SAP Business Intelligence platform 4.0 Support Package 2 Business Intelligence Software Administrator Guide

Business Intelligence Platform Administrator Guide
■ SAP BusinessObjects Business Intelligence platform 4.0 Support Package 2
2011-05-06
Copyright
© 2011 SAP AG. All rights reserved.SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP
Business ByDesign, and other SAP products and services mentioned herein as well as their respective
logos are trademarks or registered trademarks of SAP AG in Germany and other countries. Business
Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web
Intelligence, Xcelsius, and other Business Objects products and services mentioned herein as well
as their respective logos are trademarks or registered trademarks of Business Objects S.A. in the
United States and in other countries. Business Objects is an SAP company.All other product and
service names mentioned are the trademarks of their respective companies. Data contained in this
document serves informational purposes only. National product specifications may vary.These materials
are subject to change without notice. These materials are provided by SAP AG and its affiliated
companies ("SAP Group") for informational purposes only, without representation or warranty of any
kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The
only warranties for SAP Group products and services are those that are set forth in the express
warranty statements accompanying such products and services, if any. Nothing herein should be
construed as constituting an additional warranty.
2011-05-06
Contents
3
Chapter 1
Getting Started......................................................................................................................17
1.1
1.1.1
1.1.2
1.1.3
1.2
1.2.1
1.2.2
1.2.3
About this help.......................................................................................................................17
Chapter 2
Architecture...........................................................................................................................25
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.1.10
2.1.11
2.1.12
2.1.13
2.2
2.3
2.3.1
2.3.2
2.3.3
2.3.4
2.4
Architecture overview............................................................................................................25
Who should use this help?.....................................................................................................17
About SAP BusinessObjects Business Intelligence platform .................................................17
Variables................................................................................................................................18
Before you start.....................................................................................................................18
Key concepts.........................................................................................................................18
Key administrative tools.........................................................................................................21
Key tasks...............................................................................................................................22
System overview....................................................................................................................26
Databases..............................................................................................................................27
Servers..................................................................................................................................28
Web application servers.........................................................................................................29
Software Development Kits...................................................................................................30
Data sources.........................................................................................................................33
Language support..................................................................................................................34
Authentication and single sign-on...........................................................................................35
SAP integration......................................................................................................................37
Lifecycle management (LCM).................................................................................................38
Integrated version control.......................................................................................................39
Permanent data......................................................................................................................39
Upgrade path.........................................................................................................................39
Conceptual tiers.....................................................................................................................40
Services and servers..............................................................................................................41
Services.................................................................................................................................43
Service categories.................................................................................................................50
Server types..........................................................................................................................53
Servers..................................................................................................................................56
Client applications..................................................................................................................59
2011-05-06
Contents
4
2.4.1
2.4.2
2.4.3
2.4.4
2.5
2.5.1
2.5.2
2.5.3
2.5.4
Installed with SAP BusinessObjects Business Intelligence Platform Client Tools....................60
Chapter 3
Managing Licenses...............................................................................................................83
3.1
3.1.1
3.1.2
3.1.3
3.2
3.2.1
Managing License keys..........................................................................................................83
Chapter 4
Managing Users and Groups................................................................................................87
4.1
4.1.1
4.1.2
4.1.3
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.2.9
4.2.10
4.2.11
4.2.12
4.2.13
4.2.14
4.2.15
4.3
Account management overview..............................................................................................87
Installed with SAP BusinessObjects Business Intelligence Platform.......................................64
Available separately...............................................................................................................65
Web application clients..........................................................................................................66
Information Workflows...........................................................................................................70
Authentication........................................................................................................................70
Scheduling.............................................................................................................................72
Viewing..................................................................................................................................77
On Demand...........................................................................................................................79
To view license information....................................................................................................83
To add a license key...............................................................................................................83
To view current account activity.............................................................................................84
Measuring licenses................................................................................................................84
To run a license audit.............................................................................................................85
User management..................................................................................................................87
Group management...............................................................................................................89
Available authentication types ...............................................................................................90
Managing Enterprise and general accounts............................................................................92
To create a user account........................................................................................................92
To modify a user account.......................................................................................................93
To delete a user account........................................................................................................94
To create a new group...........................................................................................................94
To modify a group's properties...............................................................................................95
To view group members.........................................................................................................95
To add subgroups..................................................................................................................95
To specify group membership................................................................................................96
To delete a group...................................................................................................................96
To enable the Guest account.................................................................................................97
Adding users to groups..........................................................................................................97
Changing password settings..................................................................................................99
Granting access to users and groups...................................................................................100
Controlling access to user inboxes.......................................................................................101
Configuring BI launch pad options........................................................................................101
Managing aliases.................................................................................................................105
2011-05-06
Contents
5
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
To create a user and add a third-party alias..........................................................................105
Chapter 5
Setting Rights......................................................................................................................109
5.1
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.3
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.4
5.4.1
5.5
5.5.1
5.5.2
5.6
How rights work in BI platform.............................................................................................109
Chapter 6
Securing BI Platform...........................................................................................................137
6.1
6.2
6.3
6.4
Security overview ................................................................................................................137
To create a new alias for an existing user.............................................................................106
To assign an alias from another user....................................................................................106
To delete an alias.................................................................................................................107
To disable an alias................................................................................................................107
Access levels.......................................................................................................................109
Advanced rights settings......................................................................................................110
Inheritance...........................................................................................................................111
Type-specific rights..............................................................................................................116
Determining effective rights.................................................................................................117
Managing security settings for objects in the CMC..............................................................118
To view rights for a principal on an object.............................................................................118
To assign principals to an access control list for an object....................................................119
To modify security for a principal on an object......................................................................119
To set rights on a top-level folder in BI platform....................................................................120
Checking security settings for a principal.............................................................................120
Working with access levels..................................................................................................123
Choosing between View and View On Demand access levels.............................................125
To copy an existing access level..........................................................................................126
To create a new access level...............................................................................................126
To rename an access level...................................................................................................127
To delete an access level.....................................................................................................127
To modify rights in an access level.......................................................................................127
Tracing the relationship between access levels and objects.................................................128
Managing access levels across sites....................................................................................129
Breaking inheritance.............................................................................................................130
To disable inheritance...........................................................................................................131
Using rights to delegate administration.................................................................................131
Choosing between Modify the rights users have to objects options.....................................133
Owner rights........................................................................................................................134
Summary of recommendations for rights administration.......................................................134
Disaster recovery planning...................................................................................................137
General recommendations for securing your deployment.....................................................138
Configuring security for bundled third-party servers.............................................................139
2011-05-06
Contents
6.5
6.5.1
6.5.2
6.6
6.6.1
6.7
6.7.1
6.7.2
6.8
6.9
6.9.1
6.9.2
6.9.3
6.9.4
6.9.5
6.10
6.11
6.11.1
6.12
6.12.1
6.12.2
6.12.3
6.13
6.13.1
6.13.2
6.14
6.14.1
6.14.2
6.15
6.15.1
6.15.2
6.16
6.16.1
6.16.2
6.17
6.17.1
6.17.2
6.17.3
6.17.4
6.17.5
6.18
6
Active trust relationship........................................................................................................139
Logon tokens.......................................................................................................................139
Ticket mechanism for distributed security.............................................................................140
Sessions and session tracking.............................................................................................140
CMS session tracking..........................................................................................................141
Environment protection........................................................................................................141
Web browser to web server.................................................................................................142
Web server to BI platform....................................................................................................142
Auditing security configuration modifications .......................................................................142
Auditing web activity............................................................................................................143
Protection against malicious logon attempts.........................................................................143
Password restrictions...........................................................................................................143
Logon restrictions................................................................................................................144
User restrictions..................................................................................................................144
Guest account restrictions...................................................................................................144
Processing extensions.........................................................................................................145
Overview of BI platform data security...................................................................................145
Data processing security modes..........................................................................................146
Cryptography in BI platform..................................................................................................148
Working with cluster keys....................................................................................................148
Cryptographic Officers.........................................................................................................150
Managing cryptographic keys in the CMC............................................................................152
Configuring servers for SSL.................................................................................................156
Creating key and certificate files..........................................................................................156
Configuring the SSL protocol...............................................................................................159
Understanding communication between BI platform components.........................................163
Overview of BI platform servers and communication ports...................................................163
Communication between BI platform components ...............................................................166
Configuring BI platform for firewalls......................................................................................173
To configure the system for firewalls....................................................................................173
Debugging a firewalled deployment......................................................................................176
Examples of typical firewall scenarios...................................................................................178
Example - Application tier deployed on a separate network..................................................178
Example - Thick client and database tier separated from BI platform servers by a firewall.....180
Firewall settings for integrated environments.......................................................................182
Specific firewall guidelines for SAP integration.....................................................................183
Firewall configuration for JD Edwards EnterpriseOne integration..........................................185
Specific firewall guidelines for Oracle EBS...........................................................................187
Firewall configuration for PeopleSoft Enterprise integration .................................................188
Firewall configuration for Siebel integration..........................................................................190
BI platform and reverse proxy servers .................................................................................191
2011-05-06
Contents
7
6.18.1
6.18.2
6.19
6.19.1
6.19.2
6.19.3
6.19.4
6.19.5
6.20
6.20.1
6.20.2
6.20.3
Supported reverse proxy servers ........................................................................................191
Chapter 7
Authentication.....................................................................................................................203
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2.4
7.2.5
7.3
7.3.1
7.3.2
7.3.3
7.4
7.4.1
7.4.2
7.4.3
7.4.4
7.4.5
7.5
7.5.1
7.5.2
7.5.3
7.5.4
7.5.5
7.5.6
Authentication options in BI platform....................................................................................203
Understanding how web applications are deployed .............................................................192
Configuring reverse proxy servers for BI platform web applications......................................192
Detailed instructions for configuring reverse proxy servers..................................................192
To configure the reverse proxy server..................................................................................193
To configure Apache 2.2 reverse proxy server for BI platform .............................................193
To configure WebSEAL 6.0 reverse proxy server for BI platform .........................................194
To configure Microsoft ISA 2006 for BI platform .................................................................195
Special configuration for BI platform in reverse proxy deployments......................................196
Enabling reverse proxy for web services..............................................................................196
Enabling the root path for session cookies for ISA 2006......................................................199
Enabling reverse proxy for SAP BusinessObjects Live Office...............................................201
Primary authentication..........................................................................................................203
Security plug-ins..................................................................................................................205
Single sign-on to BI platform................................................................................................205
Enterprise authentication......................................................................................................208
Enterprise authentication overview.......................................................................................208
Enterprise authentication settings.........................................................................................208
To change Enterprise settings..............................................................................................209
Enabling Trusted Authentication...........................................................................................211
Configuring Trusted Authentication for the web application..................................................212
LDAP authentication............................................................................................................221
Using LDAP authentication..................................................................................................222
Configuring LDAP authentication..........................................................................................223
Mapping LDAP groups.........................................................................................................234
Windows AD authentication.................................................................................................238
Overview..............................................................................................................................238
Preparing for AD authentication (Kerberos)..........................................................................242
AD authentication single sign-on..........................................................................................252
Mapping AD groups and configuring AD authentication........................................................262
Troubleshooting Windows AD authentication.......................................................................267
SAP authentication...............................................................................................................268
Configuring SAP authentication ...........................................................................................268
Creating a user account for BI platform................................................................................269
Connecting to SAP entitlement systems..............................................................................270
Setting SAP Authentication options.....................................................................................272
Importing SAP roles.............................................................................................................277
Configuring Secure Network Connection (SNC)..................................................................281
2011-05-06
Contents
8
7.5.7
7.5.8
7.6
7.6.1
7.6.2
7.6.3
7.6.4
7.6.5
7.7
7.7.1
7.7.2
7.7.3
7.7.4
7.8
7.8.1
7.8.2
7.8.3
7.9
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
Setting up single sign-on to the SAP system........................................................................294
Chapter 8
Server Administration..........................................................................................................337
8.1
8.1.1
8.1.2
8.1.3
8.1.4
8.1.5
8.1.6
8.1.7
8.1.8
8.1.9
8.1.10
8.1.11
8.1.12
8.1.13
8.1.14
Server Administration...........................................................................................................337
Configuring SSO for SAP Crystal Reports and SAP NetWeaver..........................................298
PeopleSoft authentication....................................................................................................299
Overview..............................................................................................................................299
Enabling PeopleSoft Enterprise authentication......................................................................299
Mapping PeopleSoft roles to the BI Platform........................................................................300
Scheduling user updates......................................................................................................303
Using the PeopleSoft Security Bridge..................................................................................305
JD Edwards authentication...................................................................................................316
Overview..............................................................................................................................316
Enabling JD Edwards EnterpriseOne authentication..............................................................316
Mapping JD Edwards EnterpriseOne roles to BI Platform.....................................................317
Scheduling user updates......................................................................................................320
Siebel authentication............................................................................................................322
Enabling Siebel authentication..............................................................................................322
Mapping roles to BI platform................................................................................................323
Scheduling user updates......................................................................................................326
Oracle EBS authentication...................................................................................................327
Enabling Oracle EBS authentication......................................................................................328
Mapping Oracle E-Business Suite roles to BI platform..........................................................328
Unmapping roles .................................................................................................................333
Customizing rights for mapped Oracle EBS groups and users .............................................333
Configuring Single Sign-on (SSO) for SAP Crystal Reports and Oracle EBS........................335
Working with the Servers management area in the CMC.....................................................337
Managing servers by using scripts on Windows ..................................................................341
Managing servers on UNIX .................................................................................................341
Managing License keys........................................................................................................341
Measuring licenses..............................................................................................................343
Viewing and changing a server's status................................................................................344
Adding, cloning, or deleting servers......................................................................................349
Clustering Central Management Servers..............................................................................352
Managing server groups.......................................................................................................356
Assessing your system's performance.................................................................................360
Configuring server settings..................................................................................................365
Configuring server network settings.....................................................................................369
Managing Nodes..................................................................................................................377
Renaming a computer in an SAP BusinessObjects Business Intelligence platform deployment.397
2011-05-06
Contents
9
8.1.15
Using 32-bit and 64-bit third-party libraries with SAP BusinessObjects Business Intelligence
platform...............................................................................................................................398
8.1.16
Managing server and node placeholders..............................................................................398
Chapter 9
Managing Central Management Server (CMS) databases.................................................401
9.1
9.2
9.2.1
9.2.2
9.3
9.3.1
9.3.2
9.4
9.4.1
9.4.2
9.4.3
Managing CMS system database connections.....................................................................401
Chapter 10
Managing Web Application Container Servers (WACS).....................................................409
10.1
10.1.1
10.1.2
10.1.3
10.1.4
10.1.5
10.1.6
10.1.7
10.1.8
10.1.9
10.1.10
10.1.11
WACS.................................................................................................................................409
Chapter 11
Backing Up and Restoring..................................................................................................439
11.1
11.1.1
11.1.2
11.1.3
11.1.4
11.1.5
Backing up and restoring your system..................................................................................439
11.1.6
Recreating a SAP BusinessObjects Business Intelligence platform system when files are lost.448
Selecting a new or existing CMS database..........................................................................401
To select a new or existing CMS database on Windows......................................................402
To select a new or existing CMS database on UNIX............................................................402
Recreating the CMS system database.................................................................................403
To recreate the CMS system database on Windows............................................................403
To recreate the CMS system database on UNIX..................................................................404
Copying data from one CMS system database to another...................................................405
Preparing to copy a CMS system database.........................................................................405
To copy a CMS system database on Windows....................................................................406
To copy data from a CMS system database on UNIX..........................................................406
Web Application Container Server (WACS).........................................................................409
Adding or removing additional WACS to your deployment...................................................412
Adding or removing services to WACS................................................................................416
Configuring HTTPS/SSL......................................................................................................417
Supported authentication methods.......................................................................................421
Configuring AD Kerberos for WACS ...................................................................................422
Configuring AD Kerberos single sign-on ..............................................................................428
WACS and your IT environment...........................................................................................430
Configuring web application properties.................................................................................433
Troubleshooting...................................................................................................................433
WACS properties.................................................................................................................437
Conducting a system backup...............................................................................................440
Backing up server settings...................................................................................................441
Backing up Business Intelligence content.............................................................................443
Restoring your system.........................................................................................................444
Restoring lost or corrupt SAP BusinessObjects Business Intelligence platform files where a
backup is available...............................................................................................................448
2011-05-06
Contents
10
11.1.7
BackupCluster and RestoreCluster parameters...................................................................449
Chapter 12
Life Cycle Management......................................................................................................453
12.1
12.2
12.2.1
12.3
12.3.1
12.3.2
Lifecycle management console............................................................................................453
Chapter 13
Managing Applications.......................................................................................................463
13.1
13.1.1
13.1.2
13.1.3
13.2
13.2.1
13.3
13.3.1
13.3.2
13.3.3
13.4
13.4.1
13.4.2
13.4.3
13.4.4
13.4.5
Managing applications through the CMC..............................................................................463
Chapter 14
Managing Connections and Universes...............................................................................497
14.1
14.1.1
14.2
14.2.1
Managing connections.........................................................................................................497
Chapter 15
Monitoring...........................................................................................................................499
15.1
15.2
15.2.1
15.3
15.4
About Monitoring.................................................................................................................499
Version Management System settings for Lifecycle management console...........................453
Version Management System settings for Lifecycle management console...........................453
BIAR Engine Command-Line Tool.........................................................................................454
Using a properties file .........................................................................................................457
To use the BIAR Engine Command-Line Tool.......................................................................461
Overview..............................................................................................................................463
Common settings for applications........................................................................................464
Application-specific settings.................................................................................................465
Managing applications through BOE.war properties.............................................................480
The BOE war file..................................................................................................................480
Customizing BI launch pad and OpenDocument logon entry points......................................488
BI launch pad and OpenDocument file locations...................................................................489
To define a custom logon page............................................................................................490
To add trusted authentication at logon..................................................................................491
Configuring BEx Web Integration .........................................................................................491
Starting a Server for BEx Web Applications ........................................................................493
Starting a Standalone Server for BEx Web Applications ......................................................493
Configuring Server Settings.................................................................................................493
Checking Connection to BW System ..................................................................................494
Configuring a connection between BEx web application designer and BI platform................495
To delete a universe connection...........................................................................................497
Managing universes.............................................................................................................498
To delete universes..............................................................................................................498
Monitoring terms..................................................................................................................499
Architecture.........................................................................................................................500
Cluster support for monitoring server...................................................................................503
Metrics................................................................................................................................504
2011-05-06
Contents
11
15.5
15.5.1
15.6
15.6.1
15.6.2
15.7
15.8
15.8.1
15.8.2
15.8.3
15.8.4
15.8.5
15.8.6
Configuration properties.......................................................................................................512
Chapter 16
Auditing...............................................................................................................................525
16.1
16.2
16.2.1
16.2.2
16.2.3
16.3
16.3.1
Overview..............................................................................................................................525
Chapter 17
Platform Search...................................................................................................................559
17.1
17.2
17.3
17.4
17.4.1
17.4.2
17.5
17.6
17.7
17.8
17.9
17.10
17.11
17.12
17.12.1
17.12.2
Overview..............................................................................................................................559
JMX end point URL..............................................................................................................515
Integrating with other applications........................................................................................516
Integrating the monitoring application with IBM Tivoli............................................................517
Integrating the monitoring application with SAP Solution Manager ......................................520
Creating Universe for Derby Database.................................................................................520
Troubleshooting...................................................................................................................521
Dashboard...........................................................................................................................521
Alerts...................................................................................................................................522
Watchlist..............................................................................................................................522
Probes.................................................................................................................................523
Metrics................................................................................................................................523
Graph...................................................................................................................................524
CMC Auditing page.............................................................................................................531
Auditing Status....................................................................................................................531
Configuring Auditing events.................................................................................................533
Auditing Data Store configuration settings...........................................................................535
Audit events.........................................................................................................................536
Audit events and details.......................................................................................................543
Architecture.........................................................................................................................559
Cluster support for Platform Search.....................................................................................561
SDK and Open Search.........................................................................................................561
Platform Search SDK...........................................................................................................562
Open Search........................................................................................................................562
Configuring Application Properties.......................................................................................564
Searchable Content Types...................................................................................................568
Suggested Queries..............................................................................................................570
Facets..................................................................................................................................571
Multilingual Support.............................................................................................................571
Suggestions.........................................................................................................................572
Federating Search Results from SAP BusinessObjects Explorer..........................................572
Search-time Integration with SAP NetWeaver Enterprise Search.........................................572
Creating a Connector in SAP NetWeaver Enterprise Search ...............................................573
Importing a User's Role in SAP BusinessObjects Enterprise Authentication.........................574
2011-05-06
Contents
12
17.12.3
17.13
17.14
17.15
Searching from NetWeaver Enterprise Search.....................................................................574
Chapter 18
Federation...........................................................................................................................579
18.1
18.2
18.2.1
18.2.2
18.2.3
18.2.4
18.2.5
18.2.6
18.2.7
18.2.8
18.2.9
18.2.10
18.2.11
18.2.12
18.2.13
18.2.14
18.2.15
18.2.16
18.2.17
18.3
18.3.1
18.3.2
18.3.3
18.3.4
18.3.5
18.4
18.4.1
18.4.2
18.4.3
18.5
18.6
18.7
18.7.1
18.7.2
18.8
Federation............................................................................................................................579
Auditing................................................................................................................................575
Indexing Failure Listing.........................................................................................................576
Troubleshooting...................................................................................................................576
Federation terms..................................................................................................................580
BI application .......................................................................................................................580
Destination site ...................................................................................................................581
Local....................................................................................................................................581
Locally run completed instances ..........................................................................................581
Multiple origin sites .............................................................................................................581
One-way replication .............................................................................................................581
Origin site ...........................................................................................................................582
Remote................................................................................................................................582
Remote connection..............................................................................................................582
Remote scheduling..............................................................................................................582
Replication...........................................................................................................................582
Replication job.....................................................................................................................582
Replication list......................................................................................................................583
Replication object.................................................................................................................583
Replication package.............................................................................................................583
Replication refresh...............................................................................................................583
Two-way replication..............................................................................................................583
Managing security rights......................................................................................................584
Rights required on the origin site..........................................................................................584
Rights required on the destination site.................................................................................585
Federation-specific rights.....................................................................................................586
Replicating security on an object..........................................................................................588
Replicating security using access levels...............................................................................588
Replication types and mode options.....................................................................................589
One-way replication .............................................................................................................589
Two-way replication .............................................................................................................589
Refresh from origin or refresh from destination....................................................................590
Replicating third-party users and groups...............................................................................591
Replicating universes and universe connections...................................................................592
Managing replication lists.....................................................................................................593
Creating replication lists.......................................................................................................594
Modifying Replication Lists...................................................................................................596
Managing remote connections.............................................................................................597
2011-05-06
Contents
13
18.8.1
18.8.2
18.9
18.9.1
18.9.2
18.9.3
18.9.4
18.10
18.10.1
18.10.2
18.10.3
18.11
18.11.1
18.11.2
18.12
18.12.1
18.12.2
18.12.3
18.13
18.13.1
18.13.2
18.13.3
18.14
18.14.1
18.14.2
18.14.3
18.14.4
18.15
18.15.1
18.15.2
Creating remote connections...............................................................................................597
Chapter 19
Supplementary Configurations for ERP Environments........................................................627
19.1
19.1.1
19.2
19.2.1
19.2.2
19.3
19.3.1
19.3.2
19.3.3
Configurations for SAP NetWeaver integration....................................................................627
Modifying remote connections.............................................................................................599
Managing replication jobs.....................................................................................................600
Creating replication jobs.......................................................................................................600
Scheduling replication jobs...................................................................................................603
Modifying replication jobs.....................................................................................................604
Viewing a log after a replication job......................................................................................604
Managing object cleanup......................................................................................................605
How to use object cleanup...................................................................................................605
Object cleanup limits............................................................................................................606
Object cleanup frequency.....................................................................................................606
Managing conflict detection and resolution...........................................................................607
One-way replication conflict resolution.................................................................................608
Two-way replication conflict resolution.................................................................................609
Using Web Services in Federation.......................................................................................612
Session variables ................................................................................................................612
File caching .........................................................................................................................613
Custom deployment ............................................................................................................613
Remote scheduling and locally run instances........................................................................614
Remote scheduling..............................................................................................................614
Locally run instances............................................................................................................615
Instance share......................................................................................................................616
Importing and promoting replicated content..........................................................................617
Importing replicated content.................................................................................................617
Importing replicated content and continuing replication ........................................................617
Promoting content from a test environment..........................................................................618
Re-pointing a destination site...............................................................................................619
Best practices......................................................................................................................619
Current release limitations....................................................................................................622
Troubleshooting error messages..........................................................................................623
Integrating with SAP NetWeaver Business Warehouse (BW)...............................................627
Configuring for JD Edwards integration................................................................................675
Configuring Single Sign-on (SSO) for SAP Crystal Reports.................................................676
Configuring Secure Socket Layer for JD Edwards Integrations............................................676
Configuring for PeopleSoft Enterprise integration.................................................................678
Configuring Single Sign-on (SSO) for SAP Crystal Reports and PeopleSoft Enterprise........678
Configuring Secure Socket Layer communication................................................................679
Performance Tuning for PeopleSoft systems........................................................................681
2011-05-06
Contents
14
19.4
19.4.1
19.4.2
19.4.3
19.4.4
19.4.5
Configuring for Siebel integration.........................................................................................682
Chapter 20
Managing and Configuring Logs.........................................................................................689
20.1
20.2
20.3
20.3.1
20.3.2
20.3.3
20.4
20.4.1
20.4.2
20.5
20.5.1
Logging traces from components.........................................................................................689
Chapter 21
Integration to SAP Solution Manager..................................................................................703
21.1
21.2
21.3
21.3.1
21.3.2
21.3.3
21.4
21.4.1
21.4.2
21.4.3
21.5
21.5.1
21.5.2
21.5.3
21.5.4
21.6
Integration overview.............................................................................................................703
Chapter 22
Command Line Administration............................................................................................713
22.1
UNIX scripts.........................................................................................................................713
Configuring Siebel to integrate with SAP BusinessObjects Business Intelligence platform....682
Creating the Crystal Reports menu item..............................................................................683
Contextual awareness..........................................................................................................685
Configuring Single Sign-on (SSO) for SAP Crystal Reports and Siebel................................687
Configuring for Secure Sockets Layer Communication........................................................688
Trace log levels....................................................................................................................689
Configuring tracing for servers.............................................................................................690
To set the server trace log level in the CMC........................................................................691
To set the trace log level for multiple servers managed in the CMC.....................................691
To configure server tracing through the BO_trace.ini file......................................................692
Configuring tracing for web applications...............................................................................695
To set the web application trace log level in the CMC..........................................................695
To manually modify tracing settings through the BO_trace.ini file.........................................696
Configuring tracing for upgrade management tool................................................................701
To configure tracing for upgrade management tool...............................................................701
SAP Solution Manager integration checklist.........................................................................703
Managing system landscape directory registration...............................................................704
Registration of BI platform in the System Landscape...........................................................705
When is SLD registration triggered?....................................................................................706
Logging SLD connectivity ...................................................................................................706
Managing Solution Management Diagnostics agents...........................................................707
Solution Manager Diagnostics (SMD) overview...................................................................707
Working with SMD agents...................................................................................................707
SMAdmin user account........................................................................................................708
Managing performance instrumentation................................................................................708
Performance instrumentation for BI platform........................................................................709
Setting up performance instrumentation for BI platform........................................................709
Performance instrumentation for the web tier.......................................................................710
Instrumentation log files ......................................................................................................711
Tracing with SAP Passport...................................................................................................711
2011-05-06
Contents
15
22.1.1
22.1.2
22.1.3
22.2
22.2.1
22.3
22.3.1
22.3.2
22.3.3
22.3.4
22.3.5
22.3.6
22.3.7
22.3.8
22.3.9
22.3.10
22.3.11
22.3.12
Script utilities.......................................................................................................................713
Chapter 23
Rights Appendix..................................................................................................................741
23.1
23.2
23.3
23.3.1
23.3.2
23.3.3
23.3.4
23.3.5
23.3.6
23.3.7
23.3.8
23.3.9
23.3.10
23.3.11
23.3.12
23.3.13
About the rights appendix.....................................................................................................741
Chapter 24
Server Properties Appendix.................................................................................................767
24.1
24.1.1
About the server properties appendix...................................................................................767
Script templates...................................................................................................................719
Scripts used by SAP BusinessObjects Business Intelligence platform.................................719
Windows scripts..................................................................................................................721
ccm.exe...............................................................................................................................721
Server Command Lines........................................................................................................724
Command lines overview.....................................................................................................724
Standard options for all servers............................................................................................725
Central Management Server................................................................................................726
Crystal Reports Processing Server and Crystal Reports Cache Server................................729
Dashboard Design Processing Server and Dashboard Design Cache Server.......................729
Job Servers.........................................................................................................................731
Adaptive Processing Server.................................................................................................732
Report Application Server....................................................................................................732
Web Intelligence Processing Server.....................................................................................734
Input and Output File Repository Servers.............................................................................736
Event Server........................................................................................................................738
Dashboard and Dashboard Analytics Servers .....................................................................739
General rights......................................................................................................................741
Rights for specific object types............................................................................................744
Folder rights.........................................................................................................................744
Categories...........................................................................................................................744
Notes...................................................................................................................................745
Crystal reports.....................................................................................................................745
Web Intelligence documents................................................................................................746
Users and groups.................................................................................................................747
Access levels.......................................................................................................................748
BI Workspaces.....................................................................................................................749
Universe (.unv) rights...........................................................................................................750
Universe (.unx) rights...........................................................................................................751
Universe object-access levels..............................................................................................753
Connection rights.................................................................................................................754
Applications.........................................................................................................................755
Common Server Properties..................................................................................................767
2011-05-06
Contents
24.1.2
24.1.3
24.1.4
24.1.5
24.1.6
24.1.7
24.1.8
Core Services Properties.....................................................................................................770
Chapter 25
Server Metrics Appendix.....................................................................................................809
25.1
25.1.1
25.1.2
25.1.3
25.1.4
25.1.5
25.1.6
25.1.7
25.1.8
25.1.9
25.1.10
25.1.11
About the Server Metrics Appendix.....................................................................................809
Chapter 26
Server and Node Placeholder Appendix..............................................................................835
26.1
Server and node placeholders..............................................................................................835
Chapter 27
Auditing Data Store Schema Appendix...............................................................................845
27.1
27.2
27.3
Overview..............................................................................................................................845
Appendix A
More Information.................................................................................................................857
Index
16
Connectivity Services Properties.........................................................................................780
Crystal Reports Services Properties....................................................................................784
Analysis Services Properties................................................................................................792
Data Federation Services Properties....................................................................................794
Web Intelligence Services Properties...................................................................................794
Dashboard Design Services Properties................................................................................804
Common Server Metrics .....................................................................................................809
Central Management Server Metrics...................................................................................812
Connection Server Metrics..................................................................................................816
Event Server Metrics...........................................................................................................817
File Repository Server Metrics.............................................................................................818
Adaptive Processing Server Metrics....................................................................................818
Web Application Container Server Metrics..........................................................................823
Adaptive Job Server Metrics................................................................................................824
Crystal Report Server Metrics.............................................................................................826
Web Intelligence Server Metrics..........................................................................................829
Dashboard Design Server Metrics.......................................................................................831
Schema diagram..................................................................................................................845
Auditing Data Store Tables..................................................................................................846
859
2011-05-06
Getting Started
Getting Started
1.1 About this help
This help provides you with information and procedures for deploying and configuring your BI platform.
Procedures are provided for common tasks. Conceptual information and technical details are provided
for all advanced topics.
For information about installing this product, see the SAP BusinessObjects Business Intelligence Platform
Installation Guide.
1.1.1 Who should use this help?
This help covers deployment and configuration tasks. We recommend consulting this guide if you are:
•
planning your first deployment
•
configuring your first deployment
•
making significant changes to the architecture of an existing deployment
•
improving your system's performance.
This help is intended for system administrators who are responsible for configuring, managing, and
maintaining a BI platform installation. Familiarity with your operating system and your network
environment is beneficial, as is a general understanding of web application server management and
scripting technologies. However, to assist all levels of administrative experience, this help aims to
provide sufficient background and conceptual information to clarify all administrative tasks and features.
1.1.2 About SAP BusinessObjects Business Intelligence platform
The BI platform is a flexible, scalable, and reliable solution for delivering powerful, interactive reports
to end users via any web application—intranet, extranet, Internet or corporate portal. Whether it is used
for distributing weekly sales reports, providing customers with personalized service offerings, or
integrating critical information into corporate portals, BI platform delivers tangible benefits that extend
17
2011-05-06
Getting Started
across and beyond the organization. As an integrated suite for reporting, analysis, and information
delivery, the platform provides a solution for increasing end-user productivity and reducing administrative
efforts.
1.1.3 Variables
The following variables are used throughout this guide.
Variable
Description
<INSTALLDIR>
The directory where the BI platform is installed.
On a Windows machine, the default directory is C:\Program Files (x86)\SAP
BusinessObjects\.
<PLAT
FORM64DIR>
The name of your UNIX operating system. Acceptable values are:
• aix_rs6000_64
• linux_x64
• solaris_sparcv9
• hpux_ia64
<SCRIPTDIR>
The directory where scripts for administering BI platform are located.
On a Windows machine, the directory is <INSTALLDIR>\win64_x64\scripts.
On Unix machines, the directory is <INSTALLDIR>/<PLAT
FORM64DIR>/scripts.
1.2 Before you start
1.2.1 Key concepts
18
2011-05-06
Getting Started
1.2.1.1 Services and servers
The following diagram shows a hypothetical installation of BI platform.
Note:
The nodes, servers, and services shown are for illustrative purposes only. The number of hosts, nodes,
servers and services—as well as the type of servers, and services—will vary in real-world installations.
Two hosts form the cluster named ProductionBISystem, with two hosts:
• The host named HostAlpha has BI platform installed and is configured to have two nodes:
•
19
NodeMercury: contains an Adaptive Job Server (NodeMercury.AJS) with services to schedule
and publish reports, an Input File Repository Server (NodeMercury.IFRS) with a service to store
input reports, and an Output File Repository Server (NodeMercury.OFRS) with a service to store
report output.
2011-05-06
Getting Started
•
•
NodeVenus: contains an Adaptive Processing Server (NodeVenus.APS) with services to provide
publishing, monitoring, and translation features, an Adaptive Processing Server (NodeVenus.APS2)
with a service to provide client auditing, and a Central Management Server (NodeVenus.CMS)
with a service to provide the CMS services.
The host named HostBeta has BI platform installed and is configured to have three nodes:
•
•
•
NodeMars: contains a Central Management Server (NodeMars.CMS) with a service to provide
the CMS services.
NodeJupiter: contains an Web Intelligence Processing Server (NodeJupiter.Web Intelligence)
with a service to provide Web Intelligence reporting, and an Event Server
(NodeJupiter.EventServer) to provide report monitoring of files.
NodeSaturn: contains an Adaptive Processing Server (NodeSaturn.APS) with a service to provide
client auditing.
The BI platform uses the terms server and service to refer to the two types of software running on a BI
platform machine.
A service is a server subsystem that performs a specific function. The service runs within the memory
space of its server under the process id of the parent container (server). For example, the SAP
BusinessObjects Web Intelligence Scheduling and Publishing Service is a subsystem that runs within
the Adaptive Job Server.
The term server is used to describe an operating system level process (on some systems, this is referred
to as a daemon) hosting one or more services. For example, the Central Management Server (CMS)
and Adaptive Processing Server are servers. A server runs under a specific operating system account
and has its own PID.
A node is a collection of BI platform servers running on the same host. One or more nodes can be on
a single host.
BI platform can be installed on a single machine, spread across different machines on an intranet, or
separated over a wide area network (WAN).
1.2.1.2 Server Intelligence
Server Intelligence is a component of the Central Management Console (CMC) to manage a collection
or server processes, collectively known as a node. Changes to server processes applied in the CMC
are propagated to affected servers by the Server Intelligence Agent (SIA). The SIA is also used for the
automatic restart or shutdown of a server if it encounters an unexpected condition, and is used by the
Central Management Server (CMC) to manage nodes.
The Server Intelligence Agent (SIA) server archives server information in the CMS system database
so you can easily restore default server settings, or create redundant instances of server processes
with the same settings.
20
2011-05-06
Getting Started
Note:
A single machine can contain multiple nodes, and the nodes can be in the same BI platform cluster or
in different clusters.
1.2.2 Key administrative tools
1.2.2.1 Central Management Console (CMC)
The Central Management Console (CMC) is a web-based tool to perform administrative tasks, including
user, content, and server management. It also allows you to publish, organize, and configure security
settings. Because the CMC is a web-based application, you can perform all of these administrative
tasks through a web browser on any machine that can connect to the server.
All users can log on to the CMC to change their user preference settings. Only members of the
Administrators group can change management settings, unless explicitly granted the rights to do so.
Roles can also be assigned to the CMC to grant some users privileges to perform minor administrative
tasks
1.2.2.2 Central Configuration Manager (CCM)
The Central Configuration Manager (CCM) is a server troubleshooting and node management tool
provided in two forms. In a Microsoft Windows environment, the CCM allows you to manage local and
remote servers through its graphical user interface (GUI) or from a command line. In a Unix environment,
the CCM shell script (ccm.sh) allows you to manage servers from the command-line.
The CCM allows you to create and configure Server Intelligence Agent (SIA) nodes and start or stop
your web application server. On Windows, it also allows you to configure network parameters, such as
Secure Socket Layer (SSL) encryption. These parameters apply to all servers within a node.
Note:
Most server management tasks are now handled through the CMC, not through the CCM. The CCM
is now used for troubleshooting and node configuration.
21
2011-05-06
Getting Started
1.2.2.3 Repository Diagnostic Tool
The Repository Diagnostic Tool (RDT) can scan, diagnose, and repair inconsistencies that may occur
between the Central Management Server (CMS) system database and the File Repository Servers
(FRS) filestore. You can set a limit for the number of errors the RDT will find and repair before stopping.
RDT should be used after you restore your BI platform system.
1.2.2.4 Upgrade management tool
Upgrade management tool (formerly Import Wizard) is installed as a part of BI platform, and guides
administrators through the process of importing users, groups, and folders from previous versions of
the BI platform. It also allows you to import and upgrade objects, events, server groups, repository
objects, and calendars.
For information on upgrading from a previous version of BI platform, see the SAP BusinessObjects
Business Intelligence Upgrade Guide.
1.2.3 Key tasks
Depending on your situation, you may want to focus on specific sections of this help, and there may
be other resources available for you. For each of the following situations, there is a list of suggested
tasks and reading topics.
Related Topics
• Planning or performing your first deployment
• Configuring your deployment
• Improving your system's performance
• Central Management Console (CMC)
1.2.3.1 Planning or performing your first deployment
22
2011-05-06
Getting Started
If you are planning or performing your first deployment of BI platform, it is recommended that you
perform the following tasks and read the corresponding sections:
•
To get familiar with the BI platform components, read “Architectural overview”.
•
To assess your needs and design a deployment architecture that works best for you, read the SAP
BusinessObjects Business Intelligence Platform Deployment Planning Guide.
•
“Understanding communication between BI platform components”.
•
“Security overview”.
•
If you plan to use third-party authentication, read “Authentication”.
•
For more information about installing BI platform, see the SAP BusinessObjects Business Intelligence
Platform Installation Guide.
•
After you install, read “Server management overview”.
Related Topics
• Architecture overview
• Understanding communication between BI platform components
• Security overview
• Authentication options in BI platform
• Server Administration
1.2.3.2 Configuring your deployment
If you have just completed your installation of the BI platform and need to perform initial configuration
tasks, such as firewall configuration and user management, it is recommended that you read the following
sections.
Related Topics
• Server Administration
• Communication between BI platform components
• Security overview
• About Monitoring
1.2.3.3 Improving your system's performance
23
2011-05-06
Getting Started
If you want to assess your deployment's efficiency and fine-tune it in order to maximize resources, it is
recommended that you read the following sections:
•
If you want to monitor your existing system, read “Monitoring”.
•
For daily maintenance tasks and procedures for working with servers in the CMC, see “Server
Maintenance”.
Related Topics
• About Monitoring
• Server Administration
1.2.3.4 Working with objects in the CMC
If you are working with objects in the CMC, read the following sections:
•
For information about setting up users and groups in the CMC, see “Account Management Overview”.
•
To set security on objects, see “How rights work in BI platform”.
•
For general information about working with objects, see SAP BusinessObjects Business Intelligence
Platform User's Guide.
Related Topics
• Account management overview
• How rights work in BI platform
24
2011-05-06
Architecture
Architecture
2.1 Architecture overview
This section outlines the overall platform architecture, system, and service components that make up
the SAP BusinessObjects Business Intelligence platform. The information helps administrators understand
the system essentials and help to form a plan for the system deployment, management, and maintenance.
SAP BusinessObjects Business Intelligence platform is designed for high performance across a broad
spectrum of user and deployment scenarios. For example, specialized platform services handle either
on-demand data access and report generation, or report scheduling based on times and events. You
can offload processor intensive scheduling and processing by creating dedicated servers to host specific
services. The architecture is designed to meet the needs of virtually any BI deployment, and is flexible
enough to grow from several users with a single tool, to tens of thousands of users with multiple tools
and interfaces.
Developers can integrate SAP BusinessObjects Business Intelligence platform BI into your organization's
other technology systems by using web services, Java, or .NET application programming interfaces
(APIs).
End users can access, create, edit, and interact with reports using specialized tools and applications
that include:
• Clients installed by SAP BusinessObjects Business Intelligence Platform Client Tools installation
program:
• Web Intelligence
• Business View Manager
• Report Conversion Tool
• Universe design tool
• Web Service query tool (formerly Query as a Web Service)
• Information design tool (formerly Information Designer)
• Translation Management Tool (formerly Translation Manager)
• Widgets for SAP BusinessObjects Business Intelligence Platform (formerly BI Widgets)
•
Clients available separately:
• SAP Crystal Reports
• SAP BusinessObjects Dashboard Design (formerly Xcelsius)
• SAP BusinessObjects Analysis (formerly Voyager)
• BI Workspaces (formerly Dashboard Builder)
IT departments can use data and system management tools that include:
25
2011-05-06
Architecture
•
•
•
•
•
•
•
•
Report Viewers
Central Management Console (CMC)
Central Configuration Manager (CCM)
Repository Diagnostic Tool (RDT)
Data Federation Administration Tool
Upgrade management tool (formerly Import Wizard)
Universe design tool (formerly Universe Designer)
SAP BusinessObjects Mobile
To provide flexibility, reliability, and scalability, SAP BusinessObjects Business Intelligence platform
components can be installed on one or across many machines. You can even install two different
versions of SAP BusinessObjects Business Intelligence platform simultaneously on the same computer,
although this configuration is only recommended as part of the upgrade process or testing purposes.
Server processes can be “vertically scaled” (where one computer runs several, or all, server-side
processes) to reduce cost, or “horizontally scaled” (where server processes are distributed between
two or more networked machines) to improve performance. It is also possible to run multiple, redundant,
versions of the same server process on more than one machine, so that processing can continue if the
primary process encounters a problem.
Note:
While it is possible to use a mixture of Windows and Unix or Linux platforms, it is recommended that
you do not mix operating systems for Central Management Server (CMS) processes.
2.1.1 System overview
SAP BusinessObjects Business Intelligence platform provides enterprise level analysis and reporting
tools. Data can be analyzed from any of a large number of supported database systems (including text
or multi-dimensional OLAP systems) and BI reports can be published in many different formats to many
different publishing systems.
The following diagram illustrates how SAP BusinessObjects Business Intelligence platform fits in with
your organization's infrastructure.
26
2011-05-06
Architecture
SAP BusinessObjects Business Intelligence platform reports from a read-only connection to your
organization's databases, and uses its own databases for storing its configuration, auditing, and other
operational information. The BI reports created by the system can be sent to a variety of destinations,
including file systems, and email, or accessed through web sites or portals.
SAP BusinessObjects Business Intelligence platform is a self-contained system that can exist on a
single machine (for example, as a small development or pre-production test environment) or can be
scaled up into a cluster of many machines that run different components (for example, as a large-scale
production environment).
2.1.2 Databases
SAP BusinessObjects Business Intelligence platform uses several different databases.
• Reporting database
This refers to your organization's information. It is the source information analyzed and reported on
by SAP BusinessObjects Business Intelligence platform. Most commonly, the information is stored
within a relational database, but it can also be contained within text files, Microsoft Office documents,
or OLAP systems.
•
CMS system database
The CMS system database is used to store SAP BusinessObjects Business Intelligence platform
information, such as user, server, folder, document, configuration, authorization, and authentication
27
2011-05-06
Architecture
details. It is maintained by the Central Management Server (CMS), and is sometimes referred to as
the system repository.
•
Auditing Data Store
The Auditing Data Store (ADS) is used to store information on trackable events that occur in SAP
BusinessObjects Business Intelligence platform. This information can be used to monitor the usage
of system components, user activity, or other aspects of day-to-day operation.
•
Lifecycle Management database
The Lifecycle Management database tracks configuration and version information related to an SAP
BusinessObjects Business Intelligence platform installation, as well as updates.
•
Monitoring database
Monitoring uses the Java Derby database to store system configuration and component information
for SAP supportability.
If you do not have a database server in place for use with the CMS system and Auditing Data Store
databases, the SAP BusinessObjects Business Intelligence platform installation program can install
and configure one for you. It is recommended that you evaluate your requirements against information
from your database server vendor to determine which supported database would best suit your
organization's requirements.
2.1.3 Servers
SAP BusinessObjects Business Intelligence platform consists of collections of servers running on one
or more hosts. Small installations (such as test or development systems) can use a single host for a
web application server, database server, and all SAP BusinessObjects Business Intelligence platform
servers.
Medium and large installations can have servers running on multiple hosts. For example, a web
application server host can be used in combination with an SAP BusinessObjects Business Intelligence
platform server host. This frees up resources on the SAP BusinessObjects Business Intelligence platform
server host, allowing it to process more information than if it also hosted the web application server.
Large installations can have several SAP BusinessObjects Business Intelligence platform server hosts
working together in a cluster. For example, if an organization has a large number of SAP Crystal Reports
users, Crystal Reports processing servers can be created on multiple SAP BusinessObjects Business
Intelligence platform server hosts to ensure that there are plenty of resources available to process
requests from clients.
The advantages of having multiple servers include:
• Improved performance
Multiple SAP BusinessObjects Business Intelligence platform server hosts can process a queue of
reporting information faster than a single SAP BusinessObjects Business Intelligence platform server
host.
28
2011-05-06
Architecture
•
Load balancing
If a server is experiencing a higher load than the other servers in a cluster, the CMS automatically
sends new work to a server with better resources.
•
Improved availability
If a server encounters an unexpected condition, the CMS automatically re-routes work to different
servers until the condition is corrected.
2.1.4 Web application servers
A web application server acts as the translation layer between a web browser or rich application, and
SAP BusinessObjects Business Intelligence platform. Web application servers running on Windows,
Unix, and Linux are supported.
The following web application servers are supported:
• JBoss
• Oracle Application Server
• Sun Java System Application Server (Unix only)
• SAP NetWeaver AS Java
• Tomcat
• WebLogic
• WebSphere
For a detailed list of supported web application servers, consult the Supported Platforms Guide available
at: http://service.sap.com/bosap-support.
If you do not have a web application server in place for use with SAP BusinessObjects Business
Intelligence platform, the installation program can install and configure a Tomcat 6 web application
server for you. It is recommended that you evaluate your requirements against information from your
web application server vendor to determine which supported web application server would best suit
your organization's requirements.
Note:
When configuring a production environment, it is recommended that the web application server is hosted
on a separate system. Running SAP BusinessObjects Business Intelligence platform and a web
application server on the same host in a production environment may decrease performance.
2.1.4.1 Web Application Container Service (WACS)
A web application server is required to host SAP BusinessObjects Business Intelligence platform web
applications.
29
2011-05-06
Architecture
If you are an advanced Java web application server administrator with advanced administration needs,
use a supported Java web application server to host SAP BusinessObjects Business Intelligence
platform web applications. If you are using a supported Windows operating system to host SAP
BusinessObjects Business Intelligence platform, and prefer a simple web application server installation
process, or you do not have the resources to administer a Java web application server, you can install
the Web Application Container Service (WACS) when installing SAP BusinessObjects Business
Intelligence platform.
WACS is an SAP BusinessObjects Business Intelligence platform server that allows SAP BusinessObjects
Business Intelligence platform web applications, such as the Central Management Console (CMC), BI
launch pad, and Web Services, to run without the need for a previously installed Java web application
server.
Using WACS to provides a number of advantages:
• WACS requires a minimum effort to install, maintain, and configure. It is installed and configured by
the SAP BusinessObjects Business Intelligence platform installation program, and no additional
steps are required to start using it.
• WACS removes the need for Java application server administration and maintenance skills.
• WACS provides an administrative interface that is consistent with other SAP BusinessObjects
Business Intelligence platform servers.
• Like other SAP BusinessObjects Business Intelligence platform servers, WACS can be installed on
a dedicated host.
Note:
There are some limitations to using WACS instead of a dedicated Java web applications server:
• WACS is only available on supported Windows operating systems.
• Custom web applications cannot be deployed to WACS, as it only supports the web applications
installed with SAP BusinessObjects Business Intelligence platform.
• WACS cannot be used with an Apache load balancer.
It is possible to use a dedicated web application server in addition to WACS. This allows your dedicated
web application server to host custom web applications, while the CMC and other SAP BusinessObjects
Business Intelligence platform web applications are hosted by WACS.
2.1.5 Software Development Kits
A Software Development Kit (SDK) allows a developer to incorporate aspects of SAP BusinessObjects
Business Intelligence platform into an organization's own applications and systems.
SAP BusinessObjects Business Intelligence platform has SDKs for software development on Java and
.NET platforms.
Note:
SAP BusinessObjects Business Intelligence platform .NET SDKs are not installed by default, and must
be downloaded from the SAP Service Marketplace.
30
2011-05-06
Architecture
The following SDKs are supported by SAP BusinessObjects Business Intelligence platform:
• SAP BusinessObjects Business Intelligence platform Java SDK and .NET SDK
The SAP BusinessObjects Business Intelligence platform SDKs allow application to perform tasks
such as authentication, session management, working with repository objects, report scheduling
and publication, and server management.
Note:
For full access to security, server management, and auditing functions, use the Java SDK.
•
Report Application Server Java SDK and .NET SDK
The Report Application Server SDKs allow applications to open, create, and modify existing Crystal
reports, including setting parameter values, changing data sources, and exporting to other formats,
including XML, PDF, Microsoft Word, and Microsoft Excel.
•
Report Engine Java SDK and .NET SDK
The Report Engine SDKs allow applications to interact with reports created with SAP BusinessObjects
Web Intelligence.
The Report Engine SDKs include libraries that you can use to build a web report design tool.
Applications built with these SDKs can view, create, or modify, a variety of different SAP
BusinessObjects Web Intelligence documents. Users can modify documents by adding, removing,
and modifying objects such as tables, charts, conditions, and filters.
•
Platform Search SDK: The Platform Search SDK is the interface between the client application and
the Platform Search Service. Platform Search supports Public SDK that comes as a part of the
Platform Search SDK.
When a search request parameter is sent through the client application to the SDK layer, the SDK
layer converts the request parameter into XML- encoded format and passes it to the Platform Search
Service.
•
Crystal Reports Viewers Java SDK and .NET SDK
The Viewers SDKs allow applications to display and export Crystal reports. The following viewers
are available:
• DHTML Report Page Viewer: presents data and allows drill-down, page navigation, zooming,
prompting, search, highlighting, exporting, and printing.
• Report Parts Viewer: provides the ability to view individual parts of a report, including charts,
text, and fields.
• Viewer Tag Library: allows for the behavior of the viewer to be customized in JSP pages.
•
SAP BusinessObjects Business Intelligence platform Java Consumer SDK and .NET Consumer
SDK
An implementation of Web Services that allows you to handle user authentication and security,
document and report access, scheduling, publications, and server management.
Note:
The SAP BusinessObjects Business Intelligence platform JavaServer Faces Components are deprecated.
31
2011-05-06
Architecture
The SDKs can be used in combination to provide a wide range of BI functionality to your applications.
For example, the BI launch pad web application included with SAP BusinessObjects Business Intelligence
platform was built using these SDKs.
For more information on SAP BusinessObjects Business Intelligence platform SDKs, see the SAP
BusinessObjects Business Intelligence Platform Java SDK Developer Guide, the Report Application
Server Java SDK Developer Guide, the Report Application Server .NET SDK Developer Guideand the
Viewers Java SDK Developer Guide available at: http://service.sap.com/bosap-support.
2.1.5.1 Web Services Java and .NET Consumer SDKs
The SAP BusinessObjects Business Intelligence platform Web Services Java and .NET Consumer
SDKs allow you to create distributed Web Services applications that take advantage of the SAP
BusinessObjects Business Intelligence platform features.
Web Services consists of software components that can be called remotely using the Simple Object
Access Protocol (SOAP). SOAP is a protocol for exchanging information that is not dependent on a
specific platform, object model, or programming language.
SAP BusinessObjects Business Intelligence platform Web Services includes functionality in the following
areas:
• Session
Authentication and user management.
•
BI platform
Exposes advanced platform features such as scheduling, publishing, search, user and group
administration, and server administration services.
•
Report Engine
Displays SAP BusinessObjects Business Intelligence Solution and Crystal Reports in HTML, PDF,
Excel, and XML format.
•
Query
Builds ad-hoc queries based on the Universe semantic layer.
SAP BusinessObjects Business Intelligence platform Web Services uses standards such as XML,
SOAP, AXIS 2.0 and WSDL. The platform follows WS-Interoperability Basic Profile 1.0 web services
specification.
Note:
Web Services applications are currently only supported with the following load balancer configurations:
1. Source IP address persistence.
2. Source IP and destination port persistence (available only on a Cisco Content Services Switch).
3. SSL persistence.
32
2011-05-06
Architecture
Note:
SSL persistence may cause security and reliability issues on some web browsers. Check with your
network administrator to determine if SSL persistence is appropriate for your organization.
2.1.5.2 Web Services query tool
Web service query tool is a wizard-based application that allows queries to be made into a web service
and integrated with web-ready applications. Queries can be saved to create a catalog of standard
queries that application builders can select as required.
Business Intelligence (BI) content is usually bound to a specific user interface of BI tools. Web service
query tool changes this by allowing BI content to be delivered to any user interface that can process
web services.
Web service query tool is designed to work on top of any Microsoft Windows application the same way
as other web services. Query as a Web Service is based on the W3C web service specifications SOAP,
WSDL, and XML. It has two main components:
• Server component
The server component (included in SAP BusinessObjects Business Intelligence platform) stores the
Web service query tool catalog and hosts the published web services.
•
Client tool
This is how business users create and publish their queries as a web service on the server. You
can install the client tool on several machines that can access and share the same Web service
query tool catalog stored on the server. The client tool communicates with the server components
via web services.
Web service query tool allows web queries to be used as part of a range of client-side solutions, including:
• Microsoft Office, Excel, and InfoPath
• SAP NetWeaver
• OpenOffice
• Business rules and process management applications
• Enterprise Service Bus platforms
2.1.6 Data sources
33
2011-05-06
Architecture
2.1.6.1 Universes
The universe abstracts the data complexity by using business language rather than data language to
access, manipulate, and organize data. This business language is stored as objects in a universe file.
Web Intelligence and Crystal Reports use universes to simplify the user creation process required for
simple to complex end-user query and analysis.
Universes are a core component of SAP BusinessObjects Business Intelligence platform. All universe
objects and connections are stored and secured in the central repository by the Connection Server.
Universe design tools need to log into SAP BusinessObjects Business Intelligence platform to access
the system and create universes. Universe access and row-level security can also be managed at the
group or individual user level from within the design environment.
The semantic layer allows SAP BusinessObjects Web Intelligence to deliver documents, by utilizing
multiple synchronized data providers, including online analytical processing (OLAP) and common
warehousing metamodel (CWM) data sources.
2.1.6.2 Business Views
Business Views simplify report creation and interaction by abstracting the complexity of data for report
developers. Business Views help separate the data connections, data access, business elements, and
access control.
Business Views can only be used by Crystal Reports and are designed to simplify the data access and
view-time security required for Crystal report creation. Business Views support the combination of
multiple data sources in a single view. Business Views are fully supported in SAP BusinessObjects
Business Intelligence platform.
SAP BusinessObjects Business Intelligence platform includes a series of dedicated, pre-configured
platform management services for tasks such as password management, server metrics, and user
access control for decentralized management functions.
2.1.7 Language support
SAP BusinessObjects Business Intelligence platform products are translated into many different
languages and supports data in an even broader selection of languages.
Product interfaces are available in the following languages:
34
2011-05-06
Architecture
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Czech
Simplified Chinese
Traditional Chinese
Danish
Dutch
English
Finnish
French
German
Italian
Japanese
Korean
Norwegian Bokmal
Polish
Portuguese
Russian
Spanish
Swedish
Thai
In addition to supporting data in any of the languages available in the interface, the following character
sets are also supported:
• Greek
• Malaysian
• Hebrew
• Arabic
• Romanian
• Vietnamese
• Hungarian
• Turkish
• Hindi
2.1.8 Authentication and single sign-on
System security is managed by the Central Management Server (CMS), security plug-ins, and third-party
authentication tools, such as SiteMinder or Kerberos. These components authenticate users and
authorize user access for SAP BusinessObjects Business Intelligence platform, its folders, and other
objects.
The following user authentication single sign-on security plug-ins are available:
•
•
35
Enterprise (default), including Trusted Authentication support for third-party authentication.
LDAP
2011-05-06
Architecture
• Windows Active Directory (AD)
When using an Enterprise Resource Planning (ERP) system, single sign-on is used to authenticate
user access to the ERP system so that reports can be against ERP data. The following user
authentication single sign-on for ERP systems are supported:
• SAP ERP and Business Warehouse (BW)
• Oracle E-Business Suite (EBS)
• Siebel Enterprise
• JD Edwards Enterprise One
• PeopleSoft Enterprise
2.1.8.1 Security plug-ins
Security plug-ins automate account creation and management by allowing you to map user accounts
and groups from third-party systems into SAP BusinessObjects Business Intelligence platform. You
can map third-party user accounts or groups to existing Enterprise user accounts or groups, or you can
create new Enterprise user accounts or groups that correspond to each mapped entry in the external
system.
The security plug-ins dynamically maintain third-party user and group listings. So, once you map a
Lightweight Directory Access Protocol (LDAP) or Windows Active Directory (AD) group to SAP
BusinessObjects Business Intelligence platform, all users who belong to that group can log into SAP
BusinessObjects Business Intelligence platform. Subsequent changes to the third-party group
memberships are automatically propagated.
SAP BusinessObjects Business Intelligence platform supports the following security plug-ins:
•
Enterprise security plug-in
The Central Management Server (CMS) handles security information, such as user accounts, group
memberships, and object rights that define user and group privileges. This is known as Enterprise
authentication.
Enterprise authentication is always enabled; it cannot be disabled. Use the system default Enterprise
Authentication if you prefer to create distinct accounts and groups for use with SAP BusinessObjects
Business Intelligence platform, or if you have not already set up a hierarchy of users and groups on
an LDAP or Windows AD server.
Trusted Authentication is a component of Enterprise authentication that integrates with third-party
single sign-on solutions, including Java Authentication and Authorization Service (JAAS). Applications
that have established trust with the Central Management Server can use Trusted Authentication to
allow users to log on without providing their passwords.
•
•
LDAP security plug-in
Windows AD
Note:
Although a user can configure Windows AD authentication for SAP BusinessObjects Business
Intelligence platform and custom applications through the CMC, the CMC and BI launch pad do not
36
2011-05-06
Architecture
support Windows AD authentication with NTLM. The only methods of authentication that the CMC
and BI launch pad support are Windows AD with Kerberos, LDAP, Enterprise, and Trusted
Authentication.
2.1.8.2 Enterprise Resource Planning (ERP) integration
An Enterprise Resource Planning (ERP) application supports the essential functions of an organization's
processes by collecting real-time information related to day-to-day operations. SAP BusinessObjects
Business Intelligence platform supports single sign-on and reporting from the following ERP systems:
• SAP ERP and Business Warehouse (BW)
Note:
SAP GUI must be installed before using OLAP Data Access (ODA), SAP BusinessObjects Analysis
(formerly Voyager), or BW connections.
•
•
•
•
Siebel Enterprise
Oracle E-Business Suite
JD Edwards EnterpriseOne
PeopleSoft Enterprise
Note:
•
•
SAP ERP and BW support is installed by default. Use the Custom / Expand installation option to
deselect SAP integration support if you do not want support for SAP ERP or BW.
Support for Siebel Enterprise, Oracle E-Business Suite, JD Edwards EnterpriseOne, or PeopleSoft
is not installed by default. Use the "Custom / Expand" installation option to select and install integration
for non-SAP ERP systems.
For detailed information on the specific versions supported by SAP BusinessObjects Business Intelligence
platform, consult the Supported Platforms Guide, available at service.sap.com/bosap-support.
To configure ERP integration, see the SAP BusinessObjects Business Intelligence Platform Administrator
Guide.
2.1.9 SAP integration
SAP BusinessObjects Business Intelligence platform integrates with your existing SAP infrastructure
with the following SAP tools:
• SAP System Landscape Directory (SLD)
The system landscape directory of SAP NetWeaver is the central source of system landscape
information relevant for the management of your software life-cycle. By providing a directory
37
2011-05-06
Architecture
comprising information about all installable software available from SAP and automatically updated
data about systems already installed in a landscape, you get the foundation for tool support to plan
software life-cycle tasks in your system landscape.
The SAP BusinessObjects Business Intelligence platform installation program registers the vendor
and product names and versions with the SLD, as well as server and front-end component names,
versions, and location.
•
SAP Solution Manager
The SAP Solution Manager is a platform that provides the integrated content, tools, and methodologies
to implement, support, operate and monitor an organization's SAP and non-SAP solutions.
Non-SAP software with an SAP-certified integration is entered into a central repository and transferred
automatically to your SAP System Landscape Directories (SLD). SAP customers can then easily
identify which version of third-party product integration has been certified by SAP within their SAP
system environment. This service provides additional awareness for third-party products besides
our online catalogs for third-party products.
SAP Solution Manager is available to SAP customers at no extra charge, and includes direct access
to SAP support and SAP product upgrade path information. For more information on SLD, see
“Registration of SAP BusinessObjects Business Intelligence platform in the System Landscape” in
the SAP BusinessObjects Business Intelligence Platform Administrator Guide.
•
CTS Transport (CTS+)
The Change and Transport System (CTS) helps you to organize development projects in ABAP
Workbench and in Customizing, and then transport the changes between the SAP systems in your
system landscape. As well as ABAP objects, you can also transport Java objects (J2EE, JEE) and
SAP-specific non-ABAP technologies (such as Web Dynpro Java or SAP NetWeaver Portal) in your
landscape.
•
Monitoring with CA Wily Introscope
CA Wily Introscope is a web application management product that delivers the ability to monitor and
diagnose performance problems that may occur within Java-based SAP modules in production,
including visibility into custom Java applications and connections to back-end systems. It allows you
to isolate performance bottlenecks in NetWeaver modules including individual Servlets, JSPs, EJBs,
JCOs, Classes, Methods and more. It offers real-time, low-overhead monitoring, end-to-end
transaction visibility, historical data for analysis or capacity planning, customizable dashboards,
automated threshold alarms, and an open architecture to extend monitoring beyond NetWeaver
environments.
2.1.10 Lifecycle management (LCM)
Lifecycle management (LCM) refers to a set of processes involved in managing an installation's product
information. It establishes procedures for governing the installation of SAP BusinessObjects Business
Intelligence platform to development, test, production, or maintenance environments.
38
2011-05-06
Architecture
SAP BusinessObjects Business Intelligence platform Lifecycle Manager is a web-based tool that enables
you to move BI objects from one system to another system, without affecting the dependencies of those
objects. It also enables you to manage different versions, manage dependencies, or roll back a promoted
object to its previous state.
The LCM tool is a plug-in for SAP BusinessObjects Business Intelligence platform. You can promote
a BI object from one system to another system only if the same version of the application is installed
on both the source and destination systems.
For more information, see the Lifecycle management console for SAP BusinessObjects Business
Intelligence Platform 4.0 User Guide.
2.1.11 Integrated version control
The files that make up SAP BusinessObjects Business Intelligence platform on a server system are
now kept under version control. The installation program will install and configure the Subversion version
control system, or you can enter details to use an existing Subversion or ClearCase version control
system.
A version control system makes it possible to keep and restore different revisions of configuration and
other files, which means it is always possible to revert the system to a known state from any time in the
past.
2.1.12 Permanent data
The term "permanent data" refers to any piece of information considered important enough to be
migrated during a system upgrade. For example, the Central Management Server (CMS) stores
configuration information in the CMS database rather than the Windows registry or a configuration file.
All SAP BusinessObjects Business Intelligence platform products store permanent data in the CMS
system database. This allows data and configuration information to be easily migrated to a new version
when you upgrade.
2.1.13 Upgrade path
It's possible to upgrade from a previous release of SAP BusinessObjects Business Intelligence platform,
but you must first install SAP BusinessObjects Business Intelligence platform 4.0, then migrate the
settings and data from your existing system with the Upgrade management tool.
39
2011-05-06
Architecture
For information on how to upgrade from a previous version, see the SAP BusinessObjects Business
Intelligence Platform Upgrade Guide.
2.2 Conceptual tiers
SAP BusinessObjects Business Intelligence platform can be thought of as a series of conceptual tiers:
•
Web tier
The Web Tier contains web applications deployed to a Java web application server. Web applications
provide SAP BusinessObjects Business Intelligence platform functionality to end users through a
web browser. Examples of web applications include the Central Management Console (CMC)
administrative web interface and BI launch pad.
The web tier also contains Web Services. Web Services provides SAP BusinessObjects Business
Intelligence platform functionality to software tools via the web application server, such session
authentication, user privilege management, scheduling, search, administration, reporting, and query
management. For example, Live Office is a product that uses Web Services to integrate SAP
BusinessObjects Business Intelligence platform reporting into Microsoft Office products.
•
Management tier
The management tier coordinates and controls all of the components that make up SAP
BusinessObjects Business Intelligence platform. It is comprised of the Central Management Server
(CMS) and the Event Server. The CMS provides maintains security and configuration information,
sends service requests to servers, manages auditing, and maintains the CMS system database.
The Event Server manages file based events, which occur in the storage tier.
•
Processing tier
The processing tier analyzes data and produces reports. This is the only tier that accesses the
databases that contain report data.
40
2011-05-06
Architecture
•
Storage tier
The storage tier is responsible to handling files, such as documents and reports.
The Input File Repository Server manages files that contain information to be used in reports, such
as the following file types: .rpt, .car, .exe, .bat, .js, .xls, .doc, .ppt, .rtf, .txt, .pdf,
.wid, .rep, .unv.
The Output File Repository Server manages reports created by the system, such as the following
file types: .rpt, .csv, .xls, .doc, .rtf, .txt, .pdf, .wid, .rep.
The storage tier also handles report caching to save system resources when users access reports.
2.3 Services and servers
The following diagram shows a hypothetical installation of BI platform.
Note:
The nodes, servers, and services shown are for illustrative purposes only. The number of hosts, nodes,
servers and services—as well as the type of servers, and services—will vary in real-world installations.
41
2011-05-06
Architecture
Two hosts form the cluster named ProductionBISystem, with two hosts:
• The host named HostAlpha has BI platform installed and is configured to have two nodes:
•
•
•
The host named HostBeta has BI platform installed and is configured to have three nodes:
•
•
•
42
NodeMercury: contains an Adaptive Job Server (NodeMercury.AJS) with services to schedule
and publish reports, an Input File Repository Server (NodeMercury.IFRS) with a service to store
input reports, and an Output File Repository Server (NodeMercury.OFRS) with a service to store
report output.
NodeVenus: contains an Adaptive Processing Server (NodeVenus.APS) with services to provide
publishing, monitoring, and translation features, an Adaptive Processing Server (NodeVenus.APS2)
with a service to provide client auditing, and a Central Management Server (NodeVenus.CMS)
with a service to provide the CMS services.
NodeMars: contains a Central Management Server (NodeMars.CMS) with a service to provide
the CMS services.
NodeJupiter: contains an Web Intelligence Processing Server (NodeJupiter.Web Intelligence)
with a service to provide Web Intelligence reporting, and an Event Server
(NodeJupiter.EventServer) to provide report monitoring of files.
NodeSaturn: contains an Adaptive Processing Server (NodeSaturn.APS) with a service to provide
client auditing.
2011-05-06
Architecture
The BI platform uses the terms server and service to refer to the two types of software running on a BI
platform machine.
A service is a server subsystem that performs a specific function. The service runs within the memory
space of its server under the process id of the parent container (server). For example, the SAP
BusinessObjects Web Intelligence Scheduling and Publishing Service is a subsystem that runs within
the Adaptive Job Server.
The term server is used to describe an operating system level process (on some systems, this is referred
to as a daemon) hosting one or more services. For example, the Central Management Server (CMS)
and Adaptive Processing Server are servers. A server runs under a specific operating system account
and has its own PID.
A node is a collection of BI platform servers running on the same host. One or more nodes can be on
a single host.
BI platform can be installed on a single machine, spread across different machines on an intranet, or
separated over a wide area network (WAN).
2.3.1 Services
The following table describes each of the services.
Table 2-1: Services
Service
Service Category
Server type
Service description
Adaptive Connectivity
Service
Connectivity Services
Adaptive Processing
Server
Provides connectivity
services (replaces
Connection Server).
Authentication Update
Scheduling Service
Core Services
Adaptive Job Server
Provides synchronization of updates for thirdparty security plug-ins.
Adaptive Processing
Server
Provides integration of
SAP Business Warehouse (BW) Business
Explorer (BEx) web applications with BI
launch pad.
BEx Web Application
Service
43
Connectivity Services
2011-05-06
Architecture
Service
BOE Web Application
Service
Business Process BI
Service
Central Management
Service
Client Auditing Proxy
Service
Crystal Reports 2011
Processing Service
44
Service Category
Server type
Service description
Web Application Container Server
Provides web applications for WACS: includes the Central
Management Console
(CMC), BI launch pad,
and OpenDocument.
Web Application Container Server
Provides Business Process BI Web Services
for WACS: allows BI
technology to be incorporated into web applications. Business Process BI Service is deprecated.
Core Services
Central Management
Server
Provides server, user,
session management,
and security (authorization and authentication)
management. At least
one Central Management Service must be
available in a cluster for
the cluster to operate.
Core Services
Adaptive Processing
Server
Collects auditing events
sent from clients and
forwards them to the
CMS server.
Crystal Reports Processing Server
Accepts and processes
Crystal Reports 2011
reports; can share data
between reports to reduce the number of
database accesses.
Core Services
Core Services
Crystal Reports Services
Crystal Reports 2011
Scheduling Service
Crystal Reports Services
Adaptive Job Server
Runs scheduled legacy
Crystal Reports jobs
and publishes the results to a given output
location.
Crystal Reports 2011
Viewing and Modification Service
Crystal Reports Services
RAS
Report Application
Server (RAS).
2011-05-06
Architecture
Service
Crystal Reports Cache
Service
Crystal Reports Processing Service
Crystal Reports
Scheduling Service
Custom Data Access
Service
Dashboard Analytics
Service
Dashboard Design
Cache Service
45
Service Category
Server type
Service description
Crystal Reports Cache
Server
Limits the number of
database accesses
generated from Crystal
reports and speeds up
reporting by managing
a cache of reports.
Crystal Reports Processing Server
Accepts and processes
Crystal reports; can
share data between reports to reduce the
number of database
accesses.
Adaptive Job Server
Runs scheduled new
Crystal Reports jobs
and publishes the results to a given output
location.
Connectivity Services
Adaptive Processing
Server
Provides dynamic connections to data
sources that do not require a Connection
Server.
Core Services
Dashboard Analytics
Server
Provides BI
workspaces and Module functionality for data
analysis.
Dashboard Design
Cache Server
Limits the number of
database accesses
generated from Dashboard Design reports
and speeds up reporting by managing a
cache of reports.
Crystal Reports Services
Crystal Reports Services
Crystal Reports Services
Dashboard Design
Services
Dashboard Design
Processing Service
Dashboard Design
Services
Dashboard Design
Processing Server
Accepts and processes
Dashboard Design reports; can share data
between reports to reduce the number of
database accesses.
Dashboard Service
Core Services
Dashboard Server
BI workspace support
2011-05-06
Architecture
Service
Service Category
Server type
Service description
Data Federation Service
Data Federation Services
Adaptive Processing
Server
Data Federation service.
Destination Delivery
Scheduling Service
Core Services
Adaptive Job Server
Runs scheduled jobs
and publishes the results to a given output
location, such as the
file system, FTP, email,
or a user's inbox.
Document Recovery
Service
Web Intelligence Services
Adaptive Processing
Server
Web Intelligence document auto-save and recovery.
DSL Bridge Service
Web Intelligence Services
Adaptive Processing
Server
Dual Semantic Layer
(DSL) session support.
Event Server
Monitors for file events
on a File Repository
Server (FRS), and triggers reports to run
when required.
Event Service
46
Core Services
Excel Data Access
Service
Connectivity Services
Adaptive Processing
Server
Supports Excel files
uploaded to SAP BusinessObjects Business
Intelligence platform as
data sources.
Information Engine
Service
Web Intelligence Services
Web Intelligence Processing Server
Service required for
Web Intelligence documents processing.
Input Filestore Service
Core Services
Input File Repository
Server
Maintains published report and program objects that can be used
in the generation of
new reports when an
input file is received.
Web Intelligence Common Service
Web Intelligence Services
Web Intelligence Processing Server
Supports Web Intelligence documents processing.
Web Intelligence Core
Service
Web Intelligence Services
Web Intelligence Processing Server
Supports Web Intelligence documents processing.
2011-05-06
Architecture
47
Service
Service Category
Server type
Service description
Web Intelligence Monitoring Service
Web Intelligence Services
Adaptive Processing
Server
Monitors Web Intelligence Servers.
Web Intelligence Processing Service
Web Intelligence Services
Web Intelligence Processing Server
Accepts and processes
Web Intelligence documents.
Web Intelligence
Scheduling Service
Web Intelligence Services
Adaptive Job Server
Enables support for
scheduled Web Intelligence jobs.
Lifecycle Management
ClearCase Service
Lifecycle Management
Services
Adaptive Processing
Server
Provides ClearCase
support for LCM.
Lifecycle Management
Scheduling Service
Lifecycle Management
Services
Adaptive Job Server
Runs scheduled Lifecycle Management jobs.
Lifecycle Management
Service
Lifecycle Management
Services
Adaptive Processing
Server
Lifecycle Management
Core service.
Monitoring Service
Core Services
Adaptive Processing
Server
Provides monitoring
functions.
Multi Dimensional
Analysis Service
Analysis Services
Adaptive Processing
Server
Provides access to
multi-dimensional Online Analytical Processing (OLAP) data; converts the raw data into
XML, which can be
rendered into Excel,
PDF, or Analysis (formerly Voyager
)crosstabs and charts.
Native Connectivity
Service
Connectivity Services
Connection Server
Providing Native Connectivity services for
64-bit architectures.
Native Connectivity
Service (32-bit)
Connectivity Services
Connection Server
Providing Native Connectivity services for
32-bit architectures.
Output Filestore Service
Core Services
Output File Repository
Server
Maintains collection of
completed documents.
2011-05-06
Architecture
Service
Server type
Service description
Platform Search
Scheduling Service
Core Services
Adaptive Job Server
Runs scheduled search
to index all content in
the Central Management Server (CMS)
repository.
Platform Search Service
Core Services
Adaptive Processing
Server
Provides searching
functionality for the BI
platform.
Probe Scheduling Service
Core Services
Adaptive Job Server
Provides scheduled
Probe jobs and publishes the results to a given
output location.
Program Scheduling
Service
Core Services
Adaptive Job Server
Runs programs that
have been scheduled
to run at a given time.
Adaptive Job Server
Runs scheduled publishing jobs and publishes the results to a given
output location.
Adaptive Processing
Server
Performs actions on reports after they have
completed, such as
sending a report to a
specific output location.
Publication Scheduling
Service
Publishing Post Processing Service
Core Services
Core Services
Publishing Service
Core Services
Adaptive Processing
Server
Coordinates with the
Publishing Post Processing Service and
Destination Job Service
to publish reports to a
given output location,
such as the file system,
FTP, email, or a user's
inbox.
Rebean Service
Web Intelligence Services
Adaptive Processing
Server
SDK used by Web Intelligence and Explorer
Adaptive Job Server
Runs scheduled federation jobs to replicate
content between federated sites.
Replication Service
48
Service Category
Core Services
2011-05-06
Architecture
Service
Service Category
Server type
Service description
Security Query
Scheduling Service
Core Services
Adaptive Job Server
Runs scheduled Security Query jobs.
Security Token Service
Core Services
Adaptive Processing
Server
SAP Single Sign-On
support
Single Sign-on Service
Core Services
Central Management
Server
Active Directory Single
Sign-On support. This
is secondary service. It
is automatically added
to "Central Management Service".
TraceLog Service
Core Services
ANY SERVER
Tracing, Logging and
supportability support
Core Services
Adaptive Processing
Server
Translates InfoObjects
with input from the
Translation Manager
client.
Adaptive Job Server
Runs scheduled Visual
Difference (Lifecycle
Management) jobs and
publishes the results to
a given output location.
Translation Service
Visual Difference
Scheduling Service
Lifecycle Management
Services
Visual Difference Service
Lifecycle Management
Services
Adaptive Processing
Server
Determines whether
documents are visually
identical for doc promotion and Lifecycle Management.
Visualization Service
Web Intelligence Services
Adaptive Processing
Server
Common Visualization
Object Model Service,
used by Web Intelligence.
Web Services SDK and
QaaWS
Core Services
Web Application Container Server
Web Services on
WACS.
Note:
New services or server types may be added in future maintenance releases of SAP BusinessObjects
Business Intelligence platform.
49
2011-05-06
Architecture
2.3.2 Service categories
The following table lists each of the servers, ordered by service category. For a description of each
service, see Services.
Note:
New services or server types may be added in future maintenance releases of SAP BusinessObjects
Business Intelligence platform.
