BusinessObjects Planning Security Administrator's Guide

Transcription

1 BusinessObjects Planning Security Administrator's Guide BusinessObjects Planning XI Release 2

2 Copyright 2007 Business Objects. All rights reserved. Business Objects owns the following U.S. patents, which may cover products that are offered and licensed by Business Objects: 5,555,403; 6,247,008; 6,289,352; 6,490,593; 6,578,027; 6,768,986; 6,772,409; 6,831,668; 6,882,998 and 7,139,766. Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Xcelsius, Crystal Decisions, Intelligent Question, Desktop Intelligence, Crystal Enterprise, Crystal Analysis, Web Intelligence, RapidMarts, and BusinessQuery are trademarks or registered trademarks of Business Objects in the United States and/or other countries. All other names mentioned herein may be trademarks of their respective owners. Third-party Contributors Business Objects products in this release may contain redistributions of software licensed from third-party contributors. Some of these individual components may also be available under alternative licenses. A partial listing of third-party contributors that have requested or permitted acknowledgments, as well as required notices, can be found at:

3 Contents Chapter 1 Introduction 7 About this guide...8 Who should read this guide...8 Business Objects information resources...8 Chapter 2 Security Administration Overview 11 Security administration responsibilities in BusinessObjects Planning...12 About the Primary Authentication System...13 What is a system?...13 User setup requirements...13 Managing users across systems...14 Designating the Primary Authentication System...15 Impacts of changing the Primary Authentication System...15 Chapter 3 Security Integration 17 Security integration options...18 Login behavior with security integration...19 Enabling security integration...20 Selecting a security integration option...21 Defining the available domains...21 Chapter 4 Active Directory Integration 23 Active Directory user import features...24 About imported users...24 Properties imported from Active Directory...25 BusinessObjects Planning Security Administrator's Guide 3

4 Contents Handling group hierarchies...26 Limitations to Active Directory integration...26 The user import process...27 Configuring Active Directory import settings...28 Selecting Active Directory groups for import...29 Considerations when selecting Active Directory groups for import..30 Selecting target systems for Active Directory user import...30 Defining property mapping settings for Active Directory user import...32 Enabling or disabling systems for Active Directory user import...32 Exporting Active Directory import settings...33 Importing Active Directory groups and users...33 Performing an Active Directory import manually...34 Scheduling an Active Directory user import for automated execution...34 Active Directory import rules...35 Reconciling existing users to Active Directory...37 User reconciliation rules...38 Running the Active Directory User Reconciliation utility...39 Chapter 5 SiteMinder Integration 41 SiteMinder integration requirements...42 Enabling SiteMinder integration in the Planning Configuration Manager...42 SiteMinder Integration settings...43 Configuring SiteMinder for use with BusinessObjects Planning...43 Configuring the Planning realm in SiteMinder...44 Levels of protection for SiteMinder integration...44 Adjusting the Agent Config Objects settings for use with Web Reports...45 Editing the SiteMinder registry settings for use with Web Checkout...45 Logging into Enterprise Desktop using SiteMinder integration BusinessObjects Planning Security Administrator's Guide

5 Contents Chapter 6 Security Administration Features 47 Password Administration...48 Password Administration settings...49 Security Log...50 Logged activities...51 Filtering the security log...51 Exporting security log data...52 Purging the security log...53 Locking out users...53 Exporting a list of all users and groups...54 User report contents...54 Index 55 BusinessObjects Planning Security Administrator's Guide 5

6 Contents 6 BusinessObjects Planning Security Administrator's Guide

7 Introduction 1

8 Introduction 1 About this guide About this guide This guide discusses security administration concepts and procedures for BusinessObjects Planning. The information in this guide assumes that you have a working BusinessObjects Planning installation. For installation information, see the BusinessObjects Planning Installation Guide. This guide covers the following topics: the Primary Authentication System security integration options Microsoft Active Directory integration SiteMinder integration security management features This guide does not cover the following topics: manually creating security groups and users setting user access rights BusinessObjects user integration For information on the security topics not covered in this guide, see the Planning Professional Edition Online Help or the Planning Professional Edition Administrator's Guide. For information on BusinessObjects user integration, see the BusinessObjects Planning Guide to Integration with BusinessObjects XI. Who should read this guide Security administration of BusinessObjects Planning is typically handled by the organization's Information Technology department. The person handling security administration should be familiar with general security concepts as well as specific security management technologies such as Active Directory. Business Objects information resources Documentation You can access documentation from the product interface, the web, or your product distribution. 8 BusinessObjects Planning Security Administrator's Guide

