<p><div><div><div><div data-width="100" data-show-faces="false" data-send="true" data-layout="button_count" data-height="21" data-href="http://www.r-bloggers.com/deployr-enterprise-security-model/"></div></div><div><a data-url="http://www.r-bloggers.com/deployr-enterprise-security-model/" data-counturl="http://www.r-bloggers.com/deployr-enterprise-security-model/" data-count="horizontal" data-text="DeployR Enterprise Security Model" class="twitter-share-button" data-via="rbloggers" href="https://twitter.com/share"></a></div><div></div></div><div></div></div>
<div>
(This article was first published on <strong><a href="http://blog.revolutionanalytics.com/2016/07/deployr-enterprise-security-model.html"> Revolutions</a></strong>, and kindly contributed to <a rel="nofollow" href="http://www.r-bloggers.com/">R-bloggers)</a> </div>
<div>
<p>by Ramkumar Chandrasekeran, Software Engineer – Microsoft R Tiger Team</p>
<div>
<div>
<section>
<div data-menu-offset="-100">
<div>
<div>
<div>
<article>
<div>
<div>
<p><a target="_blank" href="https://msdn.microsoft.com/en-us/microsoft-r/deployr-about">DeployR Enterprise</a> is designed to deliver analytics solutions at scale to whomever needs it: inside or outside the enterprise. It also guarantees secure delivery of your analytics via DeployR web services. These secure web services integrate seamlessly with existing enterprise security solutions: Single Sign-On, LDAP, <a target="_blank" href="http://windowsitpro.com/active-directory/how-use-ldap-over-ssl-lock-down-ad-traffic">Active Directory</a>, PAM, and <a target="_blank" href="https://msdn.microsoft.com/en-us/microsoft-r/deployr-admin-security/deployr-security-authentication#ldap">Basic Authentication</a>, can enforce access privileges already defined by your IT department for existing enterprise users and also have the capability to safely support anonymous users when needed.</p>
<h4><strong>Key Security Considerations in Enterprise setting:</strong></h4>
<ul>
<li><strong>SSL/TLS</strong></li>
</ul>
<p>In all production environments, it is strongly recommended that SSL/HTTPS be enabled so that client applications can make API calls that connect over HTTPS. Use the following guide to <a target="_blank" href="https://msdn.microsoft.com/en-us/microsoft-r/deployr-admin-security/deployr-security-https">Enable TLS/SSL protocols in DeployR</a></p>
<ul>
<li><strong>LDAP and LDAPS</strong></li>
</ul>
<p>The standard protocol for reading data from and writing data to <a target="_blank" href="https://technet.microsoft.com/en-us/library/cc725767(v=ws.10).aspx">Active Directory (AD</a>) domain controllers (DCs) is LDAP. AD LDAP traffic is unsecured by default, which makes it possible to use network-monitoring software to view the LDAP traffic between clients and DCs. You can make LDAP traffic confidential and secure by using Secure Sockets Layer (SSL) / Transport Layer Security (TLS) technology. This combination is referred to as <a target="_blank" href="http://gregtechnobabble.blogspot.com/2012/11/enabling-ldap-ssl-in-windows-2012-part-1.html">LDAP over SSL</a> — or <a target="_blank" href="http://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx">LDAPS</a>. To ensure that no one else can read the traffic, SSL/TLS establishes an encrypted tunnel between an LDAP client and a DC.</p>
<p><strong>Reasons for enabling LDAPS include:</strong></p>
<ol>
<li>Organizational security policies typically require that all client/server communication is encrypted.</li>
<li>Applications use simple BIND to transport credentials and authenticate against a DC. As simple BIND exposes the users’ credentials in clear text, using SSL/TLS to encrypt the authentication session is strongly recommended.</li>
<li>Use of proxy binding or password change over LDAP, which requires LDAPS. (<a target="_blank" href="http://technet.microsoft.com/en-us/library/cc794922%28WS.10%29.aspx">Bind to an AD LDS Instance Through a Proxy Object</a>)</li>
<li>Applications that integrate with LDAP servers (such as Active Directory or Active Directory Domain Controllers) might require encrypted LDAP communications.</li>
</ol>
<h4><strong>LDAPS Authentication Workflow in DeployR:</strong></h4>
<p><a target="_blank" href="http://revolution-computing.typepad.com/.a/6a010534b1db25970b01bb0921a0da970d-pi"><img title="LdapAuthenticationWorkFlow" alt="LdapAuthenticationWorkFlow" src="http://revolution-computing.typepad.com/.a/6a010534b1db25970b01bb0921a0da970d-800wi" border="0"></a></p>
<p> </p>
</div>
</div>
</article>
</div>
</div>
</div>
</div>
</section>
</div>
</div>
<p>By default, the <strong>LDAP</strong> security provider is disabled. To enable LDAP authentication support, you must update the relevant properties in your DeployR external configuration file. The values you assign to these properties should match the configuration of your LDAP Directory Information Tree (DIT).</p>
<ul>
<li>For <strong>LDAP</strong>, set <code>grails.plugin.springsecurity.ldap.context.server</code> to the LDAP server URL, such as<code>'ldap://localhost:389/'</code>.</li>
<li>For <strong>LDAPS</strong>, set <code>grails.plugin.springsecurity.ldap.context.server</code> to the LDAP-S server URL, such as<code>'ldaps://localhost:636/'</code>.</li>
</ul>
<pre>/*
 * DeployR LDAP Authentication Configuration Properties
 *
 * To enable LDAP authentication uncomment the following properties and
 * set grails.plugin.springsecurity.ldap.active=true and
 * provide property values matching your LDAP DIT:
 */
 grails.plugin.springsecurity.ldap.active=false 
 /*
 
