> For the complete documentation index, see [llms.txt](https://academy.pentaho.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://academy.pentaho.com/administrator-path-sandbox/administrator/level-3-professional.md).
# Level 3 โ Professional
The rest of Pentaho's security surface. 20 lessons across 4 modules, ending in a peer-reviewed capstone and a proctored certification exam โ SSO, transport/data security, big data security, and awaren
{% hint style="warning" %}
**๐งช SANDBOX โ draft content, no hands-on lab content yet.** Sourced from docs.pentaho.com's "Secure the Pentaho system" section, plus Jp's existing SA\_1000 security course (reconciled โ see note below). Lesson times are estimates โ REPLACE-ME throughout.
{% endhint %}
{% hint style="info" icon="circle-info" %}
**Reconciliation note:** Jp's existing SA\_1000 course turned out to be Solution Architect-level material โ hands-on labs writing custom Spring Security extensions (custom `AuthenticationProvider`, `UserDetailsService`, `DelegatingRole`, `SQLGenerator`, Access Voter classes) for multi-tenant architectures, not admin configuration. Rather than teach the coding here, Module 4 below gives Administrators conceptual awareness of these patterns โ what they're for and when you'd need a developer to build one. The hands-on labs are earmarked to become Solution Architect content once that path is built.
{% endhint %}
Where Level 2 covers Pentaho's two out-of-the-box directory integrations, Level 3 is the rest of the security surface โ single sign-on, transport security, encryption, securing Pentaho's own access into other systems, and recognizing when a security requirement needs custom development rather than configuration.
{% columns %}
{% column %}
:file-lines:
20 lessons
across 4 modules
{% endcolumn %}
{% column %}
:flask:
10 workshops
hands-on labs
{% endcolumn %}
{% column %}
:clock:
~4h 45m
REPLACE-ME โ estimated
{% endcolumn %}
{% endcolumns %}
{% hint style="success" icon="cloud-arrow-up" %}
Every workshop is hands-on and runs on Pentaho's hosting platform. The Lab Guide is embedded in each lab and loads automatically when you open it โ nothing to install.
{% endhint %}
***
Before you start
{% columns %}
{% column %}
{% hint style="success" icon="circle-check" %}
**What you'll need**
Level 2 course completion, or equivalent experience with directory-based authentication. This level assumes you're comfortable editing Pentaho's Spring Security configuration files directly.
{% endhint %}
{% endcolumn %}
{% column %}
{% hint style="info" icon="tag" %}
**Built against**
REPLACE-ME โ confirm target Pentaho version for this level (other paths are built against 11.0.0.3-310).
{% endhint %}
{% endcolumn %}
{% endcolumns %}
***
{% hint style="info" icon="trophy" %}
#### What you'll build
The level ends in a capstone project: harden a Pentaho Server for enterprise deployment โ SSO authentication, encrypted credentials and transport, and secure access to a Hadoop cluster โ submitted for peer review as part of the proctored Level 3 certification exam.
{% endhint %}
***
What you'll learn
{% columns %}
{% column %}
* Integrate Pentaho with SSO frameworks: CAS, OIDC/OAuth 2.0, and Kerberos-based IWA for silent domain login
* Secure transport and stored credentials with SSL, AES encryption, JDBC-backed security and SSRF prevention
{% endcolumn %}
{% column %}
* Secure Pentaho's own access into a Hadoop cluster with Kerberos, secure impersonation and Knox
* Recognize enterprise security patterns โ pre-authenticated gateways, custom providers, multi-tenant isolation โ that require custom development rather than configuration
{% endcolumn %}
{% endcolumns %}
***
Course Outline
:file-lines: reading ยท :flask: hands-on workshop
{% hint style="info" icon="circle-info" %}
Full lessons unlock once you're enrolled โ this is the outline only. All times are estimates โ REPLACE-ME.
{% endhint %}
| Module | Reading | Workshops | Time | Videos |
|---|
| Single Sign-On | 1 | 3 | ~1h 10m | |
| Transport & Data Security | 2 | 4 | ~1h 20m | |
| Big Data Security | 2 | 3 | ~1h 25m | |
| Enterprise Security Patterns (Awareness) | 5 | โ | ~50m | |
| Capstone Project | โ | 1 project | โ | |
| Total | 10 | 10 | ~4h 45m | |
{% stepper %}
{% step %}
### :right-to-bracket: Single Sign-On
`1 reading ยท 3 workshops ยท ~1h 10m`
Integrate Pentaho with the SSO framework your organization already runs โ or Kerberos-based silent login for domain-joined users.
