I did not find any specific documentation for configuring Windows AD and SSO for only IS/DS components. Just thought of puttig all those steps together. I followed the below SAP Notes.
1631734 - Configuring Active Directory Manual Authentication and SSO for BI4
OS: Windows Server 2012
DB: MS SQL Server
Apps: IS/DS (Installed with IPS - Information Platform Service, no additional license required)
In our case we enabled SSO for InfoSteward and DS Designer. For DS console and CMC we are using Windows AD athentication only. But this article gives you steps to enable SSO for all components.
_____________________________________________________________________________________________________________________________________
Section 1 - Planning your Service Account Configuration
Before configuring IS/DS for AD logins we must request AD service accounts. This service accounts should have 3 roles.
1. Query AD
2. Run the SIA/CMS and allow manual AD logins
3. Allows SSO
Section 2 - Creating and preparing the service account
Instead for creating new AD account in Domain Controller, we decided to use already existing <sid>adm user as BI Service account.
Get it done these steps with the help of AD team:
It has been setup with“Password never expire" and "unlock"
Delegation for the Service Account
navigate to the properties of the service account and choose
Trust this user for delegation to any service (Kerberos only)under theDelegationtab.
Setspn Commands- Should be run on Domain controller server by AD team
setspn -a BICMS/<sid>adm.domain.com <sid>adm
setspn -a HTTP/host.domain.com <sid>adm
setspn -a HTTP/host <sid>adm
Once they run this commands you can view them from your IS/DS server by running below commands
setspn -l <sid>adm
Section 3 - Configure the AD Plugin Page in the CMC and map in AD groups
Login to CMC => Authentication => Windows AD
Check "Enable Windows Active Directory (AD)"
AD Administrator Name: Domain\<sid>adm
Default AD Domain: Domain.com
Mapped AD Member Groups: We need to add the required AD groups here who needs access.
Authentication Options:
Use Kerberos authentication
Service principal name: BICMS/<sid>adm.domain.com
Check "Enable Single Sign On for selected authentication mode.
New Alias options: Assign each new AD alias to an existing user account with the same name
Alias update options: Create new alias when alias update occurs
New User options: New users are created as concurrent users
On-demand AD update:
Update AD Groups and Alias now
Update
Verifying users
Go to
CMC>Users and Groups>Group Hierarchy
and select the AD group you mapped to view the users for that group. This will generate a live query to AD (using the CMC query account) and display the current users in that group. It will also display any nested users in that group (users that belong to nested AD groups).
Do not proceed if users and/or groups are not mapping in properly!
Section 4 — Steps to start the SIA/CMS under the service account
In order for the service account to run the SIA there are specific operating system settings that need to be set.
1.
1. Add the service account to the local administrator‘s group on any server where the service account will be running a SIA/CMS.
Open Computer Management > Local Users and Groups > Groups > Administrator > Properties > Add
2. You should also grant the local policy Act as Part of the operating system as seen in the screenshot below.
Open Local security Policy > Local Policies > User Rights Assignments > Act as part of operating system > Properties > Add User or Group
3. After the above changes have been made the service account can now run the Server Intelligence Agent (SIA). Navigate to the Central Configuration Manager (CCM), stop the SIA and on the properties tab enter the account in domain\username format. And restart SIA.
1. 4.Verify the service account and AD logins are working
You should be able to login via DataServices Designer at this point. The next steps will test an AD login with the Central Configuration Manager‘s Manage Servers tool.
Add your user to Administrator group temporarily and login to server with your id and test it.
Add your user to Administrator group in CMC temporarily
Open the DataServices Designer >
System - host[:port]: host:6400
User name: Blank
Password: Blank
Authentication: Windows AD
Log on
Then it should show the DS repositories.
Section 5 –Configuring Manual AD authentication to Java Application Servers
Two files need to be created when using java. These files need to be created from scratch and should be placed in the C:\windows\ directory on any windows application server.
