Server Side Trust and Webi Report Scheduling via Portal

Hello,
I have opened a similar thread about Server Side Trust and webintelligence reporting through the portal a few months ago.
At the time, we had some complaints about users that were getting SSO errors after 8 hours when scheduling WeBi Report through the SAP Portal.
Basically, the users connect to the Portal and then FROM the Portal, to a BOI view pointing to the Infoview.
Then, after investigatinon, it was my understanding that the WebI Reports should be scheduled through an Infoview token and not a portal token. In concrete terms Server Side Trust had to be implemented between the SAP BW Backend and the BOE 3.1 Server.
And after that the users who wanted to schedule WebI reports should connect to the Infoview directly (using their SAP BW credentials) to generate an Infoview Token.
Scheduling Webi reports from the Portal will not be solved by implementing Server Side Trust, since it is only a matter of time before the the Portal token expires ( 8 hour by default).
Now, I have configured the server side Trust between our BOE 3.1 SP2 and our BW 701 system, SNC configuration, PSE generation, exchange of certificats , etc ...
I did some scheduling tests connecting directly to the BO Infoview and it works.
But of course, now I am being told by the users that this solution is not acceptable.
The Portal being the entry point of our Infrastructure, they don't want to connect to the Infoview to schedule their reports.
So I opened a SAP customer call to try to have an official and clear statement from SAP but I never obtained it.
I had a look at my SAP BO courses but I am still confused
For example according to SAP BO100 , server side trust should be implemented when ;
"BOE client session authenticated using Single sign on using SAP token
(Enterprise Portal) and SAP reports are being scheduled at a future point in
time (after token expiry date)."
Anyone can help me to clear my mind ?
Thank you
Best Regards

Hi,
first of all lets separate the UI portion from the technical portion.
on the technical side:
yes for scheduling the Web Intelligence document you will need Server side trust
on the UI side:
- scheduling is part of InfoView
- scheduling is part of the KM integration with the portal
if that is not accepted from a UI point of view from the user you can create your own application to schedule documents using the SDK.
ingo

Similar Messages

Scheduling web intelligence reports from SAP EP Portal : Server Side Trust

Hello,
We have set-up SSO between SAP EP 701, SAP BI 701 and Business Object XI 3.1 to allow users to access reports without having to sign-on again as explained here :
/people/ingo.hilgefort/blog/2008/09/19/businessobjects-and-sap--configure-sap-authentication
But, we have recently been contacted by some users because when scheduling Webi Report from a link within the portal they have the following errors :
u201CA database error occured. The database error text is: Unable to connect to SAP BW server System received an expired SSO ticket. (WIS 10901) u201D
The user told us that he doesn't encounter the error when :
Login in directly to the BO Infoview (without SSO from the SAP Enterprise Portal.)
The first Webi scheduling is succesful from the portal (I suppose because the portal token is still valid)
I understand that we also have to configure the Server Side Trust between BO Enterprise server and the SAP BI7 backend as explained here , but I do not really understand its purpose
https://websmp106.sap-ag.de/~sapidb/011000358700001646962008E/XI3-1_BIP_SAP_INSTALL_EN.pdf
I've found a similar discussions here ;
Issue with SAP Single Sign-On and Scheduling Reports
I still have some questions :
If we configure the Server Side Trust between BO Enterprise server and the SAP BI7 backend .
The Portal Logon ticket will remain an issue at some point of time , does it mean tha the WeBi report job sheduling should not be perfromed from the SAP EP Portal ?
We haven't configured the Server Side Trust , yet the users told us that they are able to schedule webi report directly from the BO Infoview ? How is it posible ?
Thank you in advance for your help.
Regards.

