Analysis Server Security

new as of build 158
User-based authentication added in build 238

Analysis Server provides an optional security feature which gives the user or administrator the ability to specify which analyses connecting clients are allowed to access.

.aserver files

Access to analyses is determined by the permissions specified in the .aserver file in that directory. The .aserver file has only two commands: allow and deny. Each command has s simple syntax which matches the syntax for the same commands in the aserver.conf settings. The following shows a typical .aserver file:

#
# example .aserver file
#
# deny access to everyone we don't specify with an allow command
deny: *
# open up my analyses to people connecting from phoenix-int.com and test.aerospace.com, and
# also let me run analyses from home
allow: *.phoenix-int.com
allow: *.test.aerospace.com
allow: myhomecomputer.myisp.com

Each allow or deny command takes a hostname with an optional wildcard. The wildcard is typically used to easily specify all the hosts in a particular domain or subnet, but is not limited to this use. For example, the command

deny: *

was used to deny access to all hosts, and then the allow commands were used to selectively allow access from the domains to which we wanted to provide access. Since allow commands take precedence over deny commands, this method can effectively be used to prevent strangers from running your analyses.

.aserver files and the directory structure

Each directory can have its own .aserver file, and the permissions in each .aserver file form an overlapping hierarchy such that access denied in a directory is denied in all its subdirectories. If a directory does not contain its own .aserver file, the access permissions of the parent directory are used. This "inherited" permissisions feature will chain all the way up to the root analyses directory. If the root directory does not contain a .aserver file, the default access setting from aserver.conf is used.

The denyAccessByDefault setting

The denyAccessByDefault setting in the aserver.conf file is used to determine the default access for users connecting from hosts which are not specified by allow or deny commands in the appropriate .aserver file or files.

true means that unspecified hosts are denied.
false means unspecified hosts are allowed access to analyses.

Note that this may cause unexpected behavior when denyAccessByDefault is turned on. A directory with no .aserver file will fall back on the permissions of the parent directory (or system defaults). A directory with an empty .aserver file will deny access to everyone.

Security when using Archiving and Versioning

These rules only apply to traditional directories and user "public_aserver" directories. If you are publishing files out of an Archiving and Versioning system, that system will provide its own type of security, if available.

See also Analysis Server