Table 2-2: Services, ordered by service category
50
Service category
Service
Server Type
Analysis Services
BEx Web Application Service
Adaptive Processing Server
Analysis Services
Multi Dimensional Analysis Service
Adaptive Processing Server
Connectivity Services
Adaptive Connectivity Service
Adaptive Processing Server
Connectivity Services
Custom Data Access Service
Adaptive Processing Server
Connectivity Services
Excel Data Access Service
Adaptive Processing Server
Connectivity Services
Native Connectivity Service
Connection Server
Connectivity Services
Native Connectivity Service (32bit)
Connection Server
Core Services
Authentication Update Scheduling Service
Adaptive Job Server
Core Services
BOE Web Application Service
Web Application Container
Server
Core Services
Business Process BI Service
Web Application Container
Server
Core Services
Central Management Service
Central Management Server
Core Services
Client Auditing Proxy Service
Adaptive Processing Server
Core Services
Dashboard Analytics Service
Dashboard Analytics Server
Core Services
Dashboard Service
Dashboard Server
Core Services
Destination Delivery Scheduling
Service
Adaptive Job Server
2011-05-06
Architecture
51
Service category
Service
Server Type
Core Services
Event Service
Event Server
Core Services
Input Filestore Service
Input File Repository Server
Core Services
Monitoring Service
Adaptive Processing Server
Core Services
Output Filestore Service
Output File Repository Server
Core Services
Platform Search Scheduling
Service
Adaptive Job Server
Core Services
Platform Search Service
Adaptive Processing Server
Core Services
Probe Scheduling Service
Adaptive Job Server
Core Services
Program Scheduling Service
Adaptive Job Server
Core Services
Publication Scheduling Service
Adaptive Job Server
Core Services
Publishing Post Processing
Service
Adaptive Processing Server
Core Services
Publishing Service
Adaptive Processing Server
Core Services
Replication Service
Adaptive Job Server
Core Services
Security Query Scheduling Service
Adaptive Job Server
Core Services
Security Token Service
Adaptive Processing Server
Core Services
Single Sign-on Service
Central Management Server
Core Services
TraceLog Service
ANY SERVER
Core Services
Translation Service
Adaptive Processing Server
Core Services
Web Services SDK and QaaWS
Web Application Container
Server
Crystal Reports Services
Crystal Reports 2011 Processing Service
Crystal Reports Processing
Server
Crystal Reports Services
Crystal Reports 2011 Scheduling Service
Adaptive Job Server
Crystal Reports Services
Crystal Reports 2011 Viewing
and Modification Service
RAS
Crystal Reports Services
Crystal Reports Cache Service
Crystal Reports Cache Server
2011-05-06
Architecture
52
Service category
Service
Server Type
Crystal Reports Services
Crystal Reports Processing
Service
Crystal Reports Processing
Server
Crystal Reports Services
Crystal Reports Scheduling
Service
Adaptive Job Server
Dashboard Design Services
Dashboard Design Cache Service
Dashboard Design Cache Server
Dashboard Design Services
Dashboard Design Processing
Service
Dashboard Design Processing
Server
Data Federation Services
Data Federation Service
Adaptive Processing Server
Lifecycle Management Services
LifeCycle Management
ClearCase Service
Adaptive Processing Server
Lifecycle Management Services
Lifecycle Management
Scheduling Service
Adaptive Job Server
Lifecycle Management Services
Lifecycle Management Service
Adaptive Processing Server
Lifecycle Management Services
Visual Difference Scheduling
Service
Adaptive Job Server
Lifecycle Management Services
Visual Difference Service
Adaptive Processing Server
Web Intelligence Services
Document Recovery Service
Adaptive Processing Server
Web Intelligence Services
DSL Bridge Service
Adaptive Processing Server
Web Intelligence Services
Information Engine Service
Web Intelligence Processing
Server
Web Intelligence Services
Web Intelligence Monitoring
Service
Adaptive Processing Server
Web Intelligence Services
Rebean Service
Adaptive Processing Server
Web Intelligence Services
Visualization Service
Adaptive Processing Server
Web Intelligence Services
Web Intelligence Common Service
Web Intelligence Processing
Server
Web Intelligence Services
Web Intelligence Core Service
Web Intelligence Processing
Server
Web Intelligence Services
Web Intelligence Processing
Service
Web Intelligence Processing
Server
2011-05-06
Architecture
Service category
Service
Server Type
Web Intelligence Services
Web Intelligence Scheduling
Service
Adaptive Job Server
2.3.3 Server types
The following table lists each of the servers, ordered by server type. For a description of each service,
see Services.
Table 2-3: Servers, ordered by server type
53
Server Type
Service
Service category
Adaptive Job Server
Authentication Update Scheduling Service
Core Services
Adaptive Job Server
Crystal Reports 2011 Scheduling Service
Crystal Reports Services
Adaptive Job Server
Crystal Reports Scheduling
Service
Crystal Reports Services
Adaptive Job Server
Destination Delivery Scheduling
Service
Core Services
Adaptive Job Server
Lifecycle Management
Scheduling Service
Lifecycle Management Services
Adaptive Job Server
Platform Search Scheduling
Service
Core Services
Adaptive Job Server
Probe Scheduling Service
Core Services
Adaptive Job Server
Program Scheduling Service
Core Services
Adaptive Job Server
Publication Scheduling Service
Core Services
Adaptive Job Server
Replication Service
Core Services
Adaptive Job Server
Security Query Scheduling Service
Core Services
Adaptive Job Server
Visual Difference Scheduling
Service
Lifecycle Management Services
2011-05-06
Architecture
54
Server Type
Service
Service category
Adaptive Job Server
Web Intelligence Scheduling
Service
Web Intelligence Services
Adaptive Processing Server
Adaptive Connectivity Service
Connectivity Services
Adaptive Processing Server
BEx Web Application Service
Analysis Services
Adaptive Processing Server
Client Auditing Proxy Service
Core Services
Adaptive Processing Server
Custom Data Access Service
Connectivity Services
Adaptive Processing Server
Data Federation Service
Data Federation Services
Adaptive Processing Server
Document Recovery Service
Web Intelligence Services
Adaptive Processing Server
DSL Bridge Service
Web Intelligence Services
Adaptive Processing Server
Excel Data Access Service
Connectivity Services
Adaptive Processing Server
Web Intelligence Monitoring
Service
Web Intelligence Services
Adaptive Processing Server
Lifecycle Management
ClearCase Service
Lifecycle Management Services
Adaptive Processing Server
Lifecycle Management Console
Service
Lifecycle Management Services
Adaptive Processing Server
Monitoring Service
Core Services
Adaptive Processing Server
Multi Dimensional Analysis Service
Analysis Services
Adaptive Processing Server
Platform Search Service
Core Services
Adaptive Processing Server
Publishing Post Processing
Service
Core Services
Adaptive Processing Server
Publishing Service
Core Services
Adaptive Processing Server
Rebean Service
Web Intelligence Services
Adaptive Processing Server
Security Token Service
Core Services
Adaptive Processing Server
Translation Service
Core Services
Adaptive Processing Server
Visual Difference Service
Lifecycle Management Services
Adaptive Processing Server
Visualization Service
Web Intelligence Services
ANY SERVER
TraceLog Service
Core Services
2011-05-06
Architecture
55
Server Type
Service
Service category
Central Management Server
Central Management Service
Core Services
Central Management Server
Single Sign-on Service
Core Services
Connection Server
Native Connectivity Service
Connectivity Services
Connection Server
Native Connectivity Service (32bit)
Connectivity Services
Crystal Reports Cache Server
Crystal Reports Cache Service
Crystal Reports Services
Crystal Reports Processing
Server
Crystal Reports 2011 Processing Service
Crystal Reports Services
Crystal Reports Processing
Server
Crystal Reports Processing
Service
Crystal Reports Services
Dashboard Analytics Server
Dashboard Analytics Service
Core Services
Dashboard Design Cache
Server
Dashboard Design Cache Service
Dashboard Design Services
Dashboard Design Processing
Server
Dashboard Design Processing
Service
Dashboard Design Services
Dashboard Server
Dashboard Service
Core Services
Event Server
Event Service
Core Services
Input File Repository Server
Input Filestore Service
Core Services
Output File Repository Server
Output Filestore Service
Core Services
RAS
Crystal Reports 2011 Viewing
and Modification Service
Crystal Reports Services
Web Application Container
Server
BOE Web Application Service
Core Services
Web Application Container
Server
Business Process BI Service
Core Services
Web Application Container
Server
Web Services SDK and QaaWS
Core Services
Web Intelligence Processing
Server
Information Engine Service
Web Intelligence Services
Web Intelligence Processing
Server
Web Intelligence Common Service
Web Intelligence Services
2011-05-06
Architecture
Server Type
Service
Service category
Web Intelligence Processing
Server
Web Intelligence Core Service
Web Intelligence Services
Web Intelligence Processing
Server
Web Intelligence Processing
Service
Web Intelligence Services
2.3.4 Servers
Servers are collections of services running under a Server Intelligence Agent (SIA) on a host. The type
of server is denoted by the services running within it. Servers can be created in the Central Management
Console (CMC). The following table lists the different types of servers that can be created in the CMC.
56
2011-05-06
Architecture
Server
Adaptive Job Server
Description
General server that processes scheduled jobs. When you add a Job
server to the SAP BusinessObjects Business Intelligence platform, you
can configure the Job server to process reports, documents, programs,
or publications and send the results to different destinations.
Adaptive Processing Serv- A generic server that hosts services responsible for processing requests
er
from a variety of sources.
Note:
The installation program installs one Adaptive Processing Server (APS)
per host system. Depending on the features that you've installed, this APS
may host a large number of services, such as the Monitoring Service,
Lifecycle Management Service, Multi-Dimensional Analysis Service
(MDAS), Publishing Service, and others.
If you are installing a production environment, do not use the default APS.
Instead, it is highly recommended that once the installation process is
complete, you perform a system sizing to determine:
• The type and number of APS services.
• The distribution of services across multiple APS servers.
• The optimal number of APS servers. Multiple APS servers provide redundancy, better performance, and higher reliability.
• The distribution of APS servers across multiple nodes.
Create new APS server instances as determined by the sizing process.
For example, if the outcome of your sizing happens to suggest the creation
of one APS for each service category, then may end up creating eight
APS servers. One for each service category: Analysis Services, Connectivity Services, Core Services, Crystal Reports Services, Dashboard Design
Services, Data Federation Services, Lifecycle Management Services, and
Web Intelligence Services.
Central Management Serv- Maintains a database of information about your SAP BusinessObjects
er (CMS)
Business Intelligence platform (in the CMS system database) and audited
user actions (in the Auditing Data Store). All platform services are managed
by the CMS. The CMS also controls access to the system files where
documents are stored, and information on users, user groups, security
levels (including authentication and authorization), and content.
Connection Server
57
Provides database access to source data. It supports relational databases,
as well as OLAP and other formats. The Connection Server is responsible
for handling connection and interaction with the various data sources and
providing a common feature set to clients.
2011-05-06
Architecture
Server
Description
Crystal Reports Cache
Server
Intercepts report requests sent from clients to the page server. If the cache
server cannot fulfill the request with a cached report page, it passes the
request on to the Crystal Reports Processing server, which runs the report
and returns the results. The cache server then caches the report page for
potential future use.
Crystal Reports Processing Responds to page requests by processing reports and generating encapServer
sulated page format (EPF) pages. The key benefit of EPF is that it supports
page-on-demand access, so only the requested page is returned, not the
entire report. This improves system performance and reduces unnecessary
network traffic for large reports.
Dashboard Analytics Serv- Server process used by the BI Workspace component to create and
er
manage corporate and personal BI workspace module content.
Dashboard Server
Used by the BI Workspace component to create and manage corporate
and personal dashboards. BI workspaces offers dashboard management
capabilities to help organizations monitor and understand their business
activities.
Dashboard Design Cache Intercepts report requests sent from clients to the Dashboard server. If
Server
the cache server cannot fulfill the request with a cached report page, it
passes the request on to the Dashboard server, which runs the report and
returns the results. The cache server then caches the report page for potential future use.
Dashboard Design Process- Responds to Dashboard Design requests by processing reports and
ing Server
generating encapsulated page format (EPF) pages. The key benefit of
EPF is that it supports page-on-demand access, so only the requested
page is returned, not the entire report. This improves system performance
and reduces unnecessary network traffic for large reports.
Event Server
58
Monitors the system for events, which can act as a trigger for running a
report. When you set up a event trigger, the Event Server monitors the
condition and notifies the CMS that an event has occurred. The CMS can
then start any jobs that are set to run upon the event.
2011-05-06
Architecture
Server
Description
File Repository Server
Responsible for the creation of file system objects, such as exported reports, and imported files in non-native formats. An Input FRS stores report
and program objects that have been published to the system by administrators or end users. An Output FRS stores all of the report instances
generated by the Job Server.
Web Intelligence Process- Processes SAP BusinessObjects Web Intelligence documents.
ing Server
Report Application Server Provides ad-hoc reporting capabilities that allow users to create and
modify Crystal reports via the SAP Crystal Reports Server Embedded
Software Development Kit (SDK).
2.4 Client applications
You can interact with SAP BusinessObjects Business Intelligence platform using two different types of
desktop applications:
• Desktop applications
These applications must be installed on a supported Microsoft Windows operating system, and can
process data and create reports locally.
Note:
The SAP BusinessObjects Business Intelligence platform installation program no longer installs
desktop applications. To install desktop application on a server, use the stand-alone SAP
BusinessObjects Business Intelligence Platform Client Tools installation program.
Desktop clients allow you to offload some BI report processing onto individual client computers.
Most desktop applications directly access your organization's data through drivers installed on the
desktop, and communicate with your SAP BusinessObjects Business Intelligence platform deployment
through CORBA or encrypted CORBA SSL.
Examples of this type of application include: Crystal Reports and Live Office.
Note:
Although Live Office is a rich functionality application, it interfaces with SAP BusinessObjects Business
Intelligence platform web services over HTTP.
•
Web applications
These applications are hosted by a web application server and can be accessed with a supported
web browser on Windows, Macintosh, Unix, and Linux operating systems.
59
2011-05-06
Architecture
This allows you to provide business intelligence (BI) access to large groups of users, without the
challenges of deploying desktop software products. Communication is conducted over HTTP, with
or without SSL encryption (HTTPS).
Examples of this type of application include BI launch pad, SAP BusinessObjects Web Intelligence,
the Central Management Console (CMC), and report viewers.
2.4.1 Installed with SAP BusinessObjects Business Intelligence Platform Client Tools
2.4.1.1 Web Intelligence Desktop
Web Intelligence Desktop is an ad-hoc analysis and reporting tool for business users with or without
access to the SAP BusinessObjects Business Intelligence platform.
It allows business users to access and combine data from relational, online analytical processing (OLAP),
spreadsheet, or text file sources, using familiar business terms in a drag-and-drop interface. Workflows
allow very broad or very narrow questions to be analyzed, and for further questions to be asked at any
point in the analysis workflow.
Web Intelligence Desktop users can continue to working with Web Intelligence document files (.wid)
even when unable to connect to a Central Management Server (CMS).
2.4.1.2 Business View Manager
Business View Manager allows users to build semantic layer objects that simplify underlying database
complexity.
Business View Manager can create data connections, dynamic data connections, data foundations,
business elements, business views, and relational views. It also allows detailed column and row-level
security to be set for the objects in a report.
Designers can build connections to multiple data sources, join tables, alias field names, create calculated
fields, and then use the simplified structure as a Business View. Report designers and users can then
use the business view as the basis for their reports, rather than and building their own queries from the
data directly.
60
2011-05-06
Architecture
2.4.1.3 Report Conversion Tool
The Report Conversion Tool converts reports to Web Intelligence format and publishes them to a Central
Management Server (CMS).
Reports can be retrieved from the CMS folders Public, Favorites, or Inbox. Once converted,
reports publish to the same folder as the original Web Intelligence report, or to a different folder. The
tool does not convert all Web Intelligence features and reports. The level of conversion depends on the
features in the original report. Some features prevent the report from being converted. Other features
are modified, reimplemented, or removed by the tool during conversion.
The Report Conversion Tool also lets you audit your converted reports. This helps identify reports that
cannot be fully converted by the Report Conversion Tool and explains why.
2.4.1.4 Universe design tool
Universe design tool (formerly Universe Designer) allows data designers to combine data from multiple
sources in a semantic layer that hides database complexity from end users. It abstracts the complexity
of data by using business rather than technical language to access, manipulate, and organize data.
Universe design tool provides a graphical interface to select and view tables in a database. The database
tables are represented as table symbols in a schema diagram. Designers can use this interface to
manipulate tables, create joins between tables, create alias tables, create contexts, and solve loops in
a schema.
You can also create universes from metadata sources. Universe design tool is used for the universe
generation at the end of the creation process.
2.4.1.5 Web service query tool
Web service query tool (formerly Query as a Web Service) allows Business Intelligence (BI) queries to
be used in custom web applications. Business users create a query from a universe connection and
published it as a web service so it can be incorporated into a web application.
Web service query tool provides new client solutions for businesses. For example, it enables SAP
BusinessObjects Dashboard Design (formerly Xcelsius) to aggregate multiple disparate data sources
into a trusted BI view.
Web service query tool also works with a range of client-side solutions, including:
61
2011-05-06
Architecture
•
•
•
•
•
Microsoft Office, Excel, and InfoPath
SAP NetWeaver
OpenOffice
Business rules and process management applications
Enterprise Services
2.4.1.6 Information design tool
Information design tool (formerly Information Designer) is an SAP BusinessObjects metadata design
environment that enables a designer to extract, define, and manipulate metadata from relational and
OLAP sources to create and deploy SAP BusinessObjects universes.
2.4.1.7 Translation Management Tool
SAP BusinessObjects Business Intelligence platform provides support for multilingual documents and
universes. A multilingual document contains localized versions of universe metadata and document
prompts. A user can create reports, for example, from the same universe in their chosen languages.
Translation Management Tool (formerly Translation Manager) defines the multilingual universes and
manages translation of universes and their Web Intelligence documents and prompts.
Translation Management Tool:
• Translates universe or an SAP BusinessObjects Web Intelligence documents for a multilingual
audience.
• Defines the metadata language parts of a document, and the appropriate translation. It generates
external XLIFF format and imports XLIFF files to get translated information.
• Lists the universe or SAP BusinessObjects Web Intelligence document structure to be translated.
• Lets you translate the metadata through the user interface, or though an external translation tool by
importing and exporting XLIFF files.
• Creates multilingual documents.
2.4.1.8 Data Federation Administration Tool
The Data Federation Administration Tool (formerly Data Federator) is a rich client application that offers
easy-to-use features to manage your data federation service.
62
2011-05-06
Architecture
Tightly integrated in the SAP BusinessObjects Business Intelligence platform, the data federation service
enables multi-source universes by distributing queries across disparate data sources, and lets you
federate data through a single data foundation.
The data federation administration tool lets you optimize data federation queries and fine-tune the data
federation query engine for the best possible performance.
You use the data federation administration tool to do the following:
• Test SQL queries.
•
Visualize optimization plans which detail how federated queries are distributed to each source.
•
Compute “statistics” and set system parameters to fine-tune the data federation services and get
the best possible performance.
•
Manage properties to control how queries are executed in each data source at the connector level.
•
Monitor running SQL queries.
•
Browse the history of executed queries.
2.4.1.9 Widgets for SAP BusinessObjects Business Intelligence platform
Widgets are mini-applications that allow easy and fast access to frequently used functions and provide
visual information from your desktop. Widgets for SAP BusinessObjects Business Intelligence platform
(formerly BI Widgets) allows your organization to provide access to existing Business Intelligence (BI)
content on SAP BusinessObjects Business Intelligence platform, or you can add Web Dynpro applications
that are registered as XBCML (Extensible Business Client Markup Language) widgets on the SAP
NetWeaver Application Servers as desktop widgets.
To render XBCML widgets on the user's desktop, SAP Web Dynpro Flex Client is used. The SAP Web
Dynpro Flex Client is a rendering engine based on Adobe Flex which is used for rendering widgets. For
details about how to configure Web Dynpro applications, see the To enable widgets on the SAP
NetWeaver Application Server topic in the Widgets for SAP BusinessObjects User Guide.
Note:
The SAP Web Dynpro Flex Client support for XBCML Widgets begins in release 7.0 EhP2 SP3. Flex
Client queue support is confined only to Flex Client issues found in XBCML widgets in these specified
releases.
With widgets for SAP BusinessObjects Business Intelligence platform, you search or browse for existing
content, such as Web Intelligence documents, Dashboard Design models, and Web Dynpro applications,
then paste the information onto your desktop so it is available when needed.
As a widget, the content gains the following features from the widget framework:
• User-controlled size and positioning
• Automatic refresh
• Optional setting as the top application window
63
2011-05-06
Architecture
•
•
•
•
•
Full SAP BusinessObjects Business Intelligence platform security (Web Intelligence report parts
and Dashboard Design models only)
Saved display
Saved data context state (Web Intelligence report parts only)
Web Intelligence OpenDocument links to detailed reports (Web Intelligence documents only)
Tabbed views (Dashboard Design models only)
2.4.2 Installed with SAP BusinessObjects Business Intelligence Platform
2.4.2.1 Central Configuration Manager (CCM)
The Central Configuration Manager (CCM) is a server troubleshooting and node management tool
provided in two forms. In a Microsoft Windows environment, the CCM allows you to manage local and
remote servers through its graphical user interface (GUI) or from a command line. In a Unix environment,
the CCM shell script (ccm.sh) allows you to manage servers from the command-line.
The CCM allows you to create and configure Server Intelligence Agent (SIA) nodes and start or stop
your web application server. On Windows, it also allows you to configure network parameters, such as
Secure Socket Layer (SSL) encryption. These parameters apply to all servers within a node.
Note:
Most server management tasks are now handled through the CMC, not through the CCM. The CCM
is now used for troubleshooting and node configuration.
2.4.2.2 Upgrade management tool
Upgrade management tool (formerly Import Wizard) is installed as a part of BI platform, and guides
administrators through the process of importing users, groups, and folders from previous versions of
the BI platform. It also allows you to import and upgrade objects, events, server groups, repository
objects, and calendars.
For information on upgrading from a previous version of BI platform, see the SAP BusinessObjects
Business Intelligence Upgrade Guide.
64
2011-05-06
Architecture
2.4.2.3 Repository Diagnostic Tool
The Repository Diagnostic Tool (RDT) can scan, diagnose, and repair inconsistencies that may occur
between the Central Management Server (CMS) system database and the File Repository Servers
(FRS) filestore.
It can also report the repair status and completed actions. To determine synchronization between the
file system and database, RDT should be used after the user first completes a hot back-up. It can also
be used after a restoration and prior to starting their SAP BusinessObjects Business Intelligence platform
services. The user can set a limit for the number of errors the RDT will find and repair before stopping.
2.4.3 Available separately
2.4.3.1 SAP BusinessObjects Analysis, edition for Microsoft Office
SAP BusinessObjects Analysis, edition for Microsoft Office is a premium alternative to Business Explorer
(BEx) and allows business analysts to explore multi-dimensional online analytical processing (OLAP)
data.
Analysts can quickly answer business questions and then share their analysis and workspace with
others as analyses.
SAP BusinessObjects Analysis, edition for Microsoft Office enables analysts to:
• Discover trends, outliers, and details stored in financial systems without the help of a database
administrator.
• Get answers to business questions while viewing large or small multi-dimensional data sets efficiently.
• Access the full range of OLAP data sources available within the organization and share results using
a simple, intuitive interface.
• Access multiple different OLAP sources in the same analyses to get a comprehensive view of the
business and the cross-impact that one trend may have on another.
• Interrogate, analyze, compare, and forecast business drivers.
• Use a comprehensive range of business and time calculations.
65
2011-05-06
Architecture
2.4.3.2 SAP Crystal Reports
SAP Crystal Reports software enables users to design interactive reports from a data source.
2.4.3.3 SAP BusinessObjects Dashboard Design
SAP BusinessObjects Dashboard Design (formerly Xcelsius) is a tool for data visualization and the
creation of dynamic, interactive dashboards. Data and formulae are imported or directly entered into
an embedded Excel spreadsheet. A Flash interface provides a canvas that can display a variety of
analytics and dashboards.
Data can be updated dynamically from SAP BusinessObjects Business Intelligence platform, and
exported to a variety of different formats that can be viewed by data consumers in standard formats,
such as PowerPoint, PDF, or Flash.
2.4.3.4 SAP BusinessObjects Explorer
SAP BusinessObjects Explorer is a data discovery application that uses a powerful search capability
to retrieve answers to business questions from corporate data quickly and directly.
When you install SAP BusinessObjects Explorer, the following servers are added to the SAP
BusinessObjects Business Intelligence platform Central Configuration Manager (CCM) and Central
Management Console (CMC):
• Explorer Master Server: manages all of the Explorer servers.
• Explorer Indexing Server: provides and manages the indexing of information space data and metadata.
• Explorer Search Server: processes search queries and returns the results.
• Explorer Exploration Server: provides and manages the information space exploration and analysis
capabilities including search on data, filtering and aggregation.
2.4.4 Web application clients
66
2011-05-06
Architecture
Web application clients reside on a web application server, and are accessed on a client web browser.
Web applications are automatically deployed when you install SAP BusinessObjects Business Intelligence
platform.
Web applications are easy for users to access from a web browser, and communication can be secured
with SSL encryption if you plan to allow users access from outside your organization's network.
Java web applications can also be reconfigured or deployed after the initial installation by using the
bundled WDeploy command-line tool, which allows you to deploy web applications to a web application
server in two ways:
1. Standalone mode
All web application resources are deployed to a web application server that serves both dynamic
and static content. This arrangement is suitable for small installations.
2. Split mode
The web application's static content (HTML, images, CSS) is deployed to a dedicated web server,
while dynamic content (JSPs) is deployed to a web application server. This arrangement is suitable
for larger installations that will benefit from the web application server being freed up from serving
static web content.
For more information about WDeploy, see the SAP BusinessObjects Business Intelligence Platform
Web Application Deployment Guide.
2.4.4.1 Central Management Console (CMC)
The Central Management Console (CMC) is a web-based tool to perform administrative tasks, including
user, content, and server management. It also allows you to publish, organize, and configure security
settings. Because the CMC is a web-based application, you can perform all of these administrative
tasks through a web browser on any machine that can connect to the server.
All users can log on to the CMC to change their user preference settings. Only members of the
Administrators group can change management settings, unless explicitly granted the rights to do so.
Roles can also be assigned to the CMC to grant some users privileges to perform minor administrative
tasks
2.4.4.2 BI launch pad
BI launch pad (formerly InfoView) is a web-based interface that end users access to view, schedule,
and keep track of published business intelligence (BI) reports. BI launch pad can access, interact with,
and export, any type of business intelligence including reports, analytics, dashboards, scorecards, and
strategy maps.
67
2011-05-06
Architecture
BI launch pad allows users to manage:
• BI catalog browsing and searching.
• BI content access (creating, editing, and viewing).
• BI content scheduling and publishing.
2.4.4.3 BI workspaces
BI workspaces (formerly Dashboard Builder) helps you track your business activities and performance
using modules (templates for data) and Business Intelligence (BI) workspaces (viewing data in one or
more modules). Modules and BI workspaces provide information needed to adjust business rules as
conditions change. It helps you track and analyze key business data via management BI workspaces
and modules. It also supports group decision-making and analysis via integrated collaboration and
workflow capabilities. BI workspaces provides the following features:
• Tab-based browsing
• Page creation: Manage BI workspaces and modules
• A point and click application builder
• Content linking between modules for in-depth data analysis
Note:
To use the BI workspaces features, you must purchase an SAP BusinessObjects Business Intelligence
platform license that includes the use of BI workspaces as part of the agreement.
2.4.4.4 Report viewers
Report viewers support different platforms and different browsers and fall into one of two categories:
•
Client-side report viewers (Active X viewer, Java viewer)
Client-side report viewers are downloaded and installed in the user's browser. When a user requests
a report, the application server processes the request, and retrieves the report pages from SAP
BusinessObjects Business Intelligence platform. The web application server then passes the report
pages to the client-side viewer, which processes the report pages and displays them in the web
browser.
•
Zero-client report viewers (DHTML viewer)
Zero-client report viewers reside on the web application server. When a user requests a report, the
web application server retrieves the report pages from SAP BusinessObjects Business Intelligence
platform and creates DHTML pages that display in the web browser.
All report viewers process report requests and present report pages that appear in the web browser.
68
2011-05-06
Architecture
For more information on the specific functionality or platform support provided by each report viewer,
see the BI Launch Pad User's Guide, the Report Application Server .NET SDK Developer Guide or the
Viewers Java Developer Guide.
2.4.4.5 SAP BusinessObjects Web Intelligence
SAP BusinessObjects Web Intelligence is a web-based tool that provides query, reporting, and analysis
functionality for relational data sources in a single web-based product.
It allows users to create reports, perform ad-hoc queries, analyze data, and format reports in a
drag-and-drop interface. Web Intelligence hides the complexity of underlying data sources.
Reports can be published to a supported web portal, or to Microsoft Office applications using SAP
BusinessObjects Live Office.
2.4.4.6 SAP BusinessObjects Analysis, OLAP edition
SAP BusinessObjects Analysis, OLAP edition (formerly Voyager) is an online analytical processing
(OLAP) tool in the BI launch pad portal for working with multi-dimensional data. It can also combine
information from different OLAP data sources within a single workspace. Supported OLAP providers
include SAP BW and Microsoft Analysis Services.
The Analysis OLAP feature set combines elements of SAP Crystal Reports (direct data access to OLAP
cubes for production reporting) and SAP BusinessObjects Web Intelligence (ad-hoc analytic reporting
with universes from OLAP data sources). It offers a range of business and time calculations, and includes
features such as time sliders to make the analysis of OLAP data as simple as possible.
Note:
The Analysis, OLAP edition web application is available only as a Java web application. There is no
corresponding application for .NET.
2.4.4.7 SAP BusinessObjects Mobile
SAP BusinessObjects Mobile allows your users to remotely access the same business intelligence (BI)
reports, metrics, and real-time data available on desktop clients from a wireless device. Content is
optimized for mobile devices so your users can easily access, navigate, and analyze familiar reports
without additional training.
69
2011-05-06
Architecture
With SAP BusinessObjects Mobile, management and information workers can stay up-to-date and
make decisions using the latest information. Sales and field service staff can provide the right customer,
product, and work order information where and when it's needed.
SAP BusinessObjects Mobile supports a broad set of mobile devices including BlackBerry, Windows
Mobile, and Symbian.
For information on mobile installation, configuration, and deployment, see the SAP BusinessObjects
Mobile Installation and Deployment Guide. For information on using SAP BusinessObjects Mobile, see
the Using SAP BusinessObjects Mobile Guide.
2.5 Information Workflows
When tasks are performed in SAP BusinessObjects Business Intelligence platform, such as logging in,
scheduling a report, or viewing a report, information flows through the system and the servers
communicate with each other. The following section describes some of the process flows as they would
happen in the SAP BusinessObjects Business Intelligence platform system.
2.5.1 Authentication
2.5.1.1 Logging on to SAP BusinessObjects Business Intelligence platform
This workflow describes a user logging on to SAP BusinessObjects Business Intelligence platform from
a web browser.
1. The browser sends the login request via the web server to the web application server.
2. The web application server determines that the request is a logon request. The web application
server sends the username, password, and authentication type to the CMS for authentication.
3. The CMS validates the username and password against the appropriate database (in this case,
Enterprise authentication is used, and user credentials are authenticated against the CMS system
database).
4. Upon successful validation, the CMS creates a session for the user in memory.
5. The CMS sends a response to the web application server to let it know that the validation was
successful. The web application server generates a logon token for the user session in memory.
For the rest of this session, the web application server uses the logon token to validate the user
against the CMS.
70
2011-05-06
Architecture
6. The web application server generates an HTML page to send to the client. The web application
server sends the response back to the user's machine where it is rendered in the web client.
2.5.1.2 SIA start-up
A Server Intelligence Agent (SIA) can be configured to start automatically with the host operating system,
or can be started manually with Central Configuration Manager (CCM).
A SIA retrieves information about the servers it manages from a Central Management Server (CMS).
If the SIA uses a local CMS, and that CMS is not running, the SIA starts the CMS. If a SIA uses a remote
CMS, it attempts to connect to the CMS.
Once a SIA is started, the following sequence of events is performed.
1. The SIA looks in its cache to locate a CMS.
a. If the SIA is configured to start a local CMS, and the CMS is not running, the SIA starts the CMS
and connects.
b. If the SIA is configured to use a running CMS (local or remote), it attempts to connect to the first
CMS in its cache. If the CMS is not currently available, it attempts to connect to the next CMS
in the cache. If none of the cached CMSs are available, the SIA waits for one to become available.
2. The CMS confirms the SIA's identity to ensure that it is valid.
3. Once the SIA has successfully connected to a CMS, it requests a list of servers to manage.
A SIA does not store information about the servers it manages. The configuration information that
dictates which server is managed by a SIA is stored in the CMS system database and is retrieved
from the CMS by the SIA when it starts.
4. The CMS queries the CMS system database for a list of servers managed by the SIA. The
configuration for each server is also retrieved.
5. The CMS returns the list of servers, and their configuration, to the SIA.
6. For each server configured to start automatically, the SIA starts it with the appropriate configuration
and monitors its state. Each server started by the SIA is configured to use the same CMS used by
the SIA.
Any servers not configured to start automatically with the SIA will not start.
2.5.1.3 SIA shutdown
A Server Intelligence Agent (SIA) can be configured to stop automatically with the host operating system,
or can be stopped manually with the Central Configuration Manager (CCM).
When the SIA shuts down, the following steps are performed.
1. The CMS tells the SIA to stop.
71
2011-05-06
Architecture
2. The SIA tells the CMS that it is shutting down.
a. If the SIA is stopping because the host operating system is shutting down, the SIA requests its
servers to stop. Servers that do not stop within 25 seconds are forcefully terminated.
b. If the SIA is being stopped manually, it will wait for the managed server to finish processing
existing jobs. Managed servers will not accept any new jobs. Once all jobs are complete, the
servers stop. Once all servers have stopped, the SIA stops too.
Note:
During a force shutdown, the SIA tells all managed servers to stop immediately.
2.5.2 Scheduling
2.5.2.1 Scheduling an SAP Crystal report
This workflow describes the process of a user scheduling an SAP Crystal report to be run at a future
time.
1. The web client submits a schedule request in a URL, typically via the web server to the web application
server.
2. The web application server interprets the URL request and determines that the request is a schedule
request. The web application server sends the schedule time, database login values, parameter
values, destination, and format to the specified CMS.
3. The Central Management Server (CMS) ensures that the user has rights to schedule the object. If
the user has sufficient rights, the CMS adds a new record to the CMS system database. The CMS
also adds the instance to its list of pending schedules.
2.5.2.2 Scheduling an SAP Crystal report to run now
This workflow describes the process of a user scheduling an SAP Crystal report to be run immediately.
1. The user schedules a report and the request is sent to the web application server.
2. The web application server passes the request to the Central Management Server (CMS).
3. The CMS determines whether or not the user has the appropriate rights to schedule the report.
4. If the user has the appropriate rights to schedule the report, the CMS commits the scheduled object
request to the CMS system database.
5. When the scheduled time arrives, the CMS locates an available Crystal Reports Job Server based
on the "Maximum Jobs Allowed" value configured for each Crystal Reports Job Server.
72
2011-05-06
Architecture
6. The CMS sends the job information to the Crystal Reports Job Server.
7. The Crystal Reports Job Server determines the location of the Input File Repository Server (FRS)
that houses this report. The Crystal Reports Job Server then requests the report template from the
Input FRS.
8. The Input FRS locates the report template and then streams to the Crystal Reports Job Server.
9. The report template is placed in a temporary directory on the Crystal Reports Job Server.
10. The Crystal Reports Job Server launches a child process (JobServerChild.exe) to coordinate running
the report.
11. JobServerChild.exe launches ProcReport.dll and passes it all instances received from the Crystal
Reports Job Server. ProcReport.dll calls Crpe32.dll.
12. The report is created when the Crpe32.dll completes the following tasks:
• Open the report.
• Connect to the production database.
• Process the report.
• Create and save the report instance.
• Pass the report back to JobServerChild.exe.
13. The Crystal Reports Job Server updates the CMS periodically with the job status. At this time the
status shows that the report is processing.
14. JobServerChild.exe uploads the report instance to the Output FRS.
15. The Output FRS notifies the JobServerChild.exe that the report has been saved successfully.
16. JobServerChild.exe notifies the Crystal Reports Job Server that the report creation has completed.
17. The Report Job Server updates the CMS with the job status. The JobServerChild.exe clears itself
from memory.
18. The CMS updates the job status in its memory, and then writes the instance information to the CMS
system database.
2.5.2.3 A scheduled SAP Crystal report runs
This workflow describes the process of a scheduled an SAP Crystal report running at a scheduled time.
1. The Central Management Server (CMS) checks the CMS system database to determine if there is
any scheduled SAP Crystal report to be run at that time.
2. When scheduled job time arrives, the CMS locates an available Crystal Reports Job Server based
on the "Maximum Jobs Allowed" value configured on each Crystal Reports Job Server. The CMS
sends the job information to the Crystal Reports Job Server. The information the CMS sends to the
Crystal Reports Job Server is Report ID, Format, Destination, Logon information, parameters, and
selection formulas.
3. The Crystal Reports Job Server communicates with the Input File Repository Server (FRS) to obtain
a report template as per the requested Report ID.
4. The Crystal Reports Job Server launches the JobChildserver process.
73
2011-05-06
Architecture
5. The child process (JobChildserver) launches the ProcReport.dll upon receiving the template from
the Input File Repository Server via the Enterprise Infrastructure. The ProcReport.dll contains all of
the parameters that were passed from the CMS to the Crystal Reports Job Server.
6. The ProcReport.dll launches the Crpe32.dll that processes the report according to all the parameters
that were passed.
7. While still processing, records are retrieved from a database server as defined within a report.
8. The Crystal Reports Job Server updates the CMS periodically with the job status. At this time the
status shows that it is processing.
9. Once the report is compiled into the memory of the Crystal Reports Job Server, it needs to be
exported to a different format, such as Portable Document Format (PDF). When exporting to PDF,
the PDF .dll is used.
10. The report with saved data also needs to be submitted to the default location. Then it is sent to the
Output FRS.
11. Once that process is finished, the Crystal Reports Job Server updates the CMS with the job status.
At this time the status is reported as a success.
12. The CMS updates the job status in its memory, and then writes the instance information to the CMS
system database.
2.5.2.4 Scheduling an SAP BusinessObjects Web Intelligence document
This workflow describes the process of a user scheduling an SAP BusinessObjects Web Intelligence
document to be run at a future time.
1. The user sets a schedule for a document and the request is sent to the web server. The web server
passes the document schedule request to the web application server.
2. The web application server passes the document schedule request to the CMS.
3. The CMS determines whether or not the user has the appropriate rights to schedule the document.
4. An instance of the SAP BusinessObjects Web Intelligence document is created in the CMS that
contains all the relevant scheduling information.
5. If the user has the appropriate rights to schedule the document, the user then sets the different
scheduling parameters.
6. The CMS commits the scheduled object request to the system database.
2.5.2.5 A scheduled SAP BusinessObjects Web Intelligence, OLAP edition document
runs
This workflow describes the process of a scheduled an SAP BusinessObjects Web Intelligence document
running at a scheduled time.
74
2011-05-06
Architecture
1. The Central Management Server (CMS) checks the CMS system database to determine if there is
a scheduled SAP BusinessObjects Web Intelligence job to be run.
2. When the scheduled time arrives, the CMS sends the schedule request and all the information about
the request to the Adaptive Job Server that houses the SAP BusinessObjects Web Intelligence
Scheduling and Publishing Service.
3. The Adaptive Job Server (Web Intelligence Scheduling and Publishing Service) locates an available
Web Intelligence Processing Server based on the Maximum Jobs Allowed value configured on each
SAP BusinessObjects Web Intelligence Processing Server.
4. The SAP BusinessObjects Web Intelligence Processing Server determines the location of the Input
File Repository Server (FRS) that houses the document and the universe metalayer file on which
the document is based. The SAP BusinessObjects Web Intelligence Processing Server then requests
the document from the Input FRS. The Input FRS locates the SAP BusinessObjects Web Intelligence
document as well as the universe file on which the document is based and then streams them to
the SAP BusinessObjects Web Intelligence Processing Server.
5. The SAP BusinessObjects Web Intelligence document is placed in a temporary directory on the
SAP BusinessObjects Web Intelligence Processing Server. The SAP BusinessObjects Web
Intelligence Processing Server opens the document in memory. The QT.dll generates the SQL from
the Universe on which the document is based. The Connection Server (component of the SAP
BusinessObjects Web Intelligence Process Server) connects to the database. The query data passes
through QT.dll back to the Document Engine where the document is processed. A new successful
instance is created.
6. The SAP BusinessObjects Web Intelligence Processing Server uploads the document instance to
the Output FRS.
7. The SAP BusinessObjects Web Intelligence Processing Server notifies the Adaptive Job Server
(SAP BusinessObjects Web Intelligence Scheduling and Publishing Service) that document creation
is completed. If the document is scheduled to go to a destination (file system, FTP, SMTP, or Inbox),
the Adaptive Job Server retrieves the processed document from the Output FRS and delivers it to
the specified destination(s). Assume that this is not the case in this example.
8. The Adaptive Job Server (Web Intelligence Scheduling and Publishing Service) updates the CMS
with the job status.
9. The CMS updates the job status in its memory, and then writes the instance information to the CMS
system database.
2.5.2.6 Scheduling an object
This workflow describes the process of a user scheduling an object to be run.
1. The user schedules an object and the request is sent to the web server.
2. The web server passes the object schedule request to the web application server.
3. The web application server passes the request to the Central Management Server (CMS).
4. The CMS determines if the user has the appropriate rights to schedule the object.
5. If the user has the appropriate rights to schedule the object, the CMS commits the scheduled object
request to the CMS system database.
75
2011-05-06
Architecture
6. When the scheduled time arrives, the CMS locates an available Program Job Server based on the
Maximum Jobs Allowed value configured on each Program Job Server.
7. The CMS sends the job information to the Program Job Server.
8. The Program Job Server communicates with the Input File Repository Server and requests the
program object.
9. The Input File Repository Server returns the program object back to the Program Job Server.
10. The Program Job Server launches the scheduled object.
11. The Program Job Server updates the CMS periodically with the job status. At this time the status
reported is that the program is processing.
12. The Program Job Server sends a log file to the Output File Repository Server.
13. The Output File Repository Server notifies the Program Job Server that the object was scheduled
successfully by sending an object log file.
14. The Program Job Server updates the CMS with the job status.
15. The CMS updates the job status in its memory, and then writes the object instance information to
the CMS system database.
2.5.2.7 Scheduling an object to run now
This workflow describes the process of a user scheduling an object to be run immediately.
1. The user schedules an object and the request is sent to the web server.
2. The web server passes the object schedule request to the web application server.
3. The web application server passes the request to the Central Management Server (CMS).
4. The CMS determines if the user has the appropriate rights to schedule the object.
5. If the user has the appropriate rights to schedule the object, the CMS commits the scheduled object
request to the CMS system database.
6. When the scheduled time arrives, the CMS locates an available Program Job Server based on the
"Maximum Jobs Allowed" value configured on each Program Job Server.
7. The CMS sends the job information to the Program Job Server.
8. The Program Job Server communicates with the Input File Repository Server and requests the
program object.
9. The Input File Repository Server returns the program object back to the Program Job Server.
10. The Program Job Server launches the scheduled object.
11. The Program Job Server updates the CMS periodically with the job status. At this time the status
reported is that the program is processing.
12. The Program Job Server sends a log file to the Output File Repository Server.
13. The Output File Repository Server notifies the Program Job Server that the object was scheduled
successfully by sending an object log file.
14. The Program Job Server updates the CMS with the job status.
76
2011-05-06
Architecture
15. The CMS updates the job status in its memory, and then writes the object instance information to
the CMS system database.
2.5.3 Viewing
2.5.3.1 Viewing an SAP Crystal report
This workflow describes the process of a user requesting a page in an SAP Crystal report when the
report does not already exist on a cache server.
1. The user sends the view request through the web server to the web application server.
2. The web application server recognizes the request as a request to view a report page. The web
application server checks the Central Management Server (CMS) to ensure the user has sufficient
rights to view the report.
3. The CMS determines if the user has the appropriate rights to view the report.
4. The CMS sends a response to the web application server to confirm the user has sufficient rights
to view the report.
5. The web application server sends a request to the Crystal Reports Cache Server for the requested
report page.
6. The Crystal Reports Cache Server determines if the requested file exists in the cache directory.
7. The requested EPF file is not found in the cache directory.
8. The Crystal Reports Cache Server sends the request to the Crystal Reports Page Server.
9. The Crystal Reports Page Server queries the Output File Repository Server (FRS) for the requested
report instance.
10. The Output FRS sends the requested report instance to the Crystal Reports Page Server.
11. The Crystal Reports Page Server opens the report instance and checks the report to determine if it
has data.
12. The Crystal Reports Page Server determines that the report contains data and creates the file for
the requested report page without having to connect to the production database.
13. The Crystal Reports Page Server sends the EPF file to the Crystal Reports Cache Server.
14. The Crystal Reports Cache Server writes the EPF file to the cache directory.
15. The Crystal Reports Cache Server sends the requested page to the web application server.
16. The web application server forwards the file to the web server.
17. The web server sends the requested page to the report viewer.
77
2011-05-06
Architecture
2.5.3.2 Viewing a cached SAP Crystal report
This workflow describes the process of a user requesting a page in an SAP Crystal report, when the
report already exists on a cache server.
1. A web client sends a view request in a URL to the web application server.
2. The web application server interprets the request and determines that it is a request to view the first
page of a selected report instance. The web application server sends a request to the Central
Management Server (CMS) to ensure that the user has rights to view the instance.
3. The CMS checks the CMS system database to verify the user rights.
4. The CMS sends a response to the web application server to confirm the user has sufficient rights
to view the instance.
5. The web application server sends a request to the Crystal Reports Cache Server requesting the
first page of the report instance. The Crystal Reports Cache Server checks to see if the page already
exists. If the page does exist, the Crystal Reports Cache Server returns the page to the web
application server.
6. The web application server sends the page to the web client, where the page is rendered and
displayed.
2.5.3.3 Viewing an SAP Analysis, OLAP edition workspace
This workflow describes the process of a user requesting an SAP Analysis, OLAP edition (formerly
Voyager) workspace.
1. The web client sends a request via the web server to the web application server to view a new
workspace. The web client communicates with the web application server using DHTML AJAX
technology (Asynchronous JavaScript and XML). The AJAX technology allows for partial page
updates, so a new page does not have to be rendered for each new request.
2. The web application server translates the request and sends it to the Central Management Server
(CMS) to determine whether a user is entitled to view or create a new workspace.
3. The CMS retrieves the user's credentials from the CMS system database.
4. If the user is allowed to view or create a workspace, the CMS confirms this to the web application
server. At the same time, it also sends a list of one or more available Multi-Dimensional Analysis
Service (MDAS).
5. The web application server picks an MDAS from the list of available choices and sends a CORBA
request to the service to find the appropriate OLAP server(s) to create a new, or refresh an existing,
workspace.
6. The MDAS needs to communicate with the Input File Repository Server (FRS) to retrieve the
appropriate workspace document that has information about the underlying OLAP database and an
78
2011-05-06
Architecture
initial OLAP query saved with it. The Input FRS retrieves the appropriate Advanced Analyzer
workspace from the underlying directory and streams that workspace back to the MDAS.
7. The MDAS opens the workspace, formulates a query, and sends it to the OLAP database server.
The MDAS has to have an appropriate OLAP database client configured for the OLAP data source.
The translation of the web client query into the appropriate OLAP query needs to occur. The OLAP
database server sends the query result back to the MDAS.
8. The MDAS, based on the request to either create, view, print, or export, pre-renders the result to
enable the Java WAS to finish the rendering more quickly. The MDAS sends XML packages of the
rendered result back to the web application server.
9. The web application server renders the workspace and sends the formatted page or portion of the
page to the web client via the web server. The web client displays the updated or newly requested
page. This is a zero-client solution that does not need to download any Java or ActiveX components.
2.5.4 On Demand
2.5.4.1 Viewing an SAP Crystal report on demand
This workflow describes the process of a user requesting an SAP Crystal report page on demand.
1. The web client sends the view on demand request in a URL typically via the web server to the web
application server.
2. The web application server interprets the requested page and the values sent in the URL request
and determines that it is a request to view the first page of the selected report object.
3. The web application server sends a request to the Central Management Server (CMS) to ensure
that the user has rights to view the object. The CMS checks the CMS system database to verify the
user rights.
4. The CMS sends a response to the web application server to confirm the user has sufficient rights
to view the object.
5. The web application server sends a request to the Crystal Reports Cache Server requesting the
first page of the report object.
6. The Crystal Reports Cache Server checks to see if the page already exists. Unless the report meets
the requirements for On Demand report sharing (within a set time of another On Demand request,
database login, parameters), the Crystal Reports Cache Server sends a request for the Crystal
Reports Processing Server to generate the page.
7. The Crystal Reports Processing Server requests the report object from the Input File Repository
Server. The Input File Repository Server streams a copy of the object to the Crystal Reports
Processing Server. The Crystal Reports Processing Server opens the report in its memory and
checks to see if the report contains data.
79
2011-05-06
Architecture
8. Assuming that there is no data in the report object, the Crystal Reports Processing Server must
connect to the database to query for data.
9. The Crystal Reports Processing Server sends the page to the Crystal Reports Cache Server. The
Crystal Reports Cache Server stores a copy of the page in its cache directory in anticipation of new
viewing requests.
10. The Crystal Reports Cache Server sends the page to the web application server.
11. The web application server sends the .epf page to the web server. The web server sends the page
to the user's machine where it is rendered in the viewer in the web client.
2.5.4.2 Viewing an SAP BusinessObjects Web Intelligence document on demand
This workflow describes the process of a user viewing an SAP BusinessObjects Web Intelligence
document on demand.
1. A web browser sends the view request to the web application server via the web server.
2. The web application server determines that the request is for an Web Intelligence document, and
sends a request to the Central Management Server (CMS) to ensure the user has the appropriate
rights to view the document.
3. The CMS sends a response to the web application server to confirm the user has sufficient rights
to view the document.
4. The web application server sends a request to the Web Intelligence Processing Server, requesting
the document.
5. The Web Intelligence Processing Server requests the document from the Input File Repository
Server (FRS) as well as the universe file on which the requested document is built. The universe
file contains metalayer information, including row- and column-level security.
6. The Input FRS streams a copy of the document to the Web Intelligence Processing Server, as well
as the universe file on which the requested document is built.
7. The Web Intelligence Report Engine opens the document in memory.
8. The Web Intelligence Report Engine uses QT component (inproc) and Connection Server (inproc).
The QT component generates/validates/regenerates the SQL and connects to the database to run
the query. The Connection Server uses the SQL to get the data from the database to the Report
Engine where the document is processed.
9. The Web Intelligence Processing Server sends the viewable document page that was requested to
the web application server. The web application server forwards this viewable page to the web
server. The web server sends the viewable page to the user's machine, where it is rendered in a
web browser.
2.5.4.3 Viewing an SAP Crystal report on demand when the default view format
is set to Web Java
80
2011-05-06
Architecture
This workflow describes the process of a user viewing an SAP Crystal report when the default view
format is set to Web Java.
1. The web client sends the view on demand request via the web server to the web application server.
2. The web application server interprets the requested page and the values sent in the URL request
and determines that it is a request to view the first page of the selected report object.
3. The web application server sends a request to the Central Management Server (CMS) to ensure
that the user has rights to view the object. The CMS checks the CMS system database to verify the
user rights.
4. The CMS sends a response to the web application server to confirm the user has sufficient rights
to view the object.
5. The web application server sends a request to the Crystal Reports Cache Server requesting the
first page of the report object.
6. The Crystal Reports Cache Server checks to see if the page already exists. Unless the report meets
the requirements for On Demand report sharing (within a set time of another On Demand request,
database login, parameters), the Crystal Reports Cache Server sends a request for the Crystal
Reports Processing Server to generate the page.
7. The Crystal Reports Processing Server requests the report object from the Input File Repository
Server. The Input File Repository Server streams a copy of the object to the Crystal Reports
Processing Server. The Crystal Reports Processing Server opens the report in its memory and
checks to see if the report contains data.
8. Assuming that there is no data in the report object, the Crystal Reports Processing Server must
connect to the database to query for data.
9. The Crystal Reports Processing Server sends the .epf page to the Crystal Reports Cache Server.
The Crystal Reports Cache Server stores a copy of the .epf page in its cache directory in anticipation
of new viewing requests. An .etf page may also be generated and sent to the Crystal Reports Cache
Server in this step. The .etf page (left-pane group tree navigation of the report) is generated when
the first page of the report is generated and when the report is grouped. There is only one .etf page
per report, but the size of this .etf page can be substantial.
10. The Crystal Reports Cache Server sends the .epf page to the web application server.
11. The web application server sends the .epf page to the web server. The web server sends the .epf
page to the user's machine where it is rendered in the viewer in the web client.
81
2011-05-06
Architecture
82
2011-05-06
Managing Licenses
Managing Licenses
3.1 Managing License keys
This section describes how to manage license keys for your BI platform deployment.
Related Topics
• To view license information
• To add a license key
• To view current account activity
3.1.1 To view license information
The License Keys management area of the CMC identifies the number of role-based (BI Viewer and
BI Analyst), concurrent, named, and processor licenses that are associated with each key.
1. Go to the License Keys management area of the CMC.
2. Select a license key.
The details associated with the key appear in the License Key Information area. To purchase
additional license keys, contact your SAP sales representative.
Related Topics
• Managing License keys
• To add a license key
• To view current account activity
3.1.2 To add a license key
83
2011-05-06
Managing Licenses
If you are upgrading from a trial version of the product, be sure to delete the Evaluation key prior to
adding any new license keys or product activation keycodes.
1. Go to the License Keys management area of the CMC.
2. Type the key in the Add Key field.
3. Click Add.
The key is added to the list.
Related Topics
• To view license information
• To view current account activity
3.1.3 To view current account activity
1. Go to the Settings management area of the CMC.
2. Click View global system metrics.
This section displays current license usage, along with additional job metrics.
Related Topics
• Managing License keys
• To add a license key
• To view license information
3.2 Measuring licenses
The BusinessObjects License Measurement Tool (BOLMT) is a java command-line utility used to collect
and store BI platform licensing data. The output XML document contains license deployment
measurements and is sent to SAP Global License Auditing Services (GLAS) for consolidation as part
of a license audit.
The system administrator installs and runs BOLMT for every BI platform cluster whenever a license
audit is requested. BOLMT collects usage measurements on role-based, named, and concurrent user
licenses.
The administrator can specify a particular output directory for the XML document, and configure the
output document to not contain any information that may be used to identify system users.
84
2011-05-06
Managing Licenses
3.2.1 To run a license audit
To perform a license audit, you will need administrator rights and access to the directory containing the
BOLMT.jar file in the BI platform installation.
1. Open a command line console.
2. Change directories to the directory containing the java executables for your BI platform installation
By default the file is installed in the following directory:[INSTALLDIR]\SAP BusinessObjects
Enterprise XI 4.0\java\lib
3. Execute the BOLMT.jar.
The execution command is entered in the following format: -jar BOLMT.jar [options] <outputFile>
The table below summarizes the available options:
Option
Description
-c --cms
Specifies the name identifier and port number for the Central Management
Server (CMS). Specified as cmsname:port number. By default, the CMS
settings for the local host are used if this setting is not specified.
-p --password
Specifies the administrator account password used to connect to the CMS.
-a--auth
Specifies the authentication method to connect user to the CMS. Default method
is Enterprise specified as secEnterprise.
-s--sanitize
Specifies that the output audit document should filter out any personal information that may be used to identify users.
Note:
The output file specification is always the last argument in the command line. It is an optional setting.
If no argument is specified, the output goes to the console's standard output. You can also pipe
output to script as a command line argument.
Example:
C:\Program Files (x86)\SAP
Business Objects\SAP BusinessObjects Enterprise XI 4. 0\java\lib>"C:\Program Files
(x86)\SAP Business Objects\SAP BusinessObjects Enterprise XI 4.0\win64_x64\sapjvm\bin
\java.exe" -jar BOLMT.jar --cms=mycms:6400 -uAdministrator
-p=7juujg --auth=secEnterprise --sanitize audit.xml
85
2011-05-06
Managing Licenses
86
2011-05-06
Managing Users and Groups
Managing Users and Groups
4.1 Account management overview
Account management involves all of the tasks related to creating, mapping, changing, and organizing
user and group information. The "Users and Groups" management area of the Central Management
Console (CMC) provides a central place to perform these tasks.
After the user accounts and groups have been created, you can add objects and specify rights to them.
When the users log on, they can view the objects using BI launch pad or their custom web application.
4.1.1 User management
In the "Users and Groups" management area, you can specify everything required for a user to access
BI platform. You can also view the two default user accounts summarized by the “Default user accounts”
table.
Table 4-1: Default user accounts
87
Account name
Description
Administrator
This user belongs to the Administrators and
Everyone groups. An administrator can perform
all tasks in all BI platform applications (for example, the CMC, CCM, Publishing Wizard, and BI
launch pad).
Guest
This user belongs to the Everyone group. This
account is enabled by default, and is not assigned
a password by the system. If you assign it a
password, the single sign-on to BI launch pad will
be broken.
SMAdmin
This is a read-only account used by SAP Solution
Manager to access BI platform components.
2011-05-06
Managing Users and Groups
4.1.1.1 Role-based licensing
Under the user-role based licensing scheme, there are two roles which can be assigned to BI platform
users:
•
•
BI Analyst
BI Viewer
Each role is bundled with specific access levels to BI platform applications. You cannot modify or
override the access level to either user role. User roles apply to new user accounts created in BI platform
or existing users imported from third party directory services such as Windows AD or LDAP.
Note:
User roles should not be confused with group membership. When you assign a user one of the two
available roles, the user is automatically assigned predefined rights to applications. To associate a user
with specific group access levels, you must add the user to the desired group.
Click License Key in the CMC for more information on your licensing scheme, or contact your SAP
Business Objects account manager for further information on access rights for each user role.
4.1.1.1.1 BI Analyst role
The BI Analyst role is designed for users who create content in the BI platform system. Users who edit
or create reports, design and manage universes, or perform any administrative tasks in the CMC should
be assigned the BI Analyst role.
4.1.1.1.2 BI Viewer role
The BI Viewer role is designed primarily for content consumers. These users only view reports but do
not modify content.
Users assigned to the BI Viewer role will be prevented by the system from creating content, modifying
reports and performing general administrative tasks in the system. The BI Viewer role should not be
assigned to users who need to:
• Create reports
• Update or modify reports
• Perform administrative tasks using the CMC
Note:
BI Viewer users cannot access the CMC.
88
2011-05-06
Managing Users and Groups
4.1.2 Group management
Groups are collections of users who share the same account privileges; therefore, you may create
groups that are based on department, role, or location. Groups enable you to change the rights for
users in one place (a group) instead of modifying the rights for each user account individually. Also,
you can assign object rights to a group or groups.
In the "Users and Groups" area, you can create groups that give a number of people access to the
report or folder. This enables you to make changes in one place instead of modifying each user account
individually. You can also view the several default group accounts summarized by the “Default group
accounts” table.
To view available groups in the CMC, click Group List in the Tree panel. Alternatively, you can click
Group Hierarchy to display a hierarchal list of all available groups.
Table 4-2: Default group accounts
89
Account name
Description
Administrators
Members of this group can perform all tasks in all
of the BI platform applications (CMC, CCM, Publishing Wizard, and BI launch pad). By default,
the Administrators group contains only the Administrator user.
Everyone
Each user is a member of the Everyone group.
QaaWS Group Designer
Members of this group have access to Query as
a Web Service.
Report Conversion Tool Users
Members of this group have access to the Report
Conversion Tool application.
Translators
Members of this group have access to the
Translation Manager application.
2011-05-06
Managing Users and Groups
Account name
Description
Universe Designer Users
Users who belong to this group are granted access to the Universe Designer folder and the
Connections folder. They can control who has
access rights to the Designer application. You
must add users to this group as needed. By default, no user belongs to this group.
Related Topics
• How rights work in BI platform
• Granting access to users and groups
4.1.3 Available authentication types
Before setting up user accounts and groups within BI platform, decide which type of authentication you
want to use. The “Authentication types” table summarizes the authentication options which may be
available to you, depending on the security tools your organization uses.
Table 4-3: Authentication types
90
Authentication type
Description
Enterprise
Use the system default Enterprise Authentication
if you prefer to create distinct accounts and
groups for use with BI platform, or if you have not
already set up a hierarchy of users and groups in
an LDAP directory server, or a Windows AD
server.
LDAP
If you set up an LDAP directory server, you can
use existing LDAP user accounts and groups in
BI platform. When you map LDAP accounts to BI
platform, users are able to access BI platform
applications with their LDAP user name and
password. This eliminates the need to recreate
individual user and group accounts within BI
platform.
2011-05-06
Managing Users and Groups
91
Authentication type
Description
Windows AD
You can use existing Windows AD user accounts
and groups in BI platform. When you map AD
accounts to BI platform, users are able to log on
to BI platform applications with their AD user
name and password. This eliminates the need to
recreate individual user and group accounts
within BI platform.
SAP
You can map existing SAP roles into BI platform
accounts. After you map SAP roles, users are
able to log on to BI platform applications with their
SAP credentials. This eliminates the need to
recreate individual user and group accounts
within BI platform.
Oracle EBS
You can map existing Oracle EBS roles into BI
platform accounts. After you map Oracle EBS
roles, users are able to log on to BI platform applications with their Oracle EBS credentials. This
eliminates the need to recreate individual user
and group accounts within BI platform.
Siebel
You can map existing Siebel roles into BI platform
accounts. After you map Siebel roles, users are
able to log on to BI platform applications with their
Siebel credentials. This eliminates the need to
recreate individual user and group accounts
within BI platform.
PeopleSoft Enterprise
You can map existing PeopleSoft roles into BI
platform accounts. After you map PeopleSoft
roles, users are able to log on to BI platform applications with their PeopleSoft credentials. This
eliminates the need to recreate individual user
and group accounts within BI platform.
JD Edwards EnterpriseOne
You can map existing JD Edwards roles into BI
platform accounts. After you map JD Edwards
roles, users are able to log on to BI platform applications with their JD Edwards credentials. This
eliminates the need to recreate individual user
and group accounts within BI platform.
2011-05-06
Managing Users and Groups
4.2 Managing Enterprise and general accounts
Since Enterprise authentication is the default authentication method for the BI platform, it is automatically
enabled when you first install the system. When you add and manage users and groups, BI platform
maintains the user and group information within its database.
Note:
When a user logs off their web session on BI platform by navigating to a non-platform page or closing
their web browser, their Enterprise session is not logged off and they still hold a license. The Enterprise
session will time out after approximately 24 hours. To end the user's Enterprise session and free the
license for use by others, the user must log out of the platform.
4.2.1 To create a user account
When you create a new user, you specify the user's properties and select the group or groups for the
user.
1. Go to the "Users and Groups" management area of the CMC.
2. Click Manage > New > New User.
The "New User" dialog box appears.
3. To create an Enterprise user,
a. Select Enterprise from the Authentication Type list.
b. Type the account name, full name, email, and description information.
Tip:
Use the description area to include extra information about the user or account.
c. Specify the password information and settings.
4. To create a user that will logon using a different authentication type, select the appropriate option
from the Authentication Type list, and type the account name.
5. Specify how to designate the user account according to options stipulated by your SAP
BusinessObjects Business Intelligence platform license agreement.
If your license agreement is based on user roles, select one of the following options:
• BI Viewer: access to BI platform applications for all accounts under the BI Viewer role is defined
in the license agreement. Users are restricted to access application workflows that are defined
for the BI Viewer role. Access rights are generally limited to viewing business intelligence
documents. This role is typically suitable for users who consume content through platform
applications.
• BI Analyst: access to BI platform applications for all accounts under the BI Analyst role is defined
in the license agreement. Users can access all applications workflows that are defined for the BI
92
2011-05-06
Managing Users and Groups
Analyst role. Access rights include viewing and modifying business intelligence documents. This
role is typically suitable for users who create and modify content for platform applications
If your license agreement is not based on user roles, specify a connection type for the user account.
• Choose Concurrent User if this user belongs to a license agreement that states the number of
users allowed to be connected at one time.
• Choose Named User if this user belongs to a license agreement that associates a specific user
with a license. Named user licenses are useful for people who require access to BI platform
regardless of the number of other people who are currently connected.
6. Click Create & Close.
The user is added to the system and is automatically added to the Everyone group. An inbox is
automatically created for the user, together with an Enterprise alias. You can now add the user to
a group or specify rights for the user.
Related Topics
• How rights work in BI platform
• Role-based licensing
4.2.2 To modify a user account
Use this procedure to modify a user's properties or group membership.
Note:
The user will be affected if he or she is logged on when you are making the change.
1. Go to the "Users and Groups" management area of the CMC.
2. Select the user whose properties you want to change.
3. Click Manage > Properties.
The "Properties" dialog box for the user appears.
4. Modify the properties for the user.
In addition to all of the options that were available when you initially created the account, you now
can disable the account by selecting the Account is disabled check box.
Note:
Any changes you make to the user account do not appear until the next time the user logs on.
5. Click Save & Close.
Related Topics
• To create a new alias for an existing user
93
2011-05-06
Managing Users and Groups
4.2.3 To delete a user account
Use this procedure to delete a user's account. The user might receive an error if they are logged on
when their account is deleted. When you delete a user account, the Favorites folder, personal categories,
and inbox for that user are deleted as well.
If you think the user might require access to the account again in the future, select the Account is
disabled check box in the "Properties" dialog box of the selected user instead of deleting the account.
Note:
Deleting a user account won't necessarily prevent the user from being able to log on to BI platform
again. If the user account also exists in a third-party system, and if the account belongs to a third-party
group that is mapped to BI platform, the user may still be able to log on.
1. Go to the "Users and Groups" management area of the CMC.
2. Select the user you want to delete.
3. Click Manage > Delete.
The delete confirmation dialog box appears.
4. Click OK.
The user account is deleted.
Related Topics
• To modify a user account
• To delete a user account
• To disable an alias
4.2.4 To create a new group
1. Go to the "Users and Groups" management area of the CMC.
2. Click Manage > New > New Group.
The "Create New User Group" dialog box appears.
3. Enter the group name and description.
4. Click OK.
After creating a new group, you can add users, add subgroups, or specify group membership so that
the new group is actually a subgroup. Because subgroups provide you with additional levels of
organization, they are useful when you set object rights to control users' access to your BI platform
content.
94
2011-05-06
Managing Users and Groups
4.2.5 To modify a group's properties
You can modify a group's properties by making changes to any of the settings.
Note:
The users who belong to the group will be affected by the modification the next time they log on.
1. In the "Users and Groups" management area of the CMC, select the group.
2. Click Manage > Properties.
The "Properties" dialog box appears.
3. Modify the properties for the group.
Click the links from the navigation list to access different dialog boxes and modify different properties.
• If you want to change the title or description for the group, click Properties.
• If you want to modify the rights that principals have to the group, click User Security.
• If you want to modify profile values for group members, click Profile Values.
• If you want to add the group as a subgroup to another group, click Member Of.
4. Click Save.
4.2.6 To view group members
You can use this procedure to view the users who belong to a specific group.
1. Go to the "Users and Groups" management area of the CMC.
2. Expand Group Hierarchy in the Tree panel.
3. Select the group in the Tree panel.
Note:
It may take a few minutes for your list to display if you have a large number of users in the group or
if your group is mapped to a third-party directory.
The list of users who belong to the group is displayed.
4.2.7 To add subgroups
You can add a group to another group. When you do this, the group that you added becomes a subgroup.
95
2011-05-06
Managing Users and Groups
Note:
Adding a subgroup is similar to specifying group membership.
1. In the "Users and Groups" management area of the CMC, select the group that you want to add as
a subgroup to another group.
2. Click Actions > Join Group.
The "Join Group" dialog box appears.
3. Move the group that you want to add the first group to from the Available Groups list to the
Destination Group(s) list.
4. Click OK.
Related Topics
• To specify group membership
4.2.8 To specify group membership
You can make a group a member of another group. The group that becomes a member is referred to
as a subgroup. The group that you add the subgroup to is the parent group. A subgroup inherits the
rights of the parent group.
1. In the "Users and Groups" management area of the CMC, click the group that you want to add to
another group.
2. Click Actions > Member Of.
The "Member Of" dialog box appears.
3. Click Join Group.
The "Join Group" dialog box appears.
4. Move the group that you want to add the first group to from the Available Groups to the Destination
Group(s) list.
Any rights associated with the parent group will be inherited by the new group you have created.
5. Click OK.
You return to the "Member Of" dialog box, and the parent group appears in the parent groups list.
4.2.9 To delete a group
You can delete a group when that group is no longer required. You cannot delete the default groups
Administrator and Everyone.
96
2011-05-06
Managing Users and Groups
Note:
•
•
The users who belong to the deleted group will be affected by the change the next time they log on.
The users who belong to the deleted group will lose any rights they inherited from the group.
To delete a third-party authentication group, such as the Windows AD Users group, use the
"Authentication" management area in CMC.
1. Go to the "Users and Groups" management area of the CMC.
2. Select the group you want to delete.
3. Click Manage > Delete.
The delete confirmation dialog box appears.
4. Click OK.
The group is deleted.
4.2.10 To enable the Guest account
The Guest account is disabled by default to ensure that no one can log on to BI platform with this
account. This default setting also disables the anonymous single sign-on functionality of BI platform,
so users will be unable to access BI launch pad without providing a valid user name and password.
Perform this task if you want to enable the Guest account so that users do not require their own accounts
to access BI launch pad.
1. Go to the "Users and Groups" management area of the CMC.
2. Click User List in the Navigation panel.
3. Select Guest.
4. Click Manage > Properties.
The "Properties" dialog box appears.
5. Clear the Account is disabled check box.
6. Click Save & Close.
4.2.11 Adding users to groups
You can add users to groups in the following ways:
•
•
Select the group, and then click Actions > Add Members to Group.
Select the user, and then click Actions > Member Of.
•
Select the user, and then click Actions > Join Group.
The following procedures describe how to add users to groups using these methods.
97
2011-05-06
Managing Users and Groups
Related Topics
• To specify group membership
4.2.11.1 To add a user to one or more groups
1. Go to the "Users and Groups" management area of the CMC.
2. Select the user that you want to add to a group.
3. Click Actions > Join Group.
Note:
All BI platform users of the system are part of the Everyone group.
The "Join Group" dialog box appears.
4. Move the group that you want to add the user to from the Available Groups list to the Destination
Group(s) list.
Tip:
Use SHIFT + click or CTRL + click to select multiple groups.
5. Click OK.
4.2.11.2 To add one or more users to a group
1. In the "Users and Groups" management area of the CMC, select the group.
2. Click Actions > Add Members to Group.
The "Add" dialog box appears.
3. Click User list.
The Available users/groups list refreshes and displays all user accounts in the system.
4. Move the user that you want to add to the group from the Available users/groups list to the Selected
users/groups list.
Tip:
•
•
•
To select multiple users, use the SHIFT + click or CTRL + click combination.
To search for a specific user, use the search field.
If there are many users on your system, click the Previous and Next buttons to navigate through
the list of users.
5. Click OK.
98
2011-05-06
Managing Users and Groups
4.2.12 Changing password settings
Within the CMC, you can change the password settings for a specific user or for all users in the system.
The various restrictions listed below apply only to Enterprise accounts—that is, the restrictions do not
apply to accounts that you have mapped to an external user database (LDAP or Windows AD). Generally,
however, your external system will enable you to place similar restrictions on the external accounts.
4.2.12.1 To change user password settings
1. Go to the "Users and Groups" management area of the CMC.
2. Select the user whose password settings you want to change.
3. Click Manage > Properties.
The "Properties" dialog box appears.
4. Select or clear the check box associated with the password setting you want to change.
The available options are:
•
•
•
Password never expires
User must change password at next logon
User cannot change password
5. Click Save & Close.
4.2.12.2 To change general password settings
1. Go to the "Authentication" management area of the CMC.
2. Double-click Enterprise.
The "Enterprise" dialog box appears.
3. Select the check box for each password setting that you want to use, and provide a value if necessary.
The following table identifies the minimum and maximum values for each of the settings you can
configure.
99
2011-05-06
Managing Users and Groups
Table 4-4: Password settings
Password setting
Minimum
Recommended Maximum
Enforce mixed-case passwords
N/A
N/A
Must contain at least N
Characters
0 characters
64 characters
Must change password every
N day(s)
1 day
100 days
Cannot reuse the N most recent password(s)
1 password
100 passwords
Must wait N minute(s) to
change password
0 minutes
100 minutes
Disable account after N
failed attempts to log on
1 failed
100 failed
Reset failed logon count after N minute(s)
1 minute
100 minutes
Re-enable account after N
minute(s)
0 minutes
100 minutes
4. Click Update.
4.2.13 Granting access to users and groups
You can grant users and groups administrative access to other users and groups. Administrative rights
include: viewing, editing, and deleting objects; viewing and deleting object instances; and pausing object
instances. For example, for troubleshooting and system maintenance, you may want to grant your IT
department access to edit and delete objects.
100
2011-05-06
Managing Users and Groups
Related Topics
• To assign principals to an access control list for an object
4.2.14 Controlling access to user inboxes
When you add a user, the system automatically creates an inbox for that user. The inbox has the same
name as the user. By default, only the user and the administrator have the right to access a user's
inbox.
Related Topics
• Scheduling an object to run now
• Managing security settings for objects in the CMC
4.2.15 Configuring BI launch pad options
Administrators can configure the way users access the BI launch pad applications. By configuring
properties in the BOE.war file, you can specify what information is available on the user's logon screen.
You can also use the CMC to set BI launch pad preferences for specific groups.
4.2.15.1 Configuring the BI launch pad logon screen
By default, the BI launch pad logon screen prompts users for their user name and password. You can
also prompt the users for the CMS name and the authentication type. To change this setting, you need
to edit the BI launch pad properties for the BOE.war file.
4.2.15.1.1 To configure the BI launch pad logon screen
To modify BI launch pad default settings, you need to set custom BI launch pad properties for the
BOE.war file. This file deployed on the machine hosting your web application server.
1. Go to the following directory in your BI platform installation:
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\
101
2011-05-06
Managing Users and Groups
Note:
If you are using the Tomcat version installed with BI platform, you can also access the following
directory: C:\Program Files (x86)\SAP BusinessObjects\Tomcat6\webapps\BOE\WEBINF\config\custom
•
If you are using any other supported web application server, consult the documentation for your
web application server to determine the appropriate path.
2. Create a new file.
Note:
Use Notepad or any other text-editing utility.
3. Save the file under the following name:
BIlaunchpad.properties
4. To include the authentication options on the BI launch pad logon screen add the following:
authentication.visible=true
5. To change the default authentication type add the following:
authentication.default=<authentication>
Replace <authentication> with any of the following options
Authentication Type
<authentication> value
Enterprise
secEnterprise
LDAP
secLDAP
Windows AD
secWinAD
SAP
secSAPR3
6. To prompt users for the CMS name on the BI launch pad logon screen:
cms.visible=true
7. Save and close the file.
8. Restart your web application server.
Use WDeploy to redeploy the BOE.war file on the web application server. For more information on
using WDeploy see the SAP BusinessObjects Business Intelligence Platform Web Application
Deployment Guide
4.2.15.2 Configuring BI launch pad preferences for groups
Administrators can set BI launch pad preferences for specific user groups. These preferences serve
as default BI launch pad preferences for all users in the group.
102
2011-05-06
Managing Users and Groups
Note:
If users have set their own preferences, any administrator-defined settings will not be reflected in their
view of BI launch pad. Users can always switch from their own preferences to the administrator-defined
preferences at any time and use the updated settings.
By default no BI launch pad preferences are set for any user groups. Administrators can specify
preferences for the following:
• Home tab
• Documents - start location
• Folders
• Categories
• Number of objects per page
• Columns displayed in the "Document" tab
• How to display documents in BI launch pad - through tabs or a new window
4.2.15.2.1 To set BI launch pad Preferences for a group
1. Go to the "Users and Groups" management area of the CMC.
2. Select the group from the Group List.
3. Click Actions > BI launch pad Preferences
The "BI launch pad Preferences" dialog box appears
4. Unselect No Preferences Defined.
5. To set a user's initial view:
• To display the Home tab when the user first log on, click Home tab and choose one of the
following options:
Option
Description
Default Home tab
Displays the default Home tab provided with BI platform will be
used.
Select Home tab
Displays a specific website as the home tab.
Click Browse Home tab. In the "Select a Custom Home tab"
window, select a repository object and click Open.
Note:
you can only select an object that has already been added to
the repository.
•
103
To display the Documents tab when the user first log on, click Documents, and then specify
which drawer and node are open by default. You can select from the following
2011-05-06
Managing Users and Groups
Drawer
Node options
My Documents
Choose from one of the following to display in the Documents tab:
• My Favorites
• Personal Categories
• My Inbox
Folders
Choose from one of the following:
• Public Folders: this will display the public folders in the Documents tab
• Select Public folder
Click Browse Folder to select a specific public folder to display in the Documents tab.
Categories
Choose from one of the following:
• Corporate Categories: this will display the corporate categories in the
Documents tab
• Select Corporate Category
Click Browse Folder to select a specific corporate category to display in
the Documents tab.
For example, if you want the My Documents drawer to be open to the user's BI Inbox when they
first log on, click My Documents and click My Inbox.
6. Under "Choose columns displayed in Documents tab", select the summary information that you want
to see for each object in the user's List panel:
• Type
• Last Run
• Instances
• Description
• Created By
• Created On
• Location (Categories)
• Received On (Inbox)
• From (Inbox)
7. Under "Set document viewing location", choose how you want users to view their documents.
Users can open documents for viewing in new tabs within BI launch pad or in new web browser
windows.
8. Enter a number in the Set the maximum number of items per page field to specify the maximum
number of objects displayed per page when a user views lists of objects.
9. Click Save & Close.
The specified preferences will serve as defaults for users in the group you selected in Step 2. Users
will however be able to create their own BI launch pad preferences, if they have the right to set their
104
2011-05-06
Managing Users and Groups
preferences. If you do not want users to modify the preferences, you should not grant users the right
to set preferences.
4.3 Managing aliases
If a user has multiple accounts in BI platform, you can link the accounts using the Assign Alias feature.
This is useful when a user has a third-party account that is mapped to Enterprise and an Enterprise
account.
By assigning an alias to the user, the user can log on using either a third-party user name and password
or an Enterprise user name and password. Thus, an alias enables a user to log on via more than one
authentication type.
In the CMC, the alias information is displayed at the bottom of the "Properties" dialog box for a user. A
user can have any combination of Enterprise, LDAP or Windows AD aliases.
4.3.1 To create a user and add a third-party alias
When you create a user and select an authentication type other than Enterprise, the system creates
the new user in BI platform and creates a third-party alias for the user.
Note:
For the system to create the third-party alias, the following criteria must be met:
•
The authentication tool needs to have been enabled in the CMC.
•
The format of the account name must agree with the format required for the authentication type.
•
The user account must exist in the third-party authentication tool, and it must belong to a group that
is already mapped to BI platform.