grails.plugin.springsecurity.ldap.context.managerDn = 'dc=example,dc=com'
grails.plugin.springsecurity.ldap.context.managerPassword = 'secret'

// LDAP 
// grails.plugin.springsecurity.ldap.context.server = 'ldap://localhost:389/'

// LDAPS
grails.plugin.springsecurity.ldap.context.server = 'ldaps://localhost:636/'

grails.plugin.springsecurity.ldap.context.anonymousReadOnly = true
grails.plugin.springsecurity.ldap.search.base = 'ou=people,dc=example,dc=com'
grails.plugin.springsecurity.ldap.search.searchSubtree = true
grails.plugin.springsecurity.ldap.authorities.groupSearchFilter = 'member={0}'
grails.plugin.springsecurity.ldap.authorities.retrieveGroupRoles = true
grails.plugin.springsecurity.ldap.authorities.groupSearchBase = 'ou=group,dc=example,dc=com'
grails.plugin.springsecurity.ldap.authorities.defaultRole = &quot;ROLE_BASIC_USER&quot;

// Optionally, specify LDAP password encryption algorithm: MD5, SHA-256
// grails.plugin.springsecurity.password.algorithm = 'xxx'

// deployr.security.ldap.user.properties.map 
// Allows you to map LDAP user property names to DeployR user property names:
deployr.security.ldap.user.properties.map = ['displayName':'cn',
                                             'email':'mail',
                                             'uid' : 'uidNumber',
                                             'gid' : 'gidNumber']

// deployr.security.ldap.roles.map property
// Allows you to map between LDAP group names to DeployR role names.
// NOTE, while LDAP group names can be defined on the LDAP server using
// any mix of upper and lower case, such as finance, Finance or FINANCE,
// the LDAP group names that appear in the map must have ROLE_ appended
// and be capitialized. For example, an LDAP group named &quot;finance&quot; should
// appear in the map as ROLE_FINANCE. DeployR role names must
// begin with ROLE_ and must always be upper case.
deployr.security.ldap.roles.map = ['ROLE_FINANCE':'ROLE_BASIC_USER',
                                   'ROLE_ENGINEERING':'ROLE_POWER_USER']

*/</pre>
<p>For more information, see the complete list of <a target="_blank" href="https://msdn.microsoft.com/en-us/microsoft-r/deployr-admin-security/deployr-security-authentication#ldap-active-directory-configuration-properties">LDAP configuration properties</a>.</p>
<p>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>

</p>
<p><div class="feedlyNoScript"><img alt="" src="http://i1.wp.com/pixel.wp.com/b.gif?w=456&ssl=1" data-recalc-dims="1"></div></p>
<p>

</p>
</div>
<p><div><div><div><div data-width="55" data-show-faces="false" data-send="true" data-layout="box_count" data-height="62" data-href="http://www.r-bloggers.com/deployr-enterprise-security-model/"></div></div><div><a data-url="http://www.r-bloggers.com/deployr-enterprise-security-model/" data-counturl="http://www.r-bloggers.com/deployr-enterprise-security-model/" data-count="vertical" data-text="DeployR Enterprise Security Model" class="twitter-share-button" data-via="rbloggers" href="https://twitter.com/share"></a></div><div></div></div><div></div></div>
<div>
<div>To <strong>leave a comment</strong> for the author, please follow the link and comment on their blog: <strong><a href="http://blog.revolutionanalytics.com/2016/07/deployr-enterprise-security-model.html"> Revolutions</a></strong>.</div>
<hr>
<a rel="nofollow" href="http://www.r-bloggers.com/">R-bloggers.com</a> offers <strong><a rel="nofollow" href="http://feedburner.google.com/fb/a/mailverify?uri=RBloggers">daily e-mail updates</a></strong> about <a title="The R Project for Statistical Computing" rel="nofollow" href="http://www.r-project.org/">R</a> news and <a title="R tutorials" rel="nofollow" href="http://www.r-bloggers.com/?s=tutorial">tutorials</a> on topics such as: <a title="Data science" rel="nofollow" href="http://www.r-bloggers.com/?s=data%20science">Data science</a>, <a title="Big Data" rel="nofollow" href="http://www.r-bloggers.com/?s=Big%20Data">Big Data, <a title="R jobs" rel="nofollow" href="http://www.r-users.com/">R jobs</a>, visualization (<a title="ggplot and ggplot2 tutorials" rel="nofollow" href="http://www.r-bloggers.com/?s=ggplot2">ggplot2</a>, <a title="Boxplots using lattice and ggplot2 tutorials" rel="nofollow" href="http://www.r-bloggers.com/?s=boxplot">Boxplots</a>, <a title="Maps and gis" rel="nofollow" href="http://www.r-bloggers.com/?s=map">maps</a>, <a title="Animation in R" rel="nofollow" href="http://www.r-bloggers.com/?s=animation">animation</a>), programming (<a title="RStudio IDE for R" rel="nofollow" href="http://www.r-bloggers.com/?s=RStudio">RStudio</a>, <a title="Sweave and literate programming" rel="nofollow" href="http://www.r-bloggers.com/?s=sweave">Sweave</a>, <a title="LaTeX in R" rel="nofollow" href="http://www.r-bloggers.com/?s=LaTeX">LaTeX</a>, <a title="SQL and databases" rel="nofollow" href="http://www.r-bloggers.com/?s=SQL">SQL</a>, <a title="Eclipse IDE for R" rel="nofollow" href="http://www.r-bloggers.com/?s=eclipse">Eclipse</a>, <a title="git and github, Version Control System" rel="nofollow" href="http://www.r-bloggers.com/?s=git">git</a>, <a title="Large data in R using Hadoop" rel="nofollow" href="http://www.r-bloggers.com/?s=hadoop">hadoop</a>, <a title="Web Scraping of google, facebook, yahoo, twitter and more using R" rel="nofollow" href="http://www.r-bloggers.com/?s=Web+Scraping">Web Scraping</a>) statistics (<a title="Regressions and ANOVA analysis tutorials" rel="nofollow" href="http://www.r-bloggers.com/?s=regression">regression</a>, <a title="principal component analysis tutorial" rel="nofollow" href="http://www.r-bloggers.com/?s=PCA">PCA</a>, <a title="Time series" rel="nofollow" href="http://www.r-bloggers.com/?s=time+series">time series</a>, <a title="finance trading" rel="nofollow" href="http://www.r-bloggers.com/?s=trading">trading</a>) and more...
<img height="1" alt="" width="1" src="http://feeds.feedburner.com/~r/RBloggers/~4/U92FSq2t3W0"></a></div>