Kerberos and other things you need for fully functional authentication of SSAS through Cognos (Intro)

Kerberos is one of the topics that gives the creeps to most BI folks... The setup is seriously full of strange abbreviations and vaguely explained features which might look scary the first time you encounter them (sure got me confused...). Anyhow, upcoming will be a series of posts with which I will try to demystify Kerberos setup for your Cognos installation so you can finally enjoy a fully functional data level security setup in your SSAS cubes.


We will assume that you already have a working environment to start with, authenticating to SSAS with one static user account. Before moving along, just make sure you can access your cube via analysis studio.


The sample setup of hardware is like the following:

Web gateway is a IIS7.0 web server with Cognos Gateway components installed on it.
App servers have the Cognos application tier components and the actual Cognos services running on them.
SSAS is the DB server hosting our cube.
All servers running Win 2008 server.


Normally, there is nothing to install to get Kerberos authentication working. It is already there and merely waiting for things to be set up correctly before it kicks in. That said, there are multiple parts of your environment that need to be taken care of in order for Kerberos to work- every single server/service that happens to be in between the user and SSAS server has to be identified and configured correctly.

We will look into these parts:

• Windows server related configuration;
• Active Directory setup;
• Cognos server component setup;
• Web client and server configuration.

So here we have it. It might seem like quite a few bits and pieces, but you should not get too worried, we'll get your Cognos authenticating to SSAS in no time. The full story will consist of this and four more posts. We'll take a look into windows related issues next week.

M.