How to Implement Single Sign On (SSO) in OBIEE with Microsoft Active Directory ?

OBIEE LDAP authentication using microsoft Active Directory.

Before starting this, I would prefer that you read my article on session variable and initialized block here

SSO can be implemented using Lightweight Directory Access Protocol (LDAP) in OBIEE.

Most popular LDAP implementation for OBIEE is either OID (Oracle internet Directory) or Microsoft Active Directory (AD). And no wonder why LDAP authentication is supported more on OID and not AD (yeah Oracle v/s Microsoft). This does not mean we can not achieve SSO using LDAP for AD. Yes we can. But with little different implementation style and some limitations. (Oracle documentation talks about all OID and nothing at all for AD)

So Here I am going to discuss on how to implement LDAP authentication for AD to achieve SSO.

Below are the implementation step:

Setting up LDAP Server , Initialization Block and Session Variables

Step 1: Create LDAP Connection.

Open OBIEE Administration.

Go to Manage — > Security

Manage Security.

Select LDAP Servers : on the right side right click and select New LDAP Server

Security Manager

LDAP Connection

LDAP Connection Advance

Step 2: Create  initialization block and session variable

Go to Manage — > Variables

Click Session — > Initialization Block right click on the pan select New Initialization Block

Session Variable Initialization Block

Give the name to the Initialization Block e.g initLDAP

As a part of configuring Initialization Block you need to provide

Click on Edit Data Source

Data Source Type : select LDAP then click on Browse and select appropriate LDAP server connection

Data Source

Click on Edit Data Target

Session Variable

Click on New and you will see the screen like below

User Session Variable

Click ok you will and warning message as below. Just ignore it, as it warns that you are using USER session variable and it has special meaning

User Warning

User LDAP Variable

Here we have just create only one session variable which takes information from LDAP. We can create many such variable like groups( has limitation AD which i am going to discuss in detail) , display name etc etc whatever is available on LDAP.

LDAP admin can help with the name of  variable referred in LDAP

Click on Edit Execution Precedence

If you are using multiple Initialization block then this will be use ful in deciding which block should execute first. As we have just once init block we will not do anything here.

Click on Test

Enter LDAP  UserId and password, in sAMAccountName it should show the user Id which indicates the LDAP connection and hence authentication with LDAP works.

TEST LDAP connection

In the next post I will discuss on how to get group information, limitation of LDAP AD implementaion with OBIEE.

How to enable usage tracking in OBIEE ?
How to perfrom usage audit in OBIEE ?
How to set you Direct Insertion to Collect Information for Usage Tracking ?

Introduction

Oracle BI server supports collection of usage statistics which can use in a variety of ways such as who is running what and when ? database optimization, aggregation strategies, figuring out most used reports, billing departments as per their usage etc etc.

Goal

We want to achieve a reporting for usage in OBIEE. One such sample report is attached. Lots of analysis similar to this can be achieved using the Usage Tacking.

Usage Tracking Report

How it works?

When we enable usage tracking, statistics for every query are inserted into a database table or are written to a usage tracking log file. If you use direct insertion, the Oracle BI Server directly inserts the usage tracking data into a relational database table.

There are two ways to achieve Administration of usage tracking.

• Setting Up Direct Insertion to Collect Information for Usage Tracking
• Setting Up a Log File to Collect Information for Usage Tracking

Oracle Recommendation: Use direct insertion to write statistics to a database table.And I am going to discuss that method here.

Steps to Set Up Direct Insertion to Collect Information for Usage Tracking:

Set 1 : Create a necessary tables to collect usage tracking information.

A. Click here to download SAACCT.Oracle.sql or

Go to \\OracleBI\server\Schema and run the script  SAACCT.Oracle.sql to create table S_NQ_ACCT. This table will hold all the usage tracking information.

B. Go to \\OracleBI\server\Sample\usagetracking

This folder has necessary time series table creation script  and build in repository for usage tracking.

Create a tables using scripts:

Oracle_create_nQ_Clock.sql and Oracle_create_nQ_Calendar.sql

Load data in above tale using  Oracle_nQ_Clock.sql and Oracle_nQ_Calendar.sql script.

