OBIEE configuration with LDAP

1.      SET WEBLOGIC LDAP

Log on to the WebLogic Console as the weblogic adminsitrator account: http://[BI SERVER]:7001/console

• Navigate to the following screen “Security Realms > myRealm”:

Click on the “Providers” tab and then click on the “Lock and Edit” button:

Click on the link for “DefaultAuthenticator”:

• Set the “Control Flag” parameter to “SUFFICIENT”

• Click the “Save” button

1.1      CREATE NEW IDENTITY PROVIDER

• Navigate back to the “Providers” tab by clicking the link at the top of the page:

• Click on the “New” button to create a new Identity Provider:

• Set the following “Name” and “Type” before hitting the “OK” button: Name: ADAuthenticator

Type: ActiveDirectoryAuthenticator

 

• You should see you new Identity Provider listed, click on the “ADAuthenticator” link to do some further configuration:

• Set the “Control Flag” parameter to “SUFFICIENT” and then click the “Save” button

• Once saved, go to the “Provider Specific” tab:

1.2      Set the Active Directory configuration

Host: NG Active Directory Server [AD Server Hostname or IP address]

e.g my network xx.xx.xx.xx

Port: 389

Principle [DN for OBI service account, used for connecting to AD to authenticate] e.g.  my network CN=Administrator, CN=Users, DC=corp, DC=miaz, DC=com

Credential: *************

Confirm Credential: ******

User Base DN:  [DN for the location of users within AD]

 Example my network  CN=Users, DC=corp, DC=miaz, DC=com

All Users Filter:
 (&(sAMAccountName=*)(objectclass=user))  * Leave Blank Preferable and will be added automatically.

User From Name Filter: (&(sAMAccountName=%u)(objectclass=user))  * Leave Blank Preferable

User Name Attribute: cn or sAMAccountName 

Group Base DN:  [DN for the location of groups within AD]

My Network example cn=Builtin,dc=corp,dc=miaz,dc=com

Click the “Save” button

Return back to the “Providers” tab (by clicking the link at the top) and then click the “Reorder” button:

• Move “ADAuthenticator” to the second or First in the list

• Click on the “OK” button
• Now click “Activate Changes”

1.3      Restart services and then Open User and Groups and it should get populated with AD users

Groups also get populated

2.      ENABLE “VIRTUALIZATION”

NOTE: This step is required to enable the use of multiple Identity Providers and also to ensure that users will still be able to log in to OBIEE even if the WebLogic “Admin Server” went down

• Log on to Enterprise Manager as the [BI ADMIN USER] account: http://[BI SERVER]:7001/em

• Expand “WebLogic Domain”, right-mouse click on “bifoundation_domain” and then choose the following menu option:
• Security > Security Provider Configuration

In the middle of the screen, click the “Configure” button:

Click the “Add” button to add the following 3 custom properties:

• Click the “OK” button at the top-right
Observe the success message to confirm the parameters have been applied:

user.login.attr sAMAccountName

username.attr sAMAccountName

virtualize true

 

3. TUNING ACTIVE DIRECTORY FOR LARGE ORGANISATIONS

If you have a very large Active Directory tree structure, then it might cause performance issues during the login process as it takes an extended period of time for authentication and authorisation to complete.

The settings documented in this section can significantly improve performance.

In one example (where users/groups were spread over 150 sub-trees in Active Directory) these settings reduced login times from 5-6 minutes down to just a few seconds.

• Log on to the WebLogic Console as the weblogic adminsitrator account: http://[BI SERVER]:7001/console

• Navigate to the following screen “Security Realms > myRealm > Providers > Authentication” and click on the link for your “ADAuthentictor”:

• Click the “Lock and Edit” button
• Go to the “Provider Specific” tab and change the following parameters:

• 
Use Token Groups For Group Membership Lookup: [Enable]

Cache Size: 3200

• Click the “Save” button
• Now go to the “Performance” tab of your authenticator and set the parameters as follows:

Max Group Hierarchies in Cache: 1000

Group Hierarchy Cache TTL: 600

Enable SID to Group Lookup Caching: [Enable]

Max SID TO Group Lookups In Cache: 5000

• Click the “Save” Button
• Click the “Activate Changes” button 
NOTE: You will need to restart, this will be done in the next section

4.     Open BIP or OBIEE and try one of the AD user and he/she should be able to login.