In one of my previous blog post (https://ermanarslan.blogspot.com/2020/09/obiee-sso-integrating-with-third-party.html), I shared a third party SSO integration method for OBIEE.
We were just passing the user and password info as url arguments and it was working.
On that blog post, there was the following sentence;
That is -> We make our OBIEE to get the user and password through the OBIEE url. (on-the-fly login using url arguments).. Note that this is the simplest way of doing this work.. Ofcouse, customer's ability to post the usernames and passwords using any other method than this one, will make us change/improve the design of this login flow.
Anyways, this was one of the ways, but today we realized something else.. Something else that is refuting that way.That is, if we login to OBIEE and then try to reach ODV from there, we find ourself in a login dialog, where we should enter our user and password information once again. Yes.. This is not cool..
Fortuneatly; we have a solution for this too!
The solution is to enable LightweightSSO. Sound simple right? But wait a sec, LightweightSSO is not compatible with our 3rd party integration method , I mean -> Logging into the OBIEE from a third party app by passing user and password as arguments in OBIEE URL...
The solution is to enable LightweightSSO. Sound simple right? But wait a sec, LightweightSSO is not compatible with our 3rd party integration method , I mean -> Logging into the OBIEE from a third party app by passing user and password as arguments in OBIEE URL...
Remember, in that blog post, I already mentioned that when 12.2.1.3 LightWeightSSO is ON, NQPwd/User(I mean the URL method) won't work for OBIEE login.. So, as I mentioned in that earlier blog post, we disabled LightWeightSSO to be able to pass user and password info through url.
However; when the LightWeightSSO is disabled, we can't directly reach ODV from OBIEE.. I mean, ODV requires us to re-enter our user and password info as I just mentioned.
So it is not acceptable.
This means we need to enable LightWeightSSO to make automatic SSO integration between OBIEE and ODV work.. Ofcourse, this time (when the LightWeightSSO is enable), our OBIEE login (through url arguments user and password) will not work..
Well, this is what makes me write this blog post.
The question : How can we login to OBIEE from a 3rd application automatically in a custom SSO-like way, even when the LightWeightSSO is enabled?
In order to answer this, we take a look at the OBIEE login flow, I mean we do a technical login mechanism analysis.
I don't mean a code analysis, but we use our browser (For instance Chrome-> F12-> Network tab) to analyze the http requests, http headers and the form data.. We need to check the required the arguments.
Once we do those analysis; we can see that, when the LightWeightSSO is enabled, the login page changes.
Our login page becomes login.jsp. Login.jsp get the user and password info from the user and authenticates it using "login" (without .jsp suffix).
So when we check that "login", we see that it is designed to receive some POST request arguments. j_username, j_password and so on.
So if we can make a HTTP POST request to "login" directly from our 3rd party app, it should work..
This way, we will be able to pass the username and password info to OBIEE and OBIEE will let us in automatically. (even when the LightWeightSSO is enabled!)
So, we create a simple html to test this..
Note that the values that you see below are just examples. ->
<html>
<form id='redirectForm' method='POST' action='https://oiee_host:obiee_port/bi-security-login/login'>
<input type='hidden' name='j_username' value='weblogic'/>
<input type='hidden' name='j_password' value='erman'/>
<input type='hidden' name='j_msi' value='none'/>
<input type='hidden' name='j_language' value='en'/>
<input type='hidden' name='j_redirect' value='L2FuYWx5dGljcy9zYXcuZGxsP2JpZWVob21lJnN0YXJ0UGFnZT0xJmhhc2g9RlEyeDZFaGp3cnJHQXNzbmVWOWtSeVVuYmxVQjYyczZMR0JESFEtR3F5ZEoxcXh2bjMyMmxKaUlwU1R4VFIxMA'/>
</form>
<h1><a href="#" onclick="document.getElementById('redirectForm').submit()">GO!!</a></h1>
</body>
</html>
Please note the hidden input names -> j_username, j_password, j_msi, j_language and j_redirect..
j_redirect is the url that OBIEE will redirect us after the login process. It is in the base64 form. (in this case it is basically set to -> /analytics/saw.dll?bieehome&startPage=1)
So, we open this html with our browser and click GO! Guess what? We found ourselves in the OBIEE home page! (logged in automatically in the backend by posting user and password info) So it works!
At the end; we pass this html to the developers of the third party application as a reference and they modify their OBIEE login code and that's it :) We login to OBIEE automatically from a 3rd app automatically even when the LightWeightSSO is enabled.
I 'm not finished! :)
If the third party app requires a form, and if it doesn't like the form of the login.jsp. (because it is doing its work with javascript probably) , I mean if the 3rd party app requires a submit button, then we create a wrapper html like the one below and deploy it to our Weblogic (or any webserver that we have)..
Want to deploy it to a Weblogic? -> here is the way -> "How To Publish a Static HTML Page To WebLogic Server and Request Through Oracle HTTP Server 11g (Doc ID 1192439.1)" -- Part 1 is enough..
With this action, we actually put a middle man between our 3rd app and OBIEE login and make the 3rd app to post to OBIEE login using that middle man :) This works too!
So the flow becomes; "3rd pary app -> Wrapper html -> OBIEE Login"
<html>
<form name="loginform" method='POST'
action='/bi-security-login/login'
style="visibility:hidden">
<input type='hidden' name='j_username' value=''/>
<input type='hidden' name='j_password' value=''/>
<input type='hidden' name='j_msi' value=''/>
<input type='hidden' name='j_language' value=''/>
<input type='hidden' name='j_redirect' value=''/>
<input type='submit' value='Login'/>
</form>
</body>
</html>
That is it for today:) I hope this will help you.
No comments :
Post a Comment
If you will ask a question, please don't comment here..
For your questions, please create an issue into my forum.
Forum Link: http://ermanarslan.blogspot.com.tr/p/forum.html
Register and create an issue in the related category.
I will support you from there.