Create the bscLogin.conf file
Note: Make sure the file is not a text file
com.businessobjects.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required debug=true;
};
Create the krb5.ini file
[libdefaults]
default_realm =DOMAIN.COM
dns_lookup_kdc = true
dns_lookup_realm = true
default_tgs_enctypes = rc4-hmac
default_tkt_enctypes = rc4-hmac
udp_preference_limit = 1
[realms]
DOMAIN.COM= {
kdc =DCHOSTNAME.DOMAIN.COM
default_domain =DOMAIN.COM
}
Regfer OSS Note 1690665 - Unable to logon to BI Launchpad or CMC using Manual AD Authentication in BI 4.0 while creating krb5.ini file.
Verify java can successfully receive a kerberos ticket
1. From DOS command line navigate to the sapjvm\bin directory. By default this is:
E:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win64_x64\sapjvm\bin
2. Run
kinit usernamehit enter and type yourpassword
kinit <sid>adm
If the KDC and other configurations in the krb5.ini are correct you should receive a ticket.
Section 6 – Configuring CMC for manual AD login
Create CmcApp.properties file with below lines
authentication.visible=true
authentication.default=secWinAD
Point your application server to the bscLogin.conf and krb5.ini files.
Add the following lines to the tomcat java options. Tomcat must be restarted to test.
-Djava.security.auth.login.config=c:\windows\bscLogin.conf
-Djava.security.krb5.conf=c:\windows\krb5.ini
Restart the Tomcat
Verify the bscLogin.conf has been loaded by your application server
To verify the bscLogin.conf has been loaded by your application server attempt to logon to CMC (with AD selected in the drop down).
Check the sdtout.log in ..\
tomcat\logs folder and you should see "Commit succeed"
At this point you will be able to login InfoSteward, DataService Console & CMC with Windows AD logins.
Section 7 – Configuring Active Directory Single Sign On
Increase Tomcat’s maxHttpHeaderSize
..\tomcat\conf
Take the backup of existing server.xml and add the maxHttpHeaderSize="65536" in Connector Port 8080 tag
Create and configure a global.properties file
..\tomcat\webapps\BOE\WEB-INF\config\custom
Create a file namedglobal.propertieswith the following text inside:
sso.enabled=true
siteminder.enabled=false
vintela.enabled=true
idm.realm=DOMAIN.COM
idm.princ=<sid>adm
idm.allowUnsecured=true
idm.allowNTLM=false
idm.logger.name=simple
idm.logger.props=error-log.properties
For the values inboldabove replace them with the values for your service account from Section 2 above.
Create and configure a ICCExplore.properties file
Copy the ICCExplore.properties file from ..\tomcat\webapps\BOE\WEB-INF\config\default to ..\tomcat\webapps\BOE\WEB-INF\config\custom folder and modify it
authentication.default=secWinAD
cms.default=host:6400
Add additonal parameters toCmcApp.properties file - Optional
If you want to configure SSO for CMC as well? you can create CmcApp.properties file with below text inside. But it is not a good idea to enable SSO for CMC. Because if SSO doesn't work in order to troubleshoot you need to login to CMC first and also you might see security issues if some hacker get access to your domain.
cms.default=host:6400
authentication.visible=true
cms.visible=true
sso.supported.types=vintela, trustedIIS, trustedHeader, trustedParameter, trustedCookie,
trustedSession, trustedUserPrincipal, trustedVintela, trustedX509, sapSSO, siteminder
sso.types.and.order=vintela
authentication.default=secWinAD
Refer OSS Note:2190831 - How to enable CMC SSO in BI 4.1 SP6
Configuring the application server’s Java Options for AD Single Sign On
1. Add the following lines to the tomcat java options. Tomcat must be restarted to test.
-Dcom.wedgetail.idm.sso.password=password
-Djcsi.kerberos.debug=true
The wedgetail.sso.password is the password for your service account fromSection 2above.
The DJCSI.kerberos.debug options will enable a start up trace of the vintela filter.
Configuring the Data Services for SSO
Take the backup of existing web.xml file and modify the parameters which you have put in global.properities file.
