Introduction

Design Goals

The security system of the Pentaho BI Platform strives to meet the following requirements:

Unobtrusive: Security is a cross-cutting concern; it should be as unobtrusive as possible.
Extensibility: The security system must provide the option to extend key classes to fit customers' needs.
Flexibility: The security system should be easily customized, preferably declaratively.
Portability: To the greatest extent possible, the security system should not use container-specific libraries.

Acegi Security

In the Pentaho BI Platform, security is based on the infrastructure provided by the Acegi Security System for Spring (now called Spring Security).

Note: Because the platform builds on top of Acegi Security, it is highly recommended that readers consult the Acegi Security documentation. The online documentation for Acegi Security is for the latest version of Acegi Security. The Pentaho BI Platform is based on Acegi Security 1.0.6. There can be significant differences between the latest Acegi Security version and the version used by the Pentaho BI Platform. For this reason, it is not recommended that you use the online documentation. Instead, go to the Acegi Security downloads page and download the Acegi Security archive which when expanded creates a docs directory. Opening index.html with your browser then allows for local browsing of the correct version of Acegi Security.

How this Document is Organized

The remainder of this document covers the following security areas, after a brief terminology introduction.

Area	Description
Security data access objects	Security data includes usernames, passwords, granted authorities, web resource (URL) protection data, and ACLs for domain objects.
Authentication	This area is concerned with processing interactive login information (e.g. username and password) and comparing it with data retrieved from the security datastore.
Web resource (URL) authorization	Protecting URLs is a matter of answering for each user, whether or not they can access each URL (web page). Note that access here is `Yes` or `No`--there is no `Read` or `Write` granularity. Given an authenticated user, it is the responsibility of web resource authorization to decide whether to allow the page to be accessed.
Domain object authorization	Currently, the only domain objects protected by the platform are solution repository objects (e.g. action sequences). Given an authenticated user, it is the responsibility of domain object authorization to decide whether to allow the requested operation.