The I.T. Side

What Shared Services Does

Shared Services is a component of the “foundation services”.  It is the mechanism that provides a common framework for user security and administration.  It is the first component that is installed in an installation.  Once up and running, all Hyperion products and modules “plug-in” to this base.  Shared Services provides a single interface to:

1. Define External Authentication providers (ie – corporate LDAP, MSAD, etc)
2. Provision Users and Groups
3. Life Cycle Management (promotion of artifacts between DEV and PROD)

Products communicate with Shared services though a common API which allows all the products to employ true single sign-on between the products.

Shared Services components

There are 4 major components of what we collectively call Shared Services:

1. Shared Services web server.  The Web Server for the Shared Services communication and interface.  Default URL and port is http://<server&gt;:58080/interop
2. Native Directory.  A small file-based OpenLDAP directory that comes with Shared Services to store provisioning information
3. Relational Repository.  A small relational database (ie Oracle, SQL Server, etc) that stores location information
4. Corporate External Authentication (optional).  Your (already existing) corporate external authentication mechanism.

If you do not have a corporate external authentication provider you can use the provided Native Directory to create users and passwords to provision.  However, doing this puts you into the password and account maintenance business. If you do have one, you will want to use it, as that will be taken care of for you. Shared Services will not store passwords of externally authenticated users, it simply forwards on the ID/Password combination to the provider for a thumbs-up or thumbs-down. You can have multiple user directories configured and set a search order for them.

The Native directory holds user IDs and Passwords of Natively authenticated users, provisioning information for all users, and tracks user-group relationships.  Again, this is stored in the OpenLDAP repository that comes with Shared Services. The OpenLDAP that comes with HSS  is a simple file-based database that is in LDAP format which runs on port 58089.  You can actually use an LDAP browser and connect to OpenLDAP and browse around using a base DN of dc=css,dc=hyperion,dc=com.

The relational component is a separate database (or schema in Oracle) that holds registration information about the products in the environment.

The following diagram summarizes the components.  Again, the corporate LDAP authenticates the user (are they who they say they are), the relational holds product registration information (can they access this particular product), and the native directory handles authorization (do they have permission to do what they are requesting to do in this product).

Provisioning users and Groups

The User Management console using the URL http://<server&gt;:58080/interop is used to provision users.  Provisioning is the process of granting access to users to certain products and services.  Here we browse through the users, and provision Henry for the BBB Essbase Application and the Finsrvs FDM application, and the TotPlan Planning Application.

Show all users

Right click on Henry

Provision

The Process of Authentication

Once a product is registered with Shared Services, it receives and stores location of the user directories.  So when a user logs into a product, the process is as follows:

1. The user enters the ID and Password into the product log-in screen
2. The product queries all the configured user directories to verify the credentials.  Upon success, the user is authenticated.
3. Once authenticated, the product contacts Shared Services to lookup the provisioning information of the user to see if the user has been given the access to the product and service.
4. SSO is enabled for this user now for the rest of the products they are provisioned for.

What This Means for our System Administrator Brethren

1. Shared Services must be the first to be installed and configured
2. Shared Services must be the first to be started (along with OpenLDAP).  Note:  it can take a while for Shared Services to come up.  Make sure you wait a while and check that HSS is all the way up by going to the URL before starting the other services)
3. Shared Services is a single point of failure for all Hyperion Products.
4. You must be diligent in backing up Shared Services, including
   • Shared Services relational database
   • OpenLDAP (see the backup/recovery guide ….there is a utility that backs up the OpenLDAP directory)

~ by Eric Helmer on October 10, 2008.

Posted in Uncategorized
Tags: Add new tag, LDAP, openLDAP, Shared Services