Any experience of integrating IBM Cognos with Shibboleth?

[Julian Williams]

On 20/01/16 11:30, Peter Schober wrote:
>
> Someone kindly shared this some 5 years ago:
>
>> What they are able to do out of the box is get REMOTE_USER from
>> Apache and then they do an LDAP query using a service account where
>> uid=REMOTE_USER to get back all of the same attributes they would
>> have retrieved if configured for LDP authN. So even with Shib the
>> LDAP service account and set up is still basically the same and is
>> required.

Ah, I was wondering earlier this morning whether using a Shib SP might 
be possible.

>
> So if you actually wanted to federate the system with multiple SAML
> IDPs (not sure to me from your question?) that *might* involve some
> SDK and/or custom development by IBM (i.e., $$$, or £££ in your case).
>

Fortunately for this we only need to use one IdP. So no *extra* £££ 
hopefully.

> Otherwise using the Shibboleth SP for SSO and LDAP for data lookup
> seems to be working fine, as long as you also have LDAP set up
> correctly (the way Cognos wants it to be), which wasn't at all clear
> itself.

So we might not need this Motio CAP after all if we can use a standard 
Shib SP which we are used to supporting here. Great.
Yes, what they can work with in terms of LDAP schema is something I need 
to investigate further as we don't have a typical schema here.

Thanks that's very useful.

Julian


-- 
Julian Williams (Systems Developer, Identity and Access Management)
Systems Development and Support, IT Services, University of Oxford
13 Banbury Road, Oxford OX2 6NN
Tel: 01865 2 73249