Authentication
8.1.1 Primary authentication
Primary authentication occurs when a user first attempts to access the system. One of two things can happen during primary authentication:
• If single sign-on is not configured, the user provides their credentials, such as their user name, password and authentication type.
These details are entered by the users on the logon screen.
• If a method of single sign-on is configured, the credentials for the users are silently propagated.
These details are extracted using other methods such as Kerberos or SiteMinder.
• The authentication type may be Enterprise, LDAP, Windows AD, SAP, Oracle EBS, Siebel, JD
Edwards EnterpriseOne, PeopleSoft Enterprise depending upon which type(s) you have enabled and set up in the Authentication management area of the Central Management Console (CMC).
The user's web browser sends the information by HTTP to your web server, which routes the information to the CMS or the appropriate platform server.
The web application server passes the user's information through a server-side script. Internally, this script communicates with the SDK and, ultimately, the appropriate security plug-in to authenticate the user against the user database.
For instance, if the user is logging on to BI launch pad and specifies Enterprise authentication, the SDK ensures that the BI platform security plug-in performs the authentication. The Central Management
Server (CMS) uses the security plug-in to verify the user name and password against the system database. Alternatively, if the user specifies an authentication method, the SDK uses the corresponding security plug-in to authenticate the user.
If the security plug-in reports a successful match of credentials, the CMS grants the user an active system identity and the following actions are performed:
• The CMS creates an Enterprise session for the user. While the session is active, this session consumes one user license on the system.
• The CMS generates and encodes a logon token and sends it to the web application server.
• The web application server stores the user's information in memory in a session variable. While active, this session stores information that allows BI platform to respond to the user's requests.
Note:
The session variable does not contain the user's password.
• The web application server keeps the logon token in a cookie on the client's browser. This is only used for failover purposes, such as when you have a clustered CMS or when BI launch pad is clustered for session affinity.
Note:
It is possible to disable the logon token, However, if you disable the logon token, you will disable failover.
212 2012-12-12
