14 Maintaining security with OracleBI Discoverer

14.5.1 About Discoverer public connections and the OracleAS Security model

Discoverer managers can give users access to information by using Oracle Application Server Control to create public connections. Each connection specifies an EUL containing one or more business areas.

Discoverer managers can control users' access to information by restricting users to using public connections or by giving users permission to create their own private connections.

For more information about connections, see Chapter 4, "Managing OracleBI Discoverer connections".

14.6.1 About specifying Discoverer communication protocols

You can use Discoverer in different network environments that might or might not include firewalls using different communication protocols (i.e. JRMP, HTTP, HTTPS).

The most appropriate network environment depends on both existing network strategies in your organization as well as your requirements for:

• performance (how long it takes to display information)

• accessibility (whether data has to be accessed through a firewall)

• security (how secure the data needs to be during transmission)

Note that you must use HTTPS if you want to make sure that sensitive information (e.g. passwords, data) is securely transmitted across a network.

Discoverer Viewer and Discoverer Plus require different security configurations:

• for more information about configuring security for Discoverer Viewer, see Section 14.6.2, "About Discoverer Viewer security and communication protocols"

• for more information about configuring security for Discoverer Plus, see Section 14.6.3, "About Discoverer Plus security and communication protocols"

Notes

• If you are deploying OracleBI Discoverer with OracleAS Web Cache, there are security implications for some restricted user environments.

  For more information, see:

  • Section 8.4, "When to use Discoverer Viewer with OracleAS Web Cache"

  • Oracle Application Server Security Guide

• If you have deployed Discoverer in a multiple machine installation, note that you might want to specify different communication protocols on different Discoverer middle tier machines. For example, you might use:

  • the JRMP protocol on one machine for Plus users working inside a firewall

  • the HTTPS protocol on two other machines for Viewer users accessing reports across the Web

14.6.2 About Discoverer Viewer security and communication protocols

Discoverer Viewer uses standard HTTP or HTTPS protocols to connect Discoverer Viewer clients to the Discoverer servlet.

Note: Discoverer Viewer client machines require only a standard Web browser to run Discoverer Viewer.

In a default OracleAS installation, Discoverer Viewer is configured as follows:

• In a HTTP environment, no additional security configuration is required. If you are using a firewall, open the firewall for the Oracle HTTP Server port used by OracleAS (e.g. 80).

• If you are using a firewall, open the firewall for the Oracle HTTP Server SSL port used by OracleAS (e.g. 4443). In a HTTPS environment, Discoverer Viewer uses SSL security certificates on the client machine's browser. If you are using a non-standard or private SSL signing authority, you need to install the root certificates in the browser. For more information about deploying Discoverer Viewer over HTTPS, see Section 3.5, "About running Discoverer over HTTPS").

14.6.3 About Discoverer Plus security and communication protocols

Discoverer Plus uses standard Java Remote Method Protocol (JRMP), HTTP, or HTTPS protocols to connect clients to the Discoverer servlet.

Discoverer Plus uses two communication channels:

• when a Discoverer Plus client first connects to the Discoverer servlet, the Discoverer Plus applet is downloaded and installed on the Discoverer client machine

• after the Discoverer Plus applet is installed on the Discoverer client machine, the Discoverer Plus client machine uses one of JRMP, HTTP, or HTTPS to communicate with the Discoverer servlet

In a default OracleAS installation, Discoverer Plus is configured as follows, depending on the environment:

• In an Intranet environment (i.e. inside firewalls), no additional security configuration is required. Discoverer Plus clients connect to the Discoverer servlet using the JRMP protocol.

  Make sure that the default Discoverer Plus communication protocol (i.e. Default) is selected (for more information, Section 14.6.3.4, "How to set up Discoverer Plus to use the Default communication protocol").

