SSO with AD, Kerberos, Tomcat

server administration XI Server Discussion
1

Hello, I have a BOXI r3.1 SP5 installation.
I’m configuring SSO with Windows AD and Tomcat.

I’ve used this document: http://sboblog.infotrust.dk/index.php/2010/05/21/active-directory-sso-on-sap-businessobjects-xi-3-1/

I’ve followed all steps until and including step 15. So far so good, I can log on to client applications with SSO (without providing credentials).

Now te last step is to set up SSO for the Java web apps like InfoView. I seem to get stuck there, because when I open the infoview URL I get a HTTP 404 error message.

I’m thinking that the UPN for the Tomcat service account might not be unique. I’ve done some tests that are described in posts on this issue, but I’m not sure how to interpret the results. Please find a screenshot attached. Note that I get 2 sets of results: 1 for SERVER2 and 1 for SERVER2T (test machine).

What does the outcome say?
spn.png

alonso (BOB member since 2004-03-01)

2

This could be helpful for you

http://blogs.hexaware.com/business-objects-boogle/windows-ad-authentication-for-business-objects-using-kerberos/

http://blogs.hexaware.com/business-objects-boogle/windows-ad-authentication-for-business-objects-using-kerberos-–-part-ii-2/

Manikandan Elumalai :us: (BOB member since 2009-10-23)

3

Thanks, for the links, but I’m still stuck with the 404 error message when I go to the InfoView logon page.

Anyone any suggestions?

I’ve attached a screen shot of the cms. Could these warnings in red have anything to do with this problem?
warning cms.jpg

alonso (BOB member since 2004-03-01)

4

Kindly check whether you have the program objects similar to the attached one in your deployment
query.png

Manikandan Elumalai :us: (BOB member since 2009-10-23)

5

Hi, thanks for your answer. I’ve checked.
They’re not there.

What should I do to get the program objects there?

alonso (BOB member since 2004-03-01)

6

Are you using BOSSO.Keytab file or did you enter password in Tomcat?

Also is your SPN same in web.xml (idm.princ), setspn -l and CMC SPN area?

I am unable to open the link form your first post so i am not sure the steps you followed.

Abishek :us: (BOB member since 2004-12-09)

7

Hi, sort of a related question, I’m trying to reverse engineer a couple of BO envs I have inherited all envs dev, qa and prod are on BO 3.1 Windows using SSO / Win AD and SSL, dev all work.

One of the differences I notice between QA and prod is the following entry in the prod web.xml file and not in QA,

idm.keytab c:\temp\bosso.keytab

Remove the entry in web.xml in prod and can still login etc but anything like accessing reports etc I get an http 404 error. My prod is cluster of couple machines in QA its one machine.

I’m not sure what this bosso.keytab is doing though as the other entries in the files across the envs show Im using Vintela for SSO. From a google I’m thinking the bosso.keytab it handling comms authentication between the servers in my in my cluster is that correct ? I don’t understand why it would be in prod but not qa or dev.

Thank you.
Rich

Rich :uk: (BOB member since 2002-10-04)