> For the complete documentation index, see [llms.txt](https://academy.pentaho.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://academy.pentaho.com/administrator-path-sandbox/administrator/level-3-professional.md).
# Level 3 โ Certified
20 lessons across 4 modules, ending in a peer-reviewed capstone and proctored certification exam โ SSO, transport/data security, big data security and awareness of enterprise security patterns.
{% hint style="warning" %}
**๐งช SANDBOX โ draft content, no hands-on lab content yet.** Sourced from docs.pentaho.com's "Secure the Pentaho system" section, plus the existing SA\_1000 security course. Lesson times are estimates โ REPLACE-ME throughout.
**Reconciliation note (remove before publishing):** SA\_1000 turned out to be Solution Architect-level material โ hands-on labs writing custom Spring Security extensions (custom `AuthenticationProvider`, `UserDetailsService`, `DelegatingRole`, `SQLGenerator`, Access Voter classes) for multi-tenant architectures, not admin configuration. Rather than teach the coding here, Module 4 gives Administrators conceptual awareness of these patterns. The hands-on labs are now [Enterprise Security โ Speciality](https://academy.pentaho.com/solution-architect-path-sandbox/speciality-courses/enterprise-security) on the Solution Architect path, rebuilt for Pentaho 11.
{% endhint %}
Where Level 2 covers Pentaho's two out-of-the-box directory integrations, Level 3 is the rest of the security surface โ single sign-on, transport security, encryption, securing Pentaho's own access into other systems, and recognising when a security requirement needs custom development rather than configuration.
{% columns %}
{% column %}
:file-lines:
20 lessons
across 4 modules
{% endcolumn %}
{% column %}
:flask:
10 workshops
hands-on labs
{% endcolumn %}
{% column %}
:clock:
~4h 45m
REPLACE-ME โ estimated
{% endcolumn %}
{% endcolumns %}
{% hint style="success" icon="cloud-arrow-up" %}
Every workshop is hands-on and runs on Pentaho's hosting platform. The Lab Guide is embedded in each lab and loads automatically when you open it โ nothing to install.
{% endhint %}
***
Before you start
{% columns %}
{% column %}
{% hint style="success" icon="circle-check" %}
**What you'll need**
Level 2 course accreditation, or equivalent experience with directory-based authentication. This level assumes you're comfortable editing Pentaho's Spring Security configuration files directly.
{% endhint %}
{% endcolumn %}
{% column %}
{% hint style="info" icon="tag" %}
**Built against**
REPLACE-ME โ confirm target Pentaho version for this level (other paths are built against 11.0.0.3-310).
{% endhint %}
{% endcolumn %}
{% endcolumns %}
***
{% hint style="info" icon="trophy" %}
#### What you'll build
The level ends in a capstone project: harden a Pentaho Server for enterprise deployment โ SSO authentication, encrypted credentials and transport, and secure access to a Hadoop cluster โ submitted for peer review as part of the proctored Level 3 certification exam.
{% endhint %}
```mermaid
%%{init: {"theme":"base","themeVariables":{"fontFamily":"Arial, Helvetica, sans-serif","fontSize":"13px","lineColor":"#64748b","clusterBkg":"#fafaf9","clusterBorder":"#d6d3d1","edgeLabelBackground":"#ffffff"},"flowchart":{"curve":"basis","nodeSpacing":28,"rankSpacing":44,"padding":22,"wrappingWidth":600,"htmlLabels":true}}}%%
flowchart TB
classDef server fill:#ede9fe,stroke:#6d28d9,color:#3b0764,text-align:left,rx:6,ry:6
classDef store fill:#dcfce7,stroke:#15803d,color:#14532d,text-align:left,rx:6,ry:6
classDef browser fill:#fef3c7,stroke:#b45309,color:#78350f,text-align:left,rx:6,ry:6
classDef support fill:#f1f5f9,stroke:#475569,color:#0f172a,text-align:left,rx:6,ry:6
classDef off fill:#f5f5f4,stroke:#a8a29e,color:#78716c,text-align:left,rx:6,ry:6
U["A user in the browser
on a domain-joined machine, or not "]:::browser
OIDC["OIDC / OAuth 2.0
Keycloak, Entra ID, Okta "]:::support
IWA["IWA
Kerberos/SPNEGO silent login "]:::support
CAS["CAS
Central Authentication Service, legacy "]:::off
PS["Pentaho Server
single sign-on: Spring Security
chains the providers
SSL, AES-encrypted credentials,
JDBC security, SSRF prevention "]:::server
HD[("Hadoop cluster
accessed on the user's behalf:
Kerberos or secure impersonation,
Knox for CDP ")]:::store
PAT["Patterns that need a developer
recognise them, then hand over:
pre-authenticated gateways,
custom providers, multi-tenant
isolation, access voters "]:::off
U --> OIDC
U --> IWA
U --> CAS
OIDC --> PS
IWA --> PS
CAS --> PS
PS --> HD
PS -.-> PAT
```
The Level 3 security surface: single sign-on in front of the server, the server's own security, and its access into Hadoop.
***
What you'll learn
{% columns %}
{% column %}
* Integrate Pentaho with SSO frameworks: OIDC/OAuth 2.0 first, Kerberos-based IWA for silent domain login, and CAS where it is still in place
* Secure transport and stored credentials with SSL, AES encryption, JDBC-backed security and SSRF prevention
{% endcolumn %}
{% column %}
* Secure Pentaho's own access into a Hadoop cluster with Kerberos, secure impersonation and Knox
* Recognise enterprise security patterns โ pre-authenticated gateways, custom providers, multi-tenant isolation โ that require custom development rather than configuration
{% endcolumn %}
{% endcolumns %}
***
Course outline
:file-lines: reading ยท :flask: hands-on workshop
{% hint style="info" icon="circle-info" %}
Full lessons unlock once you're enrolled โ this is the outline only. All times are estimates โ REPLACE-ME.
