Security Issues

Increase Security Log Levels in the Pentaho Server

1. Stop the Pentaho Server with the following script:

   sh /usr/local/pentaho/server/pentaho-server/stop-pentaho.sh

2. Open the /pentaho/server/pentaho-server/tomcat/webapps/pentaho/WEB-INF/classes/log4j.xml file with a text editor.
3. Use XML comments (<!-- -->) to disable all of the Threshold parameters in all of the appender elements.
4. Change the priority value in the <root> section to one of the following logging levels: WARN, ERROR, FATAL, or DEBUG (depending on which level you prefer):

   <root>
     <priority value="DEBUG" />
     <appender-ref ref="PENTAHOCONSOLE"/>
     <appender-ref ref="PENTAHOFILE"/>
   </root>

5. Add the following log statements directly above the root element:

   <!-- all Spring Security classes will be set to DEBUG -->
   <category name="org.springframework.security">
     <priority value="DEBUG" />
   </category>
   
   <!-- all Pentaho security-related classes will be set to DEBUG -->
   <category name="org.pentaho.platform.engine.security">
     <priority value="DEBUG" />
   </category>
   <category name="org.pentaho.platform.plugin.services.security">
     <priority value="DEBUG" />
   </category>

6. Save and close the file, then edit the Spring Security configuration file that corresponds with your security back end in the /pentaho/server/pentaho-server/pentaho-solutions/system/ directory. The file will be one of the following options:
   • applicationContext-spring-security-memory.xml
   • applicationContext-spring-security-jdbc.xml
   • applicationContext-spring-security-ldap.xml
7. Find the daoAuthenticationProvider bean definition, then add the following property anywhere inside of it (before the </bean> tag):

   <property name="hideUserNotFoundExceptions" value="false" />

8. Save the file and close the text editor.
9. Start the Pentaho Server with the following script:

   sh /usr/local/pentaho/server/pentaho-server/start-pentaho.sh

Log Output Security Analysis

The following examples help to determine the location of security configuration issues in the pentaho.log:

• When you request a page that is protected, but you are not yet logged on, you should see an exception in the log which looks like the following text:

DEBUG [ExceptionTranslationFilter] Access is denied (user is anonymous);
            redirecting to authentication entry point org.springframework.security.AccessDeniedException:
            Access is denied

• When the user name and/or password does not match what is stored in the back end, you should see a log message like the following text:

WARN [LoggerListener] Authentication event
            AuthenticationFailureBadCredentialsEvent: suzy; details:
            org.springframework.security.ui.WebAuthenticationDetails@fffd148a: RemoteIpAddress: 127.0.0.1;
            SessionId: 976C95033136070E0200D6DA26CB0277; exception: Bad credentials

• When the user name and password match, you should see a log message that looks like the following example:

WARN [LoggerListener] Authentication event InteractiveAuthenticationSuccessEvent:
            suzy; details: org.springframework.security.ui.WebAuthenticationDetails@fffd148a: RemoteIpAddress:
            127.0.0.1; SessionId: 976C95033136070E0200D6DA26CB0277 DEBUG
            [HttpSessionContextIntegrationFilter] SecurityContext stored to HttpSession:
            'org.springframework.security.context.SecurityContextImpl@2b86afeb: Authentication:
            org.springframework.security.providers.UsernamePasswordAuthenticationToken@2b86afeb: Username:
            org.springframework.security.userdetails.ldap.LdapUserDetailsImpl@d7f51e; Password: [PROTECTED];
            Authenticated: true; Details: org.springframework.security.ui.WebAuthenticationDetails@fffd148a:
            RemoteIpAddress: 127.0.0.1; SessionId: 976C95033136070E0200D6DA26CB0277; Granted
            Authorities: ROLE_CTO, ROLE_IS, ROLE_AUTHENTICATED'

After the InteractiveAuthenticationSuccessEvent, one of the filters will show the roles fetched for the authenticated user. Compare these roles to the page-role mapping found in the filterInvocationInterceptor bean in applicationContext-spring-security.xml.

