitive. 1. In the Search section, select whether you want to search for users, groups, or roles. 2. Enter the name or partial name to search for. You can include an asterisk (*) in a name to use a wildcard character in the search. For example, enter ad* to search for all objects starting with ad. Enter *ad to search for all objects ending with ad. 3. Click Go. The Search Results section appears and displays a maximum of 100 objects. If your search returns more than 100 objects, narrow your search criteria to refine the search results. 4. Select an object in the Search Results section to display information about the object in the contents panel. Using the Security Navigator The Navigator appears in the contents panel of the Security tab. When you select an object in the Navigator, the contents panel displays information about the object. The Navigator on the Security tab includes the following sections: Groups section. Select a group to view the properties of the group, the users assigned to the group, and the roles and privileges assigned to the group. Users section. Select a user to view the properties of the user, the groups the user belongs to, and the roles and privileges assigned to the user. Roles section. Select a role to view the properties of the role, the users and groups that have the role assigned to them, and the privileges assigned to the role. The Navigator provides different ways to complete a task. You can use any of the following methods to manage groups, users, and roles: Click the Actions menu. Each section of the Navigator includes an Actions menu to manage groups, users, or roles. Select an object in the Navigator and click the Actions menu to create, delete, or move groups, users, or roles. Right-click an object. Right-click an object in the Navigator to display the create, delete, and move options available in the Actions menu. Drag an object from one section to another section. Select an object and drag it to another section of the Navigator to assign the object to another object. For example, to assign a user to a native group, you can select a user in the Users section of the Navigator and drag the user to a native group in the Groups section. Drag multiple users or roles from the contents panel to the Navigator. Select multiple users or roles in the contents panel and drag them to the Navigator to assign the objects to another object. For example, to assign multiple users to a native group, you can select the Native folder in the Users section of the Navigator to display all native users in the contents panel. Use the Ctrl or Shift keys to select multiple users and drag the selected users to a native group in the Groups section of the Navigator. Use keyboard shortcuts. Use keyboard shortcuts to move to different sections of the Navigator. Groups A group is a collection of users and groups that can have the same privileges, roles, and permissions. 14 Chapter 3: Using Informatica Administrator

28 The Groups section of the Navigator organizes groups into security domain folders. A security domain is a collection of user accounts and groups in an Informatica domain. Native authentication uses the Native security domain which contains the users and groups created and managed in the Administrator tool. When you select a security domain folder in the Groups section of the Navigator, the contents panel displays all groups belonging to the security domain. Right-click a group and select Navigate to Item to display the group details in the contents panel. When you select a group in the Navigator, the contents panel displays the following tabs: Overview. Displays general properties of the group and users assigned to the group. Privileges. Displays the privileges and roles assigned to the group for the domain and for application services in the domain. Users A user with an account in the Informatica domain can log in to the following application clients: Informatica Administrator Informatica Developer The Users section of the Navigator organizes users into security domain folders. A security domain is a collection of user accounts and groups in an Informatica domain. When you select a security domain folder in the Users section of the Navigator, the contents panel displays all users belonging to the security domain. Right-click a user and select Navigate to Item to display the user details in the contents panel. When you select a user in the Navigator, the contents panel displays the following tabs: Overview. Displays general properties of the user and all groups to which the user belongs. Privileges. Displays the privileges and roles assigned to the user for the domain and for application services in the domain. Roles A role is a collection of privileges that you assign to a user or group. Privileges determine the actions that users can perform. You assign a role to users and groups for the domain and for application services in the domain. The Roles section of the Navigator organizes roles into the following folders: System-defined Roles. Contains roles that you cannot edit or delete. The Administrator role is a systemdefined role. Custom Roles. Contains roles that you can create, edit, and delete. The Administrator tool includes some custom roles that you can edit and assign to users and groups. When you select a folder in the Roles section of the Navigator, the contents panel displays all roles belonging to the folder. Right-click a role and select Navigate to Item to display the role details in the contents panel. When you select a role in the Navigator, the contents panel displays the following tabs: Overview. Displays general properties of the role and the users and groups that have the role assigned for the domain and application services. Privileges. Displays the privileges assigned to the role for the domain and application services. Security Tab 15

29 Service States You can identify the state of the Informatica Services by the icon displayed in the Administrator tool. The following table displays the icons associated with each service state: State Icon Available Unavailable Disabled Process States You can identify the state of a Data Integration Service process or PowerCenter Integration Service process by the icon displayed in the Administrator tool. The icons for the state also depends the node in which the process runs. An yellow diamond overlay appears the process state icon if the primary node has high availability. A grid icon is superimposed the process state icon when the process runs a grid. The following table displays the icons associated with the process states: State Icon Aborted Aborted (with high availability) Aborted (Grid) Disabled Disabled (with high availability) Disabled (Grid) Failed Failed (with high availability) 16 Chapter 3: Using Informatica Administrator

30 State Icon Failed (Grid) Running Running (with high availability) Running (Grid) Standing by or Delayed Standing by or Delayed (with high availability) Standing by or Delayed (Grid) Starting Starting (with high availability) Starting (Grid) Stopped Stopped (with high availability) Stopped (Grid) Stopping Stopping (with high availability) Stopping (Grid) Process States 17

31 Job States You can identify the state of a job by the icon displayed in the Administrator tool. The following table displays the icons associated with each job state: State Icon Aborted Completed Failed In queue or Pending Running Starting Stopped Stopping Terminated 18 Chapter 3: Using Informatica Administrator

32 C H A P T E R 4 Domain Management This chapter includes the following topics: Domain Management Overview, 19 Alert Management, 20 Domain Security Management, 21 User Security Management, 21 Application Service Management, 22 Node Management, 24 Domain Tasks, 25 Domain Properties, 26 Domain Management Overview An Informatica domain is a collection of services and a node that define the Informatica environment. To manage the domain, you manage the node and services within the domain. Use the Administrator tool to complete the following tasks: Manage alerts. Configure, enable, and disable domain and service alerts for users. Manage domain security. Configure secure communication between domain components. Manage user security. Assign privileges and permissions to users and groups. Manage application services. Enable, disable, and remove application services. Enable, disable, and restart service processes. Manage node. Configure node properties, such as the backup directory and resources. Complete domain tasks. You can monitor the statuses of all application services and the node, and view dependencies among application services and node. Configure domain properties. For example, you can change the SMTP properties for alerts and domain resiliency properties. 19

33 Alert Management Alerts provide users with domain and service alerts. Domain alerts provide notification about node failure and service alerts provide notification about service process failure. To use the alerts, complete the following tasks: Configure the SMTP settings for the outgoing server. Subscribe to alerts. After you configure the SMTP settings, users can subscribe to domain and service alerts. Configuring SMTP Settings You configure the SMTP settings for the outgoing mail server to enable alerts. Configure SMTP settings on the domain Properties view. 1. In the Administrator tool, click the Domain tab. 2. In the Navigator, select the domain. 3. In the contents panel, click the Properties view. 4. In the SMTP Configuration area of the, click Edit. 5. Edit the SMTP settings. Property Host Name The SMTP outbound mail server host name. For example, enter the Microsoft Exchange Server for Microsoft Outlook. Port Port used by the outgoing mail server. Valid values are from 1 to Default is 25. User Name Password Sender Address The user name for authentication upon sending, if required by the outbound mail server. The user password for authentication upon sending, if required by the outbound mail server. The address that the Service Manager uses in the From field when sending notification s. If you leave this field blank, the Service Manager uses Administrator@<host name> as the sender. 6. Click OK. Subscribing to Alerts After you complete the SMTP configuration, you can subscribe to alerts. 1. Verify that the domain administrator has entered a valid address for your user account on the Security page. If the address or the SMTP configuration is not valid, the Service Manager cannot deliver the alert notification. 2. In the Administrator tool header area, click Manage > Preferences. The Preferences page appears. 20 Chapter 4: Domain Management

34 3. In the User Preferences section, click Edit. The Edit Preferences dialog box appears. 4. Select Subscribe for Alerts. 5. Click OK. 6. Click OK. The Service Manager sends alert notification s based on your domain privileges and permissions. Viewing Alerts When you subscribe to alerts, you can receive domain and service notification s for certain events. When a domain or service event occurs that triggers a notification, you can track the alert status in the following ways: The Service Manager sends an alert notification to all subscribers with the appropriate privilege and permission on the domain or service. The Log Manager logs alert notification delivery success or failure in the domain or service log. You can review the domain or service logs for undeliverable alert notification s. In the domain log, filter by Alerts as the category. In the service logs, search on the message code ALERT. When the Service Manager cannot send an alert notification , the following message appears in the related domain or service log: ALERT_10004: Unable to send alert of type [alert type] for object [object name], alert message [alert message], with error [error]. Domain Security Management You can configure Informatica domain components to use the Secure Sockets Layer (SSL) protocol or the Transport Layer Security (TLS) protocol to encrypt connections with other components. When you enable SSL or TLS for domain components, you ensure secure communication. You can configure secure communication in the following ways: Between services within the domain You can configure secure communication between services within the domain. Between the domain and external components You can configure secure communication between Informatica domain components and web browsers or web service clients. Each method of configuring secure communication is independent of the other methods. When you configure secure communication for one set of components, you do not need to configure secure communication for any other set. User Security Management You manage user security within the domain with privileges and permissions. Domain Security Management 21

35 Privileges determine the actions that users can complete on domain objects. Permissions define the level of access a user has to a domain object. Domain objects include the domain, node, license, database connections, and application services. Even if a user has the domain privilege to complete certain actions, the user may also require permission to complete the action on a particular object. To log in to the Administrator tool, a user must have the Access Informatica Administrator domain privilege. If a user has the Access Informatica Administrator privilege and permission on an object, but does not have the domain privilege that grants the ability to modify the object type, then the user can view the object. If a user does not have permission on a selected object in the Navigator, the contents panel displays a message indicating that permission on the object is denied. Application Service Management You can perform the following common administration tasks for application services: Enable and disable services and service processes. Configure the domain to restart service processes. Remove an application service. Troubleshoot problems with an application service. Enabling and Disabling Services and Service Processes You can enable and disable application services and service processes in the Administrator tool. When a service is enabled, there must be at least one service process enabled and running for the service to be available. By default, all service processes are enabled. A service does not start a disabled service process in any situation. The state of a service depends on the state of the constituent service processes. A service can have the following states: Available. You have enabled the service and at least one service process is running. The service is available to process requests. Unavailable. You have enabled the service but there are no service processes running. This can be a result of service processes being disabled or failing to start. The service is not available to process requests. Disabled. You have disabled the service. You can disable a service to perform a management task. When you disable a service, all associated service processes stop, but they remain enabled. 22 Chapter 4: Domain Management

