End to End Single Sign-On

With Crystal Reports server XI r2 using IIS and SQL server, I am trying to configure end to end single sign on. The sign on to infoview works, but when the reports are refreshed from infoview they run under the domain service account that was created for the services to run under. Is this by design, or is it possible to pass the actual infoview user's credentials to the report? If so, what did I miss?

In order to use end to end you must configure kerberos .net. With all the changes going on I'm not sure if our white paper for this is available. It's a rather complex process that requires settings to be made in AD, IIS and SQL. Here's a summary
1) CMC enable kerberos
2) create a service account and run the CMS and any reporting servers with this account
3) set SPN's for CMS, IIS, and SQL services
4) configure reports data source with integrated windows
5) set report connection info in the CMC
There are quite a few more steps it should be the same as in the XI 3.0 admin guide. It would be best if you could log a message with support to complete this configuration.
http://help.sap.com/businessobject/product_guides/boexir3/en/xi3_bip_admin_en.pdf
Regards,
Tim

Similar Messages

Cannot get end-to-end single sign-on to work in CR XI

Post Author: yarg
CA Forum: Authentication
Hello,
I'm looking for some help please. I have used Crystal Reports XI fairly extensively over the past year (designing reports mainly), and have now been tasked with getting CR Server XI up and running so that team members can view reports pertaining to them via a web browser. I have installed CR Server XI on a Windows Server 2003 VM and have followed every single step in the admin guide on pg285 about how to implement end-to-end single sign-on using Kerberos.
However, every time I try to access InfoView I get prompted for AD credentials. Single sign-on just is not working and there are no visible error messages to indicate why. Could anyone please offer suggestions? Even telling me whether there is any sort of log file which I can check to see what's happening behind the scenes would be very helpful.
Many thanks in advance,
Graeme

Post Author: colin mackenzie
CA Forum: Authentication
Hello Graeme.
Have you tested it with using the user settings under the Enterprise Authentication?
Does your reports and objects work for the user when connected with the "Enterprise Authentication Type?

CUP 5.3 - Single Sign On fu00FCr end user request screen?

Hi everyone,
Is there any way to achieve Single Sign On in a windows environment using the corporate Active Directory for the END USER REQUEST SCREEN in CUP 5.3?
I am aware of the document "Single Sign-On with SAP BusinessObjects Access Control 5.3" by the SAP GRC RIG (Harleen Kaur) so I know how to achieve Single Sign On for the CUP application itself.
I am also aware of the option to deactivate "end user verification required" in the authentication source definition in CUP.
What our end users are asking for is true single sign on. They would like to enter a request WITHOUT providing network user ID and/or password manually.
Thanks!

Hi Raghu,
Thanks a lot!
We have not yet configured SSO but are in the phase of analyzing our options.
I understood that SSO is only possible for the server:port//AE/index_apr.jsp page in CUP.
What about the end user request screen (server:port/AE)? Will this work with Windows-SSO using SPNEGO? Would I set the authentication source to LDAP or to UME (UME has multiple LDAP as user data source)?
Many thanks and best regards
Patrick

Bounce due to: 354 Enter mail, end with a single "."

I'm having trouble sending mail to an email address. The message bounces from the other party's mail server with the following error message:
Feb 26 11:01:47 mail postfix/smtp[22750]: 732B493DA1: to=<[email protected]>, relay=mgate.lnoca.org[208.108.152.63], delay=11, status=bounced (host mgate.lnoca.org[208.108.152.63] said: 354 Enter mail, end with a single ".". (in reply to end of DATA command))
Any idea what the trouble might be?

354 is the code an SMTP server responds to the DATA command. This should not be a rejection command (or comment). It merely indicates how a mail message should be terminated.
To me it looks like a poorly configured server on the other side. Could also be an interrupted connection.
Have you tried and contacted them?

InDesign CS4 crashes with files ending with a single page

I work in the IT team of a French press group. Our users (OS 10.6.6, InDesign CS4 [6.0.6]) work on facing pages documents, mostly set up with one spread; some files end with a single page. Most of our users complain about the fact that they always have to add a blank page (right to the single page) to avoid crashing. They never crash when they work on files containing only spreads.
Has anybody encountered the same issue?

Hi jmlevy,
Working as a consultant for graphic design companies, I did not hear of this problem. But, it is an interesting one. Can you send over one of the files crashing (+images / fonts used)? Then I can see if I can reproduce the crash.
Redmac

End of DPS Single edition support (may 2015)

Hi there team,
I would like to know what's the plan from adobe for us to be able to maintain our already published DPS Apps in the Applestore. I undestand that you plan to give support only to epub fixed layout (ibookstore) and not the Applestore after May 2015. So, what happen with our already developed Apps? What happens with our customers?
I hope you give us a solution for not to be the end of our subscriptions to the Creative Cloud before May 2015.
Rubén.

This is being discussed over in another thread: The end of DPS Single Edition. Please direct your comments and questions there. Thanks!
Neil

Could you tell me if it would be supported to pair a two node enterprise edition front end pool inc mirror sql with a one node enterprise edition front end pool inc single sql?

Hi all,
Could anyone tell me if it would be supported to pair a two node enterprise edition front end pool inc mirror sql with a one node enterprise edition front end pool inc single sql?
MUCH THANKS.

The answer from TechNet found at http://technet.microsoft.com/en-us/library/jj204697.aspx Is, and I quote:-
Enterprise Edition pools can be paired only with other Enterprise Edition pools. Similarly, Standard Edition pools can be paired only with other Standard Edition pools.
Also, "Neither Topology Builder nor topology validation will prohibit pairing two pools in a way that does not follow
these recommendations. For example, Topology Builder allows you to pair an Enterprise Edition pool with a Standard Edition pool.
However, these types of pairings are not supported."
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"

Configuring JCo3 Connection Pool with single sign on on non SAP Java server

Hi Everyone,
i have configured a connection pool on JBoss as per JCo3 Documentation and is working great.
Now I need help to configure this connection pool with single sign on so that RFc on SAP ECC systems are executed using end users credential rather than using single user name password used to configure JCo connection pool.
On SAP Java stack I am sure its possible within Java WebDynpro and i assume using JCA resource adapter. But what if we don't want to use SAP Java App server.
Any help will be appreciated.
Thanks,
Divyakumar Jain

Eason, 你好！
I have exactly the same problem. Did you find a solution to this problem? If so, please let me know!

Authentication between Single Sign-On and Web based applications

Hi everyone,
I need to create a way in Portal 10g (10.1.2.0.2) that allow me to do the following:
Once the user is logged on Portal (against Single Sign-On - SSO) he doesn't need to retype his username/password when he access a web based application throught the portal, in my case, an ASP application (not .NET, just ASP).
I made a test creating a External Application in SSO and after publishing this portlet (external application) inside portal.
It worked, BUT I was prompted to inform username/password to log on the aplication.
So, the user end up entering his password twice.
Does anybody know a way to acomplish this task?
The documentation I'm researching is:
Oracle Application Server Single Sign-On
Administrator's Guide
10g Release 2 (10.1.2)
B14078-02
Oracle Application Server Single Sign-On
Security Guide
10g Release 2 (10.1.2)
B13999-03
Thank you very much,
Diogo Santos.

have figured out how to secure any HTML, ASP, PHP, CFM, etc. web page again Portal / OID using the PDK toolkit.
Using AJAX (Asynchronous JavaScript and XML) and one Oracle Stored Procedure just adding a simple Javascript call to any HTML, ASP, PHP, etc. web page can secure it via Oracle SSO (OID). Access to any secured web page will require that it to be linked from an authenticated Portal session or a page opened in an authenticated Portal session.
This process can be easily modified to add in group security etc. This is just my starting point.
1) Create a stored procedure
# Make sure it has access to portal.wwctx_api.is_logged_on
CREATE OR REPLACE PROCEDURE login_ajax_check (
display_error IN number default NULL) AS
BEGIN NULL;
If portal.wwctx_api.is_logged_on = false then
htp.prn('DENY');
ELSE
htp.prn('ALLOW');
END IF;
Exception when others then htp.p('DENY');
END;
2) Use this Javascript in any page you wish to secure.
<-- Begin Paste Here -->
<script>
var allowgo=2
function ajaxCallRemotePage(url)
if (window.XMLHttpRequest)
// Non-IE browsers
req = new XMLHttpRequest();
req.onreadystatechange = processStateChange;
req.open("GET", url, false);
req.setRequestHeader("If-Modified-Since", "Sat, 1 Jan 2000 00:00:00 GMT");
req.send(null);
else if (window.ActiveXObject)
// IE
req = new ActiveXObject("Msxml2.XMLHTTP");
req.onreadystatechange = processStateChange;
req.open("GET", url, false);
req.setRequestHeader("If-Modified-Since", "Sat, 1 Jan 2000 00:00:00 GMT");
req.send();
else
return; // Navigateur non compatible
// process the return of the "ajaxCallRemotePage"
function CheckPortal()
ajaxCallRemotePage('[Your page calling the procedure from above]');
function processStateChange()
if (req.readyState == 4)
if (req.status == 200)
if (req.responseText.substring(0,4) == 'ALLO')
allowgo = 0;
else
allowgo = 1;
function doPage()
if (allowgo==1)
window.location='[Your login or error page]';
CheckPortal();
doPage();
</script>
<-- End Paste Here -->
That's it!!! Super easy. It works great too.
Larry Schenavar
[email protected]

Sample Application - Single Sign On from PeopleSoft to Infoview

<p>This zip file contains the code which provides the capability of Single Sign On (SSO) from the PeopleSoft portal to the BusinessObjects Enterprise Infoview portal even to the report level. See the documentation in the docs folder for information on what this code does and how to install it within your environment.</p><p> *********************</p><p>Update: Please be sure to download this <a href="http://ftp1.businessobjects.com/outgoing/CHF/boXIr2psoftwin_chf.zip">patch</a> (KBase<span style="margin-left: 5px"><a href="http://technicalsupport.businessobjects.com/KanisaSupportSite/search.do?cmd=displayKC&docType=kc&externalId=1544953&sliceId=&dialogID=14530755&stateId=1 0 14532113">1544953</a>)</span> for the Integration Kit for PeopleSoft software as well. It resolves a security issue with how the PeopleSoft logon token is handled by BusinessObjects Enterprise.</p>

Hello Boris,
The error happens seemingly at the very end of the SSO login. The Infoview screen is created, and after it is all built out the error appears. The error appears before any user interaction and before a report can be run. Clicking OK makes the error go away, but InfoView is not fully functional (folder hierarchy doesn't expand, etc etc).
WAS log file excerpt at time of error:
[5/7/07 15:31:58:926 CDT] 6ace6575 SystemOut     O 15811343 [Servlet.Engine.Transports : 15] ERROR com.businessobjects.encyclopedia.uitoolkit.web.ToolkitServlet - Request = /businessobjects/enterprise115/desktoplaunch/applications/init.bouitoolkit
[5/7/07 15:31:58:941 CDT] 6ace6575 SystemOut     O 15811358 [Servlet.Engine.Transports : 15] ERROR com.businessobjects.encyclopedia.uitoolkit.web.ToolkitServlet - From = wxpch1-bfqb.cna.com
[5/7/07 15:31:58:941 CDT] 6ace6575 SystemOut     O 15811358 [Servlet.Engine.Transports : 15] ERROR com.businessobjects.encyclopedia.uitoolkit.web.ToolkitServlet - java.lang.NullPointerException
[5/7/07 15:31:58:941 CDT] 6ace6575 WebGroup      I SRVE0181I: [Desktop Web Examples] [/businessobjects/enterprise115/desktoplaunch] [Servlet.LOG]: java.lang.NullPointerException: java.lang.NullPointerException
     at com.businessobjects.encyclopedia.reportviewer.encyclopedia.EncyclopediaApplication.init(EncyclopediaApplication.java:167)
     at com.businessobjects.encyclopedia.uitoolkit.web.HtmlApplicationFactory.createApplication(HtmlApplicationFactory.java:103)
     at com.businessobjects.encyclopedia.reportviewer.wrapper.InfoViewPanel.init(InfoViewPanel.java:106)
     at com.businessobjects.encyclopedia.uitoolkit.web.HtmlApplicationFactory.createApplication(HtmlApplicationFactory.java:103)
     at com.businessobjects.encyclopedia.uitoolkit.web.ToolkitServlet.doPost(ToolkitServlet.java:265)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:760)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.ibm.ws.webcontainer.servlet.StrictServletInstance.doService(StrictServletInstance.java:110)
     at com.ibm.ws.webcontainer.servlet.StrictLifecycleServlet._service(StrictLifecycleServlet.java:174)
     at com.ibm.ws.webcontainer.servlet.IdleServletState.service(StrictLifecycleServlet.java:313)
     at com.ibm.ws.webcontainer.servlet.StrictLifecycleServlet.service(StrictLifecycleServlet.java:116)
     at com.ibm.ws.webcontainer.servlet.ServletInstance.service(ServletInstance.java:283)
     at com.ibm.ws.webcontainer.servlet.ValidServletReferenceState.dispatch(ValidServletReferenceState.java:42)
     at com.ibm.ws.webcontainer.servlet.ServletInstanceReference.dispatch(ServletInstanceReference.java:40)
     at com.ibm.ws.webcontainer.webapp.WebAppRequestDispatcher.handleWebAppDispatch(WebAppRequestDispatcher.java:1171)
     at com.ibm.ws.webcontainer.webapp.WebAppRequestDispatcher.dispatch(WebAppRequestDispatcher.java:676)
     at com.ibm.ws.webcontainer.webapp.WebAppRequestDispatcher.forward(WebAppRequestDispatcher.java:203)
     at com.ibm.ws.webcontainer.srt.WebAppInvoker.doForward(WebAppInvoker.java:125)
     at com.ibm.ws.webcontainer.srt.WebAppInvoker.handleInvocationHook(WebAppInvoker.java(Compiled Code))
     at com.ibm.ws.webcontainer.cache.invocation.CachedInvocation.handleInvocation(CachedInvocation.java:71)
     at com.ibm.ws.webcontainer.srp.ServletRequestProcessor.dispatchByURI(ServletRequestProcessor.java:246)
     at com.ibm.ws.webcontainer.oselistener.OSEListenerDispatcher.service(OSEListener.java:334)
     at com.ibm.ws.webcontainer.http.HttpConnection.handleRequest(HttpConnection.java:56)
     at com.ibm.ws.http.HttpConnection.readAndHandleRequest(HttpConnection.java(Compiled Code))
     at com.ibm.ws.http.HttpConnection.run(HttpConnection.java:458)
This and the other information you've requested can be found in case #302807226.
Thank you for your help,
Brian

Oracle Application Single Sign-On

Dear All,
We have a requirement that there should be single sign-on for the users to use both the Oracle and non-Oracle Applications. We are using Oracle Application Server 10g at the back end.
How to enable single sign-on. Is there any tool that we need to install.
Pls guide us as we are entirely new to this process.
Regards,
Rajani

Hi,
You need to install and configure Oracle Internet directory and Single Sign On compontents of Oracle Application server 10g in order to have the Single Sign On working with Oracle Applications. After the Oracle Application Server Infrastructure tier installation there is addition integration steps you need to follow to integrate the Single Sign on with Oracle E-business suite. You can use DIP features ( Directory Integration and Provisiotion) to integrate with Third party directory server like Micrososft AD, Sun directory server etc. for Integrating the non oracle based application i think you have to use oracle single sign on API and you need to do bit of coding as well. You can also enble single sign on for database users but this requires advance security option enabled on the Database side and finally you can integrate Single sign on for OS users as well.
Raj

