BOE BI Launchpad SSO problem

[#1]

I have the BusinessObjects BI Launch Pad configured so that Single Sign On (SSO) through Windows AD is working correctly when using this URL:

http://servername:8080/BOE/BI

However, SSO fails miserably when using this URL to the same server:

http://servername.domain.com:8080/BOE/BI

What the user intially sees when the fully qualified URL is used:

If credentials are supplied in this popup window, BOE then displays the following:

HTTP Status 500 - 
--------------------------------------------------------------------------------
type Exception report
message 
description The server encountered an internal error () that prevented it from fulfilling this request.
exception 
java.lang.RuntimeException: java.lang.NullPointerException
 com.businessobjects.http.servlet.internal.BundlePathAwareServiceHandler.serviceHelper(BundlePathAwareServiceHandler.java:254)
 com.businessobjects.http.servlet.internal.BundlePathAwareServiceHandler.service(BundlePathAwareServiceHandler.java:197)
 com.businessobjects.http.servlet.internal.ProxyServlet.service(ProxyServlet.java:248)
 javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
 org.eclipse.equinox.servletbridge.BridgeServlet.service(BridgeServlet.java:220)
 javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
 com.businessobjects.pinger.TimeoutManagerFilter.doFilter(TimeoutManagerFilter.java:166)

root cause 
java.lang.NullPointerException
 com.crystaldecisions.sdk.occa.security.internal.LogonCred.<init>(LogonCred.java:28)
 com.crystaldecisions.sdk.occa.security.internal.LogonService.userLogon(LogonService.java:547)
 com.crystaldecisions.sdk.occa.security.internal.SecurityMgr.userLogon(SecurityMgr.java:185)
 com.crystaldecisions.sdk.framework.internal.SessionMgr.logon_aroundBody4(SessionMgr.java:496)
 com.crystaldecisions.sdk.framework.internal.SessionMgr.logon_aroundBody5$advice(SessionMgr.java:512)
 com.crystaldecisions.sdk.framework.internal.SessionMgr.logon(SessionMgr.java:1)
 com.businessobjects.webutil.ApplicationUtils.logonGSS(ApplicationUtils.java:158)
 com.businessobjects.infoview.logon.LogonAction.logonVintela(LogonAction.java:361)
 com.businessobjects.infoview.logon.LogonAction.handleVintela(LogonAction.java:383)
 com.businessobjects.infoview.logon.LogonAction.perform(LogonAction.java:112)
 org.apache.struts.action.ActionServlet.processActionPerform(ActionServlet.java:1787)
 org.apache.struts.action.ActionServlet.process(ActionServlet.java:1586)
 com.crystaldecisions.webapp.struts.framework.CrystalUTF8InputActionServlet.process(CrystalUTF8InputActionServlet.java:17)
 org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:492)
 javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
 javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
 com.businessobjects.http.servlet.internal.ServletRegistration.service(ServletRegistration.java:110)
 com.businessobjects.http.servlet.internal.ServletLastFilterChainElement.service(ServletLastFilterChainElement.java:30)
 com.businessobjects.http.servlet.internal.filter.FilterChainImpl.doFilter(FilterChainImpl.java:46)
 com.wedgetail.idm.sso.AuthFilter.doFilter(AuthFilter.java:149)
 com.businessobjects.sdk.credential.WrappedResponseAuthFilter.doFilter(WrappedResponseAuthFilter.java:66)
 com.businessobjects.http.servlet.internal.FilterRegistration.doFilter(FilterRegistration.java:72)
 com.businessobjects.http.servlet.internal.filter.FilterChainImpl.doFilter(FilterChainImpl.java:43)
 com.crystaldecisions.webapp.util.filter.ResponseEncodingFilter.doFilter(ResponseEncodingFilter.java:24)
 com.businessobjects.http.servlet.internal.FilterRegistration.doFilter(FilterRegistration.java:72)
 com.businessobjects.http.servlet.internal.filter.FilterChainImpl.doFilter(FilterChainImpl.java:43)
 com.businessobjects.webutil.boetrustguard.BOETrustValidateFilter.doFilter(BOETrustValidateFilter.java:45)
 com.businessobjects.http.servlet.internal.FilterRegistration.doFilter(FilterRegistration.java:72)
 com.businessobjects.http.servlet.internal.filter.FilterChainImpl.doFilter(FilterChainImpl.java:43)
 com.businessobjects.webutil.internal.filters.BrowserRenderingModeFilter.doFilter(BrowserRenderingModeFilter.java:20)
 com.businessobjects.http.servlet.internal.FilterRegistration.doFilter(FilterRegistration.java:72)
 com.businessobjects.http.servlet.internal.filter.FilterChainImpl.doFilter(FilterChainImpl.java:43)
 com.businessobjects.webutil.boetrustguard.BOETrustPrepareFilter.doFilter(BOETrustPrepareFilter.java:32)
 com.businessobjects.http.servlet.internal.FilterRegistration.doFilter(FilterRegistration.java:72)
 com.businessobjects.http.servlet.internal.filter.FilterChainImpl.doFilter(FilterChainImpl.java:43)
 com.businessobjects.swd.shared.tracelog.TraceLogScopeFilter.doFilter(TraceLogScopeFilter.java:38)
 com.businessobjects.http.servlet.internal.FilterRegistration.doFilter(FilterRegistration.java:72)
 com.businessobjects.http.servlet.internal.filter.FilterChainImpl.doFilter(FilterChainImpl.java:43)
 com.businessobjects.sdk.actionfilter.WorkflowFilter.doFilter(WorkflowFilter.java:45)
 com.businessobjects.http.servlet.internal.FilterRegistration.doFilter(FilterRegistration.java:72)
 com.businessobjects.http.servlet.internal.filter.FilterChainImpl.doFilter(FilterChainImpl.java:43)
 com.businessobjects.swd.appcontext.RequestInitFilter.doFilter(RequestInitFilter.java:26)
 com.businessobjects.http.servlet.internal.FilterRegistration.doFilter(FilterRegistration.java:72)
 com.businessobjects.http.servlet.internal.filter.FilterChainImpl.doFilter(FilterChainImpl.java:43)
 com.businessobjects.http.servlet.internal.BundlePathAwareServiceHandler.serviceHelper(BundlePathAwareServiceHandler.java:235)
 com.businessobjects.http.servlet.internal.BundlePathAwareServiceHandler.service(BundlePathAwareServiceHandler.java:197)
 com.businessobjects.http.servlet.internal.ProxyServlet.service(ProxyServlet.java:248)
 javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
 org.eclipse.equinox.servletbridge.BridgeServlet.service(BridgeServlet.java:220)
 javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
 com.businessobjects.pinger.TimeoutManagerFilter.doFilter(TimeoutManagerFilter.java:166)

