Securing access to msmdpump.dll

[Gary]

In the basic usage example, the transport read url is set to msmdpump.dll.

I am investigating how to secure access to msdmpump.dll from the client, and I think that the only way is to introduce a server-side (Web Api) service as an intermediary between msmdpump.dll and the client application. Is that correct?

Assuming it is, could you provide some guidance on how to implement Web Api to do this? 

Thanks!
Gary

[Nikolay Rusev]

Hello Gary,

We are not sure what you mean here `I am investigating how to secure access to msdmpump.dll from the client`.

However you can use ADOMD to feed the PivotGrid with data. This way the request to the msmdpump.dll is made on server, while the client requests sort of proxy to it. The following code-library demonstrates how to implement this: bind-to-adomd-client.

Regards,
Nikolay Rusev
Telerik

 

 

[Gary]

Just what I was looking for. Thanks!

[Chris]

The approach in the PivotGridBindingAdomd.zip sample does indeed allow us to prevent direct connection restriction from the client to SSAS...   BUT there is an effective pass through of the raw SSAS statement from client to web backend/Controller to SSAS  (and so could be spoofed etc to create fake commands executed against the server), so the threat surface area of exposure of SSAS is widened.

Does this effectively mean that the ajax version of pivotgrid is a tighter more secure option (as i am guessing the SSAS commands for ajax are generated server side) than the kendo version, for this dynamic stuff where commands would seem to be formed on the client.

Unless you can suggest some sort of gatekeeper layer at the server?

Please note personally everything about kendo pivotgrid appeals to me, just wanting to explore security issues / possibilities,
Thanks,
Chris

[Georgi Krustev]

Hello Chris,

In general, the PivotGrid bound to OLAP service will perform Ajax requests using the XMLA protocol, nothing more. In other words, the pivotgrid generates a XMLA request and sends it to the OLAP service. If it returns any result then the widget will render them.

That being said, it should be sufficient to secure the access to the OLAP service requesting an authentication information. Here is a thorough MSDN help document on the same subject.

Regards,
Georgi Krustev
Telerik

 

 

[Rajan]

I am evaluating Kendo UI pivotgrid. We need to communicate to SSAS cube using msmdpump.dll site on IIS. We need to specify userid and password. We have configured only Basic authentication and Impersonation on the web site.

Where do we specify userid/password in the configuration?

transport.read does not seem to have userid and password attributes?

I am trying with the following set up...but it does not connect to the cube.

               dataSource: {
                    type: "xmla",
                    columns: ...,
                    rows: ...,
                    measures: ...,
                    transport: {
                        connection: {
                            catalog:  ....,
                            cube:... ,
                      
                        },
                        read: {
                            url: "http://.../msmdpump.dll",
                            dataType: "text",
                            contentType: "text/xml",
                            type: "POST",
                            userid: ...,
                            password: ..."
                        } 
                    },
                    schema: {
                        type: "xmla"
                    }

    }

[Rajan]

A skeleton of the test file is attached here.  The issue is discussed above.  Connecting to OLAP cube in our intranet using mdmdpump.dll site does not work.

[Rajan]

Using the following I can largely resolve the issue. 

      $.support.cors = true;

 ​Still IE8 complains about web page accessing data not under its control.

I can try ajax function as an argument of transport.read.  Is there a declarative way to handle the settings better?

 

 

[Georgi Krustev]

Hello Rajan,

I would suggest you review the "Access the cube securely" help topic:

• http://docs.telerik.com/kendo-ui/web/pivotgrid/olap-cube-setup#access-the-cube-securely

It discusses the available options to use cube securely.

With regards to the older browsers that does not support CORS, I would suggest you use proxy for communication. Thus you will be able to request the cube more securely too.

Regards,
Georgi Krustev
Telerik

 

 

[Rajan]

We will look into the options. CORS situation makes life a little harder. 

[rwb]

Brilliant bit of code there Georgi. Just saved my bacon. Many thanks.

[rwb]

OK, two steps forward and one step back.

 It seems that you can't specify a username in an ADOMD connection string, and you can only log in to SSAS using a Windows account. Therefore I had to set the app pool on the web server to use my domain account.

Even so, I'm getting a lot of errors: The <CubeName> cube either does not exist or has not been processed. Which I think is symptomatic of a permissions or connection issue between the web server and SSAS.

 Any ideas or suggestions for fixes?

[Georgi Krustev]

Hi rwb,

In general, access authorization is a tricky task when it comes to data bases, cubes, IIS. What I would suggest you is to request the exposed service directly using a simple Ajax request:

• http://dojo.telerik.com/@ggkrustev/IjOQu

This, as test case, will help you to tweak the configuration until it is the proper one, and the service finally communicates correctly with Ajax requests.

I am afraid that we would not be able to assist you with this particular task, as it falls out of the scope of the entitled support service.

Regards,
Georgi Krustev
Telerik

 

 

[rwb]

Finally got a workable approach.

While the username, password, effectiveusername fields in the ADOMD connection string either are ignored or don't work, crucially, the Roles field does.

Therefore, with IIS set to run as a domain user that is an administrator in SSAS, we can set up roles in SSAS and by specifying the role name in the connection string (the web server code first matches a user to a the correct role) ensure that dimension security is enforced.

[Rajshree]

the solution file is not working.here is the error i found.

[Rajshree]

https://www.telerik.com/support/code-library/bind-to-adomd-client#R99kE6f570qtGLc3wEYrvg

project solution link.

forgot to add earlier.

error attached

[Rajshree]

so, i use similar code from the project below.

how can i pass parameter before i load the grid. for instance, i want to show only specific client data from the cube. i have client id available on html/cshtml view. how can i pass it to below and display only that specific client related data only. i dont want to show all clients data but only one client that is associated with user logged in.

https://www.telerik.com/support/code-library/bind-to-adomd-client

public ActionResult Read([PivotDataSourceRequest] PivotDataSourceRequest request)

        {

}

<script>
  $(document).ready(function () {
      var pivotgrid = $("#pivotgrid").kendoPivotGrid({
          height: 500,
          filterable: true,
          dataSource: {
              type: "xmla",
              columns: [{ name: "[Incident].[Status]" }],
              rows: [{ name: "[Clients].[Client Name]" }],
              measures: ["[Measures].[Incident Count]"],
              transport: {
                  connection: {
                      catalog: "NextGenToolIncidentCube",
                      cube: "IncidentAnalyticalCube"
                  },
                  read: {
                      url: "@Url.Action("Read")",
                      dataType: "text",
                      contentType: "text/xml",
                      type: "POST"
                  },
                  discover: {
                      url: "@Url.Action("Discover")",
                      dataType: "text",
                      contentType: "text/xml",
                      type: "POST"
                  }
              },
              schema: {
                  type: "xmla"
              },
              error: function (e) {
                  alert("error: " + kendo.stringify(e.errors[0]));
              }
          }
      }).data("kendoPivotGrid");

      $("#configurator").kendoPivotConfigurator({
          dataSource: pivotgrid.dataSource
      });
  });
      </script>

 

 

[Alex Hajigeorgieva]

Hello, Rajshree,

The described scenario to show only specific data to the user sounds like the data should be filtered.

You may pass the filter configuration as shown in the how-to article at:

https://docs.telerik.com/kendo-ui/controls/data-management/pivotgrid/how-to/filtering/filter-dimension

Let me know what you think and if you need more information, please do not hesitate to get back to me.

Regards,
Alex Hajigeorgieva
Progress Telerik