Skip to content

Web Console Sign-In

Control who can sign in to the BO console and to Meta Query on the web, and how those sessions are protected.

How it works

Browsers open the web console through the MetaMiner Server port, for example https://mms.company.com:49714/web/bo and https://mms.company.com:49714/web/metaquery. Sign-in uses MetaMiner users and passwords, so it needs MetaMiner Security on. One sign-in covers both the BO console and Meta Query in the same browser.

App Default Who can sign in
BO console (/web/bo) Off; sign-in Required when on MetaMiner users with MetaMiner Client access in at least one enabled BusinessObjects environment, and users marked MMDB Administrator
Meta Query on the web (/web/metaquery) Off MetaMiner users with Tab: Meta Query in at least one enabled environment, and users marked MMDB Administrator

Pages that change BusinessObjects also check the matching permission for the environment, for example Change Server Configuration. See Permissions Reference.

Before you begin

Steps

BO console

  1. In MMA, click Preferences > Settings... and open the WebApps page.
  2. Tick BO console (/web/bo).

  3. Set Sign-in:

    Value Effect
    Required (default, recommended) Only signed-in MetaMiner users with access can open the BO console
    Optional Sign-in is offered but not needed
    Off (no sign-in) No sign-in. Anyone who can reach the server can use the BO console, including pages that change BusinessObjects

  4. Click OK and restart the MetaMiner Server if MMA asks.

Image of Preferences > Settings > WebApps with BO console (/web/bo) ticked and Sign-in set to Required

../images/security/mma-settings-webapps-signin.png

Warning

Keep Sign-in at Required in production. With MetaMiner Security off, the BO console does not ask for sign-in whatever this setting says.

Meta Query on the web

  1. In Preferences > Settings..., open the MetaQuery page.
  2. In Web console, tick Enable the web console (/web/metaquery).
  3. Leave Allow anonymous use (lower limits, nothing saved) cleared. When ticked, anyone who can reach the server can run read-only SQL without signing in.
  4. Leave Allow sign-in over plain HTTP (password sent unencrypted) cleared. When cleared, a browser on another computer can sign in only over HTTPS. A browser on the server itself can always sign in.
  5. Set Timeout (s) and Row cap for Users:, MMDB administrators: and Anonymous:.
  6. Click OK.

Image of Preferences > Settings > MetaQuery with the Web console group: enable ticked, anonymous and plain HTTP cleared

../images/security/mma-settings-metaquery-web.png

Queries from the web run in read-only database transactions under dedicated read-only database roles, with the timeout and row cap of the user's tier.

Session rules

Rule Default Configuration key (config.json properties)
Sign-out after inactivity 60 minutes web.metaquery.session.idle.min
Maximum session length 12 hours web.metaquery.session.absolute.hours
Sign-in attempts per client address 10 per minute web.apps.metaquery.login.per.ip.per.min

MetaMiner re-checks open sessions against the MetaMiner Server about every 30 seconds, so a disabled or deleted user, or a user who loses the permission, is refused shortly after the change.

Verify

  1. Open https://<server>:49714/web/bo from a workstation. The sign-in page appears.
  2. Sign in as a user without MetaMiner Client access. Access is refused.
  3. Sign in as a permitted user. The BO console opens.

Troubleshooting

Sign-in is unavailable

MetaMiner Security is off. Turn it on in MMA. See User-Based Security.

Sign-in is refused from another computer but works on the server

The browser uses plain HTTP. Turn on SSL for the MetaMiner Server and open the HTTPS address.

The web console is turned off on this MetaMiner server

Tick the app on the WebApps or MetaQuery settings page.

Next steps