BusinessObjects Board

Kerberos Service Principal Name (Windows AD SSO Authentication)

I usually get this information from the WIndows Admin, but we do not appear to have one. Any idea on how to go about getting this information so we can successfully apply SSO authentication to our Windows AD environment? Some information I came across which may help (anyone know where to get each piece of information):

The format for specifying the SPN is <sianame/service>@<DNS_REALM_NAME> where

||Name of the Server Intelligence Agent|
||Name of the service account used to run the BI platform|
|DNS_REALM_NAME|The domain name of the domain controller in uppercase|

You can find out if there are any service principal names for your account by running the following code: (the code must be run from a command prompt)

setspn -L %YourAccount%

The configuration commands are run using the setspn command, but they have to be done on the domain controller, you won’t be able to run them from your own machine or a server. You can look at the help for setspn in a command prompt to see the options.

You should also take a look at this document: SAP KBA 2629070 - How to Securely Integrate BI 4.2 or 4.3 with Windows AD and SSO in Distributed Environments - Best Practices

Good line of code! Tried that and the result indicated that we do not have anything setup. Will review the link. Do you know if a Vintela setup allows this process to be easier? Not sure I have setup anything with Vintela before.

I’m not sure. There are some Vintela elements to the configuration in the KBA but I don’t know if there would be any other things that might have an impact. I’ve always just followed the instructions in the KBA.