Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Security & Data Access

Restrict access to metadata objects ..

Workshop - Securing the Metadata Model

Publishing metadata domains to production environments requires more than just creating business-friendly semantic layers—you must ensure that sensitive data remains protected and that users only access information appropriate to their roles and responsibilities. Pentaho's metadata security framework provides comprehensive protection mechanisms including model-level access controls, column-level field restrictions, and row-level data filtering, all enforced automatically within the metadata layer without requiring complex database views or application-level security logic.

In this hands-on workshop, you'll build the OrdersStarCustomer metadata domain and then systematically apply multiple layers of security constraints to protect sensitive business information. You'll configure the Metadata Editor to communicate with Pentaho Server's security service, implement column-level restrictions to hide financial data from unauthorized users, and create row-level security rules that automatically filter data based on user roles and territories. This comprehensive approach demonstrates how metadata-driven security creates consistent, maintainable data protection across your entire BI platform.

What You'll Accomplish:

  • Configure the Metadata Editor security service to connect with Pentaho Server's user and role repository

  • Set up Access Control Lists (ACLs) to retrieve usernames, roles, and security constraints

  • Apply model-level security to control which roles can access entire metadata domains

  • Implement column-level security to restrict access to sensitive fields like Credit Limit

  • Configure row-level security using role-based MQL formulas to filter data by territory

  • Understand metadata security inheritance from business models to tables and columns

  • Test security constraints by logging in as different users with varying permissions

  • Publish secured metadata domains and refresh server caches to apply changes

  • Validate that security rules properly restrict data visibility based on user roles

By the end of this workshop, you'll understand how Pentaho's metadata security framework provides layered data protection that's both powerful and maintainable. Rather than creating complex database views for each user role or embedding security logic in individual reports, you'll centralize security rules within your metadata layer where they're automatically enforced across all reporting tools and data access methods. You'll see first-hand how administrators view all data while restricted users like Suzy only see information appropriate to their role and territory - all managed through intuitive metadata properties rather than custom SQL or application code.

Prerequisites: Completion of OrdersME and Concepts workshops or access to OrderStarCustomer domain; Pentaho Metadata Editor and Pentaho Server installed and configured; Administrative access to Pentaho Server; Understanding of user roles and security concepts

Estimated Time: 75 minutes

SecurityOrder - constraints
data constraint.txt
138B
Open

  1. Start Metadata Editor:

    Windows (PowerShell):

    Linux:

    1. Start the Pentaho Server (not required if using Pentaho Labs):

    Windows (PowerShell):

    Linux:

Follow the guide to apply security restrictions:

Access Control List

You must know the base URL for the Pentaho BA Server (the default URL is http://localhost:8080/pentaho as well as the name of the service to execute security information retrieval (the service is ServiceAction).

The Pentaho Metadata Editor must be configured to connect to your BA Server so that it can retrieve usernames, roles, and access control lists. Follow the below directions to set up Metadata Editor.

ACL

  1. Go to the Tools menu, then select Security. The Security Service dialogue will appear.

  2. In the Service URL field, type in the base URL for the BA Server plus the security service.

  1. Next, select the level of detailed security information you want:

All

Users

Roles

If you have hundreds of users in your system, you probably only want to return the roles, and use roles for security information properties. The access control lists are returned with all three options.

  1. In the Username and Password fields, type:

Username: admin

Password: password

  1. Click Test. A popup window with the returned XML should appear.

ACL list

OrderSecurity

For clarity let's rename the current OrderStarModel to OrderSecurity. Remember its the name of the Business Models that is displayed as the Data Source.

  1. Open the OrderStarCustomer.

  2. Right-click on Business Models and select: Edit.

  1. Name the model OrderSecurity

  2. Click OK.

Offline Access

If you want to work on your model and do not have access to the Pentaho Server, you can save your security information in a file. The Pentaho Metadata Editor retrieves your settings from the file instead of accessing the server every time you open your domain.

  1. After you click Test, Copy all the XML between the tags, including content the tags themselves.

  2. Paste the XML code into your favourite text editor, and save the file as metadata_security.xml, in a location of your choice.

  3. Click the File tab in the Security Service dialog box.

  4. Browse to the file that you just saved.

  5. Click OK to exit the dialog box.

Model Access

The ACL provides the server with a list of Users and their Roles that is used to define both the Metadata Security (Model, Table, Column, Row) & Data (None, Global, User/Role - MQL) constraints.

