To use Cognos product documentation, you must enable JavaScript in your browser.

Configuring Security for Portal Services

When using Portal Services in a third-party portal, you must enable single signon to provide seamless integration between the third-party portal and Cognos 8 components.

Portal Services uses single signon to authenticate users. This means that users do not have to log on to other applications separately through the portal.

You must configure a URI into Cognos 8 components for each portlet in Portal Services.

To enable security between Cognos 8 components and the third-party portal, do the following:

      

Disable anonymous access to Cognos 8 components.

If your security infrastructure requires you to use another method for single signon, use one of the following methods:

      

Enable single signon for the third-party portal using shared secret.

If your security infrastructure requires you to use another method for single signon, use one of the following methods:

      

Configure Cognos 8 components for SSL access, if required.

Disable Anonymous Access to Cognos 8 Components

Portal Services uses single signon for authentication. If anonymous logon is enabled in Cognos 8 components, Portal Services logs all portal users as anonymous. You must ensure that anonymous access is disabled in Cognos 8 components for single signon in Portal Services to be successful. However, you can test the Portal Services connections using anonymous logon to ensure that the portlets are working in the third-party portal.

If Portal Services fails to authenticate a user, the user receives an error message at the third-party portal.

Steps

  1. Start Cognos Configuration.

  2. In the Explorer window, under Security, Authentication, click Cognos.

  3. In the Properties window, ensure that Allow anonymous access is set to False.

  4. From the File menu, click Save.

  5. Repeat steps 1 to 4 on all servers where you installed Cognos 8 components.

Enable Single Signon Using Shared Secret

You can use shared secret for single signon between Cognos portlets and Cognos 8 components. The Cognos portlets send a message that contains an encrypted version of the portal user ID. The encryption key is determined by the value of a secret character string shared between the portlets and the custom Java security provider on the Cognos server.

You can use shared secret for the third-party portal only if portal user IDs can be looked up in an NTLM, LDAP, or Cognos Series 7 authentication namespace that is shared by Cognos 8 components.

Cognos 8 components must have access to a directory server that contains user IDs for all your portal users. Using Cognos Configuration, you must configure an authentication namespace so that the portal and Cognos 8 components share the same authentication source.

You must also create a Custom Java Provider namespace to register the shared secret Java provider that is provided with Cognos 8 components. Within the portlets or iViews, you must link the portlets or iViews to the Custom Java Provider namespace within your respective portal:

You are not required to configure access to the Portal Services Web content. However, if you deploy the portlets to a third-party portal, you can configure access to an alternate URI for Portal Services images and Web content.

Steps to Configure the Required Namespaces

  1. In Cognos Configuration, configure a namespace to authenticate portal users.

    For more information, see Configuring Cognos 8 Components to Use an Authentication Provider.

  2. For an LDAP namespace, configure the following properties:

  3. For a Cognos Series 7 namespace, map the portal user IDs to Cognos Series 7 user IDs using OS signons.

    For more information, see the Cognos Series 7 documentation.

  4. In Cognos Configuration, create and configure a Custom Java Provider namespace.

  5. In Cognos Configuration, under Environment, Portal Services, configure the following properties:

  6. Under Environment, for Gateway Settings, set the Allow Namespace Override property to true.

  7. From the File menu, click Save.

  8. Restart the Cognos 8 service.

Steps to Configure Access to the Portal Services Web Content

  1. On the computer where you installed the Application Tier Components, start Cognos Configuration.

  2. In the Explorer window, under Environment, click Portal Services.

  3. In the Properties window, click the Value box next to Web Content URI.

  4. Specify the host name or IP address of the gateway and a port number using the format

    host_or_IP_address:port

  5. From the File menu, click Save.

Steps to Configure the Cognos iViews for SAP EP

  1. Open the iView editor for each Cognos iView.

  2. In the Property Category box, select Show All.

  3. For the cpsauthsecret: CPS Authorization Secret property, enter the secret character string that you used for the Shared Secret property when you configured the Custom Java Provider namespace.