9 Introduction Business Objects information resources For details on what documentation is available for BusinessObjects Planning, see the BusinessObjects Planning Documentation Roadmap. The full electronic documentation set (including the roadmap) can be found on the web at or on your product distribution in the \Documents folder. 1 Online customer support The Business Objects Customer Support web site contains information about Customer Support programs and services. It also has links to a wide range of technical information including knowledgebase articles, downloads, and support forums. Looking for the best deployment solution for your company? Business Objects consultants can accompany you from the initial analysis stage to the delivery of your deployment project. Expertise is available in relational and multidimensional databases, in connectivities, database design tools, planning and performance management, customized embedding technology, and more. For more information, contact your local sales office, or contact us at: Looking for training options? From traditional classroom learning to targeted e-learning seminars, we can offer a training package to suit your learning needs and preferred learning style. Find more information on the Business Objects Education web site: Send us your feedback Do you have a suggestion on how we can improve our documentation? Is there something you particularly like or have found useful? Drop us a line, and we will do our best to ensure that your suggestion is included in the next release of our documentation: documentation@businessobjects.com BusinessObjects Planning Security Administrator's Guide 9

10 Introduction 1 Business Objects information resources Note: If your issue concerns a Business Objects product and not the documentation, please contact our Customer Support experts. For information about Customer Support visit: 10 BusinessObjects Planning Security Administrator's Guide

11 Security Administration Overview 2

12 Security Administration Overview 2 Security administration responsibilities in BusinessObjects Planning Security administration responsibilities in BusinessObjects Planning Security administration in BusinessObjects Planning is a collaborative effort between the Information Technology department and the BusinessObjects Planning system administrator (or "Master System User"). All user authentication for BusinessObjects Planning is controlled by a designated Primary Authentication System. Users and groups can be imported from supported sources such as Active Directory, or they can be created manually within BusinessObjects Planning. Each user's access rights within BusinessObjects Planning are controlled on a per-system basis. User access can be controlled at many levels, including by feature and by major menu area. Users can also be limited to a specific subset of data. The security administration responsibilities are typically divided between the Information Technology department and the Master System User as detailed in the following table: Information Technology Department Master System User Defining security configuration settings such as the Primary Authentication System and security integration Configuring and initiating user imports from Active Directory Defining password administration rules Defining user and group access rights for each system Manually creating groups and users (if Active Directory integration is not enabled) Other security-related responsibilities, such as reviewing and archiving the security log, are typically shared. This guide discusses the responsibilities of the Information Technology department. For more details on the Master System User responsibilities, see the Planning Professional Edition Online Help or the Planning Professional Edition Administrator's Guide. 12 BusinessObjects Planning Security Administrator's Guide

13 Security Administration Overview About the Primary Authentication System About the Primary Authentication System All implementations of BusinessObjects Planning must designate one system as the Primary Authentication System. The Primary Authentication system controls user access to all BusinessObjects Planning systems defined in your environment. 2 What is a system? A "system" is a unique BusinessObjects Planning User Directory and database. Your organization may have licensed and implemented one system, or several systems. For example, you may have licensed two BusinessObjects Planning applications, one for budgeting and one for forecasting. Each of these applications has a unique User Directory and database, so each one must be set up in the Configuration Manager as a separate system. There is not always a separate User Directory and database for each BusinessObjects Planning application. For example, budgeting and payroll planning are typically implemented using a single User Directory and database. In this case, only one system needs to be defined. User setup requirements The Primary Authentication System holds the user list for all systems. Each user's specific access rights (including group assignments) are defined on a per-system basis and must be managed within each individual system. If your organization has only one BusinessObjects Planning system, then that system is the Primary Authentication System and there is only one instance of security settings to manage. To view and manage security settings for a particular system, log into that system using the Professional Edition and access Setup > Security. With the exception of user information (first name, last name, address and password), the settings defined in one system cannot be inherited by any other system. BusinessObjects Planning Security Administrator's Guide 13

