cancel
Showing results for 
Search instead for 
Did you mean: 

AD user is locked when login in designer using SAP credential

Former Member
0 Kudos

We are currently using BOBJ XI 3.1 Fp 1.8

We have setup the authentication using SAP and Windows AD being syncronized with SNC

We can login in infoview or SAP using our wndows AD or SAP credential without any issues

However in this randomly we are having the following challenge:

1 - when login to designer using my SAP credential and then do a refresh structure .. then when trying to export the universe

I am getting a windows AD error. afterwards we do find out that the system AD user is getting locked.

Any idea ?

Thank you

Philippe

Accepted Solutions (1)

Accepted Solutions (1)

IngoH
Active Contributor
0 Kudos

Hi Philippe,

the Universe Designer does not support client side SNC - hope you are aware of this.

are you logging on with the SAP Credentials to the Universe Designer ? Can you build new Universes without any issues ?

ingo

Former Member
0 Kudos

yes they loggin to the Designer using the SAP credential.

0 Kudos

Hi,

this sounds strange. can you see anything in the security log of the DC?

REgards

-Seb.

Former Member
0 Kudos

yes the DC trace didnot give anything .. here is part of the trace that is interesting: everytime I do run some delegate search once login in rich client using my SAP credential.

it always try to connect me using SNC and passing my SAP information .. but it is always failing as SNC is not supported probably thru client.. then it goes thru windows AD and pass my information .. check out the trace and let me know if you do find something interesting in it

Thu Dec 02 10:06:37.891: SAPMODULE: SAPSNCAuthenticationService: The Logical system is BPCLNT100

Thu Dec 02 10:06:37.891: SAPMODULE: SAPSNCAuthenticationService: The SAPUsername found is PMURAZ

Thu Dec 02 10:06:37.891: SAPMODULE: SAPSNCAuthenticationService::canAuthenticate: The SAP authentication will be SNC for this session.

Thu Dec 02 10:06:37.891: SAPMODULE: SAPAuthenticationService: Authentication model for SAP connectivity is SNC

Thu Dec 02 10:06:37.891: SAPMODULE: SAPAuthenticationService: Trying to connect to SAP using this URI : occa:sap://;PROVIDER=sapbw_bapi,R3NAME=BIP,GROUP=COMPANY_BIP,MSHOST=sapbpprd,LANG=en,CLIENT=100,CATALOG="ZIM_CUBE1",CUBE="ZIM_CUBE1/ZQ_QUERY1",SNC_MODE=1,SNC_QOP=9,SNC_LIB="C:\WINDOWS\system32\gsskrb5.dll",SNC_PARTNERNAME="p:SAPServiceBIP@COMPANY",SNC_MYNAME="p:systemuserid@COMPANY",EXTIDDATA=PMURAZ,EXTIDTYPE=UN

Thu Dec 02 10:06:38.110: MEMORY: StringMessageInsert: Instance 0 (0C8D5490): Created

Thu Dec 02 10:06:38.110: SAPMODULE: : Unable to connect to SAP BW server SAP_CMINIT3 : rc=20 > Connect to SAP gateway failed

Connect_PM GWHOST=192.123.234.234, GWSERV=sapgw02s, SYSNR=02

LOCATION CPIC (TCP/IP) on local host

ERROR GSS-API(maj): No valid credentials provided (or available)

GSS-API(min): No Kerberos SSPI credentials available for

requested nam

name="p:systemiduser@COMPANY"

TIME Thu Dec 02 10:06:38 201

RELEASE 710

COMPONENT SNC (Secure Network Communication)

VERSION 5

RC -4

MODULE sncxxal

Thu Dec 02 10:06:38.110: MEMORY: StringMessageInsert: Instance 0 (0C8D5490): Refcount raised to 2

Thu Dec 02 10:06:38.110: MEMORY: StringMessageInsert: Instance 0 (0C8D5490): Refcount lowered to 1

Thu Dec 02 10:06:38.110: SAPMODULE: SAPAuthenticationService: m_pRfcWrapper->RfcOpenEx() 0.219

Thu Dec 02 10:06:38.110: MEMORY: StringMessageInsert: Instance 0 (0C8D5490): Refcount lowered to 0

Thu Dec 02 10:06:38.110: MEMORY: StringMessageInsert: Instance 0 (0C8D5490): Destroyed

Thu Dec 02 10:06:38.110: SAPMODULE: SAPAuthenticationService: Unable to authenticate using SNC because the URI does not meet the minimum connection requirements.

Thu Dec 02 10:06:38.110: SAPMODULE: SAPAuthenticationService: Warning: SNC was enable and failed. The authentication process is falling back to secondary Credentials...

Thu Dec 02 10:06:38.110: SAPMODULE: SAPAuthenticationService: Determining if we can connect using SSO. Calling CanAuthenticate...

Thu Dec 02 10:06:38.110: SAPMODULE: SAPAuthenticationService: Authentication model for SAP connectivity is SSO

Thu Dec 02 10:06:38.110: SAPMODULE: SAPSSOAuthenticationService::get_sap_sso: Serialized session exists, try deserializing it.

Thu Dec 02 10:06:38.141: SAPMODULE: SAPSSOAuthenticationService::getConnectionString(: The SAP authentication will be SSO for this session.

Thu Dec 02 10:06:38.141: MEMORY: URI: Instance 14 (09B6E278): Refcount lowered to 0

Thu Dec 02 10:06:38.141: MEMORY: URI: Instance 14 (09B6E278): Destroyed

Thu Dec 02 10:06:38.141: SAPMODULE: SAPAuthenticationService: Trying to connect to SAP using this URI : occa:sap://;PROVIDER=sapbw_bapi,R3NAME=BIP,GROUP=COMPANY_BIP,MSHOST=sapbpprd,LANG=en,CLIENT=100,CATALOG="ZIM_CUBE1",CUBE="ZIM_CUBE1/ZQ_QUERY1",USER="PMURAZ",PASSWD=******

IngoH
Active Contributor
0 Kudos

Hi,

the Universe Designer does not support client side SNC. You need to leverage standard SAP credentials to authenticate

ingo

Former Member
0 Kudos

Well, I did login in the designer using My SAP credential, the thing is that when looking at the trace it still try anyway to connect me first thru SNC and then thru SAP ..

the Question is .. how would you make a change to the universe if you cannot login in designer using your SAP credential ?

Philippe

IngoH
Active Contributor
0 Kudos

hi,

what is the current integration for the SAP Authentication in regards to SNC as part of the Central Management Console ?

ingo

Former Member
0 Kudos

it is a kerberos SNC authentication, in the CMC, i do have the SNClibrary leading to gsskrb5.dll

we have also windows AD users that are mapped to the SAP user

IngoH
Active Contributor
0 Kudos

Hi Philippe,

I think I mentioned several times now that the Universe Designer does not support an authentication based on server side SNC. You would have to implement full client side SNC then.

regards

Ingo Hilgefort

Answers (1)

Answers (1)

Former Member
0 Kudos

Philippe,

Were u able to fix this issue? I have exactly the same issue to be fixed.

Thanks,

Prasanth