Authentication In OBIEE

The Oracle BI Enterprise Edition (OBIEE) supports the following authentication types:

‣ Built in BI Server authentication

BI Server authentication stores credentials and other attributes in the repository file
• Good for testing and small installations but if users change often, might be a problem
• Users can not be shared across multiple repositories
• If a user exists here no other logon procedures will be used
• Users can be imported from an LDAP server and refreshed periodically
• Maintaining your passwords in many applications is also a difficult.

‣ Database users Authentication

• Create named database users in the repository matching exactly users in the database
• Assign these users to groups if needed and grant permissions
• Specify that database authentication will be used, in the NQSConfig.ini file
• Set up a connection pool in the physical layer of the repository without shared login

NQSConfig.ini configuration changes
#----- 1 -----
#AUTHENTICATION_TYPE = NQS; // optional and default
#
#----- 2 -----
AUTHENTICATION_TYPE = DATABASE;
[ DATABASE ]
DATABASE = "asdb";
#
#----- 3 -----
#AUTHENTICATION_TYPE = BYPASS_NQS;

‣ LDAP Authentication

• Create a new LDAP server entry in the Security Manager
• Create an Initialization Block to populate the security session variable USER
• Assign the LDAP unique username attribute to the USER variable
• Log in and see the with LDAP credentials

Setup LDAP server in repository

Configure Hostname and port for LDAP

Defined the unique identifier

Create a new initialization block

Assign data source to the block

Assign the data source to the target

Create new variable for user name

Map LDAP attribute to the USER variable

Enable required for authentication

‣ External tables Lookup

• Initialization block fires to authenticate the user based on a table lookup.
• The session variables USER and PASSWORD used to query an existing security table
• Other attributes can be picked up at the same time like email and groups.

The following table can be imported into the physical layer and used for authentication.

Select
username,
groups,
fullname,
From
obiee_users
Where username=‘:USER’
and password=‘:PASSWORD’

Enter the SQL in the initialization block as below.

‣ Custom Authenticators

• An API is defined in the administration guide
• A developer implements and delivers a library that exposes the API
• The BI Administrator defines a new Custom Authenticator using the custom library
• Then define an init block to execute the custom authentication and map to session variables
• Log in with the required credentials

• The BI server Hashes the supplied password and compares with the hash in the password file
• Initialization block populates the USER and GROUP variables

Create a new custom authenticator

Specify plug in and configuration password file.

Map to USER and GROUP variables