14 Security Administration Overview 2 About the Primary Authentication System Managing users across systems BusinessObjects Planning supports two methods of creating users. Users can be imported from a supported source, or they can be created manually within a system. When importing users from a supported source, groups and users can be imported into the Primary Authentication System and any additional systems at the same time. While you still need to define the specific security settings within each system, the users and groups are automatically created in all selected systems. If you add a user within a non-primary Authentication System, BusinessObjects Planning checks to see if the user already exists within the Primary Authentication System. If the user exists, BusinessObjects Planning uses the existing user information to set up the user within the non-primary Authentication System. If the user does not exist, the user is created within the Primary Authentication System and assigned to its Planning No Access group. The Planning No Access group is a standard security group within BusinessObjects Planning. The Planning No Access group is designed to allow user authentication into BusinessObjects Planning but prevent user access to system features, data or plan workbooks. If desired, you can edit users to remove the Planning No Access group assignment or to allow certain rights. If a user is deleted from the Primary Authentication System, that user is deleted from all systems. If a user is deleted from a non-primary Authentication System, that user only loses access to that system. Note: Security groups are not shared across systems. Even if you import a group into multiple systems, the group itself exists as a unique entity within each system. 14 BusinessObjects Planning Security Administrator's Guide

15 Security Administration Overview Designating the Primary Authentication System Designating the Primary Authentication System The Primary Authentication System is set within the Configuration Manager. For full details on the Configuration Manager, see the BusinessObjects Planning Installation Guide. 1. On the server hosting Planning Application Server, choose Start > Programs > Business Objects > Planning > Configuration Manager. 2. From the tree menu in the left-hand pane, select Global Parameters > Security. The security configuration options appear in the right-hand pane. 3. From the Primary Authentication System list, select the desired system. Once the Primary Authentication System is set, it should not be changed. Changing this setting later will have repercussions on your system and is not recommended. 2 Impacts of changing the Primary Authentication System Generally, once the Primary Authentication System has been set, it should not be changed. Changing this setting later will have repercussions on your system and is not recommended. Impacts of changing the Primary Authentication System include: Users who were defined in the prior Primary Authentication System but who are not defined in the new Primary Authentication System will not be able to access BusinessObjects Planning. These users must be copied to the new Primary Authentication System. Users will no longer have access to any web favorites or alerts that were saved prior to the change. Web favorites and alerts are stored in the database of the Primary Authentication System. The \ServerRootSplash folder must be moved to the User Directory of the new Primary Authentication System. BusinessObjects Planning Security Administrator's Guide 15

16 Security Administration Overview 2 Designating the Primary Authentication System 16 BusinessObjects Planning Security Administrator's Guide

17 Security Integration 3

18 Security Integration 3 Security integration options BusinessObjects Planning supports several security integration options, including: The ability to import Active Directory users and groups into BusinessObjects Planning. The ability to authenticate users based on their network credentials. Note: BusinessObjects Planning also supports the ability to import users and groups from BusinessObjects Enterprise. This functionality is part of the BusinessObjects Integration feature set, and is discussed in the separate guide BusinessObjects Planning Guide to Integration with BusinessObjects XI. These features are mutually exclusive you can enable either BusinessObjects Integration or one of the security integration options discussed in this chapter. Security integration options BusinessObjects Planning supports three types of security integration: Desktop, Implicit Active Directory, and Explicit Active Directory. By default, security integration is not enabled. Desktop Desktop integration enables the ability to validate users based on their network credentials. If a user's network login name matches a valid user name in BusinessObjects Planning, that user does not have to provide any additional credentials to access BusinessObjects Planning. Users must be manually created within BusinessObjects Planning. The Desktop option is equivalent to the old network integration feature provided in earlier versions of the software. To enable this type of security integration, select Desktop as the Integration Enablement option in the Configuration Manager. The following considerations apply if Desktop integration is enabled: Each user's BusinessObjects Planning user name must be the same as his or her network user name. All users must be assigned a password within BusinessObjects Planning, to help prevent unauthorized access. The default password features in BusinessObjects Planning can be used to ensure that all users are assigned a password. 18 BusinessObjects Planning Security Administrator's Guide

19 Note: The Desktop integration option can also be used to enable SiteMinder integration for the web access options. Implicit Active Directory Security Integration Login behavior with security integration Implicit Active Directory integration enables integrated login and the ability to import Active Directory users. If a user's Windows user ID matches an imported user ID in BusinessObjects Planning, that user does not have to provide any additional credentials to access BusinessObjects Planning. Active Directory groups and users can be imported into BusinessObjects Planning using the import features within the Professional Edition. These import features are only available to administrators and only within the Primary Authentication System. To enable this type of security integration, select ADSImplicit as the Integration Enablement option in the Configuration Manager. 3 Explicit Active Directory Explicit Active Directory integration differs from Implicit Active Directory integration in that users must always provide their Windows password in order to access BusinessObjects Planning. To enable this type of security integration, select ADSExplicit as the Integration Enablement option in the Configuration Manager. Note: The ADSExplicit security integration option is not supported for use in environments using Novell Netware. Related Topics: SiteMinder Integration on page 41 Login behavior with security integration The BusinessObjects Planning login dialog is almost always presented to users. Even if the user does not have to enter a password, the user may still need to select a specific system to access. The exception is Enterprise Desktop if Desktop or Implicit Active Directory security integration is enabled, users will bypass the Enterprise Desktop login page and enter the home page directly. The way in which integrated users log in depends on the access option. BusinessObjects Planning Security Administrator's Guide 19

