Configuring Foundation Services for Kerberos Authentication

Subtopics

Caution!

Complete this step only after SSODiag successfully retrieves the Kerberos principal name. See Using SSODiag to Test WebLogic Server Configuration for Kerberos Authentication.

Changing the Security Model

The default security model for web applications secured by the security realm is DDonly. You must change the security model to CustomRolesAndPolicies.

  To change the security model:

  1. Using a text editor, open MIDDLEWARE_HOME/user_projects/domains/EPMSystem/config/config.xml.

  2. Locate the following element in the application deployment descriptor for each Foundation Services component:

    <security-dd-model>DDOnly</security-dd-model>

  3. Change the security model as follows for each component:

    <security-dd-model>CustomRolesAndPolicies</security-dd-model>

  4. Save and close config.xml.

Updating EPM System Security Configuration

Change EPM System security configuration to enable Kerberos SSO.

  To configure EPM System for Kerberos authentication:

  1. Log on to Shared Services Console as administrator.

  2. Add the Active Directory domain that is configured for Kerberos authentication as an external user directory in Shared Services. See “Configuring OID, Active Directory, and Other LDAP-based User Directories” in the Oracle Hyperion Enterprise Performance Management System User and Role Security Guide.

  3. Enable SSO. See “Setting Security Options” in the Oracle Hyperion Enterprise Performance Management System User and Role Security Guide.

    In Security Options, select the settings in Table 19 to enable Kerberos SSO.

    Table 19. Settings to Enable Kerberos SSO

    FieldRequired Setting
    Enable SSOSelected
    SSO Provider or AgentOther
    SSO MechanismGet Remote User from HTTP Request

  4. Restart Foundation Services.

Testing Kerberos SSO

Log in to Foundation Services to verify that Kerberos SSO is working properly.

  To test Kerberos SSO:

  1. Verify that Foundation Services and Oracle HTTP Server are running.

  2. Log on to a client machine configured for Kerberos authentication using a valid Active Directory credentials.

  3. Using a browser, connect to the Foundation Services URL.