• In a HTTPS environment, Discoverer Plus uses security certificates on the client machine's browser. When you run Discoverer Plus for the first time over HTTPS (i.e. in Secure Sockets Layer (SSL) mode), you need to install your Web server's security certificate into the Java Virtual Machine (JVM) certificate store in all client machines that need to run Discoverer Plus.

  Note: To deploy Discoverer Plus over HTTPS, you must select the Secure Tunneling security protocol in Oracle Application Server Control (Section 14.6.3.6, "How to set up Discoverer Plus to use the Secure Tunneling communication protocol").

  For more information about deploying Discoverer Plus over HTTPS, see Section 3.5, "About running Discoverer over HTTPS").

  If you are using a non-standard SSL signing authority, you might need to configure the certdb.txt file on client machines (for more information, see Section 14.6.3.1, "About configuring Discoverer Plus for a non-standard SSL signing authority"). If you are using a firewall, open the firewall for the Oracle HTTP Server SSL port used by OracleAS (e.g. port 4443 on a UNIX middle tier or 443 on a Windows middle tier).

Notes

• You typically use the same communication protocol to download the Discoverer applet as you do for communication with the Discoverer servlet (for more information, see Section 14.6.3.2, "About specifying a Discoverer Plus communication protocol").

14.7.1 Using Discoverer with OracleAS Single Sign-On

This section describes OracleAS Single Sign-On and how to use it with Discoverer.

14.7.2 What is OracleAS Single Sign-On?

OracleAS Single Sign-On is a component of Oracle Application Server that enables users to access multiple Web applications (e.g. OracleBI Discoverer and OracleAS Portal) using a single user name and password that is entered once.

Note: OracleAS Single Sign-On is implemented using Oracle Single Sign-On Server.

14.7.2.3 An example showing how Discoverer works with OracleAS Portal and Single Sign-On

When you publish Discoverer content in a portlet on an OracleAS Portal page, you give portal users access to the Discoverer workbooks and worksheets. However, portal users accessing Discoverer workbooks only see data to which they have database access. In other words, two different users accessing the same workbook might see different data, depending on their database privileges. For more information, see Section 11, "Using OracleBI Discoverer with OracleAS Portal".

To illustrate how OracleBI Discoverer works with OracleAS Portal, consider the following example:

Imagine that there are two Single Sign-On users:

• User SSO-A has a private connection Conn-A pointing to DBUSER-A@discodb, EUL-Marketing.

• User SSO-B has a private connection Conn-B pointing to DBUSER-B@discodb, EUL-Marketing.

User SSO-A using connection Conn-A creates two workbooks Workbook 1 and Workbook 2 in the Marketing EUL. User SSO-A uses Discoverer Plus to share Workbook 2 with DBUSER-B.

User SSO-B using connection Conn-B creates two workbooks Workbook 3 and Workbook 4 in the Marketing EUL. User SSO-B uses Discoverer Plus to share Workbook 4 with DBUSER-A.

This situation is shown in the figure below:

Figure 14-1 Single Sign-On users creating workbooks

Description of "Figure 14-1 Single Sign-On users creating workbooks"

Now imagine that user SSO-A creates a List of Worksheets portlet using Conn-A, and chooses the 'Use user's database connection' option in the Logged In users section (i.e. in the Select Database Connections page in the Discoverer Portlet Provider).

When user SSO-A accesses the List of Worksheets portlet, worksheets in the following workbooks are available:

• Workbook 1

• Workbook 2

• DBUSER-B.Workbook 4

When user SSO-B accesses the same List of Worksheets portlet, worksheets in the following workbooks are available:

• Workbook 3

• Workbook 4

• DBUSER-A.Workbook 2

This situation is shown in the figure below:

Figure 14-2 Single Sign-On users accessing Discoverer portlets

Description of "Figure 14-2 Single Sign-On users accessing Discoverer portlets"

14.7.3 Using Discoverer without Single Sign-On

If you are not deploying Discoverer with Single Sign-On, end users must confirm the database password each time a private connection is used. In other words, when a Discoverer end user chooses a private connection for the first time in a browser session, they are prompted to confirm the database password.

