> For the complete documentation index, see [llms.txt](https://academy.pentaho.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://academy.pentaho.com/solution-architect-path-sandbox/speciality-courses/enterprise-security.md). # Enterprise Security — Speciality The third Speciality of the Solution Architect path: OpenID Connect sign-on, custom Spring Security providers, multi-tenant isolation and platform hardening on Pentaho 11. 22 lessons across 6 modules. {% hint style="warning" %} **🧪 SANDBOX — draft content, no hands-on lab content yet.** Scoped from the Pentaho 11 documentation ("Secure the Pentaho system" and "Multi-tenancy") and the hands-on Spring Security labs of the earlier SA\_1000 security course, which have to be rebuilt for Pentaho 11 — Java 21, Tomcat 10 and Spring 6.2 — before they can run. Lesson times are estimates — REPLACE-ME throughout. {% endhint %} The third Speciality of the Solution Architect path, and the last course before certification. Installation, Containers and High Availability gave you a platform you can deploy and keep available; this course makes it safe to put in front of many tenants. You decide how users sign in — OpenID Connect with Keycloak, Microsoft Entra ID or Okta in front of Pentaho Server 11, Kerberos for domain-joined users — where their roles come from, and how to extend Pentaho's Spring Security chain when configuration runs out. Then you isolate each tenant's data, content and look, and harden the platform around it. {% columns %} {% column %}

22 lessons
across 6 modules

{% endcolumn %} {% column %}

13 workshops
hands-on labs, plus a capstone

{% endcolumn %} {% column %}

~10h 40m
REPLACE-ME — estimated

{% endcolumn %} {% endcolumns %} {% hint style="success" icon="server" %} Every workshop is hands-on. REPLACE-ME — confirm whether this course runs on Pentaho's hosting platform, with Keycloak and an LDAP directory provided, or on the Ubuntu host you built in Installation — Certified. {% endhint %} ***

Before you start

{% columns %} {% column %} {% hint style="success" icon="circle-check" %} **What you'll need** Installation — Certified, or a Pentaho Server 11 you installed yourself, and comfort editing Pentaho's Spring Security configuration files directly. For Modules 3 and 4 you will build small Java classes with Maven, so a little Java helps. Containers and High Availability come before this course on the path. {% endhint %} {% endcolumn %} {% column %} {% hint style="info" icon="tag" %} **Built against** Pentaho 11.0 on Java 21 and Tomcat 10, with Spring 6.2.12, the version the Pentaho 11 components reference certifies. Keycloak is the identity provider in the labs; Microsoft Entra ID and Okta are the documented alternatives. REPLACE-ME — confirm the Keycloak release, and whether the labs run on the 11.0.0.3-312 service pack the Installation course applies. {% endhint %} {% endcolumn %} {% endcolumns %} *** {% hint style="info" icon="shield-keyhole" %} #### What you'll build A secured, multi-tenant Pentaho Server 11. Users sign in through Keycloak with OpenID Connect, or silently with a domain ticket, and their roles come from LDAP. A custom authentication provider and role delegation cover what configuration cannot. A Dynamic Schema Processor and metadata row-level security show each tenant only its own rows, a repository access voter only its own content, a theme only its own look. TLS, AES-encrypted credentials and Vault-held secrets close the platform around it. The capstone delivers all of it with an architecture decision record a customer's security team can review. {% endhint %} ```mermaid %%{init: {"theme":"base","themeVariables":{"fontFamily":"Arial, Helvetica, sans-serif","fontSize":"13px","lineColor":"#64748b","clusterBkg":"#fafaf9","clusterBorder":"#d6d3d1","edgeLabelBackground":"#ffffff"},"flowchart":{"curve":"basis","nodeSpacing":28,"rankSpacing":44,"padding":22,"wrappingWidth":600,"htmlLabels":true}}}%% flowchart TB classDef browser fill:#fef3c7,stroke:#b45309,color:#78350f,text-align:left,rx:6,ry:6 classDef support fill:#f1f5f9,stroke:#475569,color:#0f172a,text-align:left,rx:6,ry:6 classDef server fill:#ede9fe,stroke:#6d28d9,color:#3b0764,text-align:left,rx:6,ry:6 classDef store fill:#dcfce7,stroke:#15803d,color:#14532d,text-align:left,rx:6,ry:6 classDef engine fill:#ede9fe,stroke:#6d28d9,color:#3b0764,text-align:left,rx:6,ry:6 classDef join fill:#ccfbf1,stroke:#0f766e,color:#134e4a,text-align:left,rx:6,ry:6 classDef output fill:#dcfce7,stroke:#15803d,color:#14532d,text-align:left,rx:6,ry:6 U["A user in the browser
one of many tenants,
domain-joined or not     "]:::browser IDP["Identity provider
Keycloak, Entra ID or Okta
OpenID Connect, authorization code         "]:::support PS["Pentaho Server 11
OAuth signs the user in;
the Spring Security 6 chain
decides what they may do      "]:::server ROLES[("Security provider
LDAP or Jackrabbit:
users, roles, the source of authority          ")]:::store CUST["Your extensions
custom provider, role delegation,
repository access voter      "]:::engine TEN["Tenant isolation
Dynamic Schema Processor for cubes,
metadata row-level security,
per-tenant folders and themes        "]:::join OUT["What each tenant sees
only their rows, their content,
their look   "]:::output U -->|"sign in   "| IDP IDP -->|"ID token   "| PS U -.->|"Kerberos ticket, IWA     "| PS PS -->|"who is this, which roles      "| ROLES PS --> CUST CUST --> TEN TEN --> OUT ```

