Week 3 Unit 1: Authentication and Single Sign On (SSO)

Transcription

1 Week 3 Unit 1: Authentication and Single Sign On (SSO)

2 Authentication and Authorization Authentication vs. Authorization Is this a valid user? Does the user have rights to the application or content? Groups STS/SNC Central Management Server Roles Groups 2013 SAP AG. All rights reserved. Public 2

3 Web Tier Authentication The following major logon methods are supported, with various methods of SSO: Windows AD SSO achieved via Kerberos, using the Quest Vintela plug-in Web application server can run on any platform; however, the Central Management Server MUST be on a Windows or Linux (as of 4.0 SP05) system LDAP SSO is supported with integration through CA SiteMinder SAP SSO achieved through consumption of SAP SSO tickets Enterprise Native BI authentication model. SSO can be achieved through Trusted Authentication 2013 SAP AG. All rights reserved. Public 3

4 Details on Active Directory SSO with Kerberos Active Directory SSO with Kerberos allows for end-to-end Single Sign-On to the database Scheduling a report will not carry forward the Kerberos ticket even with Schedule Now It is not possible to set up AD SSO with Kerberos for scheduling Interactive refresh enables SSO A detailed walkthrough can be found on Service Marketplace: / SAP AG. All rights reserved. Public 4

5 Details on LDAP SSO LDAP Single Sign-On is enabled using SiteMinder SiteMinder is an access management application delivered by CA Technologies Integrates with virtually any LDAP server, as well as Active Directory LDAP SSO is for front door entry only and cannot be used to achieve SSO to the database SSO to the database can be achieved using secondary credentials or by mixing with SAP SSO methods for data access 2013 SAP AG. All rights reserved. Public 5

6 Web Services SSO Setting up Web services SSO for Windows Active Directory is required to enable SSO for the following clients: LiveOffice Query as a Web Service BI Widgets Crystal Reports for Enterprise Dashboard Designer Setup is similar to configuring the BI launch pad, see SAP Note SAP AG. All rights reserved. Public 6

7 Trusted Authentication BI trusts the underlying application server to perform the authentication The Application Server passes a shared secret and user ID to BI to facilitate SSO No user password is passed to BI Enables most other authentication methods such as X.509, SAML, SecureID, etc. None of the desktop client tools support Trusted Authentication 2013 SAP AG. All rights reserved. Public 7

8 Configuring Trusted Authentication There are a number of ways to pass user information in trusted authentication Web Session HTTP Header User Principal (new method using JAAS authentication) Remote User (new method using JAAS authentication) Cookies and Query String not recommended, supported for legacy purposes It is possible to bind a different incoming user ID to an existing user in the BI system using trusted.auth.user.namespace.enabled Requires the user to manually log on the first time and binds the assertion user ID with the BI account the user logs on with Remember, you are trusting the application server, so you must secure the Web Application 2013 SAP AG. All rights reserved. Public 8

9 Dimensional Semantic Layer (DSL) Connectivity Kerberos SSO MS SQL Server Oracle DB SAP HANA Security Token Service (STS) SAP NetWeaver BW Applicable to the following clients: Crystal Reports for Enterprise Web Intelligence Dashboards Explorer Analysis OLAP 2013 SAP AG. All rights reserved. Public 9

10 Legacy Semantic Layer (.unv) Kerberos SSO MS SQL Server Oracle DB Server SNC SAP NetWeaver BW Stored user credentials All other databases Applicable to the following clients: Crystal Reports 2011 Web Intelligence 2013 SAP AG. All rights reserved. Public 10

11 Propagating User Attributes Leverage metadata from user directories like region, department, or time zone, and apply via universe security Personalize report data with flexible user attributes Full overview on SCN unity/biplatform/blog/2012/07/05/ user-attribute-mappingin-bi SAP AG. All rights reserved. Public 11

12 Mobile SSO Mobile currently uses username and password only The username and password can be saved locally on the device This option can be disabled by administrators if desired Mobile SSO remains in the roadmap for a future release 2013 SAP AG. All rights reserved. Public 12

