Securing the Cube - Expert Cube Development with SSAS Multidimensional Models - page 279

In our experience, there are very few scenarios where cell data security is really
necessary; the scenarios where Dynamic cell security is necessary are rarer still. This
is true, though, if and only if security has been correctly designed from the beginning
of the project: when security is added onto a cube as an afterthought, very often cell
security is the only approach possible.
Accessing Analysis Services from
outside a domain
So far we've seen that in order to let a user access a cube, that user needs to be a
user on the same domain as Analysis Services. We have seen that roles are based
on Windows users and groups, and that Analysis Services does not implement any
other forms of authentication.
Nevertheless, it is possible to let users outside a domain access Analysis Services if
we set up HTTP access via Internet Information Server ( IIS ). This method uses a
DLL called MSMDPUMP.DLL that acts as a bridge between IIS and Analysis Services;
when called, this DLL connects to Analysis Services and impersonates a Windows
user, which can be a domain user or a local user on the server hosting Analysis
Services and IIS. The DLL is placed in a virtual directory in IIS; the client application
then connects to the DLL via IIS and IIS therefore handles the authentication.
Using integrated Windows authentication is the recommended option, but it is also
possible to use other methods such as anonymous access or basic authentication,
for example. For security reasons, it is much better to make users connect to IIS
using HTTPS and not HTTP: this will avoid sending query results and possibly user
credentials over the network as clear text.
Another benefit of HTTP access is that it allows users to connect to Analysis Services
even in situations where a firewall blocks access to ports 2382 (for SQL Server Browser)
or 2383 (the default port on which Analysis Services listens for client connections).
A complete walkthrough of how to set up HTTP connectivity is outside the
scope of this topic; the following blog entry contains links to all of the relevant
white papers and collects a lot of other useful information on the subject at
http://tinyurl.com/MSMDPUMP .