Configuring Single Sign-on for SAP HANA

Transcription

1 Configuring Single Sign-on for SAP HANA Applies to: SAP BusinessObjects Business Intelligence platform 4.0 Feature Pack 3. For more information, visit the Business Objects homepage. Summary This document aims to describe the process for configuring single sign-on to HANA database through JDBC for BI Client Tools. Author: Frederic MOITEL Company: SAP Created on: 6 February 2012 Author Bio Frederic MOITEL is an Information Developer at SAP Company SAP AG 1

2 Table of Content Overview... 3 Configuring Kerberos and JAAS... 3 Kerberos configuration... 3 JAAS configuration... 3 Configuring the BI platform Client Tools... 4 Configuring the information design tool for local connections... 4 Configuring the information design tool for connections stored on the CMS... 4 Configuring Web Intelligence Rich Client... 5 Configuring Web Intelligence Rich Client in HTTP mode... 5 Configuring SAP BusinessObjects Web Intelligence... 5 Troubleshooting single sign-on configuration... 6 Invalid keytab... 6 Missing LoginModule in the bsclogin.conf file... 6 Cannot connect to the CMC... 6 Related Content... 7 Copyright SAP AG 2

3 Overview The SAP BusinessObjects Business Intelligence platform provides single sign-on to database for connections to SAP HANA 1.0 SP3 through JDBC. The single sign-on to database functionality uses Windows AD with Kerberos in Java. Users log in to the BI platform from an SAP BusinessObjects application by using their Windows AD credentials. For more information about Windows AD authentication, see the SAP BusinessObjects BI platform Administrator Guide. Configuring Kerberos and JAAS The process of configuring Kerberos and JAAS involves these steps: creating the Kerberos configuration file creating the JAAS login configuration file Kerberos configuration The Krb5.ini Kerberos configuration file must specify the Kerberos realm and key distribution center information. An example is below: [domain_realm].2k8addomain.com = 2K8ADDOMAIN.COM 2k8addomain.com = 2K8ADDOMAIN.COM [libdefaults] default_realm = 2K8ADDOMAIN.COM dns_lookup_kdc = true dns_lookup_realm = true forwardable = true default_tkt_enctypes = RC4-HMAC default_tgs_enctypes = RC4-HMAC [realms] 2K8ADDOMAIN.COM = { admin_server = VMDOMCONTLR kdc = VMDOMCONTLR kpasswd_server = VMDOMCONTLR default_domain = 2k8addomain.com } JAAS configuration The bsclogin.conf JAAS configuration file must reference the service principal that is defined in the CMS and the keytab file. An example is below: com.businessobjects.security.jgss.initiate { com.sun.security.auth.module.krb5loginmodule required debug=true; }; com.businessobjects.security.jgss.accept { com.sun.security.auth.module.krb5loginmodule required storekey=true keytab="c:/windows/vmboecons.keytab" donotprompt=true usekeytab=true realm="2k8addomain.com" principal="boexi40siavmboecons/cons.2k8addomain.com" 2012 SAP AG 3

4 debug=true; }; Configuring the BI platform Client Tools You must configure the BI platform Client Tools to point to the Kerberos and JAAS configuration files. The next sections focus on the following applications: the information design tool Web Intelligence Rich Client Java or HTML interface of SAP BusinessObjects Web Intelligence Configuring the information design tool for local connections 1. Exit from the information design tool. 2. Open the InformationDesignTool.ini file for editing. It is located at the <bip-installdir>\win32_x86 directory. 3. Add the following lines to the file: -Djava.security.auth.login.config=C:\<location>\bscLogin.conf -Djava.security.krb5.conf=C:\<location>\Krb5.ini where <location> is the configuration file directory on the machine where the Connection Server is running. 4. Save the file. 5. Restart the information design tool. Configuring the information design tool for connections stored on the CMS The objective is to configure the Adaptive Connectivity Service, which allows the information design tool to access Java-based data sources remotely. Important: This procedure allows you to configure single sign-on for all other Java services hosted by the Adaptive Processing Server, such as the Data Federation services. You use Data Federation services when querying on a multisource-enabled universe built on an SAP HANA connection. 1. Open the CMC. 2. Under Connectivity Services, stop the Adaptive Connectivity Service hosted by the Adaptive Processing Server. 3. Go to the Properties page. 4. Add the following options to the Command Line Parameters property: -Djava.security.auth.login.config=C:\<location>\bscLogin.conf -Djava.security.krb5.conf=C:\<location>\Krb5.ini 2012 SAP AG 4