13 SAP HANA: Kerberos SSO BI on Windows Configure AD SSO with Kerberos or manually log on using AD credentials No scheduling SSO BI on Linux Configure LDAP connectivity to Active Directory Enable Kerberos from the LDAP authentication plug-in Manually log on, then SSO to HANA becomes possible 2013 SAP AG. All rights reserved. Public 13

14 SAP HANA: Secondary Credentials Save database credentials to use for SSO using the SAP HANA native authentication Minimal configuration for BI Credentials can automatically be captured when the user manually logs on to BI launch pad Cannot use with SSO to BI Launch Pad as password will be blank 2013 SAP AG. All rights reserved. Public 14

15 SAP HANA: HANA Authentication Accessible under CMC > Applications Establishes BI as a trusted authentication source for HANA Less work to configure than Kerberos Supported with all BI clients except Design Studio and Analysis Office Works with any type of authentication to BI Enterprise, AD, LDAP, SAP, etc. Supports all platforms 2013 SAP AG. All rights reserved. Public 15

16 Thank you Contact information:

17 2013 SAP AG. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries. Please see for additional trademark information and notices SAP AG. All rights reserved. Public 17

18 Week 3 Unit 2: Best Practices for Troubleshooting

20 SAP BusinessObjects BI 4.0 Platform Monitoring Overview Monitoring is a new BI 4.0 application embedded into the Central Management Console Provides a dashboard showing an overview of SAP Business Objects deployment Records the metrics surfaced by the different BI 4.0 servers Captures historic trends and provide a graphical visualization component Provides Threshold notifications Delivers default watches for all the servers Integrates with SAP Solution Manager through CA Wily Introscope 2013 SAP AG. All rights reserved. Public 3

21 Examples of Typical Monitoring Uses 1. Understand overall system health and server deployment metrics: Dashboard with health status of each server in the deployment Understand the key deployment level metrics and how they are performing 2. Monitor the system health and understand root cause of problems Can provide an alert in case of problems Perform root cause analysis using the corresponding Watch (which triggered the alert) 3. Monitor system performance With the help of probes, configure the system to provide alerts in the case of performance issues 2013 SAP AG. All rights reserved. Public 4

22 Main Concepts of the BI4.0 Platform Monitoring Metric a system of related measures that facilitates the quantification of some particular characteristic Probe a utility to check the availability of SAP Business Objects BI4.0 services by simulating workflows Watch an abstraction of a part of the BI Landscape, providing realtime statuses and historical trends of servers and workflows within the SAP Business Objects Enterprise environment Alert a notification generated by the monitoring application, when a user-defined threshold value set for different metrics applied to a watch is breached 2013 SAP AG. All rights reserved. Public 5

23 BI4.0 CMC Integration Monitoring Dashboard Provides an overview of the entire BIPlatform landscape The KPIs show the deployment level metrics It shows all the watches along with state The graph shows the state of watch selected Alert no. in brackets shows unread, unconfirmed alerts only. On click, user navigates to Alert Inbox (filtered by alerts for that watch) to view all alerts for that watch SAP AG. All rights reserved. Public 6

24 BI4.0 CMC Integration Server Health The server status is determined by its associated watch. Watches provide real-time statuses of servers and workflows within the SAP Business Objects environment. The traffic light is associated with each watch to indicate the watch state. Click the server health icon to show watch details. Click to go see watch details 2013 SAP AG. All rights reserved. Public 7

25 Third-Party Integration Integration with IBM Tivoli via Tivoli Enterprise monitoring agent Integration with SAP Solution Manager (incl. CA Wily Introscope) Open JMX framework allows simple integration with other ESM vendor tools Provides SDK for writing new probes 2013 SAP AG. All rights reserved. Public 8

27 Managing and Configuring Logs What It Is? System-level messages generated by BI platform servers are traced and written to log files. Traces are recordings of events that occur during the operation of a monitored component. The traced events range from severe exception errors on one end to simple status messages at the other. Typical Uses These log files are used by system administrators to monitor performance or for debugging purposes SAP AG. All rights reserved. Public 10

