Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Finally found a solution. I ended up creating a redirect.jsp file on the Pentaho server. Then, I passed an encrypted http auth token to it, decrypted it, and then redirected to the login. Works great.</p> <p><strong>EDIT</strong></p> <p>Really old question but I was asked to provide more information on my solution. So here goes.</p> <p>First, the default install of Pentaho used <code>HTTP Basic Authentication (BA)</code>. If you're using a single sign-on or LDAP solution this might not work for you.</p> <p>So what I did was put a <code>JSP</code> file in the <code>ROOT</code> folder under <code>..tomcat\webapps\ROOT</code>. That JSP takes the passed in login information and de-crypts it. That login information is just a <code>BASE64</code> authenticated request.</p> <p>This isn't super secure, by any means. But what it allowed me to do was send an encrypted user/pass from one server and pass it to another server. Of course, if you're SSL all the way then this probably isn't needed but we had a situation where the information was being passed in clear text INTERNALLY. So, it was never exposed to the outside but I still wanted to make sure our internal servers are as secure as possible.</p> <p>The JSP:</p> <pre><code>&lt;%@page contentType="text/html; charset=iso-8859-1" language="java" import="java.security.*" import="javax.crypto.Cipher" import="javax.crypto.spec.SecretKeySpec" import="sun.misc.*" %&gt; &lt;% // Decrypt authenticated hash String ALGORITHM = "AES"; byte[] keyValue = "MY-SECRET-PASSWORD".getBytes(); Key key = new SecretKeySpec(keyValue, ALGORITHM); Cipher c = Cipher.getInstance(ALGORITHM); c.init(Cipher.DECRYPT_MODE, key); byte[] decodedValue = new BASE64Decoder().decodeBuffer(new String(request.getParameter("auth"))); byte[] decValue = c.doFinal(decodedValue); String decryptedValue = new String(decValue); %&gt; &lt;script type="text/javascript"&gt; var auth = '&lt;%= decryptedValue%&gt;'; function AJAX(url, callback) { var req = init(); req.onreadystatechange = processRequest; function init() { if (window.XMLHttpRequest) { return new XMLHttpRequest(); } else if (window.ActiveXObject) { return new ActiveXObject("Microsoft.XMLHTTP"); } } function processRequest () { // readyState of 4 signifies request is complete if (req.readyState == 4) { // status of 200 signifies sucessful HTTP call if (req.status == 200) { if (callback) callback(req.responseXML); } } } this.doGet = function() { req.open("GET", url, true); req.setRequestHeader("Authorization", "Basic " + auth); req.send(null); } } var url = "/pentaho/Home"; var querystr = ""; var ajax = new AJAX(url, function(){ window.location = url; }); ajax.doGet(querystr); &lt;/script&gt; </code></pre> <p>So, my login server authenticates the user against the same MySQL database Pentaho uses, creates the authenticated (BA) request, BASE64's it, encrypts it using the same <code>MY-SECRET-PASSWORD</code> and sends that to the JSP. The JSP then de-crypts it and reads the BA header and passes that on to Pentaho.</p> <p>Works great for us.</p> <p>Hope it helps someone out.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload