> For the complete documentation index, see [llms.txt](https://academy.pentaho.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://academy.pentaho.com/administrator-path-sandbox/speciality-courses/integrating-authentication-mechanisms.md).

# Integrating Authentication Mechanisms

Standalone Speciality course on single sign-on for Pentaho. 13 lessons across 3 modules and a capstone: OpenID Connect with Keycloak and Microsoft Entra ID, then Kerberos/IWA.

{% hint style="warning" %}
**🧪 SANDBOX — draft content, no hands-on lab content yet.** Topic outline sourced from docs.pentaho.com's "Secure the Pentaho system" section for Pentaho 11. Lesson times are estimates — REPLACE-ME throughout.
{% endhint %}

Level 2 covers LDAP and Active Directory — Pentaho's two out-of-the-box directory integrations. This speciality covers how users sign in without ever seeing a Pentaho login page: OpenID Connect / OAuth 2.0, the single sign-on Pentaho 11 ships out of the box, configured first against Keycloak and then against Microsoft Entra ID — and Kerberos-based silent login for domain-joined users. SAML and CAS, the sign-on of earlier releases, get one reading on where they now stand.

{% hint style="info" icon="id-badge" %}
**Why OpenID Connect, and why these two providers.** Pentaho 11 lists OIDC / OAuth 2.0 among its advanced security providers and ships it out of the box, with Keycloak, Microsoft Entra ID and Okta as the documented examples. Keycloak runs inside the hosted lab, so the mechanics can be worked through end to end; Entra ID is the identity provider most customers already run. Okta is configured the same way. SAML, listed for 10.2, is not in the Pentaho 11 provider list and its plugin ran on Karaf, which 11 removed; CAS 7 is still certified, but its documented setup uses client libraries from 2010.
{% endhint %}

{% columns %}
{% column %}

<p align="center"><i class="fa-file-lines" style="color:green;">:file-lines:</i><br><strong>13 lessons</strong><br><em>across 3 modules</em></p>
{% endcolumn %}

{% column %}

<p align="center"><i class="fa-flask" style="color:orange;">:flask:</i><br><strong>7 workshops</strong><br><em>hands-on labs</em></p>
{% endcolumn %}

{% column %}

<p align="center"><i class="fa-clock" style="color:cyan;">:clock:</i><br><strong>~3h 10m</strong><br><em>REPLACE-ME — estimated</em></p>
{% endcolumn %}
{% endcolumns %}

{% hint style="success" icon="cloud-arrow-up" %}
Every workshop is hands-on and runs on Pentaho's hosting platform. The Lab Guide is embedded in each lab and loads automatically when you open it — nothing to install.
{% endhint %}

***

<h3 align="center">Before you start</h3>

{% columns %}
{% column %}
{% hint style="success" icon="circle-check" %}
**What you'll need**

Comfort with Pentaho's security configuration files — Level 2 course accreditation or equivalent LDAP/AD experience is the natural lead-in, though this speciality stands alone.
{% endhint %}
{% endcolumn %}

{% column %}
{% hint style="info" icon="tag" %}
**Built against**

REPLACE-ME — confirm target Pentaho version for this speciality (other paths are built against 11.0.0.3-310).
{% endhint %}
{% endcolumn %}
{% endcolumns %}

***

{% hint style="info" icon="trophy" %}

#### What you'll build

The course ends in a capstone project: configure OpenID Connect sign-on end to end against Keycloak or Microsoft Entra ID, with signed-in users matched to the right Pentaho roles — and add Kerberos/IWA silent login for domain-joined users if your scenario calls for it.
{% endhint %}

```mermaid
%%{init: {"theme":"base","themeVariables":{"fontFamily":"Arial, Helvetica, sans-serif","fontSize":"13px","lineColor":"#64748b","actorBkg":"#ede9fe","actorBorder":"#6d28d9","actorTextColor":"#3b0764","signalColor":"#475569","signalTextColor":"#0f172a","noteBkgColor":"#fef3c7","noteBorderColor":"#b45309","noteTextColor":"#78350f","activationBkgColor":"#dbeafe","activationBorderColor":"#1d4ed8"},"sequence":{"mirrorActors":false,"actorMargin":40,"messageMargin":34,"width":180,"wrap":true}}}%%
sequenceDiagram
  autonumber
  participant B as Browser
  participant SP as Pentaho Server<br/>(the OAuth client)
  participant IdP as Identity provider<br/>(Keycloak, Entra ID, Okta<br/>or any OIDC provider)
  B->>SP: open the User Console
  SP-->>B: redirect to the identity provider (authorization code flow)
  B->>IdP: sign in there
  IdP-->>B: an authorization code
  B->>SP: present the code
  SP->>IdP: exchange the code for an ID token
  IdP-->>SP: the ID token, with the user's claims
  SP->>SP: match the user to roles held in Jackrabbit or LDAP
  SP-->>B: signed in, without a Pentaho login page
  Note over B,SP: Kerberos/IWA takes a shorter route: the browser presents a domain ticket (SPNEGO) and the login is silent
```