1. Go to the "Users and Groups" management area of the CMC.
2. Click Manage > New > New User.
The "New User" dialog box appears.
3.
4.
5.
6.
Select the authentication type for the user, for example, Windows AD.
Type in the third-party account name for the user, for example, bsmith.
Select the connection type for the user.
Click Create & Close.
The user is added to BI platform and is assigned an alias for the authentication type you selected,
for example, secWindowsAD:ENTERPRISE:bsmith. If required, you can add, assign, and reassign
aliases to users.
105
2011-05-06
Managing Users and Groups
4.3.2 To create a new alias for an existing user
You can create aliases for existing BI platform users. The alias can be an Enterprise alias, or an alias
for a third-party authentication tool.
Note:
For the system to create the third-party alias, the following criteria must be met:
•
The authentication tool needs to have been enabled in the CMC.
•
The format of the account name must agree with the format required for the authentication type.
•
The user account must exist in the third-party authentication tool, and it must belong to a group that
is mapped to the platform.
1. Go to the "Users and Groups" management area of the CMC.
2. Select the user that you want to add an alias to.
3. Click Manage > Properties.
The "Properties" dialog box appears.
4. Click New Alias.
5. Select the authentication type.
6. Type in the account name for the user.
7. Click Update.
An alias is created for the user. When you view the user in the CMC, at least two aliases are shown,
the one that was already assigned to the user and the one you just created.
8. Click Save & Close to exit the "Properties" dialog box.
4.3.3 To assign an alias from another user
When you assign an alias to a user, you move a third-party alias from another user to the user you are
currently viewing. You cannot assign or reassign Enterprise aliases.
Note:
If a user has only one alias and you assign that last alias to another user, the system will delete the
user account, and the Favorites folder, personal categories, and inbox for that account.
1. Go to the "Users and Groups" management area of the CMC.
2. Select the user you want to assign an alias to.
3. Click Manage > Properties.
The "Properties" dialog box appears.
106
2011-05-06
Managing Users and Groups
4. Click Assign Alias.
5. Enter the user account that has the alias you want to assign, and click Find Now.
6. Move the alias you want to assign from the Available aliases list to the Aliases to be added to
Username list.
Here Username represents the name of the user you are assigning an alias to.
Tip:
To select multiple aliases, use the SHIFT + click or CTRL + click combination.
7. Click OK.
4.3.4 To delete an alias
When you delete an alias, the alias is removed from the system. If a user has only one alias and you
delete that alias, the system automatically deletes the user account and the Favorites folder, personal
categories, and inbox for that account.
Note:
Deleting a user's alias does not necessarily prevent the user from being able to log on to BI platform
again. If the user account still exists in the third-party system, and if the account belongs to a group
that is mapped to BI platform, then BI platform will still allow the user to log on. Whether the system
creates a new user or assigns the alias to an existing user, depends on which update options you have
selected for the authentication tool in the "Authentication" management area of CMC.
1. Go to the "Users and Groups" management area of the CMC.
2. Select the user whose alias you want to delete.
3. Click Manage > Properties.
The "Properties" dialog box appears.
4. Click the Delete Alias button next to the alias that you want to delete.
5. If prompted for confirmation, click OK.
The alias is deleted.
6. Click Save & Close to exit the "Properties" dialog box.
4.3.5 To disable an alias
You can prevent a user from logging on to BI platform using a particular authentication method by
disabling the user's alias associated with that method. To prevent a user from accessing the platform
altogether, disable all aliases for that user.
107
2011-05-06
Managing Users and Groups
Note:
Deleting a user from the system does not necessarily prevent the user from being able to log on to BI
platform again. If the user account still exists in the third-party system, and if the account belongs to a
group that is mapped to the platform, then the system will still allow the user to log on. To ensure a user
can no longer use one of his or her aliases to log on to the platform, it is best to disable the alias.
1. Go to the "Users and Groups" management area of the CMC.
2. Select the user whose alias you want to disable.
3. Click Manage > Properties.
The "Properties" dialog box appears.
4. Clear the Enabled check box for the alias you want disable.
Repeat this step for each alias you want to disable.
5. Click Save & Close.
The user can no longer log on using the type of authentication that you just disabled.
Related Topics
• To delete an alias
108
2011-05-06
Setting Rights
Setting Rights
5.1 How rights work in BI platform
Rights are the base units for controlling user access to the objects, users, applications, servers, and
other features in BI platform. They play an important role in securing the system by specifying the
individual actions that users can perform on objects. Besides allowing you to control access to your BI
platform content, rights enable you to delegate user and group management to different departments,
and to provide your IT people with administrative access to servers and server groups.
It is important to note that rights are set on objects such as reports and folders rather than on the
“principals” (the users and groups) who access them. For example, to give a manager access to a
particular folder, in the "Folders" area, you add the manager to the “access control list” (the list of
principals who have access to an object) for the folder. You cannot give the manager access by
configuring the manager's rights settings in the "Users and Groups" area. The rights settings for the
manager in the "Users and Groups" area are used to grant other principals (such as delegated
administrators) access to the manager as an object in the system. In this way, principals are themselves
like objects for others with greater rights to manage.
Each right on an object can be granted, denied, or unspecified. The BI platform security model is
designed such that, if a right is left unspecified, the right is denied. Additionally, if settings result in a
right being both granted and denied to a user or group, the right is denied. This “denial-based” design
helps ensure that users and groups do not automatically acquire rights that are not explicitly granted.
There is an important exception to this rule. If a right is explicitly set on a child object that contradicts
the rights inherited from the parent object, the right set on the child object overrides the inherited rights.
This exception applies to users who are members of groups as well. If a user is explicitly granted a right
that the user's group is denied, the right set on the user overrides the inherited rights.
Related Topics
• Rights override
5.1.1 Access levels
“Access levels” are groups of rights that users frequently need. They allow administrators to set common
security levels quickly and uniformly rather than requiring that individual rights be set one by one.
109
2011-05-06
Setting Rights
BI platform comes with several predefined access levels. These predefined access levels are based
on a model of increasing rights: Beginning with View and ending with Full Control, each access level
builds upon the rights granted by the previous level.
However, you can also create and customize your own access levels; this can greatly reduce
administrative and maintenance costs associated with security. Consider a situation in which an
administrator must manage two groups, sales managers and sales employees. Both groups need to
access five reports in the BI platform system, but sales managers require more rights than sales
employees. The predefined access levels do not meet the needs of either group. Instead of adding
groups to each report as principals and modifying their rights in five different places, the administrator
can create two new access levels, Sales Managers and Sales Employees. The administrator then adds
both groups as principals to the reports and assigns the groups their respective access levels. When
rights need to be modified, the administrator can modify the access levels. Because the access levels
apply to both groups across all five reports, the rights those groups have to the reports are quickly
updated.
Related Topics
• Working with access levels
5.1.2 Advanced rights settings
To provide you with full control over object security, the CMC allows you to set “advanced rights”. These
advanced rights provide increased flexibility as you define security for objects at a granular level.
Use advanced rights settings, for instance, if you need to customize a principal's rights to a particular
object or set of objects. Most importantly, use advanced rights to explicitly deny a user or group any
right that should not be permitted to change when, in the future, you make changes to group memberships
or folder security levels.
The following table summarizes the options that you have when you set advanced rights.
Table 5-1: Rights options
Icon
110
Rights option
Description
Granted
The right is granted to a principal.
Denied
The right is denied to a principal.
Not Specified
The right is unspecified for a principal. By default, rights
set to Not Specified are denied.
2011-05-06
Setting Rights
Icon
Rights option
Description
Apply to Object
The right applies to the object. This option becomes
available when you click Granted or Denied.
Apply to Sub Object
The right applies to sub-objects. This option becomes
available when you click Granted or Denied.
Related Topics
• Type-specific rights
5.1.3 Inheritance
Rights are set on an object for a principal in order to control access to the object; however, it is impractical
to set the explicit value of every possible right for every principal on every object. Consider a system
with 100 rights, 1000 users, and 10,000 objects: to set rights explicitly on each object would require the
CMS store billions of rights in its memory, and, importantly, require that an administrator manually set
each one.
Inheritance patterns resolve this impracticality. With inheritance, the rights that users have to objects
in the system come from a combination of their memberships in different groups and subgroups and
from objects which have inherited rights from parent folders and subfolders. These users can inherit
rights as the result of group membership; subgroups can inherit rights from parent groups; and both
users and groups can inherit rights from parent folders.
By default, users or groups who have rights to a folder will inherit the same rights for any object that
are subsequently published to that folder. Consequently, the best strategy is to set the appropriate
rights for users and groups at the folder level first, then publish objects to that folder.
BI platform recognizes two types of inheritance: group inheritance and folder inheritance.
5.1.3.1 Group inheritance
Group inheritance allows principals to inherit rights as the result of group membership. Group inheritance
proves especially useful when you organize all of your users into groups that coincide with your
organization's current security conventions.
In “Group inheritance example 1”, you can see how group inheritance works. Red Group is a subgroup
of Blue Group, so it inherits Blue Group's rights. In this case, it inherits right 1 as granted, and the rest
111
2011-05-06
Setting Rights
of the rights as unspecified. Every member of Red Group inherits these rights. In addition, any other
rights that are set on the subgroup are inherited by its members. In this example, Green User is a
member of Red Group, and thus inherits right 1 as granted, rights 2, 3, 4, and 6 as not specified, and
Right 5 as denied.
Figure 5-1: Group inheritance example 1
When group inheritance is enabled for a user who belongs to more than one group, the rights of all
parent groups are considered when the system checks credentials. The user is denied any right that
is explicitly denied in any parent group, and the user is denied any right that remains completely not
specified; thus, the user is granted only those rights that are granted in one or more groups (explicitly
or through access levels) and never explicitly denied.
In “Group inheritance example 2”, Green User is a member of two unrelated groups. From Blue Group,
he inherits rights 1 and 5 as "granted" and the rest as not specified; however, because Green User also
belongs to Red Group, and Red Group has been explicitly denied right 5, Green User's inheritance to
right 5 from Blue Group is overridden.
Figure 5-2: Group inheritance example 2
Related Topics
• Rights override
5.1.3.2 Folder inheritance
112
2011-05-06
Setting Rights
Folder inheritance allows principals to inherit any rights that they have been granted on an object's
parent folder. Folder inheritance proves especially useful when you organize BI platform content into
a folder hierarchy that reflects your organization's current security conventions. For example, suppose
that you create a folder called Sales Reports, and you provide your Sales group with View On Demand
access to this folder. By default, every user that has rights to the Sales Reports folder will inherit the
same rights to the reports that you subsequently publish to this folder. Consequently, the Sales group
will have View On Demand access to all of the reports, and you need set the object rights only once,
at the folder level.
In “Folder inheritance example”, rights have been set for Red Group on a folder. Rights 1 and 5 have
been granted, while the rest have been left unspecified. With folder inheritance enabled, members of
Red Group have rights on the object level identical to the rights of the group on the folder level. Rights
1 and 5 are inherited as granted, while the rest have been left unspecified.
Figure 5-3: Folder inheritance example
Related Topics
• Rights override
5.1.3.3 Rights override
“Rights override” is a rights behavior in which rights that are set on child objects override the rights set
on parent objects. Rights override occurs under the following circumstances:
•
•
113
In general, the rights that are set on child objects override the corresponding rights that are set on
parent objects.
In general, the rights that are set on subgroups or members of groups override the corresponding
rights that are set on groups.
2011-05-06
Setting Rights
You do not need to disable inheritance to set customized rights on an object. The child object inherits
the rights settings of the parent object except for the rights that are explicitly set on the child object.
Also, any changes to rights settings on the parent object apply to the child object.
“Rights override example 1” illustrates how rights override works on parent and child objects. Blue User
is denied the right to edit a folder's contents; the rights setting is inherited by the subfolder. However,
an administrator grants Blue User Edit rights to a document in the subfolder. The Edit right that Blue
User receives on the document overrides the inherited rights that come from the folder and subfolder.
Figure 5-4: Rights override example 1
“Rights override example 2” illustrates how rights override works on members and groups. Blue Group
is denied the right to edit a folder; Blue Subgroup inherits this rights setting. However, an administrator
grants Blue User, who is a member of Blue Group and Blue Subgroup, Edit rights on the folder. The
Edit rights that Blue User receives on the folder override the inherited rights that come from Blue Group
and Blue Subgroup.
Figure 5-5: Rights override example 2
“Complex rights override” illustrates a situation where the effects of rights override are less obvious.
Purple User is a member of subgroups 1A and 2A, which are in Groups 1 and 2, respectively. Groups
1 and 2 both have Edit rights on the folder. 1A inherits the Edit rights that Group 1 has, but an
administrator denies Edit rights to 2A. The rights settings on 2A override the rights settings on Group
2 because of rights override. Therefore, Purple User inherits contradictory rights settings from 1A and
114
2011-05-06
Setting Rights
2A. 1A and 2A do not have a parent-child relationship, so rights override does not occur; that is, one
sub-group's rights settings do not override another's because they have equal status. In the end, Purple
User is denied Edit rights because of the “denial-based” rights model in BI platform.
Figure 5-6: Complex rights override
Rights override lets you make minor adjustments to the rights settings on a child object without discarding
all inherited rights settings. Consider a situation in which a sales manager needs to view confidential
reports in the Confidential folder. The sales manager is part of the Sales group, which is denied access
to the folder and its contents. The administrator grants the manager View rights on the Confidential
folder and continues to deny the Sales group access. In this case, the View rights granted to the sales
manager override the denied access that the manager inherits from membership in the Sales group.
5.1.3.4 Scope of rights
“Scope of rights” refers to the ability to control the extent of rights inheritance. To define the scope of
a right, you decide whether the right applies to the object, its sub-objects, or both. By default, the scope
of a right extends to both objects and sub-objects.
Scope of rights can be used to protect personal content in shared locations. Consider a situation in
which the finance department has a shared Expense Claims folder that contains Personal Expense
Claims subfolders for each employee. The employees want to be able to view the Expense Claims
folder and add objects to it, but they also want to protect the contents of their Personal Expense Claims
subfolders. The administrator grants all employees View and Add rights on the Expense Claims folder,
and limits the scope of these rights to the Expense Claims folder only. This means that the View and
Add rights do not apply to sub-objects in the Expense Claims folder. The administrator then grants
employees View and Add rights on their own Personal Expense Claims subfolders.
Scope of rights can also limit the effective rights that a delegated administrator has. For example, a
delegated administrator may have Securely Modify Rights and Edit rights on a folder, but the scope
of these rights is limited to the folder only and does not apply to its sub-objects. The delegated
administrator cannot grant these rights to another user on one of the folder's sub-objects.
115
2011-05-06
Setting Rights
5.1.4 Type-specific rights
“Type-specific rights” are rights that affect specific object types only, such as Crystal reports, folders,
or access levels. Type-specific rights consist of the following:
•
General rights for the object type
These rights are identical to general global rights (for example, the right to add, delete, or edit an
object), but you set them on specific object types to override the general global rights settings.
•
Specific rights for the object type
These rights are available for specific object types only. For example, the right to export a report's
data appears for Crystal reports but not for Word documents.
The diagram “Type-specific rights example” illustrates how type-specific rights work. Here right 3
represents the right to edit an object. Blue Group is denied Edit rights on the top-level folder and granted
Edit rights for Crystal reports in the folder and subfolder. These Edit rights are specific to Crystal reports
and override the rights settings on a general global level. As a result, members of Blue Group have
Edit rights for Crystal reports but not the XLF file in the subfolder.
Figure 5-7: Type-specific rights example
Type-specific rights are useful because they let you limit the rights of principals based on object type.
Consider a situation in which an administrator wants employees to be able to add objects to a folder
but not create subfolders. The administrator grants Add rights at the general global level for the folder,
and then denies Add rights for the folder object type.
Rights are divided into the following collections based on the object types they apply to:
•
General
These rights affect all objects.
116
2011-05-06
Setting Rights
•
Content
These rights are divided according to particular content object types. Examples of content object
types include Crystal reports, and Adobe Acrobat PDFs.
•
Application
These rights are divided according to which BI platform application they affect. Examples of
applications include the CMC and BI launch pad.
•
System
These rights are divided according to which core system component they affect. Examples of core
system components include Calendars, Events, and Users and Groups.
Type-specific rights are in the Content, Application, and System collections. In each collection, they
are further divided into categories based on object type.
5.1.5 Determining effective rights
Keep these considerations in mind when you set rights on an object:
•
•
Each access level grants some rights, denies some rights, and leaves the other rights unspecified.
When a user is granted several access levels, the system aggregates the effective rights and denies
any unspecified rights by default.
When you assign multiple access levels to a principal on an object, the principal has the combination
of each access level's rights. The user in “Multiple access levels” is assigned two access levels.
One access level grants the user rights 3 and 4, while the other access level grants right 3 only. The
effective rights for the user are 3 and 4.
Figure 5-8: Multiple access levels
•
Advanced rights can be combined with access levels to customize the rights settings for a principal
on an object. For example, if an advanced right and an access level are both assigned explicitly to
a principal on an object, and the advanced right contradicts a right in the access level, the advanced
right will override the right in the access level.
Advanced rights can override their identical counterparts in access levels only when they are set on
the same object for the same principal. For example, an advanced Add right set at the general global
level can override the general Add right setting in an access level; it cannot override a type-specific
Add right setting in an access level.
117
2011-05-06
Setting Rights
However, advanced rights do not always override access levels. For example, a principal is denied
an Edit right on a parent object. On the child object, the principal is assigned an access level that
grants him the Edit right. In the end, the principal has Edit rights on the child object because the
rights set on the child object override rights that are set on the parent object.
•
Rights override makes it possible for rights set on a child object to override rights that are inherited
from the parent object.
5.2 Managing security settings for objects in the CMC
You can manage security settings for most objects in the CMC with the security options on the Manage
menu. These options let you assign principals to the access control list for an object, view the rights
that a principal has, and modify the rights that the principal has to an object.
The specific details of security management vary according to your security needs and the type of
object you are setting rights for. However, in general, the workflows for the following tasks are very
similar:
•
•
•
Viewing rights for a principal on an object.
Assigning principals to an access control list for an object, and specifying which rights and access
levels those principals have.
Setting rights on a top-level folder in BI platform.
5.2.1 To view rights for a principal on an object
In general, you follow this workflow to view rights for a principal on an object.
1. Select the object for which you want to view security settings.
2. Click Manage > User Security.
The "User Security" dialog box appears and displays the access control list for the object.
3. Select a principal from the access control list, and click View Security
The "Permissions Explorer" launches and displays a list of effective rights for the principal on the
object. In addition, the "Permissions Explorer" lets you do the following:
•
•
Browse for another principal whose rights you want to view.
Filter the rights displayed according to these criteria:
•
•
•
•
•
118
assigned rights
granted rights
unassigned rights
from access level
object type
2011-05-06
Setting Rights
•
•
the name of the right
Sort the list of rights displayed in ascending or descending order according to these criteria:
•
•
•
•
collection
type
right name
right status (granted, denied, or unspecified)
Additionally, you can click one of the links in the "Source" column to display the source of inherited
rights.
5.2.2 To assign principals to an access control list for an object
An access control list specifies the users that are granted or denied rights on an object. In general, you
follow this workflow to assign a principal to an access control list, and to specify the rights that the
principal has to the object.
1. Select the object to which you want to add a principal.
2. Click Manage > User Security.
The "User Security" dialog box appears and displays the access control list.
3. Click Add Principals.
The "Add Principals" dialog box appears.
4. Move the users and groups you want to add as principals from the Available users/groups list to
the Selected users/groups list.
5. Click Add and Assign Security.
6. Select the access levels you want to grant the principal.
7. Choose whether to enable or disable folder or group inheritance.
If necessary, you can also modify rights at a granular level to override certain rights in an access level.
Related Topics
• To modify security for a principal on an object
5.2.3 To modify security for a principal on an object
In general, it is recommended that you use access levels to assign rights to a principal. However, you
may need to override certain granular rights in an access level sometimes. Advanced rights let you
customize the rights for a principal on top of the access levels the principal already has. In general, you
follow this workflow to assign advanced rights to a principal on an object.
119
2011-05-06
Setting Rights
1. Assign the principal to the access control list for the object.
2. When the principal has been added, go to Manage > User Security to display the access control
list for the object.
3. Select the principal from the access control list, and click Assign Security.
The "Assign Security" dialog box appears.
4. Click the Advanced tab.
5. Click Add/Remove rights.
6. Modify the rights for the principal.
All the available rights are summarized in the Rights Appendix.
Related Topics
• To assign principals to an access control list for an object
5.2.4 To set rights on a top-level folder in BI platform
In general, you follow this workflow to set rights on a top-level folder in BI platform.
Note:
For this release, principals require View rights on a container folder to be able to navigate in that folder
and view its sub-objects. This means that principals require View rights on the top-level folder to view
objects that are in folders. If you want to limit View rights for a principal, you can grant a principal View
rights on a specific folder and set the scope of rights to apply to that folder only.
1. Go to the CMC area that has the top-level folder you want to set rights for.
2. Click Manage > Top-Level Security > All Objects.
Here Objects represents the contents of the top-level folder. If you are prompted for confirmation,
click OK.
The "User Security" dialog box appears and displays the access control list for the top-level folder.
3. Assign the principal to the access control list for the top-level folder.
4. If necessary, assign advanced rights to the principal.
Related Topics
• To assign principals to an access control list for an object
• To modify security for a principal on an object
5.2.5 Checking security settings for a principal
120
2011-05-06
Setting Rights
In some cases, you may want to know the objects to which a principal has been granted or denied
access. You can use a security query to do this. Security queries let you determine which objects a
principal has certain rights to and manage user rights. For each security query, you provide the following
information:
•
Query principal
You specify the user or group that you want to run the security query for. You can specify one
principal for each security query.
•
Query permission
You specify the right or rights you want to run the security query for, the status of these rights, and
the object type these rights are set on. For example, you can run a security query for all reports that
a principal can refresh, or for all reports that a principal cannot export.
•
Query context
You specify the CMC areas that you want the security query to search. For each area, you can
choose whether to include sub-objects in the security query. A security query can have a maximum
of four areas.
When you run a security query, the results appear in the "Query Results" area in the Tree panel under
Security Queries. If you want to refine a security query, you can run a second query within the results
from the first query.
Security queries are useful because they allow you to see the objects that a principal has certain rights
to, and they provide the locations of these objects if you want to modify those rights. Consider a situation
in which a sales employee is promoted to sales manager. The sales manager needs Schedule rights
for Crystal reports that he only had View rights to previously, and these reports are in different folders.
In this case, the administrator runs a security query for the sales manager's right to view Crystal reports
in all folders and includes sub-objects in the query. After the security query runs, the administrator can
see all Crystal reports that the sales manager has View rights for in the "Query Results" area. Because
the Details panel displays the location of each Crystal report, the administrator can browse for each
report and modify the sales manager's rights on it.
5.2.5.1 To run a security query
1. In the "Users and Groups" area, in the Details panel, select the user or group that you want to run
a security query for.
2. Click Manage > Tools > Create Security Query.
121
2011-05-06
Setting Rights
The "Create Security Query" dialog box appears.
3. Ensure that the principal in the Query Principal area is correct.
If you decide to run a security query for a different principal, you can click Browse to select another
principal. In the "Browse for Query Principal" dialog box, expand User List or Groups List to browse
for the principal, or search for the principal by name. When you are finished, click OK to return to
the "Create Security Query" dialog box.
4. In the "Query Permission" area, specify the rights and the status of each right for which you want to
run the query..
• If you want to run a query for specific rights that the principal has on objects, click Browse, set
the status of each right that you want to run the security query for, and click OK.
Tip:
You can delete specific rights from the query by clicking the delete button next to the right, or
delete all rights from the query by clicking the delete button in the header row.
•
If you want to run a general security query, select the Do not query by permissions check box.
When you do this, BI platform runs a general security query for all objects that have the principal
in their access control lists regardless of the permissions that the principal has on the objects.
5. In the "Query Context" area, specify the CMC areas that you want to query.
a. Select a check box next to a list.
b. On the list, select a CMC area that you want to query.
If you want to query a more specific location within an area (for example, a particular folder under
Folders), click Browse to open the "Browse for Query Context" dialog box. In the details pane,
select the folder you want to query, and click OK. When you return to the Security Query dialog
box, the folder you specified appears in the box under the list.
c. Select Query sub object.
d. Repeat the steps above for each CMC area that you want to query.
122
2011-05-06
Setting Rights
Note:
You can query a maximum of four areas.
6. Click OK.
The security query runs and you are taken to the "Query Results" area.
7. To view the query results, in the Tree panel, expand Security Queries and click a query result.
Tip:
Query results are listed according to the names of principals.
The query results are displayed in the Details panel.
The "Query Results" area retains all security query results from a single user session until the user logs
off. If you want to run the query again but with new specifications, click Actions > Edit Query. You can
also rerun the exact same query by selecting the query and clicking Actions > Rerun Query. If you
want to keep your security query results, click Actions > Export to export your security query results
as a CSV file.
5.3 Working with access levels
You can do the following with access levels:
•
Copy an existing access level, make changes to the copy, rename it, and save it as a new access
level.
•
Create, rename, and delete access levels.
•
Modify the rights in an access level.
•
Trace the relationship between access levels and other objects in the system.
•
Replicate and manage access levels across sites.
•
Use one of the predefined access levels in BI platform to set rights quickly and uniformly for many
principals.
The following table summarizes the rights that each predefined access level contains.
123
2011-05-06
Setting Rights
Table 5-2: Predefined access levels
Access level
Description
Rights involved
View
If set on the folder level, a principal can view the folder, objects
within the folder, and each object's generated instances. If set
at the object level, a principal
can view the object, its history,
and its generated instances.
•
•
Schedule
A principal can generate instances by scheduling an object
to run against a specified data
source once or on a recurring
basis. The principal can view,
delete, and pause the scheduling of instances that they own.
They can also schedule to different formats and destinations,
set parameters and database
logon information, choose
servers to process jobs, add
contents to the folder, and copy
the object or folder.
View access level rights, plus:
• Schedule the document to
run
• Define server groups to process jobs
• Copy objects to another
folder
• Schedule to destinations
• Print the report's data
• Export the report's data
• Edit objects that the user
owns
• Delete instances that the user owns
• Pause and resume document instances that the user
owns
View On Demand
A principal can refresh data on
demand against a data source.
Schedule access level rights,
plus:
• Refresh the report's data
A principal has full administrative control of the object.
All available rights, including:
• Add objects to the folder
• Edit objects
• Modify rights users have to
objects
• Delete objects
• Delete instances
Full Control
View objects
View document instances
The following table summarizes the rights required to perform certain tasks on access levels.
124
2011-05-06
Setting Rights
Access level task
Rights required
Create an access level
•
Add right on the Access Levels top-level folder
View granular rights in an access
level
•
View right on the access level
Assign an access level to a princi- •
pal on an object
•
•
View right on the access level
Use the Access Level for Security Assignment right on the
access level
Modify Rights right on the object, or Securely Modify Rights
right on the object and the principal
Note:
Users who have the Securely Modify Rights right and want to
assign an access level to a principal must have that same access
level assigned to themselves.
Modify an access level
•
View and Edit rights on the access level
Delete an access level
•
View and Delete rights on the access level
Clone an access level
•
•
•
View right on the access level
Copy right on the access level
Add right on the Access Levels top-level folder
5.3.1 Choosing between View and View On Demand access levels
When reporting over the web, the choice to use live or saved data is one of the most important decisions
you'll make. Whichever choice you make, however, BI platform displays the first page as quickly as
possible, so you can see your report while the rest of the data is being processed. This section explains
the difference between two predefined access levels that you can use to make this choice.
View On Demand access level
On-demand reporting gives users real-time access to live data, straight from the database server. Use
live data to keep users up-to-date on constantly changing data, so they can access information that's
accurate to the second. For instance, if the managers of a large distribution center need to keep track
of inventory shipped on a continual basis, then live reporting is the way to give them the information
they need.
Before providing live data for all your reports, however, consider whether or not you want all of your
users hitting the database server on a continual basis. If the data isn't rapidly or constantly changing,
then all those requests to the database do little more than increase network traffic and consume server
125
2011-05-06
Setting Rights
resources. In such cases, you may prefer to schedule reports on a recurrent basis so that users can
always view recent data (report instances) without hitting the database server.
Users require View On Demand access to refresh reports against the database.
View access level
To reduce the amount of network traffic and the number of hits on your database servers, you can
schedule reports to be run at specified times. When the report has been run, users can view that report
instance as needed, without triggering additional hits on the database.
Report instances are useful for dealing with data that isn't continually updated. When users navigate
through report instances, and drill down for details on columns or charts, they don't access the database
server directly; instead, they access the saved data. Consequently, reports with saved data not only
minimize data transfer over the network, but also lighten the database server's workload.
For example, if your sales database is updated once a day, you can run the report on a similar schedule.
Sales representatives then always have access to current sales data, but they are not hitting the
database every time they open a report.
Users require only View access to display report instances.
5.3.2 To copy an existing access level
This is the best way to create an access level if you want an access level that differs slightly from one
of the existing access levels.
1. Go to the "Access Levels" area.
2. In the Details panel, select an access level.
Tip:
Select an access level that contains rights that are similar to what you want for your access level.
3. Click Organize > Copy.
A copy of the access level you selected appears in the Details panel.
5.3.3 To create a new access level
This is the best way to create an access level if you want an access level that differs greatly from one
of the existing access levels.
1. Go to the "Access Levels" area.
2. Click Manage > New > Create Access Level.
The "Create New Access Level" dialog box appears.
126
2011-05-06
Setting Rights
3. Enter a title and description for your new access level, and then click OK.
You return to the "Access Levels" area, and the new access level appears in the Details panel.
5.3.4 To rename an access level
1. In the "Access Levels" area, in the Details panel, select the access level that you want to rename.
2. Click Manage > Properties.
The "Properties" dialog box appears.
3. In the Title field, enter a new name for your access level, and then click Save & Close.
You return to the "Access Levels" area.
5.3.5 To delete an access level
1. In the "Access Levels" area, in the Details panel, select the access level that you want to delete.
2. Click Manage > Delete Access Level.
Note:
You cannot delete predefined access levels.
A dialog box appears with information about the objects that this access level affects. If you do not
want to delete the access level, click Cancel to exit the dialog box.
3. Click Delete.
The access level is deleted, and you return to the "Access Levels" area.
5.3.6 To modify rights in an access level
To set rights for an access level, you first set general global rights that apply to all objects regardless
of type, and then you specify when you want to override the general settings based on the specific
object type.
1. In the Access Levels area, in the Details panel, select the access level that you want to modify the
rights for.
2. Click Actions > Included Rights.
The Included Rights dialog box appears and displays a list of effective rights.
3. Click Add/Remove Rights.
127
2011-05-06
Setting Rights
The Included Rights dialog box displays the rights collections for the access level in the navigation
list. The General Global Rights section is expanded by default.
4. Set your general global rights.
Each right can have a status of Granted, Denied, or Not Specified. You can also choose whether
to apply that right to the object only, to apply it to sub-objects only, or both.
5. To set type-specific rights for the access level, in the navigation list, click the rights collection, and
then click the sub-collection that applies to the object type you want to set the rights for.
6. When you have finished, click OK.
You return to the list of effective rights.
Related Topics
• Managing security settings for objects in the CMC
• Type-specific rights
5.3.7 Tracing the relationship between access levels and objects
Before you modify or delete an access level, it is important to confirm that any changes you make to
the access level will not impact objects in the CMC negatively. You can do this by running a relationship
query on the access level.
Relationship queries are useful for rights management because they allow you to see objects impacted
by an access level in one convenient location. Consider a situation in which a company restructures
its organization and merges two departments, Department A and Department B, into Department C.
128
2011-05-06
Setting Rights
The administrator decides to delete the access levels for Department A and Department B because
these departments no longer exist. The administrator runs relationship queries for both access levels
before deleting them. In the "Query Results" area, the administrator can see the objects that will be
affected if the administrator deletes the access levels. The Details panel also shows the administrator
the location of the objects in the CMC if the rights on the objects must be modified before the access
levels are deleted.
Note:
•
•
To view the list of affected objects, you must have View rights on those objects.
Relationship query results for an access level only yield objects on which the access level is explicitly
assigned. If an object uses an access level because of inheritance settings, that object does not
appear in the query results.
5.3.8 Managing access levels across sites
Access levels are one of the objects that you can replicate from an Origin site to Destination sites. You
can choose to replicate access levels if they appear in a replication object's access control list. For
example, if a principal is granted access level A on a Crystal report and the Crystal report is replicated
across sites, access level A is also replicated.
Note:
If an access level with the same name exists in the Destination site, the access level replication will
fail. You or the Destination site administrator must rename one of the access levels before replication.
After you replicate an access level across sites, keep the administration considerations in this section
in mind.
Modifying replicated access levels in the Origin site
If a replicated access level is modified in the Origin site, the access level in the Destination site will be
updated the next time the replication is scheduled to run. In two-way replication scenarios, if you modify
a replicated access level in the Destination site, the access level in the Origin site changes.
Note:
Ensure that changes to an access level in one site do not affect objects in other sites negatively. Consult
your site administrators and advise them to run relationship queries for the replicated access level
before you make any changes.
Modifying replicated access levels in the Destination site
Note:
This applies to one-way replication only.
Any changes to replicated access levels made in a Destination site are not reflected in the Origin site.
For example, a Destination site administrator can grant the right to schedule Crystal reports in the
replicated access level even though this right was denied in the Origin site. As a result, although the
access level names and replicated object names remain the same, the effective rights that principals
have on objects may differ from Destination site to Destination site.
129
2011-05-06
Setting Rights
If the replicated access level differs between the Origin and Destination sites, the difference in effective
rights will be detected the next time a Replication Job is scheduled to run. You can force the Origin site
access level to override the Destination site access level, or allow the Destination site access level to
remain intact. However, if you do not force the Origin site access level to override the Destination site
access level, any objects pending Replication that use that access level will fail to replicate.
To restrict users from modifying replicated access levels in the Destination site, you can add Destination
site users to the access level as principals, and grant those users View rights only. This means that
Destination site users can view the access level but are unable to modify its rights settings or assign it
to other users.
Related Topics
• Federation
• Tracing the relationship between access levels and objects
5.4 Breaking inheritance
Inheritance lets you manage your security settings without setting rights for each individual object.
However, in some cases, you may not want rights to be inherited. For example, you may want to
customize rights for each object. You can disable inheritance for a principal in an object's access control
list. When you do this, you can choose whether to disable group inheritance, folder inheritance, or both.
Note:
When inheritance is broken, it is broken for all rights; it is not possible to turn off inheritance for some
rights but not for others.
In the diagram “Breaking inheritance”, group and folder inheritance are initially in effect. Red User
inherits rights 1 and 5 as granted, rights 2, 3, and 4 as unspecified, and right 6 as explicitly denied.
These rights, set on the folder level for the group, mean that Red User, and every other member of the
group, has these rights on the folder's objects, A and B. When inheritance is broken on the folder level,
Red User's set of rights to the objects in that folder is cleared until an administrator assigns new rights
to him.
130
2011-05-06
Setting Rights
Figure 5-9: Breaking inheritance
5.4.1 To disable inheritance
This procedure lets you disable group or folder inheritance, or both, for a principal on an object's access
control list.
1. Select the object that you want to disable inheritance for.
2. Click Manage > User Security.
The "User Security" dialog box appears.
3. Select the principal that you want to disable inheritance for, and click Assign Security.
The "Assign Security" dialog box appears.
4. Configure your inheritance settings.
• If you want to disable group inheritance (the rights that the principal inherits from group
membership), clear the Inherit From Parent Group check box.
• If you want to disable folder inheritance (the rights settings that the object inherits from the folder),
clear the Inherit From Parent Folder check box.
5. Click OK.
5.5 Using rights to delegate administration
Besides allowing you to control access to objects and settings, rights allow you to divide administrative
tasks between functional groups within your organization. For example, you may want people from
different departments to manage their own users and groups. Or you may have one administrator who
handles high-level management of BI platform, but you want all server management to be handled by
people in your IT department.
131
2011-05-06
Setting Rights
Assuming that your group structure and folder structure align with your delegated-administration security
structure, you should grant your delegated administrator rights to entire user groups, but grant the
delegated administrator less than full rights on the users he controls. For example, you might not want
the delegated administrator to edit user attributes or reassign them to different groups.
The “Rights for delegated administrators” table summarizes the rights required for delegated
administrators to perform common actions.
Table 5-3: Rights for delegated administrators
Action for delegated administrator
Rights required by the delegated administrator
Create new users
Add right on the top-level Users folder
Create new groups
Add right on the top-level User Groups folder
Delete any controlled groups, as well as individual
users in those groups
Delete right on relevant groups
Delete only users that the delegated administrator
creates
Owner Delete right on the top-level Users folder
Delete only users and groups that the delegated
administrator creates
Owner Delete right on the top-level User Groups
folder
Manipulate only users that the delegated creates
(including adding those users to those groups)
Owner Edit and Owner Securely Modify Rights
right on the top-level Users folder
Manipulate only groups that the delegated administrator creates (including adding users to those
groups)
Owner Edit and Owner Securely Modify Rights
on the top-level User Groups folder
Modify passwords for users in their controlled
groups
Edit Password right on relevant groups
Owner Edit Password right on top-level Users
folder, or on relevant groups
Modify passwords only for principals the delegated administrator creates
132
Note:
Setting the Owner Edit Password right on a
group takes effect on a user only when you add
the user to the relevant group.
2011-05-06
Setting Rights
Action for delegated administrator
Rights required by the delegated administrator
Modify user names, description, other attributes,
and reassign users to different groups
Edit right on relevant groups
Owner Edit right on top-level Users folder, or on
relevant groups
Modify user names, description, other attributes,
and reassign users to different groups, but only
for users that the delegated administrator creates
Note:
Setting the Owner Edit right on relevant groups
takes effect on a user only when you add the user
to the relevant group.
5.5.1 Choosing between “Modify the rights users have to objects” options
When you set up delegated administration, give your delegated administrator rights on the principals
he will control. You may want to give her all rights (Full Control); however, it is good practice to use
advanced rights settings to withhold the Modify Rights right and give your delegated administrator the
Securely Modify Rights right instead. You may also give your administrator the Securely Modify
Rights Inheritance Settings right instead of the Modify Rights Inheritance Settings right. The
differences between these rights are summarized below.
Modify the rights users have to objects
This right allows a user to modify any right for any user on that object. For example, if user A has the
rights View objects and Modify the rights users have to object on an object, user A can then change
the rights for that object so he or any other user has full control of this object.
Securely modify the rights users have to objects
This right allows a user to grant, deny, or revert to unspecified only the rights he is already granted. For
example, if user A has View and Securely modify the rights users have to objects rights, user A
can not give herself any more rights and can grant or deny to other users only these two rights (View
and Securely Modify Rights). Additionally, user A can change only the rights for users on objects for
which he has the Securely Modify Rights right.
These are all the conditions that must exist for user A to modify the rights for user B on object O:
133
•
User A has the Securely Modify Rights right on object O.
•
Each right or access level that user A is changing for user B is granted to A.
•
User A has the Securely Modify Rights right on user B.
2011-05-06
Setting Rights
•
If an access level is being assigned, User A has Assign Access Level right on the access level
that is changing for user B.
Scope of rights can further limit the effective rights that a delegated administrator can assign. For
example, a delegated administrator may have Securely Modify Rights and Edit rights on a folder, but
the scope of these rights is limited to the folder only and does not apply to its sub-objects. Effectively,
the delegated administrator can grant the Edit right on the folder (but not on its sub-objects) only, and
with an “Apply to objects” scope only. On the other hand, if the delegated administrator is granted the
Edit right on a folder with a scope of “Apply to sub-objects” only, she can grant other principals the
Edit right with both scopes on the folder's sub-objects, but on the folder itself, she can only grant the
Edit right with an “Apply to sub-objects” scope.
In addition, the delegated administrator will be restricted from modifying rights on those groups for other
principals that she doesn't have the Securely Modify Rights right on. This is useful, for example, if you
have two delegated administrators responsible for granting rights to different user groups for the same
folder, but you don't want one delegated administrator to be able to deny access to the groups controlled
by the other delegated administrator. The Securely Modify Rights right ensures this, since delegated
administrators generally won't have the Securely Modify Rights right on each other.
Securely modify rights inheritance settings
This right allows a delegated administrator to modify inheritance settings for other principals on the
objects that the delegated administrator has access to. To successfully modify the inheritance settings
of other principals, a delegated administrator must have this right on the object and on the user accounts
for the principals.
5.5.2 Owner rights
Owner rights are rights that apply only to the owner of the object on which rights are being checked. In
BI platform, the owner of an object is the principal who created the object; if that principal is ever deleted
from the system, ownership reverts to the Administrator.
Owner rights are useful in managing owner-based security. For example, you may want to create an
folder or hierarchy of folders in which various users can create and view documents, but can only modify
or delete their own documents. In addition, owner rights are useful for allowing users to manipulate
instances of reports they create, but not others' instances. In the case of the scheduling access level,
this permits users to edit, delete, pause and reschedule only their own instances.
Owner rights work similarly to their corresponding regular rights. However, owner rights are effective
only when the principal has been granted owner rights but regular rights are denied or not specified.
5.6 Summary of recommendations for rights administration
134
2011-05-06
Setting Rights
Keep these considerations in mind for rights administration:
135
•
Use access levels wherever possible. These predefined sets of rights simplify administration by
grouping together rights associated with common user needs.
•
Set rights and access levels on top-level folders. Enabling inheritance will allow these rights to be
passed down through the system with minimal administrative intervention.
•
Avoid breaking inheritance whenever possible. By doing so, you can reduce the amount of time it
takes to secure the content that you have added to BI platform.
•
Set appropriate rights for users and groups at the folder level, then publish objects to that folder. By
default, users or groups who have rights to a folder will inherit the same rights for any object that
you subsequently publish to that folder.
•
Organize users into user groups, assign access levels and rights to the entire group, and assign
access levels and rights to specific members when necessary.
•
Create individual administrator accounts for each administrator in the system and add them to the
Administrators group to improve accountability for system changes.
•
By default, the Everyone group is granted very limited rights to top-level folders in BI platform. After
installation, it is recommended that you review the rights of Everyone group members and assign
security accordingly.
2011-05-06
Setting Rights
136
2011-05-06
Securing BI Platform
Securing BI Platform
6.1 Security overview
This section details the ways in which BI platform addresses enterprise security concerns, thereby
providing administrators and system architects with answers to typical questions regarding security.
The BI platform architecture addresses the many security concerns that affect today's businesses and
organizations. The current release supports features such as distributed security, single sign-on, resource
access security, granular object rights, and third-party authentication in order to protect against
unauthorized access.
Because BI platform provides the framework for an increasing number of components from the Enterprise
family of SAP BusinessObjects products, this section details the security features and related functionality
to show how the framework itself enforces and maintains security. As such, this section does not provide
explicit procedural details; instead, it focuses on conceptual information and provides links to key
procedures.
After a brief introduction to security concepts for the system, details are provided for the following topics:
• How to use encryption and data processing security modes to protect data.
• How to set up the Secure Sockets Layer for BI platform deployments.
• Guidelines for setting up and maintaining firewalls for BI platform.
• Configuring reverse proxy servers.
6.2 Disaster recovery planning
Certain steps must be taken to protect your organization's investment in BI platform to ensure maximum
continuity of function lines of business in the event of a disaster. This section provides guidelines for
drafting a disaster recovery plan for your organization.
General guidelines
137
•
Perform regular system backups and send copies of some of the backup media offsite if necessary.
•
•
Safely store all software media.
Safely store all license documentation.
2011-05-06
Securing BI Platform
Specific guidelines
There are three system resources that require specific attention in terms of disaster recovery planning:
•
•
•
Content in the file repository servers: this includes proprietary content such as reports. You should
regularly backup this content - in the event of a disaster there is no way to regenerate such content
without a regular backup process in place.
The system database used by the CMS: this resource contains all the crucial metadata for your
deployment such as user information, reports and other sensitive information that is particular to
your organization.
Database information key file (.dbinfo file): this resource contains the master key to the system
database. If for some reason this key is not available, you will not be able to access the system
database. It is highly recommended after deploying BI platform you store the password for this
resource in a safe and known location. Without the password you will not be able to regenerate the
file and therefore lose access to the system database.
6.3 General recommendations for securing your deployment
The following are recommended guidelines for securing your BI platform deployments.
•
•
•
•
•
•
•
Use firewalls to protect the communication between the CMS and other system components. If
possible, always hide your CMS behind the firewall. At the very least, ensure that the system database
is safely behind the firewall.
Add additional encryption to the File Repository Servers. Once the system is up and running,
proprietary content will be stored in these servers. Add additional encryption through the OS or use
a third party tool.
Deploy a reverse proxy server in front of the web application servers in order to hide them behind
a single IP address. This configuration routes all Internet traffic that is addressed to private web
application servers through the reverse proxy server, therefore hiding private IP addresses.
Strictly enforce corporate password policies. Ensure that user passwords are routinely changed.
If you have opted to install the system database and web application server provided with BI platform,
you should access the relevant documentation to ensure these components are deployed with
adequate security configurations.
Use the Secure Sockets Layer (SSL) protocol for all network communication between clients and
servers in your deployment.
Access to the Central Management Console (CMC) should be restricted to local access only. For
information on deployment options for the CMC see the SAP BusinessObjectes Business Intelligence
Platform Web Application Deployment Guide.
Related Topics
• Requirements for communication between BI platform components
• BI platform and reverse proxy servers
• Configuring the SSL protocol
• Password restrictions
• Configuring security for bundled third-party servers
138
2011-05-06
Securing BI Platform
6.4 Configuring security for bundled third-party servers
If you have opted to install third-party server components that are bundled with BI platform, it is
recommended that you access and review the documentation for the following bundled components:
•
•
•
Microsoft SQL Server 2008 Express Edition: For detailed information on securing this system
database for Windows platforms see http://msdn.microsoft.com/en-us/li
brary/bb283235%28v=sql.100%29.aspx.
IBM DB2 Express: For detailed information on securing this system database for Unix platforms see
http://publib.boulder.ibm.com/infocenter/db2luw/v9r7/index.jsp?nav=/2_ .
Apache Tomcat 6.0: For detailed information on security for this web application server see
http://tomcat.apache.org/tomcat-6.0-doc/index.html.
6.5 Active trust relationship
In a networked environment, a trust relationship between two domains is generally a connection that
allows one domain accurately to recognize users who have been authenticated by the other domain.
While maintaining security, the trust relationship allows users to access resources in multiple domains
without repeatedly having to provide their credentials.
Within the BI platform environment, the active trust relationship works similarly to provide each user
with seamless access to resources across the system. Once the user has been authenticated and
granted an active session, all other BI platform components can process the user's requests and actions
without prompting for credentials. As such, the active trust relationship provides the basis for BI platform's
distributed security.
6.5.1 Logon tokens
A logon token is an encoded string that defines its own usage attributes and contains a user's session
information. The logon token's usage attributes are specified when the logon token is generated. These
attributes allow restrictions to be placed upon the logon token to reduce the chance of the logon token
being used by malicious users. The current logon token usage attributes are:
•
Number of minutes
This attribute restricts the lifetime of the logon token.
•
139
Number of logons
2011-05-06
Securing BI Platform
This attribute restricts the number of times that the logon token can be used to log on to BI platform.
Both attributes hinder malicious users from gaining unauthorized access to BI platform with logon tokens
retrieved from legitimate users.
Note:
Storing a logon token in a cookie is a potential security risk if the network between the browser and
application or web server is insecure – for example if the connection is made over a public network and
is not using SSL or Trusted Authentication. It is good practice to use Secure Sockets Layer (SSL) to
reduce security risk between the browser and application or web server.
When the logon cookie has been disabled, and the web server or web browser times out, the user is
presented with the logon screen. When the cookie is enabled, and the server or browser times out, the
user is seamlessly logged back onto the system. However, because state information is tied to the web
session, the user's state is lost. For example, if the user had a navigation tree expanded and a particular
item selected, the tree is reset.
For BI platform, the default is to have logon tokens enabled in the web client, however, you can disable
logon tokens for BI launch pad. When you disable the logon tokens in the client, the user session will
be limited by the web server or web browser timeout. When that session expires, the user will be required
to log in to BI platform again.
6.5.2 Ticket mechanism for distributed security
Enterprise systems dedicated to serving a large number of users typically require some form of distributed
security. An enterprise system may require distributed security to support features such the transfer of
trust (the ability to allow another component to act on behalf of the user)
BI platform addresses distributed security by implementing a ticket mechanism (one that is similar to
the Kerberos ticket mechanism). The CMS grants tickets that authorize components to perform actions
on behalf of a particular user. In BI platform, the ticket is referred to as the logon token.
This logon token is most commonly used over the Web. When users are first authenticated by BI platform
they receive logon tokens from the CMS. The user's web browser caches this logon token. When the
user makes a new request, other BI platform components can read the logon token from the user's web
browser.
6.6 Sessions and session tracking
In general, a session is a client-server connection that enables the exchange of information between
the two computers. A session's state is a set of data that describes the session's attributes, its
configuration, or its content. When you establish a client-server connection over the Web, the nature
of HTTP limits the duration of each session to a single page of information; thus, your web browser
140
2011-05-06
Securing BI Platform
retains the state of each session in memory only for as long as any single Web page is displayed. As
soon as you move from one web page to another, the state of the first session is discarded and replaced
with the state of the next session. Consequently, Web sites and Web applications must somehow store
the state of one session if they need to reuse its information in another.
BI platform uses two common methods to store session state:
•
Cookies—A cookie is a small text file that stores session state on the client side: the user's web
browser caches the cookie for later use. The BI platform logon token is an example of this method.
•
Session variables—A session variable is a portion of memory that stores session state on the server
side. When BI platform grants a user an active identity on the system, information such as the user's
authentication type is stored in a session variable. So long as the session is maintained, the system
neither has to prompt the user for the information a second time nor has to repeat any task that is
necessary for the completion of the next request.
For Java deployments, the session is used to handle .jsp requests; for .NET deployments, the
session is used to handle .aspx requests.
Note:
Ideally, the system should preserve the session variable while the user is active on the system. And,
to ensure security and to minimize resource usage, the system should destroy the session variable as
soon as the user has finished working on the system. However, because the interaction between a web
browser and a web server can be stateless, it can be difficult to know when users leave the system, if
they do not log off explicitly. To address this issue, BI platform implements session tracking.
6.6.1 CMS session tracking
The CMS implements a simple tracking algorithm. When a user logs on, the user is granted a CMS
session, which the CMS preserves until the user logs off, or until the web application server session
variable is released.
The web application server session is designed to notify the CMS on a recurring basis that it is still
active, so the CMS session is retained so long as the web application server session exists. If the web
application server session fails to communicate with the CMS for a ten-minute time period, the CMS
destroys the CMS session. This handles scenarios where client-side components shut down irregularly.
6.7 Environment protection
Environment protection refers to the security of the overall environment in which client and server
components communicate. Although the Internet and web-based systems are increasingly popular due
to their flexibility and range of functionality, they operate in an environment that can be difficult to secure.
When you deploy BI platform, environment protection is divided into two areas of communication:
141
2011-05-06
Securing BI Platform
6.7.1 Web browser to web server
When data is transmitted between the web browser and the web server, some degree of security is
usually required. Relevant security measures usually involve two general tasks:
•
Ensuring that the communication of data is secure.
•
Ensuring that only valid users retrieve information from the web server.
Note:
These tasks are typically handled by web servers through various security mechanisms, including the
Secure Sockets Layer (SSL) protocol, and other such mechanisms. It is good practice to use Secure
Sockets Layer (SSL) to reduce security risk between the browser and application or web server.
You must secure communication between the web browser and the web server independently of BI
platform. For details on securing client connections, refer to your web server documentation.
6.7.2 Web server to BI platform
Firewalls are commonly used to secure the area of communication between the web server and the
rest of the corporate intranet (including BI platform). The platform supports firewalls that use IP filtering
or static network address translation (NAT). Supported environments can involve multiple firewalls, web
servers, or application servers.
6.8 Auditing security configuration modifications
Any changes to default security configurations for the following will not be audited by BI platform:
• Properties files for the web applications (BOE, web services)
• TrustedPrincipal.conf
• Customization performed on BI launch pad and Open Document
In general, any security configuration modifications performed outside the CMC will not be audited.
This also applies to modifications performed though the Central Configuration Manager (CCM). Changes
committed through the CMC can be audited.
142
2011-05-06
Securing BI Platform
6.9 Auditing web activity
BI platform provides insight into your system by recording web activity and allowing you to inspect and
to monitor the details. The web application server allows you to select the web attributes—such as time,
date, IP address, port number, and so on—that you want to record. The auditing data is logged to disk
and stored in comma-delimited text files, so you can easily report off the data or import it into other
applications.
6.9.1 Protection against malicious logon attempts
No matter how secure a system is, there is often at least one location that is vulnerable to attack: the
location where users connect to the system. It is nearly impossible to protect this location completely,
because the process of simply guessing a valid user name and password remains a viable way to
attempt to "crack" the system.
BI platform implements several techniques to reduce the probability of a malicious user achieving access
to the system. The various restrictions listed below apply only to Enterprise accounts—that is, the
restrictions do not apply to accounts that you have mapped to an external user database (LDAP or
Windows AD). Generally, however, your external system will enable you to place similar restrictions on
the external accounts.
6.9.2 Password restrictions
Password restrictions ensure that users authenticating the default Enterprise authentication create
passwords that are relatively complex. You can enable the following options:
•
Enforce mixed-case passwords
This option ensures that passwords contain at least two of the following character classes: upper
case letters, lower case letters, numbers, or punctuation.
•
Must contain at least N characters
By enforcing a minimum complexity for passwords, you decrease a malicious user's chances of
simply guessing a valid user's password.
143
2011-05-06
Securing BI Platform
6.9.3 Logon restrictions
Logon restrictions serve primarily to prevent dictionary attacks (a method whereby a malicious user
obtains a valid user name and attempts to learn the corresponding password by trying every word in a
dictionary). With the speed of modern hardware, malicious programs can guess millions of passwords
per minute. To prevent dictionary attacks, BI platform has an internal mechanism that enforces a time
delay (0.5–1.0 second) between logon attempts. In addition, the platform provides several customizable
options that you can use to reduce the risk of a dictionary attack:
•
Disable accounts after N failed attempts to log on
•
Reset failed logon count after N minute(s)
•
Re-enable account after N minute(s)
6.9.4 User restrictions
User restrictions ensure that users authenticating the default Enterprise authentication create new
passwords on a regular basis. You can enable the following options:
•
Must change password every N day(s)
•
Cannot reuse the N most recent password(s)
•
Must wait N minute(s) to change password
These options are useful in a number of ways. Firstly, any malicious user attempting a dictionary attack
will have to recommence every time passwords change. And, because password changes are based
on each user's first logon time, the malicious user cannot easily determine when any particular password
will change. Additionally, even if a malicious user does guess or otherwise obtain another user's
credentials, they are valid only for a limited time.
6.9.5 Guest account restrictions
The BI platform supports anonymous single sign-on for the Guest account. Thus, when users connect
to BI platform without specifying a user name and password, the system logs them on automatically
under the Guest account. If you assign a secure password to the Guest account, or if you disable the
Guest account entirely, you disable this default behavior.
144
2011-05-06
Securing BI Platform
6.10 Processing extensions
BI platform allows you to further secure your reporting environment through the use of customized
processing extensions. A processing extension is a dynamically loaded library of code that applies
business logic to particular BI platform view or schedule requests before they are processed by the
system.
Through its support for processing extensions, the BI platform administration SDK essentially exposes
a "handle" that allows developers to intercept the request. Developers can then append selection
formulas to the request before the report is processed.
A typical example is a report-processing extension that enforces row-level security. This type of security
restricts data access by row within one or more database tables. The developer writes a dynamically
loaded library that intercepts view or schedule requests for a report (before the requests are processed
by a Job Server, Processing Server, or Report Application Server). The developer's code first determines
the user who owns the processing job; then it looks up the user's data-access privileges in a third-party
system. The code then generates and appends a record selection formula to the report in order to limit
the data returned from the database. In this case, the processing extension serves as a way to incorporate
customized row-level security into the BI platform environment.
Tip:
By enabling processing extensions, you configure the appropriate BI platform server components to
dynamically load your processing extensions at runtime. Included in the SDK is a fully documented API
that developers can use to write processing extensions. For more information, see the developer
documentation available on your product distribution.
6.11 Overview of BI platform data security
Administrators of BI platform systems manage the way sensitive data is secured through the following:
•
•
A security setting at the cluster level that determines which applications and clients can access the
CMS. This setting is managed through the Central Configuration Manager.
A two-key cryptography system that controls both access to the CMS repository, and keys used to
encrypt/decrypt objects within the repository. Access to the CMS repository is set via the Central
Configuration Manager, while the Central Management Console has a dedicated management area
for cryptographic keys.
These features allow administrators to set BI platform deployments to particular data security compliance
levels and to manage encryption keys used to encrypt and decrypt data within the CMS repository.
145
2011-05-06
Securing BI Platform
6.11.1 Data processing security modes
BI platform can operate in two possible data processing security modes:
•
•
The default data processing security mode. In certain instances, systems running in this mode will
use hard-coded encryption keys and do not follow a specific standard. The default mode enables
backward compatibility with previous versions of BI platform client tools and applications.
A data security mode designed to meet guidelines stipulated by the Federal Information Processing
Standard (FIPS) - specifically FIPS 140-2. In this mode FIPS-compliant algorithms and cryptographic
modules are used to protect sensitive data. When the platform runs in FIPS-compliant mode, all
clients tools and applications that do not meet FIPS guidelines are automatically disabled. The
platform client tools and applications are designed to meet the FIPS 140-2 standard. Older clients
and applications will not work when SAP BusinessObjects Business Intelligence platform 4.0 is
running in FIPS-compliant mode.
The data processing mode is transparent to system users. In both data processing security modes,
sensitive data is encrypted and decrypted in the background by an internal encryption engine.
It is recommended that you use the FIPS-compliant mode in the following circumstances:
•
•
•
Your SAP BusinessObjects Business Intelligence platform 4.0 deployment will not need to use or
interact with any legacy BI platform client tools or applications.
Your organization's data processing standards and guidelines prohibit the use of hard-coded
encryption keys.
Your organization is required to secure sensitive data according to FIPS 140-2 regulations.
The data processing security mode is set through the Central Configuration Manager on both Windows
and UNIX platforms. Every node in a clustered environment must bet set to the same mode.
6.11.1.1 To turn on FIPS-compliant mode on Windows
By default, FIPS-compliant mode is off after BI platform is installed. Use the instructions below to turn
on the FIPS-compliant setting for all nodes in your deployment.
1. To launch the CCM go to Programs > SAP BusinessObjects Enterprise XI 4.0 > SAP
BusinessObjects Enterprise > Central Configuration Manager.
2. In the CCM, right-click the Server Intelligence Agent (SIA) and choose Stop.
Caution:
Do not proceed to Step 3 until the SIA status is marked as "Stopped".
3. Right-click the SIA and choose Properties.
The "Properties" dialog box opens displaying the Properties tab.
4. Add -fips to the "Command" field and click Apply.
146
2011-05-06
Securing BI Platform
5. Click OK to close the "Properties" dialog box.
6. Restart the SIA.
The SIA is now operating in FIPS-complaint mode.
You must turn on the FIPS-compliant setting on all SIAs in your BI platform deployment.
6.11.1.2 To turn on FIPS-compliant mode on UNIX
All nodes in your BI platform deployment must be stopped before attempting the following procedure.
By default, FIPS-compliant mode is off after BI platform is installed. Use the instructions below to turn
on the FIPS-compliant setting for all nodes in your deployment.
1. Go to the directory where BI platform is installed on your UNIX machine.
2. Change to the sap_bobj directory.
3. Type ccm.config and press Enter.
The ccm.config file is loaded.
4. Add -fips to the to the node launch command parameter.
The node launch command parameter appears as [node name Launch].
5. Save your changes and Exit.
6. Restart the node.
The node is now operating in FIPS-complaint mode.
You must turn on the FIPS-compliant setting on all the nodes in your BI platform deployment.
6.11.1.3 To turn off FIPS-compliant mode on Windows
All servers in your BI platform deployment must be stopped before attempting the following procedure.
If your deployment is running on FIPS-compliant mode, use the following instructions to turn off the
setting.
1. In the CCM, right-click the Server Intelligence Agent (SIA) and choose Stop.
Caution:
Do not proceed to Step 2 until the node status is marked as "Stopped".
2. Right-click the SIA and choose Properties.
The "Properties" dialog box opens displaying the Properties tab.
3. Remove -fips from the "Command" field and click Apply.
147
2011-05-06
Securing BI Platform
4. Click OK to close the "Properties" dialog box.
5. Restart the SIA.
6.12 Cryptography in BI platform
Sensitive Data
BI platform cryptography is designed to protect sensitive data stored in the CMS repository. Sensitive
data includes user credentials, data source connectivity data, and any other info objects that store
passwords. This data is encrypted to ensure privacy, keep it free from corruption, and maintain access
control. All the requisite encryption resources (including the encryption engine, RSA libraries) are
installed by default on each BI platform deployment.
The BI platform system uses a two-key cryptography system.
Cryptographic Keys
Encryption and decryption of sensitive data is handled in the background through the SDK interacting
with the internal encryption engine. System administrators manage data security through symmetric
encryption keys without directly encrypting or decrypting specific data blocks.
In BI platform, symmetric encryption keys known as Cryptographic Keys are used to encrypt/decrypt
sensitive data. The Central Management Console has a dedicated management area for cryptographic
keys. Use the "Cryptographic Keys" to view, generate, deactivate, revoke, and delete keys. The system
ensures that any key required to decrypt sensitive data cannot be deleted.
Cluster Keys
Cluster keys are symmetric key wrapping keys that protect cryptographic keys stored in the CMS
repository. Using symmetric key algorithms, cluster keys maintain a level of access control to the CMS
repository. Each node in BI platform is assigned a cluster key during installation setup. System
administrators can use the CCM to reset the cluster key.
6.12.1 Working with cluster keys
During the installation setup for BI platform, an eight character cluster key is created for the Server
Intelligence Agent. This key is used to encrypt all the cryptographic keys in the CMS repository. Without
the correct cluster key you cannot access the CMS. The cluster key is stored in encrypted format in the
dbinfo file. In a default Windows installation the file is stored in the following directory: C:\Program
Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\win64_x64 . On Unix systems, the file is stored in the platform directory under <IN
STALLDIR>/sap_bobj/enterprise_xi40/.
148
2011-05-06
Securing BI Platform
Unix platform
Path
AIX
<INSTALLDIR>/sap_bobj/enterprise_xi40/ aix_rs6000/
Solaris
<INSTALLDIR>/sap_bobj/enterprise_xi40/ solaris_sparc/
Linux
<INSTALLDIR>/sap_bobj/enterprise_xi40/ linux_x86/
HP_UX
<INSTALLDIR>/sap_bobj/enterprise_xi40/ hpux_pa-risc/
The file is name in based on the following convention: _boe_<sia_name>.dbinfo, where <sia_name>
is the name of the server intelligence agent for the cluster.
Note:
The cluster key for any given node cannot be retrieved from the dbinfo file. It is recommended that
system administrators take considered and careful measures to protect cluster keys.
Only users with administrative privileges can reset cluster keys. When required, use the CCM to reset
the eight-character cluster key for every node your deployment. New cluster keys are automatically
used to wrap the cryptographic keys within the CMS repository.
6.12.1.1 To reset the cluster key on Windows
Before resetting the cluster key for make sure all servers managed by the Server Intelligence Agent
are stopped.
Use the following procedure to reset the cluster key for your node.
1. To launch the CCM, go to Programs > SAP BusinessObjects Enterprise XI 4.0 > SAP
BusinessObjects Enterprise > Central Configuration Manager.
2. In the CCM, right-click the Server Intelligence Agent (SIA) and choose Stop.
Caution:
Do not proceed to Step 3 until the SIA status is marked as "Stopped".
3. Right-click the Server Intelligence Agent (SIA) and choose Properties.
The "Properties" dialog box opens.
4. Click the Configuration tab.
5. Click Change under "CMS System Database Configuration".
A warning message is displayed.
6. Click Yes to continue.
The "Change Cluster Key" dialog box opens.
7. Enter the same eight-character key in both the "New Cluster Key" and "Confirm New Cluster Key"
fields.
149
2011-05-06
Securing BI Platform
Note:
On Windows platforms, cluster keys must contain a combination of upper and lower case characters.
Alternately, users can also generate a random key. A random key is required in order to be
FIPS-compliant.
8. Click OK to submit the new cluster key to the system.
A message is displayed confirming that the cluster key has been reset successfully.
9. Restart the SIA.
In a multi-node cluster, you must reset the cluster keys for all the SIAs in your BI platform deployment
to the new key.
6.12.1.2 To reset the cluster key on UNIX
Before resetting the cluster key for a node, make sure all servers managed by the node have been
stopped.
1. Go to the directory where BI platform is installed on your UNIX machine.
2. Change to the sap bobj directory.
3. Type cmsdbsetup.sh and press Enter.
The "CMS Database Setup" screen is displayed.
4. Type the name of the node and press Enter.
5. Type 2 to change the cluster key.
A warning message is displayed.
6. Select Yes to continue.
7. In the field provided type a eight character new cluster key and press Enter.
Note:
On UNIX platforms, a valid cluster key contains any combination of eight characters without
restrictions.
8. Re-enter the new cluster key in the field provided and press Enter.
A message is displayed informing you that the cluster key has been successfully reset.
9. Restart the node.
You must reset all the nodes in your BI platform deployment to use the same cluster key.
6.12.2 Cryptographic Officers
150
2011-05-06
Securing BI Platform
To manage cryptographic keys in the CMC you must be a member of the Cryptographic Officers group.
The default administrator account created for BI platform is also a member of the Cryptographic Officers
group. Use this account to add users to the Cryptographic Officers group as required. It is recommended
that membership to the group be restricted to a limited number of users.
Note:
When users are added to the Administrators group, they do not inherit the rights required to perform
management tasks on cryptographic keys.
6.12.2.1 To add a user to the Cryptographic Officers group
A user account must exist in BI platform before it can be added to the Cryptographic Officers group.
Note:
You must be a member of both of the Administrators and Cryptographic Officers groups to add a user
to the Cryptographic Officers group.
1. In the "Users and Groups" management area of the CMC, select the Cryptographic Officers group.
2. Click Actions > Add Members to Group.
The "Add" dialog box opens.
3. Click User list.
The Available users/groups list refreshes and displays all user accounts in the system.
4. Move the user account that you want to add to the Cryptographic Officers group from the Available
users/groups list to the Selected users/groups list.
Tip:
To search for a specific user, use the search field.
5. Click OK.
As a member of the Cryptographic Officers group, the newly added account will have access to the
"Cryptographic Keys" management area in the CMC.
6.12.2.2 To view cryptographic keys in the CMC
The CMC application contains a dedicated management area for cryptographic keys used by the BI
platform system. Access to this area is restricted to members of the Cryptographic Officers group.
1. To launch the CMC go to Programs > SAP BusinessObjects XI 4.0 > SAP BusinessObjects
Enterprise > SAP BusinessObjects Enterprise Central Management Console.
The CMC home page opens.
2. Click the "Cryptographic Keys" tab.
151
2011-05-06
Securing BI Platform
The "Cryptographic Keys" management area is displayed.
3. Double-click the cryptographic key for which you want to see further details.
Related Topics
• To view objects associated with a cryptographic key
6.12.3 Managing cryptographic keys in the CMC
Cryptographic officers use the "Cryptographic Keys" management area to review, generate, deactivate,
revoke, and delete keys used to protect sensitive data stored in the CMS repository.
All cryptographic keys currently defined in the system are listed on the "Cryptographic Keys" management
area . Basic information for each key is provided under the headings described in the following table:
Heading
Description
Title
Name identifier of the cryptographic key
Status
The key's current status
Last Change
Date and time stamp for the last change associated with the cryptographic
key
Objects
Number of objects associated with the key
Related Topics
• Cryptographic key status
• To create a new cryptographic key
• To delete a cryptographic key from the system
• To revoke a cryptographic key
• To view objects associated with a cryptographic key
• To mark cryptographic keys as compromised
6.12.3.1 Cryptographic key status
The following table lists all the possible status options for cryptographic keys in BI platform:
152
2011-05-06
Securing BI Platform
Status
Description
Active
Only one cryptographic key can be designated "Active" in the system. This
key is used to encrypt current sensitive data that will be stored in the CMS
database. The key is also used to decrypt all the objects that appear in its
Object List. Once a new cryptographic key is created, the current "Active"
reverts to the "Deactivated" state. An active key cannot be deleted from the
system.
Deactivated
A "Deactivated" key can no longer be used to encrypt data. It can however
be used to decrypt all the objects that appear in its Object List. You cannot
reactivate a key once it has been deactivated. A key marked as "Deactivated"
cannot be deleted. from the system. You must changed a key's status to
"Revoked" before it can be deleted.
Compromised
A cryptographic key that is deemed to be insecure can be marked as compromised. By flagging such a key, you can later proceed to re-encrypt data objects
that are still associated with the key. Once a key is marked as compromised
it must be revoked before it can be deleted from the system.
Revoked
When a cryptographic key is revoked, a process is launched in which all objects currently associated with the key are re-encrypted with the current "Active" cryptographic key. Once a key is revoked it can safely be deleted from
the system. The revocation mechanism ensures that data in the CMS
database can always be decrypted. There is no way to reactivate a key once
it has been revoked.
Deactivated: Rekeying- Indicates that the cryptographic key is in the process of being revoked. Once
in process
the process is complete, the key will be marked as "Revoked".
Deactivated: Rekeying- Indicates that the process for revoking a cryptographic key has been suspendsuspended
ed. This usually occurs if the process has been deliberately suspended or if
a data object associated with the key is not available.
Revoked-Compromised A key is flagged as Revoked-Compromised if has been marked as compromised and all the data previously associated with it has been encrypted with
another key. When a "Deactivated" key is marked as compromised, you are
given a choice of not taking action or revoking the key. Once a compromised
key is revoked it can be deleted.
6.12.3.2 To view objects associated with a cryptographic key
1. Select the key in the "Cryptographic Keys " management area of the CMC.
2. Click Manage > Properties.
The cryptographic key's "Properties" dialog box opens.
3. Click "Object List" in the navigation pane on the left of the "Properties" dialog box.
153
2011-05-06
Securing BI Platform
All the objects associated with the cryptographic key are listed to the right of the navigation pane.
Tip:
Use the search functions to look for a specific object.
6.12.3.3 To create a new cryptographic key
Caution:
When you create a new cryptographic key, the system automatically deactivates the current "Active"
key. Once a key has been deactivated it cannot be restored as the "Active" key.
1. In the "Cryptographic Keys "management area of the CMC, click Manage > New > Cryptographic
Key.
The "Create New Cryptographic Key" dialog box opens displaying a warning message.
2. Click Continue to create the new cryptographic key.
3. Type the name and a description of the new cryptographic key; click OK to save your information.
The new key is listed as the only active key in the "Cryptographic Keys" management area. The
previously "Active" key is now marked as "Deactivated."
All new sensitive data generated and stored in the CMS database will now be encrypted with the new
cryptographic key. You have the option to revoke the previous key and re-encrypt all its data objects
with the new active key.
6.12.3.4 To mark cryptographic keys as compromised
You can mark a cryptographic key as compromised if for some reason a cryptographic key is considered
to no longer be secure. This is useful for tracking purposes and you can proceed to identify which data
objects are associated with the key. A cryptographic key must be deactivated before it can marked as
compromised.
Note:
You can also mark a key as compromised after it has been revoked.
1. Go to the "Cryptographic Keys " management area of the CMC.
2. Select the cryptographic key you want to mark as compromised.
3. Click Actions > Mark as Compromised.
The "Mark as Compromised" dialog box displays a warning message.
4. Click Continue.
5. Select one of following options from the "Mark as Compromised" dialog:
154
2011-05-06
Securing BI Platform
•
•
Yes: launches the process to re-encrypt all data objects that are associated with the compromised
key.
No: the "Mark as Compromised" dialog box is closed and the cryptographic key is marked as
"Compromised" in the "Cryptographic Keys" management area .
Note:
If you select No, sensitive data will continue to be associated with the compromised key. The
compromised key will be used by the system to decrypt the associated objects.
Related Topics
• To revoke a cryptographic key
• Cryptographic key status
• To view objects associated with a cryptographic key
6.12.3.5 To revoke a cryptographic key
A "Deactivated" cryptographic key can still be used by data objects associated with it. To break the
association between the encrypted objects and the deactivated key, you must revoke the key using the
following instructions.
1. Select the key you want to revoke from the keys listed in "Cryptographic Keys "management area.
2. Click Actions > Revoke Key.
The "Revoke key" dialog box opens displaying a warning message.
3. Click OK to revoke the cryptographic key.
A process is launched to encrypt all the key's objects with the current active key. If the keys is
associated with many data objects, it will be marked as "Deactivated: Rekeying-In Process" until
the re-encryption process is complete.
Once a cryptographic key is revoked, it can be safely removed from the system since no sensitive data
objects require the key for decryption.
6.12.3.6 To delete a cryptographic key from the system
Before you can delete a cryptographic key from the BI platform, you must ensure that no data objects
in the system require the key. This restriction ensures that all sensitive data stored in the CMS repository
can always be decrypted.
After you have successfully revoked a cryptographic key, use the following instructions to delete the
key from the system.
155
2011-05-06
Securing BI Platform
1. Go to the "Cryptographic Keys " management area of the CMC.
2. Select the cryptographic key you want to delete.
3. Click Manage > Delete.
The "Delete key" dialog box displays a warning message.
4. Click Delete to remove the cryptographic key from the system.
The deleted key no longer appears in the "Cryptographic Keys "management area of the CMC.
Note:
Once a cryptographic key is deleted from the system, it cannot be restored.
Related Topics
• To revoke a cryptographic key
• Cryptographic key status
6.13 Configuring servers for SSL
You can use the Secure Sockets Layer (SSL) protocol for all network communication between clients
and servers in your BI platform deployment.
To set up SSL for all server communication you need to perform the following steps:
•
Deploy BI platform with SSL enabled.
•
Create key and certificate files for each machine in your deployment.
•
Configure the location of these files in the Central Configuration Manager (CCM) and your web
application server.
Note:
If you are using thick clients, such as Crystal Reports or Designer you will also need to configure these
for SSL if you will be connecting to the CMS from these thick client. Otherwise, you will get errors when
you attempt to connect to a CMS that has been configured for SSL from a thick client that has not been
configured the same way.
6.13.1 Creating key and certificate files
To set up SSL protocol for your server communication, use the SSLC command line tool to create a
key file and a certificate file for each machine in your deployment.
156
2011-05-06
Securing BI Platform
Note:
•
•
•
You need to create certificates and keys for all machines in the deployment, including machines
running thick client components such as Crystal Reports. For these client machines, use the
sslconfig command line tool to do the configuration.
For maximum security, all private keys should be protected and should not be transferred through
unsecured communication channels.
Certificates created for previous versions of BI platform will not work for SAP BusinessObjects
Business Intelligence platform 4.0. These certificates will need to be re-created.
6.13.1.1 To create key and certificate files for a machine
1. Run the SSLC.exe command line tool.
The SSLC tool is installed with your BI platform software. (On Windows, for example, it is installed
by default in <INSTALLDIR>\SAP BusinessObjects Enterprise XI 4.0\win64_x64.)
2. Type the following command:
sslc req -config sslc.cnf -new -out cacert.req
This command creates two files, a Certificate Authority (CA) certificate request (cacert.req) and a
private key (privkey.pem).
3. To decrypt the private key, type the following command:
sslc rsa -in privkey.pem -out cakey.pem
This command creates the decrypted key, cakey.pem.
4. To sign the CA certificate, type the following command:
sslc x509 -in cacert.req -out cacert.pem -req -signkey cakey.pem -days 365
This command creates a self-signed certificate, cacert.pem, that expires after 365 days. Choose
the number of days that suits your security needs.
5. Using a text editor, open the sslc.cnf file, which is stored in the same folder as the SSLC command
line tool.
Note:
Using a text editor is highly recommended for Windows because Windows Explorer may not properly
recognize and display files with the .cnf extension.
6. Perform the following steps based on settings in the sslc.cnf file.
•
Place the cakey.pem and cacert.pem files in the directories specified by sslc.cnf file's
certificate and private_key options.
By default, the settings in the sslc.cnf file are:
certificate = $dir/cacert.pem
157
2011-05-06
Securing BI Platform
private_key = $dir/private/cakey.pem
•
Create a file with the name specified by the sslc.cnf file's database setting.
Note:
By default, this file is $dir/index.txt. The file should be empty.
•
Create a file with the name specified by the sslc.cnf file's serial setting.
Ensure that this file provides an octet-string serial number (in hexadecimal format).
Note:
To ensure that you can create and sign more certificates, choose a large hexadecimal number
with an even number of digits, such as 11111111111111111111111111111111.)'
•
Create the directory specified by the sslc.cnf file's new_certs_dir setting.
7. To create a certificate request and a private key, type the following command:
sslc req -config sslc.cnf -new -out servercert.req
The certificate and key files generated are placed under the current working folder.
8. Run the following command to decrypt the key in the privkey.pem file.
sslc rsa -in privkey.pem -out server.key
9. To sign the certificate with the CA certificate, type the following command:
sslc ca -config sslc.cnf -days 365 -out servercert.pem -in servercert.req
This command creates the servercert.pem file, which contains the signed certificate.
10. Use the following commands to convert the certificates to DER encoded certificates:
sslc x509 -in cacert.pem -out cacert.der -outform DER
sslc x509 -in servercert.pem -out servercert.der -outform DER
Note:
The CA certificate (cacert.der) and its corresponding private key (cakey.pem) need to be generated
only once per deployment. All machines in the same deployment must share the same CA certificates.
All other certificates need to be signed by the private key of any of the CA certificates.
11. Create a text file (passphrase.txt) for storing the plain text passphrase used for decrypting the
generated private key.
12. Store the following key and certificate files in a secure location (under the same directory (d:/ssl))
that can be accessed by the machines in your BI platform deployment:
• the trusted certificate file (cacert.der)
158
•
the generated server certificate file (servercert.der)
•
the server key file (server.key)
•
the passphrase file
2011-05-06
Securing BI Platform
This location will be used to configure SSL for the CCM and your web application server.
6.13.2 Configuring the SSL protocol
After you create keys and certificates for each machine in your deployment, and store them in a secure
location, you need to provide the Central Configuration Manager (CCM) and your web application server
with the secure location.
You also need to implement specific steps for configuring the SSL protocol for the web application
server and for any machine running a thick-client application.
