AD Authentication in SAP BOX1 3.1

Question

Hi All,
We have SAP Business Objects X1 3.1 in our environment. We have requirement to enable AD Authentication in SAP.
I have gone through the "SAP Administrator Guide" . We have many domains in our AD based on the region(like EU,LA)
I have created a service account "abc" with the same name in all the domains.
While setting the SPN. Am I supposed to create SPN separately for all the domains(like EU,LA)) with the same service class ?
SETSPN.exe –A <ServiceClass>/<DomainName> <Serviceaccount>
Ex :  SETSPN.exe –A BOBJ/EU abc
        SETSPN.exe –A BOBJ/LA abc
Please help me in this regard
Regards,
Pavithra P

Answer 1

Hi All
I have set the SPN with the domain name of the service account . All the domains in AD are in the same forest and there is 2 way trust between each domains
SETSPN.exe –A BOBJ/eu.xyz.net abc
IN the CMC i mentioned the
Default Domain : EU.XYZ.NET
SPN - BOBJ/eu.xyz.net
MY Krb5.ini file is as below
[libdefaults]
default_realm = EU.XYZ.NET
dns_lookup_kdc = true
dns_lookup_realm = true
udp_preference_limit = 1
default_tgs_enctypes = rc4-hmac
default_tkt_enctypes = rc4-hmac
[realms]
EU.XYZ.NET = {
default_domain = EU.XYZ.NET
kdc = HostnameDC1.EU.XYZ.NET
AP.XYZ.NET {
default_domain = AP.XYZ.NET
kdc = HostnameDC2.AP.XYZ.NET
The users from EU(default domain) are able to login into infoview. But when the users from AP domain login they are facing the below error in foview
Code:
Account Information Not Recognized: Active Directory Authentication failed to log you on. Please contact your system administrator to make sure you are a member of a valid mapped group and try again. If you are not a member of the default domain, enter your user name as UserName@DNS_DomainName, and then try again. (FWM 00006)
I enabled the debug function in C:\WINNT\bscLogin.conf. And here is the error message:
Code:
Debug is  true storeKey false useTicketCache false useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
      [Krb5LoginModule] user entered username: [email protected]  Acquire TGT using AS Exchange
      [Krb5LoginModule] authentication failed
Cannot get kdc for realm AP.XYZ.NET
Please let me know where i m doing wrong
Regards,
Pavithra