Question Re: BPC SSO using Client Certificates in Technology Q&A

BPC SSO using Client Certificates

Former Member — Mon, 31 Mar 2014 13:36:32 GMT

I am planning on using client certificates to implement SSO with BPC 10. Has anyone out there taken this approach? Which document/video provieds the best guidance on how to do this?

Thanks in advance for any assistance

dennisb

Re: BPC SSO using Client Certificates

ChrisGela — Wed, 09 Apr 2014 12:55:07 GMT

Hi Dennis,

Are you planning to use the BPC on Microsoft or Netweaver?

If you are planning to use BPC on NetWeaver you can follow the current SSO guides for NetWeaver on SDN.

e.g. :

I know with BPC 10 on NetWeaver there is also an Excel plugin, if you get SSO working with the SAP GUI, then the excel plugin will also work. (similar to Business analyser etc)

Kind Regards,

chris

Re: BPC SSO using Client Certificates

tim_alsop — Wed, 09 Apr 2014 17:50:50 GMT

Chris,

The Excel plugin (EPM add-in) for BPC 10 does not use SNC. It uses HTTP authentication with SAP password, or asks user for certificate.

Thanks

Tim

Re: BPC SSO using Client Certificates

ChrisGela — Wed, 09 Apr 2014 18:25:19 GMT

Hi Tim,

Yes you're correct. If you configure the ABAP spengo (needed for http SSO) then EPM add-in will work with SSO.

Kind Regards,

Chris

Re: BPC SSO using Client Certificates

tim_alsop — Wed, 09 Apr 2014 19:03:42 GMT

Chris,

Are you sure it will ? Have you tried it ?

How do you stop EPM add-in from showing the Sign-On screen if you are using SPNEGO ?

Thanks

Tim

Re: BPC SSO using Client Certificates

ChrisGela — Thu, 10 Apr 2014 10:27:20 GMT

Tim,

I have tried it.

See the screen shots here:

EPM-addin.pdf - Google Drive

I'm not sure what you mean by the sign-on screen. However, when testing Business explorer Analyzer or any of the Bex designers, a logon screen does pop up, but the password text is grayed out. You can log on without having to enter a password.

screen shots here: BusExplorer.pdf - Google Drive

Kind Regards,

chris

Re: BPC SSO using Client Certificates

tim_alsop — Thu, 10 Apr 2014 10:32:05 GMT

yes, BEX Analyzer works with SNC. This is not being discussed. We are discussing the EPM add-in used with BPC10.

I cannot access your PDF on Google Drive. When I click on the link it is not showing the PDF.

Re: BPC SSO using Client Certificates

donka_dimitrova — Thu, 10 Apr 2014 10:35:18 GMT

Hello Dennis,

Please, find here the Security Guide for BPC 10 version for SAP NetWeaver:

https://websmp102.sap-ag.de/~sapidb/011000358700001239962013E

->Look at the chapter 5.2 Integration Into Single Sign-on Environment

Please, find here the Security Guide for BPC 10 version for MS platform:

https://websmp107.sap-ag.de/~sapidb/011000358700000470172011E

-> Look at the chapter 5 User authentication process

I would like to let you know also that Single Sign-On with BPC 10 is easily possible in conjunction with the SAP NetWeaver Single Sign-On product (license required). This is about re-using the Windows Logon (Kerberos, SPNego).

You can find more details here: SAP NetWeaver Single Sign-On --> Single Sign-On with Kerberos

The implementation is described step-by-step in the How-To videos.

I hope this will help you to find the answers on your questions.

Best regards,

Donka Dimitrova

Re: BPC SSO using Client Certificates

ChrisGela — Thu, 10 Apr 2014 10:45:05 GMT

Apologies, only mentioned BEX because thats the place I saw a popup.

I've attached the pdf's to the thread, hopefully you can access them now ...

(I've had to change the file extension to .text as this site does not allow .pdf - Please unzip first and then change the doc's to .pdf )

Re: BPC SSO using Client Certificates

tim_alsop — Thu, 10 Apr 2014 11:37:02 GMT

Thank you. I now have your PDF for EPM add-in. This is what we are discussing, since there are no doubts about BEx using SNC for SSO. I have therefore ignored your PDF for BEx.

In your PDF you show Connection being created and no Sign-On screen. This is not same as when I try... Maybe you can help me find out why.

Here's what I tried:

I open excel
I select EPM tab
I press Log On button
Screen opens allowing me to select a connection. I haven't created a connection yet, so I press ...
On Connection Manager screen I press Create button
I give the connection a name and put the URL into the Server URL field.
I am unable to press OK on the Create Connection screen since OK button is greyed out. I therefore press the Connect button.
When I press Connect button on Create Connection screen I am shown a Sign-On screen asking me for User Name and Password.

How does above differ from what you are doing ?

Thanks for your help.

Regards,

Tim

Re: BPC SSO using Client Certificates

ChrisGela — Thu, 10 Apr 2014 12:08:43 GMT

Okay, I understand your issue better now.

Yes, you first need to connect before you can click Okay.

But for me, when I click connect, I do not get a popup.

Could you confirm that the web gui is correctly working for your BPC ABAP backend ?

