Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS...
Transcript of Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS...
![Page 1: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/1.jpg)
Bob Hoffman Information Builders
Securing WebFOCUS – A Primer
1
![Page 2: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/2.jpg)
Agenda
Gain an understanding of the WebFOCUS Architecture •Where can security be implemented?
Review the internal WebFOCUS repository and resource templates.
Review securing the communications layer.
Review how to integrate WebFOCUS with external security provider.
2
![Page 3: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/3.jpg)
Discuss Security What should we think about in regards to security?
Encrypting the transport protocol. • Prevent an attacker from being able to “sniff” the
network to obtain data, passwords…
Authentication •Make sure that the user is who they say they are!
Authorization •Make sure that the authenticated users can only
do what they are permitted to do.
3
![Page 4: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/4.jpg)
WebFOCUS Architecture A basic WebFOCUS report request
4
Web Server
Users
Data Source
The Reporting Server does any additional calculations, joins… and formats it into the desired output (HTML, EXCEL, PDF…) The report is then passed back to WebFOCUS. (Once the report is returned to WebFOCUS, the
“agent” on the Reporting Server is released, making its resources available to subsequent requests)
WebFOCUS delivers the report to the user.
WebFOCUS interprets the request that the user made, and requests the Reporting
Server to execute the report.
The Reporting Server reviews the request, and determines
how and where to retrieve the data. It requests the data of
the data source.
The data source processes the data request, and
returns the smallest data set possible to the Reporting Server.
User requests a report from WebFOCUS.
(This is done through a URL call to the
WebFOCUS servlet)
![Page 5: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/5.jpg)
WebFOCUS 8 Repository
WebFOCUS Managed Reporting has a built in repository that manages all of the WebFOCUS content, as well as controls who has access to that content.
This can be used on it’s own, or in conjunction with external security providers.
5
![Page 6: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/6.jpg)
WebFOCUS 8 Repository
6
The WebFOCUS Repository contains all the WebFOCUS content: Folders, Reports,
Report Objects, HTML pages, Portals and Schedules.
This is a view of the WebFOCUS
Content Tree.
![Page 7: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/7.jpg)
WebFOCUS 8 Repository
7
In the repository you can also manage WebFOCUS users and
groups.
This is a view of the WebFOCUS Security Center.
![Page 8: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/8.jpg)
WebFOCUS 8 Repository
8
On every object in the content tree, users and/or groups can be
mapped to specific rules.
This allows for greater control for administrators to delegate who can do what with every
object in the repository.
However, this can also become very complicated!
![Page 9: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/9.jpg)
Resource Templates are there to make managing security
easier. • They allow you to easily create a content folder, portal,
groups and associated rules. • Each template creates several sub-groups that have
appropriate rules already applied to the content folder and portal. • Administrator, Developer, Advanced User, and Basic
User. • All you need to do is add users to the appropriate group
to give them the desired access to WebFOCUS content. • Out of the box we provide an Enterprise Template, as well
as several SaaS Templates. WebFOCUS also allows you to customize these templates, or
create your own.
9
Resource Templates
![Page 10: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/10.jpg)
Resource Templates Built-in Resource Templates
10
![Page 11: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/11.jpg)
Resource Templates Built-in Resource Templates
11
Enterprise Group Administrators Can • Create new users (WF puts them into the parent group) • Edit properties of users in their parent group • They can see all users and add anyone to their sub-groups
SaaS Group Administrators • Cannot create new users • Can only manage group membership of their users
![Page 12: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/12.jpg)
Resource Templates Consider Your User Role Requirements
12
![Page 13: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/13.jpg)
Discuss Security What should we think about in regards to security?
Encrypting the transport protocol. • Prevent an attacker from being able to “sniff” the
network to obtain data, passwords…
Authentication •Make sure that the user is who they say they are!
Authorization •Make sure that the authenticated users can only
do what they are permitted to do.
13
![Page 14: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/14.jpg)
14
Web Server
WebFOCUS Security Where can the transport layer be encrypted?
Users
Data Source
Communications between the user
and WebFOCUS can be encrypted.
Communications between
WebFOCUS and the Reporting Server
can be encrypted.
Depending on the RDBMS, communications between the Reporting
Server and a RDBMS can be encrypted.
HTTPS TSL Native RDBMS
Encryption
![Page 15: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/15.jpg)
Discuss Security What should we think about in regards to security?
