SSO options for Analytics Server (OAS)

user8686095

We are in the process of upgrading from OBIEE 12c to OAS version.

We implemented kerberos in 12c for SSO by editing the .ear files. In the current OAS version, editing ear files is not an option.

Looking for options available for implementing SSO in OAS on Windows 2019 server. Thanks.

Gianni Ceresa

The documentation is very detailed and provides 2 MOS documents about how to have a Kerberos SSO in OAS.

Keeping it simple: Kerberos SSO is managed outside OAS in Apache HTTP Server that acts as proxy in front of OAS.

It does work well and fairly simple to setup (either with an interactive wizard or by adapting a sample config file).

Do not even start trying editing the EAR, you will break things and it will not work.

https://support.oracle.com/epmos/faces/DocContentDisplay?id=2761678.1

https://support.oracle.com/epmos/faces/DocContentDisplay?id=2707401.1

Did an OAS upgrade at a customer with Kerberos SSO just few weeks ago, not a single issue.

user8686095

Thanks much Gianni Ceresa, we will proceed with Apache HTTP Server.

Can you confirm if virtual host name can be configured with Kerberos? In the past, we were asked to use actual server host name for Kerberos configuration.

Gianni Ceresa

You mean if you can have your Apache HTTP Server answering to a domain name that is different than the hostname as the proxy? Sure, that's actually the situation I had at my customer: the hostnames are different than URLs used for the OAS SSO.

user8686095

Hi Gianni,

We came across a road block setting up OAS 6.4 with Kerberos for SSO.

Apparently, there is no Kerberos module available for Apache 2.4 in Windows environment. Can you please advise if there are any options available to implement SSO for OAS in Windows environment.

Gianni Ceresa

A random quick check gave me this note:

Kerberos modules for Apache on Windows are only free available for Apache 2.2. With Apache 2.4 on Windows (x86 or x64) you either have to purchase a pre-compiled module or need to compile the latest module version on your own.

Sounds like it is possible for Apache 2.4, just depends what way you want to choose...