Setting up SSO between 2 EP7.0 Portals to get to BI data on the 1 Portal

[Former Member]

Hi. I have EP 7.0 SPS21(P1) implemented with SSO enabled between the AD(kerberos) & this Portal(SAP logon tickets, datasource = UME). All users logon to the AD & have SSO onto the Portal(P1). I now have a dual stack BI 7.0 implementation(BIP1), (datasource = ABAP). I want all users to logon to the AD, & then to Portal(P1) & then they must have the ability to click on a Link in P1(URL iView) that points to the dual stack(BIP1) & not have to get the logon screen for (BIP1). So I require SSO to be enabled on the dual stack(BIP1). I have followed the documentation as per(http://help.sap.com/saphelp_nw70ehp1/helpdata/en/45/2f873d1ca96d7be10000000a114a6b/content.htm), with no success. Does anyone have a link/documentation/explain as to how this can be done?

Kind Regards,

M.

[Former Member]

Hi all.

I went thru the trace files from the diagtool & this hepled me to see what was wrong. I amended the trustediss4=OU=J2EE,CN=DP9, instead of trustediss=CN=DP9. I also used the following order for the logon modules.

1. EvaluateTicketLoginModule SUFFICIENT

2. EvaluateAssertionTicketLoginModule SUFFICIENT

3. BasicPasswordLoginModule REQUISITE

4. CreateTicketLoginModule OPTIONALNow I am able to SSO via the Issuing Portal.

Now I am able to SSO via the Issuing Portal.

Kind Regards,

Melvin

[Former Member]

Hi. Is this report not for intergration between the portal & BI? Anyway see below for the results:-

Create RFC Destination in J2EE Engine

Use

In this activity you create an RFC destination in the J2EE Engine.

The RFC destination in the J2EE Engine is an RFC server that is called by the BI system as the RFC client. The connection is required in order to display content from the portal in the BI system. The RFC destination is used for the protal in RFC destinations.

You need this setting for all integration scenarios.

Activities

Execute the following steps to create an RFC destination in the J2EE Engine:

1. Start the Visual Administrator with <PORTAL_DIRECTORY>\admin\go.bat.

2. Connect to the portal server.

3. Select <SID>/Server<#>/Services/Jco RFC Provider from the hierarchy.

4. Maintain an RFC destination:

Program ID: <PORTAL_HOSTNAME>_PORTAL_<SID>

Gateway host: <GATEWAY_HOST>

Gateway service: sapgw<SYSTEM_NUMBER>

Number of processes (1..20): 20

Application server host: see gateway host

System number: <SYSTEM_NUMBER>

Client: <BW_MANDANT>

Language: EN

User: <USER> (user in the BW system)

Password: <PASSWORD>

5. Copy the RFC destination to the available RFC destinations by choosing Set.

6. Start the RFC server by choosing Start.

Overview

This activity is a step in report Maintain Settings for Integration into the Portal (RSPOR_SETUP). This report supports you step-by-step in maintaining the settings for integrating a BI system and a portal. The individual steps can be called directly with transaction codes RSPOR_CUST01 to RSPOR_CUST13.

The necessary parameters are requested upon execution. The individual parameters are described in the documentation on Integration into the Portal.

Also....

Status 2: Create RFC Destination for Portal Different ABAP and Java support packages. Combination of support packages invalid.

Status 9: Export Portal Certificate from Portal No check with Portal SID <PORTAL_SID>

Status 10: Import Portal Certificate into BI No check with Portal SID <PORTAL_SID>

Plse advise.

Kind regards,

Melvin

[Former Member]

Hi.

Yes both servers are on the same Domain & I am using my own ID to logon(id's & P/w's are Identical). The only difference w.r.t. the ID's is that my ID on (P1) is from the Domain & my ID on (BIP1) is on the ABAP portion of (BIP1) - due to user datasource = ABAP.

Plse advise.

Kind regards,

Melvin

[Former Member]

Melvin,

run this report in BI in tcode: SE38 RSPOR_SETUP and tell me the error message u get ??

[Former Member]

Hi....

I adjusted the logon modules in the following order & restarted SAP....

1. EvaluateAssertionTicketLoginModule SUFFICIENT

2. EvaluateTicketLoginModule SUFFICIENT

3. BasicPasswordLoginModule REQUISITE

4. CreateTicketLoginModule OPTIONAL

I then logged on to (P1) & clicked on the link that connects to

(BIP1) - I get the logon screen. The link that I am using

= "http://ndcderp55.sasol.com:50000/irj/servlet/prt/portal/prtroot/pcd!

3aportal_content!2fcom.sap.pct!2fplatform_add_ons!2fcom.sap.ip.bi!

2fiViews!2fcom.sap.ip.bi.bex?TEMPLATE=Z0IC_C03_W0001&DUMMY=0"

Please advise.

[Former Member]

Hi,

Are both the portals on the same domain and the user Ids same?

Regards,

Vijith

[Former Member]

Tx John.

I have restarted the SAP instance after implementing the changes in VA. The URL = http://ndcderp55.sasol.com:50000/irj/servlet/prt/portal/prtroot/pcd!3aportal_content!2fcom.sap.pct!2...

[Former Member]

Have you tried restarting your BI portal since making the changes?

Does your Portal Iview call a URL that looks anything like this?

http://portalhostname:5xxxx/irj/servlet/prt/portal/prtroot/pcd!3aportal_content!2fcom.sap.pct!2fplat...

I'm not a Basis person, so I can't really help you beyond that.

[Former Member]

Tx. I have now tested SSO between (P1) & the backend(BIP1) - this works fine. I still require SSO to work between the 2 portals - i.e. between (P1) and (BIP1). Like I said initially, the user logs onto the Domain, then click onto the link for the Portal(P1) - auto logs on due to SSO, & then clicks on a BI query link in (P1) that points to (BIP1 - Portal) - currently not working. Please advise.

Kind Regards,

M

[Former Member]

Hi John. Tx for your response. I did not use the sso wizard because I got an error. I have imported the Cert(DP9.crt) from (P1) into (BIP1) via VA. I also amended the UME properties as advised. I then tested via a URL iview on (P1) to (BIP1)(http://[srv-name]:port/irj/portal) - I get the logon screen for (BIP1). Please advise. I have this is screenshots in a document - is it possible to upload a document?

Kind regards,

M

[p330068]

Hi Melvin,

Please check this document for configuring your scenario in [BI System|http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/00c4742a-3a4b-2b10-b4ae-b03d08bcde6e?overridelayout=true].

Hope this will helps you.

Thanks

Arun

[Former Member]

I had a similar requirement a while ago in some EP and BI 7 systems, and was given the following advice:

"You can do this by exporting the main portal certificate and importing it into BW JAVA stack using url http://bw_host_name:5XX00/sso2 as below. This will make bw java stack trust main port java stack and allow sso coming in as long as user id matches. (note: domain names for two java stacks have to be same)

We also had to set parameter ume.logon.force_password_change_on_sso to false on the BI portal using Visual Administrator. Otherwise if you create all your users in BI with an intial password they would be prompted to change it the first time they try to run one of the BI reports.