If the end user closes the Web browser and then starts the Web browser again (i.e. creates a new browser session), they are prompted to confirm their database password. End users do not have to confirm passwords for public connections (for more information, see Section 4.2.2, "About public connections").

Notes

• To store private Discoverer connections in non-SSO environments, cookies must be enabled in the Web browser.

• In non-SSO environments, a Discoverer end user can only access private connections created using the current machine and current Web browser. If an end user wants to use a different machine or different Web browser, they must re-create the private connections.

14.8.1 Introducing Virtual Private Databases, Single Sign-On, and Discoverer

The Oracle9i Release 1 (and later) Enterprise Edition database's powerful Virtual Private Database (VPD) feature enables you to define and implement custom security policies. Among other things, the VPD feature enables you to enforce fine-grained access control based upon attributes of a user's session information (referred to as application context). This VPD functionality is commonly employed as a way of controlling access to data using the currently logged-on user's Single Sign-On (SSO) identity. For more information about setting up a VPD, see Oracle9i Application Developer's Guide - Fundamentals.

If Discoverer has been configured to require SSO authentication, Discoverer can pass a Discoverer end-user's SSO user name to the database (as the CLIENT_IDENTIFIER attribute of the built-in application context USERENV). Providing a VPD policy based on SSO user names has been implemented in the database, the data returned to a Discoverer worksheet will be restricted to the data that the SSO user is authorized to access.

You can optionally add user-defined PL/SQL statements to both database LOGON (and subsequent) triggers and to a Discoverer trigger (eul_trigger$post_login) to use the SSO user name to further control the data that is returned. You can use the database and Discoverer triggers separately or in conjunction with each other.

14.8.2 Example showing how SSO user names can limit Discoverer data

The Discoverer manager at Acme Corp. does the following:

1. Configures the Discoverer middle tier machines so that SSO authentication is necessary to access the Discoverer URLs.

2. Creates a Discoverer public connection called 'Analysis', that has access to a workbook called 'Sales'.

3. Creates a VPD policy against the base tables of the workbooks. The VPD policy determines the data that is returned, based on the value of a variable called 'CONTEXT1'.

4. Creates a database LOGON trigger that sets variable CONTEXT1 to the value of the SSO user name (extracted from the application context information passed to the database by Discoverer).

The Sales workbook is used by two Discoverer users at ACME Corp., Fred Bloggs and Jane Smith. A typical workflow for these two users is shown below:

1. User 'Fred.Bloggs' authenticates via SSO and accesses the top level Discoverer URL.

2. Fred selects the public connection 'Analysis', and opens the workbook 'Sales'.

3. Fred views the data in the default worksheet, and then logs out.

4. User 'Jane.Smith' authenticates via SSO and accesses the top level Discoverer URL.

5. Jane selects the public connection 'Analysis', and then opens workbook 'Sales'.

6. Jane views the data in the default worksheet.

Jane sees different data to Fred, despite the identical database connection, workbook, worksheet and database query. The difference is determined by the VPD policy being based on SSO user identities.

14.8.3 What tasks are required to use SSO user names to limit Discoverer data

Before the data shown in a Discoverer worksheet can be controlled using SSO user names, a Discoverer manager performs the following tasks:

• configures the Discoverer middle tier machines so that SSO authentication is necessary to access the Discoverer URLs (for more information, Section 14.7.2.2, "How to enable and disable Single Sign-On for Discoverer")

• creates a Discoverer public connection, with access to one or more workbooks (for more information, see Section 4.6, "How to create public connections")

• creates a VPD policy against the base tables of the workbooks, if one does not exist already (for more information about how to create a VPD policy, see Oracle9i Application Developer's Guide - Fundamentals

• (optional) configures a Discoverer Worksheet portlet to use SSO user names (for more information, see Section 14.8.4, "How to set up Discoverer Worksheet Portlets to show different data based on SSO user name")

