Windows AD Authentication for Business Objects BI Platform

[#1]

Currently we are running our installation of Business Objects BI Platform on a Windows 2008 r2 server with Tomcat. We understand that it is recommended that in order to authenticate with Windows AD you need to use Kerberos authentication, and this is true for SiteMinder authentication from this application as well. If this is wrong please let me know.

Because of the security restrictions on our environment we can not run the needed scripts on the AD server in order to use Kerberos. But also because of the security restriction we have to use SiteMinder against AD.

Is there any suggestion of what we can do to get this authentication to work? Thanks ahead of time!

[Former Member · Accepted solution]

This has been resolved. I worked with SAP and found you can not have the service account you are using to connect to AD be attached to just the BOE server.

[Former Member]

Kerberos is a very secure protocol, compared to others.

Creating SPNs and enabling the delegation option is required for kerberos to work.

These steps are suggested by Microsoft for kerberos to work and are not controlled by SAP BO.

Kerberos also allows you to perform SSO to the DB to view reports on demand.

However if you wish to use Siteminder, you can pull Active directory users using the AD plug-in and then use Siteminder with Trusted Authentication to pass the username authenticated by Siteminder to BO and BO can use the user name passed to create a session.

Note: As the user is already authenticated by Siteminder, BO would not perform the authentication again.

Please go thorough the below SAP Note, that helps setting up Trusted Authentication SSO.

1422248 Setting up Trusted Authentication in XI 3.x for Infoview and Opendocument using QUERY_STRING

1603002 - Setting up Trusted Authentication in BI4 for BIlaunchPad and Opendocument using HTTP_HEADER

Cheers,

Vikram.V

[Former Member]

Hello,

I think according to the requirements that you mention, that you should probably use LDAP authentication in BOE instead of AD kerberos.

Have a look at the notes 1245218 and 1609333 that will help you for the configuration.

https://service.sap.com/sap/support/notes/1245218

https://service.sap.com/sap/support/notes/1609333

Regards,

Philippe

[Former Member]

I followed the note 1245218 and I get the error "An internal error has occurred in the secLdap plugin". I have searched the web and tried the following:

-Disabled Siteminder

-Removed the Oracle 11g Client from the server

Are there any other suggestions on how to establish this connection?

Thanks!