Encrypting the transport protocol. • Prevent an attacker from being able to “sniff” the
network to obtain data, passwords…
Authentication •Make sure that the user is who they say they are!
Authorization •Make sure that the authenticated users can only
do what they are permitted to do.
15
![Page 16: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/16.jpg)
WebFOCUS Security Where can authentication be done?
16
Web Server
Users
Data Source
WebFOCUS can authenticate
externally to LDAP, AD, an RDBMS or to tables in a data
source.
Pre Internal External
user1
Administrators
PM/BasicUsers
WebFOCUS Managed Reporting can authenticate to
it’s internal repository.
Active
Directory COR-WF-PM-CORE
COR-WF-PM-SERVER
Authentication can be performed prior to WebFOCUS by the web server, a third party web authenticator (WebSEAL,
SiteMinder…) or a token handoff from custom applications.
![Page 17: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/17.jpg)
Authentication Pre-Authentication Support
17
Web Server
• IIS/Windows Auth
Web Access Mgt
• CA SiteMinder
• Tivoli WebSEAL…
OpenID
• Google, Yahoo…
• Internal Provider
Custom SSO
• SAML
• SaaS Applications
Single
Sign-on
![Page 18: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/18.jpg)
Authentication Configuring Pre Authentication using IIS/IWA
18
The user does not get prompted for
credentials. The web browser and IIS
automatically handle the authentication.
![Page 19: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/19.jpg)
Discuss Security What should we think about in regards to security?
Encrypting the transport protocol. • Prevent an attacker from being able to “sniff” the
network to obtain data, passwords…
Authentication •Make sure that the user is who they say they are!
Authorization •Make sure that the authenticated users can only
do what they are permitted to do.
19
![Page 20: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/20.jpg)
20
Web Server
Users
Data Source
WebFOCUS can “map” groups in it’s internal repository back to
elements in LDAP, AD, or tables in a data source. This allows
integrated authorization to just about any external source.
Internal External
user1
Administrators
PM/BasicUsers
WebFOCUS Managed Reporting
can authorize access to it’s
internal repository.
Active
Directory COR-WF-PM-CORE
COR-WF-PM-SERVER
WebFOCUS 8 Security Where can authorization of the application be done?
![Page 21: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/21.jpg)
Authentication & Authorization to LDAP Reporting Server LDAP Provider
Directory type is automatically detected
Appropriate defaults are automatically filled in to simplify configuration
Test the provider
Reporting Server
Console
![Page 22: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/22.jpg)
Reporting Server edaprint.log
Authentication & Authorization to LDAP WebFOCUS Trusted Connection to the Reporting Server
Simple one-click setting
&FOCSECUSER &FOCSECGROUP
WebFOCUS
Administration Console
![Page 23: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/23.jpg)
Administrator Maps the Value to a WebFOCUS Group
Resource Templates Can Configure the Mapping
Group DN or attribute value is mapped to WF group
Authentication & Authorization to LDAP WebFOCUS Trusted Connection to the Reporting Server
![Page 24: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/24.jpg)
Authentication & Authorization WebFOCUS External Authorization (to the RS)
WebFOCUS groups
can be mapped to
external groups
Accounts for these users are automatically
created when they first sign-in
User description and
email pulled from
external directory
WebFOCUS
Security Center
![Page 25: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/25.jpg)
WebFOCUS Data Security
Traditional Approach Rules in the MFD or Central DBAFILE
Dynamic DBA Leverages MFD Profile Reads entitlements from file or Table
25
![Page 26: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/26.jpg)
Security is a very broad topic, and it can be as simple, or as complex as your requirements need it to be. This presentation was merely a taste, and did not get into many areas of security that we do support.
The WebFOCUS security manual, in addition to several instructional videos, are available at https://techsupport.informationbuilders.com. These contain everything that was reviewed, and much, much more.
We have resources that can help you from our education and professional services organization. If you need a hand, please contact your account representative to point you in the right direction.
26
Wrap up Where can I find out more?
![Page 27: Securing WebFOCUS A Primer - University of Connecticut · WebFOCUS Architecture A basic WebFOCUS report request 4 Web Server Users Data Source The Reporting Server does any additional](https://reader031.fdocuments.us/reader031/viewer/2022020114/5b527a8f7f8b9a7b648d5de2/html5/thumbnails/27.jpg)
Questions?
27