The architecture the capstone delivers: a modern identity provider in front, Pentaho's own role source behind it, and your extensions keeping each tenant's rows, content and look apart.

***

What you'll learn

{% columns %} {% column %} * Separate authentication from authorisation in Pentaho 11: OAuth signs the user in, the security provider decides what they may do * Put Keycloak, Microsoft Entra ID or Okta in front of Pentaho Server with OpenID Connect — several providers side by side, logout included * Choose the protocol for a customer's estate: OpenID Connect first, Kerberos/IWA for domain-joined users, and what to do with a CAS or SAML installation * Extend the Spring Security 6 provider chain with a custom authentication provider, a user details service and role delegation {% endcolumn %} {% column %} * Isolate tenants' content with a repository access voter, URL authorisation and Pentaho 11's granular permissions * Isolate tenants' data with a Dynamic Schema Processor for Analyzer cubes and row-level security in Pentaho Metadata * Give each tenant its own folders and its own look with solution and UI multi-tenancy * Harden transport, stored credentials and secrets: TLS end to end, AES, Vault, SSRF prevention {% endcolumn %} {% endcolumns %} ***

Course outline

reading · hands-on workshop

{% hint style="info" icon="circle-info" %} Full lessons unlock once you're enrolled — this is the outline only. All times are estimates — REPLACE-ME. {% endhint %}

Module	Reading	Workshops	Time
Getting Started	1	—	~10m
Identity Architecture	4	4	~2h 55m
Custom Security with Spring Security	1	4	~2h 30m
Multi-Tenant Isolation	1	3	~2h 05m
Hardening the Platform	1	2	~1h
Capstone Project	—	1 project	~2h
Total	8	13	~10h 40m

{% stepper %} {% step %} ### Getting Started `1 reading · ~10m` How to get the most out of this guide, and what the labs give you: a Pentaho Server 11, a Keycloak realm, an LDAP directory with tenant users and groups, and a Maven project for the classes you will write.

See the full breakdown

	Lesson	Time
	Before You Start	~10m

{% endstep %} {% step %} ### Identity Architecture `4 readings · 4 workshops · ~2h 55m` How Pentaho 11 signs users in and decides what they may do, and which protocol to put in front of it. OpenID Connect is the sign-on Pentaho 11 ships out of the box; you configure Keycloak first, then a second provider, then make sure roles still come from the directory. Kerberos covers domain-joined users. CAS and SAML get a reading on where they stand and how an estate moves off them.

