[SOLVED] How to get User ID in MRE with SiteMinder Single Sign-On?

I've been looking for an answer to this for a couple of hours now, and found nothing that would work, so hopefully this isn't a repost.

We have SiteMinder enabled for single sign-on, which is working as it should. But I now want to get the ID of the user running the report.
In our non-SSO environment, I can just use &IBIMR_user, but that variable is not available when using SSO it seems.

I also took a look at the HTTP Request Info page through the admin console, and did see my user ID there, in a custom-named variable that is set in MR Security Settings - General, so everything is working correctly, but I don't know how to query that HTTP header in my procedure.
Is this even possible?

This message has been edited. Last edited by: J.Hines,

Prod: 8.2.0.4 OS:Windows 10 Output:AHTML, Excel 2007+

The life of a designer is a life of fight against the ugliness.

Posts: 141 | Location: North Carolina | Registered: August 10, 2012

Francis Mariani

Expert

posted

Hide Post

You should add &IBIMR_user as a variable in the Custom Settings area of the Admin Console.

<SET>IBIMR_user(pass)

If SiteMider does not populate this variable, try adding the custom-named variable instead.
This appears to copy an HTTP header:

HTTP_HEADER_NAME=user-agent
WFS_VAR_NAME=USER_AGENT
<call> CopyHTTPHeaderToWFVar (HTTP_HEADER_NAME,WFS_VAR_NAME)

We have some other custom code that might help:

<if> USER_AGENT EQ "WFSCOM"
IBIMR_user=&WF_REMOTE_USER
<endif>

<if> IBIMR_user EQ ""
IBIMR_user=&WF_REMOTE_USER
<endif>

Francis

Give me code, or give me retirement. In FOCUS since 1991

Production: WF 7.7.05M, Dev Studio, BID, MRE, WebSphere, DB2 / Test: WF 8.1.05M, App Studio, BI Portal, Report Caster, jQuery, HighCharts, Apache Tomcat, MS SQL Server

Posts: 10577 | Location: Toronto, Ontario, Canada | Registered: April 27, 2005

Ignored post by Francis Mariani posted

Show Post

MattC

Guru

posted

Hide Post

Our SiteMinder uses SM_USER. I think that's the standard. To enable this, which I think SM_USER comes in from the header you need to add to the following location

Admin Console > Reporting Servers > Remote Services - select your server then edit it and add SM_USER to the SECURITY OBJECT > HEADER

In your program you can use the following:

-SET &UID            = GETHEADR('SM_USER', 'A7');

This will get the SiteMinder user.

There are other ways as well. We also used the cookie, but using the header is secure.

WebFOCUS 8.1.05

Posts: 496 | Registered: January 04, 2008

Ignored post by MattC posted

Show Post

Francis Mariani

Expert

posted

Hide Post

Sounds like you can add this to the Custom Settings to make the variable available everywhere:

HTTP_HEADER_NAME=SM_USER
WFS_VAR_NAME=SM_USER
<call> CopyHTTPHeaderToWFVar (HTTP_HEADER_NAME,WFS_VAR_NAME)

Francis

Give me code, or give me retirement. In FOCUS since 1991

Production: WF 7.7.05M, Dev Studio, BID, MRE, WebSphere, DB2 / Test: WF 8.1.05M, App Studio, BI Portal, Report Caster, jQuery, HighCharts, Apache Tomcat, MS SQL Server

Posts: 10577 | Location: Toronto, Ontario, Canada | Registered: April 27, 2005

Ignored post by Francis Mariani posted

Show Post

susannah

Expert

posted

Hide Post

heres what we have in our client site.wfs
(WebFOCUS76\client\wfc\site.wfs)

<SET>IBIMR_user(PASS)
<set> IBIAPP_app (pass)
<SET>IBIMR_domain(PASS)
<set> IBIMR_folder = &IBIMR_folder (PASS)
<set> IBIMR_fex = &IBIMR_fex (PASS)
<SET>URL_PROTOCOL(PASS)
SERVERNAME = &SERVER_NAME
<SET>SERVER_NAME(PASS)
<SET>SERVERNAME(PASS)