You can do this by opening a browser and going to a this url :

e.g. : http://<hostname>:<port>/sap/bpc/

When I do this I get this in my browser:

But the important thing is there is no additional log on screen or prompt

e.g. a logon screen with a system that is not configured with ABAP HTML SPNEGO:

I hope this helps...

Kind Regards,

chris

Re: BPC SSO using Client Certificates

tim_alsop — Thu, 10 Apr 2014 12:23:21 GMT

Yes, when I access http://<hostname>:<port>/sap/bpc/ I am logged in. I configured SPNEGO in the SICF service at default_host/sap/EPM_BPC.

The info you have provided has given me a few ideas. I will do some more tests and get back to you soon. Thank you so far for your help.

@Dennis - sorry to take over your thread. Hopefully the info Chris has provided has given you what you needed ?

Re: BPC SSO using Client Certificates

tim_alsop — Thu, 10 Apr 2014 18:40:34 GMT

Chris,

I have made some progress, but still having some difficulty with the EPM add-in. I wondered if you could send me a fiddler trace showing the logon working so I can compare with my trace and check for differences ?

Thanks

Tim

Re: BPC SSO using Client Certificates

Former Member — Fri, 11 Apr 2014 16:15:46 GMT

Hi Tim,

Yes I can confirm the SSO is working as soon as the SPNEGO is configured on server side.

In fact, when the logon screen switches to SSO mode (without prompting for a user/pwd), it only depends on the server configuration.

Each time the user selects a specific connection, the EPM Add-In sends a first request (without any authentication info) to the server in order to know which authentication methods it is compatible with.

And in the case the server returns the header "WWW-Authenticate: Negotiate", then it means the SPNEGO is active and the EPM Add-In won't prompt the user to enter credentials...

This is a valid scenario for EPM Add-In with BPC MS and NW.

To answer Dennis, I just would like to confirm it is also possible to use HTTP Cient Certificate authentication from EPM Add-In.

I guess you will find all the information you need in the documentation Donka has provided, but to summarize, when creating your BPC connection in the EPM Add-In, you just have to click on the check box "Client Certificate" and to click on the Button "Choose Certificate" in order to pick up a certificate.

When conneting to the server, you won't be prompted for entering credentials...

Hope it helps...

Best Regards,

David.

Re: BPC SSO using Client Certificates

tim_alsop — Fri, 11 Apr 2014 17:35:04 GMT

David,

I have noticed that when using SPNEGO for EPM add-in authentication, there is no MYSAPSSO2 cookie issued, but instead a SAP_SESSIONID cookie is issued. Is this SESSIONID cookie being used instead of the SSO2 cookie ? I noticed that when using Basic Authentication instead of SPNEGO there is a MYSAPSSO2 cookie used.

Thanks

Tim

Re: BPC SSO using Client Certificates

former_member395983 — Tue, 07 Jul 2015 02:37:36 GMT

Hi Christopher,

Can you please help me on how you implemented SSO in your EPM add-in? We don't have enterprise portal that's why I cannot use that documentations in implementing SSO for our EPM add-in.

Do you have documentations that can help me do it step by step? I'm confused on all the documentations I'm seeing in forums

Really appreciate if you can help me on this.

Thank you and have a good day ahead.

Regards,

Jenilyn

Re: BPC SSO using Client Certificates

ChrisGela — Tue, 07 Jul 2015 09:25:46 GMT

Hi Jenilyn,

We got SSO EPM-in to work using SAP NW SS0 2.0

NW SSO 2.0 will require a seperate license - please contact your SAP account manager for more information.

NW SSO 2.0 basically allows SSO for GUI and web html access. Because the EPM-addin for EXCEL uses an HTML connection, you will need to implement NW SS0 2.0.

(Hence all the links on this thread point o NW SSO 2.0 documentation.)

Let me know if you have further questions...

Kind Regards,

chris

Re: BPC SSO using Client Certificates

former_member395983 — Wed, 08 Jul 2015 04:44:43 GMT

Hi Chris,

Thanks for your response. What if we don't want to buy license for SSO 2.0? Is there any other way to implement SSO for EPM add-in? We are using SSO Kerberos on our other systems.

Thank you again.

Regards,

Jenilyn

Re: BPC SSO using Client Certificates

former_member395983 — Wed, 08 Jul 2015 05:44:17 GMT

Hi David,

Can you please help me on how you implemented SSO in your EPM add-in? We don't have enterprise portal that's why I cannot follow the documentation from SAP. Do you have documentations that can help me do it step by step? I'm confused on all that I'm seeing in forums.

Really appreciate if you can help me on this.

Thank you and have a good day ahead.

Regards,

Jenilyn

Re: BPC SSO using Client Certificates

tim_alsop — Wed, 08 Jul 2015 06:11:00 GMT

Jenilyn

You can implement SSO for BPC 10 and EPM add-in without buying SAP SSO 2.0 license. You can instead buy a different product. It is not possible to implement this for free unless you use a portal and require users to logon to portal, login to BPC Web and launch Excel from the link provided. Of course, it is much better if the end user just opens Excel and logs into BPC without needing any additional credentials or needing to login to portal.

Thanks

TIm