ECC 6.0 and BO Single Sign on

[Former Member]

Hello All

Our scenario.

We have ECC 6.0 WebDynpro for ABAP application and standalone BO server.

The integration kit for SAP is intalled in BO server. And all the necessary roles and user have been uploaded.

There is a link in our WDA application which hits and opens a BO server login page for SAP type system.

We need to do SSO so that users don't have to login into BO system coming from ECC.

We haven't configured SNC yet, but have no confirmation that doing SNC will solve this issue.

Please advice.

[IngoH · Accepted solution]

Hi,

SNC shouldn't be needed. The SSO is possible based on SSO tickets (MYSAPSSO2).

Your ABAP server should be able to generate the ticket and you need to have the SAP Authentication configured on the BOE Server

Ingo

[Former Member · Accepted solution]

Thanks for the reply Ingo. It would be great if you could point me to some document as to how to have SAP Auth Configured in BOE.

We had aleady installed SAP BO Kit, and all the roles have been migrated to BOE server. Only SSO is remaining.

Thanks in advance.

[IngoH · Accepted solution]

Hi,

hope that this one helps.

Ingo

[Former Member · Accepted solution]

Ingo

Thanks for your reply.

In the blog you had mentioned setting up profile parameters.

login/create_sso2_ticket 1 or 2

login/accept_sso2_ticket 1

But where do I put the generated login tickets from ECC in BO system. Or after doing all the SAP related configuration in BO, and changing those profile parameters, the SSO will just start working from my WebDynpro ABAP application.

[IngoH · Accepted solution]

Hi,

when the server is generating the ticket and you did configure the BOE Server on the SAP Authentication (CMC) for the SAP system then the ticket will be leveraged automatically.

Ingo

[Former Member]

Our issue was primarlily solved by upgrading BO from 3.0 to 3.1 ( I'm guessing here the major release of version).

Once the upgrade was done and the config was in place in BO CMS, single sign on was established.

[Former Member]

Please confirm the following points about this message:

1) SNC is not required for SSO between BOBJ and SAP BI (although the BOBJ documentation says it is)

2) In the SAP BI system, all I need to do is install SAPCryptoLib in the usual way and enable the login/[accept|create]_sso_ticket parameters (and then restart the SAP system)

3) Business objects will then automatically recognizes that SSO ticket logins are possible without any config on the BOBJ side and provides access to BI data using the SAP authorizations of the actual end user and not of the BOBJ super user.

This seems a bit too magical to me, considering how clunky the rest of the BOBJ stuff is...

Russ...

[IngoH]

Hi,

1) SNC is not required for SSO between BOBJ and SAP BI (although the BOBJ documentation says it is)

>> The documentation does not make such a statement and SNC is not required for simple SSO workflows.

2) In the SAP BI system, all I need to do is install SAPCryptoLib in the usual way and enable the login/create_sso_ticket parameters (and then restart the SAP system)

>> That depends on what you would like to do with SNC - client side authentication or server side trust. the Server side trust is well explained in the installation guides.

3) Business objects will then automatically recognizes that SSO ticket logins are possible without any config on the BOBJ side and provides access to BI data using the SAP authorizations of the actual end user and not of the BOBJ super user.

>> The reason for Server Side trust is explained - it has to do with impersonation workflows.

Ingo