Single sign-on and different usernames and passwords

Hello,
I am building a Portal with WLPS 3.5 and WLS 6.0. I tried to get
information about the background of single sign-on.
I understand, that I need a Realm (i.e. LDAP Realm) to authenticate the
user for the first login to the portal (with username and password).
Now I would like to integrate my webmail-programm (to get emails from
Lotus Notes via Internet) as a portlet.
For my understanding the user has to authorizate to get access to webmail.
Therefore I create a ACL for webmail and this ACL is assigned to my
security Realm.
I would like the portlet to show after login the number of mails for the
specific user. But where are the username and password for webmail stored
and how are they received and forwarded?
I understand that my ACL included all users that have access to webmail
(i.e. all users). But I only want emails for the specific user.
Does WLS get all usernames and passwords while the first login? Do I have to
implement a algorithmen to get the specific username and password for the
requested resource in my portlet?
Has anyone solved a similar problem or can tell me where I can get more
information. I read the WebLogic Security document but I cant find a
answer to my questions.
Thanks
Lydia

Lydia,
I'm not an expert in this area, but I can give you a start.
As for single sign-on, there are different levels. For single sign-on across web-apps,
the servlet spec requires this (section 12.6 of th 2.3 spec) and therefore Weblogic
does this.
What you are talking about is single sign-on across back-end applications through
a web-app. BEA has partnered with Securant (just acquired by RSA) to provide this
kind of functionality. Browse to http://www.rsasecurity.com/products/ and look
at the ClearTrust product. BEA has also partnered with Netegrity (www.netegrity.com)
with their SiteMinder product. Neither is included in the Weblogic license. I'm
sure either vendor would be excited to explain how their product will solve your
problem if you give them a call.
As for where the username and passwords are stored, that is up to the realm. If
you are using the default WLPS RDBMSRealm, the username and encrypted password
are stored in the WLCS_USER table. If you are using LDAPRealm, they are stored
in your LDAP server.
Hope this was useful!
PJL
[email protected] wrote:
Hello,
I am using PersonalizationServer 3.5 and WLS 6.0 SP 2.
Now I try to unterstand the functionality of Single sign-on when a user
has different usernames and passwords for different applications.
Can someone explain where the usernames and passwords for a user are
stored (all in the LDAP-realm or a RDBMS-realm?) When a user access the
application how username and passwords are mapped? Or usernames and
passwords for all applications are the same and will be equalized?
Precisely I would like to get access to a mail-account for a specific
user
(webmail from Lotus Notes).
Thanks for any help
Lydia

Single Sign On -- Enterprise portal and BI JAVA

Hi,
I need to watch reports BI J2ee from an EP 7.00. I have configured the single sign On but it works just for ABAP BI Stack.
This is what I have done for SSO JAVA:
Importing the BI JAVA Certificate to the SAP NetWeaver 2004s Portal (SAP EP 7.0)
       1.      Start the SAP J2EE Engine Administrator with %INSTALLATION_ROOT%admingo.bat.
       2.      Connect to the portal server.
       3.      Choose are the values of and of certificate SAPLogonTicketKeypair-cert (see above).
You also have to add these values under evaluate_assertion_ticket:
   13.      Start the SAP J2EE Engine Administrator with %INSTALLATION_ROOT%admingo.
   14.      Connect to the portal server.
   15.      Choose (for example, CN=J2E)
Any clue?
Regards