20 Security Integration 3 Enabling security integration Note: The following discussions only apply to Desktop or Active Directory integration, not BusinessObjects integration. For information on BusinessObjects integration, see BusinessObjects Planning Guide to Integration with BusinessObjects XI. Professional Edition If security integration is enabled, a field named Authentication appears on the Professional Edition login dialog. If the user is logged into an approved domain, and the software finds a match for the user's credentials, the appropriate authentication type is selected by default. Otherwise, the user can choose the Planning authentication type to log in using a BusinessObjects Planning user name and password. Web access In the case of Enterprise Desktop or stand-alone web login, the URL syntax determines whether default or integrated login applies. For more information on Enterprise Desktop and stand-alone web login, see the BusinessObjects Planning Installation Guide. If the integrated login page is used (loginedi.aspx or loginsai.aspx), the software will attempt to authenticate the user based on the enabled type of security integration. If the software cannot find a match for the user's credentials, the user cannot log in using this page. The user must use the default login page. If the default login page is used (logined.aspx or loginsa.aspx), the user can use the Authentication field to select an authentication type (either Planning or the enabled type of security integration). Enabling security integration Security integration is enabled within the Configuration Manager. For full details on the Configuration Manager, see the BusinessObjects Planning Installation Guide. To open the Configuration Manager, choose Start > Programs > Business Objects > Planning > Configuration Manager on the server hosting Planning Application Server. 20 BusinessObjects Planning Security Administrator's Guide

21 Selecting a security integration option Security Integration Enabling security integration 1. From the tree structure in the left-hand pane, select Global Parameters > Security. The security configuration options appear in the right-hand pane. 2. From the Integration Enablement list, select one of the following options: 3 Option Desktop ADSImplicit ADSExplicit None Description Enables integrated login based on network credentials. Can also be used to enable SiteMinder integration. Enables integrated login based on Windows credentials, and the ability to import Active Directory users and groups. Enables the ability to import Active Directory users and groups. Users must provide their Windows password to access the system. No security integration is enabled, and all users must provide a BusinessObjects Planning user name and password to access the system. This is the default setting. If anything other than None is selected, you must also define the available domains for security integration. If Active Directory integration is enabled (ADSImplicit or ADSExplicit), make sure the Server Host Name and Server Port settings on the Global Parameters > Application Server node are also completed. Defining the available domains If integration is enabled (Integration Enablement is set to anything other than None), then you must define the available domains. For integrated login purposes, BusinessObjects Planning only recognizes users who are logged into the domains listed in the Available Domains list. 1. Expand the Security node and then select Available Domains. The Available Domains grid appears in the right-hand pane. 2. Type a domain name into the blank cell. BusinessObjects Planning Security Administrator's Guide 21

22 Security Integration 3 Enabling security integration One blank cell is always available in the grid. As soon as you begin typing into a blank cell, a new blank cell is created underneath it. 3. Repeat this process (one domain name per cell) until you have listed all of the domains that you want recognized for security integration. All of the domains listed must be within the same forest. 22 BusinessObjects Planning Security Administrator's Guide

23 Active Directory Integration 4

24 Active Directory Integration 4 Active Directory user import features This chapter provides an overview of the Active Directory import features in the Professional Edition, and gives instruction on how to configure and execute an import. Active Directory Integration must be enabled before it is available for use. For details on enabling Active Directory integration, see Enabling security integration on page 20. Note: The Active Directory Integration feature can only be accessed by administrators within the Primary Authentication System. While users and groups can be imported into any system, the import must be managed from within the Primary Authentication System. Active Directory user import features If Active Directory integration is enabled, a new command is available in the Professional Edition under Setup > Security named Active Directory Integration. This command is only available in the Primary Authentication System, and is only accessible by administrators. Additionally, the administrator user must be logged into Windows with a domain user account that has sufficient privileges to view the Active Directory groups and users. Using the Active Directory Integration dialog, you can perform the following tasks: Select Active Directory groups for import from various domains. Set the target BusinessObjects Planning systems for each group. Map the Active Directory user properties to the associated BusinessObjects Planning user properties. Enable or disable specific BusinessObjects Planning systems for import. Save the import configuration settings. Export the import configuration settings. Initiate an Active Directory import. Once you have saved the import configuration settings, you can schedule Active Directory imports for automated execution using the Scheduler utility. About imported users Use of the user integration features introduces the concept of two user types: imported users and BusinessObjects Planning users. 24 BusinessObjects Planning Security Administrator's Guide