Thank you Mr Hilgefort for your detailled explanations.
I now have to provide some explanations to my managers, and to be honest , there are still some points that
are unclear to me, and it would be extremely helpful if could confirm (or not) the follwoing points.
When scheduing Webi report from the sap portal, we're getting SSO errors.
SAP provide the follwoing note explaining how to extend the validity of the J2EE token (Portal token), but this is not a long term solution, at certain point of time the ticket will expire. Webi shceduling should not be perfromed from the Portal.
Sap note 1352127 - Scheduled Webi report fails with: A database error occurred. The database error text is: Unable to connect to SAP BW server System received an expired SSO ticket
Webi Scheduling should be performed from BO Infoview. SNC should be configured between BO server and SAP BI7.0 backend.
We should Configure Server SNC as explained in the BusinessObjects XI Integration for SAP Solutions Installation and Administration Guide at Chapter "Configuring SAP for server-side trust". (1341043)
The SAP Portal is not involved here and is not an option even with the configuration of SNC/Server side trust.
thank you for your patience.
Best Regards.

Scheduling Webi reports from SAP Portal.

is there a way to schedule webi reports from the SAP enterpirse portal.
Toor.

Hello Ingo,
We also need to implement the server side trust configuration.
I'm searching the document you are refering to but couldn't find it :
I only found the fowllowing documents which doesn't discuss the server side trust
BusinessObjects XI Integration Kit for SAP Installation Guide
BusinessObjects XI Integration for SAP Solutions User's Guide
Business Objects XI Integration Kit for SAP Release Notes
I didn't found it there http://help.sap.com/businessobject/product_guides/boexi/en/boxi_DocMap_en.pdf
Could you provide me the direct link please ?
Thank you !
Edited by: Raoul Shiro on Apr 1, 2011 10:05 AM

Server Side Trust - Server Group

Hi,
One of the steps to create publications / server side trust (as per SAP Press BO and BW Integ book) is to create a Server Group and add certain services to it. It says that the Destination and Publication Job Server should be added. I dont have them - will that be a problem?
Thanks

Hi,
They dont seem to exist so I am guessing I will have to create them myself?
Could you or someone please confirm that the following selections should be made when creating the servers:
DESTINATION JOB SERVER - Service Category: Core Services, Service: Destination Delivery Scheduling Service
PUBLICATION JOB SERVER - Service Category: Core Services, Service: Publication Scheduling Service
Also, do I need to include any of the additional services when creating the servers?
Many Thanks
Edited by: Leo on Apr 20, 2011 10:03 AM

How can I capture Webi server name in a webi report after refresh.

Hi Experts.
My BOE clustered with two or more webi server, I want to capture the webi server name in the webi report after I refreshed this report. Is there any standard webi funtion I can use to show the server name or any variable in the universe I can use?

Hi Bruce,
May the following links lead you to the solution......
[http://www.forumtopics.com/busobj/viewtopic.php?p=403480&sid=6cd088cfbf8cbffd78c17e0cbf280572|http://www.forumtopics.com/busobj/viewtopic.php?p=403480&sid=6cd088cfbf8cbffd78c17e0cbf280572]
[http://www.forumtopics.com/busobj/viewtopic.php?p=601777&sid=d6123b363d6af6b3cf0aaa6cef6eb86b]
Regards,
ArunKG

Server-side Trust with CryptoLib &/or 3rd party tool

I have a new installtion:
> BOE XI 3.1 SP2 (Solaris)
> SAP Integration Kit
Intend to enable server-side trust / SNC betw BOE and BW.
Separately, BASIS just installed/config'd new standard tool (Quest's Vintela) on BW for SSO from SAP GUI clients to BW. I notice some parms (such as snc/gssapi_lib) now are configured to Quest/Vintela libraries on BW.
Possible to have both Vintela and CryptoLib co-exist/co-active on BW? ... or is best approach (even forced / only approach) is to standardize on one? ... likely install Vintela on BOE and use Vintela for BOE-to-BW SNC?
thx, Clay

Hi Clay,
I believe you're right, that they can't co-exist for use as SNC libraries. I really don't have a complete understanding of how this all works, but I believe they can co-exist if the sapcrytolib is used for RFC that is not using SNC. Maybe someone else can confirm, deny, or expand on that?
Even though we (Quest) donu2019t always know the exact configuration options for each application that supports SNC, as a certified SNC interface it should always be possible to get things working in a fully supported manner. If you would like to work with me on this directly I would be happy to help. You can find my e-mail address under my business card.
Thanks!
Kyle

How can I enable java applet plug-in and Web Start applications via terminal?

