Domain Authentication: Linux

If the developed web application prompts authentication in platform repository under the domain user, organizing of such scheme may require additional setting of both DBMS server and BI server installed on Linux. See below an example of domain authentication setting in Ubuntu. If Oracle DBMS is used, the specified settings are relevant for integrated domain authentication work.

NOTE. To enable domain authentication, make sure that the web application is based on Apache or Internet Information Services web server. The domain authentication based on Apache Tomcat cannot be set up when working in Linux.

DBMS Server

Domain authentication is available on deploying of server on an Oracle DBMS 11.x and later or PostgreSQL. On working with Oracle, a DBMS server must be prepared by using one of the following instructions:

On working with PostgreSQL, authentication must be set up using the GSSAPI method according to the DBMS documentation.

Setting Up BI Server of Foresight Analytics Platform

It is assumed that DBMS server and BI server are located at different physical servers.

Download Oracle client from the official website (the basic, devel, sqlplus packages in the RPM format are required).

Consider installation using the example of the Oracle 12.1 client. Execute the following operations:

On working with Debian-based distribution file:

Convert the RPM packages into the DEB format by means of the alien utility:

sudo apt-get install alien
sudo alien oracle-instantclient12.1-basic-12.1.0.2.0-1.x86_64.rpm
sudo alien oracle-instantclient12.1-devel-12.1.0.2.0-1.x86_64.rpm
sudo alien oracle-instantclient12.1-sqlplus-12.1.0.2.0-1.x86_64.rpm

Install the obtained DEB packages (in the terminal using the dpkg utility or a similar utility) and the libaio auxiliary package:

sudo apt-get install libaio1
sudo dpkg -i oracle-instantclient12.1*

On working with RedHat-based distribution file:

Copy RPM packages and install them with the following command:

sudo yum localinstall oracle-instantclient*

After the installation add a path to the Oracle client libraries using the ldconfig utility to the list of dependent library search and update cache:

echo "/usr/lib/oracle/12.1/client64/lib" > ~/oracle.conf
sudo cp ~/oracle.conf /etc/ld.so.conf.d/
sudo ldconfig

After BI server is installed, it is required to add export of the TNS_ADMIN variable with specifying the directory containing the tnsnames.ora file to the /etc/opt/Foresight/fp9.2-biserver/envvars environment variables file for Apache2 instance. The Apache2 instance should have access to the file, the www-data:www-data owner can be set for the tnsnames.ora file.

For details about creating a repository database see the Preparing Oracle Server subsection.

Setting Up Kerberos Client

If "kinit: Generic preauthentication failure while getting initial credentials" error occurs, add the following to /etc/krb5.conf:

Setting Up Oracle Client

Setting Up Apache

Along with the main Apache HTTP Server setup, which will be executed during BI server package installation, execute additional setup.

In Ubuntu, the module is located in standard repositories, execute the following to install it:

It is assumed that keytab file for HTTP service is located at /etc/apache2/http.keytab and has read permissions for www-data.

After installation and activation of the module, correct the settings file /etc/apache2/mods-enabled/auth_kerb.conf as follows (replace <server> with the server name where BI server of Foresight Analytics Platform is deployed):

# To enable or disable the use of the Negotiate method. You need a special support on the browser side to support this mechanism.

# To enable or disable the use of password based authentication for Kerberos v5.

# If set to off this directive allow authentication controls to be pass on to another modules.

# This option takes one or more arguments (separated by spaces), specifying the Kerberos realm(s) to be used for authentication.

# This defaults to the default realm taken from the local Kerberos configuration.

# This option can be used to disable the verification tickets against local keytab to prevent KDC spoofing atacks.

# For specification the service name that will be used by Apache for authentication.

# This option takes one argument, specifying the location of the Kerberos V5 keytab file.

# It will use the "default keytab" from Kerberos V5's config if it is not specified here.

# The keytab file must be readable for the apache process, and should be different from other keytabs in the system.

# Always offer Basic authentication regardless of KrbMethodK5Pass and pass on authentication to lower modules if Basic headers arrive.

# Set to 'on' to have Kerberos do auth_to_local mapping of principal names to system user names.

Add the following strings in the file /etc/apache2/sites-enabled/000-default.conf (the name may be without .conf):

Correct work via Kerberos on Apache requires the modified coworker mpm module instead of the worker module. This is required to isolate user authentication processes.

ExpireTimeout 3600 # timeout in seconds, upon the expiry of which the process can be reused by a new user

Setting Up LDAP

Active Directory work can be checked without Apache, to do this, initialize domain user credentials cache via kinit. Then run axis2_http_server under the same local user who was used to run kinit.

Setting Up Internet Information Services

Description of web application setup deployed at web server running on Windows OS is given in the Setting Up Domain/Integrated Domain Authentication on ASP.NET Web Server article. The relevant operations are PP.xml file setup (item 5), enabling delegation (item 7), and browser setup (item 8).