Configuring Secure Communication to Oracle to Import Source and Target Definitions in PowerCenter

Transcription

1 Configuring Secure Communication to Oracle to Import Source and Target Definitions in PowerCenter 2014 Informatica Corporation. No part of this document may be reproduced or transmitted in any form, by any means (electronic, photocopying, recording or otherwise) without prior consent of Informatica Corporation. All other company and product names may be trade names or trademarks of their respective owners and/or copyrighted materials of such owners.

2 Abstract You can enable secure communication with SSL encryption from PowerCenter to third-party databases, such as Oracle. This article describes how you can configure secure communication to Oracle with an ODBC connection to import Oracle source and target definitions in PowerCenter. Supported Versions PowerCenter Table of Contents Overview Prerequisites Creating a Trust Store File for the Oracle Server Instance Creating a Key Store File for the Oracle Server Instance Configuring the ODBC Data Source to Access the Oracle Database... 4 Importing Oracle Sources Importing Oracle Targets Overview You can enable secure communication from PowerCenter to third-party databases, such as Oracle. When you read or write data to a third-party database, you can secure the communication with SSL encryption provided by the third-party database. In PowerCenter, you can configure secure communication to Oracle when you import Oracle source and target definitions. Informatica connects to an Oracle database through ODBC connection to import the source and target definitions. You must ensure that you create the ODBC data source on the machine where you install Designer. You must create a 32- bit ODBC DSN even on 64-bit machines because the Designer is 32-bit. You can use the OpenSSL program to create the key store for the Oracle server and to use the key store in the ODBC DSN. Open SSL is an open-source implementation of the SSL and TLS protocols. To configure secure communication to Oracle on the machine where you install the Informatica clients, perform the following tasks: 1. Create a trust store for the Oracle server instance. 2. Create a key store for the Oracle server instance. 3. Configure the ODBC data source to access the Oracle database. 4. Import Oracle data sources and targets in the Designer with the data source created. 2

3 Prerequisites 1. Install OpenSSL on the machine where you install the Informatica clients. You can download OpenSSL from the following website: You might have to install 32-bit or 64-bit OpenSSL program based on the size, in bits, of the machine where you install the Informatica clients. 2. To verify that you have installed the openssl program successfully, start OpenSSL and enter the following command at the command prompt: OpenSSL > version OpenSSL displays the version number. Creating a Trust Store File for the Oracle Server Instance 1. Ask your database administrator to provide you with the Oracle server SSL certificate. For example, your database administrator can provide you with a certificate file, server_ca.cert. 2. At the command prompt, enter the command to start OpenSSL. 3. At the OpenSSL prompt, enter the following command to generate the trust store file (*.pfx) from the server SSL certificate: pkcs12 - in <fullpath_to_your_server_ssl_certificate> -export - out <full_path_to_truststore_filename.pfx> -nokeys For example, enter the following command: pkcs12 -in C:\temp\server_ca.cert -export -out C:\temp1\TrustStore_ORASSL.pfx -nokeys. The command creates the PKCS#12 file by reading the certificates in the input path. The command specifies the output file name to write the PKCS#12 file without writing any private keys in the output file. Creating a Key Store File for the Oracle Server Instance 1. Create a private key and generate a certificate request with the following command: genrsa -des3 -out <full_path_to_keyname> <private_key_length> For example, enter the following command: genrsa -des3 -out C:\temp2\ORASSL_client.key 1024 The genrsa command at the OpenSSL prompt generates an RSA private key with the des3 encryption. You can write the key to an output file when you also enter the bit length of the private key. You can use 2048 for larger keys, but the strength of the key must match the type of service provided by the certificate authority. 2. To activate the process for the certificate request, enter the req command in the following format: req -new -key <full_path_to_keyname> -out <full_path_to_certificate_request_filename> For example, enter the following command: req -new -key C:\temp2\ORASSL_client.key -out C:\temp2\ORASSL_client.csr 3. Create a copy of the key, and rename the duplicate key as <key>.orig in the same key path location. For example, copy ORASSL_client.key and rename the duplicate key as follows: ORASSL_client.key.orig 4. Encrypt the key with the rsa command as follows: rsa - in <full_path_to_key>.orig -out <key> 3

4 For example, enter the following command: rsa -in C:\temp2\ORASSL_client.key.orig -out ORASSL_client.key 5. Generate a self-signed key from the private key. Use the x509 utility to sign certificates and requests with the following command: X509 -req -days <number_of_days> -in <certificate_request_or_certificate_filename> -signkey <keyname> -out <certificate_filename> For example, enter the command: Openssl> x509 -req -days 365 -in ORASSL_client.csr -signkey ORASSL_client.key.csr -out ORASSL_ODBC.crt If the input file is a certificate, it sets the issuer name to the subject name by making it self-signed. It also changes the public key to the supplied value and changes the start and end dates. The start date is set to the current time, and the end date is set to a value determined by the -days option. If the input file is a certificate request, then a self-signed certificate is created with the supplied private key that uses the subject name in the request. 6. Copy the client certificate to a new certificate with a.cert extension. For example, copy ORASSL_ODBC.crt and name the new certificate as follows: ORASSL_ODBC.cert 7. Send the new client certificate (*.cert) to the database administrator, and ask the administrator to import it into the server wallet as a trusted certificate. 8. Generate a key store file from the keys created with the following command: Openssl> pkcs12 -export -out keystore_orassl_client.pfx -inkey ORASSL_client.key -in ORASSL_ODBC.crt The command generates a key store file. For example, the command creates a key store file, keystore_ ORASSL_client.pfx. Configuring the ODBC Data Source to Access the Oracle Database 1. To start the ODBC Data Source Administrator wizard, perform one of the following actions: On a Windows 32-bit system, double-click Administrative Tools in Control Panel. In the Administrative Tools window, double-click Data Sources (ODBC). Alternatively, enter the following command at the command prompt: Odbcad32.exe On a Windows 64-bit system, enter the following command at the command prompt: %windir%\syswow64\odbcad32.exe The ODBC Data Source Administrator wizard appears. 2. On the System DSN tab, click Add. 3. In the Create a New Data Source dialog box, select the DataDirect ODBC Oracle driver from the list of available drivers and click Finish. 4. On the General tab of the DSN configuration dialog box, enter the data source name, host name, port number, and service name. 4

5 5. On the Security tab, configure the following encryption properties: Encryption Method Check with your database administrator about the value of SSL_VERSION in the database. For example, select 3-SSL3 if the SSL_VERSION in the database configuration is 3.0. Validate Server Certificate Enable this option. Trust Store Enter the location for the.pfx file generated. Trust Store Password Key Store Specify the password if you had set it when generating the.pfx file. Enter the location for the.pfx file generated. Key Store Password Specify the password if you had set it when generating the.pfx file. Key Password Specifying the key password is optional. Host Name in Certificate You must get the host name in certificate information from the database administrator. Enter the name of the database server specified in the server SSL certificate. 5

6 Importing Oracle Sources 1. Click Source > Import from Database in the Source Analyzer and select the Oracle data source name that you created. 2. Connect to the Oracle database and import the tables. Importing Oracle Targets 1. Click Targets > Import from Database in the Target Designer and select the Oracle data source name that you created. 2. Connect to the Oracle database and import the tables. 6

7 Authors Anju Andrews Lead QA Engineer Sujitha Alexander Technical Writer 7