6.13.2.1 To configure the SSL protocol in the CCM
1. In the CCM, right-click the Server Intelligence Agent and choose Properties.
2. In the Properties dialog box, click the Protocol tab.
3. Make sure Enable SSL is selected.
4. Provide the file path for the directory where you stored the key and certificate files.
Field
Description
SSL Certificates Folder
Folder where all the required SSL certificates and files are stored. For
example: d:\ssl
Server SSL Certificate
File
Name of the file used to store the server SSL certificate. By default,
servercert.der
SSL Trusted Certificates Name of the file with the SSL trusted certificate. By default, cacert.der
File
SSL Private Key File
Name of the SSL private key file used to access the certificate. By default, server.key
SSL Private Key
Passphrase File
Name of the text file containing the passphrase used to access the private key. By default, passphrase.txt
Note:
Make sure you provide the directory for the machine that the server is running on.
159
2011-05-06
Securing BI Platform
6.13.2.2 To configure the SSL protocol on UNIX
You must use the serverconfig.sh script to configure the SSL protocol for a SIA. This script provides
a text-based program that enables you to view server information and to add and delete servers from
your installation. The serverconfig.sh script is installed to the sap_bobj directory of your installation.
1. Use the ccm.sh script to stop the SIA and all the SAP BusinessObjects servers.
2. Run the serverconfig.sh script.
3. Select 3 - Modify a Server Intelligence Agent, and press Enter.
4. Specify the target SIA and press Enter.
5. Select the Modify server SSL configuration option.
6. Select ssl.
When prompted specify the SSL certificate locations.
7. Repeat steps 1-6 for every SIA if your BI platform deployment is a SIA cluster.
8. Start the SIA with the ccm.sh script, and wait for the servers to start.
6.13.2.3 To configure the SSL protocol for the web application server
1. If you have a J2EE web application server, run the Java SDK with the following system properties
set. For example:
-Dbusinessobjects.orb.oci.protocol=ssl -DcertDir=d:\ssl -DtrustedCert=cacert.der
-DsslCert=clientcert.der -DsslKey=client.key -Dpassphrase=passphrase.txt
The following table shows the descriptions that correspond to these examples:
160
Example
Description
DcertDir=d:\ssl
The directory to store all the certificates and
keys.
DtrustedCert=cacert.der
Trusted certificate file. If specifying more than
one, separate with semicolons.
DsslCert=clientcert.der
Certificate used by the SDK.
2011-05-06
Securing BI Platform
Example
Description
DsslKey=client.key
Private key of the SDK certificate.
Dpassphrase=passphrase.txt
The file that stores the passphrase for the private key.
2. If you have an IIS web application server, run the sslconfig tool from the command line and follow
the configuration steps.
6.13.2.4 To configure thick clients
Before performing the following procedure you need to create and save all the required SSL resources
(for example, certificates and private keys) in a known directory.
In the procedure below it is assumed that you have followed the instructions for creating the following
SSL resources:
SSL resource
SSL certificates folder
d:\ssl
Server SSL certificate file name
servercert.der
SSL trusted certificate or root certificate file name
cacert.der
SSL private key file name
server.key
File containing passphrase for accessing the SSL private key file
passphrase.txt
Once the above resources have been created, use the following instructions to configure thick client
applications such as the Central Configuration Manager (CCM) or the upgrade management tool.
1. Make sure the thick-client application is not in operation.
Note:
Make sure you provide the directory for the machine that the server is running on.
2. Run the sslconfig.exe command line tool.
The SSLC tool is installed with your BI platform software. (On Windows, for example, it is installed
by default in <INSTALLDIR>\SAP BusinessObjects Enterprise XI 4.0\win64_x64.)
3. Type the following command:
sslconfig.exe -dir d:\SSL -mycert servercert.der -rootcert cacert.der -mykey server.key
-passphrase passphrase.txt -protocol ssl
161
2011-05-06
Securing BI Platform
4. Restart the thick client application.
Related Topics
• To create key and certificate files for a machine
6.13.2.4.1 To configure SSL login for translation management tool
To enable users to use SSL login with the translation management tool, information about the SSL
resources must be added to the tool's configuration (.ini) file.
1. Locate the TransMgr.ini file in the following directory: <INSTALLDIR>\SAP BusinessObjects
Enterprise XI 4.0\win32_x86.
2. Using a text editor, open the TransMgr.ini.
3. Add the following parameters:
-Dbusinessobjects.orb.oci.protocol=ssl -DcertDir=D:\SSLCert
-DtrustedCert=cacert.der -DsslCert=servercert.der -DsslKey=server.key
-Dpassphrase=passphrase.txt -jar program.jar
4. Save the file and close the text editor.
Users can now use SSL to log into the translation management tool.
6.13.2.4.2 To configure SSL for report conversion tool
Before performing the following procedure you need to create and save all the required SSL resources
(for example, certificates and private keys) in a known directory. In addition, the report conversion tool
must be installed as part of your BI platform deployment.
In the procedure below it is assumed that you have followed the instructions for creating the following
SSL resources:
SSL resource
SSL certificates folder
d:\ssl
Server SSL certificate file name
servercert.der
SSL trusted certificate or root certificate file name
cacert.der
SSL private key file name
server.key
File containing passphrase for accessing the SSL private key file
passphrase.txt
Once the above resources have been created, use the following instructions to configure SSL to work
with the report conversion tool.
1. Create a Windows environment variable BOBJ_MIGRATION on the machine hosting the report
conversion tool.
Tip:
The variable can be set to any value.
2. Using a text editor, open the migration.bat in the following directory:
162
2011-05-06
Securing BI Platform
<INSTALLDIR>\SAP BusinessObjects Enterprise XI 4.0\win32_x86\scripts\.
3. Located the following line:
start "" "%JRE%\bin\javaw" -Xmx512m -Xss10m -jar "%SHAREDIR%\lib\migration.jar"
4. Add the following after the -Xss10m parameter:
-Dbusinessobjects.orb.oci.protocol=ssl
-DcertDir=C:/ssl
-DtrustedCert=cacert.der
-DsslCert=servercert.der
-DsslKey=server.key
-Dpassphrase=passphrase.txt
-Dbusinessobjects.migration
Note:
Ensure there is a space between each parameter.
5. Save the file and close the text editor.
Users can now use SSL to access the report conversion tool.
Related Topics
• To create key and certificate files for a machine
6.14 Understanding communication between BI platform components
If your BI platform system is deployed entirely on the same secured subnet, there is no need to perform
any special configuration of your firewalls. However, you might choose to deploy some components on
different subnets separated by one or more firewalls.
It is important to understand the communication between BI platform servers, rich clients, and the web
application server hosting the SAP BusinessObjects SDK before configuring your system to work with
firewalls.
Related Topics
• Configuring BI platform for firewalls
• Examples of typical firewall scenarios
6.14.1 Overview of BI platform servers and communication ports
It is important to understand the BI platform servers and their communication ports if the system is
deployed with firewalls.
163
2011-05-06
Securing BI Platform
6.14.1.1 Each BI platform server binds to a request port
A BI platform server, the Input File Repository Server for example, binds to a request port when it starts.
Other BI platform components including servers, rich clients, and the SDK hosted in the web application
server can use this request port to communicate with the server.
A server will select its request port number dynamically when the server starts or restarts, unless it is
configured to use a specific port number. A specific request port number must be configured for servers
that communicate with other BI platform components across a firewall.
6.14.1.2 Each BI platform server registers with the CMS
BI platform servers register with the CMS when they start. When a server registers, the CMS records:
•
•
The hostname (or IP address) of the server's host machine.
The server's Request Port number.
6.14.1.3 The CMS uses two ports
The CMS uses two ports: the Request Port and the Name Server Port. The Request Port is selected
dynamically by default. The Name Server Port is 6400 by default.
All BI platform servers and client applications will initially contact the CMS on its Name Server port. The
CMS will respond to this initial contact by returning the value of its Request Port. The servers will use
this Request Port for subsequent communication with the CMS.
6.14.1.4 The Central Management Server (CMS) provides a directory of registered
services
The CMS provides a directory of the services that have registered with it. Other BI platform components
such as web services, rich clients, and the SDK hosted in the web application server can contact the
CMS and request a reference to a particular service. A service's reference contains the service's Request
Port number and the host name (or IP address) of the server's host machine and service ID.
164
2011-05-06
Securing BI Platform
BI platform components might reside on a different subnet than the server they are using. The host
name (or IP address) contained in the service's reference must be routable from the component's
machine.
Note:
The reference to an BI platform server will contain the server machine's host name by default. (If a
machine has more than one hostname, the primary hostname is chosen). You can configure a server
so that its reference contains the IP address instead.
Related Topics
• Communication between BI platform components
6.14.1.5 Server Intelligence Agents (SIA) communicate with the Central
Management Server (CMS)
Your deployment will not work if the Server Intelligence Agent (SIA) and Central Management Server
(CMS) cannot communicate with each other. Ensure that your firewall ports are configured to allow
communication between all SIAs and all CMSs in the cluster.
6.14.1.6 Job server child processes communicate with the data tier and the CMS
Most job servers create a child process to handle a task such as generating a report. The job server
creates one or more child processes. Each child process has its own Request Port.
By default, a job server will dynamically select a Request Port for each child process. You can specify
a range of port numbers that the job server can select from.
All child processes communicate with the CMS. If this communication crosses a firewall, you must:
•
•
Specify the range of port numbers that the job server can select from by adding the -re
questJSChildPorts<lowestport>-<highestport> and -requestPort<port> parameters
to the server's command line. Note that the port range should be large enough to allow the maximum
number of child process as specified by -maxJobs.
Open the specified port range on the firewall.
Many child processes communicate with the data tier. For example, a child process might connect to
a reporting database, extract data, and calculate values for a report. If the job server child process
communicates with the data tier across a firewall, you must:
• Open a communicate path on the firewall from any port on the job server machine to the database
listen port on the database server machine.
165
2011-05-06
Securing BI Platform
Related Topics
• Command lines overview
6.14.2 Communication between BI platform components
BI platform components, such as browser clients, rich clients, servers, and the SDK hosted in the web
application server, communicate with each other across the network during typical workflows. You must
understand these workflows to deploy SAP BusinessObjects products across different subnets that are
separated by a firewall.
6.14.2.1 Requirements for communication between BI platform components
Deployments of BI platform must conform to these general requirements.
1. Every server must be able to initiate communication with every other BI platform server on that
server's Request Port.
2. The CMS uses two ports. Every BI platform server, rich client, and the web application server that
hosts the SDK must be able to initiate communication with the Central Management Server (CMS)
on both of its ports.
3. Every job server child process must be able to communicate with the CMS.
4. Thick clients must be able to initiate communication with the Request Port of the Input and Output
File Repository Servers
5. If auditing is enabled for thick clients and web applications they must be able to initiate communication
with the Request Port of the Adaptive Processing Servers that hosts the Client Auditing Proxy
Service.
6. In general, the web application server that hosts the SDK must be able to communicate with the
Request Port of every BI platform server.
Note:
The web application server only needs to communicate with BI platform servers that are used in the
deployment. For example, if Crystal Reports is not being used, the web application server does not
need to communicate with the Crystal Reports Cache Servers.
7. Job Servers use the port numbers that are specified with the -requestJSChildPorts <port
range> command. If no range is specified in the command line, the servers use random port
numbers. To allow a job server to communicate with a CMS, FTP, or mail server on another machine
open all of the ports in the range specified by -requestJSChildPorts on your firewall.
8. The CMS must be able to communicate with the CMS database listen port.
9. The Connection Server, most Job Server child process, and every system database and auditing
Processing Server must be able to initiate communication with the reporting database listen port.
166
2011-05-06
Securing BI Platform
Related Topics
• BI platform port requirements
6.14.2.2 BI platform port requirements
This section lists the communication ports used by BI platform servers, thick clients, the web application
server hosting the SDK, and third-party software applications. If you deploy BI platform with firewalls,
you can use this information to open the minimum number of ports in those firewalls.
6.14.2.2.1 Port Requirements for BI platform applications
This table lists the servers and port numbers used by BI platform applications.
Product
Client Application
Associated Servers
Server Port Requirements
CMS Name Server Port (6400 by default)
CMS
CMS Request Port
Input FRS
Input FRS Request Port
Crystal Reports
SAP Crystal
Reports
2011 designer
Output FRS
Output FRS Request Port
Crystal Reports 2011 Report
Application Server (RAS)
Crystal Reports 2011 Processing Server
Crystal Reports 2011 Report Application Server Request Port
Crystal Reports 2011 Processing
Server Request Port
Crystal Reports Cache Server
Crystal Reports Cache Server Request
Port
167
2011-05-06
Securing BI Platform
Product
Client Application
Associated Servers
Server Port Requirements
CMS Name Server Port (6400 by default)
CMS
CMS Request Port
Crystal Reports
SAP Crystal
Reports for
Enterprise
designer
Input FRS
Input FRS Request Port
Output FRS
Output FRS Request Port
Crystal Reports Processing
Server
Crystal Reports Processing Server
Request Port
Crystal Reports Cache Server
Crystal Reports Cache Server Request
Port
CMS
Input FRS
Dashboard
Design
168
SAP BusinessObjects
Dashboard
Design
Live Office
Live Office
Client
BI platform
SAP BusinessObjects
Web Intelligence Desktop
Output FRS
Web Services provider application (dswsbobje.war) that
hosts the Dashboard Design,
Live Office, and QaaWS web
services required for certain
data source connections
Web Services provider application (dswsbobje.war) that
hosts the Live Office web
service
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
Output FRS Request Port
HTTP port (80 by default)
HTTP port (80 by default)
CMS
CMS Name Server Port (6400 by default)
Input FRS
CMS Request Port
Input FRS Request Port
2011-05-06
Securing BI Platform
Product
BI platform
Client Application
Universe design tool
Associated Servers
Server Port Requirements
CMS
CMS Name Server Port (6400 by default)
Input FRS
CMS Request Port
Connection Server
Input FRS Request Port
Connection Server port
BI platform
Business
View Manager
CMS
CMS Name Server Port (6400 by default)
Input FRS
CMS Request Port
Input FRS Request Port
The following ports must be open to
allow CCM to manage remote BI platform servers:
CMS Name Server Port (6400 by default)
CMS Request Port
The following ports must be open to
allow CCM to manage remote SIA
processes:
BI platform
Central Configuration
Manager
(CCM)
CMS
Server Intelligence Agent
(SIA)
Microsoft Directory Services (TCP port
445)
NetBIOS Session Service (TCP port
139)
NetBIOS Datagram Service (UDP port
138)
NetBIOS Name Service (UDP port 137)
DNS (TCP/UDP port 53)
(Note that some ports listed above may
not be required. Consult your Windows
administrator).
169
2011-05-06
Securing BI Platform
Product
BI platform
Client Application
Server Intelligence Agent
(SIA
Associated Servers
SIA Request Port (6410 by default)
Every BI platform server including the CMS
)
BI platform
Report Conversion Tool
Server Port Requirements
CMS Name Server Port (6400 by default)
CMS Request Port
CMS
CMS Name Server Port (6400 by default)
Input FRS
CMS Request Port
Input FRS Request Port
BI platform
Repository
Diagnostic
Tool
CMS
CMS Name Server Port (6400 by default)
Input FRS
CMS Request Port
Output FRS
Input FRS Request Port
Output FRS Request Port
BI platform
170
BI platform
SDK hosted
in the web
application
server
All BI platform servers required by the deployed products.
For example, communication
with the Crystal Reports 2011
Processing Server Request
Port is required if the SDK is
retrieving and interacting with
Crystal reports from the CMS.
CMS Name Server Port (6400 by default)
CMS Request Port
Request Port for each server that is
required. For example, the Crystal Reports 2011 Processing Server Request
Port.
2011-05-06
Securing BI Platform
Product
Client Application
Associated Servers
All BI platform servers required by the products accessing the web services.
BI platform
Web Services
provider
(dswsbob
je.war)
For example, communication
with the Dashboard Design
Cache and Processing Server
Request Ports is required if
SAP BusinessObjects Dashboard Design is accessing
Enterprise data source connections through the Web
Services provider.
BI platform
CMS Name Server Port (6400 by default)
CMS Request Port
Request Port for each server that is
required. For example, the Dashboard
Design Cache Server and Dashboard
Design Processing Server Request
Ports.
CMS Name Server Port (6400 by default)
CMS
SAP BusinessObjects
Analysis,
edition for
OLAP
Server Port Requirements
Adaptive Processing Server
hosting the Multi Dimensional
Analysis Service
CMS Request Port
Adaptive Processing Server Request
Port
Input FRS
Input FRS Request Port
Output FRS
Output FRS Request Port
6.14.2.2.2 Port Requirements for Third-Party Applications
This table lists third-party software used by SAP Business Objects products. It includes specific examples
from some software vendors, but different vendors will have different port requirements.
171
Third-party
application
SAP Business Objects component
that uses the thirdparty product
Third-party application
port requirement
Description
CMS System
Database
Central Management
Server (CMS)
Database server listen
port
The CMS is the only server
that communicates with the
CMS system database.
2011-05-06
Securing BI Platform
Third-party
application
SAP Business Objects component
that uses the thirdparty product
Third-party application
port requirement
Description
CMS Auditing
Database
Central Management
Server (CMS)
Database server listen
port
The CMS is the only server
that communicates with the
CMS auditing database.
Database server listen
port
These servers retrieve information from the reporting
database.
Connection Server
Reporting
Database
Every Job Server
child process
Every Processing
Server
web application
server
All SAP Business Objects web services
and web applications
including BI launch
pad and CMC
FTP server
Every Job Server
HTTP port and HTTPS
port.
For example, on Tomcat
the default HTTP port is
8080 and the default
HTTPS port is 443.
FTP In (port 21)
FTP Out (port 22)
Email server
Unix servers to
which the Job
Servers can
send content
172
Every Job Server
SMTP (port 25)
rexec out (port 512)
Every Job Server
(Unix only) rsh out (port
514)
The HTTPS port is only required if secure HTTP communication is used.
The Job Servers use the FTP
ports to allow send to FTP.
The Job Servers use the
SMTP port to allow send to
email.
(Unix only) The Job Servers
use these ports to allow send
to disk.
2011-05-06
Securing BI Platform
Third-party
application
Authentication
Server
SAP Business Objects component
that uses the thirdparty product
Third-party application
port requirement
CMS
Connection port for thirdparty authentication.
web application server that hosts the SDK
every thick Client, for
example Live Office.
For example, the connection server for the Oracle
LDAP server is defined by
the user in the file
ldap.ora.
Description
User credentials are stored in
the third-party authentication
server. The CMS, SDK, and
the thick clients listed here
need to communicate with the
third-party authentication
server when a user logs on.
6.15 Configuring BI platform for firewalls
This section gives step-by-step instructions for configuring your BI platform system to work in a firewalled
environment.
6.15.1 To configure the system for firewalls
1. Determine which BI platform components must communicate across a firewall.
2. Configure the Request Port for each BI platform server that must communicate across a firewall.
3. Configure a port range for any Job Server children that must communicate across a firewall by
adding the -requestJSChildPorts<lowestport>-<highestport> and -requestPort<port>
parameters to the server's command line.
4. Configure the firewall to allow communication to the Request Ports and job server port range on the
BI platform servers that you configured in the previous step.
5. (Optional) Configure the hosts file on each machine that hosts a BI platform server that must
communicate across a firewall.
Related Topics
• Communication between BI platform components
• Configuring port numbers
• Command lines overview
• Specifying the firewall rules
173
2011-05-06
Securing BI Platform
• Configure the hosts file for firewalls that use NAT
6.15.1.1 Specifying the firewall rules
You must configure the firewall to allow the necessary traffic between BI platform components. Consult
your firewall documentation for details of how to specify these rules.
Specify one inbound access rule for each communication path that crosses the firewall. You might not
need to specify an access rule for every BI platform server behind the firewall.
Use the port number you specify in the server Port box. Remember that each server on a machine
must use a unique port number. Some Business Objects servers use more than one port.
Note:
If BI platform is deployed across firewalls that use NAT, every server on all machines needs a unique
Request Port number. That is, no two servers in the entire deployment can share the same Request
Port.
Note:
You do not need to specify any outbound access rules. BI platform servers do not initiate communication
to the web application server, or to any client applications. BI platform servers can initiate communication
to other platform servers in the same cluster. Deployments with clustered servers in an
outbound-firewalled environment are not supported.
Example:
This example shows the inbound access rules for a firewall between the web application server and
the BI platform servers. In this case you would open two ports for the CMS, one port for the Input File
Repository Server (FRS), and one port for the Output FRS. The Request Port numbers are the port
numbers you specify in the Port box in the CMC configuration page for a server.
174
Source Computer
Port
Destination
Computer
Port
Action
web application
server
Any
CMS
6400
Allow
web application
server
Any
CMS
<Request Port
number>
Allow
web application
server
Any
Input FRS
<Request Port
number>
Allow
2011-05-06
Securing BI Platform
Source Computer
Port
Destination
Computer
Port
Action
web application
server
Any
Output FRS
<Request Port
number>
Allow
Any
Any
CMS
Any
Reject
Any
Any
Other platform
servers
Any
Reject
Related Topics
• Communication between BI platform components
6.15.1.2 Configure the hosts file for firewalls that use NAT
This step is required only if the BI platform servers must communicate across a firewall on which Network
Address Translation (NAT) is enabled. This step allows the client machines to map a server's hostname
to a routable IP address.
Note:
BI platform can be deployed on machines that use Domain Name System (DNS). In this case, the
server machine host names can be mapped to externally routable IP address on the DNS server, instead
of in each machine's hosts file.
Understanding Network Address Translation
A firewall is deployed to protect an internal network from unauthorized access. Firewalls that use “NAT”
will map the IP addresses from the internal network to a different address that is used by the external
network. This “address translation” improves security by hiding the internal IP addresses from the
external network.
BI platform components such as servers, thick clients, and the web application server hosting the SDK
will use a service reference to contact a server. The service reference contains the hostname of the
server's machine. This hostname must be routable from the BI platform component's machine. This
means the hosts file on the component's machine must map the server machine's hostname to the
server machine's external IP address. The server machine's external IP address is routable from external
side of the firewall, whereas the internal IP address is not.
175
2011-05-06
Securing BI Platform
The procedure for configuring the hosts file is different for Windows and UNIX.
6.15.1.2.1 To configure the hosts file on Windows
1. Locate every machine that runs a BI platform component that must communicate across a firewall
on which “Network Address Translation ” (“NAT”) is enabled.
2. On each machine located in the previous step, open the hosts file using a text editor like Notepad.
The hosts file is located at \WINNT\system32\drivers\etc\hosts.
3. Follow the instructions in the hosts file to add an entry for each machine behind the firewall that is
running a BI platform server or servers. Map the server machine's hostname or fully qualified domain
name to its external IP address.
4. Save the hosts file.
6.15.1.2.2 To configure the hosts file on Unix
Note:
Your UNIX operating system must be configured to first consult the “hosts” file to resolve domain names
before consulting DNS. Consult your UNIX systems documentation for details.
1. Locate every machine that runs a BI platform component that must communicate across a firewall
on which “Network Address Translation ” (“NAT”) is enabled.
2. Open the “hosts” file using an editor like vi. The hosts file is located in the following directory \etc
3. Follow the instructions in the hosts file to add an entry for each machine behind the firewall that is
running a BI platform server or servers. Map the server machine's hostname or fully qualified domain
name to its external IP address.
4. Save the hosts file.
6.15.2 Debugging a firewalled deployment
If one or more of your BI platform servers do not work when your firewall is enabled, even though the
expected ports have been opened on the firewall, you can use the event logs to determine which of the
servers is attempting to listen on which ports or IP Addresses. You can then either open those ports
on your firewall, or use the Central Management Console (CMC) to change the port numbers or IP
addresses that these servers attempt to listen on.
Whenever a BI platform server starts, the server writes the following information to the Event Log for
each request port that it attempts to bind to.
•
•
"Server" - The name of the server and whether it successfully started.
"Published Address(es)" - A list of IP Address and port combinations which are posted to the name
service that other servers will use to communicate with this server.
If the server successfully binds to a port, the log file also displays "Listening on port(s)", the IP Address
and port that the server is listening on. If the server is unsuccessful in binding to the port, the log file
176
2011-05-06
Securing BI Platform
displays "Failed to listed on port(s)", the IP Address and port that the server attempts to listen on and
fails.
When a Central Management Server starts, it also writes Published Address(es), Listening on port(s),
and Failed To Listen On information for the server's Name Service Port.
Note:
If the server is configured to use a port that is auto-assigned and to use a host name or IP Address that
is invalid, the event log indicates that the server failed to listen on the host name or IP Address and
port “0”. If a specified host name or IP Address is invalid, the server will fail before the host operating
system is able to assign a port.
Example:
The following example shows the an entry for a Central Management Server that is successfully
listening on two Request Ports and a Name Service Port.
Server mynode.cms1 successfully started.
Request Port :
Published Address(es): mymachine.corp.com:11032, mymachine.corp.com:8765
Listening on port(s): [2001:0db8:85a3:0000:0000:8a2e:0370:7334]:11032, 10.90.172.216:8765
Name Service Port :
Published Address(es): mymachine.corp.com:6400
Listening on port(s): [2001:0db8:85a3:0000:0000:8a2e:0370:7334]:6400, 10.90.172.216:6400
6.15.2.1 To debug a firewalled deployment
1. Read the event log to determine if the server is successfully binding to the port that you have specified.
If the server was unable to successfully bind to a port, there is probably a port conflict between the
server and another process that is running on the same machine. The "Failed to List On" entry
indicates the port that the server is attempting to listen on. Run a utility such as netstat to determine
which process that has taken the port, and then configure either the other process or the server to
listen on another port.
2. If the server was able to successfully bind to a port, "Listening On" indicates which port the server
is listening on. If a server is listening on a port and is still not working properly, either ensure that
that port is open on the firewall or configure the server so that it listens on a port that is open.
Note:
If all of the Central Management Servers in your deployment are attempting to listen to ports or IP
Addresses that are not available, then the CMSs will not start and you will not be able to log on to the
CMC. If you want to change the port number or IP Address that the CMS attempts to listen, you must
use the Central Configuration Manager (CCM) to specify a valid port number or IP Address.
Related Topics
• Configuring port numbers
177
2011-05-06
Securing BI Platform
6.16 Examples of typical firewall scenarios
This section provides examples of typical firewall deployment scenarios.
6.16.1 Example - Application tier deployed on a separate network
This example shows how to configure a firewall and BI platform to work together in a deployment where
the firewall separates the web application server from other BI platform servers.
In this example, BI platform components are deployed across these machines:
•
•
•
Machine boe_1 hosts the web application server and the SDK.
Machine boe_2 hosts the Intelligence tier servers, including the Central Management Server, the
Input File Repository Server, the Output File Repository Server, and the Event server.
Machine boe_3 hosts the Processing tier servers, including the Adaptive Job Server, the Web
Intelligence Processing Server, the Report Application Server, the Crystal Reports Cache Server,
and Crystal Reports Processing Server.
Figure 6-1: Application tier deployed on a separate network
6.16.1.1 To configure an application tier deployed on a separate network
The following steps explain how to configure this example.
1. These communication requirements apply to this example:
178
2011-05-06
Securing BI Platform
•
•
•
The web application server that hosts the SDK must be able to communicate with the CMS on
both of its ports.
The web application server that hosts the SDK must be able to communicate with every BI
platform server.
The browser must have access to the http or the https Request Port on the Web Application
Server.
2. The web application server must communicate with all BI platform servers on machine boe_2 and
boe_3. Configure the port numbers for each server on these machines. Note that you can use any
free port between 1,025 and 65,535.
The port numbers chosen for this example are listed in the table:
Server
Port Number
Central Management Server
6400
Central Management Server
6411
Input File Repository Server
6415
Output File Repository Server
6420
Event server
6425
Adaptive Job Server
6435
Crystal Reports Cache server
6440
Web Intelligence Processing Server
6460
Report Application Server
6465
Crystal Reports Processing Server
6470
3. Configure the firewalls Firewall_1 and Firewall_2 to allow communication to the fixed ports
on the servers and the web application server that you configured in the previous step.
In this example we are opening the HTTP Port for the Tomcat Application server.
Table 6-6: Configuration for Firewall_1
Port
Destination Computer
Port
Action
Any
boe_1
8080
Allow
Configuration for firewall_2
179
2011-05-06
Securing BI Platform
Source Computer
Port
Destination Computer
Port
Action
boe_1
Any
boe_2
6400
Allow
boe_1
Any
boe_2
6411
Allow
boe_1
Any
boe_2
6415
Allow
boe_1
Any
boe_2
6420
Allow
boe_1
Any
boe_2
6425
Allow
boe_1
Any
boe_3
6435
Allow
boe_1
Any
boe_3
6440
Allow
boe_1
Any
boe_3
6460
Allow
boe_1
Any
boe_3
6465
Allow
boe_1
Any
boe_3
6470
Allow
4. This firewall is not NAT-enabled, and so we do not have to configure the hosts file.
Related Topics
• Configuring port numbers
• Understanding communication between BI platform components
6.16.2 Example - Thick client and database tier separated from BI platform servers
by a firewall
This example shows how to configure a firewall and BI platform to work together in a deployment
scenario where:
•
•
One firewall separates a thick client from the BI platform servers.
One firewall separates the BI platform servers from the database tier.
In this example, the BI platform components are deployed across these machines:
•
•
180
Machine boe_1 hosts the Publishing Wizard. Publishing Wizard is a BI platform thick client.
Machine boe_2 hosts the Intelligence tier servers, including the Central Management Server (CMS),
the Input File Repository Server, the Output File Repository Server, and the Event server.
2011-05-06
Securing BI Platform
•
•
Machine boe_3 hosts the Processing tier servers, including: Adaptive Job Server, Web Intelligence
Processing Server, Report Application Server, the Crystal Reports Processing Server, and Crystal
Reports Cache Server.
Machine Databases hosts the CMS system and auditing databases and the reporting database.
Note that you can deploy both databases on the same database server, or you can deploy each
database on its own database server. In this example, all the CMS databases and the reporting
database are deployed on the same database server. The database server listen port is 3306, which
is the default listen port for MySQL server.
Figure 6-2: Rich client and database tier deployed on separate networks
6.16.2.1 To configure tiers separated from BI platform servers by a firewall
The following steps explain how to configure this example.
1. Apply the following communication requirements to this example:
• The Publishing Wizard must be able to initiate communication with the CMS on both of its ports.
• The Publishing Wizard must be able to initiate communication with the Input File Repository
Server and the Output File Repository Server.
• The Connection Server, every Job Server child process, and every Processing Server must have
access to the listen port on the reporting database server.
• The CMS must have access to the database listen port on the CMS database server.
2. Configure a specific port for the CMS, the Input FRS, and the Output FRS. Note that you can use
any free port between 1,025 and 65,535.
The port numbers chosen for this example are listed in the table:
181
Server
Port Number
Central Management Server
6411
Input File Repository Server
6415
2011-05-06
Securing BI Platform
Server
Port Number
Output File Repository Server
6416
3. We do not need to configure a port range for the Job Server children because the firewall between
the job servers and the database servers will be configured to allow any port to initiate communication.
4. Configure Firewall_1 to allow communication to the fixed ports on the platform servers that you
configured in the previous step. Note that port 6400 is the default port number for the CMS Name
Server Port and did not need to be explicitly configured in the previous step.
Port
Destination Computer
Port
Action
Any
boe_2
6400
Allow
Any
boe_2
6411
Allow
Any
boe_2
6415
Allow
Any
boe_2
6416
Allow
Configure Firewall_2 to allow communication to the database server listen port. The CMS (on
boe_2) must have access to the CMS system and auditing database and the Job Servers (on boe_3)
must have access to the system and auditing databases. Note that we did not have configure a port
range for job server child processes because their communication with the CMS did not cross a
firewall.
Source Computer
Port
Destination Computer
Port
Action
boe_2
Any
Databases
3306
Allow
boe_3
Any
Databases
3306
Allow
5. This firewall is not NAT-enabled, and so we do not have to configure the hosts file.
Related Topics
• Understanding communication between BI platform components
• Configuring BI platform for firewalls
6.17 Firewall settings for integrated environments
182
2011-05-06
Securing BI Platform
This section details specific considerations and port settings for BI platform deployments that integrate
with the following ERP environments.
• SAP
• Oracle EBS
• Siebel
• JD Edwards
• PeopleSoft
BI platform components include browser clients, rich clients, servers, and the SDK hosted in the Web
Application server. System components can be installed on multiple machines. It is useful to understand
the basics of communication between BI platform and the ERP components before configuring you
system to work with firewalls
Port requirements for BI platform servers
The following ports are required for their corresponding servers in BI platform:
Server Port Requirements
•
•
•
•
•
•
•
•
Central Management Server Name Server port
Central Management Server Request port
Input FRS Request port
Output FRS Request port
Report Application Server Request port
Crystal Reports Cache Server Request port
Crystal Reports Page Server Request port
Crystal Reports Processing Server Request Port
6.17.1 Specific firewall guidelines for SAP integration
Your BI platform deployment must conform to the following communication rules:
•
•
•
•
•
183
The CMS must be able to initiate communication with SAP system on SAP System Gateway port.
The Crystal Reports Job Server and Crystal Reports Processing Server (along with Data Access
components) must be able to initiate communication with SAP system on the SAP System Gateway
port.
The BW Publisher component must be able to initiate communication with the SAP system on the
SAP System Gateway port.
BI platform components deployed on the SAP Enterprise Portal side (for example, iViews and KMC)
must be able to initiate communication with BI platform web applications on HTTP/HTTPS ports.
The web application server must be able to initiate communication on the SAP System Gateway
service.
2011-05-06
Securing BI Platform
•
Crystal Reports must be able to initiate communication with the SAP host on the SAP System
Gateway port and SAP System Dispatcher port.
The port that the SAP Gateway service is listening on is the same as that specified in the installation.
Note:
If a component requires an SAP router to connect to an SAP system, you can configure the component
using the SAP router string. For example, when configuring an SAP entitlement system to import roles
and users, the SAP router string can be substituted for the application server’s name. This insures that
the CMS will communicate with the SAP system through the SAP router.
Related Topics
• Installing a local SAP Gateway
6.17.1.1 Detailed port requirements
Port requirements for SAP
BI platform uses the SAP Java Connector (SAP JCO) to communicate with SAP NetWeaver (ABAP).
You need to configure and ensure the availability of the following ports:
•
•
SAP Gateway service listening port (for example, 3300).
SAP Dispatcher service listening port (for example, 3200).
The following table summarizes the specific port configurations that you need.
184
2011-05-06
Securing BI Platform
Source computer Port
Destination computer
Port
Action
SAP
Any
BI platform Web
Web Service HTTP/HTTPS port
Application Server
Allow
SAP
Any
CMS
CMS Name Server port
Allow
SAP
Any
CMS
CMS Requested port
Allow
Web Application
Server
Any
SAP
SAP System Gateway Service port Allow
Central Manage- Any
ment Server
(CMS)
SAP
SAP System Gateway Service port Allow
Crystal Reports
SAP
SAP System Gateway Service port Allow
and SAP System Dispatcher port
Any
6.17.2 Firewall configuration for JD Edwards EnterpriseOne integration
Deployments of BI platform that will communicate with JD Edwards software must conform to these
general communication rules:
• Central Management Console Web Applications must be able to initiate communication with JD
Edwards EnterpriseOne through the JDENET port and a randomly selected port.
• Crystal Reports with Data Connectivity client side component must be able to initiate communication
with JD Edwards EnterpriseOne through the JDNET port. For retrieving data, JD Edwards
EnterpriseOne side must be able to communicate with the driver through a random port that cannot
be controlled.
• Central Management Server must be able to initiate communications with JD Edwards EnterpriseOne
through the JDENET port and a randomly selected port.
• The JDENET port number can be found in the JD Edwards EnterpriseOne Application Server
configuration file (JDE.INI) under the JDENET section.
6.17.2.1 Port Requirements for BI platform servers
185
2011-05-06
Securing BI Platform
Product
Server Port Requirements
SAP BusinessObjects Business Intelligence platform
•
BI platform Sign-on Server port
6.17.2.2 Port Requirements for JD Edwards EnterpriseOne
Product
Port Requirement
Description
JD Edwards EnterpriseOne
JDENET port and a randomly
selected port
Used for communication between BI platform and the JD
Edwards EnterpriseOne application server.
6.17.2.3 Configuring the web application server to communicate with JD Edwards
This section shows how to configure a firewall and BI platform to work together in a deployment scenario
where the firewall separates the web application server from other platform servers.
For firewall configuration with BI platform servers and clients, see the BI platform port requirements
section of this guide. In addition to the standard firewall configuration, communication with JD Edwards
servers requires some extra ports to be opened.
Table 6-14: For JD Edwards EnterpriseOne Enterprise
186
Source Computer
Port
Destination Computer
Port
Action
CMS with Security Connectivity feature for JD Edwards EnterpriseOne
Any
JD Edwards EnterpriseOne
Any
Allow
BI platform servers with Data
Connectivity for JD Edwards
EnterpriseOne
Any
JD Edwards EnterpriseOne
Any
Allow
2011-05-06
Securing BI Platform
Source Computer
Port
Destination Computer
Port
Action
Crystal Reports with client side
Data Connectivity for JD Edwards EnterpriseOne
Any
JD Edwards EnterpriseOne
Any
Allow
Web application server
Any
JD Edwards EnterpriseOne
Any
Allow
6.17.3 Specific firewall guidelines for Oracle EBS
Your deployment of BI platform must allow the following components to initiate communication with the
Oracle database listener port.
• BI platform web components
•
•
•
CMS (specifically the Oracle EBS security plugin)
BI platform backend servers (specifically the EBS Data Access component)
Crystal Reports (specifically the EBS Data Access component)
Note:
The default value of the Oracle database listener port in all the above is 1521.
6.17.3.1 Detailed port requirements
In addition to the standard firewall configuration for BI platform, some extra ports need to be opened
to work in an integrated Oracle EBS environment:
187
Source Computer
Port
Destination Computer
Port
Action
Web application server
Any
Oracle EBS
Oracle database
port
Allow
CMS with security connectivity
for Oracle EBS
Any
Oracle EBS
Oracle database
port
Allow
BI platform servers with server-side data connectivity for
Oracle EBS
Any
Oracle EBS
Oracle database
port
Allow
2011-05-06
Securing BI Platform
Source Computer
Port
Destination Computer
Port
Action
Crystal Reports with client-side
data connectivity for Oracle
EBS
Any
Oracle EBS
Oracle database
port
Allow
6.17.4 Firewall configuration for PeopleSoft Enterprise integration
Deployments of BI platform that will communicate with PeopleSoft enterprise must conform to the
following general communication rules:
• The Central Management Server (CMS) with the Security Connectivity component must be able to
initiate communication with the PeopleSoft Query Access (QAS) web service.
• BI platform servers with a Data Connectivity component must be able to initiate communication with
the PeopleSoft QAS web service.
• The Crystal Reports with Data Connectivity client components must be able to initiate communication
with the PeopleSoft QAS web service.
• The Enterprise Management (EPM) Bridge must be able to communicate with the CMS and the
Input File Repository Server.
• the EPM Bridge must be able to communicate with the PeopleSoft database using an ODBC
connection.
The web service port number is the same as the port specified in PeopleSoft Enterprise Domain name.
6.17.4.1 Port Requirements for BI platform servers
Product
Server Port Requirements
SAP BusinessObjects Business Intelligence platform
•
BI platform Sign-on Server port
6.17.4.2 Port Requirements for PeopleSoft
188
2011-05-06
Securing BI Platform
Product
PeopleSoft Enterprise: People
Tools 8.46 or newer
Port Requirement
Description
Web Service HTTP/HTTPS port
This port is required when using
SOAP connection for PeopleSoft
Enterprise for People Tools 8.46
and newer solutions
6.17.4.3 Configuring BI platform and PeopleSoft for firewalls
This section shows how to configure BI platform and PeopleSoft Enterprise to work together in a
deployment scenario where the firewall separates the Web Application server from other BI platform
servers.
For firewall configuration with BI platform servers and clients, refer to the BusinessObjects Business
Intellignece platform Administrator Guide.
Besides the firewall configuration with BI platform, you will need to do some extra configuration.
Table 6-18: For PeopleSoft Enterprise: PeopleTools 8.46 or newer
189
Source Computer
Port
Destination Computer
Port
Action
CMS with Security Connectivity feature for PeopleSoft
Any
PeopleSoft
PeopleSoft web
service HTTP
/HTTPS port
Allow
BI platform servers with Data
Connectivity for PeopleSoft
Any
PeopleSoft
PeopleSoft web
service HTTP
/HTTPS port
Allow
CrystalReports with client side
Data Connectivity for PeopleSoft
Any
PeopleSoft
PeopleSoft web
service HTTP
/HTTPS port
Allow
EPM Bridge
Any
CMS
CMS Name Server
Port
Allow
EPM Bridge
Any
CMS
CMS requested
port
Allow
EPM Bridge
Any
Input File Repository
Server
Input FRS port
Allow
EPM Bridge
Any
PeopleSoft
PeopleSoft
Database Port
Allow
2011-05-06
Securing BI Platform
6.17.5 Firewall configuration for Siebel integration
This section shows which specific ports are used for communication between the BI platform and Siebel
eBusiness Application systems when they are seperated by firewalls.
•
The Web Application must be able to initiate communication with theBI platform Sign-on Server for
Siebel. For enterprise Sign-on Server for Siebel three ports are needed:
1. The Echo (TCP) port 7 for checking access to the Sign-on Server.
2. BI platform Sign-on Server for Siebel port (By default 8448) for CORBA IOR listening port.
3. A random POA port for CORBA communication that cannot be controlled, so all ports need to
open.
•
The CMS must be able to initiate communication with the BI platform Sign-on Server for Siebel.
CORBA IOR listening port configured for each Sign-on Server (for example 8448). You will also
need to open a random POA port number that will not be known until you have installed the BI
platfom.
The BI platform Sign-on Server for Siebel must be able to initiate communication with SCBroker
(Siebel connection broker) port (for example 2321).
The BI platform backend servers (Siebel Data Access component) must be able to initiate
communication with SCBroker (Siebel connection broker) port (for example 2321).
Crystal Reports (Siebel Data Access component) must be able to initiate communication with
SCBroker (Siebel connection broker) port (for example 2321).
•
•
•
Detailed description of ports
This section lists the ports that are used by the BI platform. If you deploy BI platform with firewalls, you
can use this information to open the minimum number of ports in those firewalls specific for integration
with Siebel.
Table 6-19: Port Requirements for BI platform servers
Product
Server Port Requirements
SAP BusinessObjects Business Intelligence platform
•
BI platform Sign-on Server port
Table 6-20: Port Requirement for Siebel
190
Product
Port Requirement
Description
Siebel eBusiness Application
2321
Default SCBroker (Siebel connection broker) port
2011-05-06
Securing BI Platform
Configuring BI platform firewalls for integration with Siebel
This section shows how to configure a firewalls for Siebel and BI platform to work together in a
deployment scenario where the firewall separates the Web Application server from other platform
servers.
Source Computer
Port
Destination Computer
Port
Action
Web Application Server
Any
BI platform Sign-on Server for Siebel
Any
Allow
CMS
Any
BI platform Sign-on Server for Siebel
Any
Allow
BI platform Sign-on Server
for Siebel
Any
Siebel
SCBroker
port
Allow
BI platform servers with
server side Data Connectivity for Siebel
Any
Siebel
SCBroker
port
Allow
CrystalReports with client
side Data Connectivity for
Siebel
Any
Siebel
SCBroker
port
Allow
6.18 BI platform and reverse proxy servers
BI platform can be deployed in an environment with one or more reverse proxy servers. A reverse proxy
server is typically deployed in front of the web application servers in order to hide them behind a single
IP address. This configuration routes all Internet traffic that is addressed to private web application
servers through the reverse proxy server, hiding private IP addresses.
Because the reverse proxy server translates the public URLs to internal URLs, it must be configured
with the URLs of the BI platform web applications that are deployed on the internal network.
6.18.1 Supported reverse proxy servers
BI platform supports the following reverse proxy servers:
• IBM Tivoli Access Manager WebSEAL 6
• Apache 2.2
• Microsoft ISA 2006
191
2011-05-06
Securing BI Platform
6.18.2 Understanding how web applications are deployed
BI platform web applications are deployed on a web application server. The applications are deployed
automatically during installation through the WDeploy tool. The tool can also be used to manually deploy
the applications after BI platform is deployed. The web applications are located in the following directory
on a default Windows installation:
C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise
XI 4.0\warfiles\webapps
WDeploy is used to deploy two specific WAR files:
•
•
BOE: includes the Central Management Console (CMC), BI launch pad, Open Document,
dswsbobje: contains the Web Service application
If the web application server is located behind a reverse proxy server, the reverse proxy server should
be configured with the correct context paths of the WAR files. To expose all of the BI platform functionality,
configure a context path for every BI platform WAR file that is deployed.
6.19 Configuring reverse proxy servers for BI platform web applications
The reverse proxy server must be configured to map incoming URL requests to the correct web
application in deployments where BI platform web applications are deployed behind a reverse proxy
server.
This section contains specific configuration examples for some of the supported reverse proxy servers.
Refer to the vendor documentation for your reverse proxy server for more information.
6.19.1 Detailed instructions for configuring reverse proxy servers
Configure the WAR files
BI platform web applications are deployed as WAR files on a web application server. Ensure you
configure a directive on your reverse proxy server for the WAR file that is required for your deployment.
You can use the WDeploy to deploy either the BOE or dswsbobje WAR files. For more information on
WDeploy see the BI platform Web Application Deployment Guide.
192
2011-05-06
Securing BI Platform
Specify BOE properties in the custom configuration directory
The BOE.war file includes global and application specific properties. If you need to modify any of the
of properties use the custom configuration directory. By default the directory is located at: C:\Program
Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom.
Do not modify the properties in the config\default directory.
Note:
On some web application servers such as the Tomcat version bundled with BI platform you can access
the BOE.war directly. In such a scenario you can set custom settings directly without undeploying the
WAR file. When you cannot access BOE.war, you must undeploy, customize and then redeploy the
file.
Consistent use of the '/' character
Define the context paths in the reverse proxy server in the same way as they are entered in a browser
URL. For example, if the directive contains a '/' at the end of the mirror path on the reverse proxy server,
enter '/' at the end of the browser URL.
Ensure the '/' character is used consistently in the source and destination URL in the directive of the
reverse proxy server. If the '/' character is added at the end of the source URL, it must also be added
to the end of the destination URL.
6.19.2 To configure the reverse proxy server
The steps below are required for BI platform web applications to work behind a supported reverse proxy
server.
1. Ensure the reverse proxy server is set up correctly according to the vendor's instructions and the
deployment's network topology.
2. Determine which BI platform WAR file is required.
3. Configure the reverse proxy server for each BI platform WAR file. Note that the rules are specified
differently on each type of reverse proxy server.
4. Perform any special configuration that is required. Some web applications require special configuration
when deployed on certain web application servers.
6.19.3 To configure Apache 2.2 reverse proxy server for BI platform
This section provides a workflow for configuring BI platform and Apache 2.2 to work together.
1. Ensure that BI platform and Apache 2.2 are installed on separate machines.
193
2011-05-06
Securing BI Platform
2. Ensure that Apache 2.2 is installed and configured as a reverse proxy server as described in the
vendor documentation.
3. Configure the ProxyPass for every WAR file that is deployed behind the reverse proxy server.
4. Configure the ProxyPassReverseCookiePath for every web application that is deployed behind
the reverse proxy server.
6.19.4 To configure WebSEAL 6.0 reverse proxy server for BI platform
This section explains how to configure BI platform and WebSEAL 6.0 to work together.
The recommended configuration method is to create a single standard junction that maps all of the BI
platform web applications hosted on an internal web application server or web server to a single mount
point.
1. Ensure that BI platform and WebSEAL 6.0 are installed on separate machines.
It is possible but not recommended to deploy BI platform and WebSEAL 6.0 on the same machine.
Refer to the WebSEAL 6.0 vendor documentation for instructions on configuring this deployment
scenario.
2. Ensure that WebSEAL 6.0 is installed and configured as described in the vendor documentation.
3. Launch the WebSEAL pdadmin command line utility. Log in to a secure domain such as sec_master
as a user with administration authorization.
4. Enter the following command at the pdadmin sec_master prompt:
server task <instance_name-webseald-host_name>create -t
<type> -h <host_name> -p <port> <junction_point>
Where:
•
<instance_name-webseald-host_name> specifies the full server name of the installed
WebSEAL instance. Use this full server name in the same format as displayed in the output of
the server list command.
•
<type> specifies the type of junction. Use tcp if the junction maps to an internal HTTP port.
Use ssl if the junction maps to an internal HTTPS port.
•
<host_name> specifies the DNS host name or IP address of the internal server that will receive
the requests.
<port> specifies the TCP port of the internal server that will receive the requests.
<junction_point> specifies the directory in the WebSEAL protected object space where the
document space of the internal server is mounted.
•
•
Example:
server task default-webseald-webseal.rp.sap.com
create -t tcp -h 10.50.130.123 -p 8080/hr
194
2011-05-06
Securing BI Platform
6.19.5 To configure Microsoft ISA 2006 for BI platform
This section explains how to configure BI platform and ISA 2006 to work together.
The recommended configuration method is to create a single standard junction that maps all of the BI
platform WAR files hosted on an internal web application server or web server to a single mount point.
Depending on your web application server, there are additional configuration required on the application
server for it to work with ISA 2006.
1. Ensure that BI platform and ISA 2006 are installed on separate machines.
It is possible but not recommended to deploy BI platform and ISA 2006 on the same machine. Refer
to the ISA 2006 documentation for instructions on configuring this deployment scenario.
2. Ensure that ISA 2006 is installed and configured as described in the vendor documentation.
3. Launch the ISA Server Management utility.
4. Use the navigation panel to launch a new publishing rule
a. Go to
Arrays > MachineName > Firewall Policy > New > Web Site Publishing Rule
Remember:
Replace MachineName with the name of the machine on which ISA 2006 is installed.
b.
c.
d.
e.
Type a rule name in Web publishing rule name and click Next
Select Allow as the rule action and click Next.
Select Publish a single Web site or load balancer as the publishing type and click Next.
Select a connection type between the ISA Server and the published Web site and click Next.
For example, select Use non-secured connections to connect the published Web server or
server farm.
f. Type the internal name of the Web site you are publishing (for example, the machine name
hosting BI platform) in Internal site name and click Next.
Note:
If the machine hosting ISA 2006 cannot connect to the target server select Use a computer
name or IP address to connect to the published server and type the name or IP address in
the field provided.
g. In "Public Name Details" select the domain name (for example Any domain name) and specify
any internal publishing details (for example /*). Click Next.
You now need to create a new web listener to monitor for incoming Web requests.
5. Click New to launch the New Web Listener Definition Wizard.
a. Type a name in Web Listener name and click Next.
b. Select a connection type between the ISA Server and the published Web site and click Next.
For example, select Do not require SSL secured connections with clients.
c. In "Web Listener IP Addresses" section select the following and click Next.
195
2011-05-06
Securing BI Platform
• Internal
• External
• Local Host
• All Networks
ISA Server is now configured to publish only over HTTP.
d. Select an "Authentication Setting" option, click Next, and then click Finish.
The new listener is now configured for the web publishing rule.
6. Click Next in "User Sets", then click Finish.
7. Click Apply to save all the settings for the web publishing rule and update the ISA 2006 configuration.
You now have to update the properties of the web publishing rule to map paths for the web
applications.
8. In the navigation panel, right-click the Firewall Policy you configured and select Properties.
9. On the "Paths" tab, click Add to map routes to SAP BusinessObjects web applications.
10. On the "Public Name" tab, select Request for the following websites and click Add.
11. In the "Public Name" dialog box, type your ISA 2006 server name and click OK.
12. Click Apply to save all the settings for the web publishing rule and update the ISA 2006 configuration.
13. Verify the connections by accessing the following URL:
http://<ISA Server host Name>:<web listener port number>/<External path of
the application>
For example: http://myISAserver:80/Product/BOE/CMC
Note:
You may have to refresh the browser several times.
You need to modify the HTTP policy for the rule have just configured to ensure that you will be able to
logon on to the CMC. Right-click the rule you created in the ISA Server Management utility and select
Configure HTTP. You must now deselect Verify Normalization in the "URL Protection" area.
To remotely access BI platform you need to create an access rule.
6.20 Special configuration for BI platform in reverse proxy deployments
Some BI platform products need additional configuration to function correctly in reverse proxy
deployments. This section explains how to perform the additional configuration.
6.20.1 Enabling reverse proxy for web services
196
2011-05-06
Securing BI Platform
This section describes the required procedures to enable reverse proxies for web services.
6.20.1.1 To enable reverse proxy on Tomcat 6
To enable reverse proxy on the Tomcat web application server, you must modify the server.xml file.
Required modifications include setting proxyPort as the reverse proxy server listen port and adding
a new proxyName. This section explains the procedure.
1. Stop Tomcat.
2. Open the server.xml for Tomcat.
On Windows, server.xml is located at: C:\Program Files (x86)\SAP
BusinessObjects\Tomcat6\conf
On UNIX server.xml is located at <CATALINA_HOME>/conf. The default value of <CATALI
NA_HOME> is <INSTALLDIR>/bobje/tomcat55
3. Locate this section in the server.xml file:
<!-- Define a Proxied HTTP/1.1 Connector on port 8082 -->
<!--See proxy documentation for more information about using
this.-->
<!-<Connector port="8082"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false"
acceptCount="100" debug="0" connectionTimeout="20000"
proxyPort="80" disableUploadTimeout="true" />
-->
4. Uncomment the Connector element by removing <!-- and -->.
5. Modify the value of proxyPort to be the reverse proxy server listen port.
6. Add a new proxyName attribute to the Connector’s attribute list. The value of the proxyName must
be the proxy server name which should be resolvable to the correct IP address by Tomcat.
Example:
<!--Define a Proxied HTTP/1.1 Connector on port 8082 -->
<!--See proxy documentation for more information about using
this.-->
<Connector port="8082"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false"
acceptCount="100" debug="0" connectionTimeout="20000"
proxyName="my_reverse_proxy_server.domain.com"
proxyPort="ReverseProxyServerPort"
disableUploadTimeout="true" />
Where my_reverse_proxy_server.domain.com and ReverseProxyServerPort should be
substituted by the correct reverse proxy server name and its listen port.
7. Save and close the server.xml file.
8. Restart Tomcat.
197
2011-05-06
Securing BI Platform
9. Ensure the reverse proxy server maps its virtual path to the correct Tomcat connector port. In the
above example, the port is 8082.
The following example shows a sample configuration for Apache HTTP Server 2.2 to reverse proxy
SAP Business Objects Web Services deployed on Tomcat:
ProxyPass /XI3.0/dswsbobje http://internalServer:8082/dswsbobje
ProxyPassReverseCookiePath /dswsbobje /XI3.0/dswsbobje
To enable web services, the proxy name and port number have to be identified for the connector.
6.20.1.2 Enabling reverse proxy for web services on web application servers
other than Tomcat
The following procedure requires that BI platform web applications are successfully configured against
your chosen web application server. Note that the wsresources are case-sensitive.
1. Stop the web application server.
2. Specify the external URL of the Web Services in the dsws.properties file.
This file is located in dswsbobje web application. For example, if your external is URL is
http://my_reverse_proxy_server.domain.com/dswsbobje/, update the properties in the
dsws.properties file:
• wsresource1=ReportEngine|reportengine web service alone|http://my_re
verse_proxy_server.domain.com/SAP/dswsbobje/services/ReportEngine
• wsresource2=BICatalog|bicatalog web service alone|http://my_re
verse_proxy_server.domain.com/SAP/dswsbobje/services/BICatatog
• wsresource3=Publish|publish web service alone|http://my_re
verse_proxy_server.domain.com/SAP/dswsbobje/services/Publish
• wsresource4=QueryService|query web service alone|http://my_re
verse_proxy_server.domain.com/SAP/dswsbobje/services/QueryService
• wsresource5=BIPlatform|BIPlatform web service|http://my_re
verse_proxy_server.domain.com/SAP/dswsbobje/services/BIPlatform
• wsresource6=LiveOffice|Live Office web service|http://my_re
verse_proxy_server.domain.com/SAP/dswsbobje/services/LiveOffice
3. Save and close the dsws.properties file.
4. Restart the web application server.
5. Ensure the reverse proxy server maps its virtual path to the correct web application server connector
port. The following example shows a sample configuration for Apache HTTP Server 2.2 to reverse
proxy BI platform web services deployed on the web application server of your choice:
ProxyPass /SAP/dswsbobje http://internalServer:<listening port> /dswsbobje
ProxyPassReverseCookiePath /dswsbobje /SAP/dswsbobje
198
2011-05-06
Securing BI Platform
Where <listening port> is the listening port of your web application server.
6.20.2 Enabling the root path for session cookies for ISA 2006
This section describes how to configure specific web application servers to enable the root path for
session cookies to work with ISA 2006 as the reverse proxy server.
6.20.2.1 To configure Apache Tomcat 6
To configure the root path for session cookies to work with ISA 2006 as the reverse proxy server, add
the following to the <Connector> element in server.xml:
emptySessionPath="true"
1. Stop Tomcat
2. Open the server.xml which is located in:
<CATALINA_HOME>\conf
3. Locate the following section in the server.xml file:
<!-- Define a Proxied HTTP/1.1 Connector on port 8082 -->
<!-- See proxy documentation for more information about using this -->
<!-<Connector port="8082"
maxThreads="150" minSpareThreads="25" maxS
pareThreads="75" enableLookups="false"
acceptCount="100" debug="0" connectionTimeout="20000"
proxyPort="80" disableUploadTimeout="true" />
-->
4. Uncomment the Connector element by removing <!-- and -->.
5. To configure the root path for session cookies to work with ISA 2006 as the reverse proxy server,
add the following to the <Connector> element in server.xml:
emptySessionPath="true"
6. Modify the value of proxyPort to be the reverse proxy server listen port.
7. Add a new proxyName attribute to the Connector's attribute list. The value must be the proxy server
name which should be resolvable to the correct IP address by Tomcat.
For example:
<!--Define a Proxied HTTP/1.1 Connector on port 8082
-->
<!-- See proxy documentation for more information about using
this -->
<Connector port="8082"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" emptySessionPath="true"
199
2011-05-06
Securing BI Platform
acceptCount="100" debug="0" connectionTimeout="20000"
proxyName="my_reverse_proxy_server.domain.com"
proxyPort="ReverseProxyServerPort"
disableUploadTimeout="true" />
8. Save and close the server.xml file.
9. Restart Tomcat.
Ensure the reverse proxy server maps its virtual path to the correct Tomcat connector port. In the above
example, the port is 8082.
6.20.2.2 To configure Sun Java 8.2
You need to modify the sun-web.xml for every BI platform web application.
1. Go to <SUN_WEBAPP_DOMAIN>\generated\xml\j2ee-modules\webapps\BOE\WEB-INF
2. Open sun-web.xml
3. After the <context-root> container add the following:
<session-config>
<cookie-properties>
<property name="cookiePath" value="/" />
</cookie-properties>
</session-config>
<property name="reuseSessionID" value="true"/>
4. Save and close sun-web.xml.
5. Repeat steps1-4 for every web application.
6.20.2.3 To configure Oracle Application Server 10gR3
You need to modify the global-web-application.xml or orion-web.xml for every BI platform
web application's deployment directory.
1. Go to <ORACLE_HOME>\j2ee\home\config\
2. Open global-web-application.xml or orion-web.xml.
3. Add the following line to the <orion-web-app> container:
<session-tracking cookie-path="/" />
4. Save and close the configuration file.
5. Log onto the Oracle Admin Console:
a. Go to OC4J:home > Administration > Server Properties.
b. Select Options under "Command Line Options".
200
2011-05-06
Securing BI Platform
c. Click Add another Row and type the following:
Doracle.useSessionIDFromCookie=true
6. Restart the Oracle server.
6.20.2.4 To configure WebSphere Community Edition 2.0
1. Open the WebSphere Community Edition 2.0 Admin Console.
2. In the left navigation panel, find "Server" and select Web Server.
3. Select the connectors and click Edit.
4. Select the emptySessionPath check box and click Save.
5. Type your ISA server name in ProxyName.
6. Type the ISA listener port number in ProxyPort.
7. Stop and then restart the connector.
6.20.3 Enabling reverse proxy for SAP BusinessObjects Live Office
To enable SAP BusinessObjects Live Office’s View Object in Web Browser feature for reverse proxies,
adjust the default viewer URL. This can be done in the Central Management Console (CMC) or through
Live Office options.
Note:
This section assumes reverse proxies for BI launch pad and BI platform web services have been
successfully enabled.
6.20.3.1 To adjust the default viewer URL using the CMC
1. Log on to the CMC.
2. Navigate to the Applications page and click CMC.
3. Select Processing Extensions from the Actions menu.
4. In the URL field, set the correct default viewer URL and click Set URL. For example:
http://ReverseProxyServer:ReverseProxyServerPort/BOE/OpenDocument.jsp?sID
Type=CUID&iDocID=%SI_CUID%
201
2011-05-06
Securing BI Platform
Where ReverseProxyServer and ReverseProxyServerPort are the correct reverse proxy
server name and its listen port.
202
2011-05-06
Authentication
Authentication
7.1 Authentication options in BI platform
Authentication is the process of verifying the identity of a user who attempts to access the system, and
authorization is the process of verifying that the user has been granted sufficient rights to perform the
requested action upon the specified object.
Security plugins expand and customize the ways in which the BI platform authenticates users. Security
plugins facilitate account creation and management by allowing you to map user accounts and groups
from third-party systems into the platform. You can map third-party user accounts or groups to existing
BI platform user accounts or groups, or you can create new Enterprise user accounts or groups that
correspond to each mapped entry in the external system.
The current release supports the following authentication methods:
•
•
•
•
•
•
•
•
Enterprise
LDAP
Windows AD
SAP
Oracle EBS
Siebel
JD Edwards
PeopleSoft
Because BI platform is fully customizable, the authentication and processes may vary from system to
system.
Related Topics
• Enabling JD Edwards EnterpriseOne authentication
• Enabling Oracle EBS authentication
• Enabling PeopleSoft Enterprise authentication
• Enabling Siebel authentication
7.1.1 Primary authentication
203
2011-05-06
Authentication
Primary authentication occurs when a user first attempts to access the system. One of two things can
happen during primary authentication:
•
If single sign-on is not configured, the user provides their credentials, such as their user name,
password and authentication type.
These details are entered by the users on the logon screen.
•
If a method of single sign-on is configured, the credentials for the users are silently propagated.
These details are extracted using other methods such as Kerberos or SiteMinder.
•
The authentication type may be Enterprise, LDAP, Windows AD, SAP, Oracle EBS, Siebel, JD
Edwards EnterpriseOne, PeopleSoft Enterprise depending upon which type(s) you have enabled
and set up in the Authentication management area of the Central Management Console (CMC).
The user's web browser sends the information by HTTP to your web server, which routes the
information to the CMS or the appropriate platform server.
The web application server passes the user's information through a server-side script. Internally, this
script communicates with the SDK and, ultimately, the appropriate security plug-in to authenticate the
user against the user database.
For instance, if the user is logging on to BI launch pad and specifies Enterprise authentication, the SDK
ensures that the BI platform security plug-in performs the authentication. The Central Management
Server (CMS) uses the security plug-in to verify the user name and password against the system
database. Alternatively, if the user specifies an authentication method, the SDK uses the corresponding
security plug-in to authenticate the user.
If the security plug-in reports a successful match of credentials, the CMS grants the user an active
system identity and the following actions are performed:
•
The CMS creates an enterprise session for the user. While the session is active, this session
consumes one user license on the system.
•
The CMS generates and encodes a logon token and sends it to the web application server.
•
The web application server stores the user's information in memory in a session variable. While
active, this session stores information that allows BI platform to respond to the user's requests.
Note:
The session variable does not contain the user's password.
•
The web application server keeps the logon token in a cookie on the client's browser. This is only
used for failover purposes, such as when you have a clustered CMS or when BI launch pad is
clustered for session affinity.
Note:
It is possible to disable the logon token, However, if you disable the logon token, you will disable
failover.
204
2011-05-06
Authentication
7.1.2 Security plug-ins
Security plug-ins expand and customize the ways in which BI platform authenticates users. BI platform
currently ships with the following plugins:
•
•
•
•
•
•
•
•
Enterprise
LDAP
Windows AD
SAP
Oracle EBS
Siebel
JD Edwards
PeopleSoft
Security plug-ins facilitate account creation and management by allowing you to map user accounts
and groups from third-party systems into BI platform. You can map third-party user accounts or groups
to existing BI platform user accounts or groups, or you can create new Enterprise user accounts or
groups that correspond to each mapped entry in the external system.
The security plug-ins dynamically maintain third-party user and group listings. Once you map an external
group into BI platform, all users who belong to that group can successfully log on to BI platform. When
you make subsequent changes to the third-party group membership, you do not need to update or
refresh the listing in BI platform. For instance, if you map an LDAP group to BI platform, and then you
add a new user to the group, the security plug-in dynamically creates an alias for that new user when
he or she first logs on to BI platform with valid LDAP credentials.
Moreover, security plug-ins enable you to assign rights to users and groups in a consistent manner,
because the mapped users and groups are treated as if they were Enterprise accounts. For example,
you might map some user accounts or groups from Windows AD, and some from an LDAP directory
server. Then, when you need to assign rights or create new, custom groups within BI platform, you
make all of your settings in the CMC.
Each security plug-in acts as an authentication provider that verifies user credentials against the
appropriate user database. When users log on to BI platform, they choose from the available
authentication types that you have enabled and set up in the Authorization management area of the
CMC.
Note:
The Windows AD security plugin cannot authenticate users if the BI platform server components are
running on UNIX.
7.1.3 Single sign-on to BI platform
205
2011-05-06
Authentication
Single sign-on to BI platform means that once users have logged on to the operating system, they can
access applications that support SSO without having to provide their credentials again. When a user
logs on, a security context for that user is created. This context can be propagated to BI platform in
order to perform SSO - resulting in the user being logged on as an ser that corresponds to the user.
The term “anonymous single sign-on” also refers to single sign-on to BI platform, but it specifically refers
to the single sign-on functionality for the Guest user account. When the Guest user account is enabled,
which it is by default, anyone can log on to BI platform as Guest and will have access to the system.
7.1.3.1 Single sign-on support
The term single sign-on is used to describe different scenarios. At its most basic level, it refers to a
situation where a user can access two or more applications or systems while providing their log-on
credentials only once, thus making it easier for users to interact with the system.
Single sign-on to BI launch pad can be provided by BI platform, or by different authentication tools
depending on your application server type and operating system.
These methods of single sign-on are available if you are using a Java application server on Windows:
•
Windows AD with Kerberos
•
Windows AD with SiteMinder
These methods of single sign-on are available if you are using IIS on Windows:
•
Windows AD with Kerberos
•
Windows AD with NTLM
•
Windows AD with SiteMinder
These methods of single sign-on support are available on Windows or Unix, with any supported web
application server for the platform.
•
LDAP with SiteMinder
•
Trusted Authentication
•
Windows AD with Kerberos
Note:
Windows AD with Kerberos is supported if the Java application is on UNIX. However, the BI platform
services need to run on a Windows server.
The following table describes the methods of single sign-on support for BI launch pad.
206
2011-05-06
Authentication
Authentication
CMS ServMode
er
Options
Notes
Windows
AD
Windows
only
LDAP
Any supSupported LDAP directory
LDAP authentication to the BI launch pad and
ported platservers, with SiteMinder only CMC is available out of the box. SSO to the
form
InfoView and CMC requires SiteMinder.
Windows AD with Kerberos
only
Enterprise Any supTrusted Authentication
ported platform
•
Single sign-on to BI platform
•
Single sign-on to database
•
End-to-end single sign-on
Windows AD authentication to BI launch pad
and CMC is available out of the box.
Enterprise authentication to the BI launch pad
and CMC is available out of the box. SSO with
enterprise authentication to the InfoView and
CMC requires Trusted Authentication.
7.1.3.2 Single sign-on to database
Once users are logged on to BI platform, single sign-on to the database enables them to perform actions
that require database access, in particular, viewing and refreshing reports, without having to provide
their logon credentials again. Single sign-on to the database can be combined with single sign-on to
BI platform, to provide users with even easier access to the resources they need.
7.1.3.3 End-to-end single sign-on
End-to-end single sign-on refers to a configuration where users have both single sign-on access to BI
platform at the front-end, and single sign-on access to the databases at the back-end. Thus, users need
to provide their logon credentials only once, when they log on to the operating system, to have access
to BI platform and to be able to perform actions that require database access, such as viewing reports.
In BI platform, end-to-end single sign-on is supported through Windows AD and Kerberos.
207
2011-05-06
Authentication
7.2 Enterprise authentication
7.2.1 Enterprise authentication overview
Enterprise authentication is the default authentication method for BI platform; it is automatically enabled
when you first install the system - it cannot be disabled. When you add and manage users and groups,
BI platform maintains the user and group information within its database.
Tip:
Use the system default Enterprise Authentication if you prefer to create distinct accounts and groups
for use with BI platform, or if you have not already set up a hierarchy of users and groups in a third-party
directory server.
You do not have to configure or enable Enterprise authentication. You can however modify Enterprise
authentication settings to meet your organization's particular security requirements. You can only modify
Enterprise setting through the Central Management Console (CMC).
7.2.2 Enterprise authentication settings
Settings
Options
Description
Password Restrictions
Enforce mixed-case password
This option ensures that passwords contain at
least two of the following character classes:
upper case letters, lower case letters, numbers,
or punctuation.
Must contain at least N characBy enforcing a minimum complexity for passters
words, you decrease a malicious user's
chances of simply guessing a valid user's
password.
User Restrictions
Must change password every This option ensures that the passwords do not
N day(s)
become a liability and are regularly refreshed.
208
2011-05-06
Authentication
Settings
Options
Description
Cannot reuse the N most recent passwords(s)
This option ensures that passwords will not
routinely be repeated.
Must wait N minute(s) to
change password
This option ensures that new passwords cannot be immediately changed once entered into
the system.
Logon Restrictions
Disable account after N failed This security option specifies how many atattempts to log on
tempts a user is allowed to log on to the system before their account is disabled.
Reset failed logon count after This option specifies a time interval for resetN minute(s)
ting the logon attempt counter.
Re-enable account after N
minute(s)
This option specifies for how long an account
is suspended after N failed logon attempts.
Synchronize Data
Source Credentials
with Log On
Enable and update user's data This option enables data source credentials
source credentials at logon
after the user has logged on.
time
Trusted Authentication
Provides the settings for setting up Trusted
Authentication.
Related Topics
• Enabling Trusted Authentication
7.2.3 To change Enterprise settings
1. Go to the "Authentication" management area of the CMC.
2. Double-click Enterprise.
The "Enterprise" dialog box appears.
3. Change the settings.
Tip:
To revert all the settings to the default value click Reset.
4. Click Update to save your modifications.
209
2011-05-06
Authentication
7.2.3.1 To change general password settings
1. Go to the "Authentication" management area of the CMC.
2. Double-click Enterprise.
The "Enterprise" dialog box appears.
3. Select the check box for each password setting that you want to use, and provide a value if necessary.
The following table identifies the minimum and maximum values for each of the password-related
settings you can configure.
Table 7-1: Password settings
210
Password setting
Minimum
Recommended Maximum
Enforce mixed-case passwords
N/A
N/A
Must contain at least N
Characters
0 characters
64 characters
Must change password every
N day(s)
1 day
100 days
Cannot reuse the N most recent password(s)
1 password
100 passwords
Must wait N minute(s) to
change password
0 minutes
100 minutes
Disable account after N
failed attempts to log on
1 failed
100 failed
Reset failed logon count after N minute(s)
1 minute
100 minutes
Re-enable account after N
minute(s)
0 minutes
100 minutes
2011-05-06
Authentication
4. Click Update.
7.2.4 Enabling Trusted Authentication
Enterprise Trusted Authentication is used to perform single sign-on by relying on the web application
server to verify the identity of a user. This method of authentication involves establishing trust between
the Central Management Server (CMS) and the web application server hosting the BI platform web
application. When the trust is established, the system defers the verification of the identity of a user to
the web application server. Trusted Authentication can be used to support authentication methods such
as SAML, x.509 and other methods which do not have dedicated authentication plugins.
Users prefer to log on to the system once, without needing to provide passwords several times during
a session. Trusted Authentication provides a Java single sign-on solution for integrating your BI platform
authentication solution with third-party authentication solutions. Applications that have established trust
with the Central Management Server (CMC) can use Trusted Authentication to allow users to log on
without providing their passwords.
To enable Trusted Authentication you must configure a shared secret on the server through the Enterprise
authentication settings, while the client is configured through the properties specified for the BOE war
file.
Note:
•
•
Before you are able to use Trusted Authentication, you must have either created Enterprise users,
or mapped the third-party users that will need to sign on to BI platform.
The single sign-on URL for BI launch pad is: http://server:port/BOE/BI.
Related Topics
• To configure the server to use Trusted Authentication
• To configure Trusted Authentication for the web application
7.2.4.1 To configure the server to use Trusted Authentication
To use Trusted Authentication, you must have either created Enterprise users, or mapped the third-party
users that will need to sign on to BI platform.
1. Log onto the CMC.
2. Go to the Authentication management area.
3. Click the Enterprise option.
The "Enterprise" dialog box opens.
4. Scroll down until you see "Trusted Authentication".
211
2011-05-06
Authentication
a. Click Trusted Authentication is enabled.
b. Click New Shared Secret.
The following message is displayed:
Shared secret key is generated and ready for download
c. Click Download Shared Secret.
Note:
The shared secret is used by the client and the CMS to establish trust. You must also configure
the client after you finish the Trusted Authentication configuration for the server.
The "File Download" dialog opens.
d. Click "Save" and point to following directory to save the TrustedPrincipal.conf file:
<INSTALLDIR>\SAP BusinessObjects Enterprise XI 4.0\win32_x86\
e. To specify the number of days that your shared secret will be valid, enter a value for the "Shared
Secret Validity Period" field.
f. Specify a timeout value for your trusted authentication requests.
Note:
The timeout value is the maximum amount of time, in milliseconds, that the clock on the client
and clock and the CMS can differ. If you enter 0, the amount of time the two clock times can
differ is unlimited. It is not recommended you set this value to 0 as this may increase your
vulnerability to replay attacks.
5. Click Update to commit the shared secret.
Note:
All modifications to Trusted Authentication parameters are not audited by BI platform. It is
recommended that you manually backup all your Trusted Authentication information.
The shared secret is used by the client and the CMS to establish trust. You must also configure the
client after you finish the Trusted Authentication configuration for the server.
7.2.5 Configuring Trusted Authentication for the web application
To configure Trusted Authentication for the client you must access and modify global properties for the
BOE war file, and specific properties the BI launch pad and OpenDocument applications.
You can use one of two methods to pass the shared secret to the client:
•
•
Web session
TrustedPrincipal.conf file
In addition to the shared secret, you need to pick one of the following methods for passing the user
name to the client:
• Web Session
• Cookies
212
2011-05-06
Authentication
•
•
HTTP Header:
URL Query
Whatever method you pick it must be customized in the Trusted.auth.user.retrieval global
properties for the BOE war file.
7.2.5.1 Using Trusted Authentication for SAML single sign-on
Security Assertion Markup Language (SAML) is an XML-based standard for communicating identity
information. SAML provides a secure connection where identity and trust is communicated thereby
enabling a single sign-on mechanism that eliminates additional logins for trusted users seeking to
access BI platform.
Enabling SAML authentication
If your application server can work as a SAML service provider, you can use Trusted Authentication to
provide SAML SSO to BI platform.
To do this, you must first configure the web application server for SAML authentication.
The example below contains a sample web.xml configured for SAML authentication:
<security-constraint>
<web-resource-collection>
<web-resource-name>InfoView</web-resource-name>
<url-pattern>*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>j2ee-admin</role-name>
<role-name>j2ee-guest</role-name>
<role-name>j2ee-special</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>InfoView</realm-name>
<form-login-config>
<form-login-page>/logon.jsp</form-login-page>
<form-error-page>/logon.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role>
<description>Assigned to the SAP J2EE Engine System Administrators</description>
<role-name>j2ee-admin</role-name>
</security-role>
<security-role>
<description>Assigned to all users</description>
<role-name>j2ee-guest</role-name>
</security-role>
<security-role>
<description>Assigned to a special group of users</description>
<role-name>j2ee-special</role-name>
</security-role>
Please refer to your application server documentation for further instructions on how to accomplish this,
as they will vary by application server.
213
2011-05-06
Authentication
Using Trusted Authentication
Once your web application server is configured to work as a SAML service provider, you can use Trusted
Authentication to provide SAML SSO.
Note:
Users must either be imported into BI platform or have Enterprise accounts.
Dynamic aliasing is used to enable the SSO. When a user first accesses the logon page through SAML,
they will be asked to manually log in using their existing BI platform account credentials. Once the user's
credentials are verified, the system will alias the user's SAML identity to their BI platform account.
Subsequent logon attempts for the user will be performed using SSO, as the system will have the user's
identity alias dynamically matched to an existing account.
Note:
A specific property for the BOE war file - trusted.auth.user.namespace.enabled - must be
enabled for this mechanism to work.
7.2.5.2 Trusted Authentication properties for web applications
The following table lists the Trusted Authentication settings included in the default global.properties
file for BOE.war. To overwrite any of the settings, create a new file in C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom.
214
2011-05-06
Authentication
Property
Default value
sso.en
abled=true
sso.enabled=false Enables and disables single sign-on (SSO) to BI platform.
To enable Trusted authentication, this property must be
set to true.
trust
None
ed.auth.shared.se
cret
Description
Session variable name used to retrieve the secret for
Trusted Authentication. Only applies if using the web
session to pass the shared secret.
trust
ed.auth.us
er.param
None
Specifies the variable used to retrieve the username for
Trusted Authentication.
trust
ed.auth.us
er.retrieval
None
Specifies the method used to retrieve the username for
Trusted Authentication. Can be set to one of the following:
•
•
•
•
•
•
"REMOTE_USER"
"HTTP_HEADER"
"COOKIE"
"QUERY_STRING"
"WEB_SESSION"
"USER_PRINCIPAL"
Set to empty to disable Trusted Authentication.
trust
ed.auth.us
er.names
pace.enabled
trusted.auth.us
er.namespace.en
abled=false
Enables and disables dynamic binding of aliases to existing user accounts. If property is set to true, Trusted authentication uses alias binding to authenticate users to BI
platform. With alias binding, your application server can
work as a SAML service provider therefore enabling
Trusted Authentication to provide SAML single sign-on to
the system. If set to false, Trusted Authentication will
use name matching when authenticating users.
