Fall back systemwhen multiple SAP systems trying to acheive SSO with BOEXI

Question

Friends,
I need a small clarification on ' SSO between BOE XI 3.1 and SAP BI 7' Scenario,
Say when multiple users log on through their  SAP EP Portals or Netwever Portals, they use their tokens generated by their respective EP portals which are passed through the 'Web application server' hosting BOE environment.
1) When  its a Single EP portal , we can have have a fall back system. when we register  its logical name in the CMC of BOE Environment , a typical SNC.But what's the fall back system for multiple SAP systems?
2) Also Whether there are any pit falls via token method  when more than one SAP system communicating to BOE?
3) Do we have any documentation for this?
Thanks ,
Sivakanth.

Answer 1

Hi Sivakanth,
the normal scenario for SSO is the following:
When you said ''back end system ', i did not get it.
Enterprise Portal -
(iView)-------> BOE -
> SAP BI <- This is your backend system
Well Could I define more than one logical name there in SNC tab of CMC.?
I assume you have the following situation:
(EP1, EP2, EP3) -
> BOE -
> (SAP BI 1, SAP BI 2, SAP BI n)
You can define more than one entitlement systems in the BOE CMC and also configure for each one of them for SNC. Please note that we are talking about server trust and NOT client trust here. It is all about letting your sap system and the boe system trust each other. If you have your portal with client SNC configured (ie. the user logs using a certificate and an SAP logon ticket is created) it is NOT necessary to configure SNC in the CMC (Please refer to the section "Configuring SAP Server-Side Trust" in the installation guide for the integration kit for SAP) side.
Back to the SSO scenario now: When a user connects from an enterprise portal on the BOE system the logon ticket, generated from the portal, is forwarded to the back-end system, which is defined in the portal iView the user is currently navigating through. If it is a Crystal Enterprise iView then you just have to select the appropriate system alias of your back-end system in the System drop down menu when creating the iView. For URL iViews you must utilize the relevant openDocument parameters. If you do not define anything at all when creating the iView then BOE tries to authenticate the logon ticket against the SAP BI system you selected to be the default one in the "Authentication->SAP->Options" tab of the CMC.
If what you want is just to distribute the load between your SAP back-end systems then you should consider utilizing an SAP cluster for your pursposes. As explained before BOE will not distribute the requests evenly on the back-end systems. It will try to contact either the system defined in the request (iView) or the default system. To be honest I am not sure what happens if the explicitely defined system is not available but I think that an error message is what you should expect then. I do not think that in this case the BOE system tries to use the system defined as default.
Another part is what kind of security is defined in BEX querys..as i read from SAP IK guide, we can import all the roles which are defined at ABAB level.
Will there be any security threats to SAP data via this method.
It is true that you can import all roles in your BOE system. But keep the following four things in mind:
1) You can restrict on the BOE side the users which are authorized to logon in the CMC and import the roles (normally only the BOE administrator is authorized to do this)
2) Importing a role means that an SAP user can try to logon the BOE. Still the logon process can only be succesfull only if the SAP user has special authorization on the SAP side (Please check the Appendix "Authorizations" in the installation guide of the integration Kit for SAP.
3) You can restrict the access to data by assigning authorizations only for specific infoareas/infoproviders. In order to partially restrict data access in a given infoprovider (e.g infocube or multiprovider) you can utilize authorization variables in your BW query.
4) You can further restrict access on specific reports either on the BOE side or on the portal side (by rstricting access to the defined iViews).
For sure you must invest some time to define and implement your security concept.
More over could you please answer other 2 questions in my original question.
2) Also Whether there are any pit falls via token method when more than one SAP system communicating to BOE?
3) Do we have any documentation for this?
2) As long as your portals, the back-end systems and your BOE system are configured correctly for SSO this should not be a problem. Well just a tip based on my experience: be sure to use full qualified domain names for your systems in the iView definitions. And do not forget SSO works only if all systems are in the same domain.
3) As said in my previous posting the netweaver documentation regadring SSO setup maybe interesting for you. As far as I know the multiple systems scenario is not contained explicitely in any official BOBJ documentation. I assume that you already went through the installation guide for the integration kit for SAP.
Please tell me if you have a completely different scenario in mind
Regards,
Stratos
Edited by: Efstratios Karaivazoglou on Mar 22, 2009 12:27 AM