5 5. Click Save. 6. Restart the service. Configuring Web Intelligence Rich Client The following procedure applies to the Web Intelligence Rich Client application that a user logs in to through the Windows Start menu or by double-clicking a WID document, independently of its connection mode (Connected, Offline, and Standalone). 1. Close your document and exit from Web Intelligence Rich Client. 2. Create the following environment variables in your system: o o java.security.auth.login.config=c:\<location>\bsclogin.conf java.security.krb5.conf=c:\<location>\krb5.ini 3. Restart Web Intelligence Rich Client. Configuring Web Intelligence Rich Client in HTTP mode The following procedure applies to the Web Intelligence Rich Client application in Connected mode that a user launches from the BI launch pad. You need to configure the Adaptive Connectivity Service to enable single sign-on with Web Intelligence Rich Client. See Configuring the information design tool for connections stored on the CMS. Configuring SAP BusinessObjects Web Intelligence The following procedure applies to the Java or HTML interface of SAP BusinessObjects Web Intelligence that a user launches from the BI launch pad. The objective is to configure Web Intelligence reporting services hosted by the Web Intelligence Processing Server. 4. Open the CMC. 5. Under Web Intelligence Services, stop the reporting service hosted by the Web Intelligence Processing Server SAP AG 5

6 6. Open the cs.cfg file for editing. It is located at the <bip-installdir>\dataaccess\connectionserver directory. 7. In the JavaVM section of the file, add the following Java VM options: <Options> <Option>-Djava.security.auth.login.config=C:\<location>\bscLogin.conf</Option> <Option>-Djava.security.krb5.conf=C:\<location>\Krb5.ini</Option> <Options> 8. Save the file. 9. Restart the service from the CMC. Troubleshooting single sign-on configuration Following are some exceptions you may encounter when configuring single sign-on to database. Invalid keytab Mechanism level: Specified version of key is not available (44)) Failure unspecified at GSS-API level (Mechanism level: Specified version of key is not available (44) This exception means the keytab file has not been generated correctly. Only the file generated with kvno option equal to 0 is accepted. Run a ktpass command to create the keytab file, for example: ktpass -out -mapuser sbo.servicedomain.com -pass password -kvno 0 -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT Missing LoginModule in the bsclogin.conf file No LoginModules configured for com.businessobjects.security.jgss.accept This exception means the LoginModule of single sign-on to database is missing. See the JAAS configuration file for information. Cannot connect to the CMC If you cannot connect to the CMC, verify that you have specified the following property in the com.businessobjects.security.jgss.initiate LoginModule: useticketcache=true This property is used to cache the generated logon ticket SAP AG 6

7 Related Content SAP BusinessObjects BI platform Administrator Guide SAP BusinessObjects Web Intelligence Rich Client User Guide Data Access Guide For more information, visit the Business Objects homepage SAP AG 7

8 Copyright Copyright 2012 SAP AG. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. Microsoft, Windows, Excel, Outlook, and PowerPoint are registered trademarks of Microsoft Corporation. IBM, DB2, DB2 Universal Database, System i, System i5, System p, System p5, System x, System z, System z10, System z9, z10, z9, iseries, pseries, xseries, zseries, eserver, z/vm, z/os, i5/os, S/390, OS/390, OS/400, AS/400, S/390 Parallel Enterprise Server, PowerVM, Power Architecture, POWER6+, POWER6, POWER5+, POWER5, POWER, OpenPower, PowerPC, BatchPipes, BladeCenter, System Storage, GPFS, HACMP, RETAIN, DB2 Connect, RACF, Redbooks, OS/2, Parallel Sysplex, MVS/ESA, AIX, Intelligent Miner, WebSphere, Netfinity, Tivoli and Informix are trademarks or registered trademarks of IBM Corporation. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries. Adobe, the Adobe logo, Acrobat, PostScript, and Reader are either trademarks or registered trademarks of Adobe Systems Incorporated in the United States and/or other countries. Oracle is a registered trademark of Oracle Corporation. UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group. Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of Citrix Systems, Inc. HTML, XML, XHTML and W3C are trademarks or registered trademarks of W3C, World Wide Web Consortium, Massachusetts Institute of Technology. Java is a registered trademark of Oracle Corporation. JavaScript is a registered trademark of Oracle Corporation, used under license for technology invented and implemented by Netscape. SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP Business ByDesign, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries. Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius, and other Business Objects products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Business Objects S.A. in the United States and in other countries. Business Objects is an SAP company. All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. National product specifications may vary. These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty SAP AG 8