Authentication
8.3.1 Using LDAP authentication
This section provides a general description of how LDAP authentication works with BI platform. It then introduces the administration tools that allow you to manage and configure LDAP accounts to the platform.
When you install BI platform, the LDAP authentication plug-in is installed automatically, but not enabled by default. To use LDAP authentication, you need to first ensure that you have your respective LDAP directory set up. For more information about LDAP, refer to your LDAP documentation.
Lightweight Directory Access Protocol (LDAP), a common, application-independent directory, enables users to share information among various applications. Based on an open standard, LDAP provides a means for accessing and updating information in a directory.
LDAP is based on the X.500 standard, which uses a directory access protocol (DAP) to communicate between a directory client and a directory server. LDAP is an alternative to DAP because it uses fewer resources and simplifies and omits some X.500 operations and features.
The directory structure within LDAP has entries arranged in a specific schema. Each entry is identified by its corresponding distinguished name (DN) or common name (CN). Other common attributes include the organizational unit name (OU), and the organization name (O). For example, a member group may be located in a directory tree as follows: cn=BI platform Users, ou=Enterprise Users A, o=Research.
Refer to your LDAP documentation for more information.
Because LDAP is application-independent, any client with the proper privileges can access its directories.
LDAP offers you the ability to set up users to log on to BI platform through LDAP authentication. It provides users with access rights to objects in the system. As long as you have an LDAP server (or servers) running, and use LDAP in your existing networked computer systems, you can use LDAP authentication (along with Enterprise, and Windows AD authentication).
If desired, the LDAP security plug-in provided with BI platform can communicate with your LDAP server using an SSL connection established using either server authentication or mutual authentication. With server authentication, the LDAP server has a security certificate which BI platform uses to verify that it trusts the server, while the LDAP server allows connections from anonymous clients. With mutual authentication, both the LDAP server and BI platform have security certificates, and the LDAP server must also verify the client certificate before a connection can be established.
The LDAP security plug-in provided with BI platform can be configured to communicate with your LDAP server via SSL, but always performs basic authentication when verifying users' credentials. Before deploying LDAP authentication in conjunction with BI platform, ensure that you are familiar with the differences between these LDAP types. For details, see RFC2251, which is currently available at http://www.faqs.org/rfcs/rfc2251.html
.
Related Topics
•
Configuring LDAP authentication
•
Mapping LDAP groups
230 2012-12-12
