Method and system for authentication in a business intelligence system

1. A method for presenting a report, for use in a business intelligence system having a report authoring application with a user interface capable of accepting user input during terminal sessions and having access to a data source, comprising the steps of:

a) starting a terminal session by accepting from a user at a terminal a first credential defining an identity of the user;

b) authenticating the first credential with an authentication system;

c) storing the authenticated first credential, the first credential having an indication of access rights to the data source used by the business intelligence system;

d) generating a passport and a first visa using the stored authenticated first credential;

e) accepting a subsequent credential from the user in the same terminal session; and for the subsequent credential:

i) authenticating the subsequent credential with the authentication system;

ii) storing the authenticated subsequent credential, the subsequent credential having the indication of access rights to the data source used by the business intelligence system; and

iii) creating within the passport a subsequent second visa with the indication of access rights to the data source;

f) conferring to the terminal session the union of the access rights to the data source of the passport and the second visa;

g) accepting from the user, report definitions to be generated by a query engine in collaboration with a report engine and the data source, the report definitions including access policies for the data to be used in producing a report;

h) generating the report from the report definition; and

i) presenting the report to the user, the report being at least partly based on the union of the access rights.

2. The method of claim 1 wherein each of the first credential and subsequent credential comprises one or more pieces of information, depending on authentication system requirements.

3. The method of claim 1 further comprising the steps of:

i) returning a first token representing the first credential; and

ii) storing the first token, the first token having the indication of access rights to data sources used by the business intelligence system.

4. The method of claim 1 , further comprising the steps of:

returning a subsequent token, and

ii) storing the subsequent token, the token having the indication of access rights to data sources used by the business intelligence system.

5. The method of claim 1 further comprising the steps of:

i) removing the subsequent visa under user control, and

ii) conferring to the terminal session the union of the access rights to the data source of the passport and any remaining visas.

6. The method of claim 1 further comprising the steps of:

i) logging out from the first user identity; and

ii) removing the passport and the subsequent visa from an authentication manager.

7. The method of claim 1 , further comprising the step of creating an access control list containing members from various namespaces.

8. The method of claim 1 , further comprising the steps of migrating from a first security provider to a second security provider, and authenticating the first security provider and the second security provider at the same time to include a plurality of users from a plurality of namespaces.

9. A report presentation system, for use in a business intelligence system having a report authoring application with a user interface capable of accepting user input during terminal sessions and having access to a data source, the system comprising:

a) means for starting a terminal session by accepting from a user at a terminal a first credential defining an identity of the user;

b) means for authenticating the first credential with an authentication system;

c) means for storing the authenticated first credential, the first credential having an indication of access rights to the data source used by the business intelligence system;

d) means for generating a passport and a first visa using the stored authenticated first credential;

e) means for accepting a subsequent credential from the user in the same terminal session;

f) means for authenticating each subsequent credential with the authentication system;

g) means for storing each authenticated subsequent credential, each subsequent credential having the indication of access rights to the data source used by the business intelligence system;

h) means for creating within the passport a second visa with the indication of access rights to data sources;

i) means for conferring to the terminal session the union of the access rights to the data source of the passport and the second visa;

j) means for accepting from the user, report definitions to be generated by a query engine in collaboration with a report engine and the data source, the report definitions including access policies for the data to be used in producing a report;

k) means for generating the report from the report definition; and

l) means for presenting the report to the user, the report being at least partly based on the union of the access rights.

10. The report presentation system of claim 9 , wherein each of the first credential and subsequent credential comprises one or more pieces of information, depending on authentication system requirements.

11. The report presentation system of claim 9 , further comprising: means for returning a first token representing the first credential; and means for storing the first token, the first token having the indication of access rights to data sources used by the business intelligence system.

12. The report presentation system of claim 9 , further comprising: means for returning a subsequent token, and means for storing the subsequent token, the token having the indication of access rights to data sources used by the business intelligence system.

13. The report presentation system of claim 9 , further comprising: means for removing the subsequent visa under user control, and means for conferring to the terminal session the union of the access rights to the data source of the passport and any remaining visas.

14. A storage medium readable by a computer encoding a computer program for execution by the computer to carry out a method for presenting a report, for use in a business intelligence system having a report authoring application with a user interface capable of accepting user input during terminal sessions and having access to a data source, the computer program comprising:

code means for starting a terminal session by accepting from a user at a terminal a first credential defining an identity of the user;

code means for authenticating the first credential with an authentication system;

code means for storing the authenticated first credential, the first credential having an indication of access rights to the data source used by the business intelligence system;

code means for generating a passport and a first visa using the stored authenticated first credential;

code means for accepting a subsequent credential from the user in the same terminal session;

code means for authenticating each subsequent credential with the authentication system;

code means for storing each authenticated subsequent credential, each subsequent credential having the indication of access rights to the data source used by the business intelligence system;

code means for creating within the passport a second visa with the indication of access rights to data sources;

code means for conferring to the terminal session the union of the access rights to the data source of the passport and the second visa;

code means for accepting from the user, report definitions to be generated by a query engine in collaboration with a report engine and the data source, the report definitions including access policies for the data to be used in producing a report;

code means for generating the report from the report definition; and

code means for presenting the report to the user, the report being at least partly based on the union of the access rights.

15. The storage medium of claim 14 , wherein each of the first credential and subsequent credential comprises one or more pieces of information, depending on authentication system requirements.

16. The storage medium of claim 14 , further comprising:

code means for returning a first token representing the first credential; and code means for storing the first token, the first token having the indication of access rights to data sources used by the business intelligence system.

17. The storage medium of claim 14 , further comprising:

code means for returning a subsequent token, and code means for storing the subsequent token, the token having the indication of access rights to data sources used by the business intelligence system.

18. The storage medium of claim 14 , further comprising:

code means for removing the subsequent visa under user control, and code means for conferring to the terminal session the union of the access rights to the data source of the passport and any remaining visas.

19. The storage medium of claim 14 , further comprising code means for creating an access control list containing members from various namespaces.

20. The storage medium of claim 14 , further comprising code means for migrating from a first security provider to a second security provider, and code means for authenticating the first security provider and the second security provider at the same time to include a plurality of users from a plurality of namespaces.