Processing extensions. SAP 4.1 Support Package 2

Securing the BI Platform

The BI platform supports anonymous single sign-on for the Guest account. Thus, when users connect to the BI platform without specifying a user name and password, the system logs them on automatically under the Guest account. If you assign a secure password to the Guest account, or if you disable the

Guest account entirely, you disable this default behavior.

8.10 Processing extensions

The BI platform allows you to further secure your reporting environment through the use of customized processing extensions. A processing extension is a dynamically loaded library of code that applies business logic to particular BI platform view or schedule requests before they are processed by the system.

Through its support for processing extensions, the BI platform administration SDK essentially exposes a "handle" that allows developers to intercept the request. Developers can then append selection formulas to the request before the report is processed.

A typical example is a report-processing extension that enforces row-level security. This type of security restricts data access by row within one or more database tables. The developer writes a dynamically loaded library that intercepts view or schedule requests for a report (before the requests are processed by a Job Server, Processing Server, or Report Application Server). The developer's code first determines the user who owns the processing job; then it looks up the user's data-access privileges in a third-party system. The code then generates and appends a record selection formula to the report in order to limit the data returned from the database. In this case, the processing extension serves as a way to incorporate customized row-level security into the BI platform environment.

By enabling processing extensions, you configure the appropriate BI platform server components to dynamically load your processing extensions at runtime. Included in the SDK is a fully documented API that developers can use to write processing extensions. For more information, see the developer documentation available on your product distribution.

8.11 Overview of BI platform data security

Administrators of BI platform systems manage the way sensitive data is secured through the following:

• A security setting at the cluster level that determines which applications and clients can access the

CMS. This setting is managed through the Central Configuration Manager.

• A two-key cryptography system that controls both access to the CMS repository, and keys used to encrypt/decrypt objects within the repository. Access to the CMS repository is set via the Central

Configuration Manager, while the Central Management Console has a dedicated management area for cryptographic keys.

These features allow administrators to set BI platform deployments to particular data security compliance levels and to manage encryption keys used to encrypt and decrypt data within the CMS repository.

163 2013-11-21