Security

How MetaMiner for SAP BusinessObjects protects access, connections and stored metadata, and how you harden an installation.

Start with the security model and the hardening checklist, then follow the task pages for access control, encryption and network exposure.

Fundamentals

• Security Model

  ---

  The layers that protect MetaMiner: network, TLS, MetaMiner users and roles, BusinessObjects logon, web sign-in, MMDB roles and secrets at rest.

• Hardening Checklist

  ---

  A task list you work through after installation and before go-live.

• What MetaMiner Stores

  ---

  Which BusinessObjects metadata MetaMiner collects, where it is kept, and how credentials are handled.

Access control

• User-Based Security

  ---

  Turn MetaMiner Security on or off in the MetaMiner Administrator (MMA).

• Users and Roles

  ---

  Create MetaMiner users, define roles and assign a role per environment.

• Permissions Reference

  ---

  Every permission a role can grant, and the tab or action it controls.

• Import Users from LDAP or AD

  ---

  Connect a directory, authenticate users against it and import user accounts.

• BusinessObjects User Logon

  ---

  Make MetaMiner Client users log on to BusinessObjects with their own account.

• Web Console Sign-In

  ---

  Control who can sign in to the BO console and Meta Query on the web.

Encryption

• SSL Overview

  ---

  A map of every network hop and the page that encrypts it.

• MetaMiner Server SSL

  ---

  Turn on TLS for the MetaMiner Server port.

• Client to Server SSL

  ---

  Make MetaMiner Client workstations trust the server certificate.

• MetaMiner Database SSL

  ---

  Encrypt the connection between the MetaMiner Server and the MetaMiner Database.

• Database External Connections

  ---

  Require SSL for ODBC and JDBC clients that read the MetaMiner Database.

• Server to BusinessObjects SSL

  ---

  Connect to a BusinessObjects cluster that uses CORBA SSL.

• Trusted Certificates

  ---

  How the MetaMiner Server trusts HTTPS certificates of BusinessObjects web services.

• Encrypting the Configuration

  ---

  Encrypt the server configuration file with a password.

Network and accounts

• Network Exposure

  ---

  Which ports must be reachable from where, and which stay local.

• Service Accounts

  ---

  Windows service accounts, the BusinessObjects pull account and database accounts.

Chapter status

• hardening-checklist.md - supported procedure to change the embedded MMDB account password; hand edit of validationEncryptInstances.
• data-stored.md - confirm whether saved document versions keep report data.
• user-based-security.md, users-and-roles.md - screenshots of the MMA security dialogs.
• ldap-import.md - Directory Type field; trust store for LDAPS; screenshots.
• bo-user-logon.md - screenshots of the MMA User logon tab, the MMC logon dialog and the File menu.
• web-console-sign-in.md - screenshots of the WebApps and MetaQuery settings pages.
• Metaminer Server SSL.md - decide whether to publish a password-protected key format; current dialog screenshot.
• Metaminer Postgres database SSL.md - confirm the root.crt locations on a live install.
• SSL between Metaminer server and BusinessObjects servers.md - re-test with a current BI 4.3 support pack and BI 2025.
• trusted-certificates.md - trust store password for keytool commands.
• encrypting-configuration.md - removing the plain-text file after encryption; how to turn encryption off.
• network-exposure.md - Pulse dashboard bind address; host agent over HTTPS.
• service-accounts.md - logon accounts of the Web Apps and embedded database services.