Hi ALL, OBIEE 11g can work with many Authentication Providers. OBIEE 11g provides default authentication to connect with Enterprise Manager, Analytics, and Weblogic Server. Some companies struggled with the configuration using other third party providers. I worked with some customers to configure out the OBIEE 11g security with Microsoft Active DirectoryActive Directory Configuration With Weblogic.
Create a user in Active Directory , here it is deva
The Below Screen Shot Shows user deva Properties
CN=deva,OU=Accounts,OU=OBIEE,OU=IN,DC=reg1,DC=uat1Hex,DC=Hex,DC=comRequired info from LDAP team:1) LDAP server Host name and Platform(OS Type)
2) LDAP Server IP
3) LDAP Server Port no
4) User Path structure (Object )ex.: like UAT1Hex path structure (Path : Functional user ID)GROUP:CN=Hex_BIUser,OU=Groups,OU=Accounts,OU=OBIEE,OU=IN,DC=reg1,DC=uat1Hex,DC=Hex,DC=comIN/OBIEE/accounts/Hex_1Bank
SG= OU folder
sub folder
OBIEE
sub folder
Accounts5) Group Path Structure (Object)
like e.x: (Path : Functional usergroup)
reg1.uat1Hex.Hex.com/IN/OBIEE/Accounts/Groups/Hex_BIUser.6) Access required for our functional ID: deva
--------------------------------------------------------------------------1) ldifd.tex files ---> permission required for our functional ID(deva)
2) Windows Active Directory access required for our functional ID(deva)
3) Access requred for functional id user (deva) to properties of the user in ADOracle BI EE version 11.1.1.5.0 and Microsoft Active Directory 2008 (Windows Server 2008 R2 version 64 bit type). Configuring Active Directory Authenticator in Weblogic
Now click finish and then go to the default Authenticator’s setting and select sufficient Control Flag as sufficient. Reorder the MSAD as first, like below, finaly the orderSave the settings and go to the Provder specific TAB.
Enter Host, and port will be the default port and principal as Example of LDAP Configuration for Provider Specific:
---------------------------------------------------------------------------Host:
10.10.10.10
Port
3268
Principal
CN=deva,OU=FNDEPT,OU=MAIL,OU=SW2,OU=NDS,DC=reg1,DC=Hex,DC=Tech,DC=com
Credential:
ldap deva functional id password
confirm Credential:
ldap deva functional id password
User Base DN:
DC=Hex,DC=Tech,DC=com
All Users Filter:
(&(memberof=CN=01UREG1GPCOBIEE,OU=GPCOBIEE,OU=APPS,DC=reg1,DC=Hex,DC=Tech,DC=com)(sAMAccountName=*)(objectclass=user))
User From Name Filter:
(&(memberof=CN=01UREG1GPCOBIEE,OU=GPCOBIEE,OU=APPS,DC=reg1,DC=Hex,DC=Tech,DC=com)(sAMAccountName=%u)(objectclass=user))
User Name Attribute:
sAMAccountName
User Object Class:
user
group base DN
OU=GPCOBIEE,OU=APPS,DC=reg1,DC=Hex,DC=Tech,DC=com
All group filters
(&(sAMAccountName=*)(objectclass=group))
Group From Name Filter:
(&(sAMAccountName=%g)(objectclass=group))
GUID Attribute:
objectguid
after finishing above steps save it and restart all your BI Services then login weblogic console then
check it whether the MSAD is integrated or not yet.. below screen u can find Provider type as MSAD and Defaultauthenditactor like that.Now to security realm->roles and policies->roles
Go to the global roles in that Admin role and view the conditions.
As shown in the below screenshot
Go to the below weblogic console then set global admin role to the AD user (deva) Select View Role Conditions and the below screen will appear
select user then add it our AD user (deva)Now add the condition.
Select User and click next and then In the user Argument Description type the ad username and then click add
Restart weblogic server.............
Now login to the admin console and go to the users and group “deva” is displayed in the below screen
After you login you can see that now we have successfully logged in as AD userIn the Edit Application Role screen, scroll down to the Users section and click on the button marked “Add User”.
An Add User dialog will appear. Either type your system user username into the User Name box or for a full list of users, leave it blank.
screen and select the “Configure…” button to bring up the Identity Store Configuration screen. Click on the green + icon to add the new properties to the Identity Store and as stated above, two new properties need to be added, user.login.attr and username.attr, both set to the value of the alternate user name attribute.
add the AD group or AD users into the Application role
To regenerate user GUIDs:
1. Update the FMW_UPDATE_ROLE_AND_USER_REF_GUIDS
parameter in NQSConfig.INI:
a. Open NQSConfig.INI for editing at:
b. ORACLE_INSTANCE/config/OracleBIServerComponent/coreapplication_obisn
c. Locate the FMW_UPDATE_ROLE_AND_USER_REF_GUIDS
parameter and set it to YES
, as follows:
d. FMW_UPDATE_ROLE_AND_USER_REF_GUIDS = YES;
e. Save and close the file.
2. Update the Catalog element in instanceconfig.xml:
a. Open instanceconfig.xml for editing at:
b. ORACLE_INSTANCE/config/OracleBIPresentationServicesComponent/
c. coreapplication_obipsn
d. Locate the Catalog element and update it as follows:
e. <Catalog>
f. <UpgradeAndExit>false</UpgradeAndExit>
g. <UpdateAccountGUIDs>UpdateAndExit</UpdateAccountGUIDs>
h. </Catalog>
i. Save and close the file.
3. Restart the Oracle Business Intelligence system components using opmnctl:
4. cd ORACLE_HOME/admin/instancen/bin
5. ./opmnctl stopall
6. ./opmnctl startall
7. Set the FMW_UPDATE_ROLE_AND_USER_REF_GUIDS
parameter in NQSConfig.INI back to NO
.
Important: You must perform this step to ensure that your system is secure.
8. Update the Catalog element in instanceconfig.xml to remove the UpdateAccount GUIDs entry.
9. Restart the Oracle Business Intelligence system components again using opmnctl:
10. cd ORACLE_HOME/admin/instancen/bin
11. ./opmnctl stopall
12. ./opmnctl startall
Once you’ve restarted Weblogic, check that you can still log into the Weblogic Administrative Console as the Weblogic admin user you specified during install.
Next check you can log in to Oracle BI using the credentials of one of the Active Directory users.
References:
Thanks
Deva