<p align="center"><em>OpenID Connect sign-on in Pentaho 11: the authorization code flow, then roles from Jackrabbit or LDAP. Kerberos/IWA skips the redirect.</em></p>

***

<h3 align="center">What you'll learn</h3>

{% columns %}
{% column %}

* Enable OpenID Connect / OAuth 2.0 sign-on and register Pentaho as a client with Keycloak
* Register Pentaho as an application in Microsoft Entra ID and run both providers side by side
  {% endcolumn %}

{% column %}

* Match signed-in OIDC users to Pentaho roles held in Jackrabbit or LDAP
* Enable Kerberos/SPNEGO-based Integrated Windows Authentication for silent domain login
  {% endcolumn %}
  {% endcolumns %}

***

<h3 align="center">Course outline</h3>

<p align="center"><i class="fa-file-lines" style="color:green;">:file-lines:</i> reading · <i class="fa-flask" style="color:orange;">:flask:</i> hands-on workshop</p>

{% hint style="info" icon="circle-info" %}
Full lessons unlock once you're enrolled — this is the outline only. All times are estimates — REPLACE-ME.
{% endhint %}

<table><thead><tr><th width="306">Module</th><th width="114" align="center">Reading</th><th width="139" align="center">Workshops</th><th width="100" align="right">Time</th><th>Videos</th></tr></thead><tbody><tr><td>OpenID Connect with Keycloak</td><td align="center">2</td><td align="center">3</td><td align="right">~1h 15m</td><td></td></tr><tr><td>OpenID Connect with Microsoft Entra ID</td><td align="center">2</td><td align="center">2</td><td align="right">~1h</td><td></td></tr><tr><td>Kerberos &#x26; IWA Integration</td><td align="center">2</td><td align="center">2</td><td align="right">~55m</td><td></td></tr><tr><td>Capstone Project</td><td align="center">—</td><td align="center">1 project</td><td align="right">—</td><td></td></tr><tr><td><strong>Total</strong></td><td align="center"><strong>6</strong></td><td align="center"><strong>7</strong></td><td align="right"><strong>~3h 10m</strong></td><td></td></tr></tbody></table>

{% stepper %}
{% step %}

### <i class="fa-id-badge" style="color:blue;">:id-badge:</i> OpenID Connect with Keycloak

`2 readings · 3 workshops · ~1h 15m`

The sign-on Pentaho 11 ships out of the box, worked through end to end against a Keycloak realm running in the lab. Pentaho is the OAuth client: it sends the browser to the identity provider, exchanges the returned code for an ID token, and matches the signed-in user to roles held in Jackrabbit or LDAP.

<details>

<summary>See the full breakdown</summary>

<table><thead><tr><th width="78"></th><th>Lesson</th><th width="90">Time</th></tr></thead><tbody><tr><td><i class="fa-file-lines" style="color:green;">:file-lines:</i></td><td>Overview</td><td>~10m</td></tr><tr><td></td><td></td><td></td></tr><tr><td><i class="fa-file-lines" style="color:green;">:file-lines:</i></td><td>How OIDC Sign-On Works in Pentaho 11 — the authorization code flow, authentication only, roles still from Jackrabbit or LDAP</td><td>~10m</td></tr><tr><td><i class="fa-flask" style="color:orange;">:flask:</i></td><td>Enable OAuth Authentication &#x26; Register the Pentaho Client</td><td>~15m</td></tr><tr><td><i class="fa-flask" style="color:orange;">:flask:</i></td><td>Keycloak as the Identity Provider — realm, client, redirect URI</td><td>~20m</td></tr><tr><td><i class="fa-flask" style="color:orange;">:flask:</i></td><td>Match OIDC Users to Jackrabbit or LDAP Roles</td><td>~20m</td></tr></tbody></table>

</details>
{% endstep %}

{% step %}

### <i class="fa-cloud" style="color:blue;">:cloud:</i> OpenID Connect with Microsoft Entra ID

`2 readings · 2 workshops · ~1h`

The same flow against the cloud identity provider most customers already run, enabled alongside Keycloak to show how Pentaho 11 handles more than one provider at once. Okta and any other OIDC-compliant provider are configured the same way: the same Pentaho client, different endpoints. The module closes with one reading on SAML and CAS — the sign-on of earlier releases — and where they now stand.