Hi Jorge,
if the UME is used with an ABAP based system as the back-end user storage, do the following:
Generate and export the Portal Certificate:
Go to Visual Administrator
Choose <SID> - Server - Services - Key Storage - from the tree Select the view TicketKeystore under Views
If the SAPLogonTicketKeypair exist, delete it.
If the SAPLogonTicketKeypair-cert exist, delete it.
Generate a portal certificate using the following steps:
Under Entry choose Create.
Enter the folowing values in u201CKey and Certificate Generationu201D
Organization Unit Name (OU) = J2EE
Common Name (CN) = <SID>
Entry Name = SAPLogonTicketKeypair
Store Certificate: X
Algorithm: DSA
Click u201CGenerateu201D
Import the Portal Java Certificate into ABAP
STRUSTSSO2
System PSE:
u201CImport Certificateu201D - Choose your exported .crt file - File format = Binary
Click u201CAdd to Certificate Listu201D
Click u201CAdd to ACLu201D - System ID = <SID>, Client = 000
save it.
Export PSE ABAP Certificate and import into J2EE Portal:
STRUST
Choose PSE, export it and save as <SID>.pse
sapgenpse export_p12 -p <SID>.pse <SID>.p12
copy the generated p12 file <SID>.p12 to J2EE Portal
Go to Visual Administrator
Choose <SID> - Server - Services - Key Storage - from the tree Select the view TicketKeystore under Views
export the .p12 ABAP certificate with "Load"
adjust com.sap.security.core.server.jaas.EvaluateAssertionTicketLoginModule:
Choose <SID> - Server - Services - Security Provider - from the components tree select evaluate_assertion_ticket
ensure that trustediss<n>, trusteddn<n>, trustedsys<n> are correct set.
ume.configuration.active = true.
restart the ICM in SMICM
If you also want to use SSL, there are some further steps to be done.
Regards,
Gerd

Single Sign-On (Portal to R/3 Backend)

Hi all,
Iu2019m trying to implement Single Sign On (SSO) between our SAP portal (front end) and SAP R/3 ECC 6.0 Backend. Keep in mind this has nothing to do with Active Directory.
I read posting after posting from this site and I canu2019t tell you how much documentation and canu2019t seem to get to the root cause of the problem.
To sum it up, the Test connections in the Portal, which there are 3 (SAP Web AS Connection, ITS Connection, and Connection Test for Connectors)
The connection tests work for the first 2. The one that fails is the Connector.
The errors are not much help. Here is what I get.
Test Details:
The test consists of the following steps:
1.     Retrieve the default alias of the system
2.     Check the connection to the backend application using the connector defined in this object.
Results:
1.     Retrieval of default alias successful.
2.     Connection failed. Make sure the Single Sign-On is configured correctly.
Details:      Portal Host name = lansapdep01
     Backend Host name = lansapdev01
Property Category: Connector
Application Host = lansapdev01
Gateway Host = lansapdev01
Logical System Name = devcln150
Remote Host type = 3
SAP Client = 150
SAP System ID <SID> = DEV
System Number = 01
Server Port 3600
System Type = SAP R/3

You use Server Port 3600, message server.
It means, while creating a system you used wrong template and picked "SAP system using dedicated application server".
You should use "SAP system with load balancing", since message server is doing load balancing.
Once you selected correct template you will see "Message Server" instead of App and GW servers.
Make sure to fill in
Group - Logon group to use. If not defined in R3, use SPACE
Message Server - ansapdev01
SAP Client = 150
SAP System ID <SID> = DEV
Server Port 3600
System Type = SAP R/3
It should work.
Regards,
Slava

Can Captivate pull a user's login information from a Single Sign On (SSO) page?

Looking to start pushing out quizzes and trainings via Captivate. We currently do not have a LMS, so I started testing using Acrobat.com. We have a Single Sign On (SSO) page that passes our users credenitals on to all the sites and apps. Is there a way for Captivate to get those credentials, when submitting quiz results? Do they have to submit their quiz answers via an Acrobat sign in? Can Captivate auto submit answers or does the end user have to hit the Submit/Submit All button?

Hi there,
There is no native feature for getting SSO information in Captivate course.
If you don't have an LMS, and if you would like to use Acrobat.com reporting, then learner will have to click on the post results button, and enter their Adobe.com or Acrobat.com credentials, then hit submit. (Learners must have an Account on Acrobat.com or Adobe.com to submit the results.)
If the course will be accessed within the organization's network, then you can also use Internal server reporting, that works exactly same except learners do not need an account on Adobe.com
They will have to enter their Name and E-mail address to niquely identify them while fetching result reports.
Thanks.

End to End Single Sign-On

Similar Messages

Maybe you are looking for