  4. For the cps: authentication namespace ID property, enter the Custom Java Provider namespace ID.

  5. For the cpsserver: CPS Connection Server property, enter the URL path to access Portal Services components through the gateway.

    The format of the URL is as follows:

Steps to Configure the Cognos Portlets for WebSphere Portal

  1. For each Cognos portlet application, click Modify Parameters.

  2. For the cps_auth_secret property, enter the secret character string that you used for the Shared Secret property when you configured the Custom Java Provider namespace.

  3. For the cps_auth_namespace property, enter the Custom Java Provider namespace ID.

  4. For the CPS Endpoint property, enter the URL path to access Portal Services components through the gateway.

    The format of the URL is as follows:

Steps to Configure the Remote Server for Plumtree Portal

  1. Using a plain ASCII editor, such as Notepad, edit the cpspt.properties file in the c8_location/cps/plumtree/webapps/gadgets/WEB-INF/classes directory.

  2. Configure the following settings.

    Parameter

    Value

    cps_endpoint

    The URL to connect to the report server and extract the WSDL information.

    Specify the URI to the gateway.

    For a servlet or ISAPI gateway, replace the localhost/cognos8/cgi-bin/cognos.cgi portion with the values to target the gateway.

    For example,

    http://host_name/cognos8/cgi-bin/cognos.isapi/wsrp/cps4/portlets/[package]?wsdl&b_action=cps.wsdl

    forward_cookies=

    The names of the cookie that should be sent to the report server for single signon.

    Leave blank.

    cps_auth_secret

    The shared secret code Cognos 8 uses to encrypt an HTTP header variable that carries the user identity.

    This parameter represents the authorization secret that must be shared between the Cognos portlets and the Cognos 8 server. Consider this as a secret password. Use the same value that you used for Shared Secret in Cognos Configuration.

    For security reasons, we recommend you specify a non-null value.

    cps_auth_namespace

    The namespace ID for the Custom Java Provider.

  3. Go to the c8_location/cps/plumtree directory and run the following build file:

    This creates a cps-pt.war file in the c8_location/cps/plumtree/gadgets directory.

  4. If Cognos 8 components are running using Tomcat,

  5. If Cognos 8 components are running under another type of application server, copy the cps-pt.war file to the application server.

    For instructions, see the administration guide for your application server.

Single signon is configured.

Steps to Configure Properties for the Cognos WebPart for SharePoint Portal

  1. Using a plain ASCII editor, such as Notepad, edit the web.config file in the drive\Program Files\Common Files\Microsoft Shared\web server extensions\60\CONFIG directory.

  2. Find the following string:

    <SSO cps_auth_namespace="" cps_auth_secret="" />

  3. Set cps_auth_namespace to the namespace ID for the Custom Java Provider namespace.

  4. Set cps_auth_secret to the value that you used for Shared Secret in Cognos Configuration.

Enable Single Signon for SAP EP with the SAP Logon Ticket

If you enable single signon with the SAP Logon Ticket, you must configure Cognos 8 components with an SAP namespace that links to an SAP BW server.

Then you must copy the certificate that was generated during SAP EP installation to the SAP BW personal security environment.

Users must have the same user ID in all SAP systems that are accessed through single signon.

Before you start, ensure that you have

To enable SSO for SAP EP, complete the procedures for single signon with SAP logon tickets in the SAP Enterprise Portal Security Guide.

You can now use the Cognos iViews in the SAP Enterprise Portal. For more information, see the Administration and Security Guide.

Enable Single Signon for SAP EP with User Mapping

If you enable single signon with user mapping, you define a Cognos data source in SAP EP. Individual users or an administrator can enter the user IDs and passwords for Cognos 8 components in the data source. You must map the users logon credentials in the data source to an LDAP or Cognos Series 7 or NTLM namespace. Portal Services iViews transmit the logon credentials to Cognos 8 components using HTTP Basic Authentication.

Steps to Prepare the Environment

  1. Configure the gateway URI that will be used by Portal Services to require authentication using HTTP Basic Authentication.

    For information about configuring a URL to use HTTP Basic Authentication, see the documentation for the gateway or for your Web server.

