Configuring IBM Cognos Controller 8 to use Single Sign- On

Transcription

1 Guideline Configuring IBM Cognos Controller 8 to use Single Sign- On Product(s): IBM Cognos Controller 8.2 Area of Interest: Security

2 Configuring IBM Cognos Controller 8 to use Single Sign-On 2 Copyright Copyright 2008 Cognos ULC (formerly Cognos Incorporated). Cognos ULC is an IBM Company. While every attempt has been made to ensure that the information in this document is accurate and complete, some typographical errors or technical inaccuracies may exist. Cognos does not accept responsibility for any kind of loss resulting from the use of information contained in this document. This document shows the publication date. The information contained in this document is subject to change without notice. Any improvements or changes to the information contained in this document will be documented in subsequent editions. This document contains proprietary information of Cognos. All rights are reserved. No part of this document may be copied, photocopied, reproduced, stored in a retrieval system, transmitted in any form or by any means, or translated into another language without the prior written consent of Cognos. Cognos and the Cognos logo are trademarks of Cognos ULC (formerly Cognos Incorporated) in the United States and/or other countries. IBM and the IBM logo are trademarks of International Business Machines Corporation in the United States, or other countries, or both. All other names are trademarks or registered trademarks of their respective companies. Information about Cognos products can be found at This document is maintained by the Best Practices, Product and Technology team. You can send comments, suggestions, and additions to cscogpp@ca.ibm.com.

3 Configuring IBM Cognos Controller 8 to use Single Sign-On 3 Contents 1... INTRODUCTION PURPOSE APPLICABILITY EXCLUSIONS AND EXCEPTIONS CONFIGURING CONTROLLER TO USE SINGLE-SIGNON OVERVIEW DEFAULT BEHAVIOUR DETAILS CAN YOU USE SINGLE-SIGNON WITHOUT USING WINDOWS AUTHENTICATION? APPENDIX TROUBLESHOOTING. 12

4 Configuring IBM Cognos Controller 8 to use Single Sign-On 4 1 Introduction 1.1 Purpose This document is a quick guide on how to configure a Controller 8 application server to use single-signon. 1.2 Applicability Controller Exclusions and Exceptions There are no known exclusions and exceptions at the time the document was created. 2 Configuring Controller to use Single-Signon 2.1 Overview This guide is intended as a quick-start guide, for the most popular of environments. The official documentation 1 takes precedence over this document. This document should be used as a companion to: Configuring Controller 8 to use Active Directory authentication Configuring Controller 8 to use Access Manager authentication It is assumed that: There is one Controller 8 application server The server is configured to use either Active Directory or Access Manager authentication. 1 For the full information, see Chapter 7 (p77+) Configuring Series 8 or Windows Authentication of the document Cognos 8 Controller Installation and Configuration Guide (English) ( ctrl_inst.pdf ) which can be found on the installation CD, or can be downloaded from

5 Configuring IBM Cognos Controller 8 to use Single Sign-On Default behaviour When Controller is using either Access Manager of Active Directory, you are prompted to log in when you point your browser After you log in, you can open Controller from a link on the IBM Cognos Connection web site:

6 Configuring IBM Cognos Controller 8 to use Single Sign-On 6 You are then prompted to log in again. This document demonstrates how to remove these prompts.

7 Configuring IBM Cognos Controller 8 to use Single Sign-On Details First, you configure your web site to use Windows Authentication. By default, the web site uses anonymous authentication. On the Controller 8 application server, open your Computer Management screen and right-click Default Web Site and select Properties. The Default Web Site Properties dialog appears. Click Directory Security > Edit and clear the Anonymous access check box. Click OK. Restart the IIS service by opening a command prompt and typing IISRESET.

8 Configuring IBM Cognos Controller 8 to use Single Sign-On Can you use single-signon without using Windows authentication? The following method is valid if using an Access Manager (sometimes referred to as an IBM Cognos Series 7 namespace). To confirm that you are using an IBM Cognos Series 7 namespace, open IBM Cognos Configuration. Under Security > Authentication, you see a Cognos Namespace. When you select the Namespace the Type is listed as IBM Cognos Series 7. Open Access Manager Administration. Open the Properties sheet for the default namespace and click the Signons tab.

9 Configuring IBM Cognos Controller 8 to use Single Sign-On 9 Under Active signons, click Both. You need to ensure that each Access Manager user has an appropriate Windows (domain) userid.

10 Configuring IBM Cognos Controller 8 to use Single Sign-On 1 In Access Manager Administration, expand Users. Right-click one of the users and select Properties. Click User Signons. Under OS signons click Add and enter the Windows login information for that user. Repeat the above process for each Windows user, and each corresponding Access Manager userid, so that all Controller users are configured. You have now configured true Windows single-signon. When the user logs onto Windows, this is the last time they need to log on. Controller authenticates the user automatically, using the Windows userid (for example, DOMAIN\SMITHJ), which is mapped to a Controller native user account (for example, ADM).

11 Configuring IBM Cognos Controller 8 to use Single Sign-On 1 The following method is valid if you are using an Active Directory namespace and you are not using Kerberos Delegation. To confirm that you are using an ADS, open IBM Cognos Configuration and expand Security > Authentication. Select the domain, in this example it is labeled ENTDomain, and the Type is set to Active Directory in the Resource Properties list. In the Resource Properties list, select Advanced Properties. Click the Edit button. The Advanced Properties dialog appears. For the singlesignonoption value, select IdentityMapping.

12 Configuring IBM Cognos Controller 8 to use Single Sign-On 1 Save and then restart IBM Cognos Configuration. After doing the above, you are not prompted to log on to either IBM Cognos Connection or the IBM Cognos Controller link. 2.5 Appendix Troubleshooting Confirm that the client computer is sending the IIS web site the end-user s credentials. All Controller client/server communication, uses the HTTP protocol to the IIS web server. It is important that the client s computer sends Windows credentials to the web site. Confirm that the server zone that the Controller server belongs to, on the client computer s Internet Explorer settings has Automatic logon with current username and password enabled. Open Internet Explorer, from the Tools menu, click Internet Options > Security > Custom Level. The Security Settings dialog appears. Under User Authentication > Logon click Automatic logon with current username and password. Click OK.

13 Configuring IBM Cognos Controller 8 to use Single Sign-On 1 Can you use single-sign on without using Windows authentication? Single signon (without Windows authentication) in Controller is only valid between the Controller client and the Controller Excel client.