SSO - Jedox 5.1 SR5 - Authenticating Windows users while keeping their internal Jedox Groups

Olivier Chatelain · Sep 17th 2015, 11:40pm

Currently configuring Jedox 5.1 SR5 - I'm looking for a "OnWindowsUserAuthorize" Template, that offers the abilty to Authenticate (sso) Wndows users while keeping their internal Jedox Groups.

Thanks in advance.
Grüsse

Olivier

p.hildebrandt · Sep 18th 2015, 6:26am

This is something I would like to set up too.

laloune · Sep 18th 2015, 10:24am

Can you be more specific?

when using OnWindowsUserAuthorize event you must keep the internal Jedox groups and reflect them in the AD, as well as maintain the memberOf property on each user

dominik_l · Sep 18th 2015, 5:32pm

Hi,
you can use the OnWindowsUserAuthorize event to define a new set groups for the user instead of those returned by third party system. E.g. in your php code, you can try to access System DB, read the User's groups (which of course you then have to maintain manually), and set those.

p.hildebrandt · Sep 21st 2015, 10:45am

And here is the problem (not sure if this is Oliviers problem as well).
I dont want to refelct the jedox groups in the AD. The only thing I want to use is an automatic password check against the AD without using any group information from either side.
The group in AD are completely different from the ones in Jedox and vice versa.

I just want to have some kind of single sign on behaviour when the user opens a certain URL (in our scenario this would be the main page of the web standalone environment).

Olivier Chatelain · Sep 23rd 2015, 11:36pm

Hi all,
I'm exactly trying to do that.
I'currently trying to implement a workaround: extracting user's jedox groups and filling &groups parameter in function OnWindowsUserAuthorize.
It doen't work for the moment : I think my group array structure is not valid!

the function looks like this :

Source Code

public function OnWindowsUserAuthorize($domain, $username, array $winGroups, array& $groups) { // bool
$Test_User = "";
$User_Group = "";
$Login_User = $domain.'\\'.$username;
sep_log("<< User Windows authorize: domain $domain, username $username, WindowsGroup $winGroups[0], Domain User $Login_User>>");
$Test_User = palo_ename("SupervisionServer/System","#_USER_",$Login_User);
$Allgroups = palo_dimension_list_elements("SupervisionServer/System","#_GROUP_");
$i=0;
$j=0;
foreach ($Allgroups as $value) {
$User_Group = $value['name'];
$Is_User_group = palo_data("SupervisionServer/System","#_USER_GROUP",$Login_User,$User_Group);
// sep_log("test Group $i: $User_Group - $Is_User_group");
if ($Is_User_group == 1) {
sep_log("User $Login_User belongs to $User_Group");
$groups[$j] = $User_Group; // here I put jedox group!
$j++;
}
$i++;
}
// small check for debug:
sep_log("User $Login_User in now trying to connect JEDOX with groups : ");
foreach ($groups as $value) {
sep_log("Group : $value");
}
sep_log("<<END - On Windows User Authorize >>");
return true;
}

Display All

Thanks in advance for any ideas.

Olivier

laloune · Sep 24th 2015, 12:28pm

Hi Olivier,

I have the impression that the $groups variable cannot be overridden, the parameter is passed by reference (hence the & before the variable)

try to remove the & before the parameter, then you should be able to override it

not tested though.

hope this helps!

Olivier Chatelain · Sep 25th 2015, 5:59pm

Finally it works : the problem came from the last lines of the function:

Olivier Chatelain wrote:

// small check for debug:

sep_log("User $Login_User in now trying to connect JEDOX with groups : ");
foreach ($groups as $value) {
sep_log("Group : $value");

I assume, the foreach instruction modify the & pointer value. We can now authenticate ourselves with AD accounts and keeping Jedox groups.

Warm regards.

Olivier

p.hildebrandt · Sep 30th 2015, 8:48am

This is really great news. Could you pls guide me where to put the script above, so we can try this in our environment.

Thanks in advance,
Peer

p.hildebrandt · Oct 5th 2015, 9:28am

Does nobody know how to configure the SVS and where to place the script above?
I would be very greatful if someone has an idea of how to make Olivier's SSO-Script work.

Regards, Peer.

Olivier Chatelain · Oct 7th 2015, 9:16am

Hello,

I used the following examples from svs/samplescripts folder:

adLDAP.php
sep.inc.adldap_sample.php

I made a copy in svs/custom_scripts renaming them:

adLDAP.php
adLDAP.phpsep.inc.adldap_XXX.php

Finally, I modified sep.inc.php in svs folder to use my custom scripts:

PHP Source Code

<?php
include './custom_scripts/sep.inc.adldap_XXX.php';
?>

You can then modify class SEPEventHandler extends SEPEventHandlerBase and rewrite the function OnWindowsUserAuthorize($domain, $username, array $winGroups, array& $groups

For sso, you don't need adLDAP.php library, but I implement it to use also a standard LDAP authentication (it's useful when testing on a user PC with a different account).

Take care.

Olivier.

p.hildebrandt · Oct 7th 2015, 12:24pm

Thank you very much, I will try it in our environment.

Olivier Chatelain · Oct 7th 2015, 9:30pm

don't forget to remove

sep_log("User $Login_User in now trying to connect JEDOX with groups : ");
foreach ($groups as $value) {
sep_log("Group : $value");

Olivier

p.hildebrandt · Oct 13th 2015, 10:54am

Hi Olivier,

unfortunately I'm not getting there...
Could you pls post your complete sep.inc.adldap_XXX.php file so I can analyse the differences.

Regards

Olivier Chatelain · Oct 22nd 2015, 10:49pm

Hi, one remark,

To ensure the sso process my user account are created : domain\useraccount in jedox, where domain is the net bios domain name.

Zum beispiel TEISAN\Alvin.tang

Then, if I perform an ldap authentication, we had to split the account username from the domain.

Macht es gut.
Grüße

Olivier

p.hildebrandt · Nov 2nd 2015, 3:05pm

Hi Olivier,

unfortunately I hit the same problem.
A user containing "domain\" as profix was created once sso was configured correctly.

But this is a huge issue because all of the users are already contained in System-Database without the domain-prefix.
Do you think there is a way to supress the creation of new elements containing the domain and use the user already created?

If possible the system should recognize a user only as "username" and nothing else.

Regards, Peer.

Olivier Chatelain · Nov 2nd 2015, 11:04pm

Hallo,

Did you test replacing :

Source Code

$Login_User = $domain.'\\'.$username;

by

Source Code

$Login_User = $username;

directly?

Grüsse.

Olivier.

p.hildebrandt · Nov 5th 2015, 6:43am

Nope, but probably a good idea

p.hildebrandt · Dec 18th 2015, 10:14am

Olivier Chatelain wrote:

Hallo,

Did you test replacing :

Source Code

$Login_User = $domain.'\\'.$username;

by

Source Code

$Login_User = $username;

directly?

Grüsse.

Olivier.

Unfortunately replacing does not prevent Jedox from creating a new element with domain-prefix.
Any other ideas?

p.hildebrandt · Dec 18th 2015, 10:23am

Btw, how did you manage to still use LDAP as fallback?
For me it looks like I can use either SSO or LDAP.

SSO - Jedox 5.1 SR5 - Authenticating Windows users while keeping their internal Jedox Groups

SSO - Jedox 5.1 SR5 - Authenticating Windows users while keeping their internal Jedox Groups

Source Code

Olivier Chatelain wrote:

PHP Source Code

Source Code

Source Code

Olivier Chatelain wrote:

Source Code

Source Code

Share

Tags

Similar Threads