25 Active Directory Integration Active Directory user import features The terms imported user and imported group refer to users and groups that were imported into BusinessObjects Planning from an outside source and that remain synchronized with the original source. The terms BusinessObjects Planning user and BusinessObjects Planning group refer to users and groups created within BusinessObjects Planning, or imported users and groups that have been converted to BusinessObjects Planning users and groups. All imported users and groups are flagged using the Imported check box at the top of the User Information tab or Group Information tab in Security Settings. As long as the Imported check box is selected, that user or group will be synchronized with the source during any future imports. You can convert an imported user or group into a BusinessObjects Planning user or group by clearing the Imported check box. If an imported user is converted, that user becomes completely managed within BusinessObjects Planning and is unaffected by any future imports. This conversion cannot be reversed. 4 Properties imported from Active Directory The following user properties are imported from Active Directory: First Name, Last Name, and . These properties cannot be edited in BusinessObjects Planning as long as that user remains flagged as an imported user. These properties are updated on each subsequent Active Directory import. The group assignments for imported users are synchronized as part of the Active Directory import. However, you can also assign imported users to BusinessObjects Planning groups. These BusinessObjects Planning group assignments are unaffected by subsequent Active Directory imports. When an Active Directory group is imported for the first time, it is assigned a set of filters that result in no access to data or plan workbooks. This is a security measure designed to prevent newly imported users from having full access to the system until you are able to set the specific security properties for the group and the imported users. If a new user is imported into an existing group, that user inherits that group's established security settings, so no additional restrictions are applied to the new user. Related Topics: Active Directory import rules on page 35 BusinessObjects Planning Security Administrator's Guide 25

26 Active Directory Integration 4 Active Directory user import features Handling group hierarchies Active Directory supports group hierarchies. In Active Directory, groups can contain other groups. BusinessObjects Planning does not support group hierarchies. Each group in BusinessObjects Planning is a separate entity with no relationship to any other group. Users in BusinessObjects Planning can belong to multiple groups. When hierarchical groups are imported into BusinessObjects Planning, the hierarchical structure is flattened. Users are assigned to their immediate group and any parent groups as appropriate. For example, Group B is a subgroup of Group A, and both groups are selected for import. If a user is a member of Group B, that user will be assigned to both Group A and Group B in BusinessObjects Planning. You can choose to import a subgroup without importing its parent groups, but you cannot chose to import a parent group without importing all of its subgroups. Limitations to Active Directory integration The following limitations apply to the import of Active Directory groups. All Active Directory groups to be imported must exist in the same forest. The Active Directory Integration dialog lists all domains in the current forest. While you can import groups from any domain within the forest, for authentication purposes BusinessObjects Planning only recognizes users from domains listed in the Planning Configuration Manager. Cyclical group assignments with no ultimate parent are not displayed in the Active Directory integration dialog, and therefore cannot be imported. (For example: Group A is a child of Group B, and Group B is a child of Group A.) This limitation is enforced to prevent an infinite loop when populating the list of available groups in the dialog. If a group in a cyclical assignment is also part of a non-cyclical assignment, the group will display in the dialog as part of the non-cyclical assignment, and can be imported. 26 BusinessObjects Planning Security Administrator's Guide

27 Active Directory Integration The user import process 4 Related Topics: Defining the available domains on page 21 The user import process This section describes the user import process and provides direction on where to find more information about each step. 1. Plan the groups to be imported. In this step you should analyze your user environment in regard to both Active Directory and BusinessObjects Planning. Which users require access to BusinessObjects Planning? Can you use existing Active Directory groups or do you need to create new groups? How often should user imports be performed to keep the systems synchronized? 2. If necessary, create the groups to be imported within Active Directory. For more details, see the documentation for Active Directory. 3. Enable Active Directory Integration within the Planning Configuration Manager. See Security Integration on page 17 for details on the available Active Directory integration options (ADImplicit and ADExplicit) and how to enable them within the Configuration Manager. 4. Configure and save the import settings. In this step, you define which groups to import into specific BusinessObjects Planning systems, as well as the mapping relationships between BusinessObjects Planning user properties and Active Directory user properties. See Configuring Active Directory import settings on page Perform the import. Imports can be performed manually on an ad hoc basis, or scheduled for automated execution using the Scheduler utility. Both options are discussed in Importing Active Directory groups and users on page 33. This section also describes the rules employed during an import. 6. Define the security settings for the imported users and groups. The user and group security settings for BusinessObjects Planning are typically defined by the BusinessObjects Planning Master System User. BusinessObjects Planning Security Administrator's Guide 27

