BI OLAP BW connection error openSapBwBrowsingSessionFailed

[franciscoalmeida]

I'm posting this here because I have not found this documented anywhere, so others might find it useful.

The scenario is as follows: an OLAP connection is created to a BW system, and can be confirmed to work via the CMC (using "Choose cube") or via WebI Desktop. However, when one tries to use the browser-based WebI, the error below is thrown:

This error has several causes apparently, judging from Notes 2088944 and 2062091. In these cases, the cause is a symbol in the password of the BW account. That was not the case here, as the password did not contain any symbols. Other notes suggested a BW password change may cause this as well, because the relevant APS server caches the password originally used and the new one is not forwarded to BW. We have had that very same issue just hours before a Demo and that can ruin your day . Another cause to check is authorisation in both BW (of the BW account to the cube) and BI (authorisation of the user to the OLAP connection).

Now back to the issue at hand. The logs will "help" you. The WebI processing server GLF will claim that the "password logon is no longer possible" because of "too many failed attempts" on the BW server:

Well, you know the password works, there is no authorisation issue on either sides, no symbols in the BW password, so what is wrong? Another note will suggest restarting servers, SIA and even re-creating APS servers when the BW password is changed. We tried all that, but in this case, the password had not changed, so re-creating servers, etc., did not help.

In the end, the problem is that there was an invalid configuration for SAP authentication in the area CMC > Authentication > SAP. An invalid "Entitlement Systems" entry was for some reason causing the problem. When clicking on the tab "Role Import", the same error "too many attempts" would be thrown.

Interestingly, all OLAP connections were using Pre-defined Authentication (not SSO), so one would think SSO SAP authentication would not affect these connections. Well, think again.

Solution: in the end, we just removed the offending SAP Entitlement records (there were two), restarted the APS and WebI processing servers, and the connection works. Hope this will help someone.

[former_member211289]

Dear Francisco,

Yesterday we have updated password in SAP Authentication >Entitlement systems> Logical System name(BW1 and BW2)>Updated password for two records > Understand that there is no issue with Role import tab.

Now, we are able to login to BI Launchpad with BW1 and executed reports without any issues.

But we are able to login to BI Launchpad with BW2 and unable to execute reports, getting password logon is no longer available, two many attempts.

Please let me know where and what else we missed?

Kindly do the needful, issue is in production system.

Thanks

Ram

[Former Member]

Man! This is awesome!

Thank you very much, saved my day too

[Former Member]

Thanks for Sharing .

Saved my day.

[Balaji]

hi Francisco,

thanks for your details,

as per my understanding from your post, we can use different user id for (OLAP connections which is created using IDT or in CMC) and SAP Authentication under Entitlement Systems for SSO,  is it correct?

Regards,

Balaji

[franciscoalmeida]

Hi Balaji,

That is precisely the point, I was hoping that these two authentication areas (connection to BW and sap sso) would work independently when not using the connection in SSO, given that one has a choice of using SSO when setting up that connection:

In our case, the faulty sap sso (entitlement) configuration was preventing connections configured as Pre-defined. It would be expected if this was happening for SSO connections, but the error happened when using Enterprise accounts and Pre-defined connections, and this seems to be a bug.

To answer your query more specifically, I expect you should be able to have different SAP IDs for your entitlement system and for Pre-defined OLAP connections, because that seems to be the point of allowing the Pre-defined option. However, what we observed here was that a problematic sso configuration was having an unexpected effect on the (Pre-defined) OLAP connections, so I cannot guarantee that the expectation would be confirmed. In our case, we deleted the entitlement system configuration because we don't need sap sso, and that is when the OLAP connections started working again.

[Balaji]

hi Francisco,

Thanks for your detailed explanation, lets wait and see and any experts able to guide/inputs on this request.

Regards,

Balaji

[former_member189884]

Hello Francisco.

Sorry I am trying to understand exactly what your issue is/was. Are you saying that an OLAP connection set to predefined begins to fail if there is a broken entitlement system?

I just want to be sure I understand totally before commenting or testing it out on my system.

-Josh

[franciscoalmeida]

Hi Josh,

Yes, this is precisely the scenario I tried to describe here: OLAP connections set to predefined were failing while there was a broken entitlement system configured.

Regards,

Francisco

[former_member189884]

Francisco, I tested the pre-defined connection when a bad password was entered into the entitlement system and it worked for me. Was there something particular? I noticed you mention "However, what we observed here was that a problematic sso configuration" is it the SSO configuration that was bad? Are you accessing the BI Launchpad as an SAP user?

Thanks again

[former_member189884]

Francisco, I read your initial post again and noticed you are getting the too many failed login attempts error. Was the user in the failed entitlement system the same user as in the predefined connection? If so then a failing SSO connection that locks the account would also cause the predefined connection to fail since the account itself is locked.

Just a thought, if this is not the case then my apologies.

[franciscoalmeida]

Hi Josh,

Your politeness is acknowledged and appreciated. It is a rare virtue in forums like these. I understand you are trying to understand the problem rather than proving me wrong = )

I have consistently used the "Administrator" account as the BI account for all tests, so the authentication was forcibly always "Enterprise". The SSO to SAP was not working or used at the time of the tests. In fact, no SSO at all (LDAP, AD, nothing is configured here).

The account used in the OLAP connections was different from the one used in the Entitlement System. Moreover, one can successfully connect to BW (SAP GUI) using the SAP account details.

After your comments, I tried to re-create the problem by setting up an Entitlement system with a bad password and I too could not replicate the problem. Until I restarted the SIA with that Entitlement system in place (still with a bad password). Now the good old error is back.

To make sure you can replicate exactly what I see here, below follow the steps I took:

1. Version: BI 4.1 SP05 no FP on Windows;

2. Create a new Entitlement System as below and save it (update)

3. Click on Role Import and check that it shows the error below:

4. Restart SIA/Tomcat;

5. Try creating a new (web-based) WebI on a BEx query/OLAP connection and get the error below:

The screenshot included the timestamp from the Java console so as to confirm I have just been able to re-create it following the steps above.

Note: the same connection will work if one uses the desktop version of WebI (Rich Client).

Regards,

Francisco

[former_member189884]

Sorry for not getting back to your right away on this there is currently a great deal of discussion around the expectations of the pre-defined connections.

I have tested on BI4.1 SP5 FP5 and found the following to be true:

1) If there is NO entitlement systems configured then predefined connections do not work.

2) Once an entitlement system is created the configuration of said system needs to be valid upon SIA restart (not sure why) for the predefined to work.

I believe, like you, that the predefined connections should have ZERO dependency on the entitlement systems since they are self contained. I am continuing to look into this to collect more information.

Thanks for posting!

-Josh