  2. Adjust the iView configuration to access the secure URL.

    For information, see the documentation for your Web server.

  3. In Cognos Configuration, configure a namespace to authenticate portal users.

  4. If you use an LDAP namespace, configure the following properties:

Steps to Create the Data Source and Map the Users

  1. In the SAP portal, ensure that the following properties are configured for the data source in the /PortalContent/other_vendors/every_user/com.cognos.pct.c8/systems/Cognos 8 directory:

    For more information, see the SAP Enterprise Portal Administration Guide.

  2. For each Cognos iView, enable user mapping for the data source by entering the name of the system alias at the iView level, in an attribute called CPS: User Mapping Datasource.

    For more information, see the SAP Enterprise Portal Administration Guide.

  3. For each Cognos iView, set the CPS: Authentication Namespace ID property to the namespace that you want to use for authentication.

  4. Register the Cognos credentials for the portal users.

    Users can enter their own user IDs and passwords.

    For more information, see the SAP Enterprise Portal Administration Guide.

We recommend that you enable secure communication between SAP EP and Cognos 8.

You can now use the Cognos iViews in the SAP Enterprise Portal. For more information, see the Administration and Security Guide.

Enable Secure Communication Between SAP EP and Cognos 8 Components

A secure connection, using SSL, is not required between SAP EP and Cognos 8 components. It is more important if you enabled single signon with user mapping.

The SSL security supported by SAP uses encryption above 56 bits. By default, Cognos 8 components use an encryption algorithm up to 56 bits. Cognos provides an enhanced encryption module as a complementary product. To enable SSL, you must purchase and install the Enhanced Encryption Module for OpenSSL on top of Cognos 8 components. For more information, see the Cognos Enhanced Encryption Module for OpenSSL Installation and Configuration Guide.

To enable SSL between SAP EP and Cognos 8 components, see your SAP EP security documentation.

After SSL is enabled, edit properties for the all iViews so that the cpsserver: CPS Connection Server property uses https instead of http.

You can now use the Cognos portlets in the SAP Enterprise Portal. For more information, see the Administration and Security Guide.

Enable Single Signon for WebSphere Portal Using the Application Server

The Portal Services portlets can use the Active Credentials objects provided by WebSphere Portal to connect to Cognos 8 components. Portal Services supports the following Active Credentials objects: HttpBasicAuth, LtpaToken, SiteMinderToken, and WebSealToken.

Credentials for the portal user are passed to the gateway using this object. For more information about Active Credential objects, see the documentation for IBM WebSphere Portal.

To use application server single signon, see the documentation for IBM WebSphere Application Server.

For information about SSL for Cognos 8 components on a WebSphere Application Server, see Configuring the SSL Protocol.

After single signon is set up, you can use the Cognos portlets in the WebSphere Portal. For more information, see the Administration and Security Guide.

Enable Single Signon for Plumtree Portal Using Basic Authentication

You can configure a portlet in Plumtree Portal to send the username and password as an HTTP Basic authentication header. The header can be used with an NTLM, LDAP, or Cognos Series 7 authentication namespace to provide single signon.

Steps

  1. In Cognos Configuration, configure a namespace to authenticate portal users.

  2. Install an alternate CGI or ISAPI or servlet gateway in Cognos 8.

  3. Configure the gateway.

  4. In the administration console of the Web server, configure the virtual directories to access the gateway.

    For more information, see the documentation for your Web server.

  5. Configure the Plumtree remote server to access Cognos 8:

Enable Single Signon for Plumtree Portal Using SiteMinder

If you use eTrust SiteMinder to provide single signon in your security infrastructure, you can also use it for single signon with Plumtree Portal.

You must configure a SiteMinder authentication namespace in Cognos 8. Plumtree Portal sends the SiteMinder active authentication token to the remote server, which sends the token to the Cognos 8 gateway.

Steps

  1. In Cognos Configuration, configure a SiteMinder authentication namespace.

    For instructions, see Configuring Cognos 8 Components to Use eTrust SiteMinder.

  2. Configure the remote server to forward the authentication token: