Analysis, Office Edition SSO not working to BW System for all users

[sarah_klobe]

We are currently using SAP Analysis, Office Edition 1.4.10 and are having an issue with using SSO directly to BW.

If we create a workbook, connected directly to our BW 7.4 Sandbox and BW 7.3 QA environments using SSO and then send the workbook to some people in the group, they are being prompted for their userid and password, rather than automatically using SSO to connect to BW. I can send the workbook to other people and it uses SSO, like I would expect it to. We have confirmed that the users experiencing the issue have valid logins to our environments, their account is not locked and their password is valid.

When we create a new workbook, connected directly to our BW 7.3 Production environment using SSO and then send the workbook to others, it automatically detects that we want to use SSO and logs them in with their credentials.

In this example, we have 64-bit Analysis for Office deployed using Microsoft RDS. It seems to work fine if we use a locally installed version of 32-bit Analysis for Office.

We are interested in understanding where in the workbook the connection information is stored. We opened all of the xml files included in the xlsx file and do not see the BW system we are connecting to or whether we should be using SSO or non-SSO.

Can anyone point me to information on how the connection information is stored with the workbook? Any information will be helpful while we work through the troubleshooting.

Thanks!

Sarah

[barton_wold · Accepted solution]

Sarah is out of town so I will update this post since we are working together on this.  First, to answer Gaurav's question:

- We are creating the workbook in AFO by selecting the datasource and bypassing the BOBJ platform.  This will prompt for you to select the system, which I believe it gets from SAPGui.  We select the SSO version of the system, run, and save the query.  The person who created the query can refresh just fine, but another person cannot refresh the query.  They are prompted to sign in to the non-SSO version of the system.

- This is random.  Meaning that I can create a workbook in our production system and share with others to refresh and vise-versa.  We also have certain users who can refresh workbooks created by others, but some of us get prompted to sign in.

From Diego's comments:

- First, this was really helpful for us to know what/where the system info is being saved.  So thank you!

- Second, when I look at the contents of the of this file I can see that it is saving the SSO version of the system.  Also, I do see a flag for 'SsoEnabled' set to False, however, when I compare this to a workbook that does refresh this option is also set to False.

My high level understanding of how the process for authenticating a workbook is as follows:

1) When you refresh the workbook, it goes out to the SAP system to get data.  It is turned back asking for Kerberos ticket.

2) The system then goes out to a Domain Controller to request Kerberos ticket and is given one.

3) The system tries again to login into SAP system using the Kerberos ticket.

We've used Wireshark to compare a workbook in our RDS system that does work with one that doesn't.  For the one that does work we see the authentication pattern described above.  For the one that doesn't refresh it doesn't even attempt to contact the SAP system.  Thus why we are prompted to sign directly into the system via non-SSO.

At this point we have no other ideas on how to troubleshoot and are going to open a customer incident.  However, if anyone has some other ideas for us to look at please let us know.  Thanks!

[Former Member · Accepted solution]

Hi Barton Wold,

If you are using the local connection, change it to BICS connection, that will fix SSO issue

Thanks,

Bhargav

[barton_wold · Accepted solution]

I have resolved the issue.  Apparently if you select 'Allow client and Language Selection for SSO Logon' in Settings->Advanced Settings when you save the workbook it works.  You do get prompted to change the client ID or language, (similar to when you log on to a system for the first time), but at least it selects the SSO connection.  Here is link to a discussion that I found this at: http://sap.sdn.com/docs/DOC-62466

[jamesd_stachowiak · Accepted solution]

FYI the link you reference seems to have moved (at least from my view) to http://scn.sap.com/docs/DOC-62466

Thanks for providing the information.

[Former Member]

This message was moderated.

[sarah_klobe]

Thanks Bhargav and Diego for your help with this issue!

[Former Member]

Hi Sarah - You can go to the Information tab in Analysis workbook to see the sytem/query that workbook is connecting to as well as user it is using...

If you are saying, the users are able to do SSO to your Prod system but not to QA & Sandbox, did you validate if their user account settings are the same across all systems? I am not totally sure what SSO/SNC mechanism is being used..

And what did you mean by "If we create a workbook, connected directly to our BW 7.4 Sandbox and BW 7.3 QA environments using SSO".. How are you creating the workbook? When you login to Analysis office and do a select datasource, you bypass the BI (BOBJ) platform login and connect directly to the SAP BW system.. Does it prompt you for username & pwd here or it does a SSO for you?

Thanks

Gaurav

[former_member151004]

Hi Sarah,

My first suggestion is to check if the system ID is the same on the target workstation. Once you create a workbook on your workstation you will need the same ID on the target one.

Thanks,
Diego Ferrary

[sarah_klobe]

We are both running from the same RDS Server so we definitely have the same System IDs.

Do you know how the workbook knows which System ID to connect to?

Thanks,

Sarah

[former_member151004]

Hi Sarah,

I will start from the GUI. Analysis for Office will respects custom paths from SAPGUI Options. The search order for all config files used in AO is now as follows:

1) SAPLOGON_INI_FILE environment variable
2) SAPGUI Options custom path (from registry)
3) SAPGUI 720 default path (%APPDATA%\SAP\Common)
4) SAPGUI 640 default path (%WINDIR%, usually C:\Windows)

So on the SAPGUI you must have the same ID that you have from the original workstation.

About your question, Analysis record the connection information internally. I will not recomend you to change it manually but you can check that information on a xml file called "customProperty2".

Kind regards,
Diego Ferrary

[Former Member]

Hi Diego

I'm writing to you since you seem to have been dealing a lot with analysis for office.

Problem is related to how master data is displayed on reports. If we open the report straight from BO then master data is displayed on the default language that is set on SAP for the user but if the user schedule the reports then master data will come in English only no matter what language is set as default in SAP for that user.

What I notice is that if I set the option 'Allow client and language selection for SSO logon' then language EN always shows up. Do you know why this popup shows up always in English?

I'm guessing that maybe that's the reason why always is scheduled in English. 

[former_member151004]

Hi Mariano,

I was out and I couldn't reply you earlier.
Could you please confirm that the your question got answered by the below replies?

Thanks,
Diego.

[Former Member]

Hi

No is a different issue I'm facing. The workbook is always scheduled in English but I have an open ticket with SAP already so lets see what they can find.