If you are troubleshooting LDAP problems, look for log output similar to the following text:

DEBUG [DirMgrBindAuthenticator] (LoggingInterceptor) Return value: LdapUserInfo:
            org.springframework.security.providers.ldap.LdapUserInfo@1f31c64[dn=uid=suzy,ou=users,ou=system,attributes={mail=mail:
            suzy.pentaho@pentaho.org, uid=uid: suzy, userpassword=userpassword: [B@e17c9c,
            businesscategory=businesscategory: cn=cto,ou=roles,ou=system, cn=is,ou=roles,ou=system,
            objectclass=objectClass: organizationalPerson, person, groupOfUniqueNames,
            inetOrgPerson, top, uniquemember=uniquemember: cn=cto, ou=roles, cn = is , ou = roles,
            sn=sn: Pentaho, cn=cn: suzy}]

LDAP Roles Issues with Admin and Authenticated

You must not use Admin and Authenticated roles in your LDAP. Instead, you must configure your system to use pentahoAdmins and pentahoUsers or other easily identifiable role names.

Open /pentaho-solutions/system/applicationContext-spring-security.xml in a text editor. At the bottom of this file, you will find a number of entries that look like:

A/docs/.*Z=Anonymous,Authenticated

These are entries for URL security. They are regular expressions to match a path on the browser’s URL that require the user to be a member of the defined role to gain access. For this example, both Anonymous and Authenticated gain access.

We replace Authenticated with pentahoUsers by entering A/docs/.*Z=Anonymous,pentahoUsers. For all entries that show Authenticated, replace it with pentahoUsers or your chosen name. Replace Admin with pentahoAdmins or your chosen name.

For the change from Authenticated to pentahoUsers, replace all occurrences. For Admin to pentahoAdmins you need to be a little more careful because there are some entries that look like this: A/admin.*Z=pentahoAdmins.

Edit the /pentaho-solutions/system/repository.spring.xml file and make the following changes.

From:

<bean id="singleTenantAuthenticatedAuthorityName" class="java.lang.String">
    <constructor-arg value="Authenticated" />
   </bean>

To:

<bean id="singleTenantAuthenticatedAuthorityName" class="java.lang.String">
    <constructor-arg value="pentahoUsers" />
   </bean>

From:

<bean id="singleTenantAdminAuthorityName" class="java.lang.String">
    <constructor-arg value="Admin" />
   </bean>

To:

<bean id="singleTenantAdminAuthorityName" class="java.lang.String">
    <constructor-arg value="pentahoAdmins" />
   </bean>

With LDAP Authentication, the PDI Repository Explorer is Empty

1. Stop the Pentaho Server.

2. Delete the security and default directories from the following directory: /pentaho-solutions/system/jackrabbit/repository/workspaces/.
3. Start the Pentaho Server.

You should now have a proper LDAP-based Pentaho Repository that can store content and create new directories.

LDAP Incorrectly Authenticates User IDs That Do Not Match Letter Case

Some LDAP implementations are case-insensitive, most notably Microsoft Active Directory. When using one of these LDAP distributions as a Pentaho Server authentication back end, you might run into an issue where a valid user name with invalid letter cases will improperly validate. For instance, if Bill is the valid user ID, and someone types in bILL at the User Console login screen, that name will authenticate, but it might have improper access to parts of the Pentaho Server.

1. Stop the Pentaho Server.
2. Edit the /pentaho/server/pentaho-server/pentaho-solutions/system/applicationContext-spring-security-ldap.xml file.
3. Find <bean class="org.pentaho.platform.plugin.services.security.userrole.ldap.DefaultLdapAuthenticationProvider">, and below the last </constructor-arg> element therein, and add the <property> definition shown in the following example:

   <property name="userDetailsContextMapper">
       <ref bean="ldapContextMapper" />
   </property>

4. After the </bean> tag for daoAuthenticationProvider, add the following bean definition, changing the ldapUsernameAttribute from samAccountName to the value that matches your environment:

   <bean id="ldapContextMapper" class="org.pentaho.platform.engine.security.UseridAttributeLdapContextMapper">
       <property name="ldapUsernameAttribute" value="samAccountName" />
   </bean>

5. Start the Pentaho Server.

The Pentaho Server will now force case sensitivity in LDAP user names.