Security Configuration Checklist

Configuring security involves quite a few steps. Use the list below to make sure you've covered everything.

1. Plan.
   You must plan out your security before telling Pentaho how to use it. For example, you must also have the appropriate security back-ends (e.g. LDAP) in place.
   1. Determine your roles.
      What roles (out of potentially many) will have meaning in the Pentaho BI Platform?
   2. Determine which roles should have access to particular URLs.
      This is web resource authorization. Example question: What role will be considered the Pentaho administrator?
   3. Determine which roles should have which permissions to particular action sequences in the solution repository.
      This is domain object authorization. Example question: Will role A be allowed to execute action sequences in folder X?
2. If you'd like to use a role prefix, define one. (By default, there is no role prefix.)
3. Enable action sequence security.
4. Define the Pentaho administrator role.
5. Take the domain object authorization rules (from the earlier planning step) and define them in the IAclPublisher section of pentaho.xml. ^*
6. Apply the ACLs.
7. Take the web resource authorization rules (from the earlier planning step) and define them in the filterInvocationInterceptor bean in applicationContext-acegi-security.xml.
8. Optionally, customize the login page.

^* Don't forget any applicable overrides. Note: An alternative to overrides is the Permissions UI located in the Admin area. The instructions above use the Default ACL Publisher. This is a batch operation and will remove any custom permissions created via the Permissions UI!