BusinessObjects Enterprise XI

Transcription

1 Overview Contents This document contains information on LDAP authentication and how to configure with this type of authentication. INTRODUCTION... 2 What Is LDAP?...2 LDAP platforms supported by...3 LDAP Servers... 3 Single Sign-on Server (SSO)... 3 HOW TO CONFIGURE ENTERPRISE XI FOR LDAP AUTHENTICATION...3 Overview...3 Hands-On configuration...4 HOW TO CONFIGURE ENTERPRISE XI FOR LDAP AUTHENTICATION WITH SECURE SOCKET LAYER (SSL)...5 HOW TO CONFIGURE ENTERPRISE XI FOR LDAP AUTHENTICATION WITH SINGLE SIGN-ON (SSO)...7 HOW TO MAP USER ACCOUNTS AND GROUPS FROM THE LDAP DIRECTORY SERVER... 7 HOW TO MANAGE MULTIPLE LDAP HOSTS...9 ADDITIONAL NOTE...9 FINDING MORE INFORMATION /30/2007 2:23 PM Copyright 2007 Business Objects. All rights reserved. Page 1

2 Introduction This document provides a definition for LDAP and then step-by-step instructions on how to configure LDAP authentication for use with. What Is LDAP? LDAP stands for Lightweight Directory Access Protocol and is a directory service protocol that runs over TCP/IP. Lightweight Directory Access Protocol (LDAP), a common, applicationindependent directory, enables users to share information among various applications. Based on an open standard, LDAP provides a means for accessing and updating information in a directory. LDAP is based on the X.500 standard, which uses a directory access protocol (DAP) to communicate between a directory client and a directory server. LDAP is an alternative to DAP because it uses fewer resources and simplifies and omits some X.500 operations and features. The directory structure within LDAP has entries arranged in a specific schema. Each entry is identified by its corresponding distinguished name (DN) or common name (CN). Other common attributes include the organizational unit name (OU), and the organization name (O). For example, a member group may be located in a directory tree as follows: cn=businessobjects Enterprise Users, ou=enterprise Users A, o=research. Refer to your LDAP documentation for more information. Because LDAP is application-independent, any client with the proper authorization can access its directories. LDAP offers you the ability to set up users to log on to BusinessObjects Enterprise through LDAP authentication. It also enables users to be authorized when attempting to access objects in BusinessObjects Enterprise. As long as you have an LDAP server (or servers) running, and use LDAP in your existing networked computer systems, you can use LDAP authentication. If desired, the LDAP security plug-in provided with BusinessObjects Enterprise can communicate with your LDAP server using a Secure Socket Layer (SSL) connection established using either server authentication or mutual authentication. With server authentication, the LDAP server has a security certificate which BusinessObjects Enterprise uses to verify that it trusts the server, while the LDAP server allows connections from anonymous clients. With mutual authentication, both the LDAP server and BusinessObjects Enterprise have security certificates, and the LDAP server must also verify the client certificate before a connection can be established. Currently LDAP is considered to be the most popular protocol for providing directory services on the Internet. 3/30/2007 2:23 PM Copyright 2007 Business Objects. All rights reserved. Page 2

3 LDAP platforms supported by BusinessObjects Enterprise XI LDAP Servers SunOne Directory Server*5.1 SunOne Directory Server* 5.2 IBM Secureway Directory 5.1 Lotus Domino Novell NDS edirectory 8.7 *SunOne Directory Server is previously known as iplanet Directory Server. Single Sign-on Server (SSO) Netegrity Siteminder 5.5 NOTE The LDAP security plug-in is LDAP version 3 compliant but we only support the LDAP vendors listed above. For more information and for the latest updates on BusinessObjects Enterprise XI supported platforms, search for the file name, boe_xi_supported_platforms.pdf on our support site at: How to configure Enterprise XI for LDAP authentication Overview The LDAP security plug-in (secldap.dll) allows you to map user accounts and groups from your LDAP directory server to ; it also enables the system to verify all logon requests that specify LDAP authentication. Users are authenticated against the LDAP directory server, and have their membership in a mapped LDAP group verified before the CMS grants them an active session. Enterprise XI dynamically maintains user lists and group memberships. With LDAP authentication, you can create new Enterprise accounts for existing LDAP users, or assign LDAP aliases to existing users if the user names match the Enterprise user names. In addition, you can specify multiple host names and their ports. Once you have mapped your LDAP users and groups, all of the BusinessObjects Enterprise client tools support LDAP authentication, 3/30/2007 2:23 PM Copyright 2007 Business Objects. All rights reserved. Page 3