..\tomcat\webapps\DataServices\WEB-INF
authentication.default=secWinAD
siteminder.enabled=false
vintela.enabled=true
sso.enabled=true
Uncomment the auth filters and update domain & service account details. Disable the content related to keytab. We need to enable it later
<!-- start filter setting -->
<filter>
<filter-name>authFilter</filter-name>
<filter-class>com.businessobjects.sdk.credential.WrappedResponseAuthFilter</filter-class>
<init-param>
<param-name>idm.realm</param-name>
<param-value>DOMAIN.COM</param-value>
</init-param>
<init-param>
<param-name>idm.princ</param-name>
<param-value>sidadm</param-value>
</init-param>
<!--
<init-param>
<param-name>idm.keytab</param-name>
<param-value>/path/to/keytab</param-value>
</init-param>
-->
<init-param>
<param-name>idm.allowUnsecured</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>idm.allowNTLM</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>idm.logger.name</param-name>
<param-value>simple</param-value>
</init-param>
<init-param>
<param-name>idm.logger.props</param-name>
<param-value>error-log.properties</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>authFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- End filter setting -->
Verify the vintela filter has loaded successfully
Stop Tomcat
Delete or backup the logs in below folders
..\tomcat\logs
C:\SBOPWebapp_CMC_10.66.94.147_8080
Remove the folder ..\tomcat\work\Catalina\localhost\DataServices
Restart Tomcat
Open the sdterr.log file in tomcat\logs and look for lines
INFO: Server startup in ###### ms
jcsi.kerberos: ** credentials obtained .. **.
Testing AD Single Sign On
Note: Do not test SSO on Tomcat server, so you should check on different server. When we hit the URL on browser it should automatically make you login without user/password since we logged into the server where we are testing with domain user.
Testing AD Single Sign On for InfoSteward
http://host:8080/BOE/InfoSteward
Testing AD Single Sign On for DS Designer
Login to IS/DS server with your id and start DS Designer
Open DS Designer
System - host[:port]: host:6400
User name: Blank
Password: Blank
Authentication: Windows AD
Log on
Select the repository and click OK
You should login to that repository.
Note: You should have access to that repository on DB level.
Testing AD Single Sign On for DS Management Console
http://host:8080/DataServices
You should be able to login to DS console with your domain without prompting for user/password
Section 8 – Encrypting your service account password with a keytab
An alternative to hard-coding the service account‘s password in the java options we can encrypt the password in a keytab file.
We need to run the below command on AD server.
ktpass -out bosso.keytab -princ <BI Service Account> -pass
<password> -kvno 255 -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT
Once you receive the file you need to perform the below steps
Copy the bosso.keytab to the C:\Windows\ directory of the IS/DS application server
Add the following line to ..\tomcat\webapps\BOE\WEB-INF\config\custom\global.properties
idm.keytab=C:/WINDOWS/bosso.keytab (note the FORWARD slashes)
Remove the wedgetail.passwords option from the application server‘s Tomcat java options.
Add the following lines to ..\tomcat\webapps\DataServices\WEB-INF\web.xml
<init-param>
<param-name>idm.keytab</param-name>
<param-value>C:/WINDOWS/bosso.keytab</param-value>
</init-param>
Restart Tomcat and ensure you still see jcsi.kerberos: ** credentials obtained.. **. in the application server logs per the directions in the section above titled Verify the vintela filter has loaded successfully.
Test again SSO for IS, DS.
See KBA 1359035 to test the keytab separately if SSO stops working after these changes.
Disable debug mode in Tomcat java properites
Section 9 – Additional information and settings
Ensure your .properties files are not overwritten after a patch or redeploy
1. Copy the BIlaunchpad.properties, global.properties and ICCExplorer.properties files from:
SAPBusinessObjects\tomcat\webapps\BOE\WEB-INF\config\custom
2. Paste the .properties files in the folder below:
SAPBusinessObjects\SAP BusinessObjects Enterprise XI 4.0\warfiles\webapps\BOE\WEB-INF\config\custom
3. Copy the web.xml file from
SAPBusinessObjects\tomcat\webapps\DataServices\WEB-INF
To
SAPBusinessObjects\SAP BusinessObjects Enterprise XI 4.0\warfiles\webapps\DataServices\WEB-INF
Take the backup of existing file before copying it.
End of the Article
You can post your questions or comments here, so that I can clarify.
against all the company like:
, but got stuck with NW as the web application server.