36 The following table describes the different states of a service process: Service Process State Process Configuration Running Enabled The service process is running on the node. Standing By Enabled The service process is enabled but is not running because another service process is running as the primary service process. Disabled Disabled The service is enabled but the service process is stopped and is not running on the node. Stopped Enabled The service is unavailable. Failed Enabled The service and service process are enabled, but the service process could not start. Viewing Service Processes You can view the state of a service process on the Processes view of a service. You can view the state of all service processes on the Overview view of the domain. To view the state of a service process: 1. In the Administrator tool, click the Domain tab. 2. In the Navigator, select a service. 3. In the contents panel, select the Processes view. The Processes view displays the state of the processes. Configuring Restart for Service Processes If an application service process becomes unavailable while a node is running, the domain tries to restart the process on the same node based on the restart options configured in the domain properties. 1. In the Administrator tool, click the Domain tab. 2. In the Navigator, select the domain. 3. In the Properties view, configure the following restart properties: Domain Property Maximum Restart Attempts Within Restart Period (sec) Number of times within a specified period that the domain attempts to restart an application service process when it fails. The value must be greater than or equal to 1. Default is 3. Maximum period of time that the domain spends attempting to restart an application service process when it fails. If a service fails to start after the specified number of attempts within this period of time, the service does not restart. Default is 900. Application Service Management 23

37 Troubleshooting Application Services I think that a service is using incorrect environment variable values. How can I find out which environment variable values are used by a service. Set the error severity level for the node to debug. When the service starts on the node, the Domain log will display the environment variables that the service is using. Node Management A node is a logical representation of a physical machine in the domain. The node appears in the Navigator, and you can view and edit its properties. Use the Domain tab of Administrator tool to manage the node properties. You perform the following tasks to manage a node: Configure properties. Configure node properties, such as the repository backup directory. View processes. View the processes configured to run on the node and their status. Edit permissions. View inherited permissions for the node and manage the object permissions for the node. Configuring Node Properties You configure node properties on the Properties view for the node. 1. In the Administrator tool, click the Domain tab. 2. In the Navigator, select a node. 3. Click the Properties view. The Properties view displays the node properties in separate sections. 4. In the Properties view, click Edit for the section that contains the property you want to set. You cannot edit the general properties of the node. 5. Edit the following properties: 6. Click OK. Viewing Processes on the Node You can view the status of all processes configured to run on a node. To view processes on a node: 1. In the Administrator tool, click the Domain tab. 2. In the Navigator, select a node. 3. In the content panel, select the Processes view. The tab displays the status of each process configured to run on the node. 24 Chapter 4: Domain Management

38 Domain Tasks On the Domain tab, you can complete domain tasks such as monitoring application services, managing domain objects, managing logs, and viewing service and node dependencies. You can monitor all application services and the node in a domain. You can also recycle, enable, or disable application services and view logs for application services. To perform impact analysis, view dependencies among application services and the node. Impact analysis helps you determine the implications of particular domain actions like shutting down an application service. Managing and Monitoring Application Services and Node You can manage and monitor application services and node in a domain. 1. In the Administrator tool, click the Domain tab. 2. Click the Services and Nodes view. 3. In the Navigator, select the domain. The contents panel shows the objects defined in the domain. 4. To show the names of the application services and node in the contents panel, click the Show Details button. The contents panel shows the names of the application services and node in the domain. 5. To hide the names of the application services and node in the contents panel, click the Hide Details button. The contents panel hides the names of the application services and node in the domain. 6. To view details for an object, select the object in the Navigator. For example, select an application service in the Navigator to view the service version, service status, process status, and last error message for the service. Object details appear. 7. To view properties for an object, click an object in the Navigator. The contents panels shows properties for the object. 8. To recycle, enable, disable, or show logs for an application service, double-click the application service in the Navigator. To recycle the application service, click the Recycle the Service button. To enable the application service, click the Enable the Service button. To disable the application service, click the Disable the Service button. To view logs for the application service, click the View Logs for Service button. Viewing Dependencies In the Services and Nodes view on the Domain tab, you can view dependencies for application services and node in the domain. To view the View Dependency window, you must install and enable Adobe Flash Player or later in your browser. If you use Internet Explorer, enable the Run ActiveX Controls and Plug-ins option. 1. In the Administrator tool, click the Domain tab. 2. Click the Services and Nodes view. Domain Tasks 25

39 3. In the Navigator, select the domain. The contents panel displays the objects in the domain. 4. In the contents panel, right-click a domain object and click View Dependencies. The View Dependency window shows domain objects connected by blue and orange lines, as follows: The blue lines represent service-to-node dependencies. The orange lines represent service-to-service dependencies. To hide or show the service-to-service dependencies, clear or select the Show Service dependencies option in the View Dependency window. When you clear this option, the orange lines disappear but the services are still visible. The following table describes the information that appears in the View Dependency window based on the object: Object Node Service View Dependency Window Shows all service processes running on the node and the status of each process. Shows the upstream and downstream dependencies, and the node on which the service runs. 5. In the View Dependency window, you can optionally complete the following actions: To view additional dependency information for any object, place the cursor over the object. To highlight the downstream dependencies and show additional process details for a service, place the cursor over the service. To view the View Dependency window for any object in the window, right-click the object and click Show Dependency. The View Dependency window refreshes and shows the dependencies for the selected object. Domain Properties On the Domain tab, you can configure domain properties including database properties, gateway configuration, and service levels. To view and edit properties, click the Domain tab. In the Navigator, select a domain. Then click the Properties view in the contents panel. The contents panel shows the properties for the domain. You can configure the properties to change the domain. For example, you can change the database properties, SMTP properties for alerts, and the domain resiliency properties. You can also monitor the domain at a high level. In the Services and Nodes view, you can view the statuses of the application services and the node in the domain. You can configure the following domain properties: General properties. Edit general properties, such as service resilience and dispatch mode. SMTP configuration. Edit the SMTP settings for the outgoing mail server to enable alerts. Custom properties. Edit custom properties that are unique to the Informatica environment or that apply in special cases. When you create a domain, it has no custom properties. Use custom properties only at the request of Informatica Global Customer Support. 26 Chapter 4: Domain Management

40 General Properties In the General Properties area, you can configure general properties for the domain. To edit general properties, click Edit. The following table describes the properties that you can edit in the General Properties area: Property Name Resilience Timeout Limit on Resilience Timeout Restart Period Maximum Restart Attempts within Restart Period Dispatch Mode Enable Secure Communication Service Resilience Timeout Read-only. The name of the domain. The number of seconds that an application service tries to connect or reconnect to the PowerCenter Repository Service or the PowerCenter Integration Service. Valid values are from 0 to Default is 30 seconds. The maximum number of seconds that application clients or application services can try to connect or reconnect to the PowerCenter Repository Service or the PowerCenter Integration Service. Default is 180 seconds. The maximum amount of time in seconds that the domain spends trying to restart an application service process. Valid values are from 0 to The number of times that the domain tries to restart an application service process. Valid values are from 0 to If you set the value as 0, the domain does not try to restart the service process. This property is not applicable for PowerCenter Express. Configures services to use the TLS protocol to transfer data securely within the domain. When you enable secure communication for the domain, services use secure connections to communicate with other Informatica application services and clients. The maximum number of seconds that application clients and application services can try to connect to the Data Integration Service or to the Model Repository Service. The default is 180 seconds. SMTP Configuration In the SMTP Configuration area, you can configure SMTP settings for the outgoing mail server to enable alerts. The following table describes the properties that you can edit in the SMTP Configuration area: Property Host Name The SMTP outbound mail server host name. For example, enter the Microsoft Exchange Server for Microsoft Outlook. Port Port used by the outgoing mail server. Valid values are from 1 to Default is 25. User Name The user name for authentication upon sending, if required by the outbound mail server. Domain Properties 27

41 Property Password Sender Address The user password for authentication upon sending, if required by the outbound mail server. The address that the Service Manager uses in the From field when sending notification s. If you leave this field blank, the Service Manager uses name> as the sender. Custom Properties for the Domain Configure custom properties that are unique to specific environments. You might need to apply custom properties in special cases. When you define a custom property, enter the property name and an initial value. Define custom properties only at the request of Informatica Global Customer Support. 28 Chapter 4: Domain Management

42 C H A P T E R 5 Domain Security This chapter includes the following topics: Domain Security Overview, 29 Secure Communication Within the Domain, 29 User Security, 30 Application Services and Ports, 31 Domain Security Overview You can configure Informatica domain components to use the Secure Sockets Layer (SSL) protocol or the Transport Layer Security (TLS) protocol to encrypt connections with other components. When you enable SSL or TLS for domain components, you ensure secure communication. You can configure secure communication in the following ways: Between services within the domain You can configure secure communication between services within the domain. Between the domain and external components You can configure secure communication between Informatica domain components and web browsers or web service clients. Each method of configuring secure communication is independent of the other methods. When you configure secure communication for one set of components, you do not need to configure secure communication for any other set. Secure Communication Within the Domain To configure services to use the TLS protocol to transfer data securely within the domain, enable the TLS protocol for the domain. When you enable the TLS protocol for the domain, you secure the communication between the following components: Between application services Between application services and application clients 29

43 The services use a self-signed keystore file generated by Informatica. The keystore file stores the certificates and keys that authorize the secure connection between the services and other domain components. You can use the Administrator tool to configure secure communication within the domain. Note: Passwords are encrypted for all application services, application clients, and command line programs regardless of whether the TLS protocol is enabled for the domain. Configuring Secure Communication Within the Domain You can use the Administrator tool to enable or disable the TLS protocol for the domain. When you enable the TLS protocol, you configure secure communication between services within the domain. 1. On the Domain tab, select the Services and Nodes view. 2. In the Navigator, select the domain. 3. In the General Properties area, click Edit. 4. Select Enable Transport Layer Security (TLS) and click OK. 5. Shut down and restart the domain to apply the change. User Security The Service Manager and some application services control user security in application clients. Application clients include Informatica Administrator and Informatica Developer. The Service Manager and application services control user security by performing the following functions: Encryption When you log in to an application client, the Service Manager encrypts the password. Authentication When you log in to an application client, the Service Manager authenticates your user account based on your user name and password or on your user authentication token. Authorization When you request an object in an application client, the Service Manager and some application services authorize the request based on your privileges, roles, and permissions. You can also use HTTPS for secure connection to the domain and the application services. The following application services support HTTPS connection along with the Informatica domain: Data Integration Service Analyst Service Encryption Informatica encrypts passwords sent from application clients to the Service Manager. Informatica uses AES encryption with multiple 128-bit keys to encrypt passwords and stores the encrypted passwords in the domain configuration database. Configure HTTPS to encrypt passwords sent to the Service Manager from application clients. 30 Chapter 5: Domain Security

44 Authentication The Service Manager authenticates users who log in to application clients. The first time you log in to an application client, you enter a user name, password, and security domain. A security domain is a collection of user accounts and groups in an Informatica domain. When you log in to an application client as a native user, the Service Manager authenticates your user name and password against the user accounts in the domain configuration database. Authorization The Service Manager authorizes user requests for domain objects. Requests can come from the Administrator tool. The following application services authorize user requests for other objects: Data Integration Service Model Repository Service The Service Manager synchronizes the user and group information between the repositories and the domain configuration database when the following events occur: You restart the Model Repository Service. You add or remove native users or groups. When you assign permissions to users and groups in an application client, the application service stores the permission assignments with the user and group information in the appropriate repository. When you request an object in an application client, the appropriate application service authorizes your request. For example, if you try to edit a project in Informatica Developer, the Model Repository Service authorizes your request based on your privilege, role, and permission assignments. Application Services and Ports Informatica domain services and application services in the Informatica domain have unique ports. Informatica Domain The following table lists the default port associated with the Informatica domain: Type Domain configuration Default Port Default is You can change the default port when during installation. You can modify the port after installation with the infasetup updategatewaynode command. Service Manager 6006 Service Manager Shutdown 6007 Informatica Administrator (HTTP) 6008 Informatica Administrator (HTTPS) 8443 Application Services and Ports 31

