securing oracle bi mobile - odtug mobile day, utrecht april 2015

T : +44 (0) 1273 911 268 (UK) or (888) 631-1410 (USA) or +61 3 9596 7186 (Australia & New Zealand) or +91 997 256 7970 (India)

E : [email protected] W : www.rittmanmead.com

Securing Oracle BI Mobile Mark Rittman, CTO, Rittman Mead ODTUG Mobile Day, Utrecht, April 2015





About the Speaker

•Mark Rittman, Co-Founder of Rittman Mead •Oracle ACE Director, specialising in Oracle BI&DW •14 Years Experience with Oracle Technology •Regular columnist for Oracle Magazine •Author of two Oracle Press Oracle BI books •Oracle Business Intelligence Developers Guide •Oracle Exalytics Revealed •Writer for Rittman Mead Blog :http://www.rittmanmead.com/blog

•Email : [email protected] •Twitter : @markrittman

http://www.rittmanmead.com/blog

mailto:[email protected]





About Rittman Mead

•Oracle BI and DW Gold partner •Winner of five UKOUG Partner of the Year awards in 2013 and 2014 - including BI •World leading specialist partner for technical excellence, solutions delivery and innovation in Oracle BI

•Approximately 80 consultants worldwide •All expert in Oracle BI and DW •Offices in US (Atlanta), Europe, Australia and India •Skills in broad range of supporting Oracle tools: ‣OBIEE, OBIA ‣ODIEE ‣Essbase, Oracle OLAP ‣GoldenGate ‣Endeca



What is OBIEE?

‣Oracle Business Intelligence Enterprise Edition 11g (OBIEE) is a comprehensive business intelligence platform that delivers a full range of Tools ‣Adhoc Analysis ‣Dashboards ‣Notifications/Alerts ‣Pixel Perfect Reporting ‣Mobile ‣Scorecards ‣Mapping and other advances visualisation

T : +44 (0) 1273 911 268 (UK) E : [email protected] W : www.rittmanmead.com

Built around a Common Enterprise Information Model

•All reporting tools can take their data from a shared metadata layer •Defined as dimensional model, embeds common calculations and drill paths •Subject-area and row-level security •Three-layer design to provide abstraction from underlying complicated source systems

Simplification of the Data ModelIntegration of Disparate DataSources

Addition of Business Logic and Calculations



OBIEE Benefits for Oracle Fusion Middleware Developers

‣A richer, more user-customizable set of graphs, tables and other data visualizations than provided by stock ADF DVT ‣Create formatted reports and distribute them to users ‣Metadata catalogs and repositories to provide businesscontext, control access and organize reporting ‣Access to a wide range of data sources, includingrelational, OLAP, big data, file and application sources (and the ability to combine them together) ‣Ability to create alerts that test for business events ‣Embed BI insights into applications and business



Access to Maps, KPIs, Scorecards, Mobile BI and the Catalog

‣OBIEE analyses, dashboards and other objects are held in a catalog ‣Granular access rights, mapped to application roles and LDAP users ‣Rich visualizations including maps, scorecards, KPIs and published reports ‣Report distribution through the Oracle BI Scheduler ‣More complete reporting solution compared to ADF DVT objects



Displaying OBIEE Reports & Dashboards on Mobile Devices

‣OBIEE reports and dashboards can display on mobile devices ‣But they don’t use “responsive design” and aren’t that usable ‣Buttons and menu items too small ‣Too much content for smaller devices

T : +44 (0) 1273 911 268 (UK) E : [email protected] W : www.rittmanmead.com

OBIEE Mobile Client Options

•Oracle BI Mobile ‣Native iOS & Android apps, developed by Oracle and downloadable from the respective App Stores ‣Use your mobile device to view & interact with existing OBIEE content

•Oracle BI Mobile App Designer (MAD) ‣Creates HTML5 based web applications ‣Ideal for creating departmental,focused line-of-business mobile apps ‣No data stored on device ‣Add graphics, corporate look-and-feel



Oracle BI Mobile HD•Takes existing dashboard content and re-renders for mobile •Combination of web content and iOS / Android-specific controls •Access Content such as ‣Analysis ‣Dashboards ‣BI Publisher ‣Scorecard

• iPad/iPhone feature support ‣Tilt/Flip ‣Swipe ‣Gestured Zoom ‣Download data + reports for offline use



Oracle Mobile App Designer

•Aimed at creating LOB (Line-of-Business) custom applications ‣Web Based App Designer ‣Drag’n’Drop App Components

•Publish to BI Apps Library •Any Device, Any Screen ‣Apps rendered in HTML5 ‣Can be opened in any modern browser

•Enterprise Security ‣Uses OBIEE Security Model



Android App

‣ Oracle BI Mobile HD also Available on Android ‣ Available from Google Play Store



Mobile Device Security Concerns

‣OBIEE Mobile HD and BI Mobile App Designer are “secure” ‣Makes use of SSL, typically accessed via VPN etc ‣But for some organizations, this is not enough ‣Access to Organisation Data on Personal Device

-Whole device accessing Network is a Security Risk -Mobile Malware -Copy/Paste Sensitive Information into other apps -Lost or Stolen Devices

‣To enable these types of apps,MDM (Mobile Device Management) solutions are usedto deploy apps in a secure “container” environment



What is an MDM Container?

