![](https://community.sap.com/html/assets/img_tile-default.png)
In this blog I will go through the steps to configure Single Sign on in BOBJ System for BI Launchpad. This blog will be applicable for BOBJ which is running on Windows /Linux.
Process Overview
The following tasks needs to be done to enable Single Sign on in BOBJ:
1. Create an AD service account and Set SPN Values
Request Active Directory admin to create a service account (in this blog we will call it as: SAPServiceUser)
At a command prompt set the SPN to the service account.
setspn -s HTTP/myappserver SAPServiceUser
setspn -s HTTP/myappserverhostname.com SAPServiceUser
Validate the SPN is set up correctly using the command.
setspn -L sapserviceuser
2.LDAP configuration and map AD groups
Map an AD group to the LDAP plugin page in the CMC and verify users are imported.
Ldap Host and Port
b. Select Microsoft Active Directory
c.Change Default User Search Attribute to sAMAccountName &Change Username to sAMAccountName and press next
Attribute Change
d.Enter the credentials of AD user and Password
You need to enter the AD service user distinguished name and password
CN=SAPServiceUser,OU=SAP Service Accounts,OU=Batch,DC=<Example>,DC=<com>
e.Click next select Basic (no SSl)
f. Click next and select Basic (no SSO)
g. Select the following entries and press Next
h. Press finish to complete Wizard
i. Add the LDAP groups
3. Setup QUERY_STRING Trusted authentication
3.1 Steps to be done in CMC
3.2 Steps to be done in Server
3.2.1 Steps to be done in Windows Server
INSTALLDIR:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win32_x86
INSTALLDIR:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win64_x64
TrustedPrincipal.conf location
TrustedPrincipal.conf location
-Dbobj.trustedauth.home= INSTALLDIR:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win64_x64
-Dbobj.trustedauth.home= INSTALLDIR:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win64_x86
sso.enabled=true
trusted.auth.user.param=user
trusted.auth.user.retrieval=QUERY_STRING
sso.supported.types=vintela, trustedIIS, trustedHeader, trustedParameter, trustedCookie, trustedSession, trustedUserPrincipal, trustedVintela, trustedX509, sapSSO, siteminder
3.2.2 Steps to be done in Linux Server
Linux: /usr/sap/SID/SBO/sap_bobj/enterprise_xi40/linux_x64 and /usr/sap/SID/SBO/sap_bobj/enterprise_xi40/linux_x86
sso.enabled=true
trusted.auth.user.param=user
trusted.auth.user.retrieval=QUERY_STRING
4.Setup part of Vintela SSO for the application server
4.1. Enable low level vintela tracing in Tomcat's Java Options
4.1.1 Enable low level vintela tracing in Tomcat's Java Options in Windows
4.1.2 Enable low level vintela tracing in Tomcat's Java Options in Linux
# set the JAVA_OPTS for tomcat
JAVA_OPTS="-d$OBJECT_MODEL -Dbobj.enterprise.home=${BOBJEDIR}enterprise120 -Djava.awt.headless=true -Djava.net.preferIPv4Stack=false"
To:
# set the JAVA_OPTS for tomcat
JAVA_OPTS="-d$OBJECT_MODEL -Dbobj.enterprise.home=${BOBJEDIR}enterprise120 -Djava.awt.headless=true -Djava.net.preferIPv4Stack=false -Djcsi.kerberos.debug=true"
4.2 Add trustedvintela line to the FioriBi properties (Windows and Linux)
sso.types.and.order=trustedVintela
authentication.default=secLDAP
authentication.visible=true
logon.authentication.visibleList=secEnterprise,secLDAP,secWinAD,secSAPR3,secOraApps,secPSE1,secpsenterprise,secSiebel7
cms.default=<System Alias>
cms.visible=true
sso.types.and.order=trustedVintela
sso.supported.types=vintela, trustedIIS, trustedHeader, trustedParameter, trustedCookie, trustedSession, trustedUserPrincipal, trustedVintela, trustedX509, sapSSO, siteminder
NOTE: When sso.types.and.order= is used (above) then the settings in the global.properties for sso.enabled, vintela.enabled, and trusted.auth.user.retrieval are no longer needed below (and have been removed)
4.3 Add Vintela lines to the global.properties file (Windows and Linux)
siteminder.enabled=false
sso.enabled=true
vintela.enabled=true
idm.realm=<DOMAIN NAME>.COM
idm.princ=SAPServiceUser
idm.allowS4U=true
idm.password=<Password of SAPServiceUser>
idm.allowUnsecured=true
idm.allowNTLM=false
idm.logger.name=simple
idm.logger.props=error-log.properties
4.4 Remove legacy settings in global.properties from testing query_string
Note:
4.5 Increase Tomcat's maxHttpHeaderSize
<Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" compression="on" URIEncoding="UTF-8" compressionMinSize="2048" noCompressionUserAgents="gozilla, traviata" compressableMimeType="text/html,text/xml,text/plain,text/css,text/javascript,text/json,application/json" maxHttpHeaderSize="65536"/>
NOTE: Do not copy/paste. Also, this file is case sensitive.
4.6 Restart Tomcat and check to make sure the Vintela filter has loaded
Check for message “Message sent sucessfully to KDC and credentials obtained” in stderr.log
[DEBUG] Tue Sep 27 10:31:23 EDT 2011 jcsi.kerberos: Message sent sucessfully to KDC: /10.167.255.113:88
[DEBUG] Tue Sep 27 10:31:23 EDT 2011 jcsi.kerberos: ** credentials obtained .. **
5. Setup the client browser and test SSO
6. Limitation
7. SAP Notes
The below notes will be useful for implementing SSO in BI launchpad
1965433 - Setting up AD SSO when CMS is on Unix or Linux in BI4.x ***BEST PRACTICE***
1245218 - How to connect the LDAP plugin to Active Directory
1593628 - Setting up Trusted Authentication for the BOE web applications using the QUERY_STRING method
1549258 - BI 4.x: Authentication drop down option is missing from "BI launch pad" login page
1615492 - How to preserve custom settings for SAP BusinessObjects Tomcat WebApps in Business Intelligence Platform 4.x
2629070 - How to Securely Integrate BI 4.2 or 4.3 with Windows Active Directory and SSO in Distributed Environments - Best Practices
2041379 - Explaining the sso.types.and.order parameter in BI 4.1 & 4.2
2781286 - How To: Configure Security Token Service (STS) communication on BI 4.2, BI 4.3 and above
3239174 - Quick setup of STS for Cloud (such as HEC) customers
2524775 - Certificates generation using Java Keytool when configuring STS in BI 4.2 SP04 (Patch 4) onwards instead of PKCS12 tool
1653890 - Your security profile does not include permission to create documents. (Error: ERR_WIS_30263) error given in Webi Rich Client
The above steps complete the SSO configuration in BOBJ BI Launchpad. Please refer the below KBA for entire solution
1965433 - Setting up AD SSO when CMS is on Unix or Linux in BI4.x ***BEST PRACTICE*** for entire solution
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
User | Count |
---|---|
10 | |
10 | |
10 | |
9 | |
8 | |
8 | |
6 | |
5 | |
5 | |
4 |