{% endhint %}
| Module | Reading | Workshops | Time | Videos |
|---|
| Single Sign-On | 1 | 3 | ~1h 10m | |
| Transport & Data Security | 2 | 4 | ~1h 20m | |
| Big Data Security | 2 | 3 | ~1h 25m | |
| Enterprise Security Patterns (Awareness) | 5 | โ | ~50m | |
| Capstone Project | โ | 1 project | โ | |
| Total | 10 | 10 | ~4h 45m | |
{% stepper %}
{% step %}
### :right-to-bracket: Single Sign-On
`1 reading ยท 3 workshops ยท ~1h 10m`
Integrate Pentaho with the single sign-on your organisation already runs โ OpenID Connect first, Kerberos-based silent login for domain-joined users, and CAS where it is still in place.
See the full breakdown
| Lesson | Time |
|---|
| :file-lines: | Overview | ~10m |
| | |
| :flask: | Configure OIDC / OAuth 2.0 โ Keycloak, Microsoft Entra ID, Okta and similar IdPs | ~20m |
| :flask: | Configure IWA (Integrated Windows Authentication) โ Kerberos/SPNEGO silent login | ~20m |
| :flask: | Configure CAS (Central Authentication Service) โ legacy | ~20m |
{% hint style="warning" icon="circle-question" %}
**REPLACE-ME** โ CAS 7 is still certified in the Pentaho 11 components reference, but the documented CAS setup uses client libraries from 2010, and OIDC / OAuth 2.0 is the sign-on Pentaho 11 ships out of the box. Confirm with support whether CAS keeps a workshop here or moves to a legacy note.
{% endhint %}
{% endstep %}
{% step %}
### :lock: Transport & Data Security
`2 readings ยท 4 workshops ยท ~1h 20m`
Certificates, encrypted credentials, database-backed security, and hardening against SSRF-class attacks.
See the full breakdown
| Lesson | Time |
|---|
| :file-lines: | Overview | ~10m |
| | |
| :flask: | Enable SSL Security | ~20m |
| :flask: | AES Security โ Encrypting Stored Credentials | ~15m |
| :flask: | JDBC Security โ Database-Backed Authentication | ~15m |
| :flask: | Server-Side Request Forgery (SSRF) Prevention | ~10m |
| :file-lines: | How Pentaho Chains Authentication Providers (Spring Security) | ~10m |
{% endstep %}
{% step %}
### :database: Big Data Security
`2 readings ยท 3 workshops ยท ~1h 25m`
Secure Pentaho's own access into a Hadoop cluster on a user's behalf.
See the full breakdown
| Lesson | Time |
|---|
| :file-lines: | Overview | ~10m |
| | |
| :file-lines: | Kerberos Authentication vs. Secure Impersonation โ two models compared | ~10m |
| :flask: | Set Up Kerberos for Pentaho โ prerequisites and supported components | ~25m |
| :flask: | Kerberos with MongoDB & Spark Submit | ~20m |
| :flask: | Knox & CDP Security โ accessing Cloudera Data Platform clusters | ~20m |
{% endstep %}
{% step %}
### :eye: Enterprise Security Patterns (Awareness)
`5 readings ยท ~50m`
Conceptual only โ no hands-on labs. Implementing any of these requires custom development, typically Solution Architect-level work. As an Administrator, the goal is to recognise the pattern and know when to bring in that expertise. The hands-on version is [Enterprise Security โ Speciality](https://academy.pentaho.com/solution-architect-path-sandbox/speciality-courses/enterprise-security) on the Solution Architect path.
See the full breakdown
| Lesson | Time |
|---|
| :file-lines: | Overview | ~10m |
| | |
| :file-lines: | Pre-Authenticated SSO Gateways โ SiteMinder, WebGate, WebSeal-style header trust | ~10m |
| :file-lines: | Custom Authentication & Role Providers | ~10m |
| :file-lines: | Multi-Tenant Data Isolation Patterns โ sharded sources, DSP, metadata security, SQL generators | ~10m |
| :file-lines: | Custom Role Delegation & Access Voters | ~10m |
{% hint style="warning" icon="circle-question" %}
**REPLACE-ME** โ confirm this module's framing (awareness-only, no code) is right for Level 3 โ Certified. The "go deeper here" link now points at Enterprise Security โ Speciality on the Solution Architect path.
{% endhint %}
{% endstep %}
{% step %}
### :trophy: Capstone Project
`1 project ยท peer reviewed`
Bring it all together: harden a Pentaho Server to enterprise standard โ SSO, encrypted credentials and transport, and secure big data access โ as part of the proctored Level 3 certification exam.
See the project brief
Your client is preparing for a security audit ahead of a major compliance certification. Configure enterprise SSO for platform login, encrypt stored credentials and enforce SSL across the server, and secure the platform's access into their Hadoop cluster with Kerberos or secure impersonation. Document which of the awareness-level patterns from Module 4 apply to their environment and would need custom development to implement. Your submission is peer reviewed by the Pentaho team as part of the proctored certification exam.
{% endstep %}
{% endstepper %}
***
{% hint style="warning" icon="award" %}
**Certification**
Unlike Levels 1 and 2, Level 3 doesn't offer a self-paced course exam โ it leads directly to **Certification**, a separate, proctored credential that organisations look for when engaging Pentaho consultants. The Speciality course and this level's capstone (peer reviewed by the Pentaho team) feed into it, and the exam itself is proctored.
{% endhint %}
***
Back to the Administrator path
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://academy.pentaho.com/administrator-path-sandbox/administrator/level-3-professional.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.