•Segregated Area on Device ‣Contains Company Approved Apps

-Email - Intranet Sites -File Shares -BI Mobile HD -Custom Applications

•No Company Data in/out of device other than via App Tunnel ‣Cannot Copy from Contain App to Notes or Browser outside container

•Comes in the form of a signed App



Vendors in the Mobile Device Management Space

•Good •Mobile Iron •Oracle Mobile Security Suite • and many more!..



What’s Involved in Running BI Mobile in an MDM Container?

‣Key difference is that BI Mobile HD runs within a secure MDM container ‣BI Mobile App Designer will also need to run within an MDM-supplied web browser ‣Two main vendor approaches to MDM containerisation ‣Bitzer and other vendors : take BI Mobile app libraries, compile and sign using customer certificate, then deploy using vendor container solution -Advantage is that this does not require changes to BI Mobile source code -Main certified and supported approach with Oracle (esp. after Bitzer acquisition)

‣Good and other vendors : similar approach but requires hooks and changes in BI Mobile source code to accommodate Good APIs -Can cause issues if customer does not use Good and Oracle APIs correctly(e.g. security, SSO integration)



Oracle Mobile Security Suite

•Previously known as Bitzer Secure Container •OMSS comes with a set of enterprise ready productivity apps •Wrapped apps can be installed on the container using the App Catalog feature of the container

•Secure Web Browser •Access Intranet sites secured with Kerberos, NTLM, OAM •Secure File Manager •Secure Email, Calendar, Contacts, Tasks, Notes •Google Apps, and Lotus Notes •Attachments can be restricted to the container



Installing Oracle Mobile Security Suite

•Has to be installed into Windows Server 2003/2008 •MSAC and MSAS are mandatory •Create the following groups types in Active Directory ‣ Control or ‘End User’ Group ‣ Help Desk ‣ System Admin ‣ Company Admin

•Choose Components to Install •Notification Server(MSNS) & File Manager(MSFM) are optional



Installing Oracle Mobile Security Suite (cont..)

•Supply the hostname •Administrator Email •Kerberos Domain Information




• Add Company Name/Logo • Choose whether to Sync with AD




• Configure Database Settings ‣DB holds Usage Tracking ‣Environment Settings ‣Container/User Relationships




•Configure LDAP Control Groups Sync ‣You are telling OMSS which group holds end users



OMSS Administration Console

•Dashboard ‣Display analytics on corporate usage and monitor exceptions

•Containers ‣Display container activity, location, and status. Lock and wipe containers remotely ‣Groups ‣Manage groups of users, which can be uniformly provisioned in real-time ‣Catalog ‣List apps that are available to the entire company ‣Policies ‣Manage container access and limitations, to be applied to groups ‣Settings ‣Company specific settings, (available to company administrators and system administrators)



OMSS Dashboards



OMSS Containers



•Catalog is a list of all App Versions ‣Oracle Apps ‣Custom Apps

•Oracle Supply additional Apps ‣Secure Mail ‣Browser ‣File System Access

•Users can select the Apps to download

Catalog



Preparing an iOS App for Signing using Corporate Certificate

‣Oracle supply a set of libraries and source code you can use to create a signed version ofthe BI Mobile HD app, using your own corporate Apple Developer Program certificate ‣To perform this exercise you’re going to need to get involved in Apple iOS development! ‣Prerequisites ‣ Apple Xcode Objective-C IDE ‣ Apple Developer Program License

- Agent Role - Apple main contact - Admin Role - Dev Team Leader who deploys apps

‣ Oracle Mobile Security Toolkit ‣ At least one registered physical device



What is Xcode?

‣ Apple IDE ‣Used for development of ‣ iOS (iPad & iPhone) ‣ Mac ‣Integrated with Apple Developer Account ‣Deploy Apps to Apple App Store ‣Export Custom Apps for Enterprise or ad-hoc Deployment



Importing and Signing the BI Mobile HD App

•Create a New Xcode Project •From the menu, select File > New > Project •When asked to choose a template, under iOS, select Application. Then select Single View Application and click Next

•Give your project a name and fill out the other fields with your organization's information.

