Skip to Content
0

BOBI4.1SP7+Kerberos SSO+WInAD+Firefox v52 no more work

Mar 21, 2017 at 04:32 PM

235

avatar image
Former Member

Hello,

Since Firefox version 52, Kerberos SSO on Windows AD no more works with BO BI 4.1 SP7 Launchpad.

Did anybody notice this regression ?

Any solution ?

Regards,

Stéphane.

10 |10000 characters needed characters left characters exceeded
* Please Login or Register to Answer, Follow or Comment.

8 Answers

Best Answer
avatar image
Former Member May 03, 2017 at 02:56 PM
0

Hello,

FYI, as we can guess with the symptom, it's actually a regression with the browser.

I got in touch with guys from Firefox dev team.

They admit that there is a regression since FF52.

They have corrected the problem in a patch I've tested and it's OK (FF 54.0b4 , 32-bit).

It should be officially integrated in FF 55.

So we can go on with Firefox and Kerberos SSO with BILP. :o)

Regards,

Stéphane.

Share
10 |10000 characters needed characters left characters exceeded
Imtiaz Karedia Mar 21, 2017 at 04:40 PM
0

Check if the your URLs (hostname and port) are in below parameters of firefox (about:config)

network.negotiate-auth.delegation-uris

network.negotiate-auth.trusted-uris

Share
10 |10000 characters needed characters left characters exceeded
avatar image
Former Member Mar 21, 2017 at 05:16 PM
0

Yes, all is OK.

These two parameters are effective till Firefox 51 but no more work from Firefox 52 and above. :(

Share
10 |10000 characters needed characters left characters exceeded
avatar image
Former Member Mar 22, 2017 at 03:37 PM
0

Hello,

Could anybody with such a same environment could test and tell me if this regression is reproduced with Firefox 52 and above ?

NB: you can use Firefox portable version from

http://portableapps.com/apps/internet/firefox_portable

if you don't want to "pollute" your PC.

Thanks.

Stéphane.

Share
10 |10000 characters needed characters left characters exceeded
avatar image
Former Member Mar 29, 2017 at 07:49 PM
0

Nobody can test ? :(

Share
10 |10000 characters needed characters left characters exceeded
Tim Ziemba
Mar 30, 2017 at 06:52 PM
0

Tested, works, same resolution it's always been KBA 1263764. I touched it up a bit but it was accurate.

Regards,

Tim

Share
10 |10000 characters needed characters left characters exceeded
avatar image
Former Member Apr 19, 2017 at 08:33 PM
0

Same here Single signon no longer works with Firefox 52 or higher. have been running with config from KBA 1263764 for several years without issue.

Share
10 |10000 characters needed characters left characters exceeded
Tim Ziemba
Apr 25, 2017 at 03:50 PM
0

Just to clarify the bigger picture here. AD SSO is Microsoft spnego, it is enabled for SAP BI in Microsoft AD and java SDK, it is not something created or developed by SAP/BI.

Each browser creates it's own method of performing spnego, of course Microsoft IE has the easiest implementation. Google Chrome and firefox can also perform it. When a browser fails this is not somethign caused by SAP/BI but something wrong between the browser and Microsoft (usually configuration). Again I tested this version and saw no problems. so if it's failing there is most likely an environment issue, or a 3rd party problem with the browser.

Packet scanning the SSO attempt will often sort out the problem.

Regards

Tim

Share
10 |10000 characters needed characters left characters exceeded