See the full breakdown

	Lesson	Time
	Authentication and authorisation in Pentaho 11 — OAuth signs in, the security provider authorises	~15m
	Choosing the protocol — OpenID Connect first, Kerberos for the domain, where SAML and CAS stand	~15m

	OpenID Connect with Keycloak — security.properties, the endpoints, authorization code	~45m
	A second provider — Microsoft Entra ID or Okta beside Keycloak, and logout	~30m
	Roles from LDAP behind OAuth sign-in	~30m
	Silent domain login — Kerberos/SPNEGO with Integrated Windows Authentication	~30m

	Legacy estates — moving a CAS or SAML installation to OpenID Connect	~10m
	Module review	~10m

{% hint style="warning" icon="circle-question" %} **REPLACE-ME** — SAML is listed as a security provider in the Pentaho 10.2 documentation but not in the Pentaho 11 list, and the 10.2 SAML plugin ran on Karaf, which 11 removed. CAS 7 is still certified in the 11 components reference, but its documented setup uses client libraries from 2010. Confirm with Pentaho support which of the two, if either, is supported on 11 before the legacy reading is written. {% endhint %} {% endstep %} {% step %} ### Custom Security with Spring Security `1 reading · 4 workshops · ~2h 30m` The hands-on material from the earlier SA\_1000 course, rebuilt for Pentaho 11. Pentaho authenticates through a cascading chain of Spring Security providers; when a customer's identity source has no provider, or roles must be derived rather than read, you write one. Spring 6.2, Java 21 and Tomcat 10 change the packages and some of the APIs the old labs used, so every class is written fresh against the current platform.

See the full breakdown

	Lesson	Time
	The provider chain — ProviderManager, the user details services, and what Spring 6.2 changes for your code	~15m

	A custom AuthenticationProvider and UserDetailsService	~45m
	Role delegation — derive Pentaho roles from tenant and group	~30m
	A repository access voter for content isolation	~30m
	URL authorisation and Pentaho 11's granular permissions	~30m

{% endstep %} {% step %} ### Multi-Tenant Isolation `1 reading · 3 workshops · ~2h 05m` Pentaho's three kinds of multi-tenancy — data, content and UI — and the mechanism for each. A Dynamic Schema Processor rewrites the Mondrian schema with the tenant id from the session before Analyzer queries it; metadata security and row-level constraints do the same for Interactive Reports; per-tenant folders and themes keep content and look apart.

See the full breakdown

	Lesson	Time
	Data, content and UI multi-tenancy — and when a delegate role beats a schema processor	~10m

	A Dynamic Schema Processor with the tenant id from the session	~45m
	Row-level security in Pentaho Metadata for Interactive Reports	~40m
	Solution and UI multi-tenancy — per-tenant folders and themes	~30m

{% endstep %} {% step %} ### Hardening the Platform `1 reading · 2 workshops · ~1h` The surface around the sign-in: TLS from the browser to Tomcat, between the nodes and to Carte; AES-encrypted stored credentials; secrets held in Vault rather than in files, as the Containers course set up; and Server-Side Request Forgery prevention.

See the full breakdown

	Lesson	Time
	The attack surface — transport, stored credentials, secrets, Carte and SSRF	~10m

	TLS end to end and AES-encrypted credentials	~30m
	Secrets from Vault and SSRF prevention	~20m

{% endstep %} {% step %} ### Capstone Project `1 project · ~2h` Secure a multi-tenant Pentaho Server 11 end to end, and write the architecture decision record that explains why.

See the project brief

A software vendor is putting Pentaho analytics in front of three customers on one server. Each customer signs in through its own identity provider — two with OpenID Connect, one with Kerberos — and must only ever see its own rows, its own reports and its own branding. Configure the sign-in, source the roles from the directory, write the provider and voter the vendor's model needs, isolate the data with a Dynamic Schema Processor and metadata security, harden transport and secrets, and hand over an architecture decision record their security team can audit.

{% endstep %} {% endstepper %} ***

Exam & accreditation

{% columns %} {% column %} {% hint style="info" icon="clipboard-check" %} **The course exam** REPLACE-ME — this course has no exam yet. Confirm whether it carries its own open-book exam, like Containers, or feeds the certification only, like High Availability. {% endhint %} {% endcolumn %} {% column %} {% hint style="warning" icon="file-certificate" %} **Course accreditation** REPLACE-ME — no course accreditation is issued until the exam exists; confirm its name. This course is the fifth and last step on the Certified Solution Architect learning path: DI Developer — Practitioner, then Installation — Certified, the Containers, High Availability and Enterprise Security Speciality courses, leading to the Certified Solution Architect credential. {% endhint %} {% endcolumn %} {% endcolumns %} ***

Back to the Solution Architect path

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://academy.pentaho.com/solution-architect-path-sandbox/speciality-courses/enterprise-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.