3 Configure OBIEE authentication

In this step, you install and configure the authentication plugin that allows you to access Topics reports in OBIEE using your Empirica Signal password.

This chapter includes the following sections:

• Configuring the credential store

• Copying and extracting the authentication files

• Creating a new authentication provider

• Verifying attribute information

Configuring the credential store

1. Log into the Oracle Fusion Middleware Enterprise Manager using the WebLogic administrator username and password. You can access the server at:

   http://<server name>:<port>/em

2. Expand WebLogic Domain in the left-hand pane.

3. Click the name of your Empirica BI domain (for example, empirica_bi), and select WebLogic Domain/Security/Credentials from the drop-down menu, under your domain name in the top left of the center pane.

4. Click Create Map and type oracle.hsgbu.empirica as Map Name.

5. Click OK.

6. Select oracle.hsgbu.empirica in the Credential column, and click Create Key.

7. Create the following keys:

   • DatabaseCredentials—Use the same user name and password as the corresponding DatabaseCredentials key on the Signal instance

   • AuthenticatorCredentials—Use the WebLogic administrator user name and password from the current OBIEE instance.

8. Select WebLogic Domain > Security > System Policies from the drop-down menu under your domain name in the top left of the center pane.

9. From the Type drop-down list, select Principal.

10. Click Create.

11. Under Permissions, click Add. Select the Select here to enter details for a new permission check box, and type the following values:

    Permission Class: oracle.security.jps.service.credstore.CredentialAccessPermission

    Resource Name: context=SYSTEM,mapName=oracle.hsgbu.empirica,keyName=*

    Permission Actions: read

12. Click OK.

13. Set the drop-down selector Grant to to Principal.

14. Under Grantee, do the following:

    1. Click Add.

    2. Set the Type drop-down list value to Group.

    3. Set the Principal Name drop-down list value to Starts With.

    4. Type BI in the text field, and click the blue Search roles button.

    5. Select BIAdministrators.

    6. Click OK.

15. Click OK.

16. Set the Type to Principal and search for entries starting with BI. Select BIAdministrators, and click Create Like.

17. Under Grantee, do the following:

    1. Click Add.

    2. Set the Type drop-down list value to Group.

    3. Set the Principal Name drop-down list value to Starts With.

    4. Type BI in the text field, and click the blue Search roles button.

    5. Select BIAuthors.

    6. Click OK.

18. Click OK.

19. Select BIAdministrators, and click Create Like.

20. Under Grantee, do the following:

    1. Click Add.

    2. Set the Type drop-down list value to Group.

    3. Set the Principal Name drop-down list value to Starts With.

    4. Type BI in the text field, and click Search roles.

    5. Select BIConsumers.

    6. Click OK.

    7. Click OK again.

21. The following provides access to the oracle.hsgbu.empirica Credential Store map for the patch directory:

    1. Set the Type to Principal and search for entries starting with BI. Select BIAdministrators, and click Create Like.

    2. Change the drop-down selector Grant to from Principal to Codebase.

    3. Enter the following value for Codebase:

       file:${wls.home}/../../patch_wls1036/-

    4. Click OK.

    5. Click OK again.

22. Logout.

Copying and extracting the authentication files

1. If you have not already done so, unzip the OBIEE.zip file. Open the OBIEE\empiricaprovider\obiee_auth.properties file and verify the information:

   1. Navigate to the OBIEE\empiricaprovider directory.

   2. Open the obiee_auth.properties file.

   3. Verify that the following properties are set to the appropriate values for your OBIEE WebLogic server, editing the default values if necessary:

      HOSTNAME=localhost

      PORT=7001

2. Create the following folder on the OBIEE server:

   /u01/app/oracle/empiricaprovider

3. Copy the following file from local folder OBIEE\empiricaprovider to the /u01/app/oracle/empiricaprovider folder on the OBIEE server:

   • obiee_auth.properties

   • ESAPI.properties

   • messages.properties

   Copy the following files from the current Signal deployment on Linux. The file should be located in the stage/Signal_Install/Signal/Web_root/WEB-INF/classes sub-directory:

   • webvdme.properties

4. Navigate to local directory OBIEE/mbeans and copy the following files to the <WebLogic server>/server/lib/mbeantypes folder on the OBIEE server:

   • empirica<version>.jar

   • EmpiricaCore<version>.jar

   • empiricaprovider<version>.jar

   • esapi-2.0.1.jar

   • log4j-1.2.16.jar

   • secure-coding<version>.jar

5. Add the empiricaprovider folder to the Java CLASSPATH in the Weblogic startup script:

   1. Open a Command Prompt window (for example, PuTTY) on the OBIEE server and navigate to /u01/app/oracle/product/Middleware/user_projects/domains/empirica_bi/bin (substitute your domain's name for empirica_bi if it is different).