• In the Devices dropdown, specify the devices you are targeting. Make sure to select Universal.

•Select a destination for your new project.



Merge Toolkit with New Project

•Download the Oracle Mobile Security Toolkit from OTN

•Extract the files from the security toolkit zip. •Drag the following files to the project, as shown below: ‣OBIMobile.framework ‣Settings.bundle ‣OBIMobile.bundle

•Delete the existing Images.xcassets folder and replace it with the one provided in the toolkit



Modify the Project Properties

•Edit the App Icons and Launch Images settings to point to the new image assets you added to the project.

•Set the orientations. For both the iPad and the iPhone, select every orientation: ‣Portrait ‣Upside Down ‣Landscape Left ‣Landscape Right ‣Set the URL Types ‣Customisations to Icons can be added



Testing the App

• Xcode has a iPad/iPhone Simulator Built in ‣Ensure that the OBIEE HD Project created above is opened in XCode. ‣Select Product -> Destination -> [Your Device Type] ‣Next select Product -> Run



Testing the App (cont..)

‣You will be able to navigate through the application. It is advisable you test everything thoroughly before it is distributed to users!



Deploying an Application using XCode

‣Set your destination to be your registered device ‣Select Product >Archive to generate a .app file which we can upload into the Catalog in OMSS



Deploying an Application using XCode (cont..)

• Select a Deployment Type ‣iOS App Store ‣Ad Hoc Development ‣Enterprise Distribution

• Select a Development Team ‣This will sign and compile the app into a .app file for distribution

•You are not submitting this to the Apple App Store!



Signing the App

‣You sign or certify the app to show that the code has not changed since your review ‣Unsigned Code may have had changes made to it that could compromise security ‣The App is Signed during the Deployment Process ‣Certificates are held in your Apple Developer Provisioning Profile



Signing an Android App

•Similar process to signing using Xcode, but uses Android Studio IDE

•Build > Generate Signed APK. •On the Generate Signed APK Wizard window, click Create new to create a new keystore

•Your key should be valid for at least 25 years, so you can sign app updates with the same key through the lifespan of your app.

•You can Auto-Sign apps after you've set up a keystore



Import App into OMSS

‣Import the .app file into the Catalog of OMSS so that you can distribute it to users ‣OMSS then sends provisioning emailto users; to install app using enterpriseapp store, just click on link ‣Installed outside of main publicApple App Store process



Good Technology MDM

•Supports ‣iOS, Android ‣Windows Mobile, Blackberry

•Containerisation at the Application Level ‣ App is Uploaded to Management Console ‣ Certificate is Applied, app is wrapped

• Containerisation using an SDK ‣ SDK requires code integration i.e., a developer uses the Good Dynamics security libraries APIs in conjunction with their IDE ‣Developer can take advantage of services created by other developers (e.g. Writing to Sharepoint)



Potential Customer Issues with Good

‣ All requests goes through a Good Proxy ‣ Proxy is outside company network ‣ Requests are transferred securely ‣ Can cause timeouts ‣Often issues around customer linkingto corporate SSO - easy to get wrongif control incorrectly returned to BI Server ‣File returned from the BI Server doesn't match expected format so causes BI Mobile App to render incorrectly ‣Often tricky to debug as requires low-level network monitoring / knowledge,and BI Server not architected from ground-up for mobile client support



‣Useful for organizations not set up for iOS development ‣Requires Macs, basic understanding of Xcode ‣Wrapping and Deploying BI Mobile HD via OMSS ‣1 Week Service ‣ Wrap and Sign the Mobile BI iOS App

-Using your certificates ‣ Handover & Basic Admin Training ‣Install & Configure OMSS

- Integration with Active Directory

Rittman Mead Services - BI Mobile MDM Starter Pack



Rittman Mead Services - OBIEE/Mobile Consultancy

• Advice on Best Practice ‣ OBIEE ‣ BI Mobile ‣ OMSS

•Troubleshooting Issues •Full Implementations • Preparing existing setups for ‘Mobilization’ ‣Will my Dashboards work on Mobile? ‣Are my Dashboards usable on Mobile?





Thank You for Attending!

•Thank you for attending this presentation, and more information can be found at http://www.rittmanmead.com

•Contact us at [email protected] or [email protected] •Look out for our book, “Oracle Business Intelligence Developers Guide” out now! •Follow-us on Twitter (@rittmanmead) or Facebook (facebook.com/rittmanmead)

http://www.rittmanmead.com





Securing Oracle BI Mobile Mark Rittman, CTO, Rittman Mead ODTUG Mobile Day, Utrecht, April 2015

securing oracle bi mobile - odtug mobile day, utrecht april 2015

Data & Analytics