28 Active Directory Integration 4 Configuring Active Directory import settings For more details on available settings, see the Planning Professional Edition Administrator's Guide. Subsequent imports can be performed as often as necessary to synchronize the user lists. Configuring Active Directory import settings This section provides information on configuring the user import settings for Active Directory. You must configure the user import settings before you can perform an import. Once saved, these settings can be used for future imports and can be edited at any time. The Active Directory Integration dialog is only available in the Primary Authentication System and is only accessible by administrators. Additionally, the administrator user must be logged into Windows with a domain user account that has sufficient privileges to view the Active Directory groups and users. 1. Choose Setup > Security > Active Directory Integration from the Plan menu or the Treeview. 2. On the User Groups tab, select the Active Directory groups to import. Choose a domain, and then use the arrow buttons to move selected groups from the Available Groups box to the Selected Groups box. For more specific details and considerations, see Selecting Active Directory groups for import on page For each group in the Assigned Group list, select the target BusinessObjects Planning systems that you want to import the group into. If a check box is selected for a system, that group will be imported into that system. For more specific details and considerations, see Considerations when selecting target systems for user import on page On the Settings tab, define the property mapping settings for the import. For each BusinessObjects Planning property, indicate the corresponding Active Directory property. For more specific details, see Defining property mapping settings for Active Directory user import on page BusinessObjects Planning Security Administrator's Guide

29 5. In the Enable/Disable Import by System box, select the systems to enable for import. If a check box is selected for a system, that system is enabled for import. For more specific details and considerations, see Enabling or disabling systems for Active Directory user import on page Click Save. Active Directory Integration Configuring Active Directory import settings If you are ready to perform the import now, click Import. See Importing Active Directory groups and users on page 33 for full details on performing imports. 4 Selecting Active Directory groups for import 1. Click the User Groups tab of the Active Directory Integration dialog. 2. To add a group for import: a) On the Domain list, click the desired domain. The available groups for that domain display in the Available Groups box. b) In the Available Groups box, select the check box for each group that you want to import. Note: You can use the Select All and Clear All buttons at the bottom of the dialog to select all groups or clear all check boxes. If a group has a plus icon next to the group name, you can expand the group to view its subgroups. Child groups can be selected independently of parent groups. Selecting a parent group automatically selects all child groups. c) Click the >> button to add the selected groups to the Assigned Groups box. Tip: To see a list of the users in a group, right-click on the group in the Assigned Groups box. 3. To remove a group: a) In the Assigned Groups box, click the grey box next to the group name to select the entire row. You can use the SHIFT or the CTRL key to select multiple rows. BusinessObjects Planning Security Administrator's Guide 29

30 Active Directory Integration 4 Configuring Active Directory import settings b) Click the << button to remove the group from the Assigned Groups box. Considerations when selecting Active Directory groups for import User import is defined on a per-group basis you cannot select individual users to import. Hierarchical groups (groups with subgroups) will be flattened upon import to BusinessObjects Planning. See Handling group hierarchies on page 26. For other considerations on importing groups, see Limitations to Active Directory integration on page 26. If you remove a group that has previously been imported, all imported users belonging to that group will become obsolete on the next import, unless they belong to another imported group. Selecting target systems for Active Directory user import Once Active Directory groups have been selected to import, you must indicate the target BusinessObjects Planning systems for each group. 1. Click the User Groups tab of the Active Directory Integration dialog. Each group selected for import is listed in the Assigned Groups box. To the right of the Group Name column, there is a column for all systems ( All ), and then a column for each individual system. By default, when a group is first selected for import, all systems are selected as import targets. 2. To add target systems for import: Select the check box for a specific system to import the group into that system. OR Select the All check box to select all systems. 3. To remove target systems for import: Clear the check box for a specific system. 30 BusinessObjects Planning Security Administrator's Guide