The out-of-the-box default security and data constraints enable only the Authenticated Administrator have access to everything.

Follow the guide to enable Suzy to access the OrderStarCustomer Model.

Set Properties

As we know, the Business Model is comprised of the Business Tables + Business Views. Any Properties that are set at the Business Model level will be inherited by the Business Tables & Columns.

  1. Edit the OrderStarCustomer Model.

OrderStarCustomer

  1. Ensure / Add the Metadata Security & Data Constraints Properties are available.

  2. Add Power User Role to Metadata Security.

  3. There should be no Data Constraints - None.

Set Metadata Security & Data Constraints Properties

  1. Click: OK.

Check the Properties have been set for the Business Tables & Columns.

  1. In Business Views, double-click on Orders Category.

  2. Stop the Metadata Security Override - The Power User Role will appear.

Override Metadata Security

Business Views

Currently there's a minor bug .. The Metadata Security Property set at the Business Model level is not automatically inherited in the Business View. Tou need to Stop the Override to set the inherited property.

Metadata Security - Power User

  1. Click: OK.

  2. Repeat for the other Categories:

Customers

Products

Time

  1. Save & Republish the model.

Grant Users Access to the Domain - Reference Only

Another method is to grant the access by editing the settings.xml.

By default, only users with the Administrator role can access metadata domains. To allow other users (for example, Suzy in the sample environment) to use OrderStarCustomer as a data source, you must adjust data-access permissions.

  1. Stop the Pentaho Server.

  2. Navigate to /pentaho/server/pentaho-server/pentaho-solutions/system/data-access/ and open settings.xml in a text editor.

  3. Find the following lines:

  1. To allow all authenticated users to access data sources, change them to:

  1. Alternatively, to allow specific users, modify:

  1. Save the file and restart the Pentaho Server.

  2. Wait for the server to fully start before proceeding.

Refresh Models

Obviously .. the published models and reporting data are cached to improve the user reporting experience. Next step is to refresh the caches ..

  1. Log into the Pentaho Server as Administrator:

http://localhost:8080/pentaho/Homelocalhost

  1. Select: Tools > Refresh > Reporting Metadata.

Refresh Metadata Models

  1. Click: Ok - confirm models have reloaded.

Metadata Models reloaded

  1. Log Out and log back in as Suzy.

  2. Select: Create New > Interactive Report.

Interactive Report - Suzy

  1. Select: OrderStarCustomer Data Source.

Data Source - OrderStarCustomer

  1. Click OK.

  2. Drag & Drop: Customers > Territory onto the reporting canvas.

Interactive Report

We're all set to apply some constraints ..

Column-Level Security

Scenario: Column-Level Security for Sensitive Fields

Let's restrict customer account column - Credit Limit - so that only the Admin (Finance) roles can view them.

This prevents Sales Reps (Power User Suzy) from seeing credit limits unless authorized.

  1. In the left pane, right-click on the Credit Limit column under the CUSTOMER W TER business table.

  2. Select Edit. The Business Column Properties dialog appears.

Edit CUSTOMER W TER - Credit Limit

  1. Override the Metadata Security item.

  2. Click the next to this field in the Selected Users/Groups field. A list of users and roles appears.

Override Metadata Security

  1. Select Admin from the Available list.

Select Role / User(s)

  1. Click the Right Arrow to move Admin to the Assigned list.

Add Admin User

  1. Click OK.

  2. Click OK to close the Business Column Properties dialog.

Repeat this process for any other information you wish to restrict.

  1. Save & Republish the model.

  1. Log into the Pentaho Server as Suzy.

  2. Create an Interactive Report with OrderStarCustomer as the Data Source.

Notice: In the Customers Category that the Credit Limit is not displyed. You may have to Refresh the Reporting Metadata - Admin.

Row-Level Security

Row-level security filters data results based on the user's role or department. This allows different users to see different rows from the same table.

Goal: Configure security so that user SUZY can only see Customers where Territory = "EMEA". Admin should see all data.

  1. Right-click CUSTOMER W TER Business Table.

x

x

x

x

x

PreviousSecurity & Data Access
NextCommon Questions

Was this helpful?