4 except for the Import Wizard. You can also create your own applications that support LDAP authentication. Hands-On configuration Before setting up and enabling LDAP authentication, ensure that you have your LDAP directory set up and the LDAP server information. For example, you need to know LDAP host and port information, Base LDAP Distinguished Name, and LDAP Server Administration Credentials if your LDAP Server does not allow anonymous binding. Steps to configure the LDAP host: 1. Go to the Authentication management area of the Central Management Console. 2. Click the LDAP tab, and then click Start LDAP Configuration Wizard. The LDAP Configuration Wizard leads you through the setup of LDAP authentication. The first screen of the Wizard asks for information about your LDAP host. Type your LDAP host and port information in the Add and LDAP host (hostname:port) field. For example, "myserver:123". Click Add. Repeat this step to add more than one LDAP host of the same server type if you want to add hosts that can act as failover servers. If you want to remove a host, highlight the host name and click Delete. For more information on multiple hosts, refer to the How to manage multiple LDAP hosts section in this document. 3. Click Next. 4. Select your server type from the LDAP Server Type list. Click Show Attribute Mappings if you want to view or change any of the LDAP Server Attribute Mappings or the LDAP Default Search Attributes. By default, each supported server type's server attribute mappings and search attributes are already set. 5. Click Next. 6. In the Base LDAP Distinguished Name field, type the distinguished name (for example, o=somebase). 7. Click Next. 8. Enter the credentials required by the LDAP hosts: In the LDAP Server Administration Credentials area, type the distinguished name and password for a user account that is authorized to administer your LDAP server. If your LDAP Server allows anonymous binding, leave this area blank BusinessObjects Enterprise servers and clients will bind to the primary host via anonymous logon. Enter another distinguished name and password in the LDAP Referral Credentials area if all of the following apply: 3/30/2007 2:23 PM Copyright 2007 Business Objects. All rights reserved. Page 4

5 a) The primary host has been configured to refer to another directory server that handles queries for entries under a specified base. b) The host referred to has been configured to not allow anonymous binding. c) A group from the host being referred to will be mapped to BusinessObjects Enterprise. Although groups can be mapped from multiple hosts, only one set of referral credentials can be set. Therefore, if you have multiple referral hosts, you must create a user account on each host that uses the same distinguished name and password. 9. Enter the number of referral hops in the Maximum Referral Hops field. If this field is set to zero, no referrals will be followed. 10. Click Next. 11. Proceed with configuring the Secure Socket Layer (SSL). 12. Proceed with configuring LDAP for single sign-on (SSO). 13. Map user accounts and groups from your LDAP directory server to Enterprise XI. How to configure Enterprise XI for LDAP authentication with Secure Socket Layer (SSL) You can specify that BusinessObjects Enterprise use a Secure Socket Layer (SSL) connection to communicate to the LDAP directory server for additional security. NOTE The LDAP security plug-in provided with can be configured to communicate with an LDAP server via SSL, but always performs basic authentication when verifying users' credentials. Before deploying LDAP authentication in conjunction with, ensure that you are familiar with the differences between these LDAP types. For details, see RFC2251, which is currently available at 1. Select the type of SSL authentication (Basic (no SSL), Server Authentication, or Mutual Authentication) your LDAP hosts use to establish a connection with Enterprise XI. 2. Click Next. 3. If you selected Server Authentication or Mutual Authentication, choose one of the following options: a) Always accept server certificate This is the lowest security option. Before BusinessObjects Enterprise can establish an SSL connection with the LDAP host (to authenticate LDAP users and groups), it must receive a security certificate from the LDAP host. Enterprise XI does not verify the certificate it receives. 3/30/2007 2:23 PM Copyright 2007 Business Objects. All rights reserved. Page 5