28 Managing and Configuring Logs Overview Logging Components SAP BI40 Processing servers logging SAP BI40 Web application logging SAP BI40 Client tools Trace Log Generic log file (.glf) extension System-level messages generated by BI platform Trace Log Levels Unspecified (tracing specified trough.ini) None (logging rare critical events) Low Medium High 2013 SAP AG. All rights reserved. Public 11

29 Managing and Configuring Logs Overview Configuring tracing for processing servers "TraceLog Service" for a specific server or a group in CMC Manually with the BO_trace.ini file C:\Program Files (x86)\sap BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\conf Configuring tracing for web applications "Trace Log" application settings in CMC The location for logs is in the user home folder Manually with the BO_trace.ini file C:\Program Files (x86)\sap BusinessObjects\Tomcat6\webapps\BOE\WEB-INF\TraceLog Configuring tracing for BI40 client tools Manually with the BO_trace.ini file Create environment variables (BO_TRACE_LOGDIR, BO_TRACE_CONFIGFILE) Configuring tracing for the Upgrade Management Tool Manually with the BO_trace.ini file (same as processing servers) 2013 SAP AG. All rights reserved. Public 12

31 HTTP Tracing Useful for determining What content (css, js, etc.) is being sent to the client (browser) How much data is coming from the database (CMS) If the content is being cached or not If the content has been compressed or not Where the slowness in loading pages may reside How a specific page is constructed 2013 SAP AG. All rights reserved. Public 14

32 Fiddler: Fiddler shows you the size of the request. If the page is cached or has an expires tag: Allows you to find the parent and child requests so you can calculate how long it took to load a page: 2013 SAP AG. All rights reserved. Public 15

33 Fiddler Adding the size of each request body gives you the total amount of data being sent to the client (browser), and taking the time from the first request until the last request will tell you how long it took to load the page SAP AG. All rights reserved. Public 16

37 Wireshark The Follow TCP Stream option allows you to easily get all the relevant packets together to determine where the problem may be: Change the time display format to let Wireshark calculate how much time the packet took: 2013 SAP AG. All rights reserved. Public 20

38 Wireshark Mark the first packet as the reference packet: Wireshark will now show you a listing of all the relevant packets and how much time each one took: Also, consider HTTPWatch: SAP AG. All rights reserved. Public 21

39 OS Monitoring Useful for determining How and what resources (CPU, memory, etc.) are being consumed What files and libraries are being referenced and loaded 2013 SAP AG. All rights reserved. Public 22

40 Process Monitor SysInternals Tool Includes RegMon and FileMon Lets you determine what files, registry keys, and libraries are being used or referenced: Allows you to easily exclude non-relevant processes: Tip: Hit Jump To to browse to the folder location: 2013 SAP AG. All rights reserved. Public 23

41 Process Explorer Useful to determine what command line options a specific process is running with Useful to determine which threads are consuming the most CPU 2013 SAP AG. All rights reserved. Public 24

43 Perfmon One of the least used tools, but one of the best for diagnosing performance issues Works on the principle of setting counters for what you want to monitor Tip: Put the log into Excel and create a chart 2013 SAP AG. All rights reserved. Public 26

46 What To Do When performance, hang, high memory, high CPU issue Collect the required data What is the actual issue? A hang is not the same as a crash Time the issue occurred Process IDs of all affected processes CPU/Memory data (i.e.: task manager, perfmon, etc) Logs (captured when the issue is occurring) Is the issue repeatable? If so, capture the detailed workflow HTTP/Network traces if applicable Take a memory dump (C++ or Java thread dump) If you have a core dump, run a backtrace 2013 SAP AG. All rights reserved. Public 29

49 Week 3 Unit 3: Troubleshooting Clients with Fiddler

50 Troubleshooting Clients with Fiddler Collect HTTP traffic between client and server Demo of how to use Fiddler to compare response times between XI 3.1 and BI 4.x Capture a regression in Web Intelligence drill filters Expedite delivery of a fix using the collected output 2013 SAP AG. All rights reserved. Public 2

53 Week 3 Unit 4: Troubleshooting BI Platform with Wireshark

54 Troubleshooting BI Platform with Wireshark Capture all network traffic with Wireshark Demo of how to use Wireshark to monitor the Kerberos protocol between Application Server and KDC Fundamental for resolving problems that occur in the network stack 2013 SAP AG. All rights reserved. Public 2

