I'm in the process of rolling out TM1 with the help of an IBM partner. I'm only planning on allowing remote access through the web frontend using Integrated login and IIS-SSL. Our administrators will also have access through excel.
While reading some posts on this site I noticed a couple mentions of concerns around IIS-SSL, and that made me a bit nervous.
Does anyone have any experience securing TM1Web using IIS and SSL that could give me some pointers or a higher comfort level? I'd rather not use TS or a Citrix solution due to both cost considerations (TM1Web was included in my license) and management overhead. Do I really need to have everyone log in via our Cisco VPN to ensure the tools are secure?
Any help would be appreciated as I'm a noob to both these tools and this board.
Thanks!
-bd
TM1 Web security
-
kangkc
- Community Contributor
- Posts: 206
- Joined: Fri Oct 17, 2008 2:40 am
- OLAP Product: TM1, PA , TMVGate
- Version: 2.x
- Excel Version: 36x
- Location: Singapore
- Contact:
Re: TM1 Web security
If TM1 Web and TM1 server is on a same physical server. It's not difficult to run integrated login with SSL, I have used NTLM with success.
But if TM1 Web and TM1 server is on different machine, you will have to use Kerberos. This is hell to me as getting IIS to use Kerberos is not a straight forward task. Especially is Windows 2003 has a locked down IIS. So far I only managed to did it once but in a very control environment (I can anything I want on the server).
But if TM1 Web and TM1 server is on different machine, you will have to use Kerberos. This is hell to me as getting IIS to use Kerberos is not a straight forward task. Especially is Windows 2003 has a locked down IIS. So far I only managed to did it once but in a very control environment (I can anything I want on the server).
-
Martin Erlmoser
- Community Contributor
- Posts: 125
- Joined: Wed May 28, 2008 1:22 pm
- OLAP Product: TM1, Cognos Express,..
- Version: 9.1.4 FP1
- Excel Version: 2010
- Location: Vienna
- Contact:
Re: TM1 Web security
>
Does anyone have any experience securing TM1Web using IIS and SSL that could give me some pointers or a higher comfort level?
<
i think a ssl cert. will make the communication between browser and iis secure enough, without vpn. (my netbanking works this way, maybe without iis, so what?
)
but its a really big step from an internal application to an application which is also accessible from outside, if possible, leave everything in your lan.
you have to ensure that every tm1user has a pwd which is strong enough, i don't think that SSO will work over internet. / i expect that you want to use it from external because you said somethink like vpn.. \
can you maybe explain how your environment looks like? maybe you will have to user a ts environment..
if you only use tm1/web in your LAN, there really should be no security risk.
Does anyone have any experience securing TM1Web using IIS and SSL that could give me some pointers or a higher comfort level?
<
i think a ssl cert. will make the communication between browser and iis secure enough, without vpn. (my netbanking works this way, maybe without iis, so what?
)but its a really big step from an internal application to an application which is also accessible from outside, if possible, leave everything in your lan.
you have to ensure that every tm1user has a pwd which is strong enough, i don't think that SSO will work over internet. / i expect that you want to use it from external because you said somethink like vpn.. \
can you maybe explain how your environment looks like? maybe you will have to user a ts environment..
if you only use tm1/web in your LAN, there really should be no security risk.