Cannot get end-to-end single sign-on to work in CR XI

Post Author: yarg
CA Forum: Authentication
Hello,
I'm looking for some help please. I have used Crystal Reports XI fairly extensively over the past year (designing reports mainly), and have now been tasked with getting CR Server XI up and running so that team members can view reports pertaining to them via a web browser. I have installed CR Server XI on a Windows Server 2003 VM and have followed every single step in the admin guide on pg285 about how to implement end-to-end single sign-on using Kerberos.
However, every time I try to access InfoView I get prompted for AD credentials. Single sign-on just is not working and there are no visible error messages to indicate why. Could anyone please offer suggestions? Even telling me whether there is any sort of log file which I can check to see what's happening behind the scenes would be very helpful.
Many thanks in advance,
Graeme

Post Author: colin mackenzie
CA Forum: Authentication
Hello Graeme.
Have you tested it with using the user settings under the Enterprise Authentication?
Does your reports and objects work for the user when connected with the "Enterprise Authentication Type?

Similar Messages

Single Sign-on not working for me :(

Hi Everyone,
I have set-up an OS X Server 10.5.4 Open Directory Master, Kerberos is running my Kerberos Realm: SERVER.MYDOMAIN.COM, DNS is running fine and everything is in-order as far as I can tell.
But the issue that is driving me crazy is that, When a user logs-in on their laptop and they go and click on the Server with AFP shares in Finder they get "Connection Failed" but they can login when they go under Go->Connect to Server->Login window pops-up they put their username and password they access the shares.
For Kerberos single sign-on do I have to do any other configurations that I have not run across in the documentation or discussions.
Here is the settings that are in the edu.mit.Kerberos file:
# WARNING This file is automatically created, if you wish to make changes
# delete the next two lines
# autogenerated from : /LDAPv3/server.mydomain.com
# generation_id : 1164378777
[libdefaults]
default_realm = SERVER.MYDOMAIN.COM
[realms]
SERVER.MYDOMAIN.COM = {
admin_server = server.mydomain.com
kdc = server.mydomain.com
[domain_realm]
.mydomain.com = SERVER.MYDOMAIN.COM
mydomain.com = SERVER.MYDOMAIN.COM
[logging]
admin_server = FILE:/var/log/krb5kdc/kadmin.log
kdc = FILE:/var/log/krb5kdc/kdc.log
If anyone has some ideas, that would be great!
Thanks,
D

To do SSO the client computer must first find the right KDC (Key Distribution Center) to get the ticket from, login, get the ticket and then you (the computer) should be able to use that ticket to login to any kerberized service in the same realm, without having to authenticate again as long as the ticket is valid.
The question is: when do you get that ticket and where are you connecting from?
When connecting from outside of the LAN where the KDC is, you still need to find it, if using kerberos.
I suspect you (should) get the ticket when logging in locally using an OD server account.
Wheter the machine has to be bound to he OD I don't know but it seems logical to expect that if it works similiar as to how an AD works.
I'm not 100% sure about what is cached when using a portable account but as the default time a ticket is valid is 10 hours you'll need to reauthenticate when the time is up.
When logged in, if you open this application and don't quit it: /System/Library/CoreServices/Kerberos.app
it should get you a new ticket when the old one expires.
Also, using this application you should be able to get a ticket (before) trying to mount/use kerberized services (even if not using a OD server account locally or beeing bound to the OD) and not having to authenticate again — "manual SSO"?

Single Sign-on stops working after updating to 10.4.7

Well, I'm fresh off the AFP won't start bug in 10.4.6. Now that this bug is fixed in 10.4.7, we have a new problem. It appears that on our OD Replica, single sign-on doesn't work for AFP mounts through the Apple-K method (user home directories work just fine). If a user wishes to mount an AFP share using Apple-K, he/she must re-authenticate a second time. What's more, the user MUST use his/her SHORT name to authenticate, or else the server rejects the attempt.
We tried demoting the OD Replica and then re-promoting it, but this did not solve the issue. The logon issue appears to affect 10.3 and 10.4 clients.
I believe that this might be a problem with the kerberized AFP (that is, it's not kerberized but should be). Any ideas on how to fix this?
Dual 2Ghz G5 10.4.7 Server

spent the weekend trying to troubleshoot this issue. I opened a case with AppleCare, and together, we found some interesting information. Kerberos/single sign-on/promotion to OD Master from Standalone server does NOT work under 10.4.7 Server if DNS is not set up and running on the 10.4.7 Server itself. For example, our DNS is running on a Windows Server platform. When pointing the OS X Server to the Windows servers for DNS, the Mac kerberos services refused to work. When installing DNS on the Mac server and pointing it to itself for DNS resolution, things worked fine.
On a side note, I had to completely re-set up two Mac servers from scratch after trying to promote either one to an OD Master/Kerberos/single sign-on. Something got VERY corrupted in there.
We never saw this behavior under any other 10.4.x build or 10.3.x build. This appears to have started in 10.4.7.

I cannot get firefox to load mymathlab and it was working last week

i have to do my math homework on mymathlab and i cannot get it to load on firefox it is saying website is unavailable but i know it is not the website cause it works on other computers. please help

unfortunately i'm not familiar with bitdefender - there's a general instruction on how to deal with slow internet speed at http://www.bitdefender.com/support/my-internet-is-slow-1100.html - though i'm not sure if this also applies to your situation. otherwise you can also contact the bitdefender support for assistance on how to properly configure their program so that firefox won't get blocked. there's also a chat option on their support page...

Just bought 2 Apple 6 plus phones. Cannot get my husbands email to connect. He works for the state and not sure if that is the problem or not. All his information is correct.

Just bought two new iPhone 6 plus phones. Cannot get the email to load on my husbands phone for his work. He works for the state and I don't know if that is the issue or not. Any suggestions?

Your husband should contact his IT department at work to find out if he is allowed to set up his work email on his personal device and if so, how to do it.

Cannot get ALPS touchpad on Dell Precision M4400 to work reliably.

My Dell Precision M4400 (running Arch x86-64) has an ALPS touchpad which Xfce claims is a "AlpsPS/2 ALPS DualPoint TouchPad" and a pointer stick claimed to be a "DualPoint Stick" I have the synaptic touchpad drivers installed and xorg input hotplugging on, and it works 95% of the time reliably. However, rarely, a mouse button will either act wedged down or will not respond untill I hammer the other mouse buttons for a second or so. As well, no matter what I try, I cannot get the side of the mousepad to act as a scroll wheel.
The following is the contents of my HAL configuration for the mousepad at /etc/hal/fdi/policy/11-x11-synaptics.fdi . I got it online from a wiki posting it ( http://www.linlap.com/wiki/dell+precision+m4400 ), and it fixed an earlier problems with the mousepad settings resetting on resume from suspend-to-RAM (as it fell back to PS/2 mouse emulation, I think).
<?xml version="1.0" encoding="utf-8"?>
<deviceinfo version="0.2">
<device>
<match key="info.capabilities" contains="input.touchpad">
<merge key="input.x11_driver" type="string">synaptics</merge>
<merge key="input.x11_options.SHMConfig" type="string">on</merge>
<merge key="input.x11_options.VertEdgeScroll" type="string">true</merge>
<merge key="input.x11_options.HorizEdgeScroll" type="string">true</merge>
<merge key="input.x11_options.VertScrollDelta" type="string">20</merge>
<merge key="input.x11_options.HorizScrollDelta" type="string">20</merge>
<merge key="input.x11_options.LeftEdge" type="string">80</merge>
<merge key="input.x11_options.RightEdge" type="string">880</merge>
<merge key="input.x11_options.TopEdge" type="string">150</merge>
<merge key="input.x11_options.BottomEdge" type="string">630</merge>
<merge key="input.x11_options.TapButton1" type="string">1</merge>
<merge key="input.x11_options.FingerLow" type="string">3</merge>
<merge key="input.x11_options.FingerHigh" type="string">20</merge>
</match>
</device>
</deviceinfo>
And because it might be usefull, Xorg.conf:
# nvidia-xconfig: X configuration file generated by nvidia-xconfig
# nvidia-xconfig: version 1.0 (buildmeister@builder58) Fri Apr 17 00:40:10 PDT 2009
Section "ServerLayout"
Identifier "Layout0"
Screen 0 "Screen0" 0 0
EndSection
Section "Files"
EndSection
Section "Module"
Load "dbe"
Load "extmod"
Load "freetype"
Load "glx"
Load "synaptics"
EndSection
Section "Monitor"
Identifier "Monitor0"
VendorName "Unknown"
ModelName "Unknown"
HorizSync 28.0 - 33.0
VertRefresh 43.0 - 72.0
Option "DPMS"
EndSection
Section "Device"
Identifier "Device0"
Driver "nvidia"
VendorName "NVIDIA Corporation"
Option "RegistryDwords" "PowerMizerEnable=0x1; PerfLevelSrc=0x3333"
Option "NoLogo" "True"
EndSection
Section "Screen"
Identifier "Screen0"
Device "Device0"
Monitor "Monitor0"
DefaultDepth 24
Option "AddARGBGLXVisuals" "True"
SubSection "Display"
Depth 24
EndSubSection
EndSection
Section "Extensions"
Option "Composite" "Enable"
EndSection
Section "ServerFlags"
Option "DontZap" "false"
EndSection
Last edited by GourdCaptain (2009-05-24 18:31:54)

try an -Syu real quick... my touchpad scroll didn't work before, but now it is autodetected.

Cannot get Adobe Extension Builder Extensions with iFrames to work under Windows

Currently we are unable to add an iFrame to the main HTML panel without the Windows version of Adobe InDesign closing the extension automatically. This works correctly on the MAC.

Okay, for anyone that is also having this problem I believe I figured out the problem. Adobe files are saved under .xpi extensions which is just another type of .zip file. If you do not have winzip installed you cannot install flash player. I now have mine working. Good luck!
www.winzip.com

I cannot get my iPhone 6 to sign onto iCloud

it keeps giving me a verification code. I put it in and it just gives Me another.

Maybe you'd have to contact an Apple Store or the carrier who handles
the phone, about how to reset it. There should be some helpful motions
and efforts to attempt to re-connect the vehicle to the iPhone, there.
Perhaps there's a firmware update for the vehicle at an authorized agency...
Looking ahead, when looking into newer 2015+ models, test with a phone.
Good luck & happy computing!

Cannot get into my apple ID password will not work

I recently got a new IPhone 4 because my old one was having battery issues. Now I find that I cannot sign into Apple App or ITunes
the apple store did not tell me I would lose my password how do I get it back or get a new one
it tells me to enter my email address and I would get a way to reset it but I donot even get the email that was to be sent to me.

Hello vickieucb,
Thanks for using Apple Support Communities.
For more information on this, take a look at:
Apple ID: If you forget your password
http://support.apple.com/kb/ht5787
Best of luck,
Mario

HT6114 I cannot get osx downloaded. my child needs to work with pages. Help

I cannor get OSX downloaded on my computer. My child needs to work with pages and we cannot update.

Check to see if your Mac supports Mavericks (assuming that's what you're trying to install since you're in the Mavericks forum).
To install Mavericks, you need one of these Macs:
iMac (Mid-2007 or later)
MacBook (13-inch Aluminum, Late 2008), (13-inch, Early 2009 or later)
MacBook Pro (13-inch, Mid-2009 or later),
MacBook Pro (15-inch or 17-inch, Mid/Late 2007 or later)
MacBook Air (Late 2008 or later)
Mac mini (Early 2009 or later)
Mac Pro (Early 2008 or later)
Xserve (Early 2009)
Your Mac also needs:
OS X Mountain Lion, Lion, or Snow Leopard v10.6.8 already installed
2 GB or more of memory
8 GB or more of available space

HT1414 I have done all of the above, still I cannot get nor my wifi or blue tooth to work they are greyed out and the wheel keeps on spinning, what else can I do?

Ever since I updated to IOS 7.0.2 I cannot connect to wifi or bluetooth it will not allow me to do so, I have followed all the instructions found on the support page and nothing brings my services back to normal. Help please what do I do, you can always email me to [email protected] any help will be appreciatted

did you restore the phone in itunes and set it up as a new phone?

Cannot get web service using 2-way SSL to work

WebLogic 8.1 sp4, using jdk 1.4.2_05 within BEA install dir (not JRockit). Also using WLWorkshop.
I'm trying to call a web service provided by a third-party requiring 2-way SSL; The third-party provided a server cert to trust and a key/cert to use from our client. After updating my key and trust stores, I'm able to run this with no problem from another web service test product (CapeClear).
How does one do this from WLS? I did the following (nothing has worked):
- Started my WLS server; using the console, updated the Configuration|Keystores & SSL section and restarted - the console output indicates that all loaded correctly. I also changed the option on Two Way Client Cert Behavior to 'Client Certs Requested and Enforced'.
- Updated my setDomainEnv.cmd to include the following options -Dweblogic.security.SSL.ignoreHostnameVerify=true -Dweblogic.security.SSL.enforceConstraints=off; I also added the -Dssl.debug=true -Dweblogic.StdoutDebugEnabled=true options.
- Within Workshop, created my web service control from the provided WSDL and generated a test JPF; when I run the test, I get an exception related to an invalid content type (text\html). This occurs because the client-side SSL piece did not take place and the client was presented with a login-page rather than a web-service XML result.
- I updated the JDK security jars with domestic strength algorithms; no change in behavior.
- No SSL errors in the debug trace (I can provide log upon request).
What other parameter and/or setting do I need to update to get this to work?
Any help would be tremendously appreciated.
Thanks,
Rick

I too am struggling with SSL but I was given some help by BEA. This does not help me since It seems like the proxy jar I download from the WS Home Page wants to go directly to the JPD not the jws. This example of two way SSL should work for you. I am including the Main class but not the generated files it refers to. I don't know how to attach files to the news groups. The key thing it to make use of the adapters. The Impl and Port are part of the downloaded proxy.
public static void main(String[] args) throws Exception {
// set weblogic ServiceFactory
System.setProperty("javax.xml.rpc.ServiceFactory", "weblogic.webservice.core.rpc.ServiceFactoryImpl");
// set weblogic client protocol handler
System.setProperty("java.protocol.handler.pkgs", "weblogic.webservice.client");
// set the SSL adapter
SSLAdapterFactory adapterFactory = SSLAdapterFactory.getDefaultFactory();
WLSSLAdapter adapter = (WLSSLAdapter) adapterFactory.getSSLAdapter();
// two-way SSL you must loadLocalIdentity to provide certs back to the server
FileInputStream clientCredentialFile = new FileInputStream ("./client/clientcred.pem");
String pwd = "canpass";
adapter.loadLocalIdentity(clientCredentialFile, pwd.toCharArray());
adapter.setVerbose(true);
adapter.setTrustedCertificatesFile("./config/ca1024.pem");
adapter.setStrictChecking(false);
adapterFactory.setDefaultAdapter(adapter);
adapterFactory.setUseDefaultAdapter(true);
String a = null;
if (args.length < 1) {
a = "Sample String";
} else {
a = args[0];
ToUpper_Impl lookup = new ToUpper_Impl();
ToUpperPort value = lookup.gettoUpperPort();
String result = value.toUpper(a);
System.out.println(result);
}

TS5376 Anyone have any suggestions?? Cannot get iTunes (or any other apple apps) to work now

Anyone have any suggestions?? I've run iTunes for years now, this last update "killed" the ablity for it to run automatically on my Win7 machine. I've unloaded EVERTYTHING apple on my computer 3x times now, reloaded, as admin - even paid for cleaners to make sure. Run all the Microsoft patches, updates, everthing I could find...NOTHING seems to be working.

Are you currently getting an error message when you try to launch iTunes? If so, what does it say? (Precise text, please.)

I cannot get Facebook to load. All other sites work fine. It will load if I disable all add-ons, but I have been unsucesssful determining which add-on is causing the problem.

I can get FB to load without problems in other browsers.

DFC wrote:
To whom it May Concern
Wow so dramatic, sorry that just seemed an odd way to start a message. I would first recommend trying to perform a system restore. This hardly ever fixes any thing, but it is the easiest thing to try. Go the start menu >> All Programs >> Accessories >> System Tools >> System Restore. Then choose the date that is before the system started acting weird.
If that doesn't help yeah try a repair install of LabVIEW on what ever versions are acting funny.
Unofficial Forum Rules and Guidelines - Hooovahh - LabVIEW Overlord
If 10 out of 10 experts in any field say something is bad, you should probably take their opinion seriously.

Cannot get end-to-end single sign-on to work in CR XI

Similar Messages

Maybe you are looking for