   2. Open startWebLogic.sh in a text editor.

   3. After the "fi" at line 127 (it ends the MEDREC_WEBLOGIC_CLASSPATH if-block), and before the following "echo" line, add the following two lines (keeping the double-quotes):

      CLASSPATH="${CLASSPATH}${CLASSPATHSEP}/u01/app/oracle/empiricaprovider"

      PATH="${PATH}${PATHSEP}/u01/app/oracle/empiricaprovider"

   4. Save the changes and close the file

6. Stop and restart the WebLogic administration server. See for more information.

Creating a new authentication provider

1. Log into Oracle WebLogic Server Administration Console on the OBIEE server using your WebLogic administrator username and password.

   You can access the server at http://<server>:<port>/console.

2. In the Domain Structure pane, click Security Realms.

   The Summary of Security Realms page appears.

3. In the Realms table, click myrealm.

   The Settings for myrealm page appears.

4. In the Change Center pane, click Lock & Edit.

5. Click the Providers tab, and then click the Authentication subtab.

6. If SSO is configured, perform the following steps to install the OAMIdentityAsserter:

   1. Click New.

   2. Specify the following:

      • Name: Type OAMIdentityAsserter.

      • Type: Select OAMIdentityAsserter.

   3. Click OK.

   4. Click the OAMIdentityAsserter link.

      • In the Common tab, make sure that OAM_REMOTE_USER is selected as one of the Active Types. Leave the Control Flag as OPTIONAL.

      • In the Provider Specific tab, set: SSOHeader Name: SSO_USER_LOGIN_ID

      • Click Save.

   5. On the Providers page, click Reorder.

   6. Move the OAMIdentityAsserter to the top of the list of authentication providers.

   7. Click OK.

7. Click New.

   The Create a New Authentication Provider page appears.

8. Specify the following:

   • Name: Type EmpiricaAuthenticationProvider.

   • Type: Select EmpiricaAuthenticator.

9. Click OK.

   The authentication provider is created.

10. On the Providers page, click Reorder.

    If the OAMIdentityAsserter is installed, move the EmpiricaAuthenticationProvider immediately after the OAMIdentityAsserter and before the DefaultAuthenticator.

    If the OAMIdentityAsserter is not installed, move the EmpiricaAuthenticationProvider to the top of the list of authentication providers.

11. Click OK

12. Click the EmpiricaAuthenticationProvider link. Change the Control Flag to REQUISITE.

13. Click Save.

14. Click the DefaultAuthenticator link. Change the Control Flag to SUFFICIENT for non-SSO systems. Change the Control Flag to REQUIRED for SSO systems.

15. Click Save.

16. Click Activate Changes in the Change Center.

17. If the OAMIdentityAsserter has been installed, the following steps must be taken:

    1. Save changes and shutdown all the servers in the domain.

    2. Take a backup of the $DOMAIN_HOME/bin/setDomainEnv.sh file and make the following changes to setDomainEnv.sh file.

       Add the following lines just before JAVA_PROPERTIES are defined:

       EXTRA_JAVA_PROPERTIES="-Dsso.filter.ssotoken=SSO_USER_LOGIN_ID ${EXTRA_JAVA_PROPERTIES}"

       export EXTRA_JAVA_PROPERTIES

18. Stop and restart the WebLogic administration server. See for more information.

    
    

    Note: Once the Empirica Authenticator is configured, you can no longer log into OBIEE using a non-Signal account. The SSO properties for OBIEE's copy of webvdme.properties must agree with the installation. If OBIEE is configured for SSO, then the SSO properties must be set in webvdme.properties. Likewise, if OBIEE is not configured for SSO, then the SSO properties must not be set in webvdme.properties.

    
    

Verifying attribute information

1. Log into Oracle Fusion Middleware Enterprise Manager using your WebLogic administrator username and password.

   You can access Oracle Fusion Middleware Enterprise Manager at http://<server>:<port>/em.

2. Expand the WebLogic Domain folder.

3. Right-click the domain name, and select System MBean Browser.

   The System MBean Browser appears.

4. In the System MBean Browser pane, expand the Configuration Mbeans folder.

5. Expand the Security folder.

6. Click the myrealmEmpiricaAuthenticationProvider mbean.

   The attributes appear.

7. On the Attributes tab, verify that the Value column for the EmpiricaSignalApplicationRoot attribute contains the /u01/app/oracle/empiricaprovider folder that you created in step 2 in Copying and extracting the authentication files.

8. Edit the value if necessary, and click Apply.

9. Log out.

10. Log into Oracle WebLogic Server Administration Console using your WebLogic administrator username and password.

    You can access the server at http://<server>:<port>/console.

11. To make your OBIEE usernames case-insensitive to ensure successful logins from the Empirica Signal application, do the following:

    1. In the Domain Structure pane, click the domain name. For example, empirica_bi.

       The Settings for <domain name> page appears.

    2. Click the Security tab, and click the General tab if it is not already selected.

    3. Click Advanced at the bottom of the page.

       Advanced options appear.

    4. Select the Principal Equals Case Insensitive check box.

       If the check box is not editable, click Lock and Edit.

    5. Click Save.

       Your changes are saved.

       For more information, see the following documentation:

       http://docs.oracle.com/cd/E21764_01/web.1111/e13707/domain.htm

12. In the Change Center pane, click Activate Changes.

    Your changes are activated.

13. Log out.

14. Stop and restart the WebLogic administration server. See for more information.