Siebel 8.

0 Essentials

Securing access to the application

1 of 18

Module 12: Securing Access to the Application

Module Objectives
To describe the types of user authentication in use by Siebel

application To explain the role of the security adapter To describe Single Sign On (SSO) security and how it differs from other authentication methods

Securing access to the application

3 of 18

Siebel Application Security

Siebel applications are secured at various levels:

Security in restricting data and access to views corresponding to different users Subject of previous module Only authorized users can access the application Subject of this module Securing the Communication between architecture components Subject of subsequent module

Securing access to the application

4 of 18

Authentication
Is the process of validating a users identity It concerns with verifying the identity of users before they gain

access to a Siebel application

Typically consists of collecting a set of user credentials such as

user ID and password and comparing them to pre-stored values

Securing access to the application

5 of 18

Supported Authentication Methods

Siebel applications carry out authentication by either the

Siebel servers or the Web server. In this case, its done with the help of :
Siebel security adapters are software programs that allow Siebel
servers to authenticate users Single Sign On (SSO) allows the Web server to authenticate users Siebel Web Server Extension performs authentication check Security adapter is still involved in verifying the trust token passed to it by the Web server A trust token is a software object confirming the identity og the sender. May contain additional information such as user identity or database login to be passed to the server

Securing access to the application

6 of 18

Siebel Security Adapters

A security adapter is a piece of software that connects to an

authentication service
It is Implemented as a part of the Application Object Manager (AOM)
An authentication service

A store of credentials plus a mechanism to compare user provided credentials against the stored credentials

Securing access to the application

7 of 18

Authentication Services
Siebel applications support multiple authentication services:

Database authentication Lightweight Database Authentication Protocol (LDAP) Active Directory Services Interface (ADSI) Custom authentication using the Siebel Security Adapter Software Developers Kit (SSASDK) Creating custom security adapters is beyond the scope of this course Refer to the Siebel Security Adapter SDK in Bookshelf

Securing access to the application

8 of 18

Database Authentication
Users are authenticated against the underlying database The database Security Adapter uses is the default for Siebel

applications

Securing access to the application

9 of 18

Database Authentication Considerations

Additional infrastructure components such as directory servers

are not required Uses a separate database login for each user
Requires ongoing support from a database administrator
May support the following account policies :

Password expiration Password syntax Account lockout

Supports minimal user self-management

User cannot perform self-management without being granted direct access to the database server

Securing access to the application

10 of 18

Directory Server Authentication

Authentication for users is carried out against an external directory service The directory service contains the users credentials and administrative

information A single reserved database login is typically used for all users
The default database login is LDAPUSER

Securing access to the application

11 of 18

Directory Service Considerations

Facilitates easier administration because it :

Eliminates maintenance of a separate database login for each user Allows Web users to self-register and maintain login information Allows automated creation of users from User Administration view Allows external delegated administration of users

Allows credentials store to be shared across multiple

applications May support account policies based on those of the directory service
Password expiration Password syntax Account lockout

Securing access to the application

12 of 18

Single Sign On
Web Server provides credentials to third-party service Security Adapter looks up and retrieves Siebel user ID, DB account

based on identity key from external source

Securing access to the application

13 of 18

Single Sign On Considerations

Allows users to access multiple applications without any further

login
For example, Windows Integrated Authentication allows users to

access Siebel applications directly once they have logged in to their Windows accounts
Uses credentials that are collected and verified by the Web

server
Management of authentication can be performed from a single

centralized location
Requires the use of a trust token

Secret value shared by the Web server and Object Manager

This facilitates the deployment of Siebel Application in Web sites

and portals

Securing access to the application

14 of 18

Single Sign On Considerations

Some Siebel User Administration features that are not available

using SSO should be disabled for consistency, for example:

User self-registration Delegated administration of users Change password
Requires synchronization of users between the Siebel

application and the external authentication system

Securing access to the application

15 of 18

Comparing Authentication Methods

Securing access to the application

16 of 18

Module Highlights
Siebel applications support three mechanisms for authenticating

users:
Database authentication is the default; the Siebel Server verifies the authentication information to the RDBMS for authentication Directory Service authentication uses a directory service such as LDAP or ADSI to perform the authentication; the Siebel Server passes the authentication information to the directory service Single Sign On uses a directory service at the Web server level to allow single sign-on to multiple applications; the Siebel Web Server passes the authentication information to the directory service and passes the returned trust token to the Siebel Server

Securing access to the application

17 of 18

Lab
In the lab you will:

Create a database account for a new user

Securing access to the application

18 of 18