31 OR Clear the All check box to clear all systems. Active Directory Integration Configuring Active Directory import settings 4 Considerations when selecting target systems for user import Importing into newly-added systems By default, when a group is initially added to the Selected Groups list, all systems are selected as target systems. If a new system is added later, you must manually edit the selected groups to include that system. Selecting the Primary Authentication System as a target system If the users in a group do not need to access the Primary Authentication System, then you do not need to select that system as a target system. The users will still be added to the Primary Authentication System so that they can log into BusinessObjects Planning, but within the Primary Authentication System they will be assigned to the Planning No Access group. If you change your mind later and decide to indicate the Primary Authentication System as a target system, the group will be created in the Primary Authentication System and the already-existing users will be assigned to that group. Because the users are now assigned to a group, the Planning No Access assignment is removed. Note: The automated removal of the Planning No Access assignment only occurs because the original Planning No Access assignment was automatic. If you manually assign a user to the Planning No Access group, that assignment will remain until you remove it. Removing a target system If you remove a system from a group s list of target systems, and you have already imported users from that group into that system, those users will become obsolete in that system on the next import. BusinessObjects Planning Security Administrator's Guide 31

32 Active Directory Integration 4 Configuring Active Directory import settings Defining property mapping settings for Active Directory user import During an Active Directory import, User Name is always mapped to the Active Directory property samaccountname. The remaining Planning properties must be mapped to the appropriate Active Directory properties in your environment. 1. Click the Settings tab of the Active Directory Integration dialog. 2. For each Planning property, type the name of the corresponding Active Directory property into the appropriate box, or click the button to the right of the box to look up a property name. For example, if you are using typical Active Directory property names, the properties would be mapped as follows: Planning property First Name Last Name Active Directory property givenname sn mail Enabling or disabling systems for Active Directory user import You can selectively enable or disable systems for Active Directory import without affecting the target system assignments for the imported groups. The first time that the Active Directory Integration dialog is accessed, all systems are enabled for import by default. If a new system is subsequently added, you must manually enable that system. 1. Click the Settings tab of the Active Directory Integration dialog. The available BusinessObjects Planning systems display in the Enable/Disable Import by System box. 32 BusinessObjects Planning Security Administrator's Guide

33 Active Directory Integration Importing Active Directory groups and users 2. Select the check box for a system to enable that system for import, or clear a check box for a system to disable that system for import. 4 Impacts of disabling systems for user import If you disable a system for user import, no users or groups will be imported into that system, even if that system is selected as a target system on the User Groups tab. (Note that name and information for previously imported users will still be synchronized.) Disabling the Primary Authentication System disables all user import capabilities. The import process must be able to create users within the Primary Authentication System. Exporting Active Directory import settings You can export the Active Directory import settings as an XML file to assist in troubleshooting any import issues. 1. Choose Setup > Security > Active Directory Integration from the Plan menu or the Treeview. 2. Click the Settings tab. 3. Select one of the following Export options. Click Export Configuration to export the import settings. This includes the list of selected Active Directory groups and target systems, the property mapping settings, and the system enablement settings. Click Export Groups / Users to export the list of Active Directory Groups and users that you have selected for import. 4. Navigate to the location where you want to save the export file, then click OK. Importing Active Directory groups and users Two methods are available to import Active Directory groups and users. You can manually perform an import using the Active Directory Integration dialog, or you can schedule an import for automated execution using the Scheduler utility. BusinessObjects Planning Security Administrator's Guide 33

34 Active Directory Integration 4 Importing Active Directory groups and users For details on the rules applied to users and groups during an Active Directory import, see Active Directory import rules on page 35. After an import executes successfully, be sure to check the security log for any warnings. Related Topics: Security Log on page 50 Performing an Active Directory import manually 1. Choose Setup > Security > Active Directory Integration from the Plan menu or the Treeview. 2. Review the import settings to confirm they are as desired. If you have not already configured the import settings, see Configuring Active Directory import settings on page Click Import. If any errors are experienced during the import, a message box notifies you that errors were logged to the security log. Related Topics: Security Log on page 50 Scheduling an Active Directory user import for automated execution You can schedule a user import for automated execution using the Scheduler utility. You must have already configured and saved the import settings using the Active Directory Integration dialog before scheduling the import. The following describes the basic steps for scheduling a user import. For full details on the Scheduler utility, see the Planning Professional Edition Online Help or the Planning Professional Edition Administrator's Guide. 1. Choose Utilities > Scheduler from the Plan menu or the Treeview. 2. Click the New Job icon, then type a Job Name and Description for the new job. You can also add the user import task to an existing job. 3. Add the user import task to the job: 34 BusinessObjects Planning Security Administrator's Guide

