4 Enabling SSO Authentication

This chapter provides some general guidelines for configuring single sign-on (SSO) authentication for Oracle Business Intelligence.

Note:

For a detailed list of security setup steps, see Section 1.8, "Detailed List of Steps for Setting Up Security In Oracle Business Intelligence".

This chapter contains the following topics:

• Section 4.1, "SSO Configuration Tasks for Oracle Business Intelligence"

• Section 4.2, "Understanding SSO Authentication and Oracle Business Intelligence"

• Section 4.3, "SSO Implementation Considerations"

• Section 4.4, "Configuring SSO in an Oracle Access Manager Environment"

• Section 4.5, "Configuring Custom SSO Environments"

• Section 4.6, "Using Fusion Middleware Control to Enable SSO Authentication"

Note:

Oracle recommends using Oracle Access Manager as an enterprise-level SSO authentication provider with Oracle Fusion Middleware 11g. Sections 13, 13, and 13 assume that Oracle Access Manager is the SSO authentication provider. Section 4.5 references alternative authentication providers in custom SSO environment solutions.

For more information about configuring and managing Oracle Access Manager with Oracle Fusion Middleware, see "Configuring Single Sign-On in Oracle Fusion Middleware" in Oracle Fusion Middleware Application Security Guide.

For more information about supported SSO providers, see "System Requirements and Certification".

4.1 SSO Configuration Tasks for Oracle Business Intelligence

Table 4-1 contains SSO authentication configuration tasks and provides links for obtaining more information.

Table 4-1 Task Map: Configuring SSO Authentication for Oracle Business Intelligence

Task	Description	For More Information
Configure Oracle Access Manager as the SSO authentication provider.	Configure Oracle Access Manager to protect the Oracle Business Intelligence URL entry points.	Section 4.4, "Configuring SSO in an Oracle Access Manager Environment" "Configuring Single Sign-On in Oracle Fusion Middleware" in Oracle Fusion Middleware Application Security Guide
Configure the HTTP proxy.	Configure the Web proxy to forward requests from the Oracle BI Presentation Server to the SSO provider.	"Configuring Single Sign-On in Oracle Fusion Middleware" in Oracle Fusion Middleware Application Security Guide
Configure a new authenticator for Oracle WebLogic Server.	Configure the Oracle WebLogic Server domain in which Oracle Business Intelligence is installed to use the new identity store.	Section 4.4.1, "Configuring a New Authenticator for Oracle WebLogic Server" Section 3.2, "Configuring Alternative Authentication Providers" Oracle Fusion Middleware Oracle WebLogic Server Administration Console Online Help
Configure a new identity asserter for Oracle WebLogic Server.	Configure the Oracle WebLogic Server domain in which Oracle Business Intelligence is installed to use the SSO provider as an asserter.	Section 4.4.2, "Configuring Oracle Access Manager as a New Identity Asserter for Oracle WebLogic Server" Section 3.2, "Configuring Alternative Authentication Providers" Oracle Fusion Middleware Oracle WebLogic Server Administration Console Online Help
Configure the new trusted system user to replace the default BISystemUser.	Add the new trusted system user name from Oracle Internet Directory to become a member of the BISystem Application Role.	Section 3.2.6, "Configuring a New Trusted User (BISystemUser)"
Refresh the user and group GUIDs.	Refresh the GUIDs of users and groups which migrated from the original identity store to the new identity store (authentication source).	Section 3.2.7, "Regenerating User GUIDs"
Configure custom SSO solutions.	Configure alternative custom SSO solutions to protect the Oracle Business Intelligence URL entry points.	Section 4.5, "Configuring Custom SSO Environments"
Enable Oracle Business Intelligence to accept SSO authentication.	Enable the SSO provider configured to work with Oracle Business Intelligence using Fusion Middleware Control.	Section 4.6, "Using Fusion Middleware Control to Enable SSO Authentication"

Note:

For an example of an Oracle Business Intelligence SSO installation scenario, see Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Business Intelligence.

4.2 Understanding SSO Authentication and Oracle Business Intelligence

Integrating a single sign-on (SSO) solution enables a user to log on (sign-on) and be authenticated once. Thereafter, the authenticated user is given access to system components or resources according to the permissions and privileges granted to that user. Oracle Business Intelligence can be configured to trust incoming HTTP requests authenticated by a SSO solution that is configured for use with Oracle Fusion Middleware and Oracle WebLogic Server. For more information about configuring SSO for Oracle Fusion Middleware, see "Configuring Single Sign-On in Oracle Fusion Middleware" in Oracle Fusion Middleware Application Security Guide.

When Oracle Business Intelligence is configured to use SSO authentication, it accepts authenticated users from whatever SSO solution Oracle Fusion Middleware is configured to use. If SSO is not enabled, then Oracle Business Intelligence challenges each user for authentication credentials. When Oracle Business Intelligence is configured to use SSO, a user is first redirected to the SSO solution's login page for authentication. After the user is authenticated the SSO solution forwards the user name to Oracle BI Presentation Services where this name is extracted. Next a session with the Oracle BI Server is established using the impersonation feature (a connection string between Oracle BI Presentation Server and Oracle BI Server using credentials that act on behalf of a user being impersonated).

After a successful logon using SSO, users are still required to have the oracle.bi.server.manageRepositories permission to log in to the Administration Tool using a valid user name and password combination. After installation, the oracle.bi.server.manageRepositories permission is granted by being a member of the default BIAdministration Application Role.

Configuring Oracle Business Intelligence to work with SSO authentication requires minimally that the following be done:

• Oracle Fusion Middleware and Oracle WebLogic Server are configured to accept SSO authentication. Oracle Access Manager is recommended in production environments.

• Oracle BI Presentation Services is configured to trust incoming messages.

• The HTTP header information required for identity propagation with SSO configurations (namely, user identity and SSO cookie) is specified and configured.

4.2.1 How an Identity Asserter Works

This section describes how Oracle Access Manager authentication provider works with Oracle WebLogic Server using Identity Asserter for single sign-on, providing the following features:

• Identity Asserter for Single Sign-on

  This feature uses the Oracle Access Manager authentication services and validates already-authenticated Oracle Access Manager users through a suitable token and creates a WebLogic-authenticated session. It also provides single sign-on between WebGate and portals. WebGate is a plug-in that intercepts Web resource (HTTP) requests and forwards them to the Access Server for authentication and authorization.

• Authenticator

  This feature uses Oracle Access Manager authentication services to authenticate users who access an application deployed in Oracle WebLogic Server. Users are authenticated based on their credentials, for example a user name and password.

After the authentication provider for Oracle Access Manager is configured as the Identity Asserter for single sign-on, the Web resources are protected. Perimeter authentication is performed by WebGate on the Web tier and by the appropriate token to assert the identity of users who attempt access to the protected WebLogic resources.

All access requests are routed to a reverse proxy Web server. These requests are in turn intercepted by WebGate. The user is challenged for credentials based on the authentication scheme configured within Oracle Access Manager (form-based login recommended).

After successful authentication, WebGate generates a token and the Web server forwards the request to Oracle WebLogic Server, which in turn invokes Oracle Access Manager Identity Asserter for single sign-on validation. The WebLogic Security Service invokes Oracle Access Manager Identity Asserter for single sign-on, which next gets the token from the incoming request and populates the subject with the WLSUserImpl principal. The Identity Asserter for single sign-on adds the WLSGroupImpl principal corresponding to the groups the user is a member of. Oracle Access Manager then validates the cookie.

Figure 4-1 depicts the distribution of components and the flow of information when the Oracle Access Manager Authentication Provider is configured as an Identity Asserter for SSO with Oracle Fusion Middleware.

Figure 4-1 Oracle Access Manager Single Sign-On Solution for Web Resources Only

4.2.2 How Oracle Business Intelligence Operates With SSO Authentication

After SSO authorization has been implemented, Oracle BI Presentation Services operates as if the incoming Web request is from a user authenticated by the SSO solution. Oracle BI Presentation Services next creates a connection to the Oracle BI Server using the impersonation feature and establishes the connection to the Oracle BI Server on behalf of the user. User personalization and access controls such as data-level security are maintained in this environment.

4.3 SSO Implementation Considerations

When implementing a SSO solution with Oracle Business Intelligence you should consider the following:

• When accepting trusted information from the HTTP server or servlet container, it is essential to secure the machines that communicate directly with the Oracle BI Presentation Server. This can be done by setting the Listener\Firewall node in the instanceconfig.xml file with the list of HTTP Server or servlet container IP addresses. Additionally, the Firewall node must include the IP addresses of all Oracle BI Scheduler instances, Oracle BI Presentation Services Plug-in instances, and Oracle BI JavaHost instances. If any of these components are co-located with Oracle BI Presentation Services, then address 127.0.0.1 must be added in this list as well. This setting does not control end-user browser IP addresses.

• When using mutually-authenticated SSL, you must specify the Distinguished Names (DNs) of all trusted hosts in the Listener\TrustedPeers node.

4.4 Configuring SSO in an Oracle Access Manager Environment

For information about how to configure Oracle Access Manager as the SSO authentication provider for Oracle Fusion Middleware with, see "Configuring Single Sign-On in Oracle Fusion Middleware" in Oracle Fusion Middleware Application Security Guide. For more information about managing Oracle Access Manager, see Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager.

After the Oracle Fusion Middleware environment is configured, in general the following must be done to configure Oracle Business Intelligence:

• Configure the SSO provider to protect the Oracle Business Intelligence URL entry points.

• Configure the Web server to forward requests from the Oracle BI Presentation Server to the SSO provider.

• Configure the new identity store as the main authentication source for the Oracle WebLogic Server domain in which Oracle Business Intelligence has been installed. For more information, see Section 4.4.1, "Configuring a New Authenticator for Oracle WebLogic Server".

• Configure the Oracle WebLogic Server domain in which Oracle Business Intelligence is installed to use an Oracle Access Manager asserter. For more information, see Section 4.4.2, "Configuring Oracle Access Manager as a New Identity Asserter for Oracle WebLogic Server".

• After configuration of the SSO environment is complete, enable SSO authentication for Oracle Business Intelligence. For more information, see Section 4.6, "Using Fusion Middleware Control to Enable SSO Authentication".

4.4.1 Configuring a New Authenticator for Oracle WebLogic Server

After installing Oracle Business Intelligence, the Oracle WebLogic Server embedded LDAP server is the default authentication source (identity store). To use a new identity store (for example, OID), as the main authentication source, you must configure the Oracle WebLogic Server domain (where Oracle Business Intelligence is installed).

Setting the Control Flag attribute for the authenticator provider determines the ordered execution of the Authentication providers. The possible values for the Control Flag attribute are:

• REQUIRED - This LoginModule must succeed. Even if it fails, authentication proceeds down the list of LoginModules for the configured Authentication providers. This setting is the default.

• REQUISITE - This LoginModule must succeed. If other Authentication providers are configured and this LoginModule succeeds, authentication proceeds down the list of LoginModules. Otherwise, control is returned to the application.

• SUFFICIENT - This LoginModule need not succeed. If it does succeed, return control to the application. If it fails and other Authentication providers are configured, authentication proceeds down the LoginModule list.

• OPTIONAL - This LoginModule can succeed or fail. However, if all Authentication providers configured in a security realm have the JAAS Control Flag set to OPTIONAL, the user must pass the authentication test of one of the configured providers.

For more information about creating a new default authenticator in Oracle WebLogic Server, see Oracle Fusion Middleware Oracle WebLogic Server Administration Console Online Help or Oracle Fusion Middleware Securing Oracle WebLogic Server.

To configure a new authenticator in Oracle WebLogic Server:

1. Log in to Oracle WebLogic Server Administration Console.

   For more information, see Section 2.3.2, "Launching Oracle WebLogic Server Administration Console".

2. In Oracle WebLogic Server Administration Console, select Security Realms from the left pane and click the realm you are configuring. For example, myrealm. Select Providers.

3. Click New. Complete the fields as follows:

   • Name: OID Provider, or a name of your choosing.

   • Type: OracleInternetDirectoryAuthenticator

   • Click OK

4. In the authentication providers table, click the newly added authenticator.

5. Navigate to Settings, then select Common:

   • Set the Control Flag to SUFFICIENT.

   • Click Save.

6. Click the Provider Specific tab and enter the following required settings using values for your environment:

   • Host: The LDAP host. For example: localhost.

   • Port: The LDAP host listening port. For example: 6050.

   • Principal: LDAP administrative user. For example: cn=orcladmin.

   • Credential: LDAP administrative user password.

   • User Base DN: Same as in Oracle Access Manager.

   • All Users Filter: For example, (&(uid=*) (objectclass=person)). The asterix (*) filters for all users.

   • User Name Attribute: Set as the default attribute for user name in the directory server. For example: uid

   • Group Base DN: The group searchbase (same as User Base DN)

   • Do not set the All Groups filter because the default setting is acceptable.

7. Click Save.

8. Perform the following steps to set up the default authenticator for use with the Identity Asserter:

   1. Display the Providers tab, select Authentication, then select DefaultAuthenticator to display its configuration page.

   2. Select the Common tab and set the Control Flag to SUFFICIENT.

   3. Click Save.

9. Perform the following steps to reorder Providers:

   1. Display the Providers tab.

   2. Click Reorder.

   3. On the Reorder Authentication Providers page, select a provider name and use the arrows beside the list to order the providers as follows:

      • OID Authenticator (SUFFICIENT)

      • OAM Identity Asserter (REQUIRED)

      • Default Authenticator (SUFFICIENT)

   4. Click OK to save your changes.

10. In the Change Center, click Activate Changes.

11. Restart Oracle WebLogic Server.

For more information, see Section 3.2.3.1, "Configuring Oracle Business Intelligence to use Oracle Internet Directory as the Authentication Provider".

4.4.2 Configuring Oracle Access Manager as a New Identity Asserter for Oracle WebLogic Server

The Oracle WebLogic Server domain in which Oracle Business Intelligence is installed must be configured to use an Oracle Access Manager asserter.

For more information about creating a new asserter in Oracle WebLogic Server, see Oracle Fusion Middleware Oracle WebLogic Server Administration Console Online Help.

To configure Oracle Access Manager as the new asserter for Oracle WebLogic Server:

1. Log in to Oracle WebLogic Server Administration Console.

   For more information, see Section 2.3.2, "Launching Oracle WebLogic Server Administration Console".

2. In Oracle WebLogic Server Administration Console, select Security Realms from the left pane and click the realm you are configuring. For example, myrealm. Select Providers.

3. Click New. Complete the fields as follows:

   • Name: OAM Provider, or a name of your choosing.

   • Type: OAMIdentityAsserter.

4. Click OK.

5. Click Save.

6. In the Providers tab, perform the following steps to reorder Providers:

   1. Click Reorder

   2. In the Reorder Authentication Providers page, select a provider name, and use the arrows beside the list to order the providers as follows:

      • OID Authenticator (SUFFICIENT)

      • OAM Identity Asserter (REQUIRED)

      • Default Authenticator (SUFFICIENT)

   3. Click OK to save your changes.

7. In the Change Center, click Activate Changes.

8. Restart Oracle WebLogic Server.

   You can verify that Oracle Internet Directory is the new identity store (default authenticator) by logging back into Oracle WebLogic Server and verifying the users and groups stored in the LDAP server appear in the console.

9. Use Fusion Middleware Control to enable SSO authentication.

   For more information, see Section 4.6, "Using Fusion Middleware Control to Enable SSO Authentication".

4.5 Configuring Custom SSO Environments

For information about configuring Oracle Business Intelligence to participate in custom SSO environments (for example, 'Configuring authentication and SSO with Active Directory and Windows Native Authentication', and 'Configuring Oracle Business Intelligence Enterprise Edition 11g to work with SiteMinder SSO'), see article ID 1284399.1 on My Oracle Support at:

https://support.oracle.com

4.6 Using Fusion Middleware Control to Enable SSO Authentication

After Oracle Business Intelligence has been configured to use the SSO solution configured for use by Oracle Fusion Middleware, you must enable SSO authentication for Oracle Business Intelligence in Fusion Middleware Control from the Security tab.

To enable Oracle Business Intelligence to use SSO authentication:

1. Go to the Business Intelligence Overview page.

   For information, see "Logging In to Fusion Middleware Control" in Oracle Fusion Middleware System Administrator's Guide for Oracle Business Intelligence Enterprise Edition.

2. Go to the Security page.

   Click the Help button on the page to access the page-level help for its elements.

3. Click Lock and Edit Configuration.

4. Select Enable SSO.

   When selected, this checkbox enables SSO to be the method of authentication into Oracle Business Intelligence. The appropriate form of SSO is determined by the configuration settings made for the chosen SSO provider.

5. Select the configured SSO provider from the list.

   The SSO provider list becomes active when you select the Enable SSO checkbox.

6. If required, enter logon and logoff URLs for the configured SSO provider.

   The logoff URL (specified by the SSO provider) must be outside the domain and port that the SSO provider protects, because the system does not log users out.

7. Click Apply, then Activate Changes.

8. Restart the Oracle Business Intelligence components using Fusion Middleware Control.

   For more information, see "Starting and Stopping the Oracle Business Intelligence Components" in Oracle Fusion Middleware System Administrator's Guide for Oracle Business Intelligence Enterprise Edition.