• (optional) creates or modifies database LOGON (and subsequent) triggers to use the SSO user name to further control the data that is available to the SSO user (for more information, see Section 14.8.6, "How to modify database LOGON (and subsequent) triggers to use the SSO user name")

• (optional) creates a function to be executed by the eul_trigger$post_login trigger, and registers the function using Discoverer Administrator (for more information, see Section 14.8.7, "How to use the eul_trigger$post_login trigger")

14.8.4 How to set up Discoverer Worksheet Portlets to show different data based on SSO user name

Having created a VPD policy in the database that uses SSO user names to determine the data that users can access, you can set up a Discoverer Worksheet portlet to only show the data that can be accessed by the current SSO user name.

To specify that users only see the data they can access with their SSO user name:

1. In the Users Logged In region of the Select Database Connections setup page for the Discoverer Worksheet Portlet.

2. Select the Display different data using the Publisher's connection radio button.

   
   Description of the illustration portal_14.gif
   
   

   When you select the above option, Discoverer passes the worksheet portlet user's SSO user name to the database. The VPD policy can then use the SSO user name to restrict the data that is returned to the worksheet portlet.

14.8.5 When to use other options in the Users Logged In region of the Select Database Connections page

If you want all users to always see the same data from the database regardless of their own database user names or SSO user names, do the following in the Select Database Connections setup page for the Discoverer Worksheet Portlet:

1. Select the Display same data to all users using <Publisher's Connection> radio button.

If you want users to initially see the same data from the database (regardless of their own database user names or SSO user names) but to give them the option of specifying an alternative database user name:

1. Select the Display different data by allowing users to customize database connection radio button.

2. Select the Show default data using <Publisher's Connection> check box.

14.8.6 How to modify database LOGON (and subsequent) triggers to use the SSO user name

You can modify database LOGON (and subsequent) triggers to use the SSO user name passed by Discoverer to further control the data that is available to the SSO user. For example, you might want to call custom PL/SQL functions that take the SSO user name to perform application specific initialization.

To modify database triggers to use the SSO user name:

1. Create a suitable database trigger.

2. Add the required code to manipulate the SSO user name.

   Hint: To return the SSO user name passed by Discoverer, query the CLIENT_IDENTIFIER attribute of the USERENV application context namespace using the following function call:

   SYS_CONTEXT('USERENV', 'CLIENT_IDENTIFIER')

Notes

• The SSO user name passed by Discoverer is available as early as the execution of the database LOGON trigger.

• If Discoverer has not been configured to use SSO, the SYS_CONTEXT function call above will return NULL.

• The SSO user name is only available with Oracle9i Release 1 (and later) databases.

14.8.7 How to use the eul_trigger$post_login trigger

You can use the eul_trigger$post_login trigger instead of, or in conjunction with, the database LOGON (and subsequent) triggers to further control the information that is displayed in a Discoverer worksheet based on the SSO user name. Use the eul_trigger$post_login trigger (rather than the database triggers) if:

• you want trigger code to affect just Discoverer users, not all database users

• you do not have DBA privilege (and therefore cannot modify the database LOGON (or subsequent) trigger code)

To use the eul_trigger$post_login trigger:

1. Define a PL/SQL function in the database that:

   • has a return type of integer

   • does not take any arguments

2. Add the required code to manipulate the SSO user name.

   Hint: To return the SSO user name passed by Discoverer, query the CLIENT_IDENTIFIER attribute of the USERENV application context namespace using the following function call:

   SYS_CONTEXT('USERENV', 'CLIENT_IDENTIFIER')

3. Register the function with Discoverer Administrator and give it the following properties:

   • Name: eul_trigger$post_login

   • Return type: Integer

   • Arguments: none

     For more information about registering PL/SQL functions and using Discoverer EUL triggers, see the Oracle Business Intelligence Discoverer Administration Guide.

