In a previous blog entry, I talked about scaling out your Microsoft Business Intelligence solution to get the performance you need. But what about security?
PerformancePoint Server, Sharepoint Server and Report Server are all web-based products that support a multi-tier architecture. At the minimum we are talking about 3 tiers: Client tier, Web/Application Server tier, and Database Server tier. That points to at least 3 layers of security: web host security, application security and database security. Each layer applies to the final effective permissions of the user so we need to administer at each layer individually. Being a Microsoft solution, the ideal authentication model is IIS using Windows Integrated mode running in an intranet environment. This provides a single sign-on solution. Going out to the internet usually means using Basic Authentication with SSL encryption for security which complicates things in terms of multiple user accounts and the mapping between them.
PerformancePoint Server, Sharepoint Server and Report Server as applications, all support role-based security models but each has to be administered. For instance, at the Report Server level we define membership to roles that have access to folders that contain reports. The user only sees the reports that they are authorized to run. However, if you run SSRS in Sharepoint Integrated mode, you can set up security for both directly in Sharepoint.
Of course, the third layer is database security and depends on the database you’re using for your business data. Assuming SQL Server and Analysis Services, both support role-based security too so you can protect your data by membership to roles. SSAS only supports Windows Authentication so again Microsoft is guiding us towards Windows Integrated Security.
All the details and recommended best practices are listed in Microsoft’s extensive “Deployment Guide” for PPS 2007.
In recent years I have applauded Microsoft for recognizing the end of any “single vendor” solution by supporting open standards like XML and the co-existence with Oracle and DB2.
The more we talk about Business Intelligence, the more it seems Microsoft is falling into old habits.
Cheers
Brian