6 b) Accept server certificate if it comes from a trusted Certificate Authority This is a medium security option. Before BusinessObjects Enterprise can establish an SSL connection with the LDAP host (to authenticate LDAP users and groups), it must receive and verify a security certificate sent to it by the LDAP host. To verify the certificate, BusinessObjects Enterprise must find the Certificate Authority that issued the certificate in its certificate database. TIP Java applications, such as the Java version of InfoView, always use this option, regardless of the setting you choose. c) Accept server certificate if it comes from a trusted Certificate Authority The common name attribute of the certificate matches the DNS hostname of the server. This is the highest security option. Before BusinessObjects Enterprise XI can establish an SSL connection with the LDAP host (to authenticate LDAP users and groups), it must receive and verify a security certificate sent to it by the LDAP host. To verify the certificate, must find the Certificate Authority that issued the certificate in its certificate database. It must also be able to confirm that the CN attribute on the server certificate exactly matches the host name of the LDAP host as you typed it in the "Add LDAP host" field in the first step of the Wizard. That is, if you entered the LDAP host name as ABALONE.rd.crystald.net:389, using CN =ABALONE:389 in the certificate would not work. TIP The hostname on the server security certificate is the name of the primary LDAP host. Therefore, if you select this option you cannot use a fail over LDAP host. 4. In the SSL host computer, you must next add the hostname of each machine in your system that uses the BusinessObjects Enterprise SDK. This includes the machine running your Central Management Server and the machine running your WCA. Type the hostname of each machine in the SSL Host box, and then click Add. 5. Configure the SSL settings for each SSL host in the list, starting with the default host. To select settings for the default host, clear all the Use default value boxes. 6. Type the values for the path to the certificate and key database files, and the password for the key database. Type a nickname for the client certificate in the cert7.db, if you selected mutual authentication. The settings for the default host are used for any setting (for any host) where you leave the "Use default value" check box selected, as 3/30/2007 2:23 PM Copyright 2007 Business Objects. All rights reserved. Page 6

7 well, for any machine whose name you do not explicitly add to the list of SSL hosts. To select settings for another host, select its name in the list on the left. Then type the appropriate values in the boxes on the right. 7. Click Next to complete this set of steps. How to configure Enterprise XI for LDAP authentication with Single Sign-on (SSO) Business Objects XI has introduced single sign-on for LDAP authentication. When LDAP authentication is enabled, the administrator has the option to use Siteminder (a third-party user access and authentication tool) as an external system for authentication providing single sign-on capabilities to BusinessObjects Enterprise. 1. Select the type of single sign-on authentication (Basic (no SSO) or SiteMinder). 2. Click Next. 3. If you selected SiteMinder, configure the SiteMinder hosts: In the Policy Server Host box, type the name of each Policy Server, and then click Add. For each Policy Server Host, specify the Accounting, Authentication and Authorization port numbers. Enter the name of the Web Agent and the Shared Secret. Enter the Shared Secret, again. 4. Click Next to complete this set of steps. How to map user accounts and groups from the LDAP directory server When you map an LDAP account, you can choose to create a new account or to link to an existing Enterprise account. The next screen of the LDAP Configuration Wizard controls how maps LDAP users to Enterprise users. 1. Click New Alias Options to specify how LDAP aliases are mapped to Enterprise accounts. Select either one of the following options: a) Assign each added LDAP alias to an account with the same name Use this option when you know users have an existing Enterprise account with the same name; that is, LDAP aliases will be assigned to existing users (auto alias creation is turned on). Users who do not have an existing Enterprise account, or who do not have the same name in their Enterprise and LDAP account, are added as new LDAP users. 3/30/2007 2:23 PM Copyright 2007 Business Objects. All rights reserved. Page 7