7.2.5.3 To configure Trusted Authentication for the web application
If you plan to store the shared secret in the TrustedPrincipal.conf file, make sure the file is stored
in the appropriate platform directory:
215
Platform
Location of TrustedPrincipal.conf
Windows, default installation
<INSTALLDIR>\SAP BusinessObjects
Enterprise XI 4.0\win32_x86\
2011-05-06
Authentication
Platform
Location of TrustedPrincipal.conf
AIX
<INSTALLDIR>/sap_bobj/enterprise_xi40/
aix_rs6000/
Solaris
<INSTALLDIR>/sap_bobj/enterprise_xi40/
solaris_sparc/
HP_UX
<INSTALLDIR>/sap_bobj/enterprise_xi40/
hpux_pa-risc/
Linux
<INSTALLDIR>/sap_bobj/enter
prise_xi40/linux_x86
There are various mechanisms that populate the user name variable used to configure Trusted
Authentication for the client hosting the web applications. Configure or set up your web application
server so that your user names are exposed before you use these user retrieval name methods. See
http://java.sun.com/j2ee/1.4/docs/api/javax/servlet/http/HttpServletRequest.html for further information.
To configure Trusted Authentication for the client you must access and modify properties for the BOE.war
file. The BOE.war file includes general as well as specific properties for the BI launch pad and
OpenDocument web applications.
Note:
There may be additional steps required depending on how you plan to retrieve the user name or shared
secret.
1. Access the custom folder for the BOE.war file on the machine hosting the web applications.
If you are using the Tomcat web application server provided with the BI platform installation, you
can directly access the following folder:
C:\Program Files (x86)\SAP BusinessObjects\Tomcat6\webapps\BOE\WEBINF\config\custom\
Tip:
If you are using a web application server that does not enable direct access to the deployed web
applications, you can use the following folder in your product installation to modify the BOE.war file.
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\.
You will have to later redeploy the modified BOE.war.
2. Create a new file.
Note:
Use Notepad or any other text editing utility.
3. Specify the trusted authentication properties by entering the following:
sso.enabled=true
trusted.auth.user.retrieval=Method for user ID retrieval
216
2011-05-06
Authentication
trusted.auth.user.param=Variable
trusted.auth.shared.secret=WEB_SESSION
Options for user name retrieval are listed in the following table:
Option
How the user name will be retrieved
HTTP_HEADER
The user name is retrieved from the contents
of a specified HTTP header. You must specify
which HTTP header you want to use in the
trusted.auth.user.param property.
QUERY_STRING
The user name is retrieved from the specified
parameter of the request URL. You must specify
which query string to use in the trust
ed.auth.user.param property.
COOKIE
The user name is retrieved from a specified
cookie. You must specify which cookie to use
in the trusted.auth.user.param property.
WEB_SESSION
The user name is retrieved from the contents
of a specified session variable. You must specify the web session variable to use in trust
ed.auth.user.param in the global.prop
erties.
USER_PRINCIPAL
The user name is retrieved from a call to ge
tUserPrincipal().getName()on the
HttpServletRequestobject for the current
request in a servlet or JSP.
Note:
•
•
Some web application servers require that you have the environment variable REMOTE_USER
set to true on your web application server. See the documentation specific to your web application
server for details on whether this is required. If it is required, ensure the environment variable is
set to true if you are using this method of user name retrieval.
If using USER_PRINCIPAL to pass the user name, leave the trusted.auth.user.param
blank.
4. Save the file under the following name:
global.properties
5. Restart your web application server.
217
2011-05-06
Authentication
The new properties take effect only after the modified BOE web application is redeployed on the machine
running the web application server. Use WDeploy to redeploy the WAR file on the web application
server. For more information on using WDeploy, see the SAP BusinessObjects Business Intelligence
Platform Web Application Deployment Guide.
7.2.5.3.1 Sample configurations
To pass the shared secret through the TrustedPrincipal.conf file
The following sample configuration assumes that a user JohnDoe has been created in BI platform.
The user information will be stored and passed through the web session, while the shared secret will
be passed via the TrustedPrincipal.conf file. This file is assumed to be in the following directory:
C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise
XI 4.0\win32_x86 . The bundled version of Tomcat 6 is the web application server.
1. Access the following directory:
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\
2. Create a new file.
Note:
Use Notepad or any other text editing utility.
3. Specify the trusted authentication properties by entering the following:
sso.enabled=truetrue
trusted.auth.user.retrieval=WEB_SESSION
trusted.auth.user.param=MyUser
trusted.auth.shared.secret=
4. Save the file under the following name:
global.properties
5. Access the following file:
C:\Program Files (x86)\SAP BusinessObjects\Tomcat6\webapps\BOE\WEBINF\eclipse\plugins\webpath.InfoView\web\custom.jsp
6. Modify the contents of the file to include the following:
<\!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<%@ page language="java" contentType="text/html;charset=utf-8" %>
<%
//custom Java code
request.getSession().setAttribute("MyUser", "JohnDoe");
%>
<html>
<head>
<title>Custom Entry Point</title>
</head>
<body>
<script type="text/javascript" src="noCacheCustomResources/myScript.js"></script>
<a href="javascript:goToLogonPage()">Click this to go to the logon page of BI launch pad</a>
</body>
</html>
7. Create the myScript.js file in the following directory:
218
2011-05-06
Authentication
C:\Program Files (x86)\SAP BusinessObjects\Tomcat6\webapps\BOE\WEBINF\eclipse\plugins\webpath.InfoView\web\noCacheCustomResources
8. Add the following to myScript.js:
function goToLogonPage() {
window.location = "logon.jsp";
}
9. Shutdown Tomcat.
10. Delete the work folder in the following directory:
C:\Program Files (x86)\ SAP BusinessObjects\Tomcat6
11. Restart Tomcat.
To verify that you have properly configured trusted authentication, use the following URL to access the
BI launch pad application: http://[cmsname]:8080/BOE/BI/custom.jsp where [cmsname] is
the name of the machine hosting the CMS. The following link should be displayed:
Click this to go to the logon page of BI launch pad
To pass the shared secret through the web session variable
The following sample configuration assumes that a user JohnDoe has been created in BI platform.
The user information will be stored and passed via the web session, while the shared secret will be
passed via the web session variable. This file is assumed to be in the following directory: C:\Program
Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\win32_x86. You need to open and note the content of the file. In this sample configuration, it is
assumed the shared secret is the following:
9ecb0778edcff048edae0fcdde1a5db8211293486774a127ec949c1bdb98dae8e0ea388979edc65773
841c8ae5d1f675a6bf5d7c66038b6a3f1345285b55a0a7
The bundled version of Tomcat 6 is the web application server.
1. Access the following directory:
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\
2. Create a new file.
Note:
Use Notepad or any other text editing utility.
3. Specify the trusted authentication properties by entering the following:
sso.enabled=truetrue
trusted.auth.user.retrieval=WEB_SESSION
trusted.auth.user.param=MyUser
trusted.auth.shared.secret=MySecret
4. Save the file under the following name:
global.properties
5. Access the following file:
219
2011-05-06
Authentication
C:\Program Files (x86)\SAP BusinessObjects\Tomcat6\webapps\BOE\WEBINF\eclipse\plugins\webpath.InfoView\web\custom.jsp
6. Modify the contents of the file to include the following:
<\!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<%@ page language="java" contentType="text/html;charset=utf-8" %>
<%
//custom Java code
request.getSession().setAttribute("MySecret","9ecb0778edcff048edae0fcdde1a5db82112934
86774a127ec949c1bdb98dae8e0ea388979edc65773841c8ae5d1f675a6bf5d7c66038b6a3f1345
285b55a0a7"
request.getSession().setAttribute("MyUser", "JohnDoe");
%>
<html>
<head>
<title>Custom Entry Point</title>
</head>
<body>
<script type="text/javascript" src="noCacheCustomResources/myScript.js"></script>
<a href="javascript:goToLogonPage()">Click this to go to the logon page of BI launch pad</a>
</body>
</html>
7. Create the myScript.js file in the following directory:
C:\Program Files (x86)\SAP BusinessObjects\Tomcat6\webapps\BOE\WEBINF\eclipse\plugins\webpath.InfoView\web\noCacheCustomResources
8. Add the following to myScript.js:
function goToLogonPage() {
window.location = "logon.jsp";
}
9. Shutdown Tomcat.
10. Delete the work folder in the following directory:
C:\Program Files (x86)\ SAP BusinessObjects\Tomcat6
11. Restart Tomcat.
To verify that you have properly configured Trusted authentication, use the following URL to access
the BI launch pad application: http://[cmsname]:8080/BOE/BI/custom.jsp where [cmsname]
is the name of the machine hosting the CMS. The following link should be displayed:
Click this to go to the logon page of BI launch pad
To pass the user name through user principal
The following sample configuration assumes that a user JohnDoe has been created in BI platform.
The user information will be stored and passed through the User Principal option, while the shared
secret will be passed via the TrustedPrincipal.conf file. This file is assumed to be in the following
directory: C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects
Enterprise XI 4.0\win32_x86 . The bundled version of Tomcat 6 is the web application server.
1. Stop the Tomcat server.
2. Open the server.xml file for Tomcat.
The file is available by default in the following directory:
220
2011-05-06
Authentication
C:\Program Files (x86)\SAP BusinessObjects\Tomcat6\conf\.
3. Change the value of the Realm className= to the following:
Realm className=“org.apache.catalina.realm.MemoryRealm ”
4. Open the tomcat-users.xml file.
The file is located by default in
C:\Program Files (x86)\SAP BusinessObjects\Tomcat6\conf\.
5. Locate the <tomcat-users> tag and modify the following:
<user name=“JohnDoe” password=“password”
roles=“onjavauser”/>
6. Open the web.xml file in the following directory:
C:\Program Files (x86)\SAP BusinessObjects\Tomcat6\webapps\BOE\WEB-INF\
7. Add the following before the </web-app> tag:
<security-constraint>
<web-resource-collection>
<web-resource-name>OnJavaApplication</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>onjavauser</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>OnJava Application</realm-name>
</login-config>
Note:
You should enter a specific page for the<url-pattern></url-pattern> parameter. Typically
this page would not be the default URL for BI launch pad or any other web application.
8. Delete the work folder in the following directory:
C:\Program Files (x86)\SAP BusinessObjects\Tomcat6
9. Restart Tomcat.
Note:
The configurations on the web application server are the same if using the Remote User method.
To verify that you have properly configured Trusted authentication, use the following URL to access
the BI launch pad application:http://[cmsname]:8080/BOE/BI, where [cmsname] is the name
of the machine hosting the CMS. After a few moments a logon dialog box appears.
7.3 LDAP authentication
221
2011-05-06
Authentication
7.3.1 Using LDAP authentication
This section provides a general description of how LDAP authentication works with BI platform. It then
introduces the administration tools that allow you to manage and configure LDAP accounts to the
platform.
When you install BI platform, the LDAP authentication plug-in is installed automatically, but not enabled
by default. To use LDAP authentication, you need to first ensure that you have your respective LDAP
directory set up. For more information about LDAP, refer to your LDAP documentation.
Lightweight Directory Access Protocol (LDAP), a common, application-independent directory, enables
users to share information among various applications. Based on an open standard, LDAP provides a
means for accessing and updating information in a directory.
LDAP is based on the X.500 standard, which uses a directory access protocol (DAP) to communicate
between a directory client and a directory server. LDAP is an alternative to DAP because it uses fewer
resources and simplifies and omits some X.500 operations and features.
The directory structure within LDAP has entries arranged in a specific schema. Each entry is identified
by its corresponding distinguished name (DN) or common name (CN). Other common attributes include
the organizational unit name (OU), and the organization name (O). For example, a member group may
be located in a directory tree as follows: cn=BI platform Users, ou=Enterprise Users A, o=Research.
Refer to your LDAP documentation for more information.
Because LDAP is application-independent, any client with the proper authorization can access its
directories. LDAP offers you the ability to set up users to log on to BI platform through LDAP
authentication. It also enables users to be authorized when attempting to access objects in the system.
As long as you have an LDAP server (or servers) running, and use LDAP in your existing networked
computer systems, you can use LDAP authentication (along with Enterprise, and Windows AD
authentication).
If desired, the LDAP security plug-in provided with BI platform can communicate with your LDAP server
using an SSL connection established using either server authentication or mutual authentication. With
server authentication, the LDAP server has a security certificate which BI platform uses to verify that it
trusts the server, while the LDAP server allows connections from anonymous clients. With mutual
authentication, both the LDAP server and BI platform have security certificates, and the LDAP server
must also verify the client certificate before a connection can be established.
The LDAP security plug-in provided with BI platform can be configured to communicate with your LDAP
server via SSL, but always performs basic authentication when verifying users' credentials. Before
deploying LDAP authentication in conjunction with BI platform, ensure that you are familiar with the
differences between these LDAP types. For details, see RFC2251, which is currently available at
http://www.faqs.org/rfcs/rfc2251.html.
Related Topics
• Configuring LDAP authentication
• Mapping LDAP groups
222
2011-05-06
Authentication
7.3.1.1 LDAP security plugin
The LDAP security plug-in allows you to map user accounts and groups from your LDAP directory
server to BI platform; it also enables the system to verify all logon requests that specify LDAP
authentication. Users are authenticated against the LDAP directory server, and have their membership
in a mapped LDAP group verified before the CMS grants them an active BI platform session. User lists
and group memberships are dynamically maintained by the system. You can specify that the platform
use a Secure Sockets Layer (SSL) connection to communicate to the LDAP directory server for additional
security.
LDAP authentication for BI platform is similar Windows AD authentication in that you can map groups
and set up authentication, authorization, and alias creation. Also as with NT or AD authentication, you
can create new Enterprise accounts for existing LDAP users, and can assign LDAP aliases to existing
users if the user names match the Enterprise user names. In addition, you can do the following:
•
Map users and groups from the LDAP directory service.
•
Map LDAP against AD. There are a number of restrictions if you configure LDAP against AD.
•
Specify multiple host names and their ports.
•
Configure LDAP with SiteMinder.
Once you have mapped your LDAP users and groups, all of the BI platform client tools support LDAP
authentication. You can also create your own applications that support LDAP authentication.
Related Topics
• Configuring SSL settings for LDAP Server or Mutual Authentication
• Mapping LDAP against Windows AD
• Configuring the LDAP plug-in for SiteMinder
7.3.2 Configuring LDAP authentication
To simplify administration, BI platform supports LDAP authentication for user and group accounts.
Before users can use their LDAP user name and password to log on to the system, you need to map
their LDAP account to BI platform. When you map an LDAP account, you can choose to create a new
account or link to an existing BI platform account.
Before setting up and enabling LDAP authentication, ensure that you have your LDAP directory set up.
For more information, refer to your LDAP documentation.
Configuring LDAP authentication includes the following tasks:
223
2011-05-06
Authentication
•
Configuring the LDAP host
•
Preparing the LDAP server for SSL (if required)
•
Configuring the LDAP plug-in for SiteMinder (if required)
Note:
If you configure LDAP against AD, you will be able to map your users but you will not be able to configure
AD single sign-on or single sign-on to the database. However, LDAP single sign-on methods like
SiteMinder and trusted authentication will still be available.
7.3.2.1 To configure the LDAP host
It is recommended that your LDAP server be installed and running before configuring the LDAP host.
1. Go to the Authentication management area of the CMC, and then double-click LDAP.
Note:
To get to the Authentication management area, choose Authentication from the navigation list.
2. Enter the name and port number of your LDAP hosts in the Add LDAP host (hostname:port) field
(for example, "myserver:123"), click Add, and then click OK.
Tip:
Repeat this step to add more than one LDAP host of the same server type if you want to add hosts
that can act as failover servers. If you want to remove a host, highlight the host name and click
Delete.
3. Select your server type from the LDAP Server Type list.
Note:
If you are Mapping LDAP to AD, select Microsoft Active Directory Application Server for your server
type.
4. If you want to view or change any of the LDAP Server Attribute Mappings or the LDAP Default
Search Attributes, click Show Attribute Mappings.
By default, each supported server type's server attribute mappings and search attributes are already
set.
5. Click Next.
6. In the Base LDAP Distinguished Name field, type the distinguished name (for example,
o=SomeBase) for your LDAP server, and then click Next.
7. In the LDAP Server Credentials area, specify the distinguished name and password for a user
account that has read access to the directory.
Note:
Administrator credentials are not required.
224
2011-05-06
Authentication
Note:
If your LDAP Server allows anonymous binding, leave this area blank; BI platform servers and clients
will bind to the primary host via anonymous logon.
8. If you have configured referrals on your LDAP host, enter the authentication information in the LDAP
Referral Credentials area, and then enter the number of referral hops in the Maximum Referral
Hops field.
Note:
The "LDAP Referral Credentials" area must be configured if all of the following apply:
•
The primary host has been configured to refer to another directory server that handles queries
for entries under a specified base.
•
The host being referred to has been configured to not allow anonymous binding.
•
A group from the host being referred to will be mapped to BI platform.
Note:
•
•
Although groups can be mapped from multiple hosts, only one set of referral credentials can be
set. Therefore if you have multiple referral hosts, you must create a user account on each host
that uses the same distinguished name and password.
If "Maximum Referral Hops" is set to zero, no referrals will be followed.
9. Click Next.
10. Choose the type of Secure Sockets Layer (SSL) authentication used, and then click Next.
These are your choices:
•
Basic (no SSL)
•
Server Authentication
•
Mutual Authentication
11. Choose a method of LDAP single sign-on authentication, and then click Next.
These are your choices:
•
Basic (No SSO)
•
SiteMinder
12. Select how aliases and users are mapped to BI platform accounts.
a. In "New Alias Options", select how new aliases are mapped to Enterprise accounts. Select one
of the following choices:
• Assign each added LDAP alias to an account with the same name
Use this option when you know users have an existing Enterprise account with the same
name; that is, LDAP aliases will be assigned to existing users (auto alias creation is turned
on). Users who do not have an existing Enterprise account, or who do not have the same
name in their Enterprise and LDAP account, are added as new users.
•
225
Create a new account for every added LDAP alias
2011-05-06
Authentication
Use this option when you want to create a new account for each user.
b. In "Alias Update Options", select how to manage alias updates for the Enterprise accounts. Select
one of the following choices:
• Create new aliases when the Alias Update occurs
Use this option to automatically create a new alias for every LDAP user mapped to BI platform.
New LDAP accounts are added for users without BI platform accounts, or for all users if you
selected the Create a new account for every added LDAP alias option.
•
Create new aliases only when the user logs on
Use this option when the LDAP directory you are mapping contains many users, but only a
few of them will use BI platform. The system does not automatically create aliases and
Enterprise accounts for all users. Instead, it creates aliases (and accounts, if required) only
for users who log on to the platform.
c. In "New User Options" specify how new users are created.
If your SAP BusinessObjects Business Intelligence platform license is based on users roles,
select one of the following "New User Options":
• BI Viewer
New user accounts are configured under the BI Viewer role. Access to BI platform applications
for all accounts under the BI Viewer role is defined in the license agreement. Users are
restricted to access application workflows that are defined for the BI Viewer role. Access rights
are generally limited to viewing business intelligence documents. This role is typically suitable
for users who consume content through BI platform applications.
•
BI Analyst New user accounts are configured under the BI Analyst role. Access to BI platform
applications for all accounts under the BI Analyst role is defined in the license agreement.
Users can access all applications workflows that are defined for the BI Analyst role. Access
rights include viewing and modifying business intelligence documents. This role is typically
suitable for users who create and modify content for BI platform applications.
If your SAP BusinessObjects Business Intelligence platform license is not based on users roles,
select one of the following options:
•
New users are created as named users.
New user accounts are configured to use named user licenses. Named user licenses are
associated with specific users and allow people to access the system based on their user
name and password. This provides named users with access to the system regardless of how
many other people are connected. You must have a named user license available for each
user account created using this option.
•
New users are created as concurrent users.
New user accounts are configured to use concurrent user licenses. Concurrent licenses specify
the number of people who can connect to SAP BusinessObjects Business Intelligence platform
at the same time. This type of licensing is very flexible because a small concurrent license
can support a large user base. For example, depending on how often and how long users
access the platform, a 100 user concurrent license could support 250, 500, or 700 users.
226
2011-05-06
Authentication
13. In the "Attribute Binding Options" area you can specify the attribute binding priority for the LDAP
plugin:
a. Click the Import Full Name and Email Address box.
The full names and descriptions used in the LDAP accounts are imported and stored with the
user objects in the system.
b. Specify an option for Set priority of LDAP attribute binding relative to other attributes binding.
Note:
If option is set to "1", LDAP attributes take priority in scenarios where LDAP and other plugins
(Windows AD and SAP) are enabled. If set to "3", attributes from other enabled plugins will take
priority.
14. Click Finish.
Related Topics
• Configuring SSL settings for LDAP Server or Mutual Authentication
• Configuring the LDAP plug-in for SiteMinder
• Role-based licensing
7.3.2.2 Managing multiple LDAP hosts
When using LDAP and BI platform, you can add fault tolerance to your system by adding multiple LDAP
hosts. The system uses the first host that you add as the primary LDAP host. Subsequent hosts are
treated as failover hosts.
The primary LDAP host and all failover hosts must be configured in exactly the same way, and each
LDAP host must refer to all additional hosts from which you want to map groups. For more information
about LDAP hosts and referrals, see your LDAP documentation.
To add multiple LDAP Hosts, enter all hosts when you configure LDAP using the LDAP configuration
wizard (see for details.) Or if you have already configured LDAP, go to the Authentication management
area of the Central Management Console and click the LDAP tab. In the LDAP Server Configuration
Summary area, click the name of the LDAP host to open the page that enables you to add or delete
hosts.
Note:
•
•
Make sure that you add the primary host first, followed by the remaining failover hosts.
If you use failover LDAP hosts, you cannot use the highest level of SSL security (that is, you cannot
select "Accept server certificate if it comes from a trusted Certificate Authority and the CN attribute
of the certificate matches the DNS hostname of the server.")
Related Topics
• Configuring LDAP authentication
227
2011-05-06
Authentication
7.3.2.3 Configuring SSL settings for LDAP Server or Mutual Authentication
This section describes the CMC related information for configuring SSL with LDAP Server and Mutual
Authentication. It assumes that you have configured the LDAP host and that you selected either of
these for your SSL authentication choice:
•
Server Authentication
•
Mutual Authentication
For additional information or for information on configuring the LDAP host server, refer to your LDAP
vendor documentation.
Related Topics
• To configure the LDAP host
228
2011-05-06
Authentication
7.3.2.3.1 To configure LDAP Server or Mutual Authentication
Resource
Pre-requisite actions
CA certificate
You need a certificate authority to generate a CA certificate. This certificate must
then be added to your LDAP server. For more information refer to your LDAP
vendor documentation. This action is required for both server and mutual authentication with SSL.
Server certificate
You need to request and then generate a server certificate. You need to authorize
the certificate before adding it to the LDAP server. This action is required for both
server and mutual authentication with SSL.
cert7.db key3.db
You need to access the certutil application that can generate a cert7.db file. You
can download the application from the following URL: ftp://ftp.mozilla.org/pub/mozil
la.org/security/nss/releases/NSS_3_6_RTM/ . Copy the CA certificate to the same
directory as certutil. Generate the cert7.dbkey3.db and secmod.db files using
the following command:
certutil -N -d .
Add the CA certificate to the cert7.db file using the following command:
certutil -A -n <CA_alias_name> -t CT -d . -I cacert.cer
Store the three files in a known directory on the machine hosting SAP BusinessObjects Business Intelligence platform. The files are required for both server
and mutual authentication with SSL.
cacerts
This file is only required for server or mutual authentication with SSL for Java
applications like BI launch pad. Access the keytool file in your Java bin directory.
Use the following command to create the cacerts file:
keytool -import -v -alias <CA_alias_name> -file <CA_certificate_name> -trustcacerts
-keystore
Store the cacerts file in the same directory as the cert7.db and key3.db files.
Client certificate
229
2011-05-06
Authentication
Resource
Pre-requisite actions
You need to create separate client requests for the cert7.db and the .keystore
files. To configure the LDAP plugin you need to generate a client certificate request
using certutil. To generate the client certificate request use the command:
certutil -R -s "<client_dn>" -a -o <certificate_request_name> -d .
Note:
A <client_dn> include information such as "CN=<client_name>, OU=org
unit, O=Companyname, L=city, ST=province, C=country This certificate
request then needs to be authenticated using the Certificate Authority. To retrieve
the certificate and insert it in the cert7.db file use the following command:
certutil -A -n <client_name> -t Pu -d . -I <client_certificate_name>
To facilitate Java authentication with SSL, you must generate a client certificate
request using the keytool utility from the Java bin directory. Generate a key pair
using the following command:
keytool -genkey -keystore .keystore
After specifying information about your client, use the following command to
generate a client certificate request:
keytool -certreq -file <certificate_request_name> -keystore .keystore
After the client certificate request is authenticated by the Certificate Authority, the
CA certificate needs to be inserted into the .keystore file using the following
command:
keytool -import -v -alias <CA_alias_name> -file <ca_certificate_name> -trustcacerts
-keystore .keystore
Finally retrieve the client certificate request from the CA and insert it into the
.keystore file using the following command:
keytool -import -v -file <client_certificate_name> -trustcacerts -keystore .keystore
Store the .keystore file in the same directory as cert7.db and cacerts on
the machine hosting BI platform.
1. Choose what level of SSL security you want to use from the available options:
Note:
Java applications will ignore the first and last setting and will accept the server certificate only if it
comes from a trusted Certificate Authority.
•
Always accept server certificate
This is the lowest security option. Before BI platform can establish an SSL connection with the
LDAP host (to authenticate LDAP users and groups), it must receive a security certificate from
the LDAP host. BI platform does not verify the certificate it receives.
•
Accept server certificate if it comes from a trusted Certificate Authority
This is a medium security option. Before BI platform can establish an SSL connection with the
LDAP host (to authenticate LDAP users and groups), it must receive and verify a security certificate
230
2011-05-06
Authentication
sent to it by the LDAP host. To verify the certificate, the system must find the Certificate Authority
that issued the certificate in its certificate database.
•
Accept server certificate if it comes from a trusted Certificate Authority and the CN attribute
of the certificate matches the DNS hostname of the server
This is the highest security option. Before BI platform can establish an SSL connection with the
LDAP host (to authenticate LDAP users and groups), it must receive and verify a security certificate
sent to it by the LDAP host. To verify the certificate,BI platform must find the Certificate Authority
that issued the certificate in its certificate database. It must also be able to confirm that the CN
attribute on the server certificate exactly matches the host name of the LDAP host as you typed
it in the "Add LDAP host" field in the first step of the wizard. That is, if you entered the LDAP host
name as ABALONE.rd.crystald.net:389, using CN =ABALONE:389 in the certificate would not
work.
The host name on the server security certificate is the name of the primary LDAP host. Therefore
if you select this option you cannot use a failover LDAP host.
2. In the SSL host box, type the host name of each machine, and then click Add.
Note:
You must next add the host name of each machine in your BI platform deployment that uses the
SAP BusinessObjects Business Intelligence platform SDK. (This includes the machine running your
Central Management Server and the machine running your web application server.)
3. Specify the SSL settings for each SSL host that has been added to the list, and specify the default
settings that will be used for each host that is not on the list.
Note:
The default settings will be used for any setting (for any host) where you leave the "Use default
value" box checked or for any machine whose name you do not explicitly add to the list of SSL hosts.
To specify the default settings:
a. Select default from the SSL list.
b. Clear the Use default value boxes.
c. Type your values for the "Path to the certificate and key database files" and the "Password for
the key database".
d. If you're specifying settings for Mutual authentication, you can also enter a value in the "Nickname
for the client certificate in the cert7.db" field.
To select settings for another host, select its name in the list on the left. Then type the appropriate
values in the boxes on the right.
4. Click Next.
5. Choose a method of LDAP single sign-on authentication from these choices:
• Basic (No SSO)
•
SiteMinder
6. Choose how new LDAP users and aliases are created.
7. Click Finish.
231
2011-05-06
Authentication
Related Topics
• Configuring the LDAP plug-in for SiteMinder
7.3.2.4 To modify your LDAP configuration settings
After you have configured LDAP authentication using the LDAP configuration wizard, you can change
LDAP connection parameters and member groups using the LDAP Server Configuration Summary
Page.
1. Go to the Authentication management area of the CMC.
2. Double-click LDAP.
If LDAP authorization is configured, the LDAP Server Configuration Summary page appears. On
this page you can change any of the connection parameter areas or fields. You can also modify the
Mapped LDAP Member Groups area.
3. Delete currently mapped groups that will no longer be accessible under the new connection settings,
then click Update.
4. Change your connection settings, then click Update.
5. Change your Alias and New User options, then click Update.
6. Map your new LDAP member groups, then click Update.
7.3.2.5 Configuring the LDAP plug-in for SiteMinder
This section explains how to configure the CMC to use LDAP with SiteMinder. SiteMinder is a third-party
user access and authentication tool that you can use with the LDAP security plug-in to create single
sign-on to BI platform.
To use SiteMinder and LDAP with BI platform, you need to make configuration changes in two places:
•
The LDAP plugin through the CMC
•
The BOE.war file properties
Note:
Ensure that the SiteMinder Administrator has enabled support for 4.x Agents. This must be done
regardless of what supported version of SiteMinder you are using. For more information about SiteMinder
and how to install it, refer to the SiteMinder documentation.
Related Topics
• To configure the LDAP host
232
2011-05-06
Authentication
7.3.2.5.1 To configure LDAP for single sign-on with SiteMinder
1. Open the Please configure your SiteMinder settings screen using one of the following methods:
•
•
Select SiteMinder on the "Please choose a method of LDAP single sign-on authentication" screen
in the LDAP configuration wizard.
Select the "Single Sign On Type" link on the LDAP authentication screen which is available if
you have already configured LDAP and are now adding SSO.
2. In the Policy Server Host box, type the name of each policy server, and then click Add.
3. For each Policy Server Host, specify the Accounting, Authentication and Authorization port
numbers.
4. Enter the name of the Agent Name and the Shared Secret. Enter the shared secret again.
5. Click Next.
6. Proceed with configuring the LDAP options.
7.3.2.5.2 To enable LDAP and SiteMinder in the BOE.war file
In addition to specifying SiteMinder settings for the LDAP security plugin, SiteMinder settings must be
specified for the BOE.war properties.
1. Go to the following directory in your BI platform installation:
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\.
2. Create a new file.
Note:
Use Notepad or any other text editing utility.
3. Close the file and save it under the following name:
BIlaunchpad.properties
4. Enter the following statement:
siteminder.authentication=secLDAP
siteminder.enabled=true
5. Close the file and save it under the following name:
global.properties
Note:
Make sure the file name is not saved under any extensions such as .txt.
6. Create another file in the same directory.
7. Enter the following statement:
authentication.default=LDAP
cms.default=[enter your cms name]:[Enter the CMS port number]
For example:
authentication.default=LDAP
cms.default=mycms:6400
233
2011-05-06
Authentication
8. Close the file and save it under the following name:
bilaunchpad.properties
The new properties take effect only after the modified BOE web application is redeployed on the machine
running the web application server. Use WDeploy to redeploy the WAR file on the web application
server. For more information on using WDeploy, see the SAP BusinessObjects Business Intelligence
Platform Web Application Deployment Guide.
7.3.3 Mapping LDAP groups
Once you have configured the LDAP host using the LDAP configuration wizard, you can map LDAP
groups to Enterprise groups.
Once you have mapped LDAP groups, you can view the groups by clicking the LDAP option in the
Authentication management area. If LDAP authorization is configured, the Mapped LDAP Member
Groups area displays the LDAP groups that have been mapped to BI platform.
You can also map Windows AD groups to authenticate in BI platform via the LDAP security plugin.
Note:
If you have configured LDAP against AD, this procedure will map your AD groups.
Related Topics
• Mapping LDAP against Windows AD
7.3.3.1 To map LDAP groups using BI platform
1. Go to the Authentication management area of the CMC.
2. Double-click LDAP.
If LDAP authorization is configured, the LDAP summary page appears.
3. In the "Mapped LDAP Member Groups" area, specify your LDAP group (either by common name
or distinguished name) in the Add LDAP group (by cn or dn) field; click Add.
You can add more than one LDAP group by repeating this step. To remove a group, highlight the
LDAP group and click Delete.
4. New Alias Options allow you to specify how LDAP aliases are mapped to Enterprise accounts. Select
either:
• Assign each added LDAP alias to an account with the same name
234
2011-05-06
Authentication
Use this option when you know users have an existing Enterprise account with the same name;
that is, LDAP aliases will be assigned to existing users (auto alias creation is turned on). Users
who do not have an existing Enterprise account, or who do not have the same name in their
Enterprise and LDAP account, are added as new LDAP users.
or
•
Create a new account for every added LDAP alias
Use this option when you want to create a new account for each user.
5. Update Options allow you to specify if LDAP aliases are automatically created for all new users.
Select either:
• New aliases will be added and new users will be created
Use this option to automatically create a new alias for every LDAP user mapped to BI platform.
New LDAP accounts are added for users without BI platform accounts, or for all users if you
selected the "Create a new account for every added LDAP alias" option and clicked Update.
or
•
No new aliases will be added and new users will not be created
Use this option when the LDAP directory you are mapping contains many users, but only a few
of them will use BI platform. The system does not automatically create aliases and Enterprise
accounts for all users. Instead, it creates aliases (and accounts, if required) only for users who
log on to BI platform.
6. New User Options allow you to specify properties of the new Enterprise accounts that are created
to map to LDAP accounts.
If your SAP BusinessObjects Business Intelligence platform license is based on users roles, select
one of the following "New User Options":
• BI Viewer
New user accounts are configured under the BI Viewer role. Access to BI platform applications
for all accounts under the BI Viewer role is defined in the license agreement. Users are restricted
to access application workflows that are defined for the BI Viewer role. Access rights are generally
limited to viewing business intelligence documents. This role is typically suitable for users who
consume content through BI platform applications.
•
BI Analyst
New user accounts are configured under the BI Analyst role. Access to BI platform applications
for all accounts under the BI Analyst role is defined in the license agreement. Users can access
all application workflows that are defined for the BI Analyst role. Access rights include viewing
and modifying business intelligence documents. This role is typically suitable for users who create
and modify content for BI platform applications.
If your SAP BusinessObjects Business Intelligence platform license is not based on users roles,
select one of the following options:
•
235
New users are created as named users.
2011-05-06
Authentication
New user accounts are configured to use named user licenses. Named user licenses are
associated with specific users and allow people to access the system based on their user name
and password. This provides named users with access to the system regardless of how many
other people are connected. You must have a named user license available for each user account
created using this option.
•
New users are created as concurrent users.
New user accounts are configured to use concurrent user licenses. Concurrent licenses specify
the number of people who can connect to BI platform at the same time. This type of licensing is
very flexible because a small concurrent license can support a large user base. For example,
depending on how often and how long users access the system, a 100 user concurrent license
could support 250, 500, or 700 users.
7. Click Update.
Related Topics
• Role-based licensing
7.3.3.2 To unmap LDAP groups using BI platform
1. Go to the Authentication management area of the CMC.
2. Double-click LDAP.
If LDAP authorization is configured, the LDAP summary page will appear.
3. In the "Mapped LDAP Member Groups" area, select the LDAP group you would like to remove.
4. Click Delete, and then click Update.
The users in this group will not be able to access BI platform.
Note:
The only exceptions to this occur when a user has an alias to an Enterprise account. To restrict
access, disable or delete the user's Enterprise account.
To deny LDAP Authentication for all groups, clear the "LDAP Authentication is enabled" check box and
click Update.
7.3.3.3 Mapping LDAP against Windows AD
If you configure LDAP against Windows AD (AD), note the following restrictions:
236
2011-05-06
Authentication
•
If you configure LDAP against AD, you will be able to map your users but you will not be able to
configure AD single sign-on or single sign-on to the database. However, LDAP single sign-on methods
like SiteMinder and trusted authentication will still be available.
•
Users who are only members of default groups from AD will not be able to log in successfully. Users
must also be a member of another explicitly created group in AD and, in addition, this group must
be mapped. An example of such a group is the "domain users" group.
•
If a mapped domain local group contains a user from a different domain in the forest, the user from
a different domain in the forest will not be able to log in successfully.
•
Users from a universal group from a domain different than the DC specified as the LDAP host will
not be able to log in successfully.
•
You cannot use the LDAP plug-in to map users and groups from AD forests outside the forest where
BI platform is installed.
You cannot map in the Domain Users group in AD.
You cannot map a machine local group.
If you are using the Global Catalog Domain Controller, there are additional considerations when
mapping LDAP against AD:
•
•
•
Situation
Considerations
You can map in:
• universal groups on a child domain,
Multiple domains when pointing to the
Global Catalog Domain Controller
•
groups on the same domain that contains universal
groups from a child domain, and
•
universal groups on a cross domain.
You cannot map in:
• global groups on a child domain,
• local groups on a child domain,
• groups on the same domain that contain a global group
from the child domain, and
• cross-domain global groups.
Generally, if the group is a universal group, it will support
users from cross or child domains. Other groups will not
be mapped if they contain users from cross or child domains. Within the domain you are pointing to, you can
map domain local, global, and universal groups.
Mapping in universal groups
237
To map in universal groups, you must point to the Global
Catalog Domain Controller. You should also use port
number 3268 instead of the default 389.
2011-05-06
Authentication
•
If you are using multiple domains but not pointing to the Global Catalog Domain Controller, then you
cannot map in any type of groups from cross or child domains. You can map in all types of groups
only from the specific domain you are pointing to.
7.3.3.4 Troubleshooting LDAP accounts
•
If you create a new LDAP user account, and the account does not belong to a group account that
is mapped to BI platform, either map the group, or add the new LDAP user account to a group that
is already mapped to the system.
•
If you create a new LDAP user account, and the account belongs to a group account that is mapped
to BI platform, refresh the user list.
Related Topics
• Configuring LDAP authentication
• Mapping LDAP groups
7.4 Windows AD authentication
7.4.1 Overview
7.4.1.1 Using Windows AD authentication
This section provides a general description of how Windows Active Directory (AD) authentication works
with BI platform. It then introduces the administration workflows required to enable and manage AD
accounts in BI platform. At the end of the section, there are some basic troubleshooting tips.
Support requirements
To facilitate AD authentication on BI platform, you should remember the following support requirements.
•
238
The CMS must always be installed on a supported Windows platform.
2011-05-06
Authentication
•
Although Windows 2003 and 2008 are supported platforms for both Kerberos and NTLM
authentication, certain BI platform applications may only use particular authentication methods. For
example, applications such as BI launch pad and Central Management Console only support
Kerberos.
Basic AD authentication workflow
To use AD authentication with BI platform you must follow the following basic workflow:
1.
2.
3.
4.
Configure the required domain controller resources.
Prepare the BI platform host for Windows AD authentication.
Enable the AD security plug-in and map in AD groups.
Choose an authentication method:
• Windows AD with Kerberos
• Windows AD with NTLM
5. Set up single sign-on to BI platform applications. This optional step can be facilitated via the following
methods:
• Windows AD with Vintela (Kerberos)
• Windows AD with SiteMinder (Kerberos)
7.4.1.1.1 Windows AD security plug-in
The Windows AD security plug-in enables you to map user accounts and groups from your Microsoft
Active Directory (AD) 2003, and 2008 user database to BI platform. It also enables the system to verify
all logon requests that specify AD Authentication. Users are authenticated against the AD user database,
and have their membership in a mapped AD group verified before the Central Management Server
(CMS) grants them an active BI platform session.
The Windows AD security plug-in enables you to configure the following:
•
Windows AD authentication with NTLM
•
Windows AD authentication with Kerberos
•
Windows AD authentication with SiteMinder for single sign-on
The Windows AD security plug-in is compatible with both Microsoft Active Directory 2003, and 2008
domains running in either native mode or mixed mode.
Once you have mapped your AD users and groups, they will be able to access BI platform client tools
using AD authentication.
239
•
Windows AD authentication only works if the CMS is run on Windows. For single sign-on to database
to work, the reporting servers must also run on Windows. Otherwise all other servers and services
can run on all supported platforms.
•
The Windows AD plug-in for BI platform supports domains within multiple forests.
2011-05-06
Authentication
7.4.1.1.2 Using Windows AD users and groups
BI platform supports Active Directory (AD) authentication with the Windows security plug-in, which is
included by default when the product is installed on a Windows platform. Support for Windows AD
authentication means that users and groups accounts in Microsoft Active Directory (2003 and 2008)
can be used to authenticate with BI platform. System administrator can therefore map existing AD
accounts, instead of setting up each user and group within BI platform.
Scheduling updates for Windows AD groups
BI platform enables administrators to schedule updates for Windows AD groups and user aliases. This
feature is available for AD authentication with either Kerberos or NTLM. The CMC also enables you to
view the time and date when the last update was performed.
Note:
For AD authentication to work on BI platform, you must configure how updates are scheduled for your
AD groups and aliases.
When scheduling an update, you can choose from the recurrence patterns summarized in the following
table:
240
Recurrence pattern
Description
Hourly
The update will run every hour. You specify at what time it will
start, as well as a start and end date.
Daily
The update will run every day or run every number of specified
days. You can specify at what time it will run, as well as a start
and end date.
Weekly
The update will run every week. It can be run once a week or
several times a week. You can specify on which days and at what
time it will run, as well as a start and end date.
Monthly
The update will run every month or every several months. You
can specify what time it will run, as well as a start and end date.
Nth Day of Month
The update will run on a specific day in the month. You can
specify on which day of the month, what time it will run, as well
as a start and end date.
1st Monday of Month
The update will run on the first Monday of each month. You can
specify what time it will run, as well as a start and end date.
Last Day of Month
The update will run on the last day of each month. You can
specify what time it will run, as well as a start and end date.
X Day of Nth Week of the Month
The update will run on a specified day of a specified week of the
month. You can specify what time it will run, as well as a start
and end date.
2011-05-06
Authentication
Recurrence pattern
Description
Calendar
The update will be run on the dates specified in a calendar that
has previously been created.
Scheduling AD group updates
BI platform relies on Active Directory (AD) for user and group information. To minimize the volume of
queries sent to AD, the AD plugin caches information about groups and how they relate to each other
and their user membership. The update does not run when no specific schedule is defined.
You must use the CMC to configure the recurrence of the group update refresh. This should be scheduled
to reflect how frequently your will group membership information is modified.
Scheduling AD user alias updates
User objects can be aliased to a Windows Active Directory (AD) account, allowing users to use their
AD credentials to log on to BI platform. Updates to AD accounts are propagated to BI platform by the
AD plug-in. Accounts created, deleted, or disabled in AD will be correspondingly created, deleted, or
disabled in BI platform.
If you do not schedule AD alias updates, updates will only occur when:
• A user logs on: the AD alias will be updated.
• An administrator selects the Update AD and Aliases now option from the "On-demand AD Update"
area of the CMC.
Note:
No AD passwords are stored in the user alias.
7.4.1.1.3 Single sign-on with Windows AD
The Windows AD security plug-in supports single sign-on, thereby allowing authenticated AD users to
log on to BI platform without explicitly entering their credentials. The single sign-on requirements depend
upon the way in which users access the platform: either via a thick client, or over the Web. In both
scenarios, the security plug-in obtains the security context for the user from the authentication provider,
and grants the user an active BI platform session if the user is a member of a mapped AD group.
The most common usage scenario involves single sign-on to the BI launch pad web application.
Single sign-on to database
The Windows AD plug-in supports single sign-on to database. If set properly authenticated AD users
do not have to provide their account credentials when accessing reports from the BI launch pad
application.
Related Topics
• Using Windows AD with SiteMinder
• Configuring Windows AD authentication (Kerberos) with Vintela single sign-on
241
2011-05-06
Authentication
7.4.2 Preparing for AD authentication (Kerberos)
7.4.2.1 Using Windows AD authentication with Kerberos
This section describes the prequisite tasks required for setting up the Kerberos authentication for BI
platform. Once all the prerequisite tasks have been implemented, you can proceed to configure Windows
AD authentication options for Kerberos in the Windows AD security plug-in.
Recommended workflow
To properly set up WIndows AD authentication the following prerequisite tasks need to be implemented:
•
•
•
Setting up a service account for running BI platform
Preparing the BI platform servers for Windows AD authentication with Kerberos
Configuring your web application server for Windows AD authentication with Kerberos.
7.4.2.1.1 Setting up a service account for AD authentication with Kerberos
To configure BI platform for Kerberos and Windows AD authentication, you require a service account.
You can either create a new domain account or use an existing domain account. The service account
will be used to run the BI platform servers.
Note:
After you set up the service account, you will need to grant the account appropriate rights.
If you are using a Windows 2003 or 2008 Domain, you also have the option of setting up constrained
delegation.
To set up the service account on a Windows 2003 or 2008 Domain
You need to set up a new service account on the domain controller to successfully enable Windows
AD authentication with Kerberos. This service account will be used specifically for allow users in a given
Windows AD group to sign-on to BI launch pad. This task is performed on the AD domain controller
machine.
1. Create a new account with a password on the domain controller or use an existing account.
For detailed instructions, refer to http://msdn.microsoft.com/
2. Run the keytabktpass command to create and place a Kerberos keytab file.
You will need to specify the ktpass parameters listed in the following table:
242
2011-05-06
Authentication
Parame
ter
Description
-out
Specifies the name of the Kerberos keytab file to generate.
-mapus
er
Specifies the name of the user account to which the SPN mapped. This is account
under which the server intelligence agent runs.
-pass
Specifies the password used by the service account.
-kvno
Specifies the key version number used to create the key.
Specifies the principal type. Should be specified as:
-ptype
-ptype KRB5_NT_PRINCIPAL
Specifies which encryption type to use with the service account. Use the following:
-crypto
-crypto RC4-HMAC-NT
For example,
ktpass -out -mapuser sbo.serviceDOMAIN.COM -pass password
-kvno 255 -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT
The output from the ktpass command should confirm the target domain controller, and that a
Kerberos keytab file containing the shared secret has been created. The command also maps the
principal name to the (local) service account.
3. Run the setspn -l command to verify that the ktpass command was successfully executed.
The display output lists all the service principal names registered to the local service account.
4. Right-click the service account you created in Step 1, select Properties > Delegation.
5. Click Trust this user for delegation to any service (Kerberos only).
6. Click OK to save your settings.
Once created, the service account needs to be granted rights and added to the servers's Local
Administrators group.
Granting the service account rights
To support Windows AD and Kerberos, you must grant the service account the right to act as part of
the operating system. This must be done on each machine running a Server Intelligence Agent (SIA)
with the Central Management Server (CMS).
If you require single sign-on to the database, the SIA must include the following servers:
243
•
Crystal Reports Processing Server
•
Report Application Server
•
Web Intelligence Processing Server
2011-05-06
Authentication
Note:
For single sign-on to the database to work, the service account must be trusted for delegation.
To grant the service account rights
1. Click Start > Control Panel > Administrative Tools > Local Security Policy.
2. Expand Local Policies, then click User Rights Assignment.
3. Double-click Act as part of the operating system.
4. Click Add.
5. Enter the name of the service account you created, then click OK.
6. Ensure that the Local Policy Setting check box is selected, and click OK.
7. Repeat the above steps on each machine running a BI platform server.
Note:
It is important that the Effective Right ends up being checked after Act as part of the operating
system is selected. Typically, you will need to restart the server for this to occur. If, after restarting
the server, this option is still not on, your Local Policy settings are being overridden by your Domain
Policy settings.
Adding the service account to the servers’ Local Administrators group
In order to support Kerberos, the service account must be part of the local Administrators group for
each server that has a SIA with one of the following services deployed:
•
CMS
•
Crystal Reports Processing Server (required only for SSO2DB)
•
Report Application Server (required only for SSO2DB)
•
Web Intelligence Processing Server (required only for SSO2DB)
Note:
If you're using SSO2DB, you require a service account that has been trusted for delegation. You must
also have administrative rights on the server.
To add an account to the Administrator's group
1. On the desired machine, right-click My Computer and click Manage.
2. Go to System Tools > Local Users and Groups > Groups.
3. Right-click Administrators, then click Add to Group.
4. Click Add and type the logon name of the service account.
5. Click Check Names to ensure that the account resolves.
6. Click OK, then click OK again.
7. Repeat these steps for each BI platform server that has to be configured.
244
2011-05-06
Authentication
7.4.2.1.2 Preparing the servers for Windows AD authentication with Kerberos
After the service account has been created and configured for Windows AD authentication with Kerberos,
you can run each SIA in your BI platform deployment under the account.
To configure the SIA under the service account
You need to perform the following steps for any Server Intelligence Agent (SIA) that is running services
used by the service account created for Windows AD authentication with Kerberos.
1. Go toPrograms > SAP BusinessObjects Enterprise XI 4.0 > SAPBusinessObjects Enterprise
> Central Configuration Manager .
2. In the CCM, right-click the Server Intelligence Agent (SIA) and select Stop.
Note:
When you stop the SIA, all services managed by the SIA are stopped.
3. Right-click the SIA and select Properties.
4. Clear the System Account check box.
5. Enter the service account credentials(DOMAINNAME\service name) and click OK.
6. Restart the SIA.
7. If necessary, repeat steps 1 through 5 for each SIA that is running a service that has to be configured.
7.4.2.1.3 Preparing the application server for Windows AD authentication (Kerberos)
This section contains the tasks related to configuring Kerberos for use with these the following application
servers:
•
•
•
•
•
Tomcat
WebSphere
WebLogic
Oracle Application Server
SAP NetWeaver 7.10
This section contains this information:
•
•
•
The workflow specific to a particular web application server. This workflow is necessary because
the implementation of Java Authentication and Authorization Service (JAAS) varies between different
application servers .
The procedural details for each step in the workflow.
Sample Krb5.ini file for Java application servers.
Overview
The specific process of configuring Kerberos for a web application server varies slightly depending the
specific application server. However, the general process of configuring Kerberos involves these steps:
•
•
245
Creating the Kerberos configuration file.
Creating the JAAS login configuration file.
2011-05-06
Authentication
Note:
This step is not required for the SAP NetWeaver 7.10 Java application server. However you will
need to add LoginModule to your SAP NetWeaver server.
•
•
Modifying the Java Options.
Restarting your Java application server.
To create a Kerberos configuration file for SAP NetWeaver, Tomcat, WebLogic, SAP NetWeaver
or Oracle
Follow these steps to create the Kerberos configuration file if you’re using SAP Netweaver 7.10, Tomcat
6, Oracle Application Server or WebLogic.
1. Create the file krb5.ini, if it does not exist, and store it under C:\WINNT for Windows.
Note:
•
If the application server is installed on UNIX, you should use the following directories:
Solaris: /etc/krb5/krb5.conf
Linux: /etc/krb5.conf
•
You can store this file in a different location, however if you do, you will need to specify its location
in your java options. For more information on krb5.ini go to
http://docs.sun.com/app/docs/doc/816-0219/6m6njqb94?a=view.
2. Add the following required information in the Kerberos configuration file:
[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_kdc = true
dns_lookup_realm = true
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
[domain_realm]
.domain.com = DOMAIN.COM
domain.com = DOMAIN.COM
.domain2.com = DOMAIN2.COM
domain2.com = DOMAIN2.COM
[realms]
DOMAIN.COM = {
default_domain = DOMAIN.COM
kdc = HOSTNAME.DOMAIN.COM
}
DOMAIN2.COM = {
default_domain = DOMAIN2.COM
kdc = HOSTNAME.DOMAIN2.COM
}
[capaths]
DOMAIN2.COM = {
DOMAIN.COM =
}
Note:
DOMAIN.COM is the DNS name of your domain which must be entered in uppercase in FQDN format.
kdc is the Host name of the Domain Controller. You can add multiple domain entries to the [realms]
section if your users log in from multiple domains. [capath] defines the trust between domains
that are in another AD forest. In the example above DOMAIN2.COM is a domain in an external forest
and has direct two way transitive trust to DOMAIN.COM. In a multiple domain configuration, under
[libdefaults] the default_realm value may be any of the source domains. The best practice
246
2011-05-06
Authentication
is to use the domain with the greatest number of users that will be authenticating with their AD
accounts. If no UPN suffix is supplied at log on, it defaults to the value of default_realm. This
value should be consistent with the default domain setting in the CMC.
Related Topics
• To modify the Java options for Kerberos on Tomcat
To create a Kerberos configuration file for WebSphere
1. Create the file krb5.ini, if it does not exist, and store it under C:\WINNT for Windows.
Note:
You can store this file in a different location, however if you do, you will need to specify its location
in your java options.
2. Add the following required information in the Kerberos configuration file:
[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_kdc = true
dns_lookup_realm = true
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
[domain_realm]
.domain.com = DOMAIN.COM
domain.com = DOMAIN.COM
.domain2.com = DOMAIN2.COM
domain2.com = DOMAIN2.COM
[realms]
DOMAIN.COM = {
default_domain = DOMAIN.COM
kdc = HOSTNAME.DOMAIN.COM
}
DOMAIN2.COM = {
default_domain = DOMAIN2.COM
kdc = HOSTNAME.DOMAIN2.COM
}
[capaths]
DOMAIN2.COM = {
DOMAIN.COM =
}
Note:
•
•
•
If you are using DES encryption, change rc4-hmac to des-cbc-crc.
DOMAIN.COM is the DNS name of your domain which must be entered in uppercase in FQDN
format.
hostname is the Host name of the Domain Controller.
3. Save and close the file.
Related Topics
• To modify the Java options for Kerberos on WebSphere
247
2011-05-06
Authentication
Sample multiple domain Krb5.ini file
The following is a sample file with multiple domains:
[domain_realm]
; trust relationship: childtest4<->sboptest3<->sboptest<->sboptest2
[libdefaults]
default_realm = SBOPTEST.COM
[realms]
SBOPTEST.COM = {
kdc = VANPGVMBOBJ01.sboptest.com
}
SBOPTEST2.COM = {
kdc = VANPGVMBOBJ05.sboptest2.com
}
SBOPTEST3.COM = {
kdc = VANPGVMBOBJ07.sboptest3.com
}
CHILDTEST4.SBOPTEST3.COM = {
kdc = vanpgvmbobj08.childtest4.sboptest3.com
}
[capaths]
; for clients in sboptest3 to login sboptest2
SBOPTEST3.COM = {
SBOPTEST2.COM = SBOPTEST.COM
}
; for clients in childtest4 to login sboptest2
CHILDTEST4.SBOPTEST3.COM = {
SBOPTEST2.COM = SBOPTEST.COM
SBOPTEST2.COM = SBOPTEST3.COM
}
To create a Tomcat or WebLogic JAAS login configuration file
1. Create a file called bscLogin.conf if it does not exist, and store it in the default location: C:\WINNT.
Note:
You can store this file in a different location. However, if you do, you will need to specify its location
in your java options.
2. Add the following code to your JAAS bscLogin.conf configuration file:
com.businessobjects.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required;
};
3. Save and close the file.
To create a Oracle JAAS login configuration file
1. Locate the jazn-data.xml file.
Note:
This default location for this file is C:\OraHome_1\j2ee\home\config. If you installed Oracle
Application Server in a different location, find the file specific to your installation.
2. Add the following content to the file between the <jazn-loginconfig> tags:
<application>
<name>com.businessobjects.security.jgss.initiate</name>
<login-modules>
<login-module>
<class>com.sun.security.auth.module.Krb5LoginModule</class>
248
2011-05-06
Authentication
<control-flag>required</control-flag>
</login-module>
</login-modules>
</application>
3. Save and close the jazn-data.xml file.
To create a WebSphere JAAS login configuration file
1. Create a file called bscLogin.conf if it does not exist, and store it in the default location: C:\WINNT
2. Add the following code to your JAAS bscLogin.conf configuration file:
com.businessobjects.security.jgss.initiate {
com.ibm.security.auth.module.Krb5LoginModule required;
};
3. Save and close the file.
To add a LoginModule to SAP NetWeaver
To use Kerberos and SAP NetWeaver 7.10, configure the system as if you were using the Tomcat web
application server. You will not need to create a bscLogin.conf file.
Once this has been done, you need to add a LoginModule and update some Java settings on SAP
NetWeaver 7.10.
To map the com.sun.security.auth.module.Krb5LoginModule to the
com.businessobjects.security.jgss.initiate, you need to manually add a LoginModule to NetWeaver.
1. Open the NetWeaver Administrator by typing the following address into a web browser:
http://<machine name>:<port>/nwa.
2. Click Configuration Management > Security > Authentication > Login Modules > Edit.
3. Add a new login module with the following information:
Display Name
Krb5LoginModule
Class Name
com.sun.security.auth.module.Krb5LoginModule
4. Click Save.
NetWeaver creates the new module.
5. Click Components > Edit.
6. Add a new Policy called com.businessobjects.security.jgss.initiate.
7. In the Authentication Stack, add the login module we created in Step 3, and set it to Required.
8. Confirm that there are no other entries in the "Options for Selected Login Module". If there are,
remove them.
9. Click Save.
10. Log out of the NetWeaver Administrator.
249
2011-05-06
Authentication
To modify the Java options for Kerberos on Tomcat
1. From the Start menu, select Programs >Tomcat > Tomcat Configuration.
2. Click the Java tab.
3. Add the following options:
-Djava.security.auth.login.config=C:\XXXX\bscLogin.conf
-Djava.security.krb5.conf=C:\XXXX\krb5.ini
Replace XXXX with the location where you stored the file.
4. Close the Tomcat configuration file.
5. Restart Tomcat.
To modify the Java options for SAP NetWeaver 7.10
1. Browse to the Java configuration tool (located at C:\usr\sap\<NetWeaver ID>\<in
stance>\j2ee\configtool\ by default) and double-click configtool.bat.
The configuration tool opens.
2. Click View > Expert Mode.
3. Expand Cluster-Data > Template.
4. Select the Instance that corresponds to your NetWeaver server (for example Instance - <system
ID><machine name>).
5. Click VM Parameters.
6. Select SAP from the Vendor list, and GLOBAL from the Platform list.
7. Click System.
8. Add the following custom parameter information:
java.security.krb5.conf
<path to the krb5.ini file including the
file name>
javax.security.auth.useSubjectCredsOn- false
ly
9. Click Save.
10. Click Configuration Editor.
11. Click Configurations > Security > Configurations > com.businessobjects.security.jgss.initiate
> Security > Authentication.
12. Click Edit Mode.
13. Right-click the Authentication node and select Create sub-node.
14. Select Value-Entry from the top list.
15. Enter the following:
250
2011-05-06
Authentication
Name
create_security_session
Value
false
16. Click Create.
17. Close the window.
18. Click Config Tool.
19. Click Save.
Once you have updated your configuration, you need to restart your NetWeaver server.
To modify the Java options for Kerberos on WebLogic
If you are using Kerberos with WebLogic, your Java options need to be modified to specify the location
of the Kerberos configuration file and the Kerberos login module.
1. Stop the domain of WebLogic that runs your BI platform applications.
2. Open the script that starts the domain of WebLogic that runs your BI platform applications
(startWeblogic.cmd for Windows, startWebLogic.sh for UNIX).
3. Add the following information to the Java_Options section of the file:
set JAVA_OPTIONS=-Djava.security.auth.login.config=C:/XXXX/bscLogin.conf -Djava.securi
ty.krb5.conf=C:/XXX/krb5.ini
Replace XXXX with the location you stored the file.
4. Restart the domain of WebLogic that runs your BI platform applications.
To modify the Java options for Kerberos on Oracle Application Server
If you are using Kerberos with Oracle Application Server, the Java options need to be modified to specify
the location of the Kerberos configuration file.
1.
2.
3.
4.
5.
Log on to the administration console of your Oracle Application Server.
Click the name of the OC4J instance that runs your BI platform applications.
Select Server Properties.
Scroll down to the Multiple VM Configuration section.
In the Command Line Options section, append the following at the end of the Java Options text field:
-Djava.security.krb5.conf=C:/XXXX/krb5.ini replacing XXXX with the location where
you stored the file.
6. Restart your OC4J instance.
To modify the Java options for Kerberos on WebSphere
1. Log into the administrative console for WebSphere.
For IBM WebSphere 5.1, type http://servername:9090/admin. For IBM WebSphere 6.0, type
http://servername:9060/ibm/console
251
2011-05-06
Authentication
2. Expand Server, click Application Servers, and then click the name of the application server you
created to use with BI platform.
3. Go to the JVM page.
If you are using WebSphere 5.1, follow these steps to get to the JVM page.
a. On the server page, scroll down until you see Process Definition in the Additional Properties
column.
b. Click Process Definition.
c. Scroll down and click Java Virtual Machine.
If you are using WebSphere 6.0, follow these steps to get to the JVM page.
a. On the server page, select Java and Process Management.
b. Select Process Definition.
c. Select Java Virtual Machine.
4. Click Generic JVM arguments then type the location of your Krb5.ini and the location of your
bscLogin.conf file.
-Djava.security.auth.login.config=C:\XXXX\bscLogin.conf
-Djava.security.krb5.conf=C:\XXXX\krb5.ini
Replace XXXX with the location you stored the file.
5. Click Apply, and then click Save.
6. Stop and restart the server.
7.4.3 AD authentication single sign-on
7.4.3.1 Options for Windows AD authentication single sign-on
There are two supported methods for setting up single sign-on for Windows AD authentication with BI
platform:
• Vintela single sign on - this option can only be used with Kerberos.
• Single sign on with SiteMinder - this option can only be used with Kerberos.
Note:
The most common single sign on scenario involves access to the BI launch pad application which can
only be deployed on a java application server. Single sign-on for BI launch pad is only available via
Kerberos.
252
2011-05-06
Authentication
7.4.3.2 Preparing for Windows AD authentication single sign-on
7.4.3.2.1 Configuring Windows AD authentication (Kerberos) with Vintela single sign-on
The following section details the reqiured tasks for setting up BI platform to work with Windows AD
authentication and Vintela single sign-on.
Note:
The prerequisite setup tasks for Windows AD authentication, together with the specific Vintela single
sign-on task should be completed before configuring the Windows AD authentication options in the
CMC.
Related Topics
• Setting up a service account for AD authentication with Kerberos
• Preparing the servers for Windows AD authentication with Kerberos
• Preparing the application server for Windows AD authentication (Kerberos)
7.4.3.2.2 Workflow for configuring Kerberos and single sign-on for Java BI launch pad
To set up BI platform to work with Windows AD authentication and Vintela single sign-on you need to
complete the following tasks:
1. Create and configure a service account to be used for Vintela single sign-on.
2. Setup your BI platform deployment to run under the service account.
3. Configure the BOE general and BI launch pad-specific properties for Vintela single sign on.
4. Increase the header size limit of the Java application server.
5. Configure the Internet Browsers for Vintela single sign-on.
6. Configure constrained delegation for Vintela single sign-on (optional).
Once all these tasks have been completed you can configure the Windows AD authentication options
in the CMC.
7.4.3.2.3 To set up the service account for Vintela single sign-on
You need to set up a new service account on the domain controller to successfully enable Vintela single
sign-on for Windows AD authentication. This service account will be used specifically for allow users
in a given Windows AD group to sign-on to BI launch pad. This task is performed on the AD domain
controller machine. Steps 1-5 below are required for using Windows AD with Kerberos, while steps 6-7
are specific for setting up Vintela single sign-on.
1. Create a new service account with a password on the primary domain controller.
2. Run the kerberos keytab setup command ktpass to create and place a keytab file.
253
2011-05-06
Authentication
You will need to specify the ktpass parameters listed in the following table:
Parame
ter
Description
-out
Specifies the name of the Kerberos keytab file to generate.
Specifies principal name used for the service account. This parameter should be
specified in SPN format.
-princ
Note:
The name of your service account is case-sensitive. An SPN always includes the
name of the host computer on which the service instance is running.
Tip:
The SPN must be unique in the forest in which it is registered. One way to check is
to use Windows support tool Ldp.exe to search for the SPN.
-mapus
er
Specifies the name of the user account to which the -princ (above) is mapped. This
is account under which the server intelligence agent runs.
-pass
Specifies the password used by the service account.
-kvno
Specifies the key version number used to create the key.
Specifies the principal type. Should be specified as:
-ptype
-ptype KRB5_NT_PRINCIPAL
Specifies which encryption type to use with the service account. Use the following:
-crypto
-crypto RC4-HMAC-NT
For example,
ktpass -out keytab_filename.keytab -princ
MYSIAMYSERVER/sbo.service.DOMAIN.COM
-mapuser sbo.serviceDOMAIN.COM -pass password
-kvno 255 -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT
The output from the ktpass command should confirm the target domain controller, and that a
Kerberos keytab file containing the shared secret has been created. The command also maps the
principal name to the (local) service account.
3. Run the setspn -l command to verify that the ktpass command was successfully executed.
The display output lists all the service principal names registered to the local service account.
4. Right-click the service account you created in Step 1, select Properties > Delegation.
5. Click Trust this user for delegation to any service (Kerberos only).
6. Use the setspn -a command to add the HTTP service principal names to the service account you
created in Step 1. Specify service principal names for the server, fully qualified domain server and
IP address for the machine on which BI launchpad is deployed.
254
2011-05-06
Authentication
For example,
setspn -a HTTP/servername servicename
setspn -a HTTP/servernamedomain servicename
setspn -a HTTP/<ip address of server> servicename
Where servername is the name of the server on which BI launch pad is deployed andservername
domain is the fully qualified domain name of the latter.
7. Run setspn -l servicename to verify that the HTTP service principal names were added to the
service account.
The output for the command should include all the registered service principal names as shown in
the example below:
Registered ServicePrincipalNames for
CN=bo.service,OU=boe,OU=BIP,OU=PG,DC=DOMAIN,DC=com:
HTTP/<ip address of server>
HTTP/servername.DOMAIN.com
HTTP/servername
servername/servicenameDOMAIN.com
The service account has had all the required service principal names added, and the required keytab
file has been created.
For Vintela single sign-on to work, you need to setup the BI platform servers, edit BI launchpad properties,
and to copy the keytab file to the appropriate directory.
7.4.3.2.4 Preparing the servers for Vintela single sign-on
You need to ensure that the machine on which the BI platform servers are deployed has been added
to the primary domain and that all the required DNS suffixes have been appended.
To perform the following task you will need the keytab file you created for Windows AD authentication
with Kerberos.
1. Copy the Kerberos keytab file to a location on the machine hosting the BI platform servers.
2. Add the Kerberos service account to the Admnistrator group on the host machine.
Format the account name as follows: DOMAINNAME\service name.
3. Add the Kerberos service account to the following system rights in the Local Security Policy MMC:
255
System right
Impact
Act as part of the Operating system
Allows a process to impersonate any user without the need to authenticate.
Log on as a Batch job
Enables a user to be logged on through a batchqueue facility.
Log on as a service
Allows a service account to register a process
as a service.
Replace a Process Level Token
Allows an account to call the CreateProcessAsUser() API thereby enabling one service to start
another.
2011-05-06
Authentication
You need to run the BI platform servers under the service account.
4. Go toPrograms > SAP BusinessObjects Enterprise XI 4.0 > SAPBusinessObjects Enterprise
> Central Configuration Manager .
5. In the CCM, right-click the Server Intelligence Agent (SIA) and select Stop.
6. Right-click the SIA and select Properties.
7. Clear the System Account check box.
8. Enter the Kerberos account credentials (DOMAINNAME\service name) from Step 2, and click OK.
9. Restart the SIA.
To complete the setup of Vintela single sign-on you need to complete the following tasks:
• Prepare the web application server and BI launchpad properties for Vintela single sign-on.
• Configure the Window AD security plugin to enable Windows AD authentication and Vintela single
sign-on.
7.4.3.2.5 To enable Vintela single sign-on for BI launch pad and OpenDocument
This procedure can be used for both the BI launch pad and OpenDocument web applications. In addition
to specifying Vintela single sign-on settings for the Windows AD security plugin, Vintela settings must
be specified for the BOE.war properties.
1. Access the custom folder for the BOE web application on the machine hosting the web application
server.
If you are using the Tomcat web application server provided with the BI platform installation, you
can directly access the following folder:
C:\Program Files (x86)\SAP BusinessObjects\Tomcat6\webapps\BOE\WEBINF\config\custom\
Tip:
If you are using a web application server that does not enable direct access to the deployed web
applications, you can use the following folder in your product installation to modify the BOE web
application.
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\.
You will have to later redeploy the modified BOE web application.
2. Create a new file.
Note:
Use Notepad or any other text-editing utility.
3. Enter the following:
sso.enabled=true
siteminder.enabled=false
vintela.enabled=true
idm.realm=[YOUR_REALM]
idm.princ=[YOUR_PRINCIPAL]
idm.allowUnsecured=true
idm.allowNTLM=false
idm.logger.name=simple
idm.logger.props=error-log.properties
256
2011-05-06
Authentication
Note:
The idm.realm and idm.princ parameters require valid values. The idm.realm should be the same
value you set when you configured the default_realm in your krb5.ini file. The value must be in
upper case. The idm.princ parameter is the SPN used to for the service account created for Vintela
single sign-on.
4. If you have chosen to use a keytab file, add the key pad parameter and specify the path to the file
as shown in the example below:
idm.keytab=C:/WIN/filename.keytab
Skip the following step if you do not want to use constrained delegation for Windows AD authentication
and Vintela single sign-on.
5. To use contrained delegation add:
idm.allowS4U=true
6. Close the file and save it under the following name:
global.properties
Note:
Make sure the file name is not saved under any extensions such as .txt.
7. Create another file in the same directory. Save the file as OpenDocument.properties or BI
launchpad.properties depending on your requirements.
8. Enter the following statement:
authentication.default=secWinAD
cms.default=[enter your cms name]:[Enter the CMS port number]
For example:
authentication.default=secWinAD
cms.default=mycms:6400
9. Save and close the file.
10. Restart your web application server.
The new properties will take effect only after the BOE web application is redeployed on the machine
running the web application server. Use WDeploy to redeploy BOE on the web application server. For
more information on using WDeploy to undeploy web applications, see the SAP BusinessObjects
Business Intelligence Platform Web Application Deployment Guide.
Note:
If your deployment is using a firewall, remember to open all the required ports otherwise the web
applications will not be able to connect to the BI platform servers.
Related Topics
• Sample multiple domain Krb5.ini file
• Preparing the application server for Windows AD authentication (Kerberos)
257
2011-05-06
Authentication
7.4.3.2.6 To increase the header size limit for Tomcat
Active Directory creates a Kerberos token which is used in the authentication process. This token is
stored in the HTTP header. Your Java application server will have a default HTTP header size. To avoid
failures, ensure that it has a minimum default size of 16384 bytes. (Some deployments may require a
larger size. For more information, see Microsoft's sizing guidelines on their support site
(http://support.microsoft.com/kb/327825).)
1. On the server with Tomcat installed, open the server.xml file.
On Windows, this file is located at <TomcatINSTALLDIR>/conf
•
•
If you are using the version of Tomcat installed with BI platform on Windows, and you did not
modify the default
installation location, replace <TomcatINSTALLDIR> with C:\Program Files (x86)\SAP
BusinessObjects\Tomcat6\
If you are using any other supported web application server, consult the documentation for your
web application server to determine the appropriate path.
2. Find the corresponding <Connector …> tag for the port number you have configured.
If you are using the default port of 8080, find the <Connector …> tag with port=“8080” in it.
For example:
<Connector URIEncoding="UTF-8" acceptCount="100"
connectionTimeout="20000" debug="0"
disableUploadTimeout="true" enableLookups="false"
maxSpareThreads="75" maxThreads="150"
minSpareThreads="25" port="8080" redirectPort="8443"
/>
3. Add the following value within the <Connector …> tag:
maxHttpHeaderSize="16384"
For example:
<Connector URIEncoding="UTF-8" acceptCount="100"
connectionTimeout="20000" debug="0"
disableUploadTimeout="true" enableLookups="false"
maxSpareThreads="75" maxThreads="150"
maxHttpHeaderSize="16384" minSpareThreads="25" port="8080" redirectPort="8443" />
4. Save and close the server.xml file.
5. Restart Tomcat.
Note:
For other Java application servers, consult your Java application server’s documentation.
7.4.3.2.7 Configuring Internet browsers
To support Kerberos single sign-on, you must configure BI platform clients. This involves configuring
the Internet Explorer (IE) browser on the client machines.
258
2011-05-06
Authentication
To configure Internet Explorer on the client machines
1. On the client machine open and IE browser window.
2. Enable integrated Windows authentication.
a. On the Tools menu click Internet Options.
b. Click the Advanced tab.
c. Scroll to Security, select Enable Integrated Windows Authentication, and then click Apply.
3. Add the Java Application machine or the URL to the trusted sites. You can enter the full domain
name of the site.
a. On the Tools menu click Internet Options.
b. Click the Security tab.
c. Click Sites and then click Advanced.
d. Select or enter the site and click Add.
e. Click OK until the Internet Options dialog box closes.
4. Close and reopen the Internet Explorer browser window for these changes to take effect.
5. Repeat all of these steps on each BI platform client machine.
To configure Firefox on the client machines
1. Modify network.negotiate-auth.delegation-uris
a.
b.
c.
d.
On the client machine open a Firefox browser window.
Type about:config in the URL address field. A list of configurable properties appears.
Double-click network.negotiate-auth.delegation-uris to edit the property.
Enter the URL that you will use to access BI launch pad. For example if your BI launch pad URL
is http://machine.domain.com:8080/BOE/BI, then you will need to enter http://machine.do
main.com.
Note:
To add more than one URL, separate them with a comma. For example: http://machine.do
main.com,machine2.domain.com.
e. Click OK.
2. Modify network.negotiate-auth.trusted-uris
a.
b.
c.
d.
On the client machine open a Firefox browser window.
Type about:config in the URL address field. A list of configurable properties appears.
Double-click network.negotiate-auth.trusted-uris to edit the property.
Enter the URL that you will use to access InfoView. For example if your BI launch pad URL is
http://machine.domain.com:8080/BOE/BI, then you will need to enter http://machine.do
main.com.
Note:
To add more than one URL, separate them with a comma. For example: http://machine.do
main.com,machine2.domain.com.
e. Click OK.
259
2011-05-06
Authentication
3. Close and reopen the Firefox browser window for these changes to take effect.
4. Repeat all of these steps on each BI platform client machine.
7.4.3.2.8 To configure constrained delegation for Vintela single sign-on
Constrained delegation is optional for AD authentication and Vintela single sign-on. It is required for
deployment scenarios that involve single sign-on to the system database.
1. On the AD domain controller machine, open the Active Directory "Users and Computers" snap in.
2. Right-click the service account you created for Vintela single sign-on, and click Properties >
Delegation.
3. Select Trust this user for delegation to the specified services only.
4. Select Use Kerberos only.
5. Click Add > Users or Computers.
6. Type the service account name (used for Vintela single sign-on) and click OK.
A list of services is displayed.
7. Select the following services and then clickOK.
•
•
The HTTP service
The service used to run the Service Intelligence Agent (SIA) on the machine hosting BI platform
.
The services are added to the list of services that can be delegated for the (Vintela single sign-on)
account.
You need to modify the web application properties to account for this modification. Open the BOE
global.properties file on your web application server. Add the following and then restart the web
application server.
idm.allowS4U=true
7.4.3.3 Using SiteMinder
7.4.3.3.1 Using Windows AD with SiteMinder
This section explains how to use AD and SiteMinder. SiteMinder is a third-party user access and
authentication tool that you can use with the AD security plug-in to create single sign-on to BI platform.
You can use SiteMinder with Kerberos.
Ensure your SiteMinder identity management resources are installed and configured before configuring
Windows AD authentication to work with SiteMinder. For more information about SiteMinder and how
to install it, refer to your SiteMinder documentation.
There are two tasks you must complete to enable AD single sign-on with SiteMinder:
260
2011-05-06
Authentication
•
Configure the AD plug-in for single sign-on with SiteMinder
•
Configure SiteMinder properties for the BOE web application
Note:
Ensure that the SiteMinder Administrator has enabled support for 4.x Agents. This must be done
regardless of which supported version of SiteMinder you are using. For more information about SiteMinder
configuration, refer to your SiteMinder documentation.
To modify the BOE properties file for Windows AD authentication with SiteMinder
In addition to specifying SiteMinder settings for the Windows AD security plugin, SiteMinder settings
must be specified for the BOE war properties.
1. Go to the following directory in your BI platform installation:
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\
2. Create a new file.
Note:
Use Notepad or any other text-editing utility.
3. Close the file and save it under the following name:
BIlaunchpad.properties
4. Enter the following statement:
sso.enabled=true
siteminder.authentication=secWinAD
siteminder.enabled=true
5. Close the file and save it under the following name:
global.properties
Note:
Make sure the file name is not saved under any extensions such as .txt.
6. Create another file in the same directory.
7. Enter the following statement:
authentication.default=secWinAD
cms.default=[enter your cms name]:[Enter the CMS port number]
For example:
authentication.default=LDAP
cms.default=mycms:6400
8. Close the file and save it under the following name:
BIlaunchpad.properties
The new properties will take effect only after BOE.war is redeployed on the machine running the web
application server. Use WDeploy to redeploy the WAR file on the web application server. For more
261
2011-05-06
Authentication
information on using WDeploy to undeploy web applications, see the SAP BusinessObjects Business
Intelligence Platform Web Application Deployment Guide.
To disable SiteMinder
If you want to prevent SiteMinder from being configured, or to disable it after it has been configured in
the CMC, modify the web configuration file for BI launch pad.
To disable SiteMinder for Java clients
In addition to disabling SiteMinder settings for the Windows AD security plugin, SiteMinder settings
must be disabled for the BOE war file on your web application server.
1. Go to the following directory in your BI platform installation:
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\
2. Open the global.properties file.
3. Change siteminder.enabled to false
siteminder.enabled=false
4. Save your changes and close the file.
The change takes effect only after BOE.war is redeployed on the machine running the web application
server. Use WDeploy to redeploy the WAR file on the web application server. For more information on
using WDeploy to undeploy web applications, see the SAP BusinessObjects Business Intelligence
Platform Web Application Deployment Guide.
7.4.4 Mapping AD groups and configuring AD authentication
7.4.4.1 To map AD users and groups and configure the Windows AD security
plug-in
To configure Windows AD authentication to work with a specific authentication type, you need to first
complete all the required preparatory tasks. For more information see the "Related Topics" section
below.
Regardless of which protocol is used, you must complete the following steps to allow AD users to
authenticate. Use Steps 1-8 in the procedure below to import AD groups into BI platform.
1. Go to the "Authentication" management area of the CMC.
2. Double-click Windows AD.
262
2011-05-06
Authentication
3. Ensure that Enable Windows Active Directory (AD) box is selected.
4. In the Windows AD Configuration Summary area, click the link beside AD Administration Name.
Note:
Before the Windows AD plug-in is configured, this link will appear as two double quotes. After the
configuration has been saved, the link with be populated with the AD Administration names.
5. Enter the name and password of an enabled domain user account. BI platform will use this account
to query information from AD.
Administration credentials can use one of the following formats:
•
NT name (DomainName\UserName)
•
UPN (user@DNS_domain_name)
BI platform never modifies, adds or deletes content from AD. It only reads information, therefore
only the appropriate rights are required.
Note:
AD authentication will not continue if the AD account used to read the AD directory becomes invalid
(for example, if the account's password is changed or expires or the account is disabled).
6. Complete the Default AD Domain field.
Note:
•
•
Groups from the default domain can be mapped without specifying the domain name prefix.