Since the last Java update to Snow Leopard, I have found that the system periodically disables the Java applet plug-in after a period of disuse. I know I can go to /Applications/Utilities/Java Preferences and just click to re-enable Java. But I want to write a script which will do this periodically for a couple hundred Mac users where I work.
My question is - how can I reenable the Java applet plug-in and web start applications via Terminal command? Is this possible? Is there a plist file that can be modified, etc.?
Bob Reed

It is my understanding that Apple's most recent Java update automatically disables Java after a certain period of time that it hasn't been used. We don't want users to have to keep re-enabling it. So we wanted to find a way to do this via script either run by a Casper JSS server or stored locally on each workstation.   With the guidance provided by Mark Jalbert above and some text from a script written by Rich Trouton, I was able to make a script (with some minor changes) and a launch agent to re-run the script upon login. So the preference is always enabled.
For your reference, the script content is:
#!/bin/sh
# DYNAMICALLY SET THE UUID FOR THE BYHOST FILE NAMING
if [[ `ioreg -rd1 -c IOPlatformExpertDevice | grep -i "UUID" | cut -c27-50` == "00000000-0000-1000-8000-" ]]; then
MAC_UUID=`ioreg -rd1 -c IOPlatformExpertDevice | grep -i "UUID" | cut -c51-62 | awk {'print tolower()'}`
elif [[ `ioreg -rd1 -c IOPlatformExpertDevice | grep -i "UUID" | cut -c27-50` != "00000000-0000-1000-8000-" ]]; then
MAC_UUID=`ioreg -rd1 -c IOPlatformExpertDevice | grep -i "UUID" | cut -c27-62`
fi
# Set the the "Enable applet plug-in and Web Start Applications" setting in the Java Preferences for the current user.
/usr/libexec/PlistBuddy -c "Delete :GeneralByTask:Any:WebComponentsEnabled" /Users/$USER/Library/Preferences/ByHost/com.apple.java.JavaPreferences.${MAC_UU ID}.plist
/usr/libexec/PlistBuddy -c "Add :GeneralByTask:Any:WebComponentsEnabled bool true" /Users/$USER/Library/Preferences/ByHost/com.apple.java.JavaPreferences.${MAC_UU ID}.plist
/usr/libexec/PlistBuddy -c "Delete :GeneralByTask:Any:WebComponentsLastUsed" /Users/$USER/Library/Preferences/ByHost/com.apple.java.JavaPreferences.${MAC_UU ID}.plist
/usr/libexec/PlistBuddy -c "Add :GeneralByTask:Any:WebComponentsLastUsed real $(( $(date "+%s") - 978307200 ))" /Users/$USER/Library/Preferences/ByHost/com.apple.java.JavaPreferences.${MAC_UU ID}.plist
The launch agent plist content is:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
          <key>Disabled</key>
          <false/>
          <key>Label</key>
          <string>org.XXXXX.enableJavaPlugin</string>
          <key>ProgramArguments</key>
          <array>
                    <string>sh</string>
                    <string>/Library/Scripts/XXXXX/enableJava_plugin.sh</string>
          </array>
          <key>RunAtLoad</key>
          <true/>
          <key>StartOnMount</key>
          <true/>
</dict>
</plist>
I hope this is helpful to anyone wishing to keep the Java web plugin enabled.
Bob
Message was edited by: Robert Reed2

Configure SAP for server-side trust

Hi all,
I am installing BusinessObejcts XI integration for SAP Solution. I need configure SAP for server-side trust. I have read BussinessObjects XI Integration for SAP Solution Installation Guide. In chapter 6, It introduce how to configure SAP Server-Side trust. But I don't understand how to configure SAP for server-side trust, specially configure SAP Cryptographic. Would you please to give me more detailed explanation?
Please advise,
Duypm

