Security Model¶

MetaMiner protects access and data in layers: the network, TLS on each connection, MetaMiner users and roles, BusinessObjects logon, web sign-in, database roles and secrets at rest.

How it works¶

The MetaMiner Server (MMS) is the only component that users reach over the network. The MetaMiner Client (MMC) and web browsers connect to one MMS port, 49714 by default. The MMS connects out to BusinessObjects and to the MetaMiner Database (MMDB).

flowchart LR
  MMC[MetaMiner Client] -->|49714 TLS optional| MMS[MetaMiner Server]
  Browser[Web browser] -->|49714 /web| MMS
  MMS -->|local only| WA[Web Apps service]
  MMS -->|JDBC, SSL optional| MMDB[(MetaMiner Database)]
  MMS -->|BO SDK, CORBA SSL optional| CMS[BusinessObjects CMS]
  MMS -->|HTTPS| WACS[BO RESTful web service]
  MMA[MetaMiner Administrator] -->|on the server host| MMS

Each layer is described below with the page that configures it.

Layers¶

Network¶

Only the MMS port needs to be reachable from user workstations. The Web Apps service answers local requests only, and browsers reach the web apps through the MMS port. Restrict the MMDB port to the hosts that need it.

See Network Exposure.

Transport (TLS)¶

TLS is available on every hop that leaves the server host:

Hop	How it is encrypted
MMC and browsers to MMS	TLS on the MMS port (MetaMiner Server SSL)
MMS to MMDB	PostgreSQL SSL (MetaMiner Database SSL)
Reporting tools to MMDB	ODBC or JDBC SSL (Database External Connections)
MMS to BusinessObjects CMS	CORBA SSL (Server to BusinessObjects SSL)
MMS to BO RESTful web service	HTTPS (Trusted Certificates)
MMS to LDAP or Active Directory	LDAPS (Import Users from LDAP or AD)

The full map is in SSL Overview.

MetaMiner users, roles and permissions¶

When MetaMiner Security is on, every MMC connection needs a MetaMiner user name and password. Each user has one role per environment. A role is a set of permissions, and each permission shows a tab or allows an action. The MMS checks permissions on the server for every protected request, not only in the client.

A user without a role in an environment gets No Access there. Three system roles exist: No Access, Read Only and Administrator. You can add your own roles.

See User-Based Security, Users and Roles and Permissions Reference.

Directory authentication¶

Users imported from LDAP or Active Directory sign in with their directory password. The directory enforces password rules and account status for those users.

See Import Users from LDAP or AD.

BusinessObjects user logon¶

By default, MMC actions on BusinessObjects run as the service account configured for the environment. Set BusinessObjects user logon to REQUIRED for an environment and each MMC user logs on to BusinessObjects with their own account. MMC actions then run as that user, and the MMC shows only the folders and objects that user can see.

See BusinessObjects User Logon.

The BO console and Meta Query on the web use MetaMiner users. The BO console requires sign-in by default. Meta Query on the web is off by default.

See Web Console Sign-In.

MetaMiner Database roles¶

The MMS connects to the MMDB with the database account configured in MMA. MetaMiner also maintains read-only database roles for features that only read data:

Role	Used by	Access
Configured MMDB account	MetaMiner Server	Owns the MetaMiner schemas, reads and writes
`readonly`	Alerts and Pulse dashboards	Read only
`mq_reader`, `mq_reader_all`	Meta Query on the web	Read only, with a connection limit and statement timeout

See Service Accounts.

Secrets at rest¶

Secret	Where it is kept	Protection
BusinessObjects, database, LDAP, SMTP and SSL key passwords	`server\config\config.json`	Stored encrypted. Optionally encrypt the whole file (Encrypting the Configuration)
MetaMiner user accounts	`server\security\`	Stored encrypted
BO logon of an MMC user	Not stored. A remembered logon keeps a BusinessObjects logon token on the workstation, protected with Windows DPAPI
MMC password with Remember password	The user's MetaMiner application data folder	Stored encrypted

Protect these folders with NTFS permissions. See What MetaMiner Stores.

Administration¶

The MetaMiner Administrator (MMA) runs on the MMS host and edits the server configuration and the security files directly. Anyone who can run MMA on that host can change security settings. Limit interactive logon to the MMS host to MetaMiner administrators.

Key terms¶

Term	Meaning
MetaMiner Security	The setting that makes MMC connections require a MetaMiner user and password
Role	A named set of permissions, assigned per user per environment
Service account	The BusinessObjects account configured for an environment, used for pulls
BO user logon	Per-user BusinessObjects logon in the MMC, set per environment