Securing Information platform services
The Information platform services authentication provider supports anonymous single sign-on for the
Guest account. Thus, when users connect to Information platform services without specifying a user name and password, the system logs them on automatically under the Guest account. If you assign a secure password to the Guest account, or if you disable the Guest account entirely, you disable this default behavior.
6.10 Processing extensions
Information platform services allows you to further secure your reporting environment through the use of customized processing extensions. A processing extension is a dynamically loaded library of code that applies business logic to particular Information platform services view or schedule requests before they are processed by the system.
Through its support for processing extensions, the Information platform services administration SDK essentially exposes a "handle" that allows developers to intercept the request. Developers can then append selection formulas to the request before the report is processed.
A typical example is a report-processing extension that enforces row-level security. This type of security restricts data access by row within one or more database tables. The developer writes a dynamically loaded library that intercepts view or schedule requests for a report (before the requests are processed by a Job Server, Processing Server, or Report Application Server). The developer's code first determines the user who owns the processing job; then it looks up the user's data-access privileges in a third-party system. The code then generates and appends a record selection formula to the report in order to limit the data returned from the database. In this case, the processing extension serves as a way to incorporate customized row-level security into the Information platform services environment.
Tip:
By enabling processing extensions, you configure the appropriate Information platform services server components to dynamically load your processing extensions at runtime. Included in the SDK is a fully documented API that developers can use to write processing extensions. For more information, see the developer documentation available on your product distribution.
6.11 Overview of Information platform services data security
Administrators of Information platform services systems manage the way sensitive data is secured through the following:
• A security setting at the cluster level that determines which applications and clients can access the
CMS. This setting is managed through the Central Configuration Manager.
• A two-key cryptography system that controls both access to the CMS repository, and keys used to encrypt/decrypt objects within the repository. Access to the CMS repository is set via the Central
99 2012-11-26