If you enter the Default AD Domain name, users from the default domain do not have to specify
the AD domain name when they log on to BI platform via AD authentication.
7. In the "Mapped AD Member Groups" area, enter the AD domain\group in the Add AD Group
(Domain\Group) field.
Groups can be mapped using one of the following formats:
•
Security Account Manager account name (SAM), also referred to as NT name (Domain
Name\GroupName)
•
DN (cn=GroupName, ......, dc=DomainName, dc=com)
Note:
If you want to map a local group, you can use only the NT name format (\\ServerName\GroupName).
AD does not support local users. This means that local users who belong to a mapped local group
will not be mapped to BI platform. Therefore, they will not be able to access the system.
8. Click Add.
The group is added to the list.
You can skip over steps 9-18 if you want to import AD group accounts and do not want to configure
AD authentication options or AD group updates.
9. If you want to configure single sign-on, select Enable Single Sign On for selected authentication
mode.
263
2011-05-06
Authentication
Note:
If you select this option, you need to configure the BOE web application general and BI launch pad
properties to enable single sign-on.
10. Select the option in the "Synchronization of Credentials" area to enable and update the AD user's
data source credentials at logon time. This will synchronize the data source with the user's current
logon credentials
11. Use the SiteMinder options area of the page to configure SiteMinder as your single sign-on option
for AD authentication using Kerberos.
Note:
You can configure either Vintela or SiteMinder as the single sign-on option, not both. Clear any
entries in the Service principal name field (Step 9b) if you want to configure the SiteMinder options.
a. Click Disabled.
The Windows AD SiteMinder configuration page will appear.
Note:
If you have not configured the Windows AD plug-in, you will receive a warning and will be asked
if you want to continue. Click OK.
b. Click Use SiteMinder Single Sign On.
c. In the "Policy Server Host" box, type the name of each policy server, and click Add.
d. For each Policy Server Host, specify the Accounting, Authentication and Authorization port
numbers.
e. Enter the name of the Agent Name and the Shared Secret. Enter the Shared Secret again.
Note:
Ensure that the SiteMinder Administrator has enabled support for 4.x Agents. This must be done
regardless of which supported version of SiteMinder you are using. For more information about
SiteMinder and how to install it, refer to the SiteMinder documentation.
f. Click Update to save your information and return to the main AD authentication page.
12. In the "AD Alias Options" area specify how new aliases are added and updated to BI platform.
a. In "New Alias Options", select how new aliases are mapped to Enterprise accounts. Select one
of the following choices:
• Assign each new AD alias to an existing User Account with the same name
Use this option when you know users have an existing Enterprise account with the same
name; that is, AD aliases will be assigned to existing users (auto alias creation is turned on).
Users who do not have an existing Enterprise account, or who do not have the same name
in their Enterprise and AD account, are added as new users.
•
Create a new user account for each new AD alias
Use this option when you want to create a new account for each user.
b. In "Alias Update Options", select how to manage alias updates for the Enterprise accounts. Select
one of the following choices:
• Create new aliases when the Alias Update occurs
264
2011-05-06
Authentication
Use this option to automatically create a new alias for every AD user mapped to BI platform.
New AD accounts are added for users without BI platform accounts, or for all users if you
selected the "Create a new account for each new AD alias" option and clicked Update.
•
Create new aliases only when the user logs on
Use this option when the AD directory you are mapping contains many users, but only a few
of them will use BI platform. The platform does not automatically create aliases and Enterprise
accounts for all users. Instead, it creates aliases (and accounts, if required) only for users
who log on to BI platform.
c. In "New User Options" specify how new users are created by selecting one of the following
choices:
If your SAP BusinessObjects Business Intelligence platform license is based on users roles,
select one of the following options:
• BI Viewer User
New user accounts are configured under the BI Viewer role. Access to BI platform applications
for all accounts under the BI Viewer role is defined in the license agreement. Users are
restricted to access application workflows that are defined for the BI Viewer role. Access rights
are generally limited to viewing business intelligence documents. This role is typically suitable
for users who consume content through BI platform applications.
•
BI Analyst User
New user accounts are configured under the BI Analyst role. Access to BI platform applications
for all accounts under the BI Analyst role is defined in the license agreement. Users can
access all applications workflows that are defined for the BI Analyst role. Access rights include
viewing and modifying business intelligence documents. This role is typically suitable for users
who create and modify content for BI platform applications.
If your SAP BusinessObjects Business Intelligence platform license is not based on users roles,
select one of the following options:
•
New users are created as named users
New user accounts are configured to use named user licenses. Named user licenses are
associated with specific users and allow people to access the system based on their user
name and password. This provides named users with access to the system regardless of how
many other people are connected. You must have a named user license available for each
user account created using this option.
•
New users are created as concurrent users
New user accounts are configured to use concurrent user licenses. Concurrent licenses specify
the number of people who can connect to BI platform at the same time. This type of licensing
is very flexible because a small concurrent license can support a large user base. For example,
depending on how often and how long users access the system, a 100 user concurrent license
could support 250, 500, or 700 users.
13. To configure how to schedule AD alias updates, click Schedule AD Alias Updates.
a. In the "Schedule" dialog box, select a recurrence from the Run object list.
b. Set any of the other schedule options and parameters as required.
265
2011-05-06
Authentication
c. Click Schedule.
When the alias update occurs, the group information is also updated.
14. In the "Attribute Binding Options" area you can specify the attribute binding priority for the AD plugin:
a. Click the Import Full Name and Email Address box.
The full names and descriptions used in the AD accounts are imported and stored with the user
objects in BI platform.
b. Specify an option for Set priority of AD attribute binding relative to other attributes binding.
Note:
If option is set to "1", AD attributes take priority in scenarios where AD and other plugins (LDAP
and SAP) are enabled. If set to "3", attributes from other enabled plugins will take priority.
15. You can configure AD group updates in the "AD Group Options" area.
a. Click Schedule AD Group Updates.
The "Schedule" dialog box appears.
b. Select a recurrence from the Run object list.
c. Set any of the other schedule options and parameters as required.
d. Click Schedule.
The system will schedule the update and run it according to the schedule information you specified.
You can view the next scheduled update for the AD group accounts under the " AD Group Options".
16. Use the settings in the "On-demand AD Update" area to specify what should be updated. You can
select from one of the following options:
• Update AD Group now
Select this option if you want to update the AD groups. The update will occur only after you click
Update.
Note:
This option affects any scheduled AD group updates. The next scheduled AD group update is
listed under " AD Group Options".
•
Update AD Groups and Aliases now
Select this option if you want to update the AD group and user aliases. The updates will occur
only after you click Update.
Note:
This option affects any scheduled AD group updates. The next scheduled updates are listed
under "AD Group Options" and "AD Alias Options".
•
Do not update AD Groups and Aliases now
If you click Update, neither the group nor the user aliases will be updated.
Note:
This option affects any scheduled group or alias updates. The next scheduled updates are listed
under "AD Group Options" and "AD Alias Options".
266
2011-05-06
Authentication
17. Click Update.
18. Click OK.
Related Topics
• Single sign-on with Windows AD
• Using Windows AD with SiteMinder
• Using Windows AD authentication with Kerberos
7.4.5 Troubleshooting Windows AD authentication
7.4.5.1 Troubleshooting your configuration
These steps may help you if you encounter problems when configuring Kerberos:
•
•
Enabling logging
Testing your Java SDK Kerberos configuration
7.4.5.1.1 To enable logging
1. From the Start menu, select Programs >Tomcat > Tomcat Configuration
2. Click the Java tab.
3. Add the following options:
-Dcrystal.enterprise.trace.configuration=verbose
-sun.security.krb5.debug=true
This will create a log file in the following location:
C:\Documents and Settings\<user name>\.businessobjects\jce_verbose.log
7.4.5.1.2 To test your Java Kerberos configuration
•
Run the following command to test your Kerberos configuration, where servact is the service
account and domain under which the CMS is running, and password is the password associated
with the service account.
<Install Directory>\SAP Business Objects Enterprise XI 4.0\win64_64\jdk\bin [email protected] Password
For example:
C:\Program Files\SAP BusinessObjects\
SAP Business Objects Enterprise XI 4.0\win64_64\jdk\bin\
[email protected] Password
267
2011-05-06
Authentication
If you still have a problem, ensure that the case you entered for your domain and service principal
name match exactly with what is set in Active Directory.
7.4.5.1.3 Logon failure due to different AD UPN and SAM names
A user's Active Directory ID has successfully been mapped to BI platform. Despite this fact, they are
unable to successfully log onto the CMC or BI launch pad with Windows AD authentication and Kerberos
in the following format: DOMAIN\ABC123
This problem can happen when the user is set up in Active Directory with a UPN and SAM name that
are not exactly the same. The following examples may cause a problem:
•
•
The UPN is [email protected] but the SAM name is DOMAIN\ABC123.
The UPN is jsmith@company but the SAM name is DOMAIN\johnsmith.
There are two ways to address this problem:
•
•
Have users log in using the UPN name rather than the SAM name.
Ensure the SAM account name and the UPN name are the same.
7.4.5.1.4 Pre-authentication error
A user who has previously been able to log on, can no longer log on successfully. The user will receive
this error: Account Information Not Recognized. The Tomcat error logs reveal the following error: "Preauthentication information was invalid (24)"
This can occur because the Kerberos user database didn't get a change made to UPN in AD. This may
mean that the Kerberos user database and the AD information are out of sync.
To resolve this problem, reset the user's password in AD. This will ensure the changes are propagated
correctly.
Note:
This problem is not an issue with J2SE 5.0.
7.5 SAP authentication
7.5.1 Configuring SAP authentication
This section explains how to configure BI platform authentication for your SAP environment.
268
2011-05-06
Authentication
SAP authentication enables SAP users to log onto BI platform using their SAP user names and
passwords, without storing these passwords in BI platform. SAP authentication also allows you to
preserve information about user roles in SAP, and to use this role information within the platform to
assign rights to perform administrative tasks, or access content.
Accessing the SAP authentication application
After installing SAP Authentication, you must provide BI platform with information about your SAP
system. A dedicated web application is accessible through the main BI platform administration tool, the
Central Management Console (CMC). To access it from the home page of the CMC, click Authentication.
Authenticating SAP users
Security plug-ins expand and customize the ways in which BI platform authenticates users. The SAP
Authentication feature includes an SAP security plug-in (secSAPR3.dll) for the Central Management
Server (CMS) component of BI platform. This SAP security plug-in offers several key benefits:
•
It acts as an authentication provider that verifies user credentials against your SAP system on behalf
of the CMS. When users log on to BI platform directly, they can choose SAP Authentication and
provide their usual SAP user name and password. BI platform can also validate Enterprise Portal
logon tickets against SAP systems.
•
It facilitates account creation by allowing you to map roles from SAP to BI platform user groups, and
it facilitates account management by allowing you to assign rights to users and groups in a consistent
manner within BI platform.
•
It dynamically maintains SAP role listings. So, once you map an SAP role to the platform, all users
who belong to that role can log on to the system. When you make subsequent changes to the SAP
role membership, you need not update or refresh the listing in BI platform.
•
The SAP Authentication component includes a web application for configuring the plug-in. You can
access this application in the "Authentication" area of the Central Management Console (CMC).
7.5.2 Creating a user account for BI platform
The BI platform system requires an SAP user account that is authorized to access SAP role membership
lists and authenticate SAP. You will need the account credentials to connect the BI platform to your
SAP system. For general instruction on creating SAP user accounts and assigning authorizations
through roles, see your SAP BW documentation.
Use transaction SU01 to create a new SAP user account named CRYSTAL. Use transaction PFCG to
create a new role named CRYSTAL_ENTITLEMENT. (These names are recommended but not required.)
Change the new role's authorization data by setting these values for the following authorization objects:
269
2011-05-06
Authentication
Authorization object
Authorization for file access
(S_DATASET)
Authorization Check for RFC
Access (S_RFC)
Field
Value
Activity (ACTVT)
Read, Write (33, 34)
Physical file name (FILENAME)
* (denotes All)
ABAP program name (PROGRAM)
*
Activity (ACTVT)
16
Name of RFC to be protected
(RFC_NAME)
BDCH, STPA, SUSO, BDL5,
SUUS, SU_USER, SYST, SUNI,
RFC1, SDIFRUNTIME,
PRGN_J2EE, /CRYSTAL/SECURITY
Type of RFC object to be protected (RFC_TYPE)
Function group (FUGR)
Activity (ACTVT)
Create or Generate, and Display
(03)
*
User Master Maintenance: User
Groups (S_USER_GRP)
User group in user master
maintenance (CLASS)
Note:
For greater security, you may
prefer to explicitly list the user
groups whose members require
access to BI platform.
Finally, add the CRYSTAL user to the CRYSTAL_ENTITLEMENT role.
Tip:
If your system policies require users to change their passwords when they first log onto the system,
log on now with the CRYSTAL user account and reset its password.
7.5.3 Connecting to SAP entitlement systems
270
2011-05-06
Authentication
Before you can import roles or publish BW content to the BI platform, you must provide information
about the SAP entitlement systems to which you want to integrate. BI platform uses this information to
connect to the target SAP system when it determines role memberships and authenticates SAP users.
7.5.3.1 To add an SAP entitlement system
1. Go to the "Authentication" management area of the CMC.
2. Double-click the SAP link.
The entitlement systems settings appear.
Tip:
If an entitlement system is already displayed in the Logical system name list, click New.
3. In the System field, type the three-character System ID (SID) of your SAP system.
4. In the Client field, type the client number that BI platform must use when it logs on to your SAP
system.
BI platform combines your System and Client information, and adds an entry to the Logical system
name list.
5. Ensure the Disabled check box is clear.
Note:
Use the Disabled check box to indicate to BI platform that a particular SAP system is temporarily
unavailable.
6. Complete the Message Server and Logon Group fields as appropriate, if you have set up load
balancing such that BI platform must log on through a message server.
Note:
You must make the appropriate entries in the Services file on your BI platform machine to enable
load balancing - especially if your deployment not on a single machine. Specifically you should
account for the machines hosting the CMS, the Web application server, as well as all machines
managing your authentication accounts and settings.
7. If you have not set up load balancing (or if you prefer to have BI platform log on directly to the SAP
system), complete the Application Server and System Number fields as appropriate.
8. In the User name, Password, and Language fields, type the user name, password, and language
code for the SAP account that you want BI platform to use when it logs on to SAP.
Note:
These credentials must correspond to the user account that you created for BI platform.
9. Click Update.
If you add multiple entitlement systems, click the Options tab to specify the system that BI platform
uses as the default (that is, the system that is contacted to authenticate users who attempt to log on
with SAP credentials but without specifying a particular SAP system).
271
2011-05-06
Authentication
Related Topics
• Creating a user account for BI platform
7.5.3.2 To verify if your entitlement system was added correctly
1. Click the Role Import tab.
2. Select the name of the entitlement system from the Logical system name list.
If the entitlement system was added correctly, the Available roles list will contain a list of roles that
you can choose to import.
Tip:
If no roles are visible in the Logical system name list, look for error messages on the page. These
may give you the information you need to correct the problem.
7.5.3.3 To temporarily disable a connection to an SAP entitlement system
In the CMC, you can temporarily disable a connection between BI platform and an SAP entitlement
system. This may be useful to maintain the responsiveness of the BI platform in cases such as the
scheduled down time of an SAP entitlement system.
1. In the CMC, go to the Authorization management area.
2. Double-click the SAP link.
3. In the Logical system name list, select the system you want to disable.
4. Select the Disabled check box.
5. Click Update.
7.5.4 Setting SAP Authentication options
SAP Authentication includes a number of options that you can specify when integrating BI platform with
your SAP system. The options include:
• Enabling or disabling SAP authentication
• Specifying connection settings
• Linking imported users to BI platform license models.
• Configuring single sign-on to the SAP system
272
2011-05-06
Authentication
7.5.4.1 To set SAP Authentication options
1. Go to the "Authentication" management area of the CMC.
2. Double-click the SAP link and then click the Options tab.
3. Review and modify settings as required.
273
2011-05-06
Authentication
Setting
Description
Enable SAP Authentication
Clear this check box if you want to disable SAP
Authentication completely. (To disable SAP Authentication for a specific SAP System, select that
system's Disabled check box on the Entitlement
Systems tab.)
Content folder root
Use this field to specify where you want BI platform to begin replicating the BW folder structure
in the CMC and BI Launch Pad. The default is
/SAP/2.0 but you can change it to a different
folder. To change this value, you must change it
both in the CMC and the Content Administration
Workbench.
Default system
In this list, select the SAP entitlement system that
BI platform uses as the default (that is, the system
that is contacted to authenticate users who attempt to log on with SAP credentials but without
specifying a particular SAP system).
Note:
If you designate a default system, users from that
system do not have to enter their System ID and
client when they connect from client tools like
Live Office or Universe Designer using SAP authentication. For example, if SYS~100 is set as
the default system, SYS~100/user1 would be
able to log on as user1 when SAP authentication
is chosen.
Max. number of failed attempts to access
entitlement system
Type the number of times that the platform should
re-attempt contacting an SAP system to fulfill
authentication requests. Setting the value to -1
allows BI platform to attempt to contact the entitlement system an unlimited number of times.
Setting the value to 0 limits BI platform to making
one attempt to contact the entitlement system.
Note:
Use this setting together with Keep entitlement
system disabled [seconds] to configure how BI
platform handles SAP entitlement systems that
are temporarily unavailable. The system uses
these settings to determine when to stop communicating with an SAP system that is unavailable,
and when it should resume communication with
that system.
274
2011-05-06
Authentication
Setting
Description
Keep entitlement system disabled [seconds] Type the number of seconds that BI platform
should wait before resuming attempts to authenticate users against the SAP system. For example, if you type 3 for Max failed entitlement
system accesses, BI platform allows a maximum
of 3 failed attempts to authenticate users against
any particular SAP system; the fourth failed attempt results in the system ceasing its attempts
to authenticate users against that system for the
amount of time specified.
Max. concurrent connections per system
Use this field to specify how many connections
you want to keep open to your SAP system at
the same time. For example, if you type 2 in this
field, BI platform keeps two separate connections
open to SAP.
Number of uses per connection
Use this field to specify how many operations you
want to allow to the SAP system per connection.
For example, if you specified 2 for Max concurrent connections per system and 3 for Number
of uses per connection, once there has been 3
logons on one connection, BI platform will close
that connection and restart it.
BI Viewer and BI Analyst
Use these options to specify if new user accounts
are configured under either the BI Viewer or BI
Analyst user roles. The BI Viewer role is typically
assigned to users who are content consumers.
This role has restricted access to application
workflows as stipulated in the SAP BusinessObjects Business Intelligence platform license
agreement. The BI Analyst role is for users who
create and modify content for platform applications. This role does not have restricted access
to application workflows.
Note:
The option you select here does not change the
number or type of user licenses that you have
installed in BI platform. You must have the appropriate licenses available on your system.
275
2011-05-06
Authentication
Setting
Description
Concurrent users and Named Users
Use these options to specify if new user accounts
are configured to use concurrent user licenses
or named user licenses. Concurrent licenses
specify the number of people who can connect
to BI platform at the same time. This type of licensing is very flexible because a small number of
concurrent licenses can support a large user
base. For example, depending on how often and
how long users access the system, a 100 user
concurrent license could support 250, 500, or 700
users. Named user licenses are associated with
specific users and allow people to access the
system based on their user name and password.
This provides named users with access to the
system regardless of how many other people are
connected.
Note:
The option you select here does not change the
number or type of user licenses that you have
installed in BI platform. You must have the appropriate licenses available on your system.
Import Full Name and Email Address
Select this option if you want to specify a priority
level for the SAP authentication plugin. The full
names and descriptions used in the SAP accounts are imported and stored with the user objects in BI platform.
Set priority of SAP attribute binding relative Specifies a priority for binding SAP user attributes
(full name and email address). If option is set to
to other attributes binding.
"1", SAP attributes take priority in scenarios
where SAP and other plugins (Windows AD and
LDAP) are enabled. If set to "3", attributes from
other enabled plugins will take priority.
The following fields are used to configure the SAP single sign-on service:
276
2011-05-06
Authentication
Setting
Description
"System ID"
The system identifier provided by BI platform to the SAP system when performing the SAP single sign-on service.
Browse
Use this button to upload the key store file generated to enable the SAP
single sign-on. You can also manually enter the full path to the file in the field
provided.
"Key Store Password"
Provide the password required to access the key store file.
"Private Key Password"
Provide the password required to access the certificate corresponding to the
key store file. The certificate is stored on the SAP system
"Private Key Alias"
Provide the alias required to access the key store file.
4. Click Update.
Related Topics
• Role-based licensing
• Configuring SAP authentication
7.5.4.2 To change the Content folder root
1. Go to the "Authentication" management area of the CMC.
2. Double-click the SAP link.
3. Click Options and type the name of the folder in Content folder root field.
The folder name that you type here is the folder that you want BI platform to begin replicating the
BW folder structure from.
4. Click Update.
5. In the BW Content Administration Workbench, expand Enterprise system.
6. Expand Available systems and double-click the system that BI platform is connecting to.
7. Click the Layout tab and in the Content base folder, type the folder that you want to use as the
root SAP folder in BI platform (for example, /SAP/2.0/).
7.5.5 Importing SAP roles
277
2011-05-06
Authentication
By importing SAP roles into BI platform, you allow role members to log onto the system with their usual
SAP credentials. In addition, single sign-on is enabled so that SAP users are logged on to BI platform
automatically when they access reports from within the SAP GUI or an SAP Enterprise Portal.
Note:
There are often many requirements for enabling SSO. Some of these might include using a driver and
application that are SSO-capable, and ensuring your server and web server are in the same domain.
For each role that you import, BI platform generates a group. Each group is named with the following
convention: SystemID~ClientNumber@NameOfRole. You can view the new groups in the "Users
and Groups" management area of the CMC. You can also use these groups to define object security
within BI platform.
Consider three main categories of users when configuring BI platform for publishing, and when importing
roles to the system:
•
BI platform administrators
Enterprise administrators configure the system for publishing content from SAP. They import the
appropriate roles, create necessary folders, and assign rights to those roles and folders in BI platform.
•
Content publishers
Content publishers are those users who have rights to publish content into roles. The purpose of
this category of user is to separate regular role members from those users with rights to publish
reports.
•
Role members
Role members are users who belong to “content bearing” roles. That is, these users belong to roles
to which reports are published. They have View, View on Demand, and Schedule rights for any
reports published to the roles they are members of. However, regular role members cannot publish
new content, nor can they publish updated versions of content.
You must import all content publishing and all content bearing roles to BI platform prior to publishing
for the first time.
Note:
It is strongly recommended that you keep the activities of roles distinct. For example, while it is possible
to publish from an administrator role, it is better practice to publish only from content publisher roles.
Additionally, the function of content publishing roles is only to define which users can publish content.
Thus, content publishing roles should not contain any content; content publishers should publish to
content bearing roles that are accessible to regular role members.
Related Topics
• How rights work in BI platform
• Managing security settings for objects in the CMC
278
2011-05-06
Authentication
7.5.5.1 To import SAP roles
1. Go to the "Authentication" management area of the CMC.
2. Double-click the SAP link.
3. On the Options tab, select BI Viewer, BI Analyst, Concurrent users, or Named users depending
on your license agreement.
Note that the option you select here does not change the number or type of user licenses that you
have installed in BI platform. You must have the appropriate licenses available on your system.
4. Click Update.
5. On the Role import tab, select the appropriate entitlement system from the Logical system name
list.
6. In the Available roles area, select the role(s) that you want to import, and then click Add.
7. Click Update.
7.5.5.2 To verify that roles and users were imported correctly
1. Ensure that you know the user name and password of an SAP user who belongs to one of the roles
that you just mapped to BI platform.
2. For Java BI launch pad, go to http://webserver:portnumber/BOE/BI.
Replace webserver with the name of the web server and portnumber with the port number that
is set up for BI platform. You may need to ask your administrator for the name of the web server,
the port number, or the exact URL to enter.
3. From the Authentication Type list, select SAP.
4. Type the SAP system and system client that you want to log on to.
5. Type the user name and password of a mapped user.
6. Click Log On.
You should be logged on to BI launch pad as the selected user.
7.5.5.3 Updating SAP roles and users
279
2011-05-06
Authentication
After enabling SAP authentication, it is necessary to schedule and run regular updates on mapped roles
that have been imported into BI platform. This will ensure that your SAP role information is accurately
reflected in the platform.
There are two options for running and scheduling updates for SAP roles:
•
•
Update roles only: using this option will only update the links between the currently mapped roles
that have been imported in BI platform. It is recommended that you use this option if you expect to
run frequent updates, and you have concerns over system resource usage. No new user accounts
will be created if you only update SAP roles.
Update roles and aliases: this option not only updates links between roles but will also create new
user accounts in BI platform for user aliases added to roles in the SAP system.
Note:
If you have not specified to automatically create user aliases for updates when you enabled SAP
authentication, no accounts will be created for new aliases.
7.5.5.3.1 To schedule updates for SAP roles
Once you have mapped roles into BI platform you need specify how the system updates these roles.
1. Click the User Update tab.
2. Click Schedule in either the "Update Roles Only" or "Update Roles and Aliases" sections.
Tip:
If you want to immediately run an update click Update Now.
Tip:
Use the "Update Roles Only" option if you would like frequent updates and have concerns about
system resources. It takes the system longer to update both roles and aliases.
The "Recurrence" dialog box is displayed.
3. Select an option from the" Run Object" pull-down list and provide all the requested scheduling
information in the fields provided.
When scheduling an update, you can choose from the recurrence patterns summarized in the
following table:
280
Recurrence pattern
Description
Hourly
The update will be run every hour. You specify at what time it
will start, as well as a start and end date.
Daily
The update will be run every day or run every number of specified days. You can specify at what time it will run, as well as a
start and end date.
Weekly
The update will be run every week. It can be run once a week
or several times a week. You can specify on which days and
at what time it will run, as well as and a start and end date.
2011-05-06
Authentication
Recurrence pattern
Description
Monthly
The update will be run every month or every several months.
You can what time it will run, as well as a start and end date.
Nth Day of Month
The update will run on a specific day in the month. You can
specify on which day of the month, what time it will run, as well
as a start and end date.
1st Monday of Month
The update will run on the first Monday of each month. You
can specify what time it will run, as well as and a start and end
date.
Last Day of Month
The update will run on the last day of each month. You can
specify what time it will run, as well as and a start and end date.
X Day of Nth Week of the Month
The update will run on a specified day of a specified week of
the month. You can specify what time it will run, as well as and
a start and end date.
Calendar
The update will be run on the dates specified in a calendar that
has previously been created.
4. Click Schedule after you have finished providing the scheduling information.
The date of the next scheduled role update is displayed in the User Update tab.
Note:
You can always cancel the next scheduled update by clicking Cancel Scheduled Updates in either
the "Update Roles Only" or "Update Roles and Aliases" sections.
7.5.6 Configuring Secure Network Connection (SNC)
This section describes how to configure SNC as part of the process of setting up SAP authentication
to BI platform
Before setting up trust between the SAP and BI platform systems, you must ensure the SIA is configured
to start and run under an account that has been set up for SNC. You must also configure your SAP
system to trust BI platform. It is recommended that you follow the instructions covered in the Configuring
SAP server-side trust section in the Supplementary Configurations for ERP Environments chapter of
this guide.
281
2011-05-06
Authentication
7.5.6.1 SAP Server-Side Trust Overview
This section provides procedures for configuring server-side trust between SAP Web Application Servers
(version 6.20 and up) and BI platform. You need to set up server-side trust if you are using multi-pass
report bursting (for publications where the report query depends on the context of the user).
Server-side trust involves password-less impersonation. To impersonate an SAP user without providing
a password, a user must be identified with SAP using a more secure method than a regular username
and password. (An SAP user with the SAP_ALL authorization profile cannot impersonate another SAP
user without knowing that user's password.)
Enabling server-side trust using the free SAP crypto library
To enable server-side trust for BI platform using the free SAP crypto library, you must run the relevant
servers under credentials that are authenticated using a registered Secure Network Communication
(SNC) provider. These credentials are configured within SAP to be allowed to impersonate without a
password. For BI platform, you need to run the servers involved in report-bursting under these SNC
credentials, such as the Crystal Reports Job Server.
You also need an encryption library in order to configure server-side trust. An SAP Cryptographic Library
is available for download from the SAP web site. Note that the SAP Cryptographic Library can be used
only for setting up server-side trust. The Cryptographic Library is available for Windows and UNIX. For
more information about the Cryptographic Library, see SAP notes 711093, 597059 and 397175 on the
SAP web site.
The SAP server and BI platform need to be assigned certificates that prove their identities to each other.
Each server will have its own certificate and a list of certificates for trusted parties. To configure
server-side trust between SAP and BI platform, you need to create a password-protected set of
certificates called a Personal Security Environment (PSE). This document describes how to set up and
maintain the PSEs, and how to securely associate them with BI platform processing servers.
Client versus server SNC
In client SNC, an SNC name identifier is mapped to one (or more) SAP user names in SU01. When a
logon request is sent, the SNC name together with the SAP name is passed to the SAP system, however
no password is sent. Provided the SNC name maps to the specified SAP name, the logon is permitted.
A client-side logon string for a direct application host logon is shown below:
ASHOST =myserver.mydomain SYSNR=37 CLIENT=066 LANG=EN USER=USER123
SNC_MODE=1 SNC_QOP=9 SNC_LIB="/usr/local/lib/libsapcrypto.so"
SNC_PARTNERNAME="p:CN=TheServer, OU=Dept., O=TheCompany, C=FR"
SNC_MYNAME="p:CN=TheUser, O=TheCompany, C=US"
The SAP user USER123 must be mapped to p:CN=TheUser, O=TheCompany, C=US in SU01 for
this logon attempt to succeed. In server SNC on the other hand, it is not a requirement to explicitly map
between the SNC name identifier and SAP user name. Instead, the SNC name is configured in transaction
282
2011-05-06
Authentication
SNC0 to be allowed to perform an impersonation-style logon for “any” user without having to provide
this users' password. For example:
ASHOST =myserver.mydomain SYSNR=37 CLIENT=066 LANG=EN SNC_MODE=1
SNC_QOP=9 SNC_LIB="/usr/local/lib/libsapcrypto.so"
SNC_PARTNERNAME="p:CN=TheServer, OU=Dept., O=TheCompany, C=FR"
SNC_MYNAME="p:CN=TheUser, O=TheCompany, C=US" EXTIDTYPE=UN EXTIDDATA=USER123
The server SNC impersonation logon, or logon via external ID is much more powerful than its client
counterpart. This logon enables access to any SAP user account in the system. Other External ID logon
options include Logon Tickets and X.509 client certificates.
BI platform server responsibilities
Specific BI platform servers are relevant to the SAP integration in terms of single sign-on (SSO). The
following table lists these servers, and the type of SNC they require for particular areas of responsibility.
Server
SNC type
Areas of responsibility
Web Application Server
client
SAP Authentication role list
server
Crystal Reports Dynamic Parameter pick lists and personalization
CMS
client
Password, ticket, checking role membership, and user
lists
Page Server
server
Crystal Reports view on demand
Job Server
server
Scheduling Crystal Reports
Web Intelligence Process- server
ing Server
Viewing and scheduling Web Intelligence reports and List
of Values (LOV) prompts
Multi-Dimensional Analy- server
sis Service
Analysis
Note:
The Web Application Server and the CMS use client-SNC and thus require an explicit mapping of the
SNC name to the SAP user name. This is specified in either transaction SU01 or SM30 for table USRACL.
7.5.6.2 Configuring SAP for server-side trust
The following procedure describes how to set up SNC for use with BI platform. Note that you should
consult the SAP documentation provided with your SAP server for more information or troubleshooting
assistance.
7.5.6.2.1 To configure SAP for server-side trust
1. From the SAP marketplace, download the SAP Cryptographic Library for all relevant platforms.
283
2011-05-06
Authentication
Note:
For more information about the Cryptographic Library, see SAP notes 711093, 597059 and 397175
on the SAP web site.
2. Ensure that you have SAP administrator's credentials for within SAP and for the machine running
SAP, and administrator's credentials for BI platform and the machine (or machines) it is running on.
3. On the SAP machine, copy the SAP Cryptographic Library and the SAPGENPSE tool to
<DRIVE>:\usr\sap\<SID>\SYS\exe\run\ directory (on Windows).
4. Locate the file named "ticket" that was installed with the SAP Cryptographic Library, and copy it to
the <DRIVE>:\usr\sap\<SID>\<instance>\sec\ directory (on Windows).
5. Create an environment variable named SECUDIR that points to the directory where the ticket resides.
Note:
This variable must be accessible to the user under which SAP's disp+work process runs.
6. In the SAP GUI, go to transaction RZ10 and change the instance profile in Extended maintenance
mode.
7. In profile edit mode, point SAP profile variables to the Cryptographic Library and give the SAP system
a Distinguished Name (DN). These variables should follow the LDAP naming convention:
Tag
Meaning
Description
CN
Common Name
The everyday name of the certificate proprietor.
OU
Organizational Unit PG for Product Group, for example.
O
Organization
The name of the organization for which the certificate was
issued.
C
Country
The country where the organization is located.
For example, for R21: p:CN=R21, OU=PG, O=BOBJ, C=CA
Note:
Note that the prefix p: is for the SAP Cryptographic Library. It is required when referring to the DN
within SAP, but will not be visible when examining certificates in STRUST or using SAPGENPSE.
8. Enter the following profile values, substituting for your SAP system where necessary:
284
2011-05-06
Authentication
Profile variable
Value
ssf/name
SAPSECULIB
ssf/ssfapi_lib
Full path to sapcrypto lib
sec/libsapsecu
Full path to sapcrypto lib
snc/gssapi_lib
Full path to sapcrypto lib
snc/identity/as
Your SAP system's DN
9. Restart your SAP instance.
10. When the system is running again, log on and go to transaction STRUST, which should now have
additional entries for SNC and SSL.
11. Right-click the SNC node and click Create.
The identity you specified in RZ10 should now appear.
12. Click OK.
13. To assign a password to the SNC PSE, click the lock icon.
Note:
Do not lose this password. You will be prompted for it by STRUST every time you view or edit the
SNC PSE.
14. Save the changes.
Note:
If you do not save your changes, the application server will not start again when you enable SNC.
15. Return to transaction RZ10 and add the remainder of the SNC profile parameters:
Profile variable
snc/accept_insecure_rfc
snc/accept_insecure_r3int_rfc
snc/accept_insecure_gui
snc/accept_insecure_cpic
285
Parameter
1
1
1
1
2011-05-06
Authentication
Profile variable
snc/permit_insecure_start
snc/data_protection/min
snc/data_protection/max
snc/enable
Parameter
1
1
3
1
The minimum protection level is set to authentication only (1) and the maximum is privacy (3). The
snc/data_protection/use value defines that only authentication is to be used in this case, but could
also be (2) for integrity, (3) for privacy and (9) for maximum available. The snc/accept_insecure_rfc,
snc/accept_insecure_r3int_rfc, snc/accept_insecure_gui, and snc/accept_insecure_cpic values set
to (1) ensure that previous (and potential unsecure) communication methods are still permitted.
16. Restart your SAP system.
You must now configure BI platform for server-side trust.
7.5.6.3 Configuring BI platform for server-side trust
The following procedures need to be performed in order to configure BI platform for server-side trust.
Note that these steps are Windows-based, but because the SAP tool is a command line tool, the steps
are very similar on Unix.
1. Set up the environment
2. Generate a Personal Security Environment (PSE)
3. Configure BI platform servers
4. Configure PSE access
5. Configure SAP Authentication SNC settings
6. Set up SAP dedicated server groups
Related Topics
• To set up the environment
• To generate a PSE
• To configure BI platform servers
• To configure PSE access
• To configure SAP authentication SNC settings
• Using server groups
286
2011-05-06
Authentication
7.5.6.3.1 To set up the environment
Before you begin, ensure that:
•
•
The SAP Cryptographic Library has been downloaded and expanded on the host on which BI platform
processing servers run.
The appropriate SAP systems have been configured to use SAP Cryptographic Library as the SNC
provider.
Before PSE maintenance can begin, you need to set up the library, tool, and environment where PSEs
are stored.
1. Copy the SAP Cryptographic Library (including the PSE maintenance tool) to a folder on the machine
running BI platform.
For example: C:\Program Files\SAP\Crypto
2. Add the folder to the PATH environment variable.
3. Add a system-wide environment variable SNC_LIB that points to the Cryptographic Library.
For example: C:\Program Files\SAP\Crypto\sapcrypto.dll
4. Create a subfolder named sec.
For example: C:\Program Files\SAP\Crypto\sec
5. Add a system-wide environment variable SECUDIR that points to the sec folder.
6. Copy the ticket file from the SAP Cryptographic Library into the sec folder.
Related Topics
• Configuring SAP for server-side trust
7.5.6.3.2 To generate a PSE
SAP accepts an BI platform server as a trusted entity when the relevant BI platform servers have a
PSE and the PSE is associated with SAP. This “trust” between SAP and BI platform components is
established by sharing the public version of each other's certificates. The first step is to generate a PSE
for BI platform that automatically generates its own certificate.
1. Open a command prompt and run sapgenpse.exe gen_pse -v -p BOE.pse from within the
Cryptographic Library folder.
2. Choose a PIN and the DN you want for your BI platform system.
For example, CN=MyBOE01, OU=PG, O=BOBJ, C=CA.
You now have a default PSE, with its own certificate.
3. Use the following command to export the certificate in the PSE:
sapgenpse.exe export_own_cert -v -p BOE.pse -o MyBOECert.crt
4. In the SAP GUI, go to transaction STRUST and open the SNC PSE.
You will be prompted for the password you have already assigned.
5. Import the MyBOECert.crt file created earlier:
287
2011-05-06
Authentication
The certificates from SAPGENPSE are Base64-encoded. Make sure you select Base64 when
importing them:
6. To add the BI platform certificate to the SAP server's PSE certificate list, click the Add to certificate
list button.
7. To add SAP's certificate to BI platform's PSE, double-click the SAP certificate.
8. Save your changes in STRUST.
9. Click the Export button and provide a file name for the certificate.
For example, MySAPCert.crt.
Note:
The format should remain Base64.
10. Go to transaction SNC0.
11. Add a new entry, where:
• The System ID is arbitrary but reflects your BI platform system.
• The SNC name should be the DN (prefixed by p:) that you provided when you created your BI
platform PSE (in step 2).
• The Entry for RFC activated and Entry for ext. ID activated check boxes are both selected:
12. To add the exported certificate to the BI platform PSE, run the following command on the command
prompt:
sapgenpse.exe maintain_pk -v -a MySAPCert.crt -p BOE.pse
The SAP Cryptographic Library is installed on the BI platform machine. You have created a PSE that
will be used by BI platform servers to identify themselves to SAP servers. SAP and the BI platform PSE
have exchanged certificates. SAP permits entities with access to the BI platform PSE to perform RFC
calls and password-less impersonation.
Related Topics
• To configure BI platform servers
7.5.6.3.3 To configure BI platform servers
After you generate a PSE for BI platform, you must configure an appropriate server structure for SAP
processing. The following procedure creates a node for SAP processing servers, so that you can set
operating system credentials on the node level.
Note:
In this version of BI platform, servers are no longer configured in the Central Configuration Manager
(CCM). Instead, a new Server Intelligence Agent (SIA) must be created.
1. In the CCM, create a new node for SAP processing servers.
Give the node an appropriate name such as SAPProcessor.
2. In the CMC, add the processing servers you need to the new node, then start the new servers.
288
2011-05-06
Authentication
7.5.6.3.4 To configure PSE access
After you configure the BI platform node and servers, you need to configure PSE access using the
SAPGENPSE tool.
1. Run the following command from the command prompt:
sapgenpse.exe seclogin -p SBOE.pse
Note:
You will be prompted for the PSE PIN. If you run the tool under the same credentials used by your
BI platform SAP processing servers, you do not need to specify a user name.
2. To verify that the single sign-on (SSO) link is established, list the contents of the PSE using the
following command:
sapgenpse.exe maintain_pk -l
The results should look similar to the following:
C:\Documents and Settings\hareskoug\Desktop\sapcrypto.x86\ntintel>sapgenpse.exe
maintain_pk -l
maintain_pk for PSE "C:\Documents and Settings\hareskoug\My Documents\snc\sec\bobjsapproc.pse"
*** Object <PKList> is of the type <PKList_OID> ***
1. ------------------------------------------------------------Version:
0 (X.509v1-1988)
SubjectName:
CN=R21Again, OU=PG, O=BOBJ, C=CA
IssuerName:
CN=R21Again, OU=PG, O=BOBJ, C=CA
SerialNumber:
00
Validity - NotBefore:
Wed Nov 28 16:23:53 2007 (071129002353Z)
NotAfter:
Thu Dec 31 16:00:01 2037 (380101000001Z)
Public Key Fingerprint:
851C 225D 1789 8974 21DB 9E9B 2AE8 9E9E
SubjectKey:
Algorithm RSA (OID 1.2.840.113549.1.1.1), NULL
C:\Documents and Settings\hareskoug\Desktop\sapcrypto.x86\ntintel>
You should not be prompted again for the PSE PIN after a successful seclogin command.
Note:
If you encounter PSE access problems, use the -O to specify PSE access. For example, to grant
PSE access to a specific user in a specific domain, type:
sapgenpse seclogin -p SBOE.pse -O <domain\user>
7.5.6.3.5 To configure SAP authentication SNC settings
After you configure PSE access, you need to configure the SAP authentication settings in the CMC.
1. Go to the "Authentication" management area of the CMC.
2. Double-click the SAP link.
The entitlement systems settings appear.
3. Click the SNC settings tab on the SAP Authentication page.
4. Select your entitlement system from the Logical system name list.
5. Select Enable Secure Network Communication (SNC) under Basic Settings.
289
2011-05-06
Authentication
6. Enter the path for the SNC library settings in SNC library path.
Note:
This step is necessary even though the library is already defined in the SNC_LIB environment
variable.
7. Select a level of protection under Quality of Protection.
For example select Authentication.
Note:
Make sure you do not exceed the level of protection configured on the SAP system. The level of
protection is customizable and is determined by your organization's needs and the capabilities of
their SNC library.
8. Enter the SNC name of the SAP system under Mutual authentication settings.
The SNC name format depends on the SNC library. Using the SAP cryptography library, the
distinguished name recommendation is that it follows LDAP naming conventions. It must be have
"p:" as its prefix.
9. Ensure that the SNC name of the credentials under which BI platform servers run appears in the
SNC name of Enterprise system field.
Note:
When several SNC names are configured, this field should be left blank.
10. Provide the DNs of both the SAP system and the BI platform PSE.
7.5.6.3.6 Using server groups
Unless the processing (Crystal Reports or Web Intelligence) servers are running under credentials that
have access to the PSE, you must create a specific server group containing only these servers along
with the required supporting servers. For more information and descriptions of the various BI platform
servers, see the “Architecture” chapter.
There are three options to choose from when configuring content processing servers for your SAP
content:
1. Maintain a single SIA, including all BI platform servers, running under credentials that have access
to the PSE. This is the simplest option - no server groups need to be created. This approach is the
least secure in that an unnecessary number of servers have access to the PSE.
2. Create a second SIA with access to the PSE and add to it the Crystal report or Interactive processing
servers. Delete the duplicated servers from the original SIA. No server groups need to be created
but less servers have access to the PSE.
3. Create a SIA exclusively for use for SAP with access to the PSE. Add to it the Crystal report or Web
Intelligence processing servers. In the approach, only SAP content should run on these servers,
and more importantly SAP content should only run on these servers. Since in this scenario content
needs to be directed to certain servers, you must create server groups for the SIA.
Guidelines for using a server group
The server group needs to reference the SIA used exclusively to handle SAP content. In addition, the
server group needs to reference the following servers:
290
2011-05-06
Authentication
•
•
•
Adaptive Servers
Publication Servers
Destination Job Servers
All SAP content, Web Intelligence documents, and Crystal reports need to be associated with the server
group using the strictest association; that is, that they must run on servers in the group. When this
association is done on an object level, the server group setting should be propagated into settings for
both direct scheduling as well as for publications.
To prevent other (non-SAP) content from processing on the SAP-specific processing servers, you
should create another server group that includes all the servers under the original SIA. It is recommended
that you set up a strict association between this content and the non-SAP server group.
7.5.6.4 Configuring multi-pass publications
Troubleshooting multi-pass publications
If you encounter problems with multi-pass publications, enable tracing for the Crystal Reports (CR) or
Multidimensional Data Access (MDA) drivers for SAP and look at the logon string used for each job or
recipient. These logon strings should resemble the following:
SAP: Successfully logged on to SAP server.
Logon handle: 1. Logon string: CLIENT=800 LANG=en
ASHOST="vanrdw2k107.sap.crystald.net" SYSNR=00 SNC_MODE=1 SNC_QOP=1
SNC_LIB="C:\WINDOWS\System32\sapcrypto.dll"
SNC_PARTNERNAME="p:CN=R21Again, OU=PG, O=BOBJ, C=CA" EXTIDDATA=HENRIKRPT3 EXTIDTYPE=UN
The logon string must have the appropriate EXTIDTYPE=UN (for username) and EXTIDDATA should
be the SAP username of the recipient. In this example, the logon attempt was successful.
7.5.6.5 Workflow for integrating with Secure Network Communication
BI platform supports environments that implement Secure Network Communication (SNC) for
authentication and data encryption between SAP components. If you have deployed the SAP
Cryptographic Library (or another external security product that uses the SNC interface) you must set
some additional values to integrate BI platform effectively within your secured environment.
To configure the platform to use your secure network communication, you must complete the following
tasks:
1. Configure BI platform servers to start and run under an appropriate user account.
2. Configure the SAP system to trust your BI platform system.
3. Configure the SNC settings in the SNC link in the Central Management Console.
291
2011-05-06
Authentication
4. Import SAP roles and users into BI platform.
Related Topics
• Importing SAP roles
• Configuring SAP for server-side trust
• Configuring BI platform for server-side trust
7.5.6.6 To configure the SNC settings in the Central Management Console
Before you can configure SNC settings you need to add a new entitlement system in BI platform. You
must also copy the SNC library file to a known directory and create an environment variable RFC_LIB
to point to this file.
1. Click the SNC settings tab on the SAP Authentication page.
2. Select your entitlement system from the Logical system name list.
3. Select Enable Secure Network Communication (SNC) under Basic Settings.
4. Enter the path for the SNC library settings in SNC library path.
Note:
The application server and the CMS must be on the same OS type with the same path to the crypto
library.
5. Select a level of protection under Quality of Protection.
For example select Authentication.
Note:
The level of protection is customizable and is determined by your organization's needs and the
capabilities of their SNC library.
6. Enter the SNC name of the SAP system under Mutual authentication settings.
The SNC name format depends on the SNC library. Using the SAP cryptography library, the
distinguished name recommendation is that it follows LDAP naming conventions. It must be have
"p:" as its prefix.
7. Ensure that the SNC name of the credentials under which BI platform servers run appears in the
SNC name of Enterprise system field.
Note:
In scenarios where several SNC names are configured, this field should be left blank.
8. Click Update.
9. Click the Entitlement systems tab on the SAP Authentication page.
10. There is now another field under the Language field called SNC name.
292
2011-05-06
Authentication
11. In the optional SNC name field, type the SNC name that you configured on the SAP BW server.
This name should be the same one used to configure the SAP system to trust BI platform.
Related Topics
• Connecting to SAP entitlement systems
7.5.6.7 To associate the entitlement user with an SNC name
1. Log on to your SAP BW system and execute the transaction SU01.
The User Maintenance: Initial Screen opens.
2. In the User field, type the name of the SAP account designated as the entitlement user and then
click Change on the toolbar.
The Maintain User screen opens.
3. Click the SNC tab.
4. In the SNC name field, type the SNC USER ACCOUNT you entered in step 4 above.
5. Click Save.
7.5.6.8 To add a system ID to the SNC Access Control list
1. Log on to your SAP BW system and execute the transaction SNC0.
The Change View "SNC: Access Control List (ACL) for Systems: Overview" screen opens.
2. Click New Entries on the toolbar.
The New Entries: Details of Added Entries screen opens.
3. Type the name of your BI platform machine in the System ID field.
4. Type p:<SNC USER NAME> in the SNC user name field where SNC USER NAME represents the
account you used when configuring the BI platform servers.
Note:
If your SNC provider is gssapi32.dll, use uppercase letters when indicating the SNC USER NAME.
You must include the domain name when specifying the user account. For example:
domain\username.
5. Select Entry for RFC activated and Entry for ext. ID activated.
6. Clear all other options and click Save.
293
2011-05-06
Authentication
7.5.7 Setting up single sign-on to the SAP system
To enable single sign-on to the SAP system, you need to create a keystore file and a corresponding
certificate. Use the keytool command line program to generate the file and the certificate. By default
the keytool program is installed in the sdk/bin directory for each platform.
The certificate needs to be added to your SAP ABAP BW system, and BI platform using the CMC.
Note:
The SAP authentication plugin must configured before you can set up single sign-on to the SAP database.
7.5.7.1 To generate the keystore file
The PKCS12Tool program is used to generate keystore files and certificates that are required for setting
up single sign-on to the SAP database. The following table lists the default locations for the
PKCS12Tool.jar for each supported platform:
Platform
Default location
Windows
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\java\lib
Unix
sap_bobj/enterprise_xi40/java/lib
1. Launch a command prompt and navigate to the directory where the PKCS12Tool program is located
2. To generate the keystore file with default settings run the following command:
java -jar PKCS12Tool.jar
The files cert.der and keystore.p12 are generated in the same directory. The files contain the
following default values:
294
2011-05-06
Authentication
Parameter
Default
-keystore
keystore.p12
-alias
myalias
-storepass
123456
-dname
CN=CA
-validity
365
-cert
cert.der
Tip:
To override the default values, run the tool together with the -? parameter. The following message
is displayed:
Usage: PKCS12Tool <options>
-keystore <filename(keystore.p12)>
-alias <key entry alias(myalias)>
-storepass <keystore password(123456)>
-dname <certificate subject DN(CN=CA)>
-validity <number of days(365)>
-cert <filename (cert.der)>
(No certificate is generated when importing a keystore)
-disablefips
-importkeystore <filename>
You can use the parameters to override the default values.
7.5.7.2 To export the public key certificate
You need to create and export a certificate for the keystore file.
1. Launch a command prompt and navigate to the directory where the keytool program is located
2. To export a key certificate for the keystore file use the following command:
keytool -exportcert -keystore <keystore> -storetype pkcs12 -file <filename>
-alias <alias>
Replace <keystore> with the name of the keystore file.
Replace <filename> with the name of the certificate.
Replace <alias> with the alias used to create the keystore file.
3. When prompted, enter the password you provided for the keystore file.
You now have a keystore file and a certificate in the directory where the keytool program is located.
295
2011-05-06
Authentication
7.5.7.3 Importing the certificate file into the target ABAP SAP system
You need a key store file and an associated certificate for your BI platform deployment to perform the
following task.
Note:
This action can only be performed on an ABAP SAP system.
1. Connect to your SAP ABAP BW system using the SAP GUI.
Note:
You should connect as a user with administrative privileges.
2. Execute STRUSTSSO2 in the SAP GUI.
The system is prepared for importing the certificate file.
3. Go to the Certificate tab.
4. Ensure the Use Binary option check box is selected.
5. Click the file path button to point to the location where the certificate file is located.
6. Click the green check mark.
The certificate file is uploaded.
7. Click Add to Certificate List.
The certificate is displayed in the Certificate List.
8. Click Add to ACL and the specify a SystemID and Client.
The system ID must be the same used to identify the BI platform system to SAP BW.
The certificate is added to the Access Control List (ACL). The client should be specified as “000”.
9. Save your setting and exit.
The changes are saved in the SAP system.
7.5.7.4 To set up single sign-on to the SAP database in the CMC
To perform the following procedure you need to access the SAP security plugin using an administrator
account.
1. Go to the "Authentication" management area of the CMC.
2. Double-click the SAP link and then click the Options tab.
If no certificate has been imported the following message should be displayed in the "SAP SSO
Service" section:
No key store file has been uploaded
296
2011-05-06
Authentication
3. Specify System ID for your BI platform system in the field provided.
This should be identical to the value used when importing the certificate in the target SAP ABAP
system.
4. Click the Browse button to point to the key store file.
5. Provide the following required details:
Field
Required information
"Key Store Password"
Provide the password required to access the key store file. This password was
specified when creating the key store file.
"Private Key Pass- Provide the password required to access the certificate corresponding to the
word"
key store file. This password was specified when creating the certificate for
the key store file.
"Private Key Alias" Provide the alias required to access the key store file. This alias was specified
when creating the key store file.
6. Click Update to submit your settings.
Once the settings are submitted successfully, the following message is displayed under the SystemID
field:
Key store file have been uploaded
7.5.7.5 To add the Security Token Service to the Adaptive Processing Server
In a clustered environment, the Security Token Services added separately to each Adaptive Processing
Server.
1. Go to the "Servers" management area of the CMC.
2. Double-click Core Services.
The list of servers under "Core Services" is displayed.
3. Right-click the Adaptive Processing Server and select Stop.
Do not proceed until the Server status is marked as "Stopped".
4. Right-click the Adaptive Processing Server and choose Select Services.
The "Select Services" dialog box is displayed.
5. Move the Security Token Services from the list of Available services to the "Services" list on the
right.
Use the Add to selection button to move the selection.
6. Click OK.
7. Restart the Adaptive Processing Server.
297
2011-05-06
Authentication
7.5.8 Configuring SSO for SAP Crystal Reports and SAP NetWeaver
By default, BI platform will be configured to allow SAP Crystal Reports users to access SAP data using
Single Sign-on (SSO).
7.5.8.1 To deactivate SSO for SAP NetWeaver and SAP Crystal Reports
1. In the Central Management Console (CMC), click Applications.
2. Double-click Crystal Reports Configuration.
3. Click Single Sign-On Options.
4. Select one of the following drivers:
Driver
Display name
Operational Data Store driver
crdb_ods
Open SQL driver
crdb_opensql
Infoset driver
crdb_infoset
BW MDX Query driver
crdb_bwmdx
5. Click Remove.
6. Click Save & Close.
7. Restart SAP Crystal Reports.
7.5.8.2 To reactivate SSO for SAP NetWeaver and SAP Crystal Reports
Follow the steps below to reactivate SSO for SAP NetWeaver (ABAP) and SAP Crystal Reports.
1. In the Central Management Console (CMC), click Applications.
2. Double-click Crystal Reports Configuration.
3. Click Single Sign-On Options.
4. Under "Use SSO context for database logon" type:
298
2011-05-06
Authentication
crdb_ods
To activate the ODS driver
crdb_opensql
To activate the Open SQL driver
crdb_bwmdx
To activate the SAP BW MDX Query driver
crdb_infoset
To activate the InfoSet driver
5. Click Add.
6. Click Save & Close.
7. Restart SAP Crystal Reports.
7.6 PeopleSoft authentication
7.6.1 Overview
To use your PeopleSoft Enterprise data with the BI platform, you must provide the program with
information about your deployment. This information allows the BI platform to authenticate users so
that they can use their PeopleSoft credentials to log on to the program.
7.6.2 Enabling PeopleSoft Enterprise authentication
To allow PeopleSoft Enterprise information to be used by the BI platform, the BI platform needs
information on how to authenticate into your PeopleSoft Enterprise system.
7.6.2.1 To enable PeopleSoft Enterprise authentication in the BI Platform
1. Log on as an administrator to the Central Management Console.
2. From the Manage area, click Authentication.
3. Double-click PeopleSoft Enterprise.
The "PeopleSoft Enterprise" page appears. It has four tabs: Options, Domains, Roles, and User
Update.
299
2011-05-06
Authentication
4. On the Options tab, select the Enable PeopleSoft Enterprise Authentication check box.
5. Make appropriate changes under New Alias, Update Options, and New User Options according
to your BI platform deployment. Click Update to save your changes before proceeding to the Systems
tab.
6. Click the Servers tab.
7. In the "PeopleSoft Enterprise System User" area, type a database User name and Password for the
BI platform to use to log on to your PeopleSoft Enterprise database.
8. In the "PeopleSoft Enterprise Domain" area, enter the Domain name and QAS address used to
connect to your PeopleSoft Enterprise environment, and click Add.
Note:
If you have multiple PeopleSoft domains, repeat this step for any additional domains you want to
have access to. The first domain you enter will become the default domain.
9. Click Update to save your changes.
7.6.3 Mapping PeopleSoft roles to the BI Platform
The BI platform automatically creates a group for each PeopleSoft role that you map. As well, the
program creates aliases to represent the members of the mapped PeopleSoft roles.
You can create a user account for each alias that is created.
However, if you run multiple systems, and your users have accounts in more than one of the systems,
then you can assign each user to an alias with the same name before you create the accounts in the
BI platform.
Doing so reduces the number of accounts that are created for the same user in the BI platform.
For example, if you run PeopleSoft HR 8.3 and PeopleSoft Financials 8.4, and 30 of your users have
access to both systems, then only 30 accounts are created for those users. If you choose not to assign
each user to an alias with the same name, then 60 accounts are created for the 30 users in the BI
platform.
However, if you run multiple systems, and user names overlap, then you must create a new member
account for each alias that is created.
For example, if you run PeopleSoft HR 8.3 with a user account for Russell Aquino (user name "raquino"),
and you run PeopleSoft Financials 8.4 with a user account for Raoul Aquino (user name "raquino"),
then you need to create a separate account for each user's alias. Otherwise, the two users are added
to the same the BI platform account; they will be able to log in to the BI platform with their own PeopleSoft
credentials and have access to data from both PeopleSoft systems.
300
2011-05-06
Authentication
7.6.3.1 To map a PeopleSoft role to the BI Platform
1. Log on as an administrator to the Central Management Console.
2. Click Authentication.
3. Double-click PeopleSoft Enterprise for PeopleTools.
4. On the Roles tab, in the PeopleSoft Enterprise Domains area, select the domain associated with
the role you want to map to the BI platform.
5. Use one of the following options to select the roles you want to map:
• In the PeopleSoft Enterprise Roles area, in the Search roles box, enter the role you want to locate
and map to the BI platform, and then click >.
• From the "Available Roles" list, select the role you want to map to the BI Platform and click >.
Note:
•
•
When searching for a particular user or role, you can use the wild card %. For example, to search
for all roles beginning with "A," type A%. Search is also case sensitive.
If you want to map a role from another domain, you must select the new domain from the list of
available domains to match a role from a different domain.
6. To enforce group and user synchronization between the BI platform and PeopleSoft, check the
Force user synchronization check box. To remove already imported PeopleSoft groups from the
BI platform, leave the Force user synchronization check box unchecked.
7. In the "New Alias Options" area, select one of the following options:
• Assign each added alias to an account with the same name
Select this option if you run multiple PeopleSoft Enterprise systems with users who have accounts
on more than one system (and no two users have the same user name for different systems).
•
Create a new account for every added alias
Select this option if you run only one PeopleSoft Enterprise, if the majority of your users have
accounts on only one of your systems, or if the user names overlap for different users on two or
more of your systems.
8. In the Update Options area, select one of the following options:
•
New aliases will be added and new users will be created
Select this option to create a new alias for every user that is mapped to the BI platform. New
accounts are added for users without the BI platform accounts or for all users if you selected the
Create a new account for every added alias option.
•
No new aliases will be added and new users will not be created
Select this option if the role that you want to map contains many users, but only a few of them
will use the BI platform. The platform does not automatically create aliases and accounts for the
301
2011-05-06
Authentication
users. Instead, it creates aliases (and accounts, if required) only for users when they log on to
the BI platform for the first time. This is the default option.
9. In the New User Options area specify how new users are created.
If your the SAP BusinessObjects Business Intelligence platform license is based on users roles,
select one of the following options:
• New users are created as BI Viewer
New user accounts are configured under the BI Viewer role. Access to the BI platform applications
for all accounts under the BI Viewer role is defined in the license agreement. Users are restricted
to access application workflows that are defined for the BI Viewer role. Access rights are generally
limited to viewing business intelligence documents. This role is typically suitable for users who
consume content through the BI platform applications.
•
New users are created as BI Analyst New user accounts are configured under the BI Analyst
role. Access to the BI platform applications for all accounts under the BI Analyst role is defined
in the license agreement. Users can access all applications workflows that are defined for the BI
Analyst role. Access rights include viewing and modifying business intelligence documents. This
role is typically suitable for users who create and modify content for the BI platform applications.
If your the SAP BusinessObjects Business Intelligence platform license is not based on users roles,
select one of the following options:
•
New users are created as named users.
New user accounts are configured to use named user licenses. Named user licenses are
associated with specific users and allow people to access the system based on their user name
and password. This provides named users with access to the system regardless of how many
other people are connected. You must have a named user license available for each user account
created using this option.
•
New users are created as concurrent users.
New user accounts are configured to use concurrent user licenses. Concurrent licenses specify
the number of people who can connect to the BI platform at the same time. This type of licensing
is very flexible because a small concurrent license can support a large user base. For example,
depending on how often and how long users access the BI platform, a 100 user concurrent license
could support 250, 500, or 700 users.
The roles that you selected now appear as groups in the BI platform.
7.6.3.2 Remapping consideration
If you add users to a role that has already been mapped to the BI platform, you need to remap the role
to add the users to the BI platform. When you remap the role, the option to map users as either named
users or concurrent users affects only the new users that you added to the role.
302
2011-05-06
Authentication
For example, you first map a role to the BI platform with the "New users are created as named users"
option selected. Later, you add users to the same role and remap the role with the "New users are
created as concurrent users" option selected.
In this situation, only the new users in the role are mapped to the BI platform as concurrent users; the
users that were already mapped remain named users. The same condition applies if you first map users
as concurrent users, and then you change the settings to remap new users as named users.
7.6.3.3 To unmap a role
1. Log on as an administrator to the Central Management Console.
2. Click Authentication.
3. Click PeopleSoft Enterprise.
4. Click Roles.
5. Select the role that you want to remove, and click <.
6. Click Update.
Members of the role will no longer be able to access the BI platform, unless they have other accounts
or aliases.
Note:
You can also delete individual accounts or remove users from roles before you map them to the BI
platform to prevent specific users from logging on.
7.6.4 Scheduling user updates
To ensure changes to your user data for your ERP system are reflected in your BI platform user data,
you can schedule regular user updates. These updates will automatically synchronize your ERP and
BI platform users according to the mapping settings you have configured in the Central Management
Console (CMC).
There are two options for running and scheduling updates for imported roles:
•
•
303
Update roles only: using this option will update only the links between the currently mapped roles
that have been imported in BI platform. Use this option if you expect to run frequent updates, and
you are concerned about system resource usage. No new user accounts will be created if you only
update roles.
Update roles and aliases: this option not only updates links between roles but will also create new
user accounts in BI platform for new user aliases added to the ERP system.
2011-05-06
Authentication
Note:
If you have not specified to automatically create user aliases for updates when you enabled
authentication, no accounts will be created for new aliases.
7.6.4.1 To schedule user updates
After you map roles into BI platform, you need to specify how the system updates these roles.
1. Click the User Update tab.
2. Click Schedule in either the "Update Roles Only" or "Update Roles and Aliases" sections.
Tip:
If you want to run an update immediately click Update Now.
Tip:
Use the "Update Roles Only" option if you would like frequent updates and are concerned about
system resources. It takes the system longer to update both roles and aliases.
The "Recurrence" dialog box is displayed.
3. Select an option from the "Run Object" list and provide all the requested scheduling information.
When scheduling an update, you can choose from the recurrence patterns summarized in the
following table:
304
Recurrence pattern
Description
Hourly
The update will run every hour. You specify at what time it will
start, as well as a start and end date.
Daily
The update will run every day or run every number of specified
days. You can specify at what time it will run, as well as a start
and end date.
Weekly
The update will run every week. It can be run once a week or
several times a week. You can specify on which days and at
what time it will run, as well as a start and end date.
Monthly
The update will run every month or every several months. You
can what time it will run, as well as a start and end date.
Nth Day of Month
The update will run on a specific day in the month. You can
specify on which day of the month, what time it will run, as well
as a start and end date.
1st Monday of Month
The update will run on the first Monday of each month. You
can specify what time it will run, as well as a start and end date.
2011-05-06
Authentication
Recurrence pattern
Description
Last Day of Month
The update will run on the last day of each month. You can
specify what time it will run, as well as a start and end date.
X Day of Nth Week of the Month
The update will run on a specified day of a specified week of
the month. You can specify what time it will run, as well as a
start and end date.
Calendar
The update will run on the dates specified in a calendar that
has previously been created.
4. Click Schedule after you have finished providing the scheduling information.
The date of the next scheduled role update is displayed in the User Update tab.
Note:
You can always cancel the next scheduled update by clicking Cancel Scheduled Updates in either
the "Update Roles Only" or "Update Roles and Aliases" sections.
7.6.5 Using the PeopleSoft Security Bridge
The Security Bridge feature of the BI Platform allows you to import PeopleSoft EPM security settings
to the BI Platform.
The Security Bridge operates in two modes:
•
Configuration mode
In configuration mode, the Security Bridge provides an interface that enables you to create a response
file. This response file is what governs the behavior of the Security Bridge during execution mode.
•
Execution mode
Based on the parameters that you define in the response file, the Security Bridge imports the security
settings of dimension tables in PeopleSoft EPM to universes in the BI Platform.
7.6.5.1 Importing security settings
To import the security settings, you must do the following tasks in order:
305
•
Define the objects that the Security Bridge will manage.
•
Create a response file.
2011-05-06
Authentication
•
Run the Security Bridge application.
For information about managing security after you import the settings, see the Managing security settings
section.
7.6.5.1.1 Defining managed objects
Before you run the Security Bridge, it is important to determine the objects that are managed by the
application. The Security Bridge manages one or more PeopleSoft roles, a BI Platform group, and one
or more universes.
•
Managed PeopleSoft roles
These are roles in your PeopleSoft system. Members of these roles work with PeopleSoft data
through PeopleSoft EPM. You must choose the roles that include the members for whom you want
to provide/update access privileges to the managed universes in the BI Platform.
The access rights that are defined for the members of these roles are based on their rights in
PeopleSoft EPM; the Security Bridge imports these security settings to the BI Platform.
•
Managed BI Platform group
When you run the Security Bridge, the program creates a user in the BI Platform for each member
of a managed PeopleSoft role.
The group in which the users are created is the managed BI Platform group. Members of this group
are the users whose access rights to the managed universes are maintained by the Security Bridge.
Because the users are created in one group, you can configure the Security Bridge not to update
the security settings for certain users simply by removing users from the managed BI Platform group.
Before you run the Security Bridge, you must choose a group in the BI Platform to be the location
where the users are created. If you specify a group that does not exist, the Security Bridge will create
the group in BI Platform.
•
Managed universes
Managed universes are the universes to which the Security Bridge imports security settings from
PeopleSoft EPM. From the universes that are stored in your BI Platform system, you must choose
which ones are to be managed by the Security Bridge. Members of managed PeopleSoft roles who
are also members of the managed BI Platform group cannot access any data through these universes
that they cannot access from PeopleSoft EPM.
7.6.5.1.2 To create a response file
1. Go to the folder that you specified during the installation of the Security Bridge, and run the
crpsepmsecuritybridge.bat (in Windows) and crpsepmsecuritybridge.sh (in Unix) file.
Note:
In Windows, by default, this location is C:\Program Files\Business Objects\BusinessObjects 12.0
Integration Kit for PeopleSoft\epm
The Security Bridge for PeopleSoft EPM dialog box appears.
306
2011-05-06
Authentication
2. Select New to create a response file, or select Open and click Browse to specify a response file
that you want to modify. Select the language you want for the file.
3. Click Next.
4. Provide the locations of the PeopleSoft EPM SDK and the BI Platform SDK .
Note:
•
•
The PeopleSoft EPM SDK is typically located on the PeopleSoft server at
<PS_HOME>/class/com.peoplesoft.epm.pf.jar.
The BI Platform SDK is typically located at C:\Program Files (x86)\SAP BusinessObjects\SAP
BusinessObjects Enterprise XI 4.0\java\lib.
5. Click Next.
The dialog box prompts you for connection and driver information for the PeopleSoft database.
6. From the Database list, select the appropriate database type, and provide the information for the
following fields:
Field
Description
Database
The name of the PeopleSoft database.
Host
The name of the server that hosts the database.
Port number
The port number for accessing the server.
Class location
The location of the class files for the database
driver.
User name
Your user name.
Password
Your password.
7. Click Next.
The dialog box displays a list of all the classes that the Security Bridge will use to run. If necessary,
you can add to or remove classes from the list.
8. Click Next.
The dialog box prompts you for connection information for the BI Platform.
9. Provide the appropriate information for the following fields:
307
2011-05-06
Authentication
Field
Description
Server
The name of the server where the Central
Management Server (CMS) is located.
User name
Your user name.
Password
Your password.
Authentication
Your authentication type.
10. Click Next.
11. Choose a BI Platform group, and click Next.
Note:
•
•
The group that you specify in this field is where the Security Bridge creates users for the members
of the managed PeopleSoft roles.
If you specify a group that does not already exist, it will be created by the Security Bridge.
The dialog box displays a list of roles from your PeopleSoft system.
12. Select the Imported option for the roles that you want the Security Bridge to manage, and click
Next.
Note:
The Security Bridge creates a user in the managed the BI Platform group (which you specified in
the previous step) for each member of the role(s) that you select.
The dialog box displays a list of universes in the BI Platform.
13. Select the universe(s) to which you want the Security Bridge to import security settings, and click
Next.
14. Specify a filename for the Security Bridge log file and a location where the log file will be saved. You
can use the log file to determine whether or not the Security Bridge is successful in importing the
security settings from PeopleSoft EPM.
15. Click Next.
The dialog box displays a preview of the response file that the Security Bridge will use during
execution mode.
16. Click Save, and choose a location where you want to save the response file.
17. Click Next.
You have successfully created the response file for the Security Bridge.
18. Click Exit.
308
2011-05-06
Authentication
Note:
The response file is a Java property file that you can also create and/or modify manually. For more
details, see the “PeopleSoft response file” section.
7.6.5.2 Applying the security settings
To apply the security settings, run the crpsepmsecuritybridge.bat (in Windows) or the
crpsempsecuritybridge.sh file (in UNIX), and use the response file that you created as an
argument. (For example, type crpsepmsecuritybridge.bat (Windows) or crpsempsecurity
bridge.sh (unix) myresponsefile.properties.)
The Security Bridge application runs. It creates users in the BI Platform for the members of the PeopleSoft
roles that you specified in the response file and imports the security settings from PeopleSoft EPM to
the appropriate universes.
7.6.5.2.1 Mapping considerations
During execution mode, the Security Bridge creates a user in the BI Platform for each member of a
managed PeopleSoft role.
The users are created to have only Enterprise authentication aliases, and the BI Platform assigns
random passwords to these users. As a result, the users cannot log on to the BI Platform until the
administrator manually reassigns new passwords or maps the role(s) to the BI Platform through the
PeopleSoft Security Plug-in to allow the users to log on by using their PeopleSoft credentials.
7.6.5.3 Managing security settings
You can manage the security settings that you applied by modifying the objects that are managed by
the Security Bridge.
7.6.5.3.1 Managed users
The Security Bridge manages users based on the following criteria:
•
Whether or not the user is a member of a managed PeopleSoft role.
•
Whether or not the user is a member of the managed the BI Platform group.
If you want to enable a user to access PeopleSoft data through universes in the BI Platform, ensure
that the user is a member of both a managed PeopleSoft role and the managed the BI Platform group.
309
2011-05-06
Authentication
•
For members of managed PeopleSoft roles who do not have accounts in the BI Platform, the Security
Bridge creates accounts and assigns random passwords to them. The administrator must decide
whether or not to reassign new passwords manually or map the roles to the BI Platform through the
PeopleSoft Security Plug-in to allow the users to log on to the BI Platform.
•
For members of managed PeopleSoft roles who are also members of the managed BI Platform
group, the Security Bridge updates the security settings that are applied to the users so that they
have access to the appropriate data from the managed universes.
If a member of a managed PeopleSoft role has an existing account in the BI Platform, but he or she is
not a member of the managed BI Platform group, then the Security Bridge does not update the security
settings that are applied to the user. Typically, this situation occurs only when the administrator manually
removes user accounts that have been created by the Security Bridge from the managed BI Platform
group.
Note:
This is an effective method for managing security: by removing users from the managed BI Platform
group, you can configure their security settings to be different from the security settings that they have
in PeopleSoft.
Conversely, if a member of the managed BI Platform group is not a member of a managed PeopleSoft
role, then the Security Bridge does not provide them with access to the managed universes. Typically,
this situation occurs only when PeopleSoft administrators remove users who have been previously
mapped to the BI Platform by the Security Bridge from the managed PeopleSoft role(s).
Note:
This is another method for managing security: by removing users from managed PeopleSoft roles, you
can ensure that the users have no access to data from PeopleSoft.
7.6.5.3.2 Managed universes
The Security Bridge manages universes through restriction sets, which limit the data that managed
users can access from the managed universes.
Restriction sets are groups of restrictions (for example, restrictions to Query Controls, SQL Generation,
and so on). The Security Bridge applies/updates Row Access and Object Access restrictions for the
managed universes:
•
•
It applies Row Access restrictions to dimension tables that are defined in PeopleSoft EPM. These
restrictions are user-specific and can be configured to one of the following settings:
•
The user has access to all of the data.
•
The user has access to none of the data.
•
The user has access to data based on their row-level permissions in PeopleSoft, which are
exposed through the Security Join Tables (SJT) that are defined in PeopleSoft EPM.
It applies Object Access restrictions to measure objects based on the fields that are accessed by
the measure objects.
If a measure object accesses fields that are defined as metrics in PeopleSoft, then access to the
measure object is allowed/disallowed depending on whether or not the user can access the referenced
310
2011-05-06
Authentication
metrics in PeopleSoft. If a user cannot access any of the metrics, then access to the measure object
is denied. If the user can access all of the metrics, then access to the measure object is granted.
As an administrator, you can also limit the data that users can access from your PeopleSoft system by
limiting the number of universes that are managed by the Security Bridge.
7.6.5.4 PeopleSoft response file
The Security Bridge feature of the BI Platform operates based on the settings that you specify in a
response file.
Typically, you generate the response file by using the interface that is provided by the Security Bridge
in configuration mode. However, because the file is a Java property file, you can also create or modify
it manually.
This appendix provides information about the parameters that you need to include in the response file
if you choose to generate it manually.
Note:
When you create the file, you must respect the Java property file escaping requirement (for example,
':' is escaped as '\:').
7.6.5.4.1 Response file parameters
The following table describes the parameters that are included in the response file:
Parameter
Description
The class path for loading the necessary .jar files.
Multiple class paths must be separated by a ';' on
both Windows and UNIX.
classpath
The class paths that are needed are for the
com.peoplesoft.epm.pf.jar and the JDBC
driver .jar files.
db.driver.name
311
The JDBC driver name that is used to connect to
the PeopleSoft database (for example, com.microsoft.jdbc.sqlserver.SQLServerDriver).
2011-05-06
Authentication
312
Parameter
Description
db.connect.str
The JDBC connection string that is used to con
nect to the PeopleSoft database (for example,
jdbc:microsoft:sqlserver://vanrdps
ft01:1433;DatabaseName=PRDMO)
db.user.name
The user name for logging on to the PeopleSoft
database.
db.password
The password for logging on to the PeopleSoft
database.
db.password.encrypted
The value for this parameter determines whether
the password parameter in the response file is
encrypted or not. The value can be set to either
True or False. (If no value is specified, the value
becomes False by default.)
enterprise.cms.name
The CMS in which the universes are located.
enterprise.user.name
The user name for logging on to the CMS.
enterprise.password
The password for logging on to the CMS.
enterprise.password.encrypted
The value for this parameter determines whether
the password parameter in the response file is
encrypted or not. The value can be set to either
True or False. (If no value is specified, the value
becomes False by default.)
enterprise.authMethod
The authentication method for logging on to the
CMS.
enterprise.role
The managed BI Platform group. (For more information, see Defining managed objects.)
enterprise.license
Controls the license type when importing users
from PeopleSoft. "0" sets the named user license,
"1" sets the concurrent user license.
2011-05-06
Authentication
Parameter
Description
The list of managed PeopleSoft roles. (For more
information, see Defining managed objects.)
n is an integer, and each entry occupies a property with the peoplesoft.role prefix.
peoplesoft.role.n
Note:
n is 1 based.
You can use '*' to denote all available PeopleSoft
roles, given that n is 1, and it is the only property
that has peoplesoft.role as the prefix in the response file.
The list of universes that you want the Security
Bridge to update. (For more information, see
Defining managed objects.)
n is an integer, and each entry occupies a property with the mapped.universe prefix.
mapped.universe.n
Note:
n is 1 based.
You can use '*' to denote all available universes,
given that n is 1, and it is the only property that
has mapped.universe as the prefix in the response file.
log4j.appender.file.File
313
The log file that is written by the Security Bridge.
2011-05-06
Authentication
Parameter
Description
Default log4j properties that are required for log4j
to function properly:
log4j.rootLogger=INFO, file, stdout
log4j.appender.file=org.apache.log4j.RollingFile
Appender
log4j.appender.file.layout=org.apache.log4j.Pat
ternLayout
log4j.appender.file.MaxFileSize=5000KB
log4j.*
log4j.appender.file.MaxBackupIndex=100
log4j.appender.file.layout.ConversionPattern=%d
[ %-5 ] %c{1} - %m%n
log4j.appender.stdout=org.apache.log4j.Con
soleAppender
log4j.appender.stdout.layout=org.apache.log4j.Pat
ternLayout
log4j.appender.stdout.layout.ConversionPat
tern=%d [ %-5 ] %c{1} - %m%n
peoplesoft classpath
The class path to the PeopleSoft EPM API .jar
files.
This parameter is optional.
The class path to the BI Platform SDK .jar files.
enterprise.classpath
This parameter is optional.
314
2011-05-06
Authentication
Parameter
Description
The PeopleSoft database type. This parameter
can have one of the following values:
Microsoft SQL Server 2000
Oracle Database 10.1
db.driver.type
DB2 UDB 8.2 Fixpack 7
Custom
Custom may be used to specify databases other
than the recognized types or versions.
This parameter is optional.
sql.db.class.location
sql.db.host
sql.db.port
sql.db.database
oracle.db.class.location
oracle.db.host
oracle.db.port
oracle.db.sid
db2.db.class.location
db2.db.host
db2.db.port
db2.db.sid
315
The location of the SQL Server JDB driver .jar
files, the SQL Server host machine, the SQL
Server port, and the SQL Server database name.
These parameter can be used only if the db.driver.type is Microsoft SQL Server 2000.
These parameters are optional.
The location of the Oracle JDBC driver .jar files,
the Oracle database host machine, the Oracle
database port, and the Oracle database SID.
