Download presentation
Presentation is loading. Please wait.
Published byLeona Hopkins Modified over 9 years ago
1
Copyright 2007, Information Builders. Slide 1 WebFOCUS Authentication Mark Nesson, Vashti Ragoonath Information Builders Summit 2008 User Conference June 2008
2
Copyright 2007, Information Builders. Slide 2 WebFOCUS Authentication Agenda We are going to learn more about WebFOCUS Authentication: General Overview – What is Authentication? Where are the WebFOCUS authentication checkpoints? Web Tier Reporting Server What are the Authentication options? Configuring Authentication options at security checkpoints What are some of the considerations in architecting a secured WebFOCUS environment? A look at some common customer scenarios Conclusion
3
Copyright 2007, Information Builders. Slide 3 WebFOCUS Authentication General Overview – What is Authentication? Authentication Process of confirming a user’s identity and whether he/she is allowed to access the service or application Involves identity retrieval process Via Prompt (Browser Prompt, HTML Forms, etc) Or via Secured Token (NTLM, Kerberos Token, Cookie, etc) Involves identity validation User Id and Password Validation Token Validation (NTLM Processing, SPNEGO, etc) Cookie Validation (SiteMinder Single Sign-On/SSO Cookie, Managed Reporting Cookie, etc)
4
Copyright 2007, Information Builders. Slide 4 WebFOCUS Authentication Authentication Checkpoints
5
Copyright 2007, Information Builders. Slide 5 WebFOCUS Authentication Security Options Internal Authentication Credentials are validated and stored internally in a proprietary repository. External Authentication Active Directory LDAP RDBMS Reporting Server Custom (Such as custom API, Web Services, etc) Trusted Authentication Credentials are not validated User ID is provided securely by external service (Web Server, Operating System, etc). External service (e.g SiteMinder) will pass to WebFOCUS either REMOTE_USER or an HTTP Header with the authenticated user id.
6
Copyright 2007, Information Builders. Slide 6 WebFOCUS Authentication Security Options – Trusted Authentication “Authentication” process occurs at the Web Server level. Common Web Server Authentication Scheme Anonymous Authentication (No authentication) Basic Web Authentication Integrated Windows Authentication (IWA/NTLM) Kerberos 3 rd Party Single Sign-On Applications Example: SiteMinder, Oblix, RSA ClearTrust Common Characteristics Use of Encrypted Cookie to maintain Single Sign- On session management Ability to pass authentication header (REMOTE_USER) or custom headers/cookie.
7
Copyright 2007, Information Builders. Slide 7 WebFOCUS Authentication Security Options – External Why would we want “External” Security? To provide better control To centralize identity management in a common system To provide better auditing/reporting capabilities Why would we want “Trusted” Security? To avoid repeated credentials prompting Single Sign-On
8
Copyright 2007, Information Builders. Slide 8 WebFOCUS Authentication Apply security options at WebFOCUS checkpoints SecurityCheckpoints Web Tier Managed Reporting/Dashboard WebFOCUS Client Administration Console ReportCaster Self-Service Applications Reporting Server
9
Copyright 2007, Information Builders. Slide 9 WebFOCUS Authentication Web Tier checkpoints In the context of Internal, Trusted and External Authentication: Managed Reporting/Dashboard Internal (User credentials verified against proprietary repository) External (User authenticated by LDAP, AD, WFRS,etc) Trusted ( User authenticated by Web Server) WebFOCUS Client Administration Console None (Console is unprotected) External (Reporting Server) Trusted ( User authenticated by Web Server) ReportCaster Internal ( User id and password stored in ReportCaster repository) External (User authenticated by Managed Reporting) Trusted ( User authenticated by Web Server) Self-Service Applications Trusted ( User authenticated by Web Server) External (Reporting Server)
10
Copyright 2007, Information Builders. Slide 10 WebFOCUS Authentication Reporting Server Checkpoint Authentication Options on the Reporting Server: PTH Internal, file-based authentication for HTTP connections TCP connections are not authenticated OPSYSTCP/HTTP Connections are authenticated by the Operating system DBMSTCP/HTTP Connections are authenticated by the Database Server LDAPTCP/HTTP Connections are authenticated by LDAP Server or Active Directory. New Trust Extension Setting, trust_ext=y Supported on all server platforms, including Windows Does not support impersonation Server secured with LDAP requires user be found Not supported with Server security DBMS
11
Copyright 2007, Information Builders. Slide 11 WebFOCUS Authentication Configuring WebFOCUS security options Let’s go through the steps on how to configure these security checkpoints. Then we will move on to applying the security options to some common customer scenarios. Managed Reporting/Dashboard Login to WebFOCUS Client Administration Console From Configuration/MR Security Settings General From here can set MR Authentication to Internal, External or Trusted
12
Copyright 2007, Information Builders. Slide 12 WebFOCUS Authentication Configuring WebFOCUS security options WebFOCUS Client Administration Console Login to WebFOCUS Client Administration Console From Configuration/Startup Parameters Modify IBIWFC_AUTHENTICATION Options Include No authentication Trusted (Web/REMOTE_USER and WEBHDR/HTTP Header) Reporting Server (EDA and EDA:edanode)
13
Copyright 2007, Information Builders. Slide 13 WebFOCUS Authentication Configuring WebFOCUS security options ReportCaster Open ReportCaster Configuration File General Tab/Security Authentication Plug-In set to: “None” means “use Id/Pwd from BOTUPROF” “Trusted MR Sign-on” means connect with owner Id only Caster Remote Authenticated is optional SSO setting No means sign-on with Id/Pwd Yes means use Id in REMOTE_USER HTTP Header allows you to specify header for SSO
14
Copyright 2007, Information Builders. Slide 14 WebFOCUS Authentication Configuring WebFOCUS security options Reporting Server Web Console/Workspace/Access Control Security Mode drop-down list OPSYS OFF PTH DBMS LDAP Now let’s see how we can out these options together to architect WebFOCUS secured environments.