Step 2 Import  S_NQ_ACCT into the repository.

Please note: in order for Usage tacking to work properly , one must have to include this table in physical layer.

Step 3  Creating a business and presentation layer.

We will use a repository provided at C:\OracleBI\server\Sample\usagetracking\UsageTracking.rpd So that we want have to create a repositoy from ground zero.

Click  UsageTracking.rpd to down load the usage tracking repository.

Step 4 Change configuration file.

This is most important step in setting up usage tracking.

Go to \\OracleBI\server\Config and open NQSConfig.INI.

We have to make the change in [ USAGE_TRACKING ] portion of the config file.

Change DIRECT_INSERT                  = YES;
Along with this we have change the connection properties as well.
–PHYSICAL_TABLE_NAME
–CONNECTION_POOL

Change below parameter for better insertion performance and insertion control

–BUFFER_SIZE
–BUFFER_TIME_LIMIT_SECONDS
–NUM_INSERT_THREADS
–MAX_INSERTS_PER_TRANSACTION

Please refer below screen shot for more detail.
Note : Any typo will hold server from starting.

NQSConfig DIRECT_INSERT

Step 5 Check results to see every things is working.

Copy repository UsageTracking.rpd to OracleBI\server\Repository\
make Star = UsageTracking.rpd, DEFAULT; in NQSconfig file.

Restart BI server. If server fails to start check possible typo in NQSConfig

Check the Answers to see various analysis available for Usage Tracking.

Once should be able to see the reporting as shown below.

Usage Tracking Report

Below is the list of OBIEE components (programs) and services responsible to run them. Below article is based on Windsow environment.

1) Oracle Business Intelligence Server (Oracle BI Server)
2) Oracle Business Intelligence Presentation Services (Oracle BI Presentation Server)
3) Oracle Business Intelligence Javahost (Oracle BI Java Host)
4) Oracle Business Intelligence Scheduler (Oracle BI Scheduler)
5) Oracle Business Intelligence Cluster Controller ( Oracle BI Cluster Controller)

If you followed the default installation then first 3 services will have start up type as Automatic and 4th and 5th will have start up type as Manual.

Please note that in Oder to enable Scheduler and Cluster Controller additional configuration is required. That will be discussed in separate post.

Below Screen print shows those services.

OBIEE Services

If changes have been made to Oracle BI serve’s configurations, repository files, Web Catalog for Answers , other configurations etc then above services needs restart.

Please not that order in which services are being restarted is very important. And it is as below.

1) Oracle Business Intelligence Server (Oracle BI Server)
2) Oracle Business Intelligence Presentation Services (Oracle BI Presentation Server)
3) Oracle Business Intelligence Javahost (Oracle BI Java Host)
4) Oracle Business Intelligence Scheduler (Oracle BI Scheduler)
5) Oracle Business Intelligence Cluster Controller ( Oracle BI Cluster Controller)

Important this is not all services needs restart each time you make any of the changes describe. It mainly depends on the changes or rather type of change you are making.

Requirement : Often time its really a pain to create users in bulk.So below script will be helpful to create users with default password.

Step 1: Create the script as shown below.
This script basically creates a declaration syntex for OBIEE.

Run the SQL Command like to Generate the File Called : userImport.udml (or you may use excel or something else )

SELECT
‘DECLARE USER “‘|| Sales_person ||’” AS “‘||Sales_person ||’” UPGRADE ID 1121 FULL NAME {’||Sales_Person_Name||’} PASSWORD ”’Welcome”’ PRIVILEGES ( READ);’ FROM tbl_sales_person
Modify the script according to the usage.

save the output of the above sql command to a file called
userImport.udml

Step 2: Run the command to load the users
Once above file is ready locate the exe file called nqudmlexec.exe

(History : nqudmlexec.exe – check the name, it starts with nq. Siebel had acquired nQuire Software in 2001. Still lots of logs, exes still have prefix nq)

Run the below command to
C:\OracleBI\server\Bin>nqudmlexec -U -P
I userImport.udml -B Security.rpd -O Security1.rpd

Importing OBIEE Users to repository