These parameters can be used only if the
db.driver.type is Oracle Database 10.1.
These parameters are optional.
The location of the DB2 JDBC driver .jar files, the
DB2 database host machine, the DB2 database
port, and the DB2 database SID.
These parameters can be used only if the
db.driver.type is DB2 UDB 8.2 Fixpack 7
These parameters are optional.
2011-05-06
Authentication
Parameter
Description
custom.db.class.location
The location, name, and connection string of the
custom JDBC driver.
custom.db.drivername
custom.db.connectStr
These parameters can be used only if the
db.driver.type is Custom.
These parameters are optional.
7.7 JD Edwards authentication
7.7.1 Overview
To use your JD Edwards data with the BI platform, you must provide the system with information about
your JD Edwards deployment. This information is what allows the BI platform to authenticate users so
that they can use their JD Edwards EnterpriseOne credentials to log on to the BI platform.
7.7.2 Enabling JD Edwards EnterpriseOne authentication
To allow JD Edwards EnterpriseOne information to be used by the BI platform, Enterprise needs
information on how to authenticate into your JD Edwards EnterpriseOne system.
7.7.2.1 To enable JD Edwards authentication in the BI Platform
1. Log on as an administrator to the Central Management Console.
2. From the Manage area, click Authentication.
3. Double-click JD Edwards EnterpriseOne.
316
2011-05-06
Authentication
The "JD Edwards EnterpriseOne" page appears. It has four tabs: Options, Servers, Roles, and
User Update.
4. On the Options tab, click Enable JD Edwards EnterpriseOne Authentication check box.
5. Make appropriate changes under New Alias, Update Options, and New User Options according
to your BI platform deployment. Click Update to save your changes before proceeding to the Systems
tab.
6. Click the Servers tab.
7. In the "JD Edwards EnterpriseOne System User" area, type a database User name and Password
for the BI platform to use to log on to your JD Edwards EnterpriseOne database.
8. In the "JD Edwards EnterpriseOne Domain" area, enter the name, host, and port used to connect
to your JD Edwards EnterpriseOne environment, enter a name for the environment and click Add.
9. Click Update to save your changes.
7.7.3 Mapping JD Edwards EnterpriseOne roles to BI Platform
The BI platform automatically creates a group for each JD Edwards EnterpriseOne role that you map.
As well, the system creates aliases to represent the members of the mapped JD Edwards EnterpriseOne
roles.
You can create a user account for each alias that is created.
However, if you run multiple systems, and your users have accounts in more than one of the systems,
then you can assign each user to an alias with the same name before you create the accounts in the
BI platform.
Doing so reduces the number of accounts that are created for the same user in the BI platform.
For example, if you run a JD Edwards EnterpriseOne test environment and production environment,
and 30 of your users have access to both systems, then only 30 accounts are created for those users.
If you choose not to assign each user to an alias with the same name, then 60 accounts are created
for the 30 users in the BI platform.
However, if you run multiple systems, and user names overlap, then you must create a new member
account for each alias that is created.
For example, if you run your test environment with a user account for Russell Aquino (user name
"raquino"), and you run the production environment with a user account for Raoul Aquino (user name
"raquino"), then you need to create a separate account for each user's alias. If you do not, the two users
are added to the same BI platform account, and they will not be able to log on to the BI platform with
their own JD Edwards EnterpriseOne credentials.
317
2011-05-06
Authentication
7.7.3.1 To map a JD Edwards EnterpriseOne role
1. Log on as an administrator to the Central Management Console.
2. From the "Manage" area, click Authentication.
3. Double-click JD Edwards EnterpriseOne.
4. In the New Alias Options area, select one of the following options:
•
Assign each added alias to an account with the same name
Select this option if you run multiple JD Edwards EnterpriseOne Enterprise systems with users
who have accounts on more than one system (and no two users have the same user name for
different systems).
•
Create a new account for every added alias
Select this option if you run only one JD Edwards EnterpriseOne, if the majority of your users
have accounts on only one of your systems, or if the user names overlap for different users on
two or more of your systems.
5. In the Update Options area, select one of the following options:
•
New aliases will be added and new users will be created
Select this option to create a new alias for every user that is mapped to BI platform. New accounts
are added for users without BI platform accounts or for all users if you selected the Create a new
account for every added alias option.
•
No new aliases will be added and new users will not be created
Select this option if the role that you want to map contains many users, but only a few of them
will use BI platform. The system does not automatically create aliases and accounts for the users.
Instead, it creates aliases (and accounts, if required) only for users when they log on to BI platform
for the first time. This is the default option.
6. In the New User Options area specify how new users are created.
If your SAP BusinessObjects Business Intelligence platform license is based on users roles, select
one of the following options:
• New users are created as BI Viewer
New user accounts are configured under the BI Viewer role. Access to BI platform applications
for all accounts under the BI Viewer role is defined in the license agreement. Users are restricted
to access application workflows that are defined for the BI Viewer role. Access rights are generally
limited to viewing business intelligence documents. This role is typically suitable for users who
consume content through BI platform applications.
•
New users are created as BI Analyst
New user accounts are configured under the BI Analyst role. Access to BI platform applications
for all accounts under the BI Analyst role is defined in the license agreement. Users can access
318
2011-05-06
Authentication
all applications workflows that are defined for the BI Analyst role. Access rights include viewing
and modifying business intelligence documents. This role is typically suitable for users who create
and modify content for BI platform applications.
If your SAP BusinessObjects Business Intelligence platform license is not based on users roles,
select one of the following options:
•
New users are created as named users.
New user accounts are configured to use named user licenses. Named user licenses are
associated with specific users and allow people to access the system based on their user name
and password. This provides named users with access to the system regardless of how many
other people are connected. You must have a named user license available for each user account
created using this option.
•
New users are created as concurrent users.
New user accounts are configured to use concurrent user licenses. Concurrent licenses specify
the number of people who can connect to BI platform at the same time. This type of licensing is
very flexible because a small concurrent license can support a large user base. For example,
depending on how often and how long users access BI platform, a 100 user concurrent license
could support 250, 500, or 700 users.
The roles that you selected now appear as groups in BI platform.
7. Click the Roles tab.
8. Under Select a Server, select the JD Edwards server that contains the roles you want to map.
9. Under "Imported Roles", select the roles you want to map to BI platform and click <.
10. Click Update.
The roles will be mapped to BI platform.
7.7.3.2 Remapping consideration
If you add users to a role that has already been mapped to the BI platform, you need to remap the role
to add the users to the BI platform. When you remap the role, the option to map users as either named
users or concurrent users affects only the new users that you added to the role.
For example, you first map a role to the BI platform with the "New users are created as named users"
option selected. Later, you add users to the same role and remap the role with the "New users are
created as concurrent users" option selected.
In this situation, only the new users in the role are mapped to the BI platform as concurrent users; the
users that were already mapped remain named users. The same condition applies if you first map users
as concurrent users, and then you change the settings to remap new users as named users.
319
2011-05-06
Authentication
7.7.3.3 To unmap a role
1. Log on as an administrator to the Central Management Console.
2. From the "Manage " area, click Authentication.
3. Click the tab for JD Edwards EnterpriseOne.
4. In the "Roles" area, select the role that you want to remove, and click <.
5. Click Update.
Members of the role will no longer be able to access the BI platform, unless they have other accounts
or aliases.
Note:
You can also delete individual accounts or remove users from roles before you map them to the BI
platform to prevent specific users from logging on.
7.7.4 Scheduling user updates
To ensure changes to your user data for your ERP system are reflected in your BI platform user data,
you can schedule regular user updates. These updates will automatically synchronize your ERP and
BI platform users according to the mapping settings you have configured in the Central Management
Console (CMC).
There are two options for running and scheduling updates for imported roles:
•
•
Update roles only: using this option will update only the links between the currently mapped roles
that have been imported in BI platform. Use this option if you expect to run frequent updates, and
you are concerned about system resource usage. No new user accounts will be created if you only
update roles.
Update roles and aliases: this option not only updates links between roles but will also create new
user accounts in BI platform for new user aliases added to the ERP system.
Note:
If you have not specified to automatically create user aliases for updates when you enabled
authentication, no accounts will be created for new aliases.
7.7.4.1 To schedule user updates
320
2011-05-06
Authentication
After you map roles into BI platform, you need to specify how the system updates these roles.
1. Click the User Update tab.
2. Click Schedule in either the "Update Roles Only" or "Update Roles and Aliases" sections.
Tip:
If you want to run an update immediately click Update Now.
Tip:
Use the "Update Roles Only" option if you would like frequent updates and are concerned about
system resources. It takes the system longer to update both roles and aliases.
The "Recurrence" dialog box is displayed.
3. Select an option from the "Run Object" list and provide all the requested scheduling information.
When scheduling an update, you can choose from the recurrence patterns summarized in the
following table:
Recurrence pattern
Description
Hourly
The update will run every hour. You specify at what time it will
start, as well as a start and end date.
Daily
The update will run every day or run every number of specified
days. You can specify at what time it will run, as well as a start
and end date.
Weekly
The update will run every week. It can be run once a week or
several times a week. You can specify on which days and at
what time it will run, as well as a start and end date.
Monthly
The update will run every month or every several months. You
can what time it will run, as well as a start and end date.
Nth Day of Month
The update will run on a specific day in the month. You can
specify on which day of the month, what time it will run, as well
as a start and end date.
1st Monday of Month
The update will run on the first Monday of each month. You
can specify what time it will run, as well as a start and end date.
Last Day of Month
The update will run on the last day of each month. You can
specify what time it will run, as well as a start and end date.
X Day of Nth Week of the Month
The update will run on a specified day of a specified week of
the month. You can specify what time it will run, as well as a
start and end date.
Calendar
The update will run on the dates specified in a calendar that
has previously been created.
4. Click Schedule after you have finished providing the scheduling information.
321
2011-05-06
Authentication
The date of the next scheduled role update is displayed in the User Update tab.
Note:
You can always cancel the next scheduled update by clicking Cancel Scheduled Updates in either
the "Update Roles Only" or "Update Roles and Aliases" sections.
7.8 Siebel authentication
7.8.1 Enabling Siebel authentication
To allow Siebel information to be used by the BI platform, it needs information on how to authenticate
into your Siebel system.
7.8.1.1 To enable Siebel authentication in the BI Platform
1. Log on as an administrator to the Central Management Console.
2. From the Manage area, click Authentication.
3. Double-click Siebel.
The "Siebel" page appears. It has four tabs: Options, Systems, Responsibilities, and User Update.
4. On the Options tab, select the Enable Siebel Authentication check box.
5. Make appropriate changes under New Alias, Update Options, and New User Options according
to your BI platform deployment. Click Update to save your changes before proceeding to the Systems
tab.
6. Click the Domains tab.
7. In the Domain Name field enter the domain name for the Siebel system you want to connect to.
8. Under Connection enter the connection string for that domain.
9. In the Username area, type a database User name and Password for the BI platform to use to log
on to your Siebel database.
10. In the Password area, enter the password for the user you have selected.
11. Click Add to add the system information to your "Current Domains" list.
12. Click Update to save your changes.
322
2011-05-06
Authentication
7.8.2 Mapping roles to BI platform
The BI platform automatically creates a group for each Siebel role that you map. As well, the program
creates aliases to represent the members of the mapped Siebel roles.
You can create a user account for each alias that is created.
However, if you run multiple systems, and your users have accounts in more than one of the systems,
then you can assign each user to an alias with the same name before you create the accounts in the
BI platform.
Doing so reduces the number of accounts that are created for the same user in the program.
For example, if you run a Siebel eBusiness test environment and production environment, and 30 of
your users have access to both systems, then only 30 accounts are created for those users. If you
choose not to assign each user to an alias with the same name, then 60 accounts are created for the
30 users in the BI platform.
However, if you run multiple systems, and user names overlap, then you must create a new member
account for each alias that is created.
For example, if you run your test environment with a user account for Russell Aquino (user name
"raquino"), and you run the production environment with a user account for Raoul Aquino (user name
"raquino"), then you need to create a separate account for each user's alias. If you do not, the two users
are added to the same account, and they will not be able to log on to the BI platform with their own
Siebel eBusiness credentials.
7.8.2.1 To map a Siebel eBusiness role to BI Platform
1. Log on as an administrator to the Central Management Console.
2. Click Authentication.
3. Double-click Siebel eBusiness.
4. In the New Alias Options area, select one of the following options:
•
Assign each added alias to an account with the same name
Select this option if you run multiple Siebel eBusiness systems with users who have accounts
on more than one system (and no two users have the same user name for different systems).
•
Create a new account for every added alias
Select this option if you run only one Siebel eBusiness, if the majority of your users have accounts
on only one of your systems, or if the user names overlap for different users on two or more of
your systems.
323
2011-05-06
Authentication
5. In the Update Options area, select one of the following options:
•
New aliases will be added and new users will be created
Select this option to create a new alias for every user that is mapped to the BI platform. New
accounts are added for users without BI platform accounts or for all users if you selected the
Create a new account for every added alias option.
•
No new aliases will be added and new users will not be created
Select this option if the role that you want to map contains many users, but only a few of them
will use the BI platform. The program does not automatically create aliases and accounts for the
users. Instead, it creates aliases (and accounts, if required) only for users when they log on to
the BI platform for the first time. This is the default option.
6. In the New User Options area specify how new users are created.
If your the BI platform license is based on users roles, select one of the following options:
• New users are created as BI Viewer
New user accounts are configured under the BI Viewer role. Access to the BI platform applications
for all accounts under the BI Viewer role is defined in the license agreement. Users are restricted
to access application workflows that are defined for the BI Viewer role. Access rights are generally
limited to viewing business intelligence documents. This role is typically suitable for users who
consume content through the BI platform applications.
•
New users are created as BI Analyst
New user accounts are configured under the BI Analyst role. Access to the BI platform applications
for all accounts under the BI Analyst role is defined in the license agreement. Users can access
all applications workflows that are defined for the BI Analyst role. Access rights include viewing
and modifying business intelligence documents. This role is typically suitable for users who create
and modify content for the BI platform applications.
If your the BI platform license is not based on users roles, select one of the following options:
•
New users are created as named users.
New user accounts are configured to use named user licenses. Named user licenses are
associated with specific users and allow people to access the system based on their user name
and password. This provides named users with access to the system regardless of how many
other people are connected. You must have a named user license available for each user account
created using this option.
•
New users are created as concurrent users.
New user accounts are configured to use concurrent user licenses. Concurrent licenses specify
the number of people who can connect to the BI platform at the same time. This type of licensing
is very flexible because a small concurrent license can support a large user base. For example,
depending on how often and how long users access the BI platform, a 100 user concurrent license
could support 250, 500, or 700 users.
7. Click the Roles tab.
8. Select the domain that corresponds to the Siebel server you want to map roles for.
9. Under "Available roles", select the roles you want to map and click >.
324
2011-05-06
Authentication
Note:
You can use the Search Roles Begin With: field to narrow your search if you have a large number
of roles. Enter the characters that the role or roles begin with followed by the wildcard (%) character,
and click Search.
10. Click Update.
The roles will be mapped to the BI platform.
7.8.2.2 Remapping consideration
To enforce group and user synchronization between the BI platform and Siebel, set the Force user
synchronization.
Note:
In order to select Force user synchronization you must first select New aliases will be added and
new users will be created.
When you remap the role, the option to map users as either named users or concurrent users affects
only the new users that you added to the role.
For example, you first map a role to the BI platform with the "New users are created as named users"
option selected. Later, you add users to the same role and remap the role with the "New users are
created as concurrent users" option selected.
In this situation, only the new users in the role are mapped to the BI platform as concurrent users; the
users that were already mapped remain named users. The same condition applies if you first map users
as concurrent users, and then you change the settings to remap new users as named users.
7.8.2.3 To unmap a role
1. Log on as an administrator to the Central Management Console.
2. From the "Manage" area, click Authentication.
3. Double-click Siebel.
4. On the Domains tab select the Siebel domain that corresponds to the role or roles you want to
unmap.
5. In the Roles tab select the role that you want to remove, and click <.
6. Click Update.
Members of the responsibility will no longer be able to access the BI platform, unless they have
other accounts or aliases.
325
2011-05-06
Authentication
Note:
You can also delete individual accounts or remove users from roles before you map them to the BI
platform to prevent specific users from logging on.
7.8.3 Scheduling user updates
To ensure changes to your user data for your ERP system are reflected in your BI platform user data,
you can schedule regular user updates. These updates will automatically synchronize your ERP and
BI platform users according to the mapping settings you have configured in the Central Management
Console (CMC).
There are two options for running and scheduling updates for imported roles:
•
•
Update roles only: using this option will update only the links between the currently mapped roles
that have been imported in BI platform. Use this option if you expect to run frequent updates, and
you are concerned about system resource usage. No new user accounts will be created if you only
update roles.
Update roles and aliases: this option not only updates links between roles but will also create new
user accounts in BI platform for new user aliases added to the ERP system.
Note:
If you have not specified to automatically create user aliases for updates when you enabled
authentication, no accounts will be created for new aliases.
7.8.3.1 To schedule user updates
After you map roles into BI platform, you need to specify how the system updates these roles.
1. Click the User Update tab.
2. Click Schedule in either the "Update Roles Only" or "Update Roles and Aliases" sections.
Tip:
If you want to run an update immediately click Update Now.
Tip:
Use the "Update Roles Only" option if you would like frequent updates and are concerned about
system resources. It takes the system longer to update both roles and aliases.
The "Recurrence" dialog box is displayed.
3. Select an option from the "Run Object" list and provide all the requested scheduling information.
When scheduling an update, you can choose from the recurrence patterns summarized in the
following table:
326
2011-05-06
Authentication
Recurrence pattern
Description
Hourly
The update will run every hour. You specify at what time it will
start, as well as a start and end date.
Daily
The update will run every day or run every number of specified
days. You can specify at what time it will run, as well as a start
and end date.
Weekly
The update will run every week. It can be run once a week or
several times a week. You can specify on which days and at
what time it will run, as well as a start and end date.
Monthly
The update will run every month or every several months. You
can what time it will run, as well as a start and end date.
Nth Day of Month
The update will run on a specific day in the month. You can
specify on which day of the month, what time it will run, as well
as a start and end date.
1st Monday of Month
The update will run on the first Monday of each month. You
can specify what time it will run, as well as a start and end date.
Last Day of Month
The update will run on the last day of each month. You can
specify what time it will run, as well as a start and end date.
X Day of Nth Week of the Month
The update will run on a specified day of a specified week of
the month. You can specify what time it will run, as well as a
start and end date.
Calendar
The update will run on the dates specified in a calendar that
has previously been created.
4. Click Schedule after you have finished providing the scheduling information.
The date of the next scheduled role update is displayed in the User Update tab.
Note:
You can always cancel the next scheduled update by clicking Cancel Scheduled Updates in either
the "Update Roles Only" or "Update Roles and Aliases" sections.
7.9 Oracle EBS authentication
327
2011-05-06
Authentication
7.9.1 Enabling Oracle EBS authentication
To allow Oracle EBS information to be used by BI platform the system needs information on how to
authenticate into your Oracle EBS system.
7.9.1.1 To enable Oracle E-Business Suite authentication
1. Log on as an administrator to the Central Management Console.
2. From the Manage area, click Authentication.
3. Click Oracle EBS.
The "Oracle EBS" page appears. It has four tabs: Options, Systems, Responsibilities, and User
Update.
4. On the Options tab, select the Oracle EBS Authentication is enabled check box.
5. Make appropriate changes under New Alias, Update Options, and New User Options according
to your BI platform deployment. Click Update to save your changes before proceeding to the Systems
tab.
6. Click the Systems tab.
7. In the "Oracle EBS System User" area, type a database User name and Password for BI platform
to use to log on to your Oracle E-Business Suite database.
8. In the "Oracle EBS Services" area, enter the service name used by your Oracle EBS environment
and click Add.
9. Click Update to save your changes.
You now need to map Oracle EBS roles into the system.
Related Topics
• To map Oracle E-Business Suite roles
7.9.2 Mapping Oracle E-Business Suite roles to BI platform
BI platform automatically creates a group for each Oracle E-Business Suite (EBS) role that you map.
The system also creates aliases to represent the members of the mapped Oracle E-Business Suite
roles.
328
2011-05-06
Authentication
You can create a user account for each alias that is created. However, if you run multiple systems and
your users have accounts in more than one of the systems, then you can assign each user to an alias
with the same name before you create the accounts in BI platform
Doing so reduces the number of accounts that are created for the same user in the system.
For example, if you run a EBS test environment and production environment, and 30 of your users have
access to both systems, then only 30 accounts are created for those users. If you choose not to assign
each user to an alias with the same name, then 60 accounts are created for the 30 users in BI platform.
However, if you run multiple systems, and user names overlap, then you must create a new member
account for each alias that is created.
For example, if you run your test environment with a user account for Russell Aquino (user name
"raquino"), and you run the production environment with a user account for Raoul Aquino (user name
"raquino"), then you need to create a separate account for each user's alias. Otherwise, the two users
are added to the same BI platform account; they will be able to log on to the system with their own
Oracle EBS credentials and have access to data from both EBS environments.
7.9.2.1 To map Oracle E-Business Suite roles
1. Log on as an administrator to the Central Management Console.
2. From the Manage area, click Authentication.
3. Click Oracle EBS.
The "Oracle EBS" page displays the Options tab.
4. In the "New Alias Options" area, select one of the following options:
• Assign each added Oracle EBS alias to an account with the same name
Select this option if you run multiple Oracle E-Business Suite systems with users who have
accounts on more than one system (and if no two users have the same user name for different
systems).
•
Create a new account for every added Oracle EBS alias
Select this option if you run only one Oracle E-Business Suite, if the majority of your users have
accounts on only one of your systems, or if the user names overlap for different users on two or
more of your systems.
5. In the "Update Options" area, select one of the following options:
• New aliases will be added and new users will be created
Select this option to create a new alias for every user that is mapped to BI platform. New accounts
are added for users without BI platform accounts or for all users if you selected the Create a new
account for every added Oracle EBS alias option.
•
329
No new aliases will be added and new users will not be created
2011-05-06
Authentication
Select this option if the role that you want to map contains many users, but only a few of them
will use BI platform. The platform does not automatically create aliases and accounts for the
users. Instead, it creates aliases (and accounts, if required) only for users when they log on to
BI platform for the first time. This is the default option.
6. In "New User Options" specify how new users are created, and then click Update.
If your SAP BusinessObjects Business Intelligence platform license is based on users roles, select
one of the following options:
• New users are created as BI Viewer
New user accounts are configured under the BI Viewer role. Access to BI platform applications
for all accounts under the BI Viewer role is defined in the license agreement. Users are restricted
to access application workflows that are defined for the BI Viewer role. Access rights are generally
limited to viewing business intelligence documents. This role is typically suitable for users who
consume content through BI platform applications.
•
New users are created as BI Analyst
New user accounts are configured under the BI Analyst role. Access to BI platform applications
for all accounts under the BI Analyst role is defined in the license agreement. Users can access
all applications workflows that are defined for the BI Analyst role. Access rights include viewing
and modifying business intelligence documents. This role is typically suitable for users who create
and modify content for BI platform applications.
If your SAP BusinessObjects Business Intelligence platform license is not based on users roles,
select one of the following options:
•
New users are created as named users.
New user accounts are configured to use named user licenses. Named user licenses are
associated with specific users and allow people to access the system based on their user name
and password. This provides named users with access to the system regardless of how many
other people are connected. You must have a named user license available for each user account
created using this option.
•
New users are created as concurrent users.
New user accounts are configured to use concurrent user licenses. Concurrent licenses specify
the number of people who can connect to BI platform at the same time. This type of licensing is
very flexible because a small concurrent license can support a large user base. For example,
depending on how often and how long users access the platform, a 100 user concurrent license
could support 250, 500, or 700 users.
The roles that you selected now appear as groups in BI platform.
7. Click the Responsibilities tab.
8. Select Force user synchronization if you want to synchronize Oracle EBS user account information
after you click Update in the Responsibilities tab.
9. Under Current Oracle EBS Services, select the Oracle EBS service that contains the roles you
want to map.
10. You can specify filters for Oracle EBS users under "Mapped Oracle EBS Roles".
a. Select which applications users can use for the new role from the Application list.
330
2011-05-06
Authentication
b. Select what Oracle applications, functions, reports, and concurrent programs the user can run
in the Responsibility list.
c. Select which security group the new role is assigned to in the Security group in the Security
Group
d. Use the Add and Delete buttons under "Current Role" to modify the security group assignments
for the role.
11. Click Update.
The roles will be mapped to BI platform.
After you map roles into BI platform you need to specify how the system updates these roles.
Related Topics
• Role-based licensing
7.9.2.1.1 Updating Oracle EBS roles and users
After enabling Oracle EBS authentication, it is necessary to schedule and run regular updates on
mapped roles that have been imported into BI platform. This will ensure that updated Oracle EBS role
information is accurately reflected in the BI platform.
There are two options for running and scheduling updates for Oracle EBS roles:
•
•
Update roles only: using this option will only update the links between the currently mapped roles
that have been imported in BI platform. It is recommended that you use this option if you expect to
run frequent updates, and you have concerns over system resource usage. No new user accounts
will be created if you only update Oracle EBS roles.
Update roles and aliases: this option not only updates links between roles but will also create new
user accounts in BI platform for user aliases added to roles in the Oracle EBS system.
Note:
If you have not specified to automatically create user aliases for updates when you enabled Oracle
EBS authentication, no accounts will be created for new aliases.
7.9.2.1.2 To schedule updates for Oracle EBS roles
After you map roles into BI platform you need to specify how the system updates these roles.
1. Click the User Update tab.
2. Click Schedule in either the "Update Roles Only" or "Update Roles and Aliases" sections.
Tip:
If you want to immediately run an update click Update Now.
Tip:
Use the "Update Roles Only" option if you would like frequent updates and have concerns about
system resources. It takes the system longer to update both roles and aliases.
The "Recurrence" dialog box is displayed.
331
2011-05-06
Authentication
3. Select an option from the" Run Object" pull-down list and provide all the requested scheduling
information in the fields provided.
When scheduling an update, you can choose from the recurrence patterns summarized in the
following table:
Recurrence pattern
Description
Hourly
The update will run every hour. You specify at what time it will
start, as well as a start and end date.
Daily
The update will run every day or every number of specified
days. You can specify at what time it will run, as well as a start
and end date.
Weekly
The update will run every week. It can run once a week or
several times a week. You can specify on which days and at
what time it will run, as well as a start and end date.
Monthly
The update will run every month or every several months. You
can what time it will run, as well as a start and end date.
Nth Day of Month
The update will run on a specific day in the month. You can
specify on which day of the month, what time it will run, as well
as a start and end date.
1st Monday of Month
The update will run on the first Monday of each month. You
can specify what time it will run, as well as a start and end date.
Last Day of Month
The update will run on the last day of each month. You can
specify what time it will run, as well as a start and end date.
X Day of Nth Week of the Month
The update will run on a specified day of a specified week of
the month. You can specify what time it will run, as well as a
start and end date.
Calendar
The update will run on the dates specified in a calendar that
has previously been created.
4. Click Schedule after you have finished providing the scheduling information.
The date of the next scheduled role update is displayed in the User Update tab.
Note:
You can always cancel the next scheduled update by clicking Cancel Scheduled Updates in either
the "Update Roles Only" or "Update Roles and Aliases" sections.
332
2011-05-06
Authentication
7.9.3 Unmapping roles
To prevent specific user groups from logging on to BI platform, you can unmap the roles to which they
belong.
7.9.3.1 To unmap a role
1. Log on as an administrator to the Central Management Console.
2. From the Manage area, click Authentication.
3. Double-click the name of the ERP system you want to unmap roles for.
The ERP system page displays the Options tab.
4. Click the Responsibilities or Roles tab.
5. Select the target role from the Imported Roles area and click < or Delete to remove them.
6. Click Update.
Members of the role will no longer be able to access BI platform, unless they have other accounts
or aliases.
Note:
You can also delete individual accounts or remove users from roles before you map them to BI
platform to prevent specific users from logging on.
7.9.4 Customizing rights for mapped Oracle EBS groups and users
When you map roles to BI platform, you can set rights or grant permissions for the groups and users
that are created.
7.9.4.1 To assign administration rights
To allow users to maintain BI platform, you must make them members of the default Administrator's
group. Members of this group receive full control over all aspects of the system, which includes accounts,
servers, folders, objects, settings, and so on.
333
2011-05-06
Authentication
1. Log on as an administrator to the Central Management Console.
2. From the "Organize" area, click Users.
3. In the Name column, click Administrators.
4. Click Group List, and then from the Actions list, click Add.
The Available Users/Groups page appears.
5. From the User List or Group List area, select the mapped role to which you want to assign
administrative rights.
6. Click > to make the role a subgroup of the Administrators group, and click OK.
Members of the role now have administration rights in BI platform.
Note:
You can also create a role within Oracle EBS, add the appropriate users to the role, map the role to BI
platform, and make the mapped role a subgroup of the default Administrator's group to grant members
of the role administrative rights.
7.9.4.2 To assign publishing rights
If your system has users who are designated as content creators within your organization, you can
grant them permission to publish objects to BI platform.
1. Log on as an administrator to the Central Management Console.
2. From the "Organize" area, click Folders.
3. Go to the folder where you want to allow users to add objects.
4. Click Manage, Top-Level Security and then All Folders.
5. Click Add Principals.
The Add Principals page appears.
6. In the Available users/groups list, select the group that includes the members to whom you want
to give publishing rights.
7. Click > to enable the group to access the folder, and then click Add & Assign Security.
The Assign Security page appears.
8. In the Available Access Level list, select the access level you want and click > to explicitly assign
the access level.
9. If the Inherit from Parent Folder and Inherit from Parent Group options are selected, deselect
them, and click Apply.
10. Click OK.
Members of the role now have permission to add objects to the folder and all of its subfolders. To
remove assigned permissions, click Remove Access.
334
2011-05-06
Authentication
7.9.5 Configuring Single Sign-on (SSO) for SAP Crystal Reports and Oracle EBS
By default, BI platform will be configured to allow SAP Crystal Reports users to access Oracle EBS
data using Single Sign-on (SSO).
7.9.5.1 To deactivate SSO for Oracle EBS and SAP Crystal Reports
1. In the Central Management Console (CMC), click Applications.
2. Double-click Crystal Reports Configuration.
3. Click Single Sign-On Options.
4. Select crdb_oraapps.
5. Click Remove.
6. Click Save & Close.
7. Restart SAP Crystal Reports.
7.9.5.2 To reactivate SSO for Oracle EBS and SAP Crystal Reports
Follow the steps below to reactivate SSO for Oracle EBS and SAP Crystal Reports.
1. In the Central Management Console (CMC), click Applications.
2. Double-click Crystal Reports Configuration.
3. Click Single Sign-On Options.
4. Under "Use SSO context for database logon" type crdb_oraapps.
5. Click Add.
6. Click Save & Close.
7. Restart SAP Crystal Reports.
335
2011-05-06
Authentication
336
2011-05-06
Server Administration
Server Administration
8.1 Server Administration
8.1.1 Working with the Servers management area in the CMC
The Servers management area of the CMC is your primary tool for server management tasks. It provides
a list of all of the servers in your deployment. For most management and configuration tasks, you need
to select a server in the list and choose a command from the Manage or Action menu.
About the navigation tree
The navigation tree on the left side of the Servers management area provides a number of ways to
view the Servers list. Select items in the navigation tree to change the information displayed in the
"Details" pane.
337
Navigation tree option
Description
Servers List
Displays a complete list of all servers in the deployment.
Server Groups List
Displays a flat list of all available server groups
in the Details pane. Select this option if you want
to configure a server group's settings or security.
Server Groups
Lists the server groups and the servers within
each server group. When you select a server
group, its servers and server groups are displayed
in the Details pane in a hierarchical view.
2011-05-06
Server Administration
Navigation tree option
Description
Nodes
Displays a list of the nodes in your deployment.
Nodes are configured in the CCM. You can select
a node by clicking it to view or manage the
servers on the node.
Provides a list of the types of services that may
be in your deployment. Service categories are
divided into core BI platform services and services
associated with specific SAP Business Objects
components. Service categories include:
Service Categories
•
•
•
•
•
•
•
•
Connectivity Services
Core Services
Crystal Reports Services
Data Federation Services
Lifecycle Management Services
Analysis Services
Web Intelligence Services
Dashboard Design Services
Select a service category in the navigation list to
view or manage the servers in the category.
Note:
A server may host services belonging to multiple
service categories. Therefore a server can appear
in several service categories.
338
2011-05-06
Server Administration
Navigation tree option
Description
Displays the servers according to their current
status. This is a valuable tool for checking to see
which of your servers are running or stopped. If
you are experiencing slow performance on the
system, for example, you can use the" Server
Status" list to quickly determine if any of your
servers are in an abnormal state. Possible server
states include the following:
Server Status
•
•
•
•
•
•
•
•
Stopped
Starting
Initializing
Running
Stopping
Started with Errors
Failed
Waiting for resources
About the Details pane
Depending on which options you have selected in the navigation tree, the "Details" pane on the right
side of the Servers management area shows a list of servers, server groups, states, categories, or
nodes. The following table describes the information listed for servers in the "Details" pane.
Note:
For nodes, server groups, categories, and states, the "Details" pane usually shows names and
descriptions.
339
Details pane column
Description
Server Name or Name
Displays the name of the server.
2011-05-06
Server Administration
Details pane column
Description
Displays the current status of the server. You can
sort by server state using the "Server Status" list
in the navigation tree. Possible server states include the following:
State
340
•
•
•
•
•
•
•
•
Stopped
Starting
Initializing
Running
Stopping
Started with Errors
Failed
Waiting for resources
Enabled
Displays whether the server is enabled or disabled.
Stale
If the server is marked as Stale, then it requires
a restart. For example, if you change certain
server settings in the server's "Properties" screen,
you may need to restart the server before the
changes will take effect.
Kind
Displays the type of server.
Host Name
Displays the Host Name for the server.
Health
Indicates the general health of the server.
PID
Displays the unique Process ID number for the
server.
Description
Displays a description of the server. You can
change this description in the server's "Properties"
page.
Date Modified
Displays the date that the server was last modified, or when the server's state was changed. This
column is very useful if you want to check the
status of recently changed servers.
2011-05-06
Server Administration
Related Topics
• Managing server groups
• Using nodes
• Viewing the state of servers
• Starting, stopping, and restarting servers
• To change a server's properties
8.1.2 Managing servers by using scripts on Windows
The ccm.exe executable lets you start, stop, restart, enable, and disable the servers in your Windows
deployment through the command line.
Related Topics
• ccm.exe
8.1.3 Managing servers on UNIX
The ccm.sh executable lets you start, stop, restart, enable, and disable the servers in your Windows
deployment through the command line.
Related Topics
• ccm.sh
8.1.4 Managing License keys
This section describes how to manage license keys for your BI platform deployment.
Related Topics
• To view license information
• To add a license key
• To view current account activity
341
2011-05-06
Server Administration
8.1.4.1 To view license information
The License Keys management area of the CMC identifies the number of role-based (BI Viewer and
BI Analyst), concurrent, named, and processor licenses that are associated with each key.
1. Go to the License Keys management area of the CMC.
2. Select a license key.
The details associated with the key appear in the License Key Information area. To purchase
additional license keys, contact your SAP sales representative.
Related Topics
• Managing License keys
• To add a license key
• To view current account activity
8.1.4.2 To add a license key
If you are upgrading from a trial version of the product, be sure to delete the Evaluation key prior to
adding any new license keys or product activation keycodes.
1. Go to the License Keys management area of the CMC.
2. Type the key in the Add Key field.
3. Click Add.
The key is added to the list.
Related Topics
• To view license information
• To view current account activity
8.1.4.3 To view current account activity
1. Go to the Settings management area of the CMC.
2. Click View global system metrics.
342
2011-05-06
Server Administration
This section displays current license usage, along with additional job metrics.
Related Topics
• Managing License keys
• To add a license key
• To view license information
8.1.5 Measuring licenses
The BusinessObjects License Measurement Tool (BOLMT) is a java command-line utility used to collect
and store BI platform licensing data. The output XML document contains license deployment
measurements and is sent to SAP Global License Auditing Services (GLAS) for consolidation as part
of a license audit.
The system administrator installs and runs BOLMT for every BI platform cluster whenever a license
audit is requested. BOLMT collects usage measurements on role-based, named, and concurrent user
licenses.
The administrator can specify a particular output directory for the XML document, and configure the
output document to not contain any information that may be used to identify system users.
8.1.5.1 To run a license audit
To perform a license audit, you will need administrator rights and access to the directory containing the
BOLMT.jar file in the BI platform installation.
1. Open a command line console.
2. Change directories to the directory containing the java executables for your BI platform installation
By default the file is installed in the following directory:[INSTALLDIR]\SAP BusinessObjects
Enterprise XI 4.0\java\lib
3. Execute the BOLMT.jar.
The execution command is entered in the following format: -jar BOLMT.jar [options] <outputFile>
The table below summarizes the available options:
343
2011-05-06
Server Administration
Option
Description
-c --cms
Specifies the name identifier and port number for the Central Management
Server (CMS). Specified as cmsname:port number. By default, the CMS
settings for the local host are used if this setting is not specified.
-p --password
Specifies the administrator account password used to connect to the CMS.
-a--auth
Specifies the authentication method to connect user to the CMS. Default method
is Enterprise specified as secEnterprise.
-s--sanitize
Specifies that the output audit document should filter out any personal information that may be used to identify users.
Note:
The output file specification is always the last argument in the command line. It is an optional setting.
If no argument is specified, the output goes to the console's standard output. You can also pipe
output to script as a command line argument.
Example:
C:\Program Files (x86)\SAP
Business Objects\SAP BusinessObjects Enterprise XI 4. 0\java\lib>"C:\Program Files
(x86)\SAP Business Objects\SAP BusinessObjects Enterprise XI 4.0\win64_x64\sapjvm\bin
\java.exe" -jar BOLMT.jar --cms=mycms:6400 -uAdministrator
-p=7juujg --auth=secEnterprise --sanitize audit.xml
8.1.6 Viewing and changing a server's status
8.1.6.1 Viewing the state of servers
The status of a server is its current state of operation: a server can be running, starting, stopping,
stopped, failed, initializing, started with errors, or waiting for resources. To respond to SAP
BusinessObjects Business Intelligence platform requests, a server must be running and enabled. A
server that is disabled is still running as a process; however, it is not accepting requests from the rest
of SAP BusinessObjects Business Intelligence platform. A server that is stopped is no longer running
as a process.
This section shows how to modify the state of servers by using the CMC.
Related Topics
• To view a server's status
344
2011-05-06
Server Administration
• Starting, stopping, and restarting servers
• Enabling and disabling servers
• Stopping a Central Management Server
• To start a server automatically
8.1.6.1.1 To view a server's status
1. Go to the "Servers" management area of the CMC.
The "Details" pane displays the service categories in your deployment.
2. To view a list of servers in a given Server Group, Node, or Service Category, in the navigation tree
click the server group, node, or category.
The "Details" pane displays the list of servers in your deployment. A State column that provides the
status for each server in the list.
3. If you want to view a list of all of the servers that currently have a particular status, expand the Server
Status option in the navigation tree and select the status you want.
A list of servers with the selected status appears in the Details pane.
Note:
This can be particularly useful if you need to quickly view a list of servers that are not starting properly
or have stopped unexpectedly.
8.1.6.2 Starting, stopping, and restarting servers
Starting, stopping, and restarting servers are common actions that you perform when you configure
servers or take them offline. For example, if you want to change the name of a server, then you must
first stop the server. Once you have made your changes, you start the server again to effect your
changes. If you make changes to a server's configuration settings, the CMC will prompt you if you need
to restart the server.
The remainder of this section tells you when a certain configuration change requires that you first stop
or restart the server. However, because these tasks appear frequently, the concepts and differences
are explained first, and the general procedures are provided for reference.
345
Action
Description
Stopping a server
You may need to stop SAP BusinessObjects
Business Intelligence platform servers before you
can modify certain properties and settings.
2011-05-06
Server Administration
Action
Description
Starting a server
If you have stopped a server to configure it, you
need to start it to effect your changes and to have
the server resume processing requests.
Restarting a server
Restarting a server is a shortcut to stopping a
server completely and then starting it again. If you
need to restart a server after changing a server
setting, you will be prompted by the CMC.
Starting a server automatically
You can set servers to start automatically when
the Server Intelligence Agent starts.
Force Termination
Stops a server immediately (whereas when you
stop a server, it will stop when it has completed
its current processing activities). Forcibly terminate a server only when stopping the server has
failed and you need to stop the server immediately.
Tip:
When you stop (or restart) a server, you terminate the server's process, thereby stopping the server
completely. Before you stop a server, it is recommended that you
• Disable the server so it can finish processing any jobs it has in progress, and
• Ensure that there are no auditing events remaining in the queue. To view the number of auditing
events remaining in the queue, navigate to the server's "Metrics" screen and view the "Current
Number of Auditing Events in the Queue" metric.
Related Topics
• Enabling and disabling servers
8.1.6.2.1 To start, stop, or restart servers with CMC
1. Go to the "Servers" management area of the CMC.
The "Details" pane displays the service categories in your deployment.
2. To view a list of servers in a particular Server Group, Node, or Service Category, select the group,
node, or category on the navigation pane.
The "Details" pane displays a list of servers.
3. If you want to view a list of all of the servers that currently have a particular status, expand the Server
Status option in the navigation tree and select the status you want.
346
2011-05-06
Server Administration
A list of servers with the selected status appears in the "Details" pane.
Note:
This can be particularly useful if you need to quickly view a list of servers that are not starting properly
or have stopped unexpectedly.
4. Right-click the server whose status you want to change, and depending on the action you need to
perform select Start Server, Restart Server, Stop Server, or Force Termination.
Related Topics
• Viewing the state of servers
8.1.6.2.2 To start, stop, or restart a Windows server with the CCM
1. In the CCM, click the Manage Servers button on the toolbar.
2. When prompted, log on to your CMS with an administrative account.
3. In the "Manage Servers" dialog box, select the server that you want to start, stop, or restart.
4. Click Start, Stop, Restart, or Force Terminate.
5. Click Close to return to the CCM.
8.1.6.2.3 To start a server automatically
By default, servers in your deployment are started automatically when the Server Intelligence Agent
starts. This procedure shows where to set this option.
1. Go to the Servers management area of the CMC.
2. Double-click the server that you want to start automatically.
The "Properties" screen appears.
3. Under "Common Settings", select the Automatically start this server when the Server Intelligence
Agent starts check box, then click Save or Save & Close.
Note:
If the automatic start setting is deselected for all CMSs in the cluster, you need to use the CCM to
restart the system. After using the CCM to stop the SIA, right-click the SIA, and select Properties.
On the Startup tab, change the Autostart setting to Yes, then click Save. Restart the SIA.
8.1.6.3 Stopping a Central Management Server
If your SAP BusinessObjects Business Intelligence platform installation has more than one active Central
Management Server (CMS), you can shut down a single CMS without losing data or affecting system
functionality. Another CMS on the node will assume the workload of the stopped server. Clustering
multiple CMSs enables you to perform maintenance on each of your Central Management Servers in
turn without taking SAP BusinessObjects Business Intelligence platform out of service.
347
2011-05-06
Server Administration
However, if your SAP BusinessObjects Business Intelligence platform deployment has a single CMS,
shutting it down will make SAP BusinessObjects Business Intelligence platform unavailable to your
users and will interrupt the processing of reports and programs. To avoid this problem, the Server
Intelligence Agent for each node ensures that at least one CMS is running at all times. You can still
stop a CMS by stopping its SIA, but before stopping the SIA, you should disable the processing servers
via the CMC so that they can finish any jobs in progress before SAP BusinessObjects Business
Intelligence platform shuts down, because all other servers on the node will also shut down.
Note:
You may encounter situations where the CMS has been stopped and you need to restart the system
from the CCM. For example, if you shut down all of the CMSs on a node and all of the CMSs are not
set to automatically start when the SIA starts, then you need to use the CCM to restart the system. In
the CCM, right-click the SIA and choose Properties. On the Startup tab, change the Autostart setting
to Yes, then click Save. Restart the SIA.
If you want to configure your system so that you can start and stop the Central Management Server in
the cluster without starting and stopping other servers, put the CMS on a separate node. Create a new
node and clone the CMS to the node. With the CMS on its own node, you can easily shut down the
node without affecting other servers.
Related Topics
• Using nodes
• Cloning servers
• Clustering Central Management Servers
8.1.6.4 Enabling and disabling servers
When you disable an SAP BusinessObjects Business Intelligence platform server, you prevent it from
receiving and responding to new SAP BusinessObjects Business Intelligence platform requests, but
you do not actually stop the server process. This is useful when you want to allow a server to finish
processing all of its current requests before you stop it completely.
For example, you may want to stop a Job Server before rebooting the machine it is running on. However,
you want to allow the server to fulfill any outstanding report requests that are in its queue. First, you
disable the Job Server so it cannot accept any additional requests. Next, go to the Central Management
Console to monitor when the server completes the jobs it has in progress. (From the "Servers"
management area, right-click the server and select "Metrics".) Then, once it has finished processing
current requests, you can safely stop the server.
Note:
•
•
348
The CMS must be running in order for you to enable and/or disable other servers.
A CMS cannot be enabled or disabled.
2011-05-06
Server Administration
8.1.6.4.1 To enable and disable servers with CMC
1. Go to the "Servers" management area of the CMC.
2. Right-click the server whose status you want to change, and depending on the action you need to
perform click Enable Server or Disable Server.
8.1.6.4.2 To enable or disable a Windows server with the CCM
1. In the CCM, click Manage Servers.
2. When prompted, log on to your CMS with the credentials that provide you with administrative privileges
to BI platform.
3. In the "Manage Servers" dialog box, select the server that you want to enable or disable.
4. Click Enable or Disable.
5. Click Close to return to the CCM.
8.1.7 Adding, cloning, or deleting servers
8.1.7.1 Adding, cloning, and deleting servers
If you want to add new hardware to SAP BusinessObjects Business Intelligence platform by installing
server components on new, additional machines, run the SAP BusinessObjects Business Intelligence
platform installation program from your product distribution. The setup program allows you to perform
a Custom installation. During the Custom installation, specify the CMS from your existing deployment,
and select the components that you want to install on the local machine. For details on custom installation
options, see the SAP BusinessObjects Business Intelligence platform Installation Guide.
8.1.7.1.1 Adding a server
You can run multiple instances of the same BI platform server on the same machine. To add a server:
1. Go to the "Servers" management area of the CMC.
2. On the Manage menu, click New > New Server.
The "Create New Server" dialog box appears.
3. Choose the Service Category.
4. Choose the type of service that you need from the Select Service list, then click Next.
5. To add an additional service to the server, select the service in the Available Additional Services
list and click >.
349
2011-05-06
Server Administration
Note:
Additional services are not available for all server types.
6. After adding the additional services you want, click Next.
7. If your BI platform architecture is composed of multiple nodes, choose the node where you want to
add the new server from the Node list.
8. Type a name for the server in the Server Name box.
Each server on the system must have a unique name. The default naming convention is <NODE
NAME>.<servertype> (a number is appended if there is more than one server of the same type
on the same host machine).
9. To include a description for the server, type it into the Description box.
10. If you are adding a new Central Management Server, specify a port number in the Name Server
Port field.
11. Click Create.
The new server appears in the list of servers in the Servers area of the CMC, but it is neither started
nor enabled.
12. Use the CMC to start and enable the new server when you want it to begin responding to BI platform
requests.
Related Topics
• Services and servers
• Configuring server settings
• Configuring port numbers
• Viewing the state of servers
8.1.7.1.2 Cloning servers
If you want to add a new server instance to your deployment, you can clone an existing server. The
cloned server retains the configuration settings of the original server. This can be particularly useful if
you are expanding your deployment and want to create new server instances that use almost all of the
same server configuration settings as an existing server.
Cloning also simplifies the process of moving servers between nodes. If you want to move an existing
CMS to another node, you can clone it to the new node. The cloned CMS appears on the new node
and retains all of the configuration settings of the original CMS.
There are some considerations to keep in mind when cloning servers. You may not want all settings to
be cloned, so it's good practice to check the cloned server to make sure it meets your needs. For
example, if you clone a CMS to the same machine, make sure you change the port number settings
that were copied from the original CMS to the cloned CMS.
Note:
•
350
Before you clone servers, make sure that all machines in your deployment have the same version
of SAP BusinessObjects Business Intelligence platform (and any updates, if applicable).
2011-05-06
Server Administration
•
•
You can clone servers from any machine. However, you can only clone servers to machines where
the required binaries for the server are installed.
When you clone a server, it does not necessarily mean that the new server will use the same OS
credentials. The user account is controlled by the Server Intelligence Agent that the server is running
under.
Using placeholders for server settings
Placeholders are node-level variables are used by the servers that are running on the node. Placeholders
are listed on a dedicated page in the Central Management Console (CMC). When you double-click any
server listed under "Servers" in the CMC, a link is provided on the left-hand navigation pane for
“Placeholders”. The "Placeholders" page lists all the available placeholder names and their associated
values for the selected server. Placeholders contain read-only values and the placeholder names begin
and end with the percentage character %.
Note:
You can always overwrite a placeholder setting with a specific string in the CMC Server "Properties"
page.
Example:
Placeholders are useful when cloning servers. For example, multi-drive machine A has SAP
BusinessObjects Business Intelligence platform installed on C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI 4.0. So the %DefaultAudit
ingDir% placeholder will be D:\Program Files (x86)\SAP BusinessObjects\SAP
BusinessObjects Enterprise XI 4.0\Auditing\.
On another machine, machine B, there is only one disc drive (no drive D) and SAP BusinessObjects
Business Intelligence platform is installed on C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI 4.0 . In this case the %Default
AuditingDir% placeholder will be C:\Program Files (x86)\SAP BusinessObjects\SAP
BusinessObjects Enterprise XI 4.0\Auditing\
To clone the Event Server from machine A to machine B, if placeholders are used for the Auditing
Temporary Directory, the placeholders will resolve themselves and the Event Server will work properly.
If no placeholders are used, the Event Server will fail unless you manually overwrite the Auditing
Temporary Directory setting.
To clone a server
1. On the machine that you want to add the cloned server to, go to the "Servers" management area of
the CMC.
2. Right-click the server that you want to clone and select Clone Server.
The "Clone Server" dialog box appears.
3. Type a name for the server (or use the default name) in the New Server Name field.
4. If you are cloning a Central Management Server, specify a port number in the Name Server Port
field.
351
2011-05-06
Server Administration
5. On the Clone to Node list, choose the node where you want to add the cloned server, then click
OK.
The new server appears in the "Servers" management area of the CMC.
Note:
Port number settings are also cloned. In many cases, such as cloning a CMS, you will want to change
the port number to avoid port conflicts between the original server and its clone.
8.1.7.1.3 Deleting a server
1. Go to the "Servers" management area of the CMC.
2. Stop the server that you want to delete.
3. Right-click the server and select Delete.
4. When prompted for confirmation, click OK.
8.1.8 Clustering Central Management Servers
8.1.8.1 Clustering Central Management Servers
If you have a large or mission-critical implementation of SAP BusinessObjects Business Intelligence
platform, you will probably want to run several CMS machines together in a cluster. A cluster consists
of two or more CMS servers working together against a common CMS system database. If a machine
that is running one CMS fails, a machine with another CMS will continue to service SAP BusinessObjects
Business Intelligence platform requests. This "high availability" support helps to ensure that SAP
BusinessObjects Business Intelligence platform users can still access information when there is an
equipment failure.
This section shows how to add a new CMS cluster member to a production system that is already up
and running. When you add a new CMS to an existing cluster, you instruct the new CMS to connect to
the existing CMS system database and to share the processing workload with any existing CMS
machines. For information about your current CMS, go to the Servers management area of the CMC.
Before clustering CMS machines, you must make sure that each CMS is installed on a system that
meets the detailed requirements (including version levels and patch levels) for operating system,
database server, database access method, database driver, and database client outlined in the plat
forms.txt file included in your product distribution.
In addition, you must meet the following clustering requirements:
352
2011-05-06
Server Administration
•
For best performance, the database server that you choose to host the system database must be
able to process small queries very quickly. The CMS communicates frequently with the system
database and sends it many small queries. If the database server is unable to process these requests
in a timely manner, SAP BusinessObjects Business Intelligence platform performance will be greatly
affected.
•
For best performance, run each CMS cluster member on a machine that has the same amount of
memory and the same type of CPU.
•
Configure each machine similarly:
•
Install the same operating system, including the same version of operating system service packs
and patches.
•
Install the same version of SAP BusinessObjects Business Intelligence platform (including patches,
if applicable).
•
Ensure that each CMS connects to the CMS system database in the same manner: whether you
use native or ODBC drivers. Make sure that the drivers are the same on each machine, and are
a supported version.
•
Ensure that each CMS uses the same database client to connect to its system database, and
that it is a supported version.
•
Check that each CMS uses the same database user account and password to connect to the
CMS system database. This account must have create, delete, and update rights on the system
database.
•
Ensure that the nodes on which each CMS is located are running under the same operating
system account. (On Windows, the default is the "LocalSystem" account.)
•
Verify that the current date and time are set correctly on each CMS machine (including settings
for daylight savings time).
•
Ensure that the same WAR files are installed on all web application servers in the cluster. For
more information on WAR file deployment, see the SAP BusinessObjects Business Intelligence
platform Installation Guide.
•
Ensure that each and every CMS in a cluster is on the same Local Area Network.
•
If your cluster has more than eight CMS cluster members, ensure that the command line for each
CMS includes the -oobthreads <numCMS> option, where <numCMS> is the number of CMS
servers in the cluster. This option ensures that the cluster can handle heavy loads. For information
about configuring server command lines, see the Server Command Lines appendix of the SAP
BusinessObjects Business Intelligence platform Administrator Guide.
•
If you want to enable auditing, each CMS must be configured to use the same auditing database
and to connect to it in the same manner. The requirements for the auditing database are the same
as those for the system database in terms of database servers, clients, access methods, drivers,
and user IDs.
Tip:
By default, a cluster name reflects the specific name of the first CMS that you install.
353
2011-05-06
Server Administration
Related Topics
• Changing the name of a CMS cluster
8.1.8.1.1 Adding a CMS to a cluster
There are several ways to add a new CMS cluster member. Follow the appropriate procedure:
•
You can install a new node with a CMS on a new machine.
•
If you already have a node with CMS binary files, then you can add a new CMS server from the
CMC.
•
If you already have a node with CMS binary files, you can also add a new CMS server by cloning
an existing CMS server.
Note:
Back up your current CMS system database and the contents of you Input and Output File Repositories
before making any changes. If necessary, contact your database administrator.
Related Topics
• Adding a new node to a cluster
• Adding a server
• Cloning servers
• Backing up and restoring your system
8.1.8.1.2 Adding a new node to a cluster
When you add a node, you are prompted to either create a new CMS or to cluster the node to an existing
CMS.
If you want to cluster a node to an existing CMS, you can also use the installation setup program. Run
the SAP BusinessObjects Business Intelligence platform installation and setup program on the machine
where you want to install the new CMS cluster member. The setup program allows you to perform a
Custom installation. During the Custom installation, specify the existing CMS whose system you want
to expand, and select the components that want to install on the local machine. In this case, specify
the name of the CMS that is running your existing system, and choose to install a new CMS on the
local machine. Then provide the Setup program with the information it needs to connect to your existing
CMS system database. When the Setup program installs the new CMS on the local machine, it
automatically adds the server to your existing cluster.
Related Topics
• Using nodes
354
2011-05-06
Server Administration
8.1.8.1.3 Adding clusters to the web application property files
If you have added additional CMSs to your deployment, and you are using a Java application server,
you must modify the PlatformServices.properties file in the \webapps\BOE\WEB-INF\con
fig\custom directory of your web application deployment.
To define cluster properties for the BOE web application
1. Access the custom folder for the BOE.war file on the machine hosting the web applications.
If you are using the Tomcat web application server provided with the SAP BusinessObjects Business
Intelligence platform installation, you can directly access the following folder:
C:\Program Files (x86)\SAP BusinessObjects\Tomcat6\webapps\BOE\WEBINF\config\custom\
Tip:
If you are using a web application server that does not enable direct access to the deployed web
applications, you can use the following folder in your product installation to modify the BOE.war file.
<INSTALLDIR>\SAP BusinessObjects Business Intelligence platform
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\.
You will have to later redeploy the modified BOE.war.
2. Create a new file.
Note:
Use Notepad or any other text editing utility.
3. Specify the CMC cluster properties.
The cms.clusters property to specify all the clusters in the deployment. Every cluster name must
be preceded by the @ character and separated by a comma. For example, cms.clusters=@sam
plecluster,@samplecluster2, @samplecluster3.Use the cms.clusters.[cluster
name] property to specify every CMS contained in the cluster. For example:
cms.clusters=@samplecluster,@samplecluster2, @samplecluster3
cms.clusters.samplecluster=cmsone:6400,cmstwo
cms.clusters.samplecluster2=cms3,cms4, cms5
cms.clusters.samplecluster3=aps05
Note:
Separate each CMS name with a comma. The port number is separated from the CMS name with
a colon; The port number is assumed to be 6400 unless it is specified. Repeat the procedure for
each cluster you have.
4. Save the file under the following name:
PlatformServices.properties
5. Restart your application server.
The new properties take affect only after the modified BOE web application is redeployed on the machine
running the web application server. Use WDeploy to redeploy the WAR file on the web application
server. For more information on using WDeploy, see the SAP BusinessObjects Business Intelligence
platform Web Application Deployment Guide.
355
2011-05-06
Server Administration
8.1.8.1.4 Changing the name of a CMS cluster
This procedure allows you to change the name of a cluster that is already installed. After changing the
name of the CMS cluster, the Server Intelligences Agent automatically reconfigures each SAP Business
Objects server so that it registers with the CMS cluster, rather than with an individual CMS.
Note:
For experienced administrators of SAP BusinessObjects Business Intelligence platform, note that you
can no longer use the -ns option on the server command line to configure which CMS a server should
register with. This is now handled automatically by the SIA.
To change the cluster name on Windows
1. Use the CCM to stop the Server Intelligence Agent for the node that contains a Central Management
Server that is a member of the cluster whose name you want to change.
2. Right-click the Server Intelligence Agent and choose Properties.
3. In the Properties dialog box, click the Configuration tab.
4. Select the Change Cluster Name to check box.
5. Type the new name for the cluster.
6. Click OK and then restart the Server Intelligence Agent.
The CMS cluster name is now changed. All other CMS cluster members are dynamically notified of
the new cluster name (although it may take several minutes for your changes to propagate across
cluster members).
7. Go to the Servers management area of the CMC and check that all of your servers remain enabled.
If necessary, enable any servers that have been disabled by your changes.
To change the cluster name on UNIX
Use the cmsdbsetup.sh script. For reference, see the Unix Tools chapter of the SAP BusinessObjects
Business Intelligence platform Administrator Guide.
8.1.9 Managing server groups
Server groups provide a way of organizing your SAP BusinessObjects Business Intelligence platform
servers to make them easier to manage. That is, when you manage a group of servers, you need only
view a subset of all the servers on your system. More importantly, server groups are a powerful way of
customizing SAP BusinessObjects Business Intelligence platform to optimize your system for users in
different locations, or for objects of different types.
If you group your servers by region, you can easily set up default processing settings, recurrent
schedules, and schedule destinations that are appropriate to users who work in a particular regional
office. You can associate an object with a single server group, so the object is always processed by
356
2011-05-06
Server Administration
the same servers. And you can associate scheduled objects with a particular server group to ensure
that scheduled objects are sent to the correct printers, file servers, and so on. Thus, server groups
prove especially useful when maintaining systems that span multiple locations and multiple time zones.
If you group your servers by type, you can configure objects to be processed by servers that have been
optimized for those objects. For example, processing servers need to communicate frequently with the
database containing data for published reports. Placing processing servers close to the database server
that they need to access improves system performance and minimizes network traffic. Therefore, if you
had a number of reports that ran against a DB2 database, you might want to create a group of Processing
Servers that process reports only against the DB2 database server. If you then configured the appropriate
reports to always use this Processing Server group for viewing, you would improve system performance
for viewing these reports.
After creating server groups, configure objects to use specific server groups for scheduling, or for
viewing and modifying reports. Use the navigation tree in the Servers management area of the CMC
to view server groups. The Server Groups List option displays a list of server groups in the details pane,
and the Server Groups option allows you to view the servers in the group.
8.1.9.1 Creating a server group
To create a server group, you need to specify the name and description of the group, and then add
servers to the group.
8.1.9.1.1 To create a server group
1. Go to the "Servers" management area of the CMC.
2. Choose Manage > New > Create Server Group.
The "Create Server Group" dialog box appears.
3. In the Name field, type a name for the new group of servers.
4. If you want to include additional information about the server group, type it in the Description field.
5. Click OK.
6. In the "Servers" management area, click Server Groups in the navigation tree and select the new
server group.
7. Choose Add Members from the Actions menu.
8. Select the servers that you want to add to this group; then click > .
Tip:
Use CTRL + click to select multiple servers.
9. Click OK.
You are returned to the "Servers" management area, which now lists all the servers that you added
to the group. You can now change the status, view server metrics, and change the properties of the
servers in the group.
357
2011-05-06
Server Administration
Related Topics
• Viewing the state of servers
8.1.9.2 Working with server subgroups
Subgroups of servers provide you with a way of further organizing your servers. A subgroup is just a
server group that is a member of another server group.
For example, if you group servers by region and by country, then each regional group becomes a
subgroup of a country group. To organize servers in this way, first create a group for each region, and
add the appropriate servers to each regional group. Then, create a group for each country, and add
each regional group to the corresponding country group.
There are two ways to set up subgroups: you can modify the subgroups of a server group, or you can
make one server group a member of another. The results are the same, so use whichever method
proves most convenient.
8.1.9.2.1 To add subgroups to a server group
1. Go to the "Servers" management area of the CMC.
2. Click Server Groups in the navigation tree and select the server group you want to add subgroups
to.
This group is the parent group.
3. Choose Add Members from the Actions menu.
4. Click Server Groups in the navigation tree, select the server groups that you want to add to this
group, and then click >.
Tip:
Use CTRL + click to select multiple server groups.
5. Click OK.
You are returned to the "Servers" management area, which now lists the server groups that you
added to the parent group.
8.1.9.2.2 To make one server group a member of another
1. Go to the "Servers" management area of the CMC.
2. Click the group that you want to add to another group.
3. Choose Add to Server Group from the Actions menu.
4. In the Available server groups list, select the other groups that you want to add the group to, then
click >.
358
2011-05-06
Server Administration
Tip:
Use CTRL + click to select multiple server groups.
5. Click OK.
8.1.9.3 Modifying the group membership of a server
You can modify a server's group membership to quickly add the server to (or remove it from) any group
or subgroup that you have already created on the system.
For example, suppose that you created server groups for a number of regions. You might want to use
a single Central Management Server (CMS) for multiple regions. Instead of having to add the CMS
individually to each regional server group, you can click the server's Member of link to add it to all three
regions at once.
8.1.9.3.1 To modify a server's group membership
1. Go to the "Servers" management area of the CMC.
2. Right-click the server whose membership information you want to change, and select Existing
Server Groups.
In the details panel, the Available server groups list displays the groups you can add the server
to. The Member of Server Groups list displays any server groups that the server currently belongs
to.
3. To change the groups that the server is a member of, use the arrows to move server groups between
the lists, then click OK.
8.1.9.4 User access to servers and server groups
You can use rights to grant people access to servers and server groups, allowing them to perform tasks
such as starting and stopping servers.
Depending on your system configuration and security concerns, you may want to limit server management
to the SAP BusinessObjects Business Intelligence platform administrator. However, you may need to
provide access to other people using those servers. Many organizations have a group of IT professionals
dedicated to server management. If your server team needs to perform regular server maintenance
tasks that require them to shut down and start up servers, you need to grant them rights to the servers.
You may also want to delegate SAP BusinessObjects Business Intelligence platform server administration
tasks to other people. Or you may want different groups within your organization to have control over
their own server management.
359
2011-05-06
Server Administration
8.1.9.4.1 To grant access to a server or server group
1. Go to the "Servers" management area of the CMC.
2. Right-click the server or server group you want to grant access to and select User Security.
3. Click Add Principals to add users or groups that you want to give access to the selected server or
server group.
The "Add Principals" dialog box appears.
4. Select the user or group you want to grant access to the specified server or server group, then click
>.
5. Click Add and Assign Security.
6. On the "Assign Security" screen, choose the security settings you want for the user or group, and
click OK.
For detailed information about assigning rights, refer to the Setting Rights chapter.
8.1.9.4.2 Object rights for the Report Application Server
To allow users to create or modify reports over the Web through the Report Application Server (RAS),
you must have RAS Report Modification licenses available on your system. You must also grant users
a minimum set of object rights. When you grant users these rights to a report object, they can select
the report as a data source for a new report or modify the report directly:
•
View objects (or “View document instances” as appropriate)
•
Edit objects
•
Refresh the report's data
•
Export the report's data
User must also have permission to add objects to at least one folder before they can save new reports
back to SAP BusinessObjects Business Intelligence platform.
To ensure that users retain the ability to perform additional reporting tasks (such as copying, scheduling,
printing, and so on), it's recommended that you first assign the appropriate access level and update
your changes. Then, change the access level to Advanced, and add any of the required rights that are
not already granted. For instance, if users already have View On Demand rights to a report object, you
allow them to modify the report by changing the access level to Advanced and explicitly granting the
additional Edit objects right.
When users view reports through the Advanced DHTML viewer and the RAS, the View access level is
sufficient to display the report, but View On Demand is required to actually use the advanced search
features. The extra Edit objects right is not required.
8.1.10 Assessing your system's performance
360
2011-05-06
Server Administration
8.1.10.1 Monitoring SAP BusinessObjects Business Intelligence platform servers
The Monitoring application provides the ability to capture the runtime and historical metrics of SAP
BusinessObjects Business Intelligence platform servers, for reporting and notification. The application
helps system administrators to identify if servers are functioning normally and if the response times are
as expected.
Related Topics
• About Monitoring
8.1.10.2 Analyzing server metrics
The Central Management Console (CMC) allows you to view the metrics for the servers in your system.
These metrics include general information about each machine, along with details that are specific to
the type of server. The CMC also allows you to view system metrics, which include information about
your product version, your CMS, and your current system activity.
Note:
You can only view the metrics for servers that are currently running.
8.1.10.2.1 To view server metrics
1. Go to the "Servers" management area of the CMC.
2. Right-click the server whose metrics you want to view, and select Metrics.
The "Metrics" tab displays a list of metrics for the server.
Related Topics
• To change a server's properties
• About the Server Metrics Appendix
8.1.10.3 Viewing system metrics
The "Settings" management area of the CMC displays system metrics that provide general information
about your SAP BusinessObjects Business Intelligence platform installation. The "Properties" section
361
2011-05-06
Server Administration
includes information about the product version and build. It also lists the data source, database name,
and database user name of the CMS database. The "View global system metrics" section lists current
account activity, along with statistics about current and processed jobs. The "Cluster" section lists the
name of the CMS you are connected to, the name of the CMS cluster, and the names of other cluster
members.
8.1.10.3.1 To view system metrics
1. Go to the "Settings" management area of the CMC.
2. Click the arrows to expand and view the settings for the "Properties", "View global system metrics",
and "Cluster" sections.
8.1.10.4 Logging server activity
SAP BusinessObjects Business Intelligence platform allows you to log specific information about SAP
BusinessObjects Business Intelligence platform web activity.
•
In addition, each of the SAP BusinessObjects Business Intelligence platform servers is designed to
log messages to your operating system's standard system log.
•
On Windows, SAP BusinessObjects Business Intelligence platform logs to the Event Log service.
You can view the results with the Event Viewer (in the Application Log).
•
On UNIX, SAP BusinessObjects Business Intelligence platform logs to the syslog daemon as a
User application. Each server prepends its name and PID to any messages that it logs.
Each server also logs assert messages to the logging directory of your product installation. The
programmatic information logged to these files is typically useful only to SAP Business Objects support
staff for advanced debugging purposes. The location of these log files depends upon your operating
system:
•
On Windows, the default logging directory is <INSTALLDIR>\SAP BusinessObjects
Enterprise XI 4.0\Logging.
•
On UNIX, the default logging directory <INSTALLDIR>/sap_bobj/logging directory of your
installation.
The important point to note is that these log files are cleaned up automatically, so there will never be
more than approximately 1 MB of logged data per server.
Note:
To enable logging to function on UNIX machines that are hosting SAP BusinessObjects Business
Intelligence platform servers, you must set up and configure system logging so that all messages logged
to the “user” facility of “info” level or higher are recorded. You must also configure SYSLOGD to accept
remote logging.
Setup procedures vary from system to system. Consult your operating system documentation for specific
instructions.
362
2011-05-06
Server Administration
8.1.10.5 Configuring servers in the CMC to optimize Publishing performance
In general, you can do the following to optimize server performance for Publishing:
•
•
In the "Servers" area of the CMC, disable unnecessary servers. For example, if you are running a
Crystal reports publication only, you can disable Desktop Intelligence and Web Intelligence servers.
However, before you do this, ensure that the servers that you want to disable are not being used
by other users in the system.
For Job Servers that are used in Publishing, ensure that Maximum Concurrent Jobs is set to five
per CPU. To do this, in the "Servers" area, select the Job Server and click Manage > Properties.
Consider changing the level of detail logged by the Adaptive Processing Server.
Note:
Increasing the level of detail in log files may affect server performance.
The default (and recommended) setting for the level of detail in log files is ERROR. However, you or
your publisher may want to increase the level of detail in Adaptive Processing Server log files to better
track the progress of publication jobs. To do this, in the "Servers" area, select the Adaptive Processing
Server and click Manage > Properties. On the "Log level" list, select INFO. INFO gives you more
details such as the following:
•
•
•
The publication has been delivered successfully to a recipient.
A batch of recipients has been processed successfully.
Post-processing publication extensions have been initialized.
Configure the Adaptive Processing Server to handle more jobs.
The following recommendations can improve the performance of the Adaptive Processing Server:
•
•
•
If several publications are running concurrently, create multiple instances of the Adaptive Processing
Server. In general, it is recommended that you have one Adaptive Processing Server instance for
every three concurrent publications.
Increase the heap size for the Adaptive Processing Server. To do this, click Manage > Properties,
and add the following to the command-line parameter: -Xmx1024M.
Run the Publishing Service and Publishing Post-Processing Service on different instances of the
Adaptive Processing Server.
If your publisher wants to enable auditing and clean-up, configure auditing for the CMS so
that it logs all details.
For high-volume publications, it is recommended that the publisher enable clean-up to delete unnecessary
files generated by the publication job and conserve server space. To do this, during the publication
design process, the publisher will deselect the default Enterprise location as a destination.
If auditing has been enabled for Publishing, you must configure the CMS to support this scenario so
that the details of the deleted files are still recorded. In the "Servers" area, select the CMS and click
Manage > Properties. In the dialog box that appears, click Audit Events on the navigation list. Ensure
Auditing is Enabled and Object Deleted are selected.
363
2011-05-06
Server Administration
Ensure that the email settings are configured properly for the Destination Job Server.
Publications that are intended for email destinations may fail because email has not been configured
properly as a destination for the Destination Job Server. In the "Servers" area of the CMC, double-click
the Destination Job Server. In the "Properties" dialog box, click Destination on the navigation list to
ensure the following:
•
•
•
Email has been added as a destination.
The values in the Domain Name, Host, and Port fields are correct.
The To field contains %SI_EMAIL_ADDRESS%.
Increase the number of concurrent jobs that the Destination Job Server can process.
If publications are intended for the default BI platform location or an unmanaged disk destination, and
you use striped disks for the Output FRS, it is recommended that you set the maximum number of
concurrent jobs as the number of disks multiplied by five.
If the publisher uses Crystal report dynamic recipient sources, ensure the Report Application
Server (RAS) is configured correctly.
The RAS must be configured to read at least the same number of database records as the number of
recipients in the dynamic recipient source. For instance, to process a dynamic recipient source with
data for 100,000 recipients, the RAS must be set to read more than 100,000 database records.
To check this setting, in the "Servers" area of the CMC, select the RAS and go to Manage > Properties.
In the Number of database records to read when previewing or refreshing a report field, ensure
the number is correct or enter a new number.
Resolving “Out of memory” errors
If the publisher receives the error message java.lang.OutOfMemoryError: unable to create
new native thread when a high-volume publication is run, it is because the Adaptive Processing
Server and Publishing Service have insufficient stack memory to handle the number of Publishing
threads that are generated. This error can occur if stack memory is designated as Java heap space.
You can set a thread limit for the Adaptive Processing Server. In the "Servers" area of the CMC, select
the Adaptive Processing Server and go to Manage > Properties. In the Command Line Parameters
field, enter the following command line parameter:
-Dcom.businessobjects.publisher.threadpool.size=threadlimitnumber
Replace threadlimitnumber with the thread limit number that you want.
If the publisher receives the error message java.lang.OutOfMemoryError: Java heap space
when you run a high-volume publication, it is because the Adaptive Processing Server has insufficient
heap space. In the "Servers" area of the CMC, select the Adaptive Processing Server and go to Manage
> Properties. In the Command Line Parameters field, change the number in the command-line
parameter -Xmx256m to a larger number (for example, -Xmx1024m).
Note:
In some cases, you may have to create more instances of the Adaptive Processing Server to resolve
“Out of memory” errors.
364
2011-05-06
Server Administration
Working in high-volume publishing scenarios
In scenarios where Publications are sent to a high number of recipients with different profile values, the
publishing resources may not be configured to take advantage of all the processing resources available
in the deployment. Underemployed child job servers may actually cause performance bottlenecks
through high volume requests to the system database.
It is possible to tune the Publishing Services to increase the number of simultaneously scheduled jobs
by adjusting the -Dcom.businessobjects.publisher.threadpool.size property for the Adaptive Processing
Server. Increasing the property will increase the use of available job (and children) servers.
Tip:
Some planning and testing in a development environment should be implemented before applying a
new threadpool size to a production deployment.
Use the following guidelines when planning, testing and implementing a new value for the threadpool
size property.
1. Do not use a threadpool size lower than 40.
2. Divide the target resource usage by the usage observed in high-volume publishing scenarios. Multiply
the outcome by 40. Use this number as the target threadpool size. For example in a deployment
running high volume publishing, 30% of the available job processing child servers are used to process
jobs. If an administrator wants to increase utilization to 60%, the threadpool property value needs
to be changed to 80 “-Dcom.businessobjects.publisher.threadpool.size=80”. This result is based on
the calculation of 60% (target utility) divided by 30% (observed utility) multiplied by 40.
Note:
Increasing the threadpool property size impacts the memory used by the publishing resources and
could impact other resources in the deployment. Adjusting the threadpool size property should therefore
only be considered for high-volume publishing scenarios. Ensure that sufficient RAM is available and
that the requisite memory is specified for the Adaptive Processing Server's Java memory settings.
8.1.11 Configuring server settings
This section includes technical information and procedures that show how you can modify settings for
SAP BusinessObjects Business Intelligence platform servers.
The majority of the settings discussed in this section allow you to integrate SAP BusinessObjects
Business Intelligence platform more effectively with your current hardware, software, and network
configurations. Consequently, the settings that you choose will depend largely upon your own
requirements.
You can change server settings though the Central Management Console (CMC) in two ways.
• On "Properties" screen for the server.
• On the "Edit Common Services" screen for the server.
It is important to note that not all changes occur immediately. If a setting cannot change immediately,
the "Properties" and "Edit Common Services" screens display both the current setting (in red text) and
365
2011-05-06
Server Administration
the desired setting. When you return to the Servers management area, the server will be marked as
Stale. When you restart the server, it will use the desired settings and the Stale flag is removed from
the server.
Note:
This section does not show how to configure your Web application server to deploy SAP BusinessObjects
Business Intelligence platform applications. This task is typically performed when you install the product.
For details, see the SAP BusinessObjects Business Intelligence platform Installation Guide.
Related Topics
• Configuring port numbers
• To change a server's properties
• Recreating the CMS system database
• Selecting a new or existing CMS database
8.1.11.1 To change a server's properties
1. Go to the "Servers" management area of the CMC.
2. Double-click the server whose settings you want to change.
The "Properties" screen appears.
3. Make the changes you want, then click Save or Save & Close.
Note:
Not all changes occur immediately. If a setting cannot change immediately, the Properties dialog
box display both the current setting (in red text) and the desired setting. When you return to the
Servers management area, the server will be marked as Stale. When you restart the server, it will
use the desired settings from the Properties dialog box and the Stale flag is removed from the server.
8.1.11.2 To apply service settings to multiple servers
To apply the same setting to services that are hosted on multiple servers,
1. Go to the "Servers" management area of the CMC.
2. Right-click the servers that host the services whose settings you want to change and select Edit
Common Services.
The "Edit Common Services" dialog displays the services that are hosted on all of the servers that
you have selected and that have settings that you can change.
3. If the "Edit Common Services" dialog lists more than one service, select the service that you want
to edit and click Continue.
366
2011-05-06
Server Administration
4. Make the changes that you want and click OK.
Note:
You are redirected to the "Servers" management area of the CMC. If the servers require a restart, the
servers are marked as Stale. When you restarts the server, they will use the desired settings, and the
Stale flag is removed from the servers.
8.1.11.3 Working with configuration templates
Configuration templates allow you to easily configure multiple instances of servers. Configuration
templates store a list of settings for each service type, which you can use to configure additional server
instances. For example, if you have a dozen Web Intelligence Processing Servers that you want to
configure identically, you only need to configure settings for one of them. You can then use the configured
service to define the configuration template for Web Intelligence Processing Servers, and then apply
the template to the other 11 service instances.
Each type of SAP BusinessObjects Business Intelligence platform service has its own configuration
template. For example, there is one configuration template for the Web Intelligence Processing service
type, one for the Publishing service type, and so on. The configuration template is defined in the server
properties in the Central Management Console (CMC).
When you make a server use a configuration template, existing settings for the server are overwritten
with the values from the template. If you later decide to stop using the template, the original settings
are not restored. Subsequent changes to the configuration template no longer affect the server.
It is good practice to use configuration templates as follows:
1. Set the configuration template on one server.
2. Assuming you want the same configuration on all servers of the same type, check Use Configuration
Template for all servers of the same type, including the one where you set the configuration template.
3. Later, if you want to change the configuration of all services of this type, view the properties of any
one of the services, deselect the Use Configuration Template check box. Change the settings you
want, then select Set Configuration Template for this server and click Save. All services of that
type are updated. By not having a server that is always set as the configuration template, you ensure
that you will not accidentally change configuration settings for all servers of that type.
Related Topics
• To set a configuration template
• To apply a configuration template to a server
8.1.11.3.1 To set a configuration template
You can set a configuration template for each type of service. You cannot set multiple configuration
templates for a service. You can use any server's "Properties" page to configure the settings that will
be used by the configuration template for a service type that is hosted on the server.