45 Type Default Port Informatica Administrator shutdown 6009 Service Process (Minimum) 6013 Service Process (Maximum) 6113 Analyst Service The following table lists the default port associated with the Analyst Service: Type Default Port Analyst Service (HTTP) 8085 Analyst Service (HTTPS) Analyst Service (Staging database) No default port. Enter the required port number when you create the service. No default port. Enter the database port number. Content Management Service The following table lists the default port associated with the Content Management Service: Type Default Port Content Management Service (HTTP) 8105 Content Management Service (HTTPS) No default port. Enter the required port number when you create the service. Data Director Service The following table lists the default port associated with the Data Director Service: Type Data Director Service (HTTP) Data Director Service (HTTPS) Default Port No default port. Enter the required port number when you create the service. No default port. Enter the required port number when you create the service. 32 Chapter 5: Domain Security

46 Data Integration Service The following table lists the default port associated with the Data Integration Service: Type Default Port Data Integration Service (HTTP proxy) 8085 Data Integration Service (HTTP) 8095 Data Integration Service (HTTPS) Profiling Warehouse database Human Task database No default port. Enter the required port number when you create the service. No default port. Enter the database port number. No default port. Enter the database port number. Metadata Manager Service The following table lists the default port associated with the Metadata Manager Service: Type Default Port Metadata Manager Service (HTTP) Default is Metadata Manager Service (HTTPS) No default port. Enter the required port number when you create the service. If you configure HTTPS, verify that the port number one less than the HTTPS port is also available. For example, if you configure for the HTTPS port number, you must verify that is also available. Metadata Manager uses port for HTTP. PowerExchange Listener Service Use the same port number that you specify in the SVCNODE statement of the DBMOVER file. If you define more than one Listener Service to run on a node, you must define a unique SVCNODE port number for each service. PowerExchange Logger Service Use the same port number that you specify in the SVCNODE statement of the DBMOVER file. If you define more than one Listener Service to run on a node, you must define a unique SVCNODE port number for each service. Reporting Service The following table lists the default port associated with the Reporting Service: Type Default Port Reporting Service (HTTP) Reporting Service (HTTPS) Application Services and Ports 33

47 Reporting and Dashboards Service The following table lists the default port associated with the Reporting and Dashboards Service: Type Reporting and Dashboards Service (HTTP) Reporting and Dashboards Service (HTTPS) Default Port No default port. Enter the required port number when you create the service. No default port. Enter the required port number when you create the service. Web Services Hub Service The following table lists the default port associated with the Web Services Hub Service: Type Default Port Web Services Hub Service (HTTP) 7333 Web Services Hub Service (HTTPS) Chapter 5: Domain Security

48 C H A P T E R 6 Users and Groups This chapter includes the following topics: Users and Groups Overview, 35 Understanding User Accounts, 36 Managing Users, 37 Managing Groups, 39 Account Lockout, 41 Users and Groups Overview To access the application services and objects in the Informatica domain and to use the application clients, you must have a user account. The tasks you can perform depend on the type of user account you have and the type of PowerCenter Express license. During installation, a default administrator user account is created. Use the default administrator account to log in to the Informatica domain and manage application services, domain objects, and other user accounts. When you log in to the Informatica domain after installation, change the password to ensure security for the Informatica domain and applications. Note: If you install PowerCenter Express Personal Edition you must use the default administrator account for all operations. You cannot create users or groups and manage permissions. User account management in Informatica involves the following key components: Users. You can set up different types of user accounts in the Informatica domain. Users can perform tasks based on the roles, privileges, and permissions assigned to them. Authentication. When a user logs in to an application client, the Service Manager authenticates the user account in the Informatica domain and verifies that the user can use the application client. Groups. You can set up groups of users and assign different roles, privileges, and permissions to each group. The roles, privileges, and permissions assigned to the group determines the tasks that users in the group can perform within the Informatica domain. Privileges and roles. Privileges determine the actions that users can perform in application clients. A role is a collection of privileges that you can assign to users and groups. You assign roles or privileges to users and groups for the domain and for application services in the domain. Account lockout. You can configure account lockout to lock a user account when the user specifies an incorrect login in the Administrator tool or the Developer tool. You can also unlock a user account. 35

49 Default Everyone Group An Informatica domain includes a default group named Everyone. All users in the domain belong to the group. You can assign privileges, roles, and permissions to the Everyone group to grant the same access to all users. You cannot complete the following tasks for the Everyone group: Edit or delete the Everyone group. Add users to or remove users from the Everyone group. Move a group to the Everyone group. Understanding User Accounts An Informatica domain can have the following types of accounts: Default administrator Domain administrator Application client administrator User Default Administrator When you install Informatica services, the installer creates the default administrator with a user name and password you provide. You can use the default administrator account to initially log in to the Administrator tool. The default administrator has administrator permissions and privileges on the domain and all application services. The default administrator is a user account in the native security domain. You cannot create a default administrator. You cannot disable or modify the user name or privileges of the default administrator. You can change the default administrator password. Domain Administrator User A domain administrator can create and manage objects in the domain. The domain administrator can log in to the Administrator tool and configure application services in the domain. However, by default, the domain administrator cannot log in to application clients. The default administrator must explicitly give a domain administrator full permissions and privileges to the application services so that they can log in and perform administrative tasks in the application clients. To create a domain administrator, assign a user the Administrator role for a domain. A user with an account in the Informatica domain can perform tasks in the application clients. Typically, the default administrator or a domain administrator creates and manages user accounts and assigns roles, permissions, and privileges in the Informatica domain. However, any user with the required domain privileges and permissions can create a user account and assign roles, permissions, and privileges. 36 Chapter 6: Users and Groups

50 Users can perform tasks in application clients based on the privileges and permissions assigned to them. Managing Users You can create, edit, and delete users depending on the type of PowerCenter Express license. You can assign roles, permissions, and privileges to a user account. The roles, permissions, and privileges assigned to the user determines the tasks the user can perform within the Informatica domain. If you have the PowerCenter Express Personal Edition, you cannot create users or groups. You must use the default Administrator user to perform all tasks. You can also unlock a user account. Creating Users Add, edit, or delete native users on the Security tab. 1. In the Administrator tool, click the Security tab. 2. On the Security Actions menu, click Create User. 3. Enter the following details for the user: Property Login Name Password Confirm Password Full Name Login name for the user account. The login name for a user account must be unique within the security domain to which it belongs. The name is not case sensitive and cannot exceed 128 characters. It cannot include a tab, newline character, or the following special characters:, + " \ < > ; / * %? & The name can include an ASCII space character except for the first and last character. All other space characters are not allowed. Password for the user account. The password can be from 1 through 80 characters long. Enter the password again to confirm. You must retype the password. Do not copy and paste the password. Full name for the user account. The full name cannot include the following special characters: < > of the user account. The description cannot exceed 765 characters or include the following special characters: < > Managing Users 37

51 Property Phone address for the user. The address cannot include the following special characters: < > Enter the address in the format Telephone number for the user. The telephone number cannot include the following special characters: < > 4. Click OK to save the user account. After you create a user account, the details panel displays the properties of the user account and the groups that the user is assigned to. Editing General Properties of Native Users You cannot change the login name of a native user. You can change the password and other details for a native user account. 1. In the Administrator tool, click the Security tab. 2. In the Users section of the Navigator, select a native user account and click Edit. 3. To change the password, select Change Password. The Security tab clears the Password and Confirm Password fields. 4. Enter a new password and confirm. 5. Modify the full name, description, , and phone as necessary. 6. Click OK to save the changes. Assigning Native Users to Native Groups Assign native users to native groups on the Security tab. 1. In the Administrator tool, click the Security tab. 2. In the Users section of the Navigator, select a native user account and click Edit. 3. Click the Groups tab. 4. To assign a native user to a group, select a group name in the All Groups column and click Add. If nested groups do not display in the All Groups column, expand each group to show all nested groups. You can assign a native user to more than group. Use the Ctrl or Shift keys to select multiple groups at the same time. 5. To remove a native user from a group, select a group in the Assigned Groups column and click Remove. 6. Click OK to save the group assignments. Enabling and Disabling User Accounts Users with active accounts can log in to application clients and perform tasks based on their permissions and privileges. If you do not want users to access application clients temporarily, you can disable their accounts. When you disable a user account, the user cannot log in to the application clients. 38 Chapter 6: Users and Groups

52 To disable a user account, select a user account in the Users section of the Navigator and click Disable. When you select a disabled user account, the Security tab displays a message that the user account is disabled. When a user account is disabled, the Enable button is available. To enable the user account, click Enable. You cannot disable the default administrator account. Deleting Native Users To delete a native user account, right-click the user account name in the Users section of the Navigator and select Delete User. Confirm that you want to delete the user account. You cannot delete the default administrator account. When you log in to the Administrator tool, you cannot delete your user account. Unlocking a User Account The domain administrator can unlock a user account that is locked out of the domain. If the user is a native user, the administrator can request that the user reset their password before logging back into the domain. The user must have a valid address configured in the domain to receive notifications when their account password has been reset. 1. In the Administrator tool, click the Security tab. 2. Click Account Management. The Account Management page displays the following lists of locked-out users: Locked Out Native Users Includes user accounts in the Native security domain that are locked out. Locked Out LDAP Users Includes user accounts in LDAP security domains that are locked out. 3. Select the users that you want to unlock. 4. Select Unlock user and reset password to generate a new password for the user after you unlock the account. The user receives the new password in an Click the Unlock selected users button. Managing Groups You can create, edit, and delete groups in the native security domain. You can assign roles, permissions, and privileges to a group. The roles, permissions, and privileges assigned to the group determines the tasks that users in the group can perform within the Informatica domain. Adding a Native Group Add, edit, or remove native groups on the Security tab. A native group can contain user accounts or other native groups. You can create multiple levels of native groups. For example, the Finance group contains the AccountsPayable group which contains the Managing Groups 39

53 OfficeSupplies group. The Finance group is the parent group of the AccountsPayable group and the AccountsPayable group is the parent group of the OfficeSupplies group. Each group can contain other native groups. 1. In the Administrator tool, click the Security tab. 2. On the Security Actions menu, click Create Group. 3. Enter the following information for the group: Property Name Name of the group. The name is not case sensitive and cannot exceed 128 characters. It cannot include a tab, newline character, or the following special characters:, + " \ < > ; / * %? The name can include an ASCII space character except for the first and last character. All other space characters are not allowed. Parent Group Group to which the new group belongs. If you select a native group before you click Create Group, the selected group is the parent group. Otherwise, Parent Group field displays Native indicating that the new group does not belong to a group. of the group. The group description cannot exceed 765 characters or include the following special characters: < > 4. Click Browse to select a different parent group. You can create more than one level of groups and subgroups. 5. Click OK to save the group. Editing Properties of a Native Group After you create a group, you can change the description of the group and the list of users in the group. You cannot change the name of the group or the parent of the group. To change the parent of the group, you must move the group to another group. 1. In the Administrator tool, click the Security tab. 2. In the Groups section of the Navigator, select a native group and click Edit. 3. Change the description of the group. 4. To change the list of users in the group, click the Users tab. The Users tab displays the list of users in the domain and the list of users assigned to the group. 5. To assign users to the group, select a user account in the All Users column and click Add. 6. To remove a user from a group, select a user account in the Assigned Users column and click Remove. 7. Click OK to save the changes. Moving a Native Group to Another Native Group To organize the groups of users in the native security domain, you can set up nested groups and move a group to another group. To move a native group to another native group, right-click the name of a native group in the Groups section of the Navigator and select Move Group. 40 Chapter 6: Users and Groups