note The full stack trace of the root cause is available in the Apache Tomcat/6.0.24 logs.

--------------------------------------------------------------------------------
Apache Tomcat/6.0.24

I must use the fully qualified URL in order to get SSL working; the cert I've been issued is for *.domain.com

Any suggestions???

[Former Member · Accepted solution]

Did you add the Fully qualified URl in local intranet in IE ?

Did you create the Client side SPN for FQDN URL like HTTP/server.domain.com

Regards,

Rohit Vamsi

[Former Member · Accepted solution]

Hi Rohit,

Thank you for responding to my thread.

Once I added the fully qualified URL to "local internet" in IE, the problem was fixed.  My networking knowledge is not really great, so I'm confused about why this is necessary.  Anyway, thank you very much for the answer.

Dean

[Former Member · Accepted solution]

SSO whether spnego or NTLM occurs on the client workstation based on the browser rules

By default IE will only send credentials to websites determined to be in the local intranet zone

IE can be setup to send credentials regardless of zone but this is usually considered insecure as it could results in credentials being sent over the internet

If the URL contains a . (period) then it will automatically be interpreted as a internet site and IE defaults will not send credentials

If the URL contains a . ensure that it has been added to the local intranet sites in IE > Options > Security > Local Intranet

Hope this answers your query

Regards,

Rohit Vamsi