Hi Duypm,
the SAP server side configuration is part of the Installation Guide Chapter 6. It starts on Page 94.
If you unclear about this and what SNC configuration means for the SAP server make sure you talk to the administrator for the SAP system. You need administrative rights for the SAP system and the system will have to be restarted as outlined in the installation guide
Ingo

SQLNCLI11 - Recordset with Server Side cursor and Property PreserveOnCommit = TRUE

I am migrating an OLEDB application from Microsoft Access to SQL. I am using the SQL Native Client in my connection string
"Provider=SQLNCLI11;Server=%s;Database=%s;Trusted_Connection=yes;"
The application uses the following call to open a table in the database
m_pRecordset->Open((LPCTSTR)m_strQuery, _variant_t((IDispatch*)mpdb, TRUE), adCursorType, adLockOptimistic, options);
where m_strQuery is the table name, adCursorType is adOpenKeyset or adOpenDynamic (I've tried both), options is adCmdTable or adCmdTableDirect (I've tried both)
mpdb is a _ConnectionPtr. Cursor location can be either adUseClient or adUseServer.
If I set Cursor location to adUseClient, the PreserveOnCommit Property of the Recordset is true; if I set Cursor location to adUseServer the PreserveOnCommit property of the Recordset is false. I cannot set this property after the recordset
is open
Is there a way to Open the recorfdset with a server side cursor and PreserveOnCommit TRUE?
Howard P. Weiss

Thanks, Dan, that has been very insightful. We will try to move our legacy VBA data access layer to client-side cursors (first for SQLs with CTEs, then for all SQLs, if everything works out well).
Regarding deprecation: What is the currently recommended way to access SQL Server from VBA projects? I did a bit of research and it appears that all methods I can think of are deprecated in one way or another:
DAO with ODBCDirect: Support has been dropped with Access 2007.
DAO via JET: Using JET SQL syntax instead of T-SQL? Not seriously. Anyway, it's considered obsolete by Microsoft.
ADO with the SQLOLEDB provider: Deprecated.
ADO with the SQL Server Native OLEDB provider: Won't be supported after SQL Sever 2012.
ADO with the Microsoft OLE DB provider for ODBC: Not supported: "SQL Server Native Client is not supported from the Microsoft OLE DB provider for ODBC (MSDASQL)."
What did I miss?
Best regards
Heinzi

SNC server side trust based on kerberos - is it possible ?

Hi all,
We're trying to make this scenario work:
Existing SAP system uses ntlm sso in the sapgui.
We're now in the process of deploying BOE in the company.
We're using sso with winad to infoview which works
We're trying to configure server side trust between SAP and BOE due to requirement of 'multipass burst' functionality
This causes a conflict between sso in the gui and the dll used for setting up SNC server side trust.
I've tried to figure out how to use the kerberos dll gx64krb5.dll on the SAP server to enable both sso solution in gui and server side trust between SAP and BOE, but I cannot generate the SNC PSE in the SAP trust manager.
I've not been able to find threads/info in sap notes on how to set SNC PSE using kerberos dll - is it possible.
Can we have both sapgui sso to SAP and server side trust bewteen SAP and BOE ?
TIA.
Torben