57 Week 3 Unit 5: Troubleshooting with BW Transaction

58 BW Workflows on the BI Platform Don t underestimate the importance of splitting APS to isolate MDAS, DSL, and DF workflows. Note How to enable SAPJCO trace on Adaptive Processing Server in Business Intelligence 4.x 2013 SAP AG. All rights reserved. Public 2

62 Performance Analysis Using Transaction /nst05 Types of traces include: RFC, SQL, and HTTP. Use SQL trace to validate the effectiveness of RSRT settings, by checking modifications to SQL statements (i.e. flag selection of structure elements ) 2013 SAP AG. All rights reserved. Public 6

63 Validating MDX Expressions Using Transaction /nmdxtest BI 4.0: How to enable MDA tracing for OLAP-based universes See video: How to Retrieve and Use MDX Statements from MDA Logs Copy/paste the Select statement into MDXTEST select Run mode Check the output in the list viewer to ensure accuracy of data / columns / runtime / stability possible correction Notes SAP AG. All rights reserved. Public 7

64 Gathering Runtime Statistics in BW: Using Transactions RSDDSTAT, and SE16 Table: RSDDSTAT_OLAP Table RSDDSTAT_OLAP Filter By EventID Gather runtimes Filter! (User/Date) Overview of EventIDs: 488a1aa03115e a1553f7/content.htm 2013 SAP AG. All rights reserved. Public 8

65 Gathering Runtime Statistics in BW Using Transaction /nstad Click RFC to see the statistical record Filter by User Choose view Restrict time Double-click RFC row with long Response time Click Calls to see the single BAPI usage (e.g. BAPI_MDDATASET_GET_AXIS_DATA) Check size of dataset sent SAP AG. All rights reserved. Public 9

66 Workload Monitor Using Transaction /nst03n An overview cockpit for gathering up runtime statistics at a global (instance) level. Can be navigated using predefined selections/views Integrated functions allow drilling down into details and into individual stat levels (as per /nstad) 2013 SAP AG. All rights reserved. Public 10

67 BW Analysis Using Transaction /ndb02 A neat way to interpret cube content & table storage on the host. Can quickly focus on objects that have worrying metrics (facts, compression..) 2013 SAP AG. All rights reserved. Public 11

72 Week 3 Unit 6: Performance Testing with JMeter

73 Performance Testing Value Proposition Users are happier with applications that perform well Effective use of server resources results in lower total cost of ownership Increased Customer Satisfaction Lower TCO Performance Testing Improved ROI Drive additional consumption and wide-spread usage based on confidence in platform response Expanded Usage Business use is more effective, resulting in increased returns on the investment As business applications become more complex, it is imperative to consider the impact performance has on our end users. By testing and tuning performance-related aspects, such as response time and throughput, we enable a number of benefits SAP AG. All rights reserved. Public 2

74 Performance Testing The Dream Wiki content explaining how to correlate dynamic data for WebI, Crystal, Dashboards, etc. SAP Enablement for core BI Clients Better SAP BI for Everyone Large or Small, performance testing for all Ecosystem collaboration Customers and Partners contribute use cases and experiences 2013 SAP AG. All rights reserved. Public 3

76 Apache JMeter An Overview Apache JMeter is open source software, a 100% pure Java desktop application designed to load test functional behavior and measure performance. May be used to test performance both on static and dynamic resources (Files, Servlets, Perl scripts, Java Objects, Databases and Queries, FTP Servers, and more). Can be used to simulate heavy load on a server, network, or object to test its strength or to analyze overall performance under different load types. Used to make a graphical analysis of performance or to test your server/script/object behavior under heavy concurrent load SAP AG. All rights reserved. Public 5

77 JMeter Capabilities Can load and performance test many different server types: Web - HTTP, HTTPS SOAP Database via JDBC LDAP JMS Highly Extensible: Full multithreading framework allows concurrent sampling by many threads and simultaneous sampling of different functions by separate thread groups. Data analysis and visualization plugins allow great extensibility as well as personalization. Functions can be used to provide dynamic input to a test or provide data manipulation SAP AG. All rights reserved. Public 6