iServer using Kerberos/AD for Authentication

I have installed iServer Express on a Linux Machine (kernel 2.6.18-164) using CentOS release 5.4 (Final). The Linux machine uses Kerberos 5 to authenticate against Active Directory Domain Controllers running on Windows 2008 SP2. Our SQL servers are using integrated authentication, in other words, SQL Users are authenticated against the same AD used by Kerberos. 
 
We don't want to create or import lists of users, we want to delegate this functionality to Active Directory. 
 
We would like to have integrated privileges plus single sign-on, so usernames & roles are not stored in iServer Express, and the login to iServer Express is handled by Kerberos and Active Directory. 
 
Does anybody have done something similar before? 
 
Thanks, 
 
Rodrigo

Find more posts tagged with

Comments

averma

Hi Rodrigo,
iServer provides a flexible security mechanism that allows you to externalize the authorization and authentication aspects. The specific iServer technologies that address this is called RSSE (Report Server Security Extension) and IPSE (IPortal Security Extension).
RSSE provides SOAP based API's that supports running the security layer as a web service. In your case this web service would have the smarts to interact with AD. iServer comes with some sample RSSE implementation for integration with LDAP. Here is a link to a short wiki article that describes RSSE: http://www.birt-exchange.org/org/wiki/index.php?title=Report_Server_Security_Extention Chapter 11 of the following product documentation has more information on this topic: http://www.birt-exchange.com/be/documentation/Manuals10SP1/using-iserver-integration-tech.pdf

Finally you can extend IPSE to implement your own custom security class for single sign-on. Chapter 8 of the following product documentation has more information on this: http://www.birt-exchange.com/be/documentation/Manuals10SP1/creating-custom-deployment-kit-apps.pdf

Ashwini

johnw

This is a very common request for iServer. The integration point your looking for is called RSSE. What you would build is an RSSE for ActiveDirectory/LDAP, and point the iServer Express instance to the location of that RSSE.

There is an LDAP example that should come with your integration tech.

Carvajal

<blockquote class='ipsBlockquote' data-author="'averma'" data-cid="67713" data-time="1282684153" data-date="24 August 2010 - 02:09 PM">
The specific iServer technologies that address this is called RSSE (Report Server Security Extension) and IPSE (IPortal Security Extension). </blockquote>
 
Hi Averma, 
 
Thank you for your pointers to RSSE and IPSE. I know it will involve some programming and configuration changes in a few systems. I was not expecting an "off the shelf" solution, but probably something easier to implement. 
 
Thanks!