<SET>SERVER_PORT(PASS)  

_httpheader=sm-user
_wfsvar=AUTH_ID
<call> CopyHTTPHeaderToWFVar(_httpheader,_wfsvar)
SM_USER = &AUTH_ID
IBIC_user = &AUTH_ID

<SET>SM_USER(PASS)
IBIC_user=&SM_USER
<SET>IBIC_user(PASS)
<if> IBIMR_user NE "null" 
_site_profile = -INCLUDE MOD_MAKEUPPER
<endif>

... that module for makeupper case sits in the baseapp and does stuff...makes all userid's 8 characters, uppercases them, runs each users standard profile...yada yada
if you want it, i can send it.

note: apparently Site Minder gives you sm-user, dash not underscore

This message has been edited. Last edited by: susannah,

In Focus since 1979///7706m/5 ;wintel 2008/64;OAM security; Oracle db, ///MRE/BID

Posts: 3811 | Location: Manhattan | Registered: October 28, 2003

Ignored post by susannah posted

Show Post

Francis Mariani

Expert

posted

Hide Post

Oh Susannah to the rescue!

Francis

Give me code, or give me retirement. In FOCUS since 1991

Production: WF 7.7.05M, Dev Studio, BID, MRE, WebSphere, DB2 / Test: WF 8.1.05M, App Studio, BI Portal, Report Caster, jQuery, HighCharts, Apache Tomcat, MS SQL Server

Posts: 10577 | Location: Toronto, Ontario, Canada | Registered: April 27, 2005

Ignored post by Francis Mariani posted

Show Post

J.Hines

Platinum Member

posted

Hide Post

All very helpful, that gave me what I needed to request the configuration from my admin team.
From what I can tell, all they had to do was add the following to Configuration/Custom Settings, which also edited the site.wfs file.

<set> IBIMR_user(pass)
<set> IBIMR_domain(pass)

I can now use &IBIMR_user in my procedures. Does this mean that our SiteMinder is populating the variable, so all we had to do was just pass it on through?

Prod: 8.2.0.4 OS:Windows 10 Output:AHTML, Excel 2007+

The life of a designer is a life of fight against the ugliness.

Posts: 141 | Location: North Carolina | Registered: August 10, 2012

Ignored post by J.Hines posted

Show Post

MattC

Guru

posted

Hide Post

I want to say that what you have there is the MRUSER not the SM_USER. Generally they are the same and for the most part it should be fine but to get the true SiteMinder user you need to do either method mentioned above.

We have

<set> IBIMR_user(pass)

in our custom settings as well since our DEV environment is not SiteMinder protectd to get the userid.

WebFOCUS 8.1.05

Posts: 496 | Registered: January 04, 2008

Ignored post by MattC posted

Show Post

susannah

Expert

posted

Hide Post

J... just to remind you that IBIMRuser is NOT available to any back end fexes... If your entire life is in MRE, you're ok. If not, you're sol with just MRuser...
and as Matt says, no site minder is Not the mre user.

In Focus since 1979///7706m/5 ;wintel 2008/64;OAM security; Oracle db, ///MRE/BID

Posts: 3811 | Location: Manhattan | Registered: October 28, 2003

Ignored post by susannah posted

Show Post

eric.woerle

Master

posted

Hide Post

To get the user id from the Reporting Server you can use the function cnctuser('A50'). But beware this does not work with Chrome until HF8 I believe. I had a case opened for it and they did resolve it in the latest 7.7 release and latest WF8 release.

Personally I like the function better as I see the &variable easier to spoof. but as we support accessing things through chrome and I'm not at a point where I can go through another upgrade at the moment, I'll have to live with my security being based on &IBIMR_user

Eric Woerle
8.1.05M Gen 913- Reporting Server Unix
8.1.05 Client Unix
Oracle 11.2.0.2

Posts: 750 | Location: Warrenville, IL | Registered: January 08, 2013

Ignored post by eric.woerle posted

Show Post

Please Wait. Your request is being processed...