54 Deleting a Native Group To delete a native group, right-click the group name in the Groups section of the Navigator and select Delete Group. When you delete a group, the users in the group lose their membership in the group and all permissions or privileges inherited from group. When you delete a group, the Service Manager deletes all groups and subgroups that belong to the group. Account Lockout The domain administrator can configure account lockout to increase domain security. The domain administrator can enable account lockout to prevent hackers from gaining access to the domain. The administrator can specify the number of failed login attempts before the account is locked. If the account is locked, the administrator can unlock the account. When the administrator unlocks a user account, the administrator can request that the user reset their password before logging back into the domain. To enable the domain to send s to users when their passwords are reset, configure the server settings for the domain. Configuring Account Lockout Select the account lockout options to lock out user accounts in the Informatica domain after multiple failed logins. 1. In the Administrator tool, click Security > Account Management. 2. In Account Lockout Configuration section, click Edit. 3. Set the following properties: Property Enable Account Lockout Enable Admin Account Lockout Maximum Login Attempts Enforces lockout of an Informatica domain user account after a specified number of failed logins. By default, this option does not enforce lockout of administrator user accounts. You must select the Enable Admin Account Lockout option to enforce lockout for administrator user accounts. Enforces lockout of an Informatica domain administrator user account after a specified number of failed logins. You must select the Enable Account Lockout option before you can enforce lockout for administrator user accounts. Specifies the maximum number of consecutive login failures allowed before a user account is locked out of the Informatica domain. Account Lockout 41

55 C H A P T E R 7 Privileges and Roles This chapter includes the following topics: Privileges and Roles Overview, 42 Domain Privileges, 43 Data Integration Service Privileges, 47 Model Repository Service Privileges, 48 Managing Roles, 48 Assigning Privileges and Roles to Users and Groups, 51 Viewing Users with Privileges for a Service, 53 Privileges and Roles Overview You manage user security with privileges and roles. You can modify privileges and roles depending on the type of PowerCenter Express license. Privileges Privileges determine the actions that users can perform in application clients. Informatica includes the following privileges: Domain privileges. Determine actions on the Informatica domain that users can perform using the Administrator tool. Data Integration Service privilege. Determines actions on applications that users can perform using the Administrator tool. This privilege also determines whether users can drill down and export profile results. Model Repository Service privilege. Determines actions on projects that users can perform using Informatica Developer. Test Data Manager Service privileges. Determine data discovery, data masking, data subset, and test data generation tasks that users can perform using the Test Data Manager. You assign privileges to users and groups for application services. You can assign different privileges to a user for each application service of the same service type. You assign privileges to users and groups on the Security tab of the Administrator tool. The Administrator tool organizes privileges into levels. A privilege is listed below the privilege that it includes. Some privileges include other privileges. When you assign a privilege to users and groups, the Administrator tool also assigns any included privileges. 42

56 Roles Privilege Groups The domain and application service privileges are organized into privilege groups. A privilege group is an organization of privileges that define common user actions. For example, the domain privileges include the following privilege groups: Tools. Includes privileges to log in to the Administrator tool. Security Administration. Includes privileges to manage users, groups, roles, and privileges. Domain Administration. Includes privileges to manage the domain, folders, and application services. Tip: When you assign privileges to users and user groups, you can select a privilege group to assign all privileges in the group. A role is a collection of privileges that you assign to a user or group. Each user within an organization has a specific role, whether the user is a developer, administrator, basic user, or advanced user. You assign a role to users and groups for the domain and for application services in the domain. Domain Privileges Domain privileges determine the actions that users can perform using the Administrator tool and the infacmd and pmrep command line programs. The following table describes each domain privilege group: Privilege Group Security Administration Domain Administration Monitoring Tools Includes privileges to manage users, groups, roles, and privileges. Includes privileges to manage the domain, application services, and connections. Includes privileges to configure monitoring preferences, to view monitoring for integration objects, and to access monitoring. Includes privileges to log in to the Administrator tool. Security Administration Privilege Group Privileges in the Security Administration privilege group and domain object permissions determine the security management actions users can perform. Some security management tasks are determined by the Administrator role, not by privileges or permissions. Note: To complete security management tasks in the Administrator tool, users must also have the Access Informatica Administrator privilege. Domain Privileges 43

57 Grant Privileges and Roles Privilege Users assigned the Grant Privileges and Roles privilege can assign privileges and roles to users and groups. The following table lists the required permissions and the actions that users can perform with the Grant Privileges and Roles privilege: Permission On Domain or application service User is able to perform the following actions: - Assign privileges and roles to users and groups for the domain or application service. - Edit and remove the privileges and roles assigned to users and groups. Domain Administration Privilege Group Domain management actions that users can perform depend on privileges in the Domain Administration group and permissions on domain objects. Some domain management tasks are determined by the Administrator role, not by privileges or permissions. A user assigned the Administrator role for the domain can complete the following tasks: Configure domain properties. Grant permission on the domain. Manage and purge log events. Receive domain alerts. View user activity log events. Users assigned domain object permissions but no privileges can complete some domain management tasks. The following table lists the actions that users can perform when they are assigned domain object permissions only: Permission On Domain Application service Node User is able to perform the following actions: - View domain properties and log events. - Configure the global settings. User is able to view application service properties and log events. User is able to view node properties. Note: To complete domain management tasks in the Administrator tool, users must also have the Access Informatica Administrator privilege. 44 Chapter 7: Privileges and Roles

58 Manage Service Execution Privilege Users assigned the Manage Service Execution privilege can enable and disable application services and receive application service alerts. The following table lists the required permissions and the actions that users can perform with the Manage Service Execution privilege: Permission On Application service User is able to perform the following actions: - Enable and disable application services and service processes. - Receive application service alerts. Manage Services Privilege Users assigned the Manage Services privilege can create, configure, move, remove, and grant permission on application services and license objects. The Manage Services privilege includes the Manage Service Execution privilege. The following table lists the required permissions and the actions that users can perform with the Manage Services privilege: Permission On Domain where application service runs, and any associated application service Application service Model Repository Service User is able to create application services. User is able to perform the following actions: - Configure application services. - Grant permission on application services. User is able to perform the following actions: - Create and delete Model repository content. - Create, delete, and re-index the search index. Manage Connections Privilege Users assigned the Manage Connections privilege can create, edit, and delete connections in the Administrator tool, Developer tool, and infacmd command line program. Users can also copy connections in the Developer tool and can grant permissions on connections in the Administrator tool and infacmd command line program. Users assigned connection permissions but not the Manage Connections privilege can perform the following connection management actions: View all connection metadata, except passwords. Requires read permission on connection. Preview data or run a mapping or profile. Requires execute permission on connection. Domain Privileges 45

59 The following table lists the required permissions and the actions that users can perform with the Manage Connections privilege: Permission - User is able to create connections. Write on connection Grant on connection User is able to copy, edit, and delete connections. User is able to grant and revoke permissions on connections. Monitoring Privilege Group The privileges in the Monitoring group determine which users can view and configure monitoring. The following table lists the required permissions and the actions that users can perform with the privileges in the Monitoring group: Privilege Permission On Configure Global Settings Domain User is able to configure the global settings. Configure Statistics and Reports Domain User is able to configure preferences for monitoring statistics and reports. View Jobs of Other Users - User is able to displays jobs of other users. View Statistics - User is able to view statistics for domain objects. View Reports - User is able to view reports for domain objects. Access from Developer Tool Access from Administrator Tool - User is able to access the monitoring feature from the Developer tool. - User is able to access the monitoring feature from the Administration tool. Allow Actions for Jobs - User is able to perform the following actions: - Abort jobs. - Reissue mapping jobs. - View logs about a job. To access the read-only view of the Monitoring tab, users do not need the Access Informatica Administrator privilege. Tools Privilege Group The privilege in the domain Tools group determines which users can access the Administrator tool. 46 Chapter 7: Privileges and Roles

60 The following table lists the required permissions and the actions that users can perform with the privilege in the Tools group: Privilege Permission Access Informatica Administrator - User is able to perform the following actions: - Log in to the Administrator tool. - Manage their own user account in the Administrator tool. - Export log events. To complete tasks in the Administrator tool, users must have the Access Informatica Administrator privilege. To run infacmd commands or to access the read-only view of the Monitoring tab, users do not need the Access Informatica Administrator privilege. Data Integration Service Privileges The Data Integration Service privileges determine actions that users can perform on applications using the Administrator tool and the infacmd command line program. They also determine whether users can drill down and export profile results using the Developer tool. The following table lists the required permissions and the actions that users can perform with the privilege in the Application Administration privilege group: Privilege Name Permission On Manage Applications Data Integration Service User is able to perform the following actions: - Back up and restore an application to a file. - Deploy an application to a Data Integration Service and resolve name conflicts. - Start an application after deployment. - Find an application. - Start or stop objects in an application. - Configure application properties. The following table lists the required permissions and the actions that users can perform with the privilege in the Profiling Administration privilege group: Privilege Name Permission On Drilldown and Export Results Read on project Execute on relational data source connection is also required to drill down on live data User is able to perform the following actions: - Drill down profiling results. - Export profiling results. Data Integration Service Privileges 47

61 Model Repository Service Privileges The Model Repository Service privileges determine actions that users can perform on projects using Informatica Developer. The Model Repository Service privileges and the Model repository object permissions determine the tasks that users can complete on projects and objects in projects. The following table lists the required permissions and the actions that users can perform with the Model Repository Service privileges: Privilege Permission - Read on project User is able to view projects and objects in projects. - Write on project User is able to create, edit, and delete objects in projects. - Grant on project User is able to grant and revoke permissions on projects for users and groups. Access Developer - User is able to access the Model repository from the Developer tool. Create, Edit, and Delete Projects - User is able to perform the following actions: - Create projects. - Upgrade the Model Repository Service using the Actions menu. Create, Edit, and Delete Projects Write on project User is able to perform the following actions: - Edit projects. - Delete projects if the user created the projects. Show Security Details - User is able to view the names of projects for which users do not have read permission in error and warning message details. Managing Roles A role is a collection of privileges that you can assign to users and groups. You can assign the following types of roles: System-defined. Roles that you cannot edit or delete. Custom. Roles that you can create, edit, and delete. A role includes privileges for the domain or an application service type. You assign roles to users or groups for the domain or for each application service in the domain. When you select a role in the Roles section of the Navigator, you can view all users and groups that have been directly assigned the role for the domain and application services. You can view the role assignments by users and groups or by services. To navigate to a user or group listed in the Assignments section, rightclick the user or group and select Navigate to Item. You can search for system-defined and custom roles. 48 Chapter 7: Privileges and Roles

