LDAP how restrict the login to members of certain groups in OBIEE?

March 4, 2009
All OBIEE services are up but the application page is not opening
March 5, 2009

he question is – if you can mix LDAP and other type of authentication. In one word – yes and no.

Here’s what Oracle suggests:

1. You can have internal authentication and LDAP authentication. eg users in the rpd, and users in the LDAP.

For users not defined in the repository, the presence of a defined session system variable USER determines that external authentication is performed.
So using this method, you can have groups with internal users using the internal security, and groups with users that use the LDAP authentication.

But you cannot mix external table and LDAP authentication for example, as you cannot have different connection pools on same init block.

2. The best option would be to create your own authentication Dll (Custom authentication) so  you will have full control on what systems you will lookup for the user account.
You can write your own DLL in C++ , and have OBI Server invoke it. BI just pass the username/pwd received, and wait for an authenticated/no authenticated message from the dll.

This exists since

We provide an example of such dll.
Location for the sample one: D:\OracleBI\server\SDK\CustomAuthenticatorSamples

I wonder if anyone tried it – I think that at this time, it’d be easier to work around the requirement by using standard methods. Let’s see what John Minkjan might say about it.


  1. John Minkjan says:

    Hi Andriy,

    You know I love a challenge, But Borkur already did it:
    http://ioug.itconvergence.com/pls/htmldb/DWBISIG.download_my_file?p_file=2005. You will have to find an old C++ compliler. MS express can’t work out an “upgrade” for the SDK code.



  2. Andy says:

    Nice job John!

  3. john lee says:

    I have a problem in my OBIEE, Authentication is not done by the OBI server, any one can login into the OBI server i.e if user does not exist( new user ), then it creates the user and logins directly. Here I have not changed any privileges for that, I don’t understand why this is happening. Please suggest what are the changes that i hava to do.
    John Lee

Leave a Reply