Trusted Authentication in Java SDK using shared secret

[former_member593299]

I posted same question to support and posting to the public forums too to see if someone else has experienced similar.

We are trying to expose BOE (Version 4 SP6) Documents/Reports inside an internal/custom Web application. Users are already authenticated to our Web application, so we try to do a SSO integration, where they don't have to login again to see the reports, but have our application trusted by BOE server and login users to BOE automatically.

We think the Trusted Authentication method would work for this so we configured the CMS server as such and generated a TrustePrincipal.conf file. We built a simple Spring Boot Java app that is using the BOE Java SDK and takes an environment variable with the folder where the TrustedPrincipal.conf is located

-Dbobj.trustedauth.home=C:/proj/resources

The Java app calls this method to authenticate:

trustedPrincipal = sessionMgr.createTrustedPrincipal(“johns”, "ourCmsServer:6400" );

The method returns this error:

Enterprise authentication could not log you on. Please make sure your logon information is correct. (FWB 00008)

We looked in the log files generated by the server for this operation and see these messages in a sequence:

• BCM error: Could not finish CCL decryption
• failed UTF8 -> UCS2 conversion
• CEnterprise::AcceptLogin: SCrypt: failed to decrypt client's request for trusted authentication.
• Invalid password for user johns

We are not sure how to troubleshoot this further. Can’t tell if our Java app is reading the TrustedPrincipal.conf file correctly and if the secret it contains is sent to the server. We tried to use an overload of the “createTrustedPrincipal” that takes the secret in the .conf file as the third argument, but that did not work either, the results were the same. We need help to troubleshoot this and make the trusted authentication work. Thank you

[former_member593299 · Accepted solution]

I figured it out, I was using the old version of the SDK, 14.2.4.2410, while the server was on the newer one 14.2.6.2891 (BOE V4 SP6).

BTW, in case someone needs it, I think the the jar files needed to run the Trusted Auth logon are these

1. aspectjrt.jar
2. bcm.jar
3. ceaspect.jar
4. cecore.jar
5. celib.jar
6. cesession.jar
7. corbaidl.jar
8. cryptojce.jar
9. cryptojFIPS.jar
10. ebus405.jar
11. jcmFIPS.jar
12. logging.jar
13. TraceLog.jar

This can be closed, thank you.

[former_member203619]

Hi Florin,

A couple comments:
1. The UTF8 error can occur if you have a really old version of Java (Like 1.3). You should be using at least 1.7 or 1.8

2. The BCM error almost always results from mismatched jar files. Specifically the crypto jar files (certjFIPS.jar, cryptojFIPS.jar, ssljFIPS.jar, jcmFIPS.jar, cryptojce.jar) You need to ensure that you are using the exact same jar files that are located on your BOE server. I strongly recommend that you remove all jar files from your application and then get fresh copies of them from your BOE server. (Use the developer guide to see which ones) You can find them in the folder: <BOE Install Folder>\SAP BusinessObjects Enterprise XI 4.0\java\lib

3. Given that it failed when passing the sharedsecret in code - the issue is most likely a runtime issue. Get your application working first using the code method - then see about placing the sharedsecret file.

Note: A common issue with sharedsecret is on the sharedsecret page in the CMC if you click on the "Download Shared Secret" button, but don't also click on the "Update" button you end up with an incorrect sharedsecret file. Make sure your sharedsecret is correct by going to the Trusted Auth page in the CMC, click the "Update" button, and then click the download button and verify that the shared secret is correct.

Shawn