62 System-Defined Roles A system-defined role is a role that you cannot edit or delete. The Administrator role is a system-defined role. When you assign the Administrator role to a user or group for the domain, Data Integration Service, or Model Repository Service, the user or group is granted all privileges for the service. The Administrator role bypasses permission checking. Users with the Administrator role can access all objects managed by the service. Administrator Role When you assign the Administrator role to a user or group for the domain or Data Integration Service, the user or group can complete some tasks that are determined by the Administrator role, not by privileges or permissions. You can assign a user or group all privileges for the domain or Data Integration Service and then grant the user or group full permissions on all domain objects. However, this user or group cannot complete the tasks determined by the Administrator role. For example, a user assigned the Administrator role for the domain can configure domain properties in the Administrator tool. A user assigned all domain privileges and permission on the domain cannot configure domain properties. The following table lists the tasks determined by the Administrator role for the domain or Data Integration Service: Service Tasks Domain - Configure domain properties. - Grant permission on the domain - Manage and purge log events. - Receive domain alerts. - View user activity log events. Managing Custom Roles You can create, edit, and delete custom roles. Creating Custom Roles When you create a custom role, you assign privileges to the role for the domain or for an application service type. A role can include privileges for one or more services. 1. In the Administrator tool, click the Security tab. 2. On the Security Actions menu, click Create Role. The Create Role dialog box appears. Managing Roles 49

63 3. Enter the following properties for the role: Property Name Name of the role. The role name is case insensitive and cannot exceed 128 characters. It cannot include a tab, newline character, or the following special characters:, + " \ < > ; / * %? The name can include an ASCII space character except for the first and last character. All other space characters are not allowed. of the role. The description cannot exceed 765 characters or include a tab, newline character, or the following special characters: < > " 4. Click the Privileges tab. 5. Expand the domain or an application service type. 6. Select the privileges to assign to the role for the domain or application service type. 7. Click OK. Editing Properties for Custom Roles When you edit a custom role, you can change the description of the role. You cannot change the name of the role. 1. In the Administrator tool, click the Security tab. 2. In the Roles section of the Navigator, select a role. 3. Click Edit. 4. Change the description of the role and click OK. Editing Privileges Assigned to Custom Roles You can change the privileges assigned to a custom role for the domain and for each application service type. 1. In the Administrator tool, click the Security tab. 2. In the Roles section of the Navigator, select a role. 3. Click the Privileges tab. 4. Click Edit. The Edit Roles and Privileges dialog box appears. 5. Expand the domain or an application service type. 6. To assign privileges to the role, select the privileges for the domain or application service type. 7. To remove privileges from the role, clear the privileges for the domain or application service type. 8. Repeat the steps to change the privileges for each service type. 9. Click OK. Deleting Custom Roles When you delete a custom role, the custom role and all privileges that it included are removed from any user or group assigned the role. 50 Chapter 7: Privileges and Roles

64 To delete a custom role, right-click the role in the Roles section of the Navigator and select Delete Role. Confirm that you want to delete the role. Assigning Privileges and Roles to Users and Groups You determine the actions that users can perform by assigning the following items to users and groups: Privileges. A privilege determines the actions that users can perform in application clients. Roles. A role is a collection of privileges. When you assign a role to a user or group, you assign the collection of privileges belonging to the role. Use the following rules and guidelines when you assign privileges and roles to users and groups: You assign privileges and roles to users and groups for the domain and for each application service that is running in the domain. You can assign different privileges and roles to a user or group for each application service of the same service type. A role can include privileges for the domain and multiple application service types. When you assign the role to a user or group for one application service, privileges for that application service type are assigned to the user or group. If you change the privileges or roles assigned to a user, the changed privileges or roles take affect the next time the user logs in. Note: You cannot edit the privileges or roles assigned to the default Administrator user account. Inherited Privileges A user or group can inherit privileges from the following objects: Group. When you assign privileges to a group, all subgroups and users belonging to the group inherit the privileges. Role. When you assign a role to a user, the user inherits the privileges belonging to the role. When you assign a role to a group, the group and all subgroups and users belonging to the group inherit the privileges belonging to the role. The subgroups and users do not inherit the role. You cannot revoke privileges inherited from a group or role. You can assign additional privileges to a user or group that are not inherited from a group or role. The Privileges tab for a user or group displays all the roles and privileges assigned to the user or group for the domain and for each application service. Expand the domain or application service to view the roles and privileges assigned for the domain or service. Click the following items to display additional information about the assigned roles and privileges: Name of an assigned role. Displays the role details on the details panel. Information icon for an assigned role. Highlights all privileges inherited with that role. Privileges that are inherited from a role or group display an inheritance icon. The tooltip for an inherited privilege displays which role or group the user inherited the privilege from. Assigning Privileges and Roles to Users and Groups 51

65 Steps to Assign Privileges and Roles to Users and Groups You can assign privileges and roles to users and groups in the following ways: Navigate to a user or group and edit the privilege and role assignments. Drag roles to a user or group. Assigning Privileges and Roles to a User or Group by Navigation 1. In the Administrator tool, click the Security tab. 2. In the Navigator, select a user or group. 3. Click the Privileges tab. 4. Click Edit. The Edit Roles and Privileges dialog box appears. 5. To assign roles, expand the domain or an application service on the Roles tab. 6. To grant roles, select the roles to assign to the user or group for the domain or application service. You can select any role that includes privileges for the selected domain or application service type. 7. To revoke roles, clear the roles assigned to the user or group. 8. Repeat steps 5 through 7 to assign roles for another service. 9. To assign privileges, click the Privileges tab. 10. Expand the domain or an application service. 11. To grant privileges, select the privileges to assign to the user or group for the domain or application service. 12. To revoke privileges, clear the privileges assigned to the user or group. You cannot revoke privileges inherited from a role or group. 13. Repeat steps 10 through 12 to assign privileges for another service. 14. Click OK. Assigning Roles to a User or Group by Dragging 1. In the Administrator tool, click the Security tab. 2. In the Roles section of the Navigator, select the folder containing the roles you want to assign. 3. In the details panel, select the role you want to assign. You can use the Ctrl or Shift keys to select multiple roles. 4. Drag the selected roles to a user or group in the Users or Groups sections of the Navigator. The Assign Roles dialog box appears. 5. Select the domain or application services to which you want to assign the role. 6. Click OK. 52 Chapter 7: Privileges and Roles

66 Viewing Users with Privileges for a Service You can view all users that have privileges for the domain or an application service. 1. In the Administrator tool, click the Security tab. 2. On the Security Actions menu, click Service User Privileges. The Services dialog box appears. 3. Select the domain or an application service. The details panel displays all users that have privileges for the domain or application service. 4. Right-click a user name and click Navigate to Item to navigate to the user. Viewing Users with Privileges for a Service 53

67 C H A P T E R 8 Permissions This chapter includes the following topics: Permissions Overview, 54 Domain Object Permissions, 55 Connection Permissions, 58 Permissions Overview You manage user security with privileges and permissions. Permissions define the level of access that users and groups have to an object. Even if a user has the privilege to perform certain actions, the user may also require permission to perform the action on a particular object. You use different tools to configure permissions on the following objects: Object Type Tool Connection objects Administrator tool Developer tool You can assign permissions on connections defined in the Administrator tool or Developer tool. These tools share the connection permissions. Domain objects Administrator tool You can assign permissions on the following domain objects: domain, folders, node, and application services. Model repository projects Developer tool You can assign permissions on projects defined in the Developer tool. Types of Permissions Users and groups can have the following types of permissions in a domain: 54

68 Direct permissions Permissions that are assigned directly to a user or group. When users and groups have permission on an object, they can perform administrative tasks on that object if they also have the appropriate privilege. You can edit direct permissions. Inherited permissions Permissions that users inherit. When users have permission on a domain, they inherit permission on all objects in the domain. When groups have permission on a domain object, all subgroups and users belonging to the group inherit permission on the domain object. You cannot revoke inherited permissions. You also cannot revoke permissions from users or groups assigned the Administrator role. The Administrator role bypasses permission checking. Users with the Administrator role can access all objects. You can deny inherited permissions on some object types. When you deny permissions, you configure exceptions to the permissions that users and groups might already have. Effective permissions Superset of all permissions for a user or group. Includes direct permissions and inherited permissions. When you view permission details, you can view the origin of effective permissions. Permission details display direct permissions assigned to the user or group, direct permissions assigned to parent groups, and permissions inherited from parent objects. In addition, permission details display whether the user or group is assigned the Administrator role which bypasses permission checking. Permission Search Filters When you assign permissions, view permission details, or edit permissions for a user or group, you can use search filters to search for a user or group. When you manage permissions for a user or group, you can use the following search filters: Security domain Select the security domain to search for users or groups. Pattern string Enter a string to search for users or groups. The Administrator tool returns all names that contain the search string. The string is not case sensitive. For example, the string "DA" can return "iasdaemon," "daphne," and "DA_AdminGroup." You can also sort the list of users or groups. Right-click a column name to sort the column in ascending or descending order. Domain Object Permissions You configure privileges and permissions to manage user security within the domain. Permissions define the level of access a user has to a domain object. To log in to the Administrator tool, a user must have permission on at least one domain object. If a user has permission on an object, but does not have the domain privilege that grants the ability to modify the object type, then the user can only view the object. Domain Object Permissions 55

69 You can configure permissions on the following types of domain objects: Domain Object Type Domain Node Application Service License of Permission Enables Administrator tool users to access all objects in the domain. When users have permission on a domain, they inherit permission on all objects in the domain. Enables Administrator tool users to view and edit the node properties. Enables Administrator tool users to view and edit the application service properties. Enables Administrator tool users to view and edit the license properties. You can use the following methods to manage domain object permissions: Manage permissions by domain object. Use the Permissions view of a domain object to assign and edit permissions on the object for multiple users or groups. Manage permissions by user or group. Use the Manage Permissions dialog box to assign and edit permissions on domain objects for a specific user or group. Permissions by Domain Object Use the Permissions view of a domain object to assign, view, and edit permissions on the domain object for multiple users or groups. Assigning Permissions on a Domain Object When you assign permissions on a domain object, you grant users and groups access to the object. 1. On the Domain tab, select the Services and Nodes view. 2. In the Navigator, select the domain object. 3. In the contents panel, select the Permissions view. 4. Click the Groups or Users tab. 5. Click Actions > Assign Permission. The Assign Permissions dialog box displays all users or groups that do not have permission on the object. 6. Enter the filter conditions to search for users and groups, and click the Filter button. 7. Select a user or group, and click Next. 8. Select Allow, and click Finish. Viewing Permission Details on a Domain Object When you view permission details, you can view the origin of effective permissions. 1. On the Domain tab, select the Services and Nodes view. 2. In the Navigator, select the domain object. 56 Chapter 8: Permissions

