Skip to main content
Pentaho Documentation

Pentaho Server security

Parent article

Pentaho Security is the easiest way to configure security quickly. Pentaho Security works well if you do not have a security provider or if you have a user community with less than 100 users.

The User Console enables you to define security by users and roles. The Pentaho Server controls which users and roles can access web resources through the User Console or resources in the Pentaho Repository.

Restrict or share files and folders

Access to files or folders can be refined using the Pentaho User Console. Each file or folder can either use the default permissions or you can tailor them for specific users and roles.

Before you begin

Prior to performing this task, you need to have determined whether you are going to use the default Pentaho roles, or created specific users and roles. You must also have successfully set up your security back end. Once you establish roles, you can share or restrict files and folders by role-type from the administration view within the User Console.

Procedure

  1. Log in to the User Console using the administrator role.

  2. From the Browse Files page, choose the folder you want to set permissions on from the Folders pane.

    If you want to set permissions on a specific file within that folder, click to highlight the file in the center Files pane.
  3. Click Properties in the Actions pane on the right.

    The Properties window appears.
  4. On the Share tab, highlight the Role that you want to set permissions for, then clear the check box next to Inherits folder permissions.

    The Permissions for [Role] field becomes accessible.
  5. Select the permissions for that role using the check boxes and click OK.

Results

The permissions are set for that file or folder and are associated with the selected role.

Next steps

For additional security in multi-tenancy organizations, you can hide individual users' Home folders. See Hiding user folders in PUC and PDI for more information.

Pass authentication credentials in URL parameters

Explains how to configure the Pentaho Server so you can pass authentication credentials in URL parameters.

By default, the Pentaho Server does not accept authentication credentials passed as URL parameters. To enable this, modify the security properties file on the Pentaho Server. Here is how to configure the Pentaho Server to accept credentials in a URL.

NoteIf automatic remote authentication is required, we strongly encourage you to configure using one of the Single Sign-On (SSO) solutions available such as CAS. You can also use one of our other authentication methods outlined in the Pentaho Server API documentation instead.

Procedure

  1. Go to the pentaho-server/pentaho-solutions/system directory and open the security.properties file.

  2. Set the requestParameterAuthenticationEnabled property to true like this:

    requestParameterAuthenticationEnabled=true
    
  3. Save and close the file.

  4. Stop and restart the Pentaho Server.

  5. Test the configuration by passing a username and password as URL parameters to one of the already-installed sample reports, like this:

    http://localhost:8080/pentaho/api/repos/%3Apublic%3ASteel%20Wheels%3ACountry%20Performance%20%28heat%20grid%29.xanalyzer/editor?userid=admin&password=password
    

Results

If you have configured it correctly you are not prompted to supply authentication credentials and the report displays.

Remove security

You can remove security by enabling anonymous access or by modifying data source management.

Enable anonymous access

You can bypass the built-in security on the Pentaho Server by giving all permissions to anonymous users. An "anonymousUser" is any user, either existing or newly created, that you specify as an all-permissions, no-login user, and to whom you grant the Anonymous role.

CautionThe procedure below will grant full Pentaho Server access to the Anonymous role and never require a login.

All of the files you will be using are located in the /pentaho/server/pentaho-server/pentaho-solutions/system directory. Before you begin, stop the Pentaho Server.

Modify application security
Perform the following steps to modify application security:

Procedure

  1. Open the applicationContext-spring-security.xml file with any text editor.

  2. Make sure that a default anonymous role is defined. Match your bean definition and property value to the code shown in the following example:

    <bean id="anonymousProcessingFilter" class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter">
      <constructor-arg value="foobar" />
      <constructor-arg value="anonymousUser" />
      <constructor-arg>
        <list>
          <bean class="org.springframework.security.core.authority.SimpleGrantedAuthority">
            <constructor-arg value="Anonymous" />
          </bean>
        </list>
      </constructor-arg>
    </bean>
    
    NoteThese next steps permit PDI client tools to publish to the Pentaho Server without having to supply a user name and password.
  3. Find these two beans in the same file from the previous step.

    • filterInvocationInterceptor
    • filterInvocationInterceptorForWS
  4. Locate the securityMetadataSource property inside the beans and match the contents to the code shown in the following example:

    <bean id="filterInvocationInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
      <property name="authenticationManager" ref="authenticationManager" />
      <property name="accessDecisionManager" ref="httpRequestAccessDecisionManager" />
      <property name="securityMetadataSource">
        <sec:filter-security-metadata-source request-matcher="ciRegex" use-expressions="false">
          <!-- all patterns have Anonymous role access -->
          <sec:intercept-url pattern="\A/.*\Z" access="Anonymous,Authenticated" />
        </sec:filter-security-metadata-source>
      </property>
    </bean>
    
  5. Save and close the applicationContext-spring-security.xml file.

Modify Pentaho configuration
Perform the following steps to modify the Pentaho configuration:

Procedure

  1. Open the pentaho.xml file with the text editor.

  2. Find the anonymous-authentication lines of the pentaho-system section, and define the anonymous user and role as shown in the following code example:

    <pentaho-system>
    <!-- omitted -->
      <anonymous-authentication>
        <anonymous-user>anonymousUser</anonymous-user>
        <anonymous-role>Anonymous</anonymous-role>
      </anonymous-authentication> <!-- omitted -->
    </pentaho-system>
    
  3. Save and close the pentaho.xml file.

Modify repository properties
Perform the following steps to modify the repository properties:

Procedure

  1. Open the repository-spring.properties file with the text editor.

  2. Find the singleTenantAdminAuthorityName and replace the value with Anonymous.

  3. Find the singleTenantAdminUserName and replace the value with the name <your anonymous user>.

  4. Save and close the repository-spring.properties file.

Map the appropriate role
Perform the following steps to map roles:

Procedure

  1. Find all references to the bean id="Mondrian-UserRoleMapper" and make sure that the only mapper uncommented (active) is the one shown in the following code example:

    <bean id="Mondrian-UserRoleMapper" name="Mondrian-SampleUserSession-UserRoleMapper" class="org.pentaho.platform.plugin.action.mondrian.mapper.MondrianUserSessionUserRoleListMapper" scope="singleton">
      <property name="sessionProperty" value="MondrianUserRoles" />
    </bean>
    
  2. If you have made any changes to pentahoObjects.spring.xml, save and close the file.

Results

You have now effectively worked around the security features of the Pentaho Server. If you are using the relational metadata database model, refer to Remove Security from Metadata Domain Repository for the next few steps.

Remove security from data source management

This procedure changes your data source management so that an anonymous user can access it. These steps are necessary to completely remove security from the Pentaho Server. However, this procedure does not remove all security. If you need to remove all security, enable anonymous access as described above.

Perform the following steps to completely remove security from the Pentaho Server:

Procedure

  1. If you need to, stop the Pentaho Server

  2. Open /pentaho/server/pentaho-server/pentaho-solutions/system/data-access/settings.xml file with a text editor.

    1. Find the <data-access-roles>Administrator</data-access-roles> line in the file and change the following text:

      Administrator to Anonymous
    2. Find the <data-access-view-roles>Authenticated,Administrator</data-access-view-roles> line in the file and change the following text:

      Authenticated,Administrator to Anonymous
    3. Find the <data-access-view-users>suzy</data-access-view-users> line and change the following text:

      suzy to anonymousUser
    4. Find the <data-access-datasource-solution-storage>admin</data-access-datasource-solution-storage> line and change the following text:

      admin to anonymousUser
  3. Save and close the file.

  4. Restart the Pentaho Server.