Dear Torben and Ingo,
For your question: "Can we have both sapgui sso to SAP and server side trust bewteen SAP and BOE ?"
Have you done implementing those? Because we already have client SNC (between SAP GUI and SAP BW) using Kerberos SSP (since SAP Crypto can only be used for Server SNC).
And now we're going to implement server SNC (between SAP BW and BOE) using SAP Crypto.
Is it possible to have these 2 together? Because some of the settings in RZ10 will overlap between the two like below. And if we continue with server side trust between SAP BW and BOE, settings for Client SNC will need to be overwritten and it will stop working.
1. RZ10 setting
Kerberos SSP (between SAP GUI and SAP BW)
snc/gssapi_lib = D:\usr\sap\gx64krb5.dll
snc/identity/as = p:SAPServiceSID(at)myorgunit.myorg.mycountry
SAP Crypto (between SAP BW and BOE)
snc/gssapi_lib = $(DIR_INSTANCE)\exe\sapcrypto.dll
snc/identity/as = p: CN: mybwserver, OU: myorgunit, O: myorg, C: mycountry
2.
And also with client SNC using Kerberos SSP we need to tag each user in SU01 with SNC name, whereas this is not needed for server SNC. If i leave this SNC name on each BW user, will that make my server SNC between BW and BOE not working?
3.
Overlap in location of file named "ticket" between SAP
Crypto and Kerberos SSP, which is to be copied to the same location
below:
<DRIVE>:\usr\sap\<SID>\<instance>\sec\ directory (on
Windows).
4.
Overlap in environment variable named SECUDIR that points to the
directory where the ticket resides.
Is there any documentations that explain how to get these 2 SSO to run together?
Thank you very much.
Kind regards,
aswin
Edited by: Aswin Setyawan Margono on Jan 5, 2011 7:15 AM
Edited by: Aswin Setyawan Margono on Jan 5, 2011 7:18 AM

Company code restriction for dashboard and webi reports in BOBJ

Hi Friends,
We have a requirment where we need to restrict user on company code level in bobj.
we have some dashborads and webi reports which need to be restricted at company code level, hence i have created a role in BI and restricted the queries (bex queries) on company code level and same role and user i have imported in BOBJ.
Now i can see the role and user in BOBJ and also i can login to BILAUNCH PAD with authentication as SAP But unable to run the webi reports and dashboard hence i have added those reports to this user in bobj and now i can run the reports, but restriction is not working.
In BI I am able to restrict user but in bobj its not restricting. kindly let me know if i am missing anything?
We are having BO 4.0 SP6.
Thanks
Basis

Hi Saurabh,
In BI its wokring perfectly fine.
I can run the query for specific company code and data is being populated as the respective compay code.
I have also configure SSO between BI & BO using below link
http://wiki.scn.sap.com/wiki/display/BOBJ/How+to+setup+SSO+against+SAP+BW+with+SAP+BO+BI4.0+Common+Semantic+Layer+%28UNX%29+or+BICS
but when i am trying to create a olap connection in IDT with SSO connection test is getting failed with belwo error.
com.businessobjects.mds.olap.OlapException: [Internal] SSO token or User password is empty.
I checked STS is already there in APS .
Thanks
Basis

Document integration for Bex reports and web reports

Hi,
I would like to attach few documentaion (like business usage of the report) for all existing reports in BW system. We are delivering all reports through Bex reports and Web reports.
Report user should be able to see attached documentation through "Document" property in Web report.
I have followed this way but not able to get on-line documentation for queries.
1. RSA1--> Documents >Meta Data> selected Object type ELEM> Import document> attached word document.
2. I enabled Documents property in Query designer.
3. When I executed this query in Bex, I could see document symbol for all characteristics & Key figures in all cell (in default view)
4. The same result with Web report (all cells are having document symbol).
But I dont want to display documents in defaul view, if any user wanted to have doucment info, then should click on "document" tab and should be able to down load / read on line.
Let me know why I am getting document symbol for all key / char, even though i selected "ELEM". I know we could direclty import documents in query designer, what is the difference..
Rgds..

Hi,
Anybody could provide step to step procedure for doucument integration for Bex reports.
Best regards,

Migration of work books, queries and web report

Hi,
kindly give me the steps to migrate workbooks, queries and web reports from BW 3.5 TO BI 7.0
Regards
Asim

Hi,
Kindly check the below link:
Migration of Queries and Work Books from BW 3.x to BI 7
/people/teja.badugu/blog/2008/11/11/migration-of-queries-and-work-books-from-bw-3x-to-bi-7
Hope it helps,
Thanks,
Amit

Migrating Crystal and Webi Reports with Universe from 1 folder to different folders