70 3. In the contents panel, select the Permissions view. 4. Click the Groups or Users tab. 5. Enter the filter conditions to search for users and groups, and click the Filter button. 6. Select a user or group and click Actions > View Permission Details. The Permission Details dialog box appears. The dialog box displays direct permissions assigned to the user or group, direct permissions assigned to parent groups, and permissions inherited from parent objects. In addition, permission details display whether the user or group is assigned the Administrator role which bypasses permission checking. 7. Click Close. 8. Or, click Edit Permissions to edit direct permissions. Editing Permissions on a Domain Object You can edit direct permissions on a domain object for a user or group. You cannot revoke inherited permissions or your own permissions. Note: If you revoke direct permission on an object, the user or group might still inherit permission from a parent group or object. 1. On the Domain tab, select the Services and Nodes view. 2. In the Navigator, select the domain object. 3. In the contents panel, select the Permissions view. 4. Click the Groups or Users tab. 5. Enter the filter conditions to search for users and groups, and click the Filter button. 6. Select a user or group and click Actions > Edit Direct Permissions. The Edit Direct Permissions dialog box appears. 7. To assign permission on the object, select Allow. 8. To revoke permission on the object, select Revoke. You can view whether the permission is directly assigned or inherited by clicking View Permission Details. 9. Click OK. Permissions by User or Group Use the Manage Permissions dialog box to view, assign, and edit domain object permissions for a specific user or group. Viewing Permission Details for a User or Group When you view permission details, you can view the origin of effective permissions. 1. In the header of Infomatica Administrator, click Manage > Permissions. The Manage Permissions dialog box appears. 2. Click the Groups or Users tab. 3. Enter a string to search for users and groups, and click the Filter button. 4. Select a user or group. 5. Select a domain object and click the View Permission Details button. Domain Object Permissions 57

71 The Permission Details dialog box appears. The dialog box displays direct permissions assigned to the user or group, direct permissions assigned to parent groups, and permissions inherited from parent objects. In addition, permission details display whether the user or group is assigned the Administrator role which bypasses permission checking. 6. Click Close. 7. Or, click Edit Permissions to edit direct permissions. Assigning and Editing Permissions for a User or Group When you edit domain object permissions for a user or group, you can assign permissions and edit existing direct permissions. You cannot revoke inherited permissions or your own permissions. Note: If you revoke direct permission on an object, the user or group might still inherit permission from a parent group or object. 1. In the header of Infomatica Administrator, click Manage > Permissions. The Manage Permissions dialog box appears. 2. Click the Groups or Users tab. 3. Enter a string to search for users and groups and click the Filter button. 4. Select a user or group. 5. Select a domain object and click the Edit Direct Permissions button. The Edit Direct Permissions dialog box appears. 6. To assign permission on the object, select Allow. 7. To revoke permission on the object, select Revoke. You can view whether the permission is directly assigned or inherited by clicking View Permission Details. 8. Click OK. 9. Click Close. Connection Permissions Permissions control the level of access that a user or group has on the connection. You can configure permissions on a connection in the Developer tool or Administrator tool. Any connection permission that is assigned to a user or group in one tool also applies in other tools. For example, you grant GroupA permission on ConnectionA in the Developer tool. GroupA has permission on ConnectionA in the Administrator tool also. The following Informatica components use the connection permissions: Administrator tool. Enforces read, write, and execute permissions on connections. Developer tool. Enforces read, write, and execute permissions on connections. Data Integration Service. Enforces execute permissions when a user tries to preview data or run a mapping, or profile. 58 Chapter 8: Permissions

72 Types of Connection Permissions You can assign different permission types to users to perform the following actions: Action View all connection metadata, except passwords, such as connection name, type, description, connection strings, and user names. Edit all connection metadata, including passwords. Delete the connection. Users with Write permission inherit Read permission. Access the physical data in the underlying data source defined by the connection. Users can preview data, run a mapping, run a mapping in a workflow Mapping task, or run a profile that uses the connection. Grant and revoke permissions on connections. Permission Types Read Write Execute Grant Default Connection Permissions The domain administrator has all permissions on all connections. The user that creates a connection has read, write, execute, and grant permission on the connection. By default, all users have permission to perform the following actions on connections: View basic connection metadata, such as connection name, type, and description. Use the connection in mappings in the Developer tool. Assigning Permissions on a Connection When you assign permissions on a connection, you define the level of access a user or group has to the connection. 1. On the Domain tab, select the Connections view. 2. In the Navigator, select the connection. 3. In the contents panel, select the Permissions view. 4. Click the Groups or Users tab. 5. Click Actions > Assign Permission. The Assign Permissions dialog box displays all users or groups that do not have permission on the connection. 6. Enter the filter conditions to search for users and groups, and click the Filter button. 7. Select a user or group, and click Next. 8. Select Allow for each permission type that you want to assign. 9. Click Finish. Connection Permissions 59

73 Viewing Permission Details on a Connection When you view permission details, you can view the origin of effective permissions. 1. On the Domain tab, select the Connections view. 2. In the Navigator, select the connection. 3. In the contents panel, select the Permissions view. 4. Click the Groups or Users tab. 5. Enter the filter conditions to search for users and groups, and click the Filter button. 6. Select a user or group and click Actions > View Permission Details. The View Permission Details dialog box appears. The dialog box displays direct permissions assigned to the user or group and direct permissions assigned to parent groups. In addition, permission details display whether the user or group is assigned the Administrator role which bypasses the permission check. 7. Click Close. 8. Or, click Edit Permissions to edit direct permissions. Editing Permissions on a Connection You can edit direct permissions on a connection for a user or group. You cannot revoke inherited permissions or your own permissions. Note: If you revoke direct permission on an object, the user or group might still inherit permission from a parent group or object. 1. On the Domain tab, select the Connections view. 2. In the Navigator, select the connection. 3. In the contents panel, select the Permissions view. 4. Click the Groups or Users tab. 5. Enter the filter conditions to search for users and groups, and click the Filter button. 6. Select a user or group and click Actions > Edit Direct Permissions. The Edit Direct Permissions dialog box appears. 7. Choose to allow or revoke permissions. Select Allow to assign a permission. Clear Allow to revoke a single permission. Select Revoke to revoke all permissions. You can view whether the permission is directly assigned or inherited by clicking View Permission Details. 8. Click OK. 60 Chapter 8: Permissions

74 C H A P T E R 9 Data Integration Service This chapter includes the following topics: Data Integration Service Overview, 61 Data Integration Service Architecture, 62 Data Integration Service Properties, 64 Data Integration Service Process Properties, 69 Enabling, Disabling, and Recycling the Data Integration Service, 72 Data Object Caching, 72 Pass-through Security, 73 Data Integration Service Overview The Data Integration Service is an application service in the Informatica domain that performs data integration tasks for the Developer tool. It also performs data integration tasks for external clients. The Data Integration Service is an application service in the Informatica domain that performs data integration tasks for the Developer tool. When you preview or run mappings and profiles, the application client sends requests to the Data Integration Service to perform the data integration tasks. When you start a command from the command line or an external client to run mappings, the command sends the request to the Data Integration Service. The Data Integration Service performs the following tasks: Runs mappings and generates mapping previews in the Developer tool. Runs profiles and generates previews for profiles in the Developer tool. Runs scorecards for the profiles in the Developer tool. Runs mappings in a deployed application. Runs workflows in a deployed application. Caches data objects for mappings deployed in an application. When you deploy an application, you must associate it with a Data Integration Service. The Data Integration Service runs the mappings and workflows in the application. The Data Integration Service also writes metadata to the associated Model repository. During deployment, the Data Integration Service works with the Model Repository Service to create a copy of the metadata required to run the objects in the application. Each application requires its own run-time metadata. Data Integration Services do not share run-time metadata even when applications contain the same data objects. 61

75 Data Integration Service Architecture The Data Integration Service performs the data transformation processes for mappings, profiles, and workflows in a Model repository. Each component in the Data Integration Service performs its role to complete the data transformation process. The Data Integration Service includes modules that manage the data transformation process. The Deployment Manager and Data Object Cache Manager manage application deployment and data caching and ensure that the data objects required to complete data transformation are available. Requests to the Data Integration Service can come from the Developer tool. The Developer tool send requests to preview or run mappings and profiles. An external client can send a request to run deployed mappings. When the Deployment Manager deploys an application, the Deployment Manager works with the Model Repository Service to store run-time metadata in the Model repository for the mappings and workflows in the application. If you choose to cache the data for an application, the Deployment Manager caches the data in a relational database. Data Transformation Manager The Data Transformation Manager (DTM) is the component of the Data Integration Service that extracts, transforms, and loads data to complete a data transformation job such as a preview or mapping. When a service module in the Data Integration Service receives a request to run a job, the service module calls the DTM to perform the processes required to complete the request. A service module creates a DTM instance to run the job. You can configure the Data Integration Service to create DTM instances in separate operating system processes or in one operating system process. A DTM instance is a specific, logical representation of the Data Transformation Manager. The service module runs multiple instances of the DTM to complete multiple requests. For example, the Mapping Service Module runs a separate instance of the DTM each time it receives a request from the Developer tool to preview a mapping. When the DTM runs mappings, it uses reader, transformation, and writer threads that run in parallel to extract, transform, and load data. The DTM also creates data caches when it runs mappings to temporarily store data used by the mapping objects. When it processes a large amount of data, the DTM writes the data into cache files. After the Data Integration Service completes the mapping, the DTM releases the data caches and cache files. The DTM consists of the following components: Logical DTM (LDTM) Compiles and optimizes requests. The LDTM filters data at the start of the process to reduce the number of rows to be processed and optimize the job. Execution DTM (EDTM) Runs the job. The job can be any data transformation job, profile, or data preview. The LDTM and EDTM work together to optimally complete the job. Profiling Service Module The Profiling Service Module is the component in the Data Integration Service that manages requests to run profiles. When you run a profile in the Developer tool, the application sends the request to the Data Integration Service. The Profiling Service Module starts a DTM instance to get the profiling rules and run the profile. To create and run profiles, you must associate the Data Integration Service with a profiling warehouse. The Profiling Service Module stores profiling data and metadata in the profiling warehouse. 62 Chapter 9: Data Integration Service

76 Mapping Service Module The Mapping Service Module is the component service in the Data Integration Service that manages requests to preview target data and run mappings. The following table lists the requests that the Mapping Service Module manages from the different client tools: Request Preview target data based on mapping logic. Run a mapping. Run a mapping in a deployed application. Client Tools Developer tool Developer tool Command line When you preview or run a mapping, the client tool sends the request and the mapping to the Data Integration Service. The Mapping Service Module starts a DTM instance, which generates the preview data or runs the mapping. If the preview includes a relational or flat file target, the Mapping Service Module writes the preview data to the target. Note: To preview relational table data using the Developer tool, the database client must be installed on the machine on which the Mapping Service Module runs. You must configure the connection to the database in the Developer tool. Workflow Service Module The Workflow Service Module is the component in the Data Integration Service that manages requests to run workflows. When you start a workflow instance in a deployed application, the Data Integration Service receives the request. The Workflow Service Module runs and manages the workflow instance. The Workflow Service Module runs workflow objects in the order that the objects are connected. The Workflow Service Module evaluates expressions in conditional sequence flows to determine whether to run the next task. If the expression evaluates to true or if the sequence flow does not include a condition, the Workflow Service Module starts and passes input data to the connected task. The task uses the input data to complete a single unit of work. When a Mapping task runs a mapping, it starts a DTM instance to run the mapping. When a task finishes processing a unit of work, the task passes output data back to the Workflow Service Module. The Workflow Service Module uses this data to evaluate expressions in conditional sequence flows or uses this data as input for the remaining tasks in the workflow. Data Object Cache Manager The Data Object Cache Manager is the component in the Data Integration Service that caches data in an application. When you enable data object caching, the Data Object Cache Manager can cache logical data objects. The Data Object Cache Manager initially caches the data when you enable the application. Optimal performance for the cache depends on the speed and performance of the database. By default, the Data Object Cache Manager manages the data object cache in the data object cache database. The Data Object Cache Manager creates the cache tables and refreshes the cache. It creates one table for each cached logical data object in an application. Objects within an application share cache tables, Data Integration Service Architecture 63