<details>

<summary>See the full breakdown</summary>

<table><thead><tr><th width="78"></th><th>Lesson</th><th width="90">Time</th></tr></thead><tbody><tr><td><i class="fa-file-lines" style="color:green;">:file-lines:</i></td><td>Overview</td><td>~10m</td></tr><tr><td></td><td></td><td></td></tr><tr><td><i class="fa-flask" style="color:orange;">:flask:</i></td><td>Register Pentaho as an Application in Microsoft Entra ID</td><td>~20m</td></tr><tr><td><i class="fa-flask" style="color:orange;">:flask:</i></td><td>Enable Entra ID as a Second Provider Alongside Keycloak</td><td>~20m</td></tr><tr><td><i class="fa-file-lines" style="color:green;">:file-lines:</i></td><td>SAML &#x26; CAS — Where the Older Sign-On Integrations Stand in Pentaho 11</td><td>~10m</td></tr></tbody></table>

</details>

{% hint style="warning" icon="circle-question" %}
**REPLACE-ME** — confirm how the Entra ID workshops get a tenant: a Pentaho-owned test tenant provisioned with the lab, or the learner's own. Confirm with support whether SAML is supported on Pentaho 11 at all; if it is, the closing reading becomes a short migration note rather than a retirement one.
{% endhint %}
{% endstep %}

{% step %}

### <i class="fa-windows" style="color:blue;">:windows:</i> Kerberos & IWA Integration

`2 readings · 2 workshops · ~55m`

Integrated Windows Authentication (IWA) lets domain-joined users log into Pentaho silently, using Kerberos/SPNEGO instead of a username and password — platform login SSO, distinct from the big-data Kerberos work in Level 3.

<details>

<summary>See the full breakdown</summary>

<table><thead><tr><th width="78"></th><th>Lesson</th><th width="90">Time</th></tr></thead><tbody><tr><td><i class="fa-file-lines" style="color:green;">:file-lines:</i></td><td>Overview</td><td>~10m</td></tr><tr><td></td><td></td><td></td></tr><tr><td><i class="fa-flask" style="color:orange;">:flask:</i></td><td>Configure IWA Prerequisites</td><td>~15m</td></tr><tr><td><i class="fa-flask" style="color:orange;">:flask:</i></td><td>Enable Kerberos/SPNEGO Silent Login</td><td>~20m</td></tr><tr><td><i class="fa-file-lines" style="color:green;">:file-lines:</i></td><td>Troubleshooting IWA Login Failures</td><td>~10m</td></tr></tbody></table>

</details>

{% hint style="warning" icon="circle-question" %}
**REPLACE-ME** — confirm the lab stack for IWA. The public setup guide still references Windows Server 2012 R2, IIS 8.5 and Internet Explorer, while the Pentaho 11 components reference certifies IWA with IIS 10.
{% endhint %}
{% endstep %}

{% step %}

### <i class="fa-trophy" style="color:red;">:trophy:</i> Capstone Project

`1 project`

Bring it all together: configure OpenID Connect sign-on end to end against a real identity provider, with users matched to the right Pentaho roles, and add silent login for domain-joined users where the scenario needs it.

<details>

<summary>See the project brief</summary>

Your client's security team has mandated single sign-on for Pentaho through the identity provider they already run — Keycloak or Microsoft Entra ID. Register Pentaho as a client, configure the provider, match the signed-in users to the right Pentaho roles, and confirm a user can log in without ever seeing the Pentaho login page. If the client also has domain-joined desktops, add Kerberos/IWA so those users sign in silently.

</details>
{% endstep %}
{% endstepper %}

***

{% hint style="info" icon="award" %}
**Counts towards Level 3 certification**

This speciality forms part of the **Level 3 — Certified** credential, since it covers the same authentication ground — SSO and enterprise identity — in more depth. There's no separate course exam here; completing this speciality's capstone feeds into the Level 3 certification requirements.
{% endhint %}

***

<p align="center"><a href="/administrator-path-sandbox/speciality-courses.md" class="button secondary" data-icon="arrow-left">Back to Speciality Courses</a></p>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://academy.pentaho.com/administrator-path-sandbox/speciality-courses/integrating-authentication-mechanisms.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.