8 b) Create a new account for every added LDAP alias Use this option when you want to create a new account for each user. 2. Click Update Options to specify if LDAP aliases are automatically created for all new users. Select either one of the following options: a) New aliases will be added and new users will be created Use this option to automatically create a new alias for every LDAP user mapped to BusinessObjects Enterprise. New LDAP accounts are added for users without BusinessObjects Enterprise accounts, or for all users if you selected the "Create a new account for every added LDAP alias" option. b) No new aliases will be added and new users will not be created Use this option when the LDAP directory you are mapping contains many users, but only a few of them will use BusinessObjects Enterprise. BusinessObjects Enterprise does not automatically create aliases and Enterprise accounts for all users. Instead, it creates aliases (and accounts, if required) only for users who log on to BusinessObjects Enterprise. 3. Click New User Options to specify properties of the new Enterprise accounts that are created to map to LDAP accounts. Select either one of the following: a) New users are created as named users New user accounts are configured to use named user licenses. Named user licenses are associated with specific users and allow people to access the system based on their user name and password. This provides named users with access to the system regardless of how many other people are connected. You must have a named user license available for each user account created using this option. a) New users are created as concurrent users New user accounts are configured to use concurrent user licenses. Concurrent licenses specify the number of people who can connect to at the same time. This type of licensing is very flexible because a small concurrent license can support a large user base. For example, depending on how often and how long users access BusinessObjects Enterprise, a 100 user concurrent license could support 250, 500, or 700 users. 4. Click Finish to save your LDAP settings. The LDAP Server Summary page appears. Once you have configured LDAP authentication using the LDAP Configuration Wizard, you can map LDAP groups to Enterprise groups. 5. In the "Mapped LDAP Member Groups" area, specify your LDAP group (either by common name or distinguished name) in the Add LDAP group (by cn or dn) field; click Add. You can add more than 3/30/2007 2:23 PM Copyright 2007 Business Objects. All rights reserved. Page 8

9 one LDAP group by repeating this step. To remove a group, highlight the LDAP group and click Delete. 6. Click Update to save the settings. How to manage multiple LDAP hosts 7. To confirm that these groups are successfully mapped to BusinessObject Enterprise XI, click the Organize GROUPS link located in the Home area of the Central Management Console. In the Groups page, you can see the new LDAP groups just mapped from the LDAP directory server. Using LDAP and BusinessObjects Enterprise, you can add fault tolerance to your system by adding multiple LDAP hosts. BusinessObjects Enterprise XI uses the first host that you add as the primary LDAP host. Subsequent hosts are treated as fail over hosts. The primary LDAP host and all fail over hosts must be configured in exactly the same way, and each LDAP host must refer to all additional hosts from which you wish to map groups. For more information about LDAP hosts and referrals, refer to LDAP documentation. To add multiple LDAP Hosts, enter all hosts when you configure LDAP using the LDAP Configuration Wizard (refer to the section on How to configure LDAP authentication for details.) Or, if you have already configured LDAP, go to the Authentication Management area of the Central Management Console and click the LDAP tab. In the LDAP Server Configuration Summary area, click the name of the LDAP host to open the page that enables you to add or delete hosts. NOTE The order in which the hosts are communicated with matters, so ensure that you add the primary host first, followed by the remaining fail over hosts. If you use fail over LDAP hosts, you cannot use the highest level of SSL security. That is, you cannot select "Accept server certificate if it comes from a trusted Certificate Authority and the CN attribute of the certificate matches the DNS hostname of the server." Additional note JAVA SDK - LDAP authentication When logging on to BusinessObjects Enterprise 11 using the JAVA SDK s LDAP provider (in particular, when logging on to the Java InfoView via LDAP), specified referral credentials are not used when following referrals while looking up users. For LDAP authentication to succeed, you need to enable anonymous logon for all LDAP servers specified in referrals. (Refer to release.pdf on the installation CD as the source for this note.) 3/30/2007 2:23 PM Copyright 2007 Business Objects. All rights reserved. Page 9

10 Finding More Information For more information and resources, refer to the product documentation and visit the support area of the web site at: 3/30/2007 2:23 PM Copyright 2007 Business Objects. All rights reserved. Page 10