35 a) In the Tasks for Job pane at the bottom of the dialog, click the New Task icon. The Setup Task dialog opens. b) On the Task Type list, click User Import. c) Type a Name for the task, then click OK. Active Directory Integration Importing Active Directory groups and users 4. Complete the remaining job settings (Job Recurrence and Notifications) by clicking through the Job Wizard. Note: Remember that the scheduled time is evaluated in the context of the Planning database server's time zone. The Job Wizard displays the database time (as "Scheduler time") and the local time for your reference. 4 Active Directory import rules This section describes the rules applied by BusinessObjects Planning when performing an Active Directory import. This summary is provided to help you understand how BusinessObjects Planning handles the various user and group conditions that may be present during an import. Group Rules For each group to be imported, BusinessObjects Planning checks the group list of the target system to determine if the group already exists. The basis of comparison is the group ID. If no match is found for the group ID, the following occurs: Before creating a new group, the software checks to make sure that no BusinessObjects Planning groups already exist with the same name. If a duplicate group name is found, then no action is taken to the existing group and no users are imported for the Active Directory group. A warning message is logged in the security log if this occurs. If no duplicate group name is found, then the new group is created, flagged as an imported group, and assigned filters that result in no access to data or plan workbooks. The group ID and group name are imported from Active Directory. The associated users are imported into the new group. Note: If the imported group name contains characters that are not supported in the BusinessObjects Planning database, then that group is considered invalid and no users are imported for that group. A warning message is logged in the security log if this occurs. BusinessObjects Planning Security Administrator's Guide 35

36 Active Directory Integration 4 Importing Active Directory groups and users If a match is found for the group ID, any new users are imported into the existing group. This occurs regardless of whether the group is still flagged as Imported in BusinessObjects Planning. If the group is still flagged as Imported and the group name has been changed in Active Directory, then the group name is synchronized to match the new name in Active Directory. User Rules For each user to be imported, BusinessObjects Planning checks the user list to determine if the user already exists. The basis for comparison is the user ID. If no match is found for the user ID, the following occurs: Before creating a new user, the software checks to make sure that no BusinessObjects Planning users already exist with the same name. If a duplicate user name is found, then no action is taken to the existing user. A warning message is logged in the security log if this occurs. If no duplicate user name is found, then the new user is created, flagged as an imported user, and assigned to the appropriate imported groups. The user's First Name, Last Name and properties are imported. Note: If the imported user name contains characters that are not supported in the BusinessObjects Planning database, then that user is considered invalid and is not imported. A warning message is logged in the security log if this occurs. If a match is found for the user ID, the following occurs: If the user is flagged as an Imported user, then the user's First Name, Last Name and properties are updated. The user's imported group assignments are synchronized. Any group assignments that were made manually by an administrator are not changed. If the user is not flagged as an Imported user (the user was converted to a BusinessObjects Planning user), then no action is taken to the existing user. If the Primary Authentication System was not indicated as a target system for the group the user is being imported from, then any new users added to a non-primary Authentication System are also added to the Primary Authentication System. The new user is created, flagged as an imported user, and assigned to the Planning No Access group. 36 BusinessObjects Planning Security Administrator's Guide

37 Obsolete Users Within the pool of groups currently being imported, BusinessObjects Planning compares its list of imported users (users flagged as Imported) to the users in the current import. If a previously imported user does not exist in the current import, that user is flagged as obsolete. The most typical situations where a user would be flagged as obsolete are: The user was deleted from Active Directory entirely. The user was removed from all Active Directory groups that are designated for import. The user belongs to a group that was removed from the Active Directory Integration settings, and the user does not belong to any of the other groups designated for import. Obsolete users cannot access the system. If the obsolete user is a Process Control stage owner or the owner of a Scheduler job, this issue is noted in the security log so that an administrator can move the assignments to other users as appropriate. The names of obsolete users display in grey font in the Security Settings dialog. Obsolete users remain in the system until deleted by an administrator. For security reasons, BusinessObjects Planning does not provide the ability to manually remove the obsolete flag from a user. If a user was mistakenly removed from an Active Directory group (which resulted in the user being flagged as obsolete), you can re-run the import to restore the user after correcting the issue in Active Directory. Related Topics: About the Primary Authentication System on page 13 Active Directory Integration Reconciling existing users to Active Directory 4 Reconciling existing users to Active Directory The Professional Edition contains a user reconciliation tool to assist existing customers with implementing Active Directory integration. This feature is only available in the Primary Authentication System, and is only accessible by administrators. The Active Directory User Reconciliation utility compares BusinessObjects Planning users with Active Directory users based on user name. If a match is found, the BusinessObjects Planning user is converted to an imported BusinessObjects Planning Security Administrator's Guide 37