See the full breakdown
| Lesson | Time |
|---|
| :file-lines: | Overview | ~10m |
| | |
| :flask: | Configure CAS (Central Authentication Service) | ~20m |
| :flask: | Configure OIDC / OAuth 2.0 โ also the path for Keycloak, Okta and similar IdPs | ~20m |
| :flask: | Configure IWA (Integrated Windows Authentication) โ Kerberos/SPNEGO silent login | ~20m |
{% endstep %}
{% step %}
### :lock: Transport & Data Security
`2 reading ยท 4 workshops ยท ~1h 20m`
Certificates, encrypted credentials, database-backed security, and hardening against SSRF-class attacks.
See the full breakdown
| Lesson | Time |
|---|
| :file-lines: | Overview | ~10m |
| | |
| :flask: | Enable SSL Security | ~20m |
| :flask: | AES Security โ Encrypting Stored Credentials | ~15m |
| :flask: | JDBC Security โ Database-Backed Authentication | ~15m |
| :flask: | Server-Side Request Forgery (SSRF) Prevention | ~10m |
| :file-lines: | How Pentaho Chains Authentication Providers (Spring Security) | ~10m |
{% endstep %}
{% step %}
### :database: Big Data Security
`2 reading ยท 3 workshops ยท ~1h 25m`
Secure Pentaho's own access into a Hadoop cluster on a user's behalf.
See the full breakdown
| Lesson | Time |
|---|
| :file-lines: | Overview | ~10m |
| | |
| :file-lines: | Kerberos Authentication vs. Secure Impersonation โ two models compared | ~10m |
| :flask: | Set Up Kerberos for Pentaho โ prerequisites and supported components | ~25m |
| :flask: | Kerberos with MongoDB & Spark Submit | ~20m |
| :flask: | Knox & CDP Security โ accessing Cloudera Data Platform clusters | ~20m |
{% endstep %}
{% step %}
### :eye: Enterprise Security Patterns (Awareness)
`5 reading ยท ~50m`
Conceptual only โ no hands-on labs. Implementing any of these requires custom development, typically Solution Architect-level work. As an Administrator, the goal is to recognize the pattern and know when to bring in that expertise.
See the full breakdown
| Lesson | Time |
|---|
| :file-lines: | Overview | ~10m |
| | |
| :file-lines: | Pre-Authenticated SSO Gateways โ SiteMinder, WebGate, WebSeal-style header trust | ~10m |
| :file-lines: | Custom Authentication & Role Providers | ~10m |
| :file-lines: | Multi-Tenant Data Isolation Patterns โ sharded sources, DSP, metadata security, SQL generators | ~10m |
| :file-lines: | Custom Role Delegation & Access Voters | ~10m |
{% hint style="warning" icon="circle-question" %}
**REPLACE-ME** โ confirm this module's framing (awareness-only, no code) is right for Level 3 โ Professional, and revisit once the Solution Architect path exists to cross-link "go deeper here" for learners who want the hands-on version.
{% endhint %}
{% endstep %}
{% step %}
### :trophy: Capstone Project
`1 project ยท peer reviewed`
Bring it all together: harden a Pentaho Server to enterprise standard โ SSO, encrypted credentials and transport, and secure big data access โ as part of the proctored Level 3 certification exam.
See the project brief
Your client is preparing for a security audit ahead of a major compliance certification. Configure enterprise SSO for platform login, encrypt stored credentials and enforce SSL across the server, and secure the platform's access into their Hadoop cluster with Kerberos or secure impersonation. Document which of the awareness-level patterns from Module 4 apply to their environment and would need custom development to implement. Your submission is peer reviewed by the Pentaho team as part of the proctored certification exam.
{% endstep %}
{% endstepper %}
***
{% hint style="warning" icon="award" %}
**Certification**
Unlike Levels 1 and 2, Level 3 doesn't offer a self-paced course-completion exam โ it leads directly to **Certification**, a separate, proctored credential that organisations look for when engaging Pentaho consultants. The Speciality course and this level's capstone (peer reviewed by the Pentaho team) feed into it, and the exam itself is proctored.
{% endhint %}
***
Back to Administrator path
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://academy.pentaho.com/administrator-path-sandbox/administrator/level-3-professional.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.