Hi There
Does anybody know of a way to do the following
this is for BOE XI 3.1 SP 6 FP 6.2 on Windows 2008 R2
We have multiple Crystal and Webi reports developed from 1 universe and we need to copy these Crystal and Webi reports to different folders in the same CMS for example
Universe Dev > Universe Folder Dev - Crystal and Webi Reports set in Dev Folder
Create a copy of the Dev Universe to Universe Folder Test – Copy the Dev Crystal and Webi Reports to Folder Test we need to Map it to the universe in the Test Universe folder(Copy of the Dev Universe)
Create a copy of the Dev Universe to Universe Folder UAT– Copy the Dev Crystal and Webi Reports to Folder UAT we need to Map it to the universe in the UAT Universe folder(Copy of the Dev Universe)
Create a copy of the Dev Universe to Universe Folder PROD – Copy the Dev Crystal and Webi Reports to Folder PROD we need to Map it to the universe in the PROD Universe folder(Copy of the Dev Universe)
The reason for this is each of these universe are connected to a different database i.e Test, UAT, Prod and we have over 200 reports and at the moment we have to manually map each report to the new universe individual which take up hours.
I have tried Lifecycle manager but came to the conclusion it cannot achive this
You cannot change the universe attached to the Crystal and Webi reports
you cannot promote Reports and Universes in the Same CMS to different folders
you cannot change the folder even if you promote jobs between servers
Does anybody know of a way to do this

Hi,
The way you should do this is to have 4 different BO systems, Dev, Test, UAT and Prod.
Having this will allow you to use the same universe across all systems, but the connection to the database will be different on each system.
Not only will this allow you to smoothly report off different data sources, but you will also be able to upgrade and make configuration changes without impacting your production system.
Cheers,
Josh

Calling a web dynpro application via portal using SSO

Hello Expert,
i have a requirement where i need to call a web dnpro application via portal.
But it is asking for user name and password.
i want to call using single sign on.
Can u please suggest a way.
i did the coding like this:-
CALL METHOD cl_wd_utilities=>construct_wd_url
EXPORTING
application_name = l_c_appl_name
IMPORTING
out_absolute_url = l_v_gv_url_string.
l_v_icf_url = l_c_icf_url_val.                      "#EC SYNTCHAR
CALL METHOD cl_icf_tree=>if_icf_tree~service_from_url
EXPORTING
url             = l_v_icf_url
hostnumber      = l_c_0
authority_check = space
IMPORTING
icfactive       = l_v_m_sso_active.
IF l_v_m_sso_active = l_c_x .
CREATE OBJECT o_viewer
EXPORTING
parent = o_empty_co.
CALL METHOD o_viewer->enable_sapsso
EXPORTING
enabled = l_c_x
EXCEPTIONS
OTHERS = 0.
l_v_gv_url_c = l_v_gv_url_string .
CONCATENATE l_v_gv_url_c l_c_url_string p0022-pernr INTO l_v_gv_url_c.
CALL METHOD o_viewer->detach_url_in_browser
EXPORTING
url        = l_v_gv_url_c
EXCEPTIONS
cntl_error = 1
OTHERS     = 2.
IF sy-subrc <> 0.
MESSAGE ID sy-msgid TYPE sy-msgty NUMBER sy-msgno
WITH sy-msgv1 sy-msgv2 sy-msgv3 sy-msgv4
RAISING error_occured.
ENDIF.
cl_gui_cfw=>flush( ).
ENDIF.
but it is not working
thanks
Mahesh

Hi Mahesh,
You need to setup a Single Sign On between SAP Portal and ECC system where yoy are doing the development.
Ask basis team to setup the single sign on and usually this is the job done by Basis teams. Refer the below link to get some idea on SSO setup:
http://scn.sap.com/community/enterprise-portal/blog/2013/12/15/sso-configuration-between-sap-portal-73-and-ecc-60-ehp-6
Thanks
Krishna

Server Side Trust and Webi Report Scheduling via Portal

Similar Messages

Maybe you are looking for