4. If the Database/EnableTriggers preference exists in the pref.txt file, set it to a value other than zero.

Notes

• If the Database/EnableTriggers preference does not exist in the pref.txt file, do not create it.

• If the Database/EnableTriggers preference does exist and you have to change its value (i.e. to make it non-zero), you must subsequently:

  1. Run the applypreferences script to apply the preference change.

  2. Stop and restart the OracleBI Discoverer service for the change to take effect.

14.9.1 What is a firewall?

A firewall is one system or a group of several systems put in place to enforce a security policy between the Internet and an organization's network.

In other words, a firewall is an electronic 'fence' around a network to protect it from unauthorized access.

Figure 14-3 A typical Internet connection with a Client-side and Server-side firewall

Description of "Figure 14-3 A typical Internet connection with a Client-side and Server-side firewall"

Typically, an organization using a Web Server machine that communicates across the Internet has a firewall between its Oracle HTTP Server machine and the Internet. This is known as a Server-side firewall. Other organizations (or remote parts of the same organization) connecting to this Web Server machine typically have their own firewall, known as a Client-side firewall. Information that conforms to the organization's firewall policy is allowed to pass through the firewalls enabling server machines and client machines to communicate.

14.9.2 What is a demilitarized zone (DMZ)?

A demilitarized zone (DMZ) is a firewall configuration that provides an additional level of security. In this configuration, the DMZ is an extra network placed between a protected network and the Internet. Resources residing within the DMZ are visible on the public Internet, but are secure. DMZs typically hold servers that host a company's public Web site, File Transfer Protocol (FTP) site, and Simple Mail Transfer Protocol (SMTP) server.

Figure 14-4 A Demilitarized Zone (DMZ)

Description of "Figure 14-4 A Demilitarized Zone (DMZ)"

Firewall policies vary across organization and there are a wide variety of bespoke and off-the-shelf firewall packages in use.

A good firewall configuration assumes that resources in the DMZ will be breached, and if this happens should minimize damage to the internal network and any sensitive data residing on the network. This involves two steps:

• move sensitive private resources (at a minimum, databases and application logic) from the DMZ to the internal network behind the internal firewall

• restrict access to sensitive private resources from the DMZ itself, as well as from internal networks

14.9.3 What is HTTPS and why should I use it?

The HTTPS protocol uses an industry standard protocol called Secure Sockets Layer (SSL) to establish secure connections between clients and servers.

The SSL protocol enables sensitive data to be transmitted over an insecure network, such as the Internet, by providing the following security features:

• authentication - a client can determine a server's identity and be certain that the server is not an impostor (and optionally, a client can also authenticate the identity of its server)

• privacy - data passed between the client and server is encrypted so that if a third party intercepts their messages, the third party will not be able to unscramble the data

• integrity - the recipient of encrypted data will know if a third party has corrupted or modified that data

You can tell when SSL is enabled in Discoverer as follows:

• the URL to start Discoverer Plus begins with https://, and a closed padlock appears at the left hand side of the applet's status bar

  Note: To deploy Discoverer Plus over HTTPS, you must select the Secure Tunneling security protocol in Oracle Application Server Control (Section 14.6.3.6, "How to set up Discoverer Plus to use the Secure Tunneling communication protocol").

• the URL to start Discoverer Viewer starts with https://, and a closed padlock or other equivalent symbol (browser dependent) appears in the browser's status bar

14.9.4 How do I configure Discoverer to work in an intranet

You configure Discoverer to work in an intranet as follows:

• Discoverer Viewer

  Deploying Discoverer Viewer in an intranet (i.e. inside a firewall) requires no additional configuration after an OracleAS installation. Discoverer Viewer uses a HTTP connection.

• Discoverer Plus

  Deploying Discoverer Plus in an intranet (i.e. inside a firewall) requires no additional configuration after an OracleAS installation. Discoverer Plus uses a direct connection using JRMP.

