The Oracle BI Enterprise Edition (OBIEE) supports the following authentication types:
‣ Built in BI Server authentication
BI Server authentication stores credentials and other attributes in the repository file
• Good for testing and small installations but if users change often, might be a problem
• Users can not be shared across multiple repositories
• If a user exists here no other logon procedures will be used
• Users can be imported from an LDAP server and refreshed periodically
• Maintaining your passwords in many applications is also a difficult.
‣ Database users Authentication
• Create named database users in the repository matching exactly users in the database• Assign these users to groups if needed and grant permissions
• Specify that database authentication will be used, in the NQSConfig.ini file
• Set up a connection pool in the physical layer of the repository without shared login
NQSConfig.ini configuration changes
#----- 1 -----
#AUTHENTICATION_TYPE = NQS; // optional and default
#
#----- 2 -----
AUTHENTICATION_TYPE = DATABASE;
[ DATABASE ]
DATABASE = "asdb";
#
#----- 3 -----
#AUTHENTICATION_TYPE = BYPASS_NQS;
‣ LDAP Authentication
• Create an Initialization Block to populate the security session variable USER
• Assign the LDAP unique username attribute to the USER variable
• Log in and see the with LDAP credentials
Setup LDAP server in repository
Configure Hostname and port for LDAP
Defined the unique identifier
Create a new initialization block
Assign data source to the block
Assign the data source to the target
Create new variable for user name
Map LDAP attribute to the USER variable
Enable required for authentication
‣ External tables Lookup
• Initialization block fires to authenticate the user based on a table lookup.
• The session variables USER and PASSWORD used to query an existing security table
• Other attributes can be picked up at the same time like email and groups.
The following table can be imported into the physical layer and used for authentication.
Select
username,
groups,
fullname,
From
obiee_users
Where username=‘:USER’
and password=‘:PASSWORD’
Enter the SQL in the initialization block as below.
‣ Custom Authenticators
• An API is defined in the administration guide
• A developer implements and delivers a library that exposes the API
• The BI Administrator defines a new Custom Authenticator using the custom library
• Then define an init block to execute the custom authentication and map to session variables
• Log in with the required credentials
• The BI server Hashes the supplied password and compares with the hash in the password file
• Initialization block populates the USER and GROUP variables
Create a new custom authenticator
Specify plug in and configuration password file.
Map to USER and GROUP variables
