SSO and RFC

I am trying to use SSO from EP to a BW 3.5 instance using C / RFC (the sso2 cookie is obtained via a servlet). I am using RfcOpenEX and the parameters seems ok:

TYPE=3 CLIENT=... USER=... MYSAPSSO2= ... LANG=EN ASHOST=... SYSNR=... GWHOST=... GWSERV=...

in the BW rfc trace I can clearly see the SSO cookie, but I get an error message "user name or password invalid"

can someone tell me what I am doing wrong ?

Thanks.