77 but objects in different applications do not. If one data object is used in multiple applications, the Data Object Cache Manager creates a separate cache table for each instance of the data object. Deployment Manager The Deployment Manager is the component in Data Integration Service that manages the applications. When you deploy an application to a Data Integration Service, the Deployment Manager manages the interaction between the Data Integration Service and the Model Repository Service. The Deployment Manager starts and stops an application. When it starts an application, the Deployment Manager validates the mappings and workflows in the application and their dependent objects. After validation, the Deployment Manager works with the Model Repository Service associated with the Data Integration Service to store the run-time metadata required to run the mappings and workflows in the application. The Deployment Manager creates a separate set of run-time metadata in the Model repository for each application. When the Data Integration Service runs mappings and workflows in an application, the Deployment Manager retrieves the run-time metadata and makes it available to the DTM. Data Integration Service Logs The Data Integration Service generates operational and error log events that are collected by the Log Manager in the domain. You can view the logs in the log viewer of the Administrator tool. When the DTM runs, it generates log events for the process that it is running. The DTM bypasses the Log Manager and sends the log events to log files. The DTM stores the log files in the directory specified in the properties for the Data Integration Service process. When the Workflow Service Module runs workflows, it generates log events for the workflow. The Workflow Service Module bypasses the Log Manager and sends the log events to log files. The Workflow Service Module stores the log files in a folder named workflow in the directory specified in the properties for the Data Integration Service process. When a Mapping task in a workflow starts a DTM instance to run a mapping, the DTM generates log events for the mapping. The DTM stores the log files in a folder named builtinhandlers in the directory specified in the properties for the Data Integration Service process. Data Integration Service Properties To view the Data Integration Service properties, select the service in the Domain Navigator and click the Properties view. You can change the properties while the service is running, but you must restart the service for the properties to take effect. General Properties The general properties of a Data Integration Service includes name, license, and node assignment. The following table describes general properties of a Data Integration Service: General Property Name Name of the Data Integration Service. Read only. Short description of the Data Integration Service. 64 Chapter 9: Data Integration Service

78 General Property License Assign Node License key that you enter when you create the service. Read only. In PowerCenter Express the Data Integration Service runs on a single node. Name of the node on which the Data Integration Service runs if the service runs on a node. Click the node name to view the node configuration. Model Repository Properties The following table describes the Model repository properties for the Data Integration Service: Property Model Repository Service User Name Password Service that stores run-time metadata required to run mappings. User name to access the Model repository. The user must have the Create Project privilege for the Model Repository Service. User password to access the Model repository. Execution Options The following table describes the execution option for the Data Integration Service: Property Launch Jobs as Separate Processes Runs each Data Integration Service job in a separate operating system process selected from a pool of reusable DTM processes. Enable to increase the stability of the Data Integration Service and to isolate batch jobs. When enabled, an unexpected interruption to one job does not affect all other jobs running on the Data Integration Service. When disabled, all jobs run in one operating system process, the Data Integration Service process. Default is true. Note: If the Data Integration Service runs on UNIX and you enable this option, verify that the host file on the node that runs the Data Integration Service contains a localhost entry. Otherwise, jobs that run in separate operating system processes fail. Data Integration Service Properties 65

79 Server Properties The following table describes the server properties that the Data Integration Service uses to send notifications from a workflow: Property SMTP Server Host Name SMTP Server Port SMTP Server User Name SMTP Server Password SMTP Server Connection Timeout SMTP Server Communication Timeout SMTP Authentication Enabled Use TLS Security Use SSL Security Sender Address The SMTP outbound mail server host name. For example, enter the Microsoft Exchange Server for Microsoft Outlook. Default is localhost. Port number used by the outbound SMTP mail server. Valid values are from 1 to Default is 25. User name for authentication upon sending, if required by the outbound SMTP mail server. Password for authentication upon sending, if required by the outbound SMTP mail server. Maximum number of seconds that the Data Integration Service waits to connect to the SMTP server before it times out. Default is 60. Maximum number of seconds that the Data Integration Service waits to send an before it times out. Default is 60. Indicates that the SMTP server is enabled for authentication. If true, the outbound mail server requires a user name and password. If true, you must select whether the server uses TLS or SSL security. Default is false. Indicates that the SMTP server uses the Transport Layer Security (TLS) protocol. If true, enter the TLS port number for the SMTP server port property. Default is false. Indicates that the SMTP server uses the Secure Sockets Layer (SSL) protocol. If true, enter the SSL port number for the SMTP server port property. Default is false. address that the Data Integration Service uses in the From field when sending notification s from a workflow. Default is admin@example.com. 66 Chapter 9: Data Integration Service

80 Logical Data Object Cache Properties The following table describes the data object cache properties: Property Cache Removal Time Cache Connection The number of milliseconds that the Data Integration Service waits before cleaning up cache storage after a refresh. Default is 3,600,000. The database connection name for the database that stores the data object cache. Select a valid connection object name. Logging Properties The following table describes the log level properties: Property Log Level Level of error messages that the Data Integration Service writes to the Service log. Choose one of the following message levels: - Fatal. Writes FATAL messages to the log. FATAL messages include nonrecoverable system failures that cause the Data Integration Service to shut down or become unavailable. - Error. Writes FATAL and ERROR code messages to the log. ERROR messages include connection failures, failures to save or retrieve metadata, service errors. - Warning. Writes FATAL, WARNING, and ERROR messages to the log. WARNING errors include recoverable system failures or warnings. - Info. Writes FATAL, INFO, WARNING, and ERROR messages to the log. INFO messages include system and service change messages. - Trace. Write FATAL, TRACE, INFO, WARNING, and ERROR code messages to the log. TRACE messages log user request failures such as SQL request failures, mapping run request failures, and deployment failures. - Debug. Write FATAL, DEBUG, TRACE, INFO, WARNING, and ERROR messages to the log. DEBUG messages are user request logs. Deployment Options The following table describes the deployment options for the Data Integration Service: Property Default Deployment Mode Determines whether to enable and start each application after you deploy it to a Data Integration Service. Default Deployment mode affects applications that you deploy from the Developer tool, command line, and Administrator tool. Choose one of the following options: - Enable and Start. Enable the application and start the application. - Enable Only. Enable the application but do not start the application. - Disable. Do not enable the application. Modules By default, all Data Integration Service modules are enabled. You can disable some of the modules. Data Integration Service Properties 67

81 You might want to disable a module if you are testing and you have limited resources on the computer. You can save memory by limiting the Data Integration Service functionality. Before you disable a module, you must disable the Data Integration Service. The following table describes the Data Integration Service modules: Module Mapping Service Module Profiling Service Module Workflow Service Module Runs mappings and previews. Runs profiles. Runs workflows. Mapping Service Properties The following table describes Mapping Service Module properties of a Data Integration Service: Property Maximum Notification Thread Pool Size The maximum number of concurrent job completion notifications that the Mapping Service Module sends to external clients after the Data Integration Service completes jobs. The Mapping Service Module is a component in the Data Integration Service that manages requests sent to run mappings. Default is 5. Profiling Warehouse Database Properties The following table describes the profiling warehouse database properties: Property Profiling Warehouse Database The connection to the profiling warehouse. Maximum Ranks Number of minimum and maximum values to display for a profile. Default is 5. Maximum Patterns Maximum number of patterns to display for a profile. Default is 10. Maximum Profile Execution Pool Size Maximum number of threads to run profiling. Default is 10. Maximum DB Connections Maximum number of database connections for each profiling job. Default is 5. Profile Results Export Path Location where the Data Integration Service exports profile results file. 68 Chapter 9: Data Integration Service

82 Advanced Profiling Properties The following table describes the advanced profiling properties: Property Pattern Threshold Percentage Maximum # Value Frequency Pairs Maximum number of values required to derive a pattern. Default is 5. Maximum number of value-frequency pairs to store in the profiling warehouse. Default is 16,000. Maximum String Length Maximum length of a string that the Profiling Service can process. Default is 255. Maximum Numeric Precision Maximum Concurrent Profile Jobs Maximum Concurrent Columns Maximum Concurrent Profile Threads Maximum Column Heap Size Reserved Profile Threads Maximum number of digits for a numeric value. Default is 38. The maximum number of concurrent profile threads used for profiling flat files. If left blank, the Profiling Service plug-in determines the best number based on the set of running jobs and other environment factors. Maximum number of columns that you can combine for profiling flat files in a single execution pool thread. Default is 5. The maximum number of concurrent execution pool threads that can profile flat files. Default is 1. Amount of memory to allow each column for column profiling. Default is 64 megabytes. Number of threads of the Maximum Execution Pool Size that are for priority requests. Default is 1. Custom Properties for the Data Integration Service Configure custom properties that are unique to specific environments. You might need to apply custom properties in special cases. When you define a custom property, enter the property name and an initial value. Define custom properties only at the request of Informatica Global Customer Support. Data Integration Service Process Properties View the Data Integration Service process nodes on the Processes tab. You can edit service process properties such as the HTTP port, logs directory, custom properties, and environment variables. You can also set properties for the Address Manager. If you update any of the process properties, restart the Data Integration Service process for the modifications to take effect. Data Integration Service Process Properties 69

83 Data Integration Service Security Properties When you set the HTTP protocol type for the Data Integration Service to HTTPS or both, you enable the Transport Layer Security (TLS) protocol for the service. Depending on the HTTP protocol type of the service, you define the HTTP port, the HTTPS port, or both ports for the service process. The following table describes the Data Integration Service Security properties: Property HTTP Port HTTPS Port Unique HTTP port number for the Data Integration Service process when the service uses the HTTP protocol. Default is Unique HTTPS port number for the Data Integration Service process when the service uses the HTTPS protocol. When you set an HTTPS port number, you must also define the keystore file that contains the required keys and certificates. Advanced Properties The following table describes the Advanced properties: Property Maximum Heap Size JVM Command Line Options Amount of RAM allocated to the Java Virtual Machine (JVM) that runs the Data Integration Service. Use this property to increase the performance. Append one of the following letters to the value to specify the units: - b for bytes. - k for kilobytes. - m for megabytes. - g for gigabytes. Default is 512 megabytes. Java Virtual Machine (JVM) command line options to run Java-based programs. When you configure the JVM options, you must set the Java SDK classpath, Java SDK minimum memory, and Java SDK maximum memory properties. Logging Options The following table describes the logging options for the Data Integration Service process: Property Logging Directory Directory for Data Integration Service node process logs. Default is <InformaticaInstallationDir>\tomcat\bin\disLogs. 70 Chapter 9: Data Integration Service