15
Copyright 2007, Information Builders. Slide 15 WebFOCUS Authentication Configuring WebFOCUS security options Reporting Server When do we use the different Reporting Server options? ON/LDAP/RDBMS Preferred due to added security level by requiring an authentication prior to connection to the service LDAP and RDBMS offer more flexibility in terms of the authentication providers PTH/OFF/Explicit Connection ID Useful when connection can be “trusted” into the Reporting Server tier due an “authentication” occurring up-front at the web or application tier (such as MR SIGNON) Console is still protected under PTH mode Password is not available beyond the Web Tier Customer does not want to maintain OS level accounts for every user
16
Copyright 2007, Information Builders. Slide 16 WebFOCUS Authentication Reporting Server Impersonation Scenario 1 Enables fine-grained access control and auditing at the file system and relational database Requires Reporting Server Security = OPSYS Requires RC Authentication Plug-in = MR Trusted Sign-on Tip: This is always a requirement whenever MR Authentication is External or Trusted Recommendation A – Kerberos SSO (7.6.1) MR Authentication = Trusted / REMOTE_USER WF Console Authentication = WEB RC Caster Remote Authenticated = YES Server Connection Security = KERBEROS
17
Copyright 2007, Information Builders. Slide 17 WebFOCUS Authentication Reporting Server Impersonation Recommendation B – MR Sign-on Page MR Authentication = External / WFRS WF Console Authentication = EDA Server Connection Security = Default Recommendation C – Basic Web Authentication (7.6.1) Web Server Security = Basic Web Authentication MR Authentication = Trusted / REMOTE_USER WF Console Authentication = WEB RC Caster Remote Authenticated = YES Server Connection Security = HTTP Basic If SSO vendor solution preferred for Web-tier, then Reporting Server will require secondary Id/Pwd prompt
18
Copyright 2007, Information Builders. Slide 18 WebFOCUS Authentication Authenticate to Sun One LDAP Server Recommendation A - MR / WFRS MR Authentication = External / WFRS WF Console Authentication = EDA Server Security = LDAP Server Connection Security = Default ReportCaster Data Server Settings: Run Id=User Drawback If LDAP passwords expire periodically, user passwords stored in ReportCaster repository will become stale, potentially resulting in failed schedule execution Workaround Set trust_ext=y option on Server (7.6.1) ReportCaster Data Server Settings: Run Id=User, Shared=Yes, Trusted=Passthrough
19
Copyright 2007, Information Builders. Slide 19 WebFOCUS Authentication Authenticate to Sun One LDAP Server Alternative B - MR / LDAP MR Authentication = LDAP Server Security = LDAP, trust_ext=y (7.6.1) WF Console Authentication = EDA Server Connection Security = Trusted: IBIMR_user (7.6.1) ReportCaster Data Server Settings: Run Id=User, Shared=Yes, Trusted=Passthrough
20
Copyright 2007, Information Builders. Slide 20 WebFOCUS Authentication Netegrity SiteMinder SSO Consider SiteMinder Authenticates to Active Directory MR Authentication = Trusted Trusted to HTTP Header (e.g., sm_user) or Trusted to REMOTE_USER Server Connection Security = Trusted Trusted to HTTP Header IBIWFC_authentication WEB or WEBHDR Caster Remote Authenticated Yes (uses REMOTE_USER) ReportCaster Settings: Run Id=User, Trusted=Yes HTTP Header ReportCaster Settings: Run Id=User, Trusted=Passthrough, Shared=Yes
21
Copyright 2007, Information Builders. Slide 21 WebFOCUS Authentication Netegrity SiteMinder SSO Alternative B - MR / LDAP MR Authentication = LDAP Server Security = LDAP, trust_ext=y (7.6.1) WF Console Authentication = EDA Server Connection Security = Trusted: IBIMR_user (7.6.1) ReportCaster Data Server Settings: Run Id=User, Shared=Yes, Trusted=Passthrough
22
Copyright 2007, Information Builders. Slide 22 WebFOCUS Authentication Conclusion We wish to extend our thanks to Jeff Rustandi and Jim Thorstad for their contributions to this presentation.
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.