Kerberos Authentication for MicroStrategy Gateways

Kerberos is a computer network authentication protocol that works on the basis of 'tickets' to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner.  Its designers aimed it primarily at a client–server model and it provides mutual authentication—both the user and the server verify each other's identity. Kerberos protocol messages are protected against eavesdropping and replay attacks.

 

Description

The client authenticates itself to the Authentication Server (AS) which forwards the username to a key distribution center (KDC). The KDC issues a ticket-granting ticket (TGT), which is time stamped and encrypts it using the TGS's secret key and returns the encrypted result to the user's workstation. This is done infrequently, typically at user logon; the TGT expires at some point although it may be transparently renewed by the user's session manager while they are logged in.

When the client needs to communicate with another node ("principal" in Kerberos parlance) to some service on that node the client sends the TGT to the ticket-granting service (TGS), which usually shares the same host as the KDC. Service must be registered at TGT with a Service Principal Name (SPN). The client uses the SPN to request access to this service. After verifying that the TGT is valid and that the user is permitted to access the requested service, the TGS issues ticket and session keys to the client. The client then sends the ticket to the service server (SS) along with its service request.


Architecture Diagram:

Observations:
 

1. There are two different and generally independent connections that can use Kerberos protocol for authentication.

• End users can authenticate to MicroStrategy using Kerberos. In this scenario the “client” is the end user software, e.g. a browser to connect to MicroStrategy Web, or a mobile client, or Developer/Workstation. The principal/service is “MicroStrategy” , meaning that MicroStrategy relies on the Kerberos server to identify the client trying to connect to MicroStrategy.
• MicroStrategy can authenticate to gateways using Kerberos. In this scenario MicroStrategy Intelligence Server is the client, trying to connect to a gateway service. It is possible to configure MicroStrategy to connect to a gateway service “on behalf of the end user” using end user specific credentials.

1. MicroStrategy can use Kerberos protocol to connect to different classes of gateways.

• Relational/Big data sources where MicroStrategy connects via JDBC/ODBC protocols
• MDX data sources where MicroStrategy connects via XMLA/ODBO protocols
• MicroStrategy Hadoop Gateway

1. There are two main implementations of the Kerberos protocol.

• MIT makes an implementation of Kerberos freely available, under copyright permissions similar to those used for
• Windows 2000 and later uses Kerberos as its default authentication method. Kerberos is used as preferred authentication method: In general, joining a client to a Windows domain (requires Active Directory Server) means enabling Kerberos as default protocol for authentications from that client to services in the Windows domain and all domains with trust relationships to that domain. [3]  The main benefit is that this offers an “integrated” authentication experience including transparent (to end user and MicroStrategy) ticket management (single-sign-on).  For this reason, the integration with Microsoft Active Directory as KDC is recommended.

Considerations:

• Generally, setting up and maintaining a Kerberos server environment represents a significant investment in security infrastructure. For this reason, customers often want to use the same authentication protocol both for authentication to MicroStrategy as well as authentication to gateways. 
• In some cases, customers have a MicroStrategy deployment that does not depend on Kerberos, but want to add secure connectivity to a new gateway that requires Kerberos authentication
• By default, MicroStrategy connects to a gateway using a single set of credentials. This means that queries from all users are submitted using these credentials, in such a configuration personalized data level security can be implemented using MicroStrategy Security Filters
• Customers that have implemented data level security on the gateway want user specific queries being submitted with end user credentials. MicroStrategy supports such a configuration and calls it pass-through authentication. Depending on support of the gateway this can be achieved in the following ways when authenticating to the gateway using Kerberos:

 

• In case Kerberos is used both for end user and gateway authentication MicroStrategy supports a specific feature of the Kerberos protocol that allows a service to reuse a Kerberos ticket (TGT) to authenticate to another service (in this case it allows MicroStrategy to connect to a gateway). This process is called Delegation.
• Specific ODBC drivers (at this time Hive and Impala) implement a user impersonation feature, where MicroStrategy connects to the gateway using a single credential (in this case a Kerberos ticket). The gateway offers the capability allowing to impersonate into other user accounts.

Table of Contents