84 Execution Options The following table describes the execution options for the Data Integration Service process: Property Maximum Execution Pool Size Temporary Directories The maximum number of requests that the Data Integration Service can run concurrently. Default is 10. Location of temporary directories for Data Integration Service process on the node. Default is <home directory>/distemp. Add a second path to this value to provide a dedicated directory for temporary files created in profile operations. Use a semicolon to separate the paths. Do not use a space after the semicolon. You cannot use the following characters in the directory path: *? < > ", [ ] Home Directory Root directory accessible by the node. This is the root directory for other service process variables. Default is <Informatica Services Installation Directory>/tomcat/bin. You cannot use the following characters in the directory path: *? < > ", [ ] Cache Directory Directory for index and data cache files for transformations. Default is <home directory>/cache. You can increase performance when the cache directory is a drive local to the Data Integration Service process. Do not use a mapped or mounted drive for cache files. You cannot use the following characters in the directory path: *? < > ", [ ] Source Directory Directory for source flat files used in a mapping. Default is <home directory>/source. You cannot use the following characters in the directory path: *? < > ", [ ] Target Directory Default directory for target flat files used in a mapping. Default is <home directory>/target. You cannot use the following characters in the directory path: *? < > ", [ ] Rejected Files Directory Directory for reject files. Reject files contain rows that were rejected when running a mapping. Default is <home directory>/reject. You cannot use the following characters in the directory path: *? < > ", [ ] Custom Properties for the Data Integration Service Process Configure custom properties that are unique to specific environments. Data Integration Service Process Properties 71

85 You might need to apply custom properties in special cases. When you define a custom property, enter the property name and an initial value. Define custom properties only at the request of Informatica Global Customer Support. Environment Variables You can configure environment variables for the Data Integration Service process. The following table describes the environment variables: Property Environment Variable Enter a name and a value for the environment variable. Enabling, Disabling, and Recycling the Data Integration Service You can enable, disable, or recycle the Data Integration Service from the Administrator tool. You might disable a Data Integration Service if you need to perform maintenance or you need to temporarily restrict users from using the service. You might recycle a service if you modified a property. When you disable a Data Integration Service, you must choose the mode to disable it in. You can choose one of the following options: Complete. Allows the jobs to run to completion before disabling the service. Abort. Tries to stop all jobs before aborting them and disabling the service. When you recycle the service, the Data Integration Service restarts the service. When the Administrator tool restarts the Data Integration Service, it also restores the state of each application associated with the Data Integration Service. To enable the service, select the service in the Domain Navigator and click Enable the Service. The Model Repository Service must be running before you enable the Data Integration Service. To disable the service, select the service in the Domain Navigator and click Disable the Service. To recycle the service, select the service in the Domain Navigator and click Recycle. You must recycle the Data Integration Service whenever you change a property for a Data Integration Service process. Note: When you enable or disable a service with Microsoft Internet Explorer, the progress bar does not animate unless you enable an advanced option in the browser. Enable Play Animations in Web Pages in the Internet Options Advanced tab. Data Object Caching Data object caching enables the Data Integration Service to access pre-built logical data objects. Enable data object caching to increase performance for mappings. 72 Chapter 9: Data Integration Service

86 By default, the Data Integration Service extracts source data and builds required data objects when it runs a mapping. When you enable data object caching, the Data Integration Service can use cached logical data objects. Complete the following steps to enable data object caching for logical data objects in an application: 1. Configure the cache database connection in the logical data object cache properties for the Data Integration Service. Note: All applications that are deployed to a Data Integration Service use the same connection. 2. Enable caching in the properties of logical data objects in the application. 3. To generate indexes on cache tables based on a column, enable the create index property in the column properties of the logical data object in the application. By default, the Data Object Cache Manager of the Data Integration Service manages the cache for logical data objects. Pass-through Security Pass-through security is the capability to connect to an SQL data service or an external source with the client user credentials instead of the credentials from a connection object. Users might have access to different sets of data based on the job in the organization. Client systems restrict access to databases by the user name and the password. When you create an SQL data service, you might combine data from different systems to create one view of the data. However, when you define the connection to the SQL data service, the connection has one user name and password. If you configure pass-through security, you can restrict users from some of the data in an SQL data service based on their user name. When a user connects to the SQL data service, the Data Integration Service ignores the user name and the password in the connection object. The user connects with the client user name or the LDAP user name. A web service operation mapping might need to use a connection object to access data. If you configure pass-through security and the web service uses WS-Security, the web service operation mapping connects to a source using the user name and password provided in the web service SOAP request. Configure pass-through security for a connection in the connection properties of the Administrator tool or with infacmd dis UpdateServiceOptions. You can set pass-through security for connections to deployed applications. You cannot set pass-through security in the Developer tool. Only SQL data services and web services recognize the pass-through security configuration. For more information about configuring security for SQL data services, see the Informatica How-To Library article "How to Configure Security for SQL Data Services": Example An organization combines employee data from multiple databases to present a single view of employee data in an SQL data service. The SQL data service contains data from the Employee and Compensation databases. The Employee database contains name, address, and department information. The Compensation database contains salary and stock option information. A user might have access to the Employee database but not the Compensation database. When the user runs a query against the SQL data service, the Data Integration Service replaces the credentials in each database connection with the user name and the user password. The query fails if the user includes salary information from the Compensation database. Pass-through Security 73

87 Pass-Through Security with Data Object Caching To use data object caching with pass-through security, you must enable caching in the pass-through security properties for the Data Integration Service. When you deploy an SQL data service or a web service, you can choose to cache the logical data objects in a database. You must specify the database in which to store the data object cache. The Data Integration Service validates the user credentials for access to the cache database. If a user can connect to the cache database, the user has access to all tables in the cache. The Data Integration Service does not validate user credentials against the source databases when caching is enabled. For example, you configure caching for the EmployeeSQLDS SQL data service and enable pass-through security for connections. The Data Integration Service caches tables from the Compensation and the Employee databases. A user might not have access to the Compensation database. However, if the user has access to the cache database, the user can select compensation data in an SQL query. When you configure pass-through security, the default is to disallow data object caching for data objects that depend on pass-through connections. When you enable data object caching with pass-through security, verify that you do not allow unauthorized users access to some of the data in the cache. When you enable caching for pass-through security connections, you enable data object caching for all pass-through security connections. Adding Pass-Through Security Enable pass-through security for a connection in the connection properties. Enable data object caching for pass-through security connections in the pass-through security properties of the Data Integration Service. 1. Select a connection. 2. Click the Properties view. 3. Edit the connection properties. The Edit Connection Properties dialog box appears. 4. To choose pass-through security for the connection, select the Pass-through Security Enabled option. 5. Optionally, select the Data Integration Service for which you want to enable object caching for passthrough security. 6. Click the Properties view. 7. Edit the pass-through security options. The Edit Pass-through Security Properties dialog box appears. 8. Select Allow Caching to allow data object caching for the SQL data service or web service. This applies to all connections. 9. Click OK. You must recycle the Data Integration Service to enable caching for the connections. 74 Chapter 9: Data Integration Service

88 C H A P T E R 1 0 Data Integration Service Processing This chapter includes the following topics: Data Integration Service Processing Overview, 75 Run Jobs in Separate Processes, 75 Maintain Connection Pools, 77 Data Integration Service Processing Overview You can configure how the Data Integration Service processes data integration jobs. When you configure Data Integration Service processing, you can optimize service performance. You can configure the Data Integration Service to run jobs in separate operating system processes or in one operating system process. Running jobs in separate processes optimizes stability because an unexpected interruption to one job does not affect all other jobs. You can configure whether the Data Integration Service maintains connection pools for database connections when the service processes jobs. When you configure connection pooling for the database connections, the Data Integration Service maintains and reuses a pool of database connections. Reusing connections optimizes performance because it minimizes the amount of time and resources used to open and close multiple database connections. Run Jobs in Separate Processes When the Data Integration Service runs jobs in separate operating system processes, stability increases because an unexpected interruption to one job does not affect all other jobs. The Launch Jobs as Separate Processes property for the Data Integration Service determines whether the service runs jobs in separate operating system processes or in one operating system process. An operating system process is an instance that is running in an operating system. By default, the property is enabled, and the Data Integration Service runs jobs in separate operating system processes. When you disable the Launch Jobs as Separate Processes property, the Data Integration Service runs all jobs in one operating system process, the Data Integration Service process. 75

89 You might choose to disable the property and run jobs in one operating system process if you have configured connection pooling and want to maintain fewer idle connection instances. When you run jobs in one operating system process, the Data Integration Service process maintains one connection pool library. When you run jobs in separate operating system processes, each operating system process maintains its own connection pool library. Host File Configuration on UNIX When the Data Integration Service runs jobs in separate operating system processes, the jobs connect to the Data Integration Service process using the host name localhost. When the Data Integration Service runs on UNIX, the host file on the node that runs the Data Integration Service must contain a localhost entry. If the host file does not contain a localhost entry, jobs that run in separate operating system processes fail. Windows does not require a localhost entry in the host file. DTM Process Pool Management When the Data Integration Service runs jobs in separate operating system processes, the Data Integration Service maintains a pool of reusable DTM processes. When the Data Integration Service receives a request to run a job, the service creates a DTM instance to run the job. A DTM instance is a specific, logical representation of the Data Transformation Manager. When you run DTM instances in separate operating system processes, the Data Integration Service maintains a pool of reusable DTM processes. A DTM process is the operating system process that the Data Integration Service creates to run DTM instances. The DTM process pool includes DTM processes that are running jobs and DTM processes that are idle. Each running DTM process in the pool is reserved for use by one of the following groups of related jobs: Jobs from the same deployed application Preview jobs Profiling jobs Mapping jobs run from the Developer tool For example, if you run two jobs from the same deployed application, the Data Integration Service creates two DTM instances in the same DTM process. If you run a preview job, the Data Integration Service creates the DTM instance in a different DTM process. When the Data Integration Service runs a job in a separate operating system process, it requests a DTM process from the pool. If a DTM process that runs related jobs exists or if an idle DTM process exists, the Data Integration Service uses the existing DTM process. If the DTM process pool does not have an existing DTM process for the job, the Data Integration Service creates another DTM process. When a DTM process finishes running a job, the process closes the DTM instance. When the DTM process finishes running all jobs, the Data Integration Service releases the DTM process to the pool as an idle DTM process. An idle DTM process is available to run any type of job. Example of the DTM Process Pool The DTM process pool includes DTM processes that are running jobs and DTM processes that are idle. 76 Chapter 10: Data Integration Service Processing

90 The following figure shows an example DTM process pool: The preceding figure contains the following DTM processes in the pool: DTMProcess1 is a running process reserved for jobs from deployed application application1. The DTM process is running three DTM instances. DTMProcess2 is a running process reserved for preview jobs. The DTM process is running two DTM instances. DTMProcess3 is an idle process and is available to run any type of job. Maintain Connection Pools Connection pooling is a framework to cache database connection information that is used by the Data Integration Service. Connection pools increase performance through the reuse of cached connection information. A connection pool is a group of connection instances for one connection object. A connection instance is a representation of a physical connection to a data source. A connection pool library can contain multiple connection pools. The number of connection pools depends on the number of unique connections that the DTM instances use while running jobs. By default, the Data Integration Service runs each job in a separate operating system process selected from a pool of reusable DTM processes. Each DTM process maintains its own connection pool library that all DTM instances running in the process can use. The number of connection pool libraries depends on the number of running DTM processes. If you configure the Data Integration Service to run each job in one operating system process, the Data Integration Service process maintains one connection pool library that all DTM instances use. A connection instance can be active or idle. An active connection instance is a connection instance that a DTM instance is using to connect to a database. A DTM process or the Data Integration Service process can create an unlimited number of active connection instances. An idle connection instance is a connection instance in a connection pool that is not in use. A connection pool retains idle connection instances based on the pooling properties that you configure for a database Maintain Connection Pools 77