SSO to BO from Portal an Fiori

[JaySchwendemann]

Dear all,

we want to establish an SSO to a single BO system (BI Launchpad and OpenDocument) from both(!) a single Portal system and a single Fiori system. We also only have one BW system. Preferably I wanna do this via logon tickets.

I admit, that I don't fully understand the possibilities but in this area, I think SAP's architectural design is near madness... 🙂

Anyways, here's what I understood so far (might be wrong, please correct me)

1. To setup SSO between Portal and BO you have a menage a trois between BW, Portal and BO
2. You will configure the BW System as entitlement system
3. (?) You will configure the BW System as default system (?)
4. You will establish a trust between Portal and BO using a shared secret
5. You will establish trust between BO and BW using a certificate (private key in BO, import public key in BW)
6. You will establish trust between BW and Portal using a certificate (private key in Portal, import public key in BW)
7. You will configure BO as special system in Portal using "SAP BusinessObject" Template
8. You will need special iView Templates in Portal for BO "SAP BusinessObjects Document Viewer" / "SAP BusinessObjects Document List"
9. (?) You generate iViews from that templates and need to enter some Alias (?)
10. (?) You can only have SSO to BO via Logon Tickets from ONE calling system (?)
11. (?) You cannot have (at least frictionless?) support for both SAML SSO and other SSO methods like AD (Kerberos) or Logon Tickets (?)

My Questions:

1. (See Figure 3) Which system will you configure as a default system assuming that the main entry point should be enterprise portal
2. (See Figure 😎 Which Alias would I need to enter in the BP iView "SAP BusinessObjects Document Viewer" assuming I want to have Logon Ticket SSO from Portal to BO. And where to put that Alias in BO (CMC)
3. (See Figure 10) This is a main concern:
   In https://launchpad.support.sap.com/#/notes/1495354 SAP states "The BI system will append the default system information to the front of the MYSAPSSO2 token received, so SSO will only work for users coming in from the same SAP system defined as the default. If you are using iViews for Enterprise Portal, then there is a solution available in KBA 1507252 with Multiple BW SAP Systems via the SAP Portals [...] Currently, there is no similar workaround or solution for the Fiori Portal. SSO will only function for the default SAP system defined.
   --> I only have one BW system and one Portal system (and one BO system), where the note speaks of Systems.
   
   In https://launchpad.support.sap.com/#/notes/1701240 SAP states "mysapsso2 tokens can be used to authenticate to BI from various SAP applications (CRM, fiori, EP, KM), they all require a similar configuration but the front end application steps may vary".
   --> Now who is right? Will I be able to have a SSO via logon tickets for both clients reaching BO via Portal and clients reaching BO via Fiori?
4. (See figure 11) In https://launchpad.support.sap.com/#/notes/2760952 SAP states that there's no simultaneous SSO possible when SAML is configured. This is nonsense from a integration point of view but at least clearly stated.
   -->What would be the consequences to have that double BOE web application directory in terms of user management, deployment of content, ...?

Many(!) thanks for input to any of the 4 questions. I really like to get my head around this topic 🙂

Cheers

Jens

[denis_konovalov]

I have fixed your tags. Please select more careful next time.

[JaySchwendemann]

Thanks for stepping in but what'd I do wrong?

Cheers

Jens

[cristiano_mazzotti]

Alerted moderator for incorrect tag

[Joel_B]

Jens,

Have you considered SAML? I just setup a BO 4.3 instance which uses SAML 2.0 via Azure Cloud for passwordless single-sign on. With a SAML configuration, you can embed BO components in Fiori, or any content provider really.

[former_member761261]

Hi Jens,

Did you manage to perform SSO to BO from both Portal and Fiori ? We are also in the same situation. Currently we have been upgraded BO to 4.2 SP09 patch 300. We are running in On-Premises.

Your advise could be much appreciated.

Regards

Chandra