Configure active directory:<\/strong><\/p>\n In this document we assume that the MSAD(Microsoft Active Directory) has been already setup. Installing and Configuring Tomcat IIS Connector<\/strong><\/p>\n Installation and Configuration of IIS Role<\/strong> Pentaho+ Configurations:<\/strong> Follow these steps to set tomcatAuthentication to False:<\/strong> Enable Preauthenticated Processing Filter<\/strong> Configure Authentication Manager<\/strong> Configure Preauthentication Provider<\/strong> Configure Exception Translation Filter<\/strong> Configure Exception Translation Filter for WS<\/strong> Configuring Pentaho+ with Integrated Windows authentication<\/p>\n","protected":false},"author":23,"featured_media":1874,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[424],"tags":[530,499],"class_list":["post-1830","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-pentaho","tag-integrated-windows-authentication","tag-pentaho"],"acf":[],"_links":{"self":[{"href":"https:\/\/tenthplanet.in\/blogs\/wp-json\/wp\/v2\/posts\/1830","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tenthplanet.in\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tenthplanet.in\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tenthplanet.in\/blogs\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/tenthplanet.in\/blogs\/wp-json\/wp\/v2\/comments?post=1830"}],"version-history":[{"count":1,"href":"https:\/\/tenthplanet.in\/blogs\/wp-json\/wp\/v2\/posts\/1830\/revisions"}],"predecessor-version":[{"id":11435,"href":"https:\/\/tenthplanet.in\/blogs\/wp-json\/wp\/v2\/posts\/1830\/revisions\/11435"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tenthplanet.in\/blogs\/wp-json\/wp\/v2\/media\/1874"}],"wp:attachment":[{"href":"https:\/\/tenthplanet.in\/blogs\/wp-json\/wp\/v2\/media?parent=1830"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tenthplanet.in\/blogs\/wp-json\/wp\/v2\/categories?post=1830"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tenthplanet.in\/blogs\/wp-json\/wp\/v2\/tags?post=1830"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nBefore we go into the configuration part we must understand few terminologies that are available in MSAD like 1)DN 2)DC 3)OU 4)CN
\n1) DN:- Distinguished Name, each entry has a unique identifier.
\n2) DC:- Domain Component, is the DN of the parent entry.
\n3) OU:- Organizational Unit.
\n4) CN:- Common Name, this is can be a user group name.
\nTo configure the MSAD right click on the Active Directory server and select NEW and create a OU. example OU=BIUSERS, simillarly create another OU. example OU=BIROLES.<\/p>\n\n
![\"\"](\"https:\/\/tenthplanet.in\/blogs\/wp-content\/uploads\/sites\/21\/2019\/06\/create_group-300x171.png\" "\\"\\"")
<\/p>\n![\"\"](\"https:\/\/tenthplanet.in\/blogs\/wp-content\/uploads\/sites\/21\/2019\/06\/group-300x256.png\" "\\"\\"")
<\/p>\n\n
\nLogin into the Pentaho+ User Console (PUC) and click on the HOME toggle button, and select the Administration. Then under the Administration select the Authentication option.<\/li>\n![\"\"](\"https:\/\/tenthplanet.in\/blogs\/wp-content\/uploads\/sites\/21\/2019\/06\/auth_check_1-300x276.png\" "\\"\\"")
<\/p>\n\n
\n
\nhttps:\/\/github.com\/Bilal-S\/iis2tomcat\/releases<\/li>\n
\nHere are the steps to add server roles:<\/p>\n\n
\nThis section contains the configuration steps for your Pentaho+ installation. You can find details on
\nthese topics in the following sections:<\/p>\n\n
\n1. Locate the following file: Pentaho-server\/tomcat\/conf\/server.xml
\n2. Locate the AJP connector entry and change it from:
\n<!– Define an AJP 1.3 Connector on port 8009 –>
\n<Connector URIEncoding=”UTF-8″ port=”8009″ protocol=”AJP\/1.3″
\nredirectPort=”8443″ \/>
\nTo this:
\n<!– Define an AJP 1.3 Connector on port 8009 –>
\n<Connector URIEncoding=”UTF-8″ port=”8009″ protocol=”AJP\/1.3″
\nenableLookups=”false” tomcatAuthentication=”false” redirectPort=”8443″ \/><\/p>\n