Figure 14-5 A typical network configuration for Discoverer in an intranet

Description of "Figure 14-5 A typical network configuration for Discoverer in an intranet"

14.9.5 How do I configure Discoverer to work through a firewall?

You configure Discoverer to work through firewalls with HTTP or HTTPS, as follows:

• Discoverer Viewer

  Discoverer Viewer requires no additional configuration as long as the firewall allows HTTP traffic to pass through.

• Discoverer Plus

  Discoverer Plus requires no additional configuration as long as the firewall allows HTTP or HTTPS traffic to pass through.

  To improve performance on initial connection, you might want to change the Discoverer Plus communication protocol to one of the following:

  • for HTTP, set the communication protocol to Tunneling to prevent the Discoverer client from first trying to connect using JRMP, then by HTTP (for more information, see Section 14.6.3.5, "How to set up Discoverer Plus to use the Tunneling communication protocol").

  • for HTTPS, set the communication protocol to Secure Tunneling to prevent the Discoverer client from first trying to connect using JRMP, then by HTTP, then by HTTPS (for more information, see Section 14.6.3.6, "How to set up Discoverer Plus to use the Secure Tunneling communication protocol").

Figure 14-6 A typical firewall configuration for Discoverer using HTTP

Description of "Figure 14-6 A typical firewall configuration for Discoverer using HTTP"

14.9.6 Can I configure Discoverer to work through multiple firewalls?

Yes, if you are using HTTP or HTTPS, Discoverer will work through multiple firewalls (for more information, see Section 14.9.5, "How do I configure Discoverer to work through a firewall?").

14.9.7 How do I configure Discoverer to use encryption in an intranet?

You configure Discoverer to use encryption as follows:

• Discoverer Viewer

  Configure mod_ossl to use HTTPS (for more information, see Oracle HTTP Server Administrator's Guide) and deploy Discoverer Viewer on a HTTPS URL.

• Discoverer Plus

  Configure mod_ossl to use HTTPS (for more information, see Oracle HTTP Server Administrator's Guide) and deploy Discoverer Plus on a HTTPS URL. You must change the Discoverer Plus communication protocol to Secure Tunneling (for more information, see Section 14.6.3.6, "How to set up Discoverer Plus to use the Secure Tunneling communication protocol").

14.9.8 How do I configure Discoverer to use encryption through firewalls?

You configure Discoverer to use encryption through firewalls as follows:

• Discoverer Viewer

  Configure Discoverer Viewer to work through a firewall (for more information, see Section 14.9.5, "How do I configure Discoverer to work through a firewall?"). Then, make sure that the firewall(s) allow HTTPS traffic to pass through.

• Discoverer Plus

  Configure Discoverer Plus to work through a firewall (for more information, see Section 14.9.5, "How do I configure Discoverer to work through a firewall?"). Then, make sure that the firewall(s) allow HTTPS traffic to pass through.

Figure 14-7 A typical firewall configuration for Discoverer using HTTPS

Description of "Figure 14-7 A typical firewall configuration for Discoverer using HTTPS"

14.9.9 How can I verify that Discoverer is encrypting communications?

In Discoverer Viewer, make sure that client browsers display a closed padlock or other equivalent symbol (browser dependent) in the Discoverer Viewer browser's status bar.

In Discoverer Plus, make sure that the client displays a closed padlock symbol in the bottom left-hand corner of the Discoverer Plus applet window.

14.9.10 Can I configure Discoverer for both intranet users and users accessing Discoverer through a firewall?

Yes, you can configure Discoverer for both intranet users and Internet users. For example, if you use the Default Discoverer Plus communication protocol:

• sessions connecting from inside the firewall use a direct JRMP connection because JRMP is a direct connection that only works inside a firewall

• sessions connecting from outside the firewall automatically use a HTTP or HTTPS connection (depending on the URL)

14.9.11 Can I use Discoverer with a NAT device?

Yes, you can deploy Discoverer using any standard Network Address Translation (NAT) device.