\nThese steps will help you enable preAuthenticatedProcessingFilter:
\n1. Locate the following file: \\pentaho-server\\pentaho-
\nsolutions\\system\\applicationContext-spring-security.xml
\n2. Locate the filterChainProxy and replace the patterns using this text:
\n<sec:filter-chain pattern=”\/api\/repos\/dashboards\/print”
\nfilters=”securityContextHolderAwareRequestFilter,httpSessionPentahoSessionC
\nontextIntegrationFilter,httpSessionContextIntegrationFilter,preAuthenticate
\ndSecurityFilter,httpSessionReuseDetectionFilter,logoutFilter,authentication
\nProcessingFilter,basicProcessingFilter,requestParameterProcessingFilter,ano
\nnymousProcessingFilter,sessionMgmtFilter,exceptionTranslationFilter,filtrate
\nnvocationInterceptor” \/>
\n<sec:filter-chain pattern=”\/webservices\/**”
\nfilters=”httpSessionPentahoSessionContextIntegrationFilter,httpSessionConte
\nxtIntegrationFilter,preAuthenticatedProcessingFilter,basicProcessingFilter,
\nanonymousProcessingFilter,sessionMgmtFilter,securityContextHolderAwareReque
\nstFilterForWS,exceptionTranslationFilterForWS,filterInvocationInterceptorFo
\nrWS” \/>
\n<sec:filter-chain pattern=”\/api\/repos\/**”
\nfilters=”httpSessionPentahoSessionContextIntegrationFilter,httpSessionConte
\nxtIntegrationFilter,preAuthenticatedProcessingFilter,basicProcessingFilter,
\nrequestParameterProcessingFilter,anonymousProcessingFilter,sessionMgmtFilte
\nr,securityContextHolderAwareRequestFilterForWS,exceptionTranslationFilterFo
\nrWS,filterInvocationInterceptorForWS,preFlightFilter” \/>
\n<sec:filter-chain pattern=”\/api\/**”
\nfilters=”httpSessionPentahoSessionContextIntegrationFilter,httpSessionConte
\nxtIntegrationFilter,preAuthenticatedProcessingFilter,basicProcessingFilter,
\nrequestParameterProcessingFilter,anonymousProcessingFilter,sessionMgmtFilte
\nr,securityContextHolderAwareRequestFilterForWS,exceptionTranslationFilterFo
\nrWS,filterInvocationInterceptorForWS” \/>
\n<sec:filter-chain pattern=”\/plugin\/reporting\/api\/jobs\/**”
\nfilters=”httpSessionPentahoSessionContextIntegrationFilter,httpSessionConte
\nxtIntegrationFilter,preAuthenticatedProcessingFilter,basicProcessingFilter,
\nrequestParameterProcessingFilter,anonymousProcessingFilter,sessionMgmtFilte
\nr,securityContextHolderAwareRequestFilterForWS,exceptionTranslationFilterFo
\nrWS,filterInvocationInterceptorForWS,preFlightFilter” \/>
\n<sec:filter-chain pattern=”\/plugin\/**”
\nfilters=”httpSessionPentahoSessionContextIntegrationFilter,httpSessionConte
\nxtIntegrationFilter,preAuthenticatedProcessingFilter,basicProcessingFilter,
\nrequestParameterProcessingFilter,anonymousProcessingFilter,sessionMgmtFilte
\nr,securityContextHolderAwareRequestFilterForWS,exceptionTranslationFilterFo
\nrWS,filterInvocationInterceptorForWS” \/>
\n<sec:filter-chain pattern=”\/**”
\nfilters=”httpSessionPentahoSessionContextIntegrationFilter,httpSessionConte
\nxtIntegrationFilter,httpSessionReuseDetectionFilter,logoutFilter,preAuthent
\nicatedProcessingFilter,authenticationProcessingFilter,basicProcessingFilter
\n,requestParameterProcessingFilter,anonymousProcessingFilter,sessionMgmtFilt
\ner,securityContextHolderAwareRequestFilter,exceptionTranslationFilter,filte
\nrInvocationInterceptor” \/><\/p>\n
\nFollow these steps to configure authenticationManager:
\n1. Locate the following file: \\pentaho-server\\pentaho-
\nsolutions\\system\\applicationContext-spring-security.xml
\n2. Replace the following authenticationManager:
\n<bean id=”authenticationManager”
\nclass=”org.springframework.security.authentication.ProviderManager”>
\n<constructor-arg>
\n<util:list>
\n<pen:bean
\nclass=”org.springframework.security.authentication.AuthenticationProvider”\/
\n>
\n<ref bean=”anonymousAuthenticationProvider” \/>
\n<\/util:list>
\n<\/constructor-arg>
\n<property name=”authenticationEventPublisher”>
\n<ref bean=”defaultAuthenticationEventPublisher” \/>
\n<\/property>
\n<\/bean>
\n3. Add the following authenticationManager:
\n<!– ================ AUTHENTICATION ======================= –>
\n<bean id=”authenticationManager”
\nclass=”org.springframework.security.authentication.ProviderManager”>
\n<constructor-arg>
\n<util:list>
\n<ref bean=”preAuthAuthenticationProvider” \/>
\n<ref bean=”anonymousAuthenticationProvider”\/>
\n<\/util:list>
\n<\/constructor-arg>
\n<property name=”authenticationEventPublisher”>
\n<ref bean=”defaultAuthenticationEventPublisher” \/>
\n<\/property>
\n<\/bean>
\nConfigure Preauthenticated Processing Filter
\nIn the same file, add the following bean for preAuthenticatedProcessingFilter:
\n<!— IWA —>
\n<bean id=”preAuthenticatedProcessingFilter”
\nclass=”org.pentaho.platform.web.http.security.UsernameSubstringPreAut
\nhenticatedProcessingFilter”>
\n<property name=”authenticationManager”>
\n<ref bean=”authenticationManager”\/>
\n<\/property>
\n<property name=”regex” value=”.+\\\\(.+)”\/>
\n<\/bean><\/p>\n
\nIn the same file, add the following bean for preAuthAuthenticationProvider, just below the
\npreAuthenticationProcessingFilter:
\n<bean id=”preAuthAuthenticationProvider”
\nclass=”org.springframework.security.web.authentication.preauth.PreAuthentic
\natedAuthenticationProvider” >
\n<property name=”preAuthenticatedUserDetailsService”>
\n<bean id=”userDetailsServiceWrapper”
\nclass=”org.springframework.security.core.userdetails.UserDetailsByNameServi
\nceWrapper”>
\n<property name=”userDetailsService”
\nref=”ldapUserDetailsService” \/>
\n<\/bean>
\n<\/property>
\n<\/bean><\/p>\n
\nHere are the steps for configuring exceptionTranslationFilter:
\n1. Locate the following file: \\pentaho-server\\pentaho-
\nsolutions\\system\\applicationContext-spring-security.xml
\n2. Locate the following bean, exceptionTranslationFilter:
\n<bean id=”exceptionTranslationFilter”
\nclass=”org.springframework.security.web.access.ExceptionTranslationFilter”>
\n<constructor-arg ref=”authenticationProcessingFilterEntryPoint”\/>
\n<property name=”accessDeniedHandler”>
\n<bean
\nclass=”org.springframework.security.web.access.AccessDeniedHandlerImpl” \/>
\n<\/property>
\n<\/bean>
\n3. Replace it with the following bean declaration:
\n<bean id=”exceptionTranslationFilter”
\nclass=”org.springframework.security.web.access.ExceptionTranslationFilter”>
\n<constructor-arg ref=”preAuthenticatedProcessingFilterEntryPoint” \/>
\n<property name=”accessDeniedHandler”>
\n<bean
\nclass=”org.springframework.security.web.access.AccessDeniedHandlerImpl” \/>
\n<\/property>
\n<\/bean>
\n4. Add the following bean, below the exceptionTranslationFitler:
\n<bean id=”preAuthenticatedProcessingFilterEntryPoint”
\nclass=”org.springframework.security.web.authentication.Http403ForbiddenEntr
\nyPoint” \/><\/p>\n
\nThese steps will help you configure exceptionTranslationFilterForWS:
\n1. Locate the following bean:
\n<bean id=”exceptionTranslationFilterForWS”
\nclass=”org.springframework.security.web.access.ExceptionTranslationFilter”>
\n<constructor-arg ref=”basicProcessingFilterEntryPoint”\/>
\n<property name=”accessDeniedHandler”>
\n<bean
\nclass=”org.springframework.security.web.access.AccessDeniedHandlerImpl” \/>
\n<\/property>
\n<\/bean>
\n2. Replace it with the following bean:
\n<bean id=”exceptionTranslationFilterForWS”
\nclass=”org.springframework.security.web.access.ExceptionTranslationFilter”>
\n<constructor-arg ref=”preAuthenticatedProcessingFilterEntryPoint” \/>
\n<property name=”accessDeniedHandler”>
\n<bean
\nclass=”org.springframework.security.web.access.AccessDeniedHandlerImpl” \/>
\n<\/property>
\n<\/bean>
\n3. Save your changes.
\n4. Restart Pentaho+ Server.
\n5. Test the changes. You should be able to log into the URL served by IIS. Go to Internet
\nExplorer and type the following URL: http:\/\/localhost\/pentaho\/.<\/p>\n![\"\"](\"https:\/\/tenthplanet.in\/blogs\/wp-content\/uploads\/sites\/21\/2019\/06\/login-1-300x157.png\" "\\"\\"")
<\/p>\n","protected":false},"excerpt":{"rendered":"