367
2011-05-06
Server Administration
1. Go to the "Servers" management area of the CMC.
2. Double-click the server that hosts services whose configuration template you want to set.
The "Properties" screen appears.
3. Configure the service settings that you want to use in the template, select the Set Configuration
Template check box and click Save or Save & Close.
The configuration template for the service type that you selected is defined according to the settings of
the current server. Other servers of the same type hosting the same services will be automatically and
immediately reconfigured to match the configuration template if they have the Use Configuration
Template option enabled in their properties.
Note:
If you don't explicitly define the settings for the configuration template, the service's default settings are
used.
Related Topics
• To apply a configuration template to a server
8.1.11.3.2 To apply a configuration template to a server
Before you apply a configuration template, ensure that you have defined the configuration template
settings for the type of server you want to apply the template to. If you haven't explicitly defined the
configuration template settings, the default settings for the service are used.
Note:
Servers that do not have the Use Configuration Template setting enabled will not be updated when you
modify the settings of the configuration template.
1. Go to the "Servers" management area of the CMC.
2. Double-click the server that is hosting a service you want to apply the configuration template to.
The "Properties" screen appears.
3. Select the Use Configuration Template check box and click Save or Save & Close.
Note:
If the server requires you to restart it in order for the new settings to take effect, it will show up as
"stale" in the servers list.
The appropriate configuration template is applied to the current server. Any subsequent changes to the
configuration template change the configuration of all servers that use the configuration template.
Unchecking Use Configuration Template does not restore the server configuration to the values as
they were when the configuration template was applied. Subsequent changes to the configuration
template do not affect the configuration of the servers that are using the configuration template.
Related Topics
• To set a configuration template
368
2011-05-06
Server Administration
8.1.11.3.3 To restore system defaults
You may want to restore a service's configuration to the settings it was initially installed with (for example,
if you misconfigure the servers, or experience performance issues).
1. Go to the "Servers" management area of the CMC.
2. Double-click the server hosting a service that you want to restore system defaults for.
The "Properties" screen appears.
3. Select the Restore System Defaults check box and click Save or Save & Close.
The default settings for the particular service type are restored.
8.1.12 Configuring server network settings
The networking settings for SAP BusinessObjects Business Intelligence platform servers are managed
through the CMC. These settings are divided into two categories: port settings and host identification.
Default settings
During installation, server host identifiers are set to Auto assign. Each server can however be assigned
either a specific IP address or a hostname. The default CMS port number is 6400. The other SAP
BusinessObjects Business Intelligence platform servers dynamically bind to available ports. Port numbers
are automatically managed by SAP BusinessObjects Business Intelligence platform, but you can use
the CMC to specify port numbers.
8.1.12.1 Network environment options
SAP BusinessObjects Business Intelligence platform supports both Internet Protocol 6 (IPv6) and
Internet Protocol version 4 (IPv4) network traffic. You can use the server and client components in any
of the following environments:
•
•
•
IPv4 network: all server and client components run with IPv4 protocol only.
IPv6 network: all server and client components run with IPv6 protocol only.
Mixed IPv6/IPv4 network: server and client components can run with both IPv6 and IPv4 protocols.
Note:
Network configuration should be performed by the system and network administrator. SAP
BusinessObjects Business Intelligence platform does not provide a mechanism to designate a networking
environment. You can use the CMC to bind to a specific IPv6 or IPv4 address for any of your SAP
BusinessObjects Business Intelligence platform servers.
369
2011-05-06
Server Administration
8.1.12.1.1 Mixed IPv6/IPv4 environment
The IPv6/IPv4 networking environment enables the following:
•
•
SAP BusinessObjects Business Intelligence platform servers can service both IPv6 and IPv4 requests
when running in mixed IPv6/IPv4 mode.
Client components can interoperate with servers as IPv6-only nodes, IPv4-only nodes, or IPv6/IPv4
nodes.
The mixed mode is particularly useful in the following scenarios:
• You are moving from an IPv4-only node to an IPv6-only node environment. All the client and server
components will continue to seamlessly interoperate until the transition is complete. You can then
deactivate the IPv4 settings for all the servers.
• Third party software that is not IPv6 compatible will continue to function in the IPv6/IPv4 node
environment.
Note:
DNS names do not resolve properly if IPv6-only node is used with Windows 2003. It is recommended
that your deployment runs as both IPv6/IPv4 if IPv4 stack is disabled on Windows 2003.
8.1.12.2 Server host identification options
Host identification options can be specified in the CMC for every SAP BusinessObjects Business
Intelligence platform server. The following table summarizes the options available in the Common
Settings area:
370
2011-05-06
Server Administration
Option
Description
Auto assign
This is the default setting for all servers. When Auto-Assign is selected, the
server automatically binds the server's Request Port onto the first network interface
on the machine.
Note:
It is good practice to select the Auto-Assign check box for the Host Name setting.
However in some cases, such as when the server is running on multi-homed
machine, or when the server needs to inter-operate with a certain firewall configuration, you should consider using either a specific hostname or IP address. For
more information see “Configuring a multihomed machine” and the “Working with
Firewalls” chapter in the SAP BusinessObjects Business Intelligence platform
Administrator Guide.
Hostname
Specifies the host name of the network interface that the server listens for requests
on. For the CMS, this setting specifies the host name of the network interface
that the CMS binds the Name Server Port and the Request Port.
IP Address
Specifies the IP address of the network interface that the server listens for requests
on. For the CMS this setting specifies the address of the network interface that
the CMS binds the Name Server Port and the Request Port. For every server,
separate fields are provided to specify IPv4 and/or IPv6 IP addresses.
Caution:
Important: If you specify Auto assign on a multi-homed machines, the CMS may automatically bind to
the wrong network interface. To prevent this from happening, make sure the network interfaces on the
host machine are listed in the correct order (using the machine's OS tools). You must also specify the
Host Name setting for the CMS in the CMC.
Note:
If you are working with multi-homed machines or in certain NAT firewall configurations, you may need
to specify the Host Name using fully qualified domain names instead of host names.
Related Topics
• Configuring a multi-homed machine
• To troubleshoot multiple network interfaces
8.1.12.2.1 To modify a server's host identification
1. Go to the "Servers" management area of the CMC.
2. Select the server, then choose Stop Server from the Actions menu.
3. Choose Properties from the Manage menu.
4. Under Common Settings, select one of the following options:
371
2011-05-06
Server Administration
Option
Description
Auto assign
The server will bind to one of the available network interfaces.
Hostname
Enter the host name of the network interface on which server listens for requests.
IP Address
Enter in the fields provided either an IPv4 or an IPv6 IP address for the network
interface on which server listens for requests.
Note:
To enable the server to operate as a dual IPv4/IPv6 node, enter a valid IP address in both fields.
5. Click Save or Save & Close.
The changes are reflected in the command line displayed on the "Properties" tab.
6. Start and enable the server.
8.1.12.3 Configuring a multi-homed machine
A multi-homed machine is one that has multiple network addresses. You may accomplish this with
multiple network interfaces, each with one or more IP addresses, or with a single network interface that
has been assigned multiple IP addresses.
If you have multiple network interfaces, each with a single IP address, change the binding order so that
the network interface at the top of the binding order is the one you want the SAP BusinessObjects
Business Intelligence platform servers to bind to. If your interface has multiple IP addresses, use the
Host Name option in the CMC to specify a network interface card for the SAP BusinessObjects Business
Intelligence platform server. It can be specified by host name or IP address. For more information about
configuring the Host Name setting, see “To troubleshoot multiple NICs ”.
Tip:
This section shows how to restrict all servers to the same network address, but it is possible to bind
individual servers to different addresses. For instance, you might want to bind the File Repository
Servers to a private address that is not routable from users' machines. Advanced configurations such
as this require your DNS configuration to route communications effectively between all the SAP
BusinessObjects Business Intelligence platform server components. In this example, the DNS must
route communications from the other SAP BusinessObjects Business Intelligence platform servers to
the private address of the File Repository Servers.
Related Topics
• To troubleshoot multiple network interfaces
372
2011-05-06
Server Administration
8.1.12.3.1 To configure the CMS to bind to a network address
Note:
On a multi-homed machine, the Host Identifier can be set to the fully qualified domain name or the IP
address of the interface that you want the server to bind to.
1. Go to the Servers management area of the CMC.
2. Double-click the CMS.
3. Under "Common Settings", select one of the following options:
• Hostname
• Enter the host name of the network interface to which the server will bind.
• IP Address
• Enter in the fields provided either an IPv4 or an IPv6 IP address for the network interface to which
the server will bind.
Note:
To enable the server to operate as a dual IPv4/IPv6 node, enter a valid IP address in both fields.
Caution:
Do not select Auto assign.
4. For Request Port you can do one of the following:
•
•
Select the Auto assign option.
Enter a valid port number in the Request Port field.
5. Make sure that a port number is specified in the Name Server Port dialog box.
Note:
The default port number is 6400.
8.1.12.3.2 Configuring the remaining servers to bind to a network address
The remaining SAP BusinessObjects Business Intelligence platform servers select their ports dynamically
by default. For information on disabling the Auto assign setting that dynamically propagates this
information, see “To change the port a server uses for accepting requests ”.
Related Topics
• To change the port a server uses for accepting requests
8.1.12.3.3 To troubleshoot multiple network interfaces
On a multi-homed machine, the CMS may automatically bind to the wrong network interface. To prevent
this from happening, you can ensure the network interfaces on the host machine are listed in the correct
order (using the machine's OS tools), or make sure you specify the Host Name setting for the CMS in
the CMC. If the primary network interface is not routable, you can use the following procedure to
configure BI platform to bind to a non-primary routable network interface. Perform these steps immediately
after installing BI platform on the local machine, before installing the platform on other machines.
373
2011-05-06
Server Administration
1. Open the CCM and stop the SIA for the node on the machine that has multiple network interfaces.
2. Right-click the SIA and choose Properties.
3. In the "Properties" dialog box, click the "Configuration" tab.
4. To bind the SIA to a specific network interface, type in the Port field one of the following:
•
•
the hostname of the target network interface and port number (use the hostname:port number
format)
the IP address of the target network interface and port number (use the IP address:port number
format)
5. Click OK and select the "Startup" tab.
6. From the "Local CMS Servers" list select the CMS and click Properties.
7. To bind the CMS to a specific network interface, type in the Port field one of the following:
•
•
the hostname of the target network interface and port number (use the hostname:port number
format)
the IP address of the target network interface and port number (use the IP address:port number
format)
8. Click OK to apply the new settings.
9. Start the SIA and wait for the servers to start.
10. Launch the Central Management Console (CMC), and go to the "Servers" management area. Repeat
steps 11-14 for each server.
11. Select the server, then choose Stop Server from the Actions menu.
12. Choose Properties from the Manage menu.
13. Under Common Settings, select one of the following options:
•
•
Hostname: enter the host name of the network interface to which the server will bind.
IP Address: enter in the fields provided either an IPv4 or an IPv6 IP address for the network
interface to which the server will bind.
Note:
To enable the server to operate as a dual IPv4/IPv6 node, enter a valid IP address in both fields.
Caution:
Do not select Auto assign.
14. Click Save or Save & Close.
15. Return to the CCM and restart the SIA.
The SIA restarts all servers on the node. All servers on the machine now bind to the correct network
interface.
8.1.12.4 Configuring port numbers
374
2011-05-06
Server Administration
During installation, the CMS is set up to use default port numbers. The default CMS port number is
6400. This port falls within the range of ports reserved by SAP Business Objects (6400 to 6410).
Communication on these ports should not conflict with third-party applications.
When started and enabled, each of the other SAP BusinessObjects Business Intelligence platform
servers dynamically binds to an available port (higher than 1024), registers with this port on the CMS,
and then listens for SAP BusinessObjects Business Intelligence platform requests. If necessary, you
can instruct each server component to listen on a specific port (rather than dynamically selecting any
available port).
Port numbers can be specified on each server's Properties tab in the CMC. This table summarizes the
options under the "Common Settings" area as they relate to port usage for specific server types:
Setting
CMS
Other Servers
Request Port
Specifies the port that the CMS uses
for accepting all requests from other
servers (except for Name Server
requests). Uses the same network
interface as the Name Server Port.
When Auto assign is selected, the
server automatically uses an OSassigned port number.
Specifies the port on which the
server listens for all requests. When
Auto assign is selected, the server
automatically uses a port number
assigned by the OS.
Name Server Port
Specifies the SAP BusinessObjects
Business Intelligence platform port
on which the CMS listens for name
service requests. The default is
6400.
Not applicable.
8.1.12.4.1 To change the default CMS port in the CMC
If there is a CMS already running on the cluster, you can use the CMC to change the default CMS port
number. If no CMS is running on the cluster, you must use the CCM on Windows, or the servercon
fig.sh script on UNIX, to change the port number.
Note:
The CMS uses the same network interface card for the request port and the name server port.
1. Go to the "Servers" management area of the CMC.
2. Double-click the CMS in the server list.
3. Replace the Name Server Port number with the port that you want the CMS to listen on. (The default
port is 6400.)
4. Click Save & Close.
5. Restart the CMS.
The CMS begins listening on the port number you specified. The Server Intelligence Agent dynamically
propagates the new settings to the other servers on the node, if those servers have the Auto assign
375
2011-05-06
Server Administration
option selected for the request port. (It may take several minutes for your changes to appear in the
Properties settings of all node members.)
The settings you choose on the "Properties" page are reflected in the server command line, which
also appears on the "Properties" page.
8.1.12.4.2 To change the default CMS port in the CCM on Windows
If no CMS is accessible on the cluster and you want to modify the default CMS port for one or more
CMSs in your deployment, you must use the CCM to change the CMS port number.
1. Open the CCM and stop the SIA for the node.
2. Right-click the SIA and choose Properties.
3. In the "Properties" dialog box, click the "Startup" tab.
4. From the "Local CMS Servers" list select the CMS that you want to change the port number for, and
click Properties.
5. To bind the CMS to a specific port, type in the Port field one of the following:
•
•
•
port number
the hostname and port number (use the hostname:port number format)
the IP address and port number (use the IP address:port number format)
6. Click OK to apply the new settings.
7. Start the SIA and wait for the servers to start.
8.1.12.4.3 To change the default CMS port in the CCM on UNIX
If no CMS is accessible on the cluster and you want to modify the default CMS port for one or more
CMSs in your deployment, you must use the serverconfig.sh script to change the CMS port number.
1. Use the ccm.sh script to stop the Server Intelligence Agent (SIA) that hosts the CMS whose port
number you want to change.
2. Run the serverconfig.sh script. By default this script is in the <InstallDir>/sap_bobj
directory by default.
3. Select 3 - Modify a Server Intelligence Agent, and press Enter.
4. Select the SIA that hosts the CMS that you want to modify, and press Enter.
5. Select 4 - Modify a server and press Enter.
A list of CMSs that are currently hosted on the SIA is displayed.
6. Select the CMS that you want to modify and press Enter.
7. Type the new port number for the CMS and press Enter.
8. Specify whether you want the CMS to automatically start when the SIA starts and press Enter.
9. Type the command-line arguments for the CMS, or accept the current arguments, and press Enter.
10. Start the SIA with the ccm.sh script, and wait for the servers to start.
8.1.12.4.4 To change the port a server uses for accepting requests
1. Go to the "Servers" management area of the CMC.
376
2011-05-06
Server Administration
2. Select the server, then choose Stop Server from the Actions menu.
3. Double-click the server.
The "Properties" screen appears.
4. Under "Common Settings", deselect the Auto assign check box for Request Port, then type the
port number you want the server to listen on.
5. Click Save or Save & Close.
6. Start and enable the server.
The server binds to the new port, registers with the CMS, and begins listening for SAP BusinessObjects
Business Intelligence platform requests on the new port.
8.1.13 Managing Nodes
8.1.13.1 Using nodes
A node is a group of BI platform servers that run on the same host. All of the servers on a node run
under the same user account.
One machine can contain many nodes, so you can run processes under different user accounts.
One Server Intelligence Agent (SIA) manages and monitors all of the servers on a node, ensuring they
operate properly.
Note:
You must use an Administrator account with Enterprise authentication to perform all node management
procedures securely. However, if SSL communication between servers is enabled, you must disable
SSL to perform any node management procedures. For more information, see the “Configuring servers
for SSL” section.
8.1.13.1.1 Variables
This chapter uses the following variables.
377
2011-05-06
Server Administration
Variable
Description
<INSTALLDIR>
The directory where BI platform is installed.
On a Windows machine, it is C:\Program Files (x86)\SAP
BusinessObjects
<SCRIPTDIR>
The directory where node management scripts are located.
On a Windows machine, it is <INSTALLDIR>\SAP BusinessObjects
Business Intelligence platform 4.0\win64_x64\scripts
On Unix machines, it is <INSTALLDIR>/sap_bobj/enterprise_xi40/<PLAT
FORM>/scripts
<PLATFORM>
The name of your Unix operating system. Acceptable values are:
• aix_rs6000_64
• linux_x64
• solaris_sparcv9
• hpux_ia64
8.1.13.2 Adding a new node
The installation program creates nodes when you first install SAP BusinessObjects Business Intelligence
platform.
You may need additional nodes if you want to add a new machine to an existing cluster to improve the
cluster's performance, or if you want to run servers under different user accounts with an existing
deployment.
You can add a new node using the Central Configuration Manager (CCM), or using a node management
script. If you use a firewall, ensure that the ports of your Server Intelligence Agent (SIA) and Central
Management Server (CMS) are open.
Note:
You can add a node only on the machine where the node is located. A single machine can contain
multiple nodes, and the nodes can be in the same BI platform cluster or in different clusters.
8.1.13.2.1 Adding a node to a new machine on an existing deployment
You can automatically create the first node on a machine when you use the installation program to add
a new machine to an existing deployment.
Tip:
During the installation, click Expand, and specify your existing Central Management Server.
378
2011-05-06
Server Administration
If you want to create additional nodes, use the Central Configuration Manager or the script.
For more information on installation, see the SAP BusinessObjects Business Intelligence Platform
Installation Guide.
8.1.13.2.2 To add a node on Windows
Caution:
Back up the server configuration for the entire cluster before and after you add a node.
1. In the Central Configuration Manager (CCM), on the toolbar, click Add Node.
2. In the "Add Node Wizard", enter the node name and port number for the new Server Intelligence
Agent (SIA).
3. Choose whether you want to create servers on the new node.
•
•
•
Add node with no servers
Add node with CMS
Add node with default servers
This option creates only the servers installed on this machine. It does not include all possible
servers.
4. Select a CMS.
• If your deployment is running, select Use existing running CMS, and click Next.
If prompted, enter the host name and port for the existing CMS, the Administrator credentials,
the data source name, the credentials for the system database, and the cluster key.
•
If your deployment is stopped, select Start a new temporary CMS, and click Next.
If prompted, enter the host name and port for the temporary CMS, the Administrator credentials,
the data source name, the database credentials for the system database, and the cluster key. A
temporary CMS will start. (It will stop when this process finishes.)
Caution:
Avoid using the deployment while the temporary CMS runs. Ensure that the existing and temporary
CMS use different ports.
5. Review the confirmation page, and click Finish.
The CCM creates a node. If any errors occur, review the log file.
You can now use the CCM to start the new node.
Adding a node on Windows using a script
Caution:
Back up the server configuration for the entire cluster before and after you add a node.
You can use AddNode.bat to add a node on a Windows machine. For more information, see the
“Script parameters for adding, recreating, and deleting nodes” section.
379
2011-05-06
Server Administration
Example:
Due to the limitations of the command prompt, you must use the caret (^) to escape spaces, the equals
sign (=) and the semicolon (;) in the -connect string.
<SCRIPTDIR>\AddNode.bat -name mynode2
-siaport 6415
-cms mycms:6400
-username Administrator
-password Password1
-cmsport 7400
-dbdriver mysqldatabasesubsystem
-connect "DSN^=BusinessObjects^ CMS^ 140^;UID^=username^;PWD^=Password1^;HOSTNAME^=database^;PORT^=3306"
-dbkey abc1234
Note:
To avoid using the caret in long strings, you can write the script's name and all of its parameters to a
temporary response.bat file, and then run response.bat without any parameters.
Related Topics
• Variables
• Script parameters for adding, recreating, and deleting nodes
8.1.13.2.3 To add a node on Unix
Caution:
Back up the server configuration for the entire cluster before and after you add a node.
1. Run <INSTALLDIR>/sap_bobj/serverconfig.sh
2. Select 1 - Add node, and press Enter.
3. Type the name of the new node, and press Enter.
4. Type the port number of the new SIA, and press Enter.
5. Choose whether you want to create servers on the new node.
• no servers
Creates a node that does not contain any servers.
•
cms
Creates a CMS on the node, but does not create other servers.
•
default servers
Creates only the servers installed on this machine. It does not include all possible servers.
6. Select a CMS.
• If your deployment is running, select existing, and press Enter.
If prompted, enter the host name and port for the existing CMS, the Administrator credentials,
the database connection information and the credentials for the system database, and the cluster
key.
380
2011-05-06
Server Administration
•
If your deployment is stopped, select temporary, and press Enter.
If prompted, enter the host name and port for the temporary CMS, the Administrator credentials,
the database connection information and the credentials for the system database, and the cluster
key. A temporary CMS will start. (It will stop when this process finishes.)
Caution:
Avoid using the deployment while the temporary CMS runs. Ensure that the existing and temporary
CMS use different ports.
7. Review the confirmation page, and press Enter.
The CCM creates a node. If any errors occur, review the log file.
You can now run <INSTALLDIR>/sap_bobj/ccm.sh -start <nodeName> to start the new node.
Adding a node on Unix using a script
Caution:
Back up the server configuration for the entire cluster before and after you add a node.
You can use addnode.sh to add a node on a Unix machine. For more information, see the “Script
parameters for adding, recreating, and deleting nodes” section.
Example:
<SCRIPTDIR>/addnode.sh -name mynode2
-siaport 6415
-cms mycms:6400
-username Administrator
-password Password1
-cmsport 7400
-dbdriver mysqldatabasesubsystem
-connect "DSN=BusinessObjects CMS 140;UID=Administrator;PWD=Password1;HOSTNAME=myDatabase;PORT=3306"
-dbkey abc1234
Related Topics
• Variables
• Script parameters for adding, recreating, and deleting nodes
8.1.13.3 Recreating a node
You can recreate a node using the Central Configuration Manager (CCM), or using a node management
script, after you restore the server configuration for the entire cluster, or if the machine hosting your
deployment fails, becomes damaged, or has a corrupt file system. Use the following guidelines:
•
381
It is not necessary to recreate a node if you reinstall the deployment on a replacement machine with
identical installation options and node name. The installation program automatically recreates the
node.
2011-05-06
Server Administration
•
•
•
•
A node should be recreated only on a machine with an existing deployment with identical installation
options and patch level.
You should recreate only nodes that do not exist on any machines in your deployment. Ensure that
no other machines host the same node.
Although the deployment allows nodes to run on different operating systems, you should recreate
nodes only on machines that use the same operating system.
If you use a firewall, ensure that the ports of your Server Intelligence Agent (SIA) and Central
Management Server (CMS) are open.
Remember:
You can recreate a node only on the machine where the node is located.
Related Topics
• Restoring your system
8.1.13.3.1 To recreate a node on Windows
1. In the Central Configuration Manager (CCM), on the toolbar, click Add Node.
2. In the "Add Node Wizard", enter the node name and port number for the recreated Server Intelligence
Agent (SIA).
Note:
The names of the original and recreated nodes must be identical.
3. Select Recreate node, and click Next.
•
If the node exists in the system database of the Central Management Server (CMS), it is recreated
on the local host.
Caution:
Use this option only if the node does not exist on any hosts in the cluster.
•
If the node does not exist in the system database of the CMS, a new node with default servers
is added. Default servers include all of the servers installed on the host.
4. Select a CMS.
• If your CMS is running, select Use existing running CMS, and click Next.
If prompted, enter the host name and port for the existing CMS, the Administrator credentials,
the data source name, the credentials for the system database, and the cluster key.
•
If your CMS is stopped, select Start a new temporary CMS, and click Next.
If prompted, enter the host name and port for the temporary CMS, the Administrator credentials,
the data source name, the credentials for the system database, and the cluster key. A temporary
CMS will start. (It will stop when this process finishes.)
Caution:
Avoid using the deployment while the temporary CMS runs. Ensure that the existing and temporary
CMS use different ports.
5. Review the confirmation page, and click Finish.
382
2011-05-06
Server Administration
The CCM recreates the node, and adds information about the node to the local machine. If any
errors occur, review the log file.
You can now use the CCM to start the recreated node.
Recreating a node on Windows using a script
You can use AddNode.bat to recreate a node on a Windows machine. For more information, see the
“Script parameters for adding, recreating, and deleting nodes” section.
Example:
Due to the limitations of the command prompt, you must use the caret (^) to escape spaces, the equals
sign (=) and the semicolon (;) in the -connect string.
<SCRIPTDIR>\AddNode.bat -name mynode2
-siaport 6415
-cms mycms:6400
-username Administrator
-password Password1
-cmsport 7400
-dbdriver mysqldatabasesubsystem
-connect "DSN^=BusinessObjects^ CMS^ 140^;UID^=username^;PWD^=Password1^;HOSTNAME^=database^;PORT^=3306"
-dbkey abc1234
-adopt
Note:
To avoid using the caret in long strings, you can write the script's name and all of its parameters to a
temporary response.bat file, and then run response.bat without any parameters.
Related Topics
• Variables
• Script parameters for adding, recreating, and deleting nodes
8.1.13.3.2 To recreate a node on Unix
1. Run <INSTALLDIR>/sap_bobj/serverconfig.sh
2. Select 1 - Add node, and press Enter.
3. Type the name of the new node, and press Enter.
Note:
The names of the original and recreated nodes must be identical.
4. Type the port number of the new SIA, and press Enter.
5. Select recreate node and press Enter.
•
If the node exists in the system database of the Central Management Server (CMS), it is recreated
on the local host.
Caution:
Use this option only if the node does not exist on any hosts in the cluster.
383
2011-05-06
Server Administration
•
If the node does not exist in the system database of the CMS, a new node with default servers
is added. Default servers include all of the servers installed on the host.
6. Select a CMS.
• If your deployment is running, select existing, and press Enter.
If prompted, enter the host name and port for the existing CMS, the Administrator credentials,
the database connection information and the credentials for the system database, and the cluster
key.
•
If your deployment is stopped, select temporary, and press Enter.
If prompted, enter the host name and port for the temporary CMS, the Administrator credentials,
the database connection information and the credentials for the system database, and the cluster
key. A temporary CMS will start. (It will stop when this process finishes.)
Caution:
Avoid using the deployment while the temporary CMS runs. Ensure that the existing and temporary
CMS use different ports.
7. Review the confirmation page, and press Enter.
The CCM recreates the node, and adds information about the node to the local machine. If any
errors occur, review the log file.
You can now run <INSTALLDIR>/sap_bobj/ccm.sh -start <nodeName> to start the recreated
node.
Recreating a node on Unix using a script
You can use addnode.sh to recreate a node on a Unix machine. For more information, see the “Script
parameters for adding, recreating, and deleting nodes” section.
Example:
<SCRIPTDIR>/addnode.sh -name mynode2
-siaport 6415
-cms mycms:6400
-username Administrator
-password Password1
-cmsport 7400
-dbdriver mysqldatabasesubsystem
-connect "DSN=BusinessObjects CMS 140;UID=Administrator;PWD=Password1;HOSTNAME=database;PORT=3306"
-dbkey abc1234
-adopt
Related Topics
• Variables
• Script parameters for adding, recreating, and deleting nodes
384
2011-05-06
Server Administration
8.1.13.4 Deleting a node
You can delete a stopped node using a running Central Configuration Manager (CCM), or using a node
management script. Use the following guidelines:
•
•
Deleting a node also permanently deletes the servers on the node.
If your cluster has multiple machines, delete the nodes before you remove a machine from the cluster
and uninstall the software from it. If you remove a machine from a cluster before deleting a node,
or if the file system on a machine malfunctions, you must recreate the node on a different machine
with the same servers, in the same cluster, and then delete the node.
Remember:
You can delete a node only on the machine where the node is located.
Related Topics
• Recreating a node
8.1.13.4.1 To delete a node on Windows
Caution:
Back up the server configuration for the entire cluster before and after you delete a node.
1. Run the Central Configuration Manager (CCM).
2. In the CCM, stop the node that you want to delete.
3. Select the node, and click Delete Node on the toolbar.
4. If prompted, enter the host name, the port, the Administrator credentials for the CMS, and the cluster
key.
The CCM deletes the node and all the servers on the node.
Deleting a node on Windows using a script
Caution:
Back up the server configuration for the entire cluster before and after you delete a node.
You can use RemoveNode.bat to delete a node on a Windows machine. For more information, see
the “Script parameters for adding, recreating, and deleting nodes” section.
Example:
<SCRIPTDIR>\RemoveNode.bat -name mynode2
-cms mycms:6400
-username Administrator
-password Password1
385
2011-05-06
Server Administration
Related Topics
• Variables
• Script parameters for adding, recreating, and deleting nodes
8.1.13.4.2 To delete a node on Unix
Caution:
Back up the server configuration for the entire cluster before and after you delete a node.
1. Run <INSTALLDIR>/sap_bobj/ccm.sh -stop <nodeName> to stop the node that you want
to delete.
2. Run <INSTALLDIR>/sap_bobj/serverconfig.sh
3. Select 2 - Delete node, and press Enter.
4. Select the node you want to delete, and press Enter.
5. If prompted, enter the host name, the port, the Administrator credentials for the CMS, and the cluster
key.
The node and all the servers on the node are deleted.
Deleting a node on Unix using a script
Caution:
Back up the server configuration for the entire cluster before and after you delete a node.
You can use removenode.sh to delete a node on a Unix machine. For more information, see the
“Script parameters for adding, recreating, and deleting nodes” section.
Example:
<SCRIPTDIR>\RemoveNode.sh -name mynode2
-cms mycms:6400
-username Administrator
-password Password1
Related Topics
• Variables
• Script parameters for adding, recreating, and deleting nodes
8.1.13.5 Renaming a node
You can rename a node using the Central Configuration Manager (CCM). In order to rename a node,
you must create a new node with a new name, clone the servers from the original node to the new
node, and then delete the original node. Use the following guidelines:
386
2011-05-06
Server Administration
•
•
If you rename the machine where a node is located, you do not need to rename the node. You can
continue to use the existing node name.
If you use a firewall, ensure that the ports of your Server Intelligence Agent (SIA) and Central
Management Server (CMS) are open.
Remember:
You can rename a node only on the machine where the node is located.
Related Topics
• Adding a new node
• Cloning servers
• Deleting a node
8.1.13.5.1 To rename a node on Windows
Caution:
Back up the server configuration for the entire cluster before and after you rename a node.
1. Start the Central Configuration Manager (CCM).
2. In the Central Configuration Manager (CCM), on the toolbar, click Add Node.
3. In the "Add Node Wizard", enter the node name and port number for the new Server Intelligence
Agent (SIA), the Administrator credentials, the database connection information, the credentials for
the system database, and the cluster key.
4. Select Add node with no servers.
5. After the node is created, use the "Server Management" page of the Central Management Console
to clone all of the servers from the original node to the new node.
Note:
Ensure that the cloned servers have no port conflicts with servers on the old node.
6. In the CCM, start the new node.
7. After the new node has been running for five minutes, use the CCM to delete the original node.
Related Topics
• Adding a new node
• Cloning servers
• Deleting a node
8.1.13.5.2 To rename a node on Unix
Caution:
Back up the server configuration for the entire cluster before and after you rename a node.
1. Run <INSTALLDIR>/sap_bobj/serverconfig.sh.
2. Select 1 - Add node, and press Enter.
3. Type the name of the new node, and press Enter.
387
2011-05-06
Server Administration
4. Type the port number of the new SIA, and press Enter.
5. If prompted, enter the Administrator credentials, the database connection information, the credentials
for the system database, and the cluster key.
6. Select no servers and press Enter.
7. After the node is created, use the "Server Management" page of the Central Management Console
to clone all of the servers from the original node to the new node.
Note:
Ensure that the cloned servers have no port conflicts with servers on the old node.
8. Run <INSTALLDIR>/sap_bobj/ccm.sh -start <nodeName> to start the new node.
9. After the new node has been running for five minutes, use serverconfig.sh to delete the original
node.
Related Topics
• Adding a new node
• Cloning servers
• Deleting a node
8.1.13.6 Moving a node
You can move a stopped node from one cluster to another using the Central Configuration Manager
(CCM), or using a node management script. Use the following guidelines:
•
•
•
Ensure that the destination cluster does not have a node with the same name.
Ensure that all server types installed on the machine where the source node is located are also
installed on the production cluster.
If you want to add a new machine to a production cluster but do not want the machine to be usable
until you finish testing it, install BI platform on a stand-alone machine, test the machine, then move
the node to a production cluster.
Remember:
You can move a node only on the machine where the node is located.
8.1.13.6.1 To move an existing node on Windows
In this example, the node that you want to move is installed on the source system. The machine was
initially not in a cluster, but it is to be added to the destination cluster.
Caution:
Back up the server configuration for the entire cluster before and after you move a node.
1. Stop the node in the Central Configuration Manager (CCM).
2. Right-click the node and select Move.
388
2011-05-06
Server Administration
3. If prompted, select the data source name, and enter the host name, the port, the database connection
information, the Administrator credentials for the destination CMS, and the cluster key.
4. Select a CMS.
• If your source deployment is running, select Use existing running CMS, and click Next.
If prompted, enter the host name and port for the source system's existing CMS, the Administrator
credentials, the data source name, the credentials for the source system database, and the
cluster key.
•
If your source deployment is stopped, select Start a new temporary CMS, and click Next.
If prompted, enter the host name and port for the source system's temporary CMS, the
Administrator credentials, the data source name, the database credentials for the source system
database, and the cluster key. A temporary CMS will start. (It will stop when this process finishes.)
Caution:
Avoid using the deployment while the temporary CMS runs. Ensure that the existing and temporary
CMS use different ports.
5. Review the confirmation page, and click Finish.
The CCM creates a new node on the destination cluster with the same name and the same servers
as the node on the source cluster. A copy of the node remains on the source cluster. The configuration
templates for the servers in the node do not move. If any errors occur, review the log file.
Caution:
Do not use the source cluster after moving the node.
6. In the CCM, start the moved node.
Moving a node on Windows using a script
Caution:
Back up the server configuration for the entire cluster before and after you move a node.
You can use MoveNode.bat to move a node on a Windows machine. For more information, see the
“Script parameters for moving nodes” section.
Example:
Due to the limitations of the command prompt, you must use the caret (^) to escape spaces, the equals
sign (=) and the semicolon (;) in the -connect string.
<SCRIPTDIR>\MoveNode.bat -cms sourceMachine:6409
-username Administrator
-password Password1
-dbdriver mysqldatabasesubsystem
-connect "DSN^=Source^ BOEXI40^;UID^=username^;PWD^=Password1^;HOSTNAME^=database1^;PORT^=3306"
-dbkey abc1234
-destcms destinationMachine:6401
-destusername Administrator
-destpassword Password2
-destdbdriver sybasedatabasesubsystem
-destconnect "DSN^=Destin^ BOEXI40^;UID^=username^;PWD^=Password2^;"
-destdbkey def5678
389
2011-05-06
Server Administration
Note:
To avoid using the caret in long strings, you can write the script's name and all of its parameters to a
temporary response.bat file, and then run response.bat without any parameters.
Related Topics
• Variables
• Script parameters for moving nodes
8.1.13.6.2 To move an existing node on Unix
In this example, the node that you want to move is installed on the source system. The machine was
initially part of a standalone cluster, but it is to be added to the destination cluster.
Caution:
Back up the server configuration for the entire cluster before and after you move a node.
1. Run <INSTALLDIR>/sap_bobj/ccm.sh -stop <nodeName> to stop the node.
2. Run <INSTALLDIR>/sap_bobj/serverconfig.sh
3. Select 4 - Move node, and press Enter.
4. Select the node you want to move, and press Enter.
5. When prompted, select the system database connection information, and enter the host name, the
port, the Administrator credentials for the destination CMS, and the cluster key.
6. Select a CMS.
• If your source deployment is running, select existing, and press Enter.
If prompted, enter the host name and port for the source system's existing CMS, the Administrator
credentials, the database connection information and the credentials for the source system
database, and the cluster key.
•
If your source deployment is stopped, select temporary, and press Enter.
If prompted, enter the host name and port for the source system's temporary CMS, the
Administrator credentials, the database connection information and the credentials for the source
system database, and the cluster key. A temporary CMS will start. (It will stop when this process
finishes.)
Caution:
Avoid using the deployment while the temporary CMS runs. Ensure that the existing and temporary
CMS use different ports.
7. Review the confirmation page, and press Enter.
The CCM creates a new node on the destination cluster with the same name and the same servers
as the node on the source cluster. A copy of the node remains on the source cluster. The configuration
templates for the servers in the node do not move. If any errors occur, review the log file.
390
2011-05-06
Server Administration
Caution:
Do not use the source cluster after moving the node.
8. Run <INSTALLDIR>/sap_bobj/ccm.sh -start <nodeName> to start the moved node.
Moving a node on Unix using a script
Caution:
Back up the server configuration for the entire cluster before and after you move a node.
You can use movenode.sh to move a node on a Unix machine. For more information, see the “Script
parameters for moving nodes” section.
Example:
<SCRIPTDIR>/movenode.sh -cms sourceMachine:6409
-username Administrator
-password Password1
-dbdriver mysqldatabasesubsystem
-connect "DSN=Source BOEXI40;UID^=username;PWD=Password1;HOSTNAME=database1;PORT=3306"
-dbkey abc1234
-destcms destinationMachine:6401
-destusername Administrator
-destpassword Password2
-destdbdriver sybasedatabasesubsystem
-destconnect "DSN=Destin BOEXI40;UID=username;PWD=Password2;"
-destdbkey def5678
Related Topics
• Variables
• Script parameters for moving nodes
8.1.13.7 Script parameters
8.1.13.7.1 Script parameters for adding, recreating, and deleting nodes
391
Parameter
Description
Example
-adopt
Recreates the node if it already exists
in the CMS.
-adopt
2011-05-06
Server Administration
Parameter
Description
Example
The name and port number of the
Central Management Server (CMS).
-cms
Caution:
Do not use this parameter if you use
-usetempcms
-cms mycms:6409
Note:
You must specify a port number if the
CMS is not running on the default 6400
port.
•
The port of the CMS when starting
a temporary CMS.
Restriction:
You must also use the -usetem
pcms, -dbdriver, -connect, and
-dbkey parameters.
-cmsport
•
The port of the CMS when creating
a new CMS.
-cmsport 6401
Restriction:
You must also use the -dbdriver,
-connect, and -dbkey parameters.
The connection string of the CMS or
the temporary CMS system database.
-connect
Note:
Omit the HOSTNAME and PORT attributes when connecting to DB2, Oracle, SQL Server, or Sybase databases.
-connect "DSN=BusinessObjects CMS
140;UID=username;PWD=pass
word;HOST
NAME=database;PORT=3306"
The database driver of the CMS.
392
-dbdriver
Accepted values:
• db2databasesubsystem
• maxdbdatabasesubsystem
• mysqldatabasesubsystem
• oracledatabasesubsystem
• sqlserverdatabasesubsystem
• sybasedatabasesubsystem
-dbdriver mysqldatabasesubsystem
-dbkey
The cluster key.
-dbkey abc1234
2011-05-06
Server Administration
Parameter
Description
Example
-name
The name of a node.
-name mynode2
Creates a node without servers.
-noservers
Note:
The additional -createcms parameter
creates a node with a CMS, but no
other servers. Omit these parameters
to create a node with all of the default
servers.
-noservers
-password
The password of the Administrator account.
-password Password1
-siaport
The port number of the Server Intelligence Agent for the node.
-siaport 6409
-username
The user name of the Administrator
account.
-username Administrator
Caution:
Do not use this parameter if you use
-cms
-usetempcms
Starts and uses the temporary CMS.
-usetempcms
Note:
Use a temporary CMS when your deployment is not running.
Related Topics
• Adding a node on Windows using a script
• Adding a node on Unix using a script
• Recreating a node on Windows using a script
• Recreating a node on Unix using a script
• Deleting a node on Windows using a script
• Deleting a node on Unix using a script
393
2011-05-06
Server Administration
8.1.13.7.2 Script parameters for moving nodes
Parameter
Description
Example
The name of the source Central Management Server (CMS).
-cms
Caution:
Do not use this parameter if you use
-usetempcms
-cms sourceMachine:6409
Note:
You must specify a port number if the
CMS is not running on the default 6400
port.
•
The port of the CMS when starting
a temporary CMS.
Restriction:
You must also use the -usetem
pcms, -dbdriver, -connect, and
-dbkey parameters.
-cmsport
•
The port of the CMS when creating
a new CMS.
-cmsport 6401
Restriction:
You must also use the -dbdriver,
-connect, and -dbkey parameters.
The connection string of the source
CMS or the temporary CMS system
database.
-connect
394
Note:
Omit the HOSTNAME and PORT attributes when connecting to DB2, Oracle, SQL Server, or Sybase databases.
-connect "DSN=Source
BOEXI40;UID=username;PWD=pass
word;HOST
NAME=database;PORT=3306"
2011-05-06
Server Administration
Parameter
Description
Example
The database driver of the source
CMS.
-dbdriver
-dbkey
Accepted values:
• db2databasesubsystem
• maxdbdatabasesubsystem
• mysqldatabasesubsystem
• oracledatabasesubsystem
• sqlserverdatabasesubsystem
• sybasedatabasesubsystem
The source cluster key.
-dbdriver mysqldatabasesubsystem
-dbkey abc1234
The name of the destination CMS.
-destcms
Note:
You must specify a port number if the
CMS is not running on the default 6400
port.
The connection string of the destination
CMS system database.
-destconnect
Note:
Omit the HOSTNAME and PORT attributes when connecting to DB2, Oracle, SQL Server, or Sybase databases.
-destcms destinationMachine:6401
-destconnect "DSN=Destin
BOEXI40;UID=username;PWD=pass
word;HOST
NAME=database;PORT=3306"
The database driver of the destination
CMS.
-destdbdriver
Accepted values:
• db2databasesubsystem
• maxdbdatabasesubsystem
• mysqldatabasesubsystem
• oracledatabasesubsystem
• sqlserverdatabasesubsystem
• sybasedatabasesubsystem
-destdbdriver sybasedatabasesubsystem
Note:
sqlserverdatabase is not supported
on Unix.
-destdbkey
395
The destination cluster key.
-destdbkey def5678
2011-05-06
Server Administration
Parameter
Description
Example
-destpassword
The password of the Administrator account on the destination CMS.
-destpassword Password2
-destusername
The user name of the Administrator
account on the destination CMS.
-destusername Administrator
-password
The password of the Administrator account on the source CMS.
-password Password1
-username
The user name of the Administrator
account on the source CMS.
-username Administrator
Caution:
Do not use this parameter if you use
-cms
-usetempcms
Starts and uses the temporary CMS.
-usetempcms
Note:
Use a temporary CMS when your deployment is not running.
Related Topics
• Moving a node on Windows using a script
• Moving a node on Unix using a script
8.1.13.8 Adding Windows server dependencies
In a Windows environment, each instance of the Server Intelligence Agent (SIA) depends on the Event
Log and Remote Procedure Call (RPC) services.
If a SIA does not operate correctly, ensure that both services appear on the SIA's "Dependency" tab.
8.1.13.8.1 To add Windows server dependencies
1. Use the Central Configuration Manager (CCM) to stop the Server Intelligence Agent (SIA).
2. Right-click the SIA and select Properties.
3. Click the Dependency tab.
4. Click Add.
The "Add Dependency" dialog box appears, displaying a list of all available dependencies.
396
2011-05-06
Server Administration
5. Select a dependency, and click Add.
6. Click OK.
7. Use the CCM to restart the SIA.
8.1.13.9 Changing the user credentials for a node
You can use the Central Configuration Manager (CCM) to specify or update the user credentials for
the Server Intelligence Agent (SIA) if the operating system password changes, or if you want to run all
of the servers on a node under a different user account.
All servers managed by the SIA run under the same account. To run a server using a non-system
account, ensure that your account is a member of the Local Administrators group on the server machine,
and that it has the “Replace a process level token” right.
Restriction:
On a Unix machine, you must run BI platform with the same account that was used to install it. To use
a different account, reinstall the deployment using a different account.
8.1.13.9.1 To change the user credentials for a node on Windows
1. Use the Central Configuration Manager (CCM) to stop the Server Intelligence Agent (SIA).
2. Right-click the SIA and select Properties.
3. Clear the System Account check box.
4. Enter a username and a password, and click OK.
5. Use the CCM to restart the SIA.
The SIA and the server processes log onto the local machine with the new user account.
8.1.14 Renaming a computer in an SAP BusinessObjects Business Intelligence platform
deployment
You can change the name of a computer in an SAP BusinessObjects Business Intelligence platform
deployment at any time by stopping all SAP BusinessObjects Business Intelligence platform servers
on the computer and then renaming the computer. If this computer is part of a cluster, it is not necessary
to stop all of the computers and servers in the cluster; you can rename the servers in the Central
Management Console (CMC) will the other computers are running.
If the CMS system database or the auditing database is located on the computer that you are renaming,
you must update the database connection information after you've renamed the computer. If you are
using ODBC connections to either of these databases, you must update the connection with the new
397
2011-05-06
Server Administration
name of the computer. For all other database connections, you must select the existing database in
the Central Configuration Manager (CCM).
If you are renaming a computer in a deployment, it is not necessary to rename the nodes on the
computer.
Related Topics
• Selecting a new or existing CMS database
8.1.15 Using 32-bit and 64-bit third-party libraries with SAP BusinessObjects
Business Intelligence platform
SAP BusinessObjects Business Intelligence platform servers are a combination of 32-bit and 64-bit
processes. Some servers additionally launch 32-bit and 64-bit child processes. To use the correct
version of third-party libraries (32-bit vs 64-bit) with SAP BusinessObjects Business Intelligence platform
processes, you must set separate environment variables for each version on the machine hosting SAP
BusinessObjects Business Intelligence platform. You must then set an additional environment variable
that contains a comma-separated list of those environment variables that have 32-bit and 64-bit versions.
When a process is launched by SAP BusinessObjects Business Intelligence platform, it will select the
appropriate variable depending on whether the process is 32-bit or 64-bit.
• <FIRST_ENV_VAR>=The value to be used by 64-bit SAP BusinessObjects Business Intelligence
platform processes.
• <FIRST_ENV_VAR32>=The value to be used by 32-bit processes.
• <SECOND_ENV_VAR>=The value to be used by 64-bit processes.
• <SECOND_ENV_VAR32>=The value to be used by 32-bit processes.
• BOE_USE_32BIT_ENV_FOR=<FIRST_ENV_VAR>,<SECOND_ENV_VAR>
For example, if you've installed SAP BusinessObjects Business Intelligence platform on an AIX machine,
as well as 32-bit and 64-bit Oracle clients, and need to set the LIBPATH variable, set the following
variables:
• ORACLE_HOME=<64-bit version of the Oracle client>
• ORACLE_HOME32=<32-bit version>
• LIBPATH=<64-bit version>
• LIBPATH32=<32-bit version>
• BOE_USE_32BIT_ENV_FOR=ORACLE_HOME,LIBPATH
8.1.16 Managing server and node placeholders
398
2011-05-06
Server Administration
8.1.16.1 To view server placeholders
•
In the "Servers" management area of the CMC, right-click a server and select Placeholders.
The "Placeholders" dialog displays a list of placeholders for all of the servers on the same cluster
as the server that you selected. If you want to change the value for a placeholder, modify the
placeholder for the node.
Related Topics
• Server and node placeholders
8.1.16.2 To view and edit the placeholders for a node
1. In the "Servers" management area of the Central Management Console, right-click the node for
which you want to change the placeholders, and select Placeholders.
2. If you want to edit any of the settings for the placeholders, make the appropriate changes and click
OK to continue.
Related Topics
• Server and node placeholders
399
2011-05-06
Server Administration
400
2011-05-06
Managing Central Management Server (CMS) databases
Managing Central Management Server (CMS) databases
9.1 Managing CMS system database connections
If the CMS system database is unavailable, for example due to a hardware or software failure or a
network problem, the CMS goes into the “Waiting for resources” state. If the SAP BusinessObjects
Business Intelligence platform deployment has multiple CMSs, then subsequent requests from other
servers are forwarded to any CMSs in the cluster that have an active connection to the system database.
While a CMS is in the “Waiting for resources” state, any current requests that do not require database
access continue to be processed, but requests that require access to the CMS database will fail.
By default, a CMS in the “Waiting for resources” state periodically attempts to reestablish the number
of connections that are specified in the “System Database Connections Requested” property. As soon
as at least one database connection is established, the CMS synchronizes all necessary data, goes
into the “Running” state, and resumes normal operations.
In some cases, you may want to prevent the CMS from automatically reestablishing a connection to
the database. For example, you may want to verify the integrity of the database before database
connections are reestablished. To do so, on the "Properties" page of the CMS server, uncheck Auto
Reconnect to System Database.
Related Topics
• To change a server's properties
9.2 Selecting a new or existing CMS database
You can use the CCM to specify a new or existing CMS system database for a node. Generally, there
are only a few times when you need to complete these steps:
401
•
If you have changed the password for the current CMS system database, these steps allow you to
disconnect from, and then reconnect to, the current database. When prompted, you can provide the
CMS with the new password.
•
If you want to select and initialize an empty database for SAP BusinessObjects Business Intelligence
platform, these steps allow you to select that new data source.
2011-05-06
Managing Central Management Server (CMS) databases
•
If you have restored a CMS system database from backup (using your standard database
administration tools and procedures) in a way that renders the original database connection invalid,
you will need to reconnect the CMS to the restored database. (This might occur, for instance, if you
restored the original CMS database to a newly installed database server.)
9.2.1 To select a new or existing CMS database on Windows
1. Use the CCM to stop the Server Intelligence Agent (SIA).
2. Select the SIA and click Specify CMS System Database Data Source on the toolbar.
3. In the Configuration tab of the "Properties" dialog box, under CMS Data Source, click Specify.
4. The remaining steps depend upon the connection type you selected:
• If you selected ODBC, the Windows "Select Data Source" dialog box appears. Select the ODBC
data source that you want to use as the CMS database; then click OK. (Click New to configure
a new DSN.) When prompted, provide your database credentials and click OK.
•
If you selected a native driver, you are prompted for your database Server Name, your Login ID,
and your Password. Provide this information and then click OK.
The CCM notifies you when the CMS database setup is complete.
5. In the "Properties" dialog box, click OK.
6. Restart the Server Intelligence Agent.
9.2.2 To select a new or existing CMS database on UNIX
Use the cmsdbsetup.sh script. For reference, see the UNIX Tools chapter.
1. Run the cmsdbsetup.sh script (located by default in <InstallDirectory>/sap_bobj/).
2. Select the update action (option 6).
3. When prompted, provide the database type of the new CMS database.
4. Provide the database information (for example: host name, user name, and password).
A notification message appears when the CMS database has been pointed to the new location.
5. If you are prompted to rebuild the Server Intelligence Agent (SIA), provide the administrator password
and the port number you want to CMS to communicate on.
Note:
You will be prompted for this information only if you point to an empty CMS database.
402
2011-05-06
Managing Central Management Server (CMS) databases
9.3 Recreating the CMS system database
This procedure shows how to recreate (re-initialize) the current CMS system database. By performing
this task, you destroy all data that is already present in the database. This procedure is useful, for
instance, if you have installed SAP BusinessObjects Business Intelligence platform in a development
environment for designing and testing your own, custom web applications. You can re-initialize the
CMS system database in your development environment every time you need to clear the system of
all its data.
Caution:
By implementing the steps outlined in this workflow, you will delete of all data in the CMS database as
well as objects such as reports and users. Do not perform these steps on a production deployment.
It is very important that you back up all server configuration settings before re-initializing the CMS
system database. When you recreate the database, your server configuration settings will be erased
and you must have a backup in order to restore this information.
When you recreate the system database, your existing license keys should be retained in the database.
However, if you need to enter license keys again, log on to the CMC with the default Administrator
account. Go to the Authorization management area and enter your information on the License Keys
tab.
Note:
If you re-initialize your CMS system database, all data in your current CMS system database will be
destroyed. Consider backing up your current database before beginning. If necessary, contact your
database administrator.
Related Topics
• Backing up server settings
9.3.1 To recreate the CMS system database on Windows
1. Use the CCM to stop the Server Intelligence Agent (SIA).
Note:
For this procedure, you cannot run the CCM on a remote machine; it must be run on a machine with
at least one valid node.
2. Right-click the SIA and choose Properties.
3. In the Properties dialog box, go to the "Configuration" tab and click Specify.
4. In the CMS Database Setup dialog box, click Recreate the current Data Source.
403
2011-05-06
Managing Central Management Server (CMS) databases
Note:
All servers and objects from the machine where you ran the CCM in step 1 will also be recreated.
5. Click OK and, when prompted to confirm, click Yes.
6. Specify the password for the CMS system database, and click OK.
The CCM notifies you when the CMS system database setup is complete.
7. Click OK.
You are returned to the CCM.
8. Restart the Server Intelligence Agent and enable services.
While it is starting, the Server Intelligence Agent starts the CMS. The CMS writes required system
data to the newly emptied data source.
9. If your deployment has more than one machine, you need to re-create the nodes on the other
machines.
9.3.2 To recreate the CMS system database on UNIX
Use the cmsdbsetup.sh script. For reference, see the UNIX Tools chapter of the SAP BusinessObjects
Business Intelligence platform Administrator Guide.
1. Run cmsdbsetup.sh (located in <INSTALLDIR>/sap_bobj/, by default).
2. Select the "reinitialize" option (option 5), then confirm your choice.
The cmsdbsetup.sh script begins recreating the CMS system database.
3. Provide the CMS system database password.
4. When the database creation is complete, exit the cmsdbsetup.sh script.
5. Provide the database information (for example: host name, user name, and password).
A notification message appears when the CMS database has been pointed to the new location.
6. If you are prompted to rebuild the Server Intelligence Agent (SIA), provide the administrator password
and the port number you want to CMS to communicate on.
Note:
You will be prompted for this information only if you point to an empty CMS database.
7. In the <INSTALLDIR>/sap_bobj/ directory, use the following command to start the node.
ccm.sh -start <nodename>
8. To enable the services, use the following command:
ccm.sh -enable all -cms <CMSNAME:PORT> -username administrator -password <password>
Note:
Since you just recreated the CMS database, the administrator password is blank.
404
2011-05-06
Managing Central Management Server (CMS) databases
9.4 Copying data from one CMS system database to another
You can use the Central Configuration Manager (CCM) to copy system data from the one database
server into another database server. For example, if you want to replace the database with another
database because you are upgrading the database or are moving from one database type to another,
you can copy the contents of the existing database into the new database before decommissioning it.
The destination database is initialized before the new data is copied in, so any existing contents of the
destination database are permanently deleted (all BI platform tables are destroyed permanently and
then recreated). Once the data has been copied, the destination database is established as the current
database for the CMS.
Note:
If you want to import users, groups, folders, and reports from a previous version of BI platform to the
current version, use the upgrade management tool. For more information, see the SAP BusinessObjects
Business Intelligence Platform Upgrade Guide.
9.4.1 Preparing to copy a CMS system database
Before copying a CMS system database, take the source and the destination environments offline by
disabling and subsequently stopping all servers. Back up both CMS databases, and back up the root
directories used by all Input and Output File Repository Servers. If necessary, contact your database
or network administrator.
Ensure that you have a database user account that has permission to read all data in the source
database, and a database user account that has Create, Delete, and Update rights to the destination
database. Also ensure also that you can connect to both databases—through your database client
software or through ODBC, according to your configuration—from the CMS machine whose database
you are replacing.
If you are copying a CMS database from its current location to a different database server, your current
CMS database is the source environment. Its contents are copied to the destination database, which
is then established as the active database for the current CMS. This is the procedure to follow if you
want to move the default CMS database from the existing default database to a dedicated database
server, such as Microsoft SQL Server, Informix, Oracle, DB2, or Sybase. Log on with an administrative
account to the machine that is running the CMS whose database you want to move.
Note:
•
405
When you copy data from one database to another, the destination database is initialized before
the new data is copied in. That is, if your destination database does not contain the SAP
BusinessObjects Business Intelligence platform system tables, these tables are created. If the
destination database does contain SAP BusinessObjects Business Intelligence platform system
2011-05-06
Managing Central Management Server (CMS) databases
•
tables, the tables will be permanently deleted, new system tables will be created, and data from the
source database will be copied into the new tables. Other tables in the database are unaffected.
If you are copying a CMS system database to a MaxDB destination database on Windows, you must
ensure that the path to the MaxDB client has been added to the PATH environment variable. For
example, ;C:\Program Files\sdb\MAXDB1\pgm.
9.4.2 To copy a CMS system database on Windows
Before you copy the contents of the CMS database, ensure that you can logon to the destination
database with an account that has permissions to add or drop tables, and to add, drop, or modify data
in those tables.
1. Open the Central Configuration Manager (CCM) and stop the Server Intelligence Agent (SIA).
2. Right-click the SIA and choose Properties.
3. Click the Configuration tab, and then click Specify.
4. Choose Copy, then click OK.
5. Select the database type for the source CMS database, and then specify its database information
(including host name, user name, and password).
6. Select the database type for the destination CMS database, and then specify its database information
(including host name, user name, and password).
7. When the CMS database has finished copying, click OK.
9.4.3 To copy data from a CMS system database on UNIX
Before you copy the contents of the CMS database, ensure that you can logon to the destination
database with an account that has permissions to add or drop tables, and to add, drop, or modify data
in those tables.
Note:
On UNIX you can not migrate directly from a source environment that uses an ODBC connection to the
CMS database. If your source CMS database uses ODBC, you must first upgrade that system to a
supported native driver.
1. Stop the CMS by typing the following command:
./ccm.sh -stop <nodename>
2. Run cmsdbsetup.sh (located in <InstallDirectory>/sap_bobj/, by default).
3. Select the “copy” option (option 4), then confirm your choice.
4. Select the database type for the source CMS database, then specify its database information
(including host name, user name, and password).
406
2011-05-06
Managing Central Management Server (CMS) databases
5. Select the database type for the destination CMS database, and then specify its database information
(including host name, user name, and password).
The CMS database is copied to the destination database. A message appears when the copy is
complete.
407
2011-05-06
Managing Central Management Server (CMS) databases
408
2011-05-06
Managing Web Application Container Servers (WACS)
Managing Web Application Container Servers (WACS)
10.1 WACS
10.1.1 Web Application Container Server (WACS)
Web Application Container Servers (WACS) provide a platform for hosting BI platform web applications.
For example, a Central Management Console (CMC) can be hosted on a WACS.
WACS simplifies system administration by removing several workflows that were previously required
for configuring application servers and deploying web applications, and by providing a simplified,
consistent administrative interface.
Web applications are automatically deployed to WACS. WACS does not support manual or WDeploy
deployment of BI platform or external web applications.
10.1.1.1 Do I need WACS?
If you do not want to use a Java application server to host your SAP Business Objects web applications,
then you can host them on WACS.
If you plan to use a supported Java application server to deploy SAP BusinessObjects Business
Intelligence platform web applications, or if you are installing SAP BusinessObjects Business Intelligence
platform on a UNIX system, you do not need to install and use WACS.
10.1.1.2 What are the advantages of using WACS?
Using WACS to host the CMC provides you with a number of advantages:
409
2011-05-06
Managing Web Application Container Servers (WACS)
•
•
•
•
•
WACS requires a minimum effort to install, maintain, and configure.
All hosted applications are predeployed on WACS, so that no additional manual steps are required.
WACS is supported by SAP.
WACS removes the need for Java application server administration and maintenance skills.
WACS provides an administrative interface that is consistent with other SAP BusinessObjects
Business Intelligence platform servers.
10.1.1.3 Common Tasks
Task
Description
Topic
How can I improve the performance of web applications or
web services that are hosted on
WACS.
You can improve the perfor•
mance of the web applications or
web services by installing WACS
•
on multiple machines.
Adding or removing additional
WACS to your deployment
Cloning a Web Application
Container Server
How can I improve the availability Create additional WACS in your Adding or removing additional
of my web-tier?
deployment, so that in the event WACS to your deployment
of a hardware or software failure
on one server, another server
can continue servicing requests.
How can I create an environment Create a second, stopped,
Adding or removing additional
where I can easily recover from WACS, and use this WACS to
WACS to your deployment
a misconfigured CMC?
define a configuration template.
In the event that the primary
WACS becomes misconfigured,
either use the second WACS until
you configure the first server, or
apply the configuration template
to the first server.
410
How can I improve the security
of communication between
clients and WACS?
Configure HTTPS on WACS.
How can I improve the security
of communication between
WACS and other Business Objects servers in my deployment?
Configure SSL communication
•
between WACS and other SAP
BusinessObjects Business Intelli- •
gence platform servers in your
deployment.
•
•
Configuring HTTPS/SSL
Using WACS with firewalls
Configuring servers for SSL
Using WACS with firewalls
2011-05-06
Managing Web Application Container Servers (WACS)
Task
Description
Topic
Can I use WACS with HTTPS
and a reverse proxy?
You can use WACS with HTTPS To configure WACS to support
and a reverse proxy if you create HTTPS with a reverse proxy
two WACS and configure both
servers with HTTPS. Use the first
WACS for communication inside
your internal network, and the
other WACS for communication
with an external network through
a reverse proxy.
How does WACS fit in my IT en- WACS can be deployed in an IT
•
vironment?
environment with existing web
servers, hardware load bal•
ancers, reverse proxies, and
firewalls.
•
•
Using WACS with other web
servers
Using WACS with a load balancer
Using WACS with a reverse
proxy
Using WACS with firewalls
Can I use WACS in a deployment You can use WACS in a deploy- Using WACS with a load balancer
with a load balancer?
ment that uses a hardware load
balancer. WACS itself cannot be
used as a load balancer.
Can I use WACS in a deployment You can use WACS in a deploy- Using WACS with a reverse
with a reverse proxy?
ment that uses a reverse proxy. proxy
WACS itself cannot be used as
a reverse proxy.
How can I troubleshoot my
WACS servers?
411
If you need to determine the rea•
sons for/causes of the poor performance of your WACS, you can •
view the log files and view the
system metrics.
To configure tracing on WACS
To view server metrics
2011-05-06
Managing Web Application Container Servers (WACS)
Task
Description
I don't get any pages served to
me on a particular port. What is
wrong?
There are a number of reasons
why you might not be able to
connect to WACS. Check to see
if:
• The HTTP, HTTP through
proxy, and HTTPS ports that
you specified for the WACS
have been taken by other applications.
• The WACS has enough
memory allocated to it.
• The WACS allows enough
concurrent requests.
• If necessary, restore the system defaults for the WACS.
Topic
•
•
•
•
To resolve HTTP port conflicts
To change memory settings
To change the number of
concurrent requests
To restore system defaults
How can I configure the properConfiguring web application
The procedure for configuring the
ties of web applications that are
properties
properties for web applications
hosted on WACS?
depends on the specific property
and web application. For more
information, see the “ Configuring
web application properties” section of this chapter.
Where can I find a list of WACS
Core Services Properties
The “Server Properties Appendix”
properties?
of this guide contains a list of
WACS properties.
10.1.2 Adding or removing additional WACS to your deployment
Adding additional WACS to your deployment can give you a number of advantages:
•
•
•
•
Faster recovery from a misconfigured server.
Improved server availability.
Better load balancing.
Better overall performance.
There are three ways to add additional WACS to your deployment:
• Installing WACS on a machine.
• Creating a new WACS.
412
2011-05-06
Managing Web Application Container Servers (WACS)
•
Cloning a WACS.
Note:
It is recommended that you run a single WACS on the same machine at the same time due to high
resource utilization. However, you can deploy more than one WACS on the same machine, and only
run one of them, to help you recover in the event of a misconfigured WACS.
10.1.2.1 Installing WACS
Installing WACS on separate machines can provide your deployment with better performance, better
load balancing, and higher server availability. If your deployment contains two or more WACS on
separate machines, the availability of web applications and web services won't be affected by hardware
or software failures on a specific machine, because the other WACS will continue to provide the services.
You can install a Web Application Container Server by using the BI platform installation program. There
are two ways that you can install WACS:
•
In a Full installation, on the "Select Java Web Application" screen choose Install Web Application
Container Server and automatically deploy web applications and services to it.
If you select a Java application server in a New installation, WACS is not installed.
•
In a Custom / Expand installation, you can choose to install WACS on the "Select Features" screen
by expanding Servers > Platform Services and selecting Web Application Container Server.
If you install WACS, the installation program automatically creates a server called
<NODE>.WebApplicationContainerServer, where <NODE> is the name of your node. BI platform web
applications and web services are then deployed to that server. No manual steps are required to deploy
or configure the CMC. The system is ready to use.
When you install WACS, the installation program prompts you to provide an HTTP port number for
WACS. Ensure that you specify a port number that is not used. The default port number is 6405. If you
plan to allow users to connect to the WACS from outside a firewall, you must ensure that the server's
HTTP port is open on the firewall.
WACS is supported only on Windows operating systems.
Note:
The web applications that WACS hosts are automatically deployed when you install WACS or when
you apply updates or hot-fixes to WACS or to WACS-hosted web applications. It takes several minutes
for the web applications to deploy. The WACS will be in the “Initializing” state until the web application
deployment is complete. Users will not be able to access web applications hosted on WACS until the
web applications are fully deployed. Do not stop the server until the initial deployment is completed.
You can view the server state of the WACS through the Central Configuration Manager (CCM).
This delay occurs only when starting WACS the first time after installing WACS or applying updates to
it. This delay does not occur for subsequent WACS restarts.
413
2011-05-06
Managing Web Application Container Servers (WACS)
Web applications cannot be manually deployed to a WACS server. You cannot use WDeploy to deploy
web applications to WACS.
10.1.2.2 Adding a new Web Application Container Server
Note:
It is recommended that you run a single WACS on the same machine at the same time due to high
resource utilization. However, you can deploy more than one WACS on the same machine, and only
run one of them, to help you recover in the event of a misconfigured WACS.
1. Go to the "Servers" management area of the CMC.
2. Select Manage > New > New Server.
The "Create New Server" screen appears.
3. From the Service Category list, select Core Services.
4. From the Select Service list, select the services that you want the WACS to host, and click Next.
•
•
•
•
If you want the WACS to host web applications such as the CMC, BI launch pad or
OpenDocument, select BOE Web Application Service.
If you want the WACS to host web services such as Live Office or Query as a Web Service
(QaaWS), select Web Services SDK and QaaWS.
If you want the WACS to host Business Process BI Web Services, select Business Process BI
Web Service.
If you want the WACS to support server tracing, select TraceLog Service.
5. On the next "Create New Server" screen, select any additional services that you want the WACS to
host, and click Next.
6. On the next "Create New Server" screen, click Next.
7. On the next "Create Server Screen", select a node to add the server to, type a server name and
description for the server, and click Create.
Note:
Only those nodes that have WACS installed will appear in the Node list.
8. On the "Servers" screen, double-click the newly created WACS.
The "Properties" screen appears.
9. If you do not want the WACS to automatically start when the system restarts, in the "Common
Settings" pane, ensure that the Automatically start this server when the Server Intelligence
Agent starts check box is unchecked.
10. Click Save & Close
A new WACS is created. The default settings and properties are applied to the server.
414
2011-05-06
Managing Web Application Container Servers (WACS)
10.1.2.3 Cloning a Web Application Container Server
As an alternative to adding a new WACS to your deployment, you can also clone a WACS, either to
the same machine or to another machine. While adding a new WACS creates a server with the default
settings, cloning a WACS applies the settings of the source WACS to the new WACS.
Servers can only be cloned to machines that already have WACS installed.
Note:
It is recommended that you run a single WACS on the same machine at the same time due to high
resource utilization. However, you can deploy more than one WACS on the same machine, and only
run one of them, to help you recover in the event of a misconfigured WACS.
1. Go to the "Servers" management area of the CMC.
2. Select the WACS that you want to clone, right-click and select Clone Server.
The "Clone Server" screen displays a list of nodes in your deployment that you can clone the WACS
to. Only those nodes that have WACS installed appear in the Clone to Node list.
3. On the "Clone Server" screen, type a new server name, select the node that you want to clone the
server to, and click OK.
A new WACS is created. The new server contains the same services as the server that it is cloned
from. The new server and services that it hosts have the same settings as the server it was cloned
from, with the exception of the server name.
Note:
If you cloned a WACS to the same machine, you may have port conflicts with the WACS that was used
for cloning. If this occurs, you must change the port numbers on the newly cloned WACS instance.
Related Topics
• To resolve HTTP port conflicts
10.1.2.4 Deleting WACS from your deployment
You can only delete a WACS if the server isn't currently serving the CMC to you. If you want to delete
a WACS from your deployment, you must log on to a CMC from another WACS or a Java application
server. You cannot delete a WACS that is currently serving the CMC to you.
1. Go to the "Servers" management area of the CMC.
2. Stop the server that you want to delete by right-clicking the server and clicking Stop Server.
3. Right-click the server and select Delete.
415
2011-05-06
Managing Web Application Container Servers (WACS)
4. When prompted for confirmation, click OK.
10.1.3 Adding or removing services to WACS
10.1.3.1 To add a web application or web service to a WACS
Adding additional BI platform web applications or web services to a WACS requires that you stop the
WACS. Therefore, you must have at least one additional CMC hosted on a WACS in your deployment
that provides a BOE Web Application Service while you are stopping and adding a service to the other
WACS.
When you add a service to WACS, the service is automatically deployed to WACS when the server is
restarted.
1. Go to the "Servers" management area of the CMC.
2. Double-click the WACS that you want to add the service to, and view the properties of the server to
ensure that the service that you want to add is not already present.
3. Click Cancel to return to the "Servers" screen.
4. Stop the server by right-clicking the server and clicking Stop Server.
If you are trying to stop the WACS that is currently serving the CMC to you, a warning message
appears. Don't proceed unless you have at least one additional running BOE Web Application Service
on another WACS in your deployment. If you do, click OK, log on to another WACS, and start this
procedure from the beginning.
5. Right-click the server and choose Select Services.
The "Select Services" screen appears.
6. Select the service that you want to add to the server, add the service to the server by clicking >, and
click OK.
7. Start the WACS by right-clicking the server and clicking Start Server.
The service is added to the WACS. The default settings and properties for the service are applied.
10.1.3.2 To remove a web application or web service from a WACS
In order to remove a web application or web service from a WACS, you must log on to a CMC on another
WACS or on a Java application server. You cannot stop the WACS that is currently serving the CMC
to you.
416
2011-05-06
Managing Web Application Container Servers (WACS)
You cannot delete the last service from a WACS. Therefore, if you are removing a web service from a
WACS, you must ensure that the server is hosting at least one other service.
If you want to remove the last service from a WACS, delete the WACS itself.
1. Go to the "Servers" management area of the CMC.
2. Double-click the WACS that you want to remove the web service from, and view the properties of
the server to ensure that the web service that you want to remove is present.
3. Click Cancel to return to the "Servers" screen.
4. Stop the WACS by right-clicking the server and clicking Stop Server.
If you are trying to stop the WACS that is currently serving the CMC to you, a warning message
appears. Don't proceed unless you have at least one additional running BOE Web Application Service
on another WACS in your deployment. If you do, click OK, log on to another WACS, and start this
procedure from the beginning.
5. Right-click the WACS and choose Select Services.
The "Select Services" screen appears.
6. Select the service that you want to remove, click <, and then click OK.
7. Start the WACS by right-clicking the server and clicking Start Server.
The service is removed from the WACS.
10.1.4 Configuring HTTPS/SSL
You can use the Secure Sockets Layer (SSL) protocol and HTTP for network communication between
clients and WACS in your SAP BusinessObjects Business Intelligence platform deployment. SSL/HTTPS
encrypts network traffic and provides improved security.
There are two types of SSL:
• SSL used between SAP BusinessObjects Business Intelligence platform servers, including WACS
and other SAP BusinessObjects Business Intelligence platform servers in your deployment. This is
known as CorbaSSL. For more information on using SSL between the SAP BusinessObjects Business
Intelligence platform servers in your deployment, see the “Understanding communication between
SAP BusinessObjects Business Intelligence platform components” section of the “Working with
Firewalls” chapter of the SAP BusinessObjects Business Intelligence platform Administrator Guide.
• HTTP over SSL, which occurs between WACS and clients (for example, browsers) that communicate
with WACS.
Note:
If you are deploying WACS in a deployment with a proxy or reverse proxy, and want to use SSL to
secure the network communication in your deployment, you must create two WACS. For more
information, see Using WACS with a reverse proxy.
To configure HTTPS/SSL on a WACS, you must complete these steps:
417
2011-05-06
Managing Web Application Container Servers (WACS)
•
Generate or obtain a PKCS12 certificate store or JKS keystore which contains your certificates and
private keys. You can use Microsoft's Internet Information Service (IIS) and Microsoft Management
Console (MMC) to generate a PCKS12 file, or use openssl or the Java keytool command line tool
to generate a keystore file.
•
If you want only certain clients to connect to a WACS, then you must generate a certificate trust list
file.
•
When you have a certificate store and, if necessary, a certificate trust list file, copy the files to the
WACS machine.
•
Configure HTTPS on the WACS.
Related Topics
• Understanding communication between BI platform components
• Using WACS with a reverse proxy
10.1.4.1 To generate a PKCS12 certificate file store
There are many ways of generating a PKCS12 certificate file stores or Java keystores, and tools that
you can use. The method that you use depends on the tools that you have access to and are familiar
with.
This example demonstrates how to generate a PKCS12 file using Microsoft's Internet Information
Services (IIS) and the Microsoft Management Console (MMC).
1. Log on to the machine that hosts WACS as an administrator.
2. In IIS, request a certificate from Certificate Authority. For information on doing this, see the IIS help
documentation.
3. Start the MMC by clicking Start > Run, typing mmc.exe, and clicking OK.
4. Add Certificates Snap-in to the MMC:
a. From File menu, click Add/Remove Snap-in.
b. Click Add.
c. On the "Add Standalone Snap-in" dialog, select Certificates, and click Add.
d. Select Computer account, and click Next.
e. Select Local Computer, and click Finish.
f. Click Close, and click OK.
The Certificates Snap-In is added to the MMC.
5. In the MMC, expand Certificates, and select the certificate that you want to use.
6. On the Action menu, select All Tasks > Export.
The "Certificate Export Wizard" starts.
7. Click Next.
418
2011-05-06
Managing Web Application Container Servers (WACS)
8. Select Yes, export the private key, and click Next.
9. Select Personal Information Exchange - PKCS #12 (.PFX), and click Next.
10. Enter the password you used when you created the certificate and click Next. You must specify this
password in the Private Key Access Password field when you configure HTTPS for the WACS.
A PKCS12 certificate file store is created.
10.1.4.2 To generate a Certificate Trust List
1. Log on to the machine that hosts WACS as an administrator.
2. Start the Microsoft Management Console (MMC).
3. Add the Internet Information Services Snap-in:
a. From the File menu, select Add/Remove Snap-in, and click Add.
b. In the "Add Standalone Snap-in" dialog, select Internet Information Services (IIS) Manager,
and click Add.
c. Click Close, and click OK.
The IIS snap-in is added to the MMC.
4. In the left pane of the MMC, find the web site for which you want to create the Certificate Trust List.
5. Right-click the web site, and select Properties.
6. Click the Directory Security tab, and under "Secure Communications", click Edit.
7. Click Enable certificate trust list, and click New.
The "Certificate Trust List Wizard" starts.
8. Click Next.
9. Click Add from Store or Add from File, select the certificate that you want to add to the Certificate
Trust List, click OK, and click Next.
10. Type a name and description for the Certificate Trust List, and click Next.
11. Click Finish, and then click OK.
The Certificate Trust List is displayed in the Current CTL field.
12. Select the Certificate Trust List and click Edit.
The "Certificate Trust List Wizard" starts.
13. Click Next.
14. On the Current CTL certificates list, select the Trust List, and click View Certificates.
15. Click the Details tab, and click Copy to File.
The "Certificate Export Wizard" starts.
16. Click Next.
17. Select Yes, export the private key, and click Next.
18. Select Personal Information Exchange - PKCS #12 (.PFX), and click Next.
419
2011-05-06
Managing Web Application Container Servers (WACS)
19. Enter the password you used when you created the certificate and click Next. You must specify this
password in the Certificate Trust List Private Key Access Password field when you configure
HTTPS for the WACS.
10.1.4.3 To configure HTTPS/SSL
Before you configure HTTPS/SSL on your WACS, ensure that you've already created a PCKS12 file
or JKS keystore, and that you've copied or moved the file to the machine that is hosting the WACS.
1. Go to the "Servers" management area of the CMC.
2. Double-click the WACS the server for which you want to enable HTTPS.
The "Properties" screen appears.
3. In the "HTTPS Configuration" section, check the Enable HTTPS check box.
4. In the Bind to Hostname or IP Address field, specify the IP address for which the certificates were
issued and to which WACS will bind.
HTTPS services will be provided through IP address that you specify.
5. In the HTTPS Port field, specify a port number for WACS to provide HTTPS service. You must
ensure that this port is free. If you plan to allow users to connect to the WACS from outside a firewall,
you must also ensure that this port is open on the firewall.
6. If you are configuring SSL with a reverse proxy, specify the proxy server's hostname and port in the
Proxy Hostname and Proxy Port fields.
7. On the Protocol list, select a protocol. The available options are:
•
SSL
SSL is the Secure Sockets Layer protocol, which is a protocol for encrypting network traffic.
•
TLS
TLS is the Transport Layer Security protocol, and is a newer, enhanced protocol. The differences
between SSL and TLS are minor, but include stronger encryption algorithms in TLS.
8. Under the Certificate Store Type field, specify the file type for the certificate. The available options
are:
• PKCS12
Select PKCS12 if you are more comfortable working with Microsoft tools.
•
JKS
Select JKS if you are more comfortable working with Java tools.
9. In the Certificate Store File Location field, specify the path where you copied or moved the certificate
file store or Java keystore file.
10. In the Private Key Access Password field, specify the password.
420
2011-05-06
Managing Web Application Container Servers (WACS)
PKCS12 certificate stores and JKS keystores have private keys that are password protected, to
prevent unauthorized access. You must specify the password for accessing the private keys, so that
WACS can access the private keys.
11. It is recommended that you either use a certificate file store or keystore that either contains a single
certificate, or where the certificate that you want to use is listed first. However, if you are using a
certificate file store or keystore that contains more than one certificate, and that certificate is not the
first one in the filestore, in the Certificate Alias field, you must specify the alias for the certificate.
12. If you want the WACS to only accept HTTPS requests from certain clients, enable client authentication.
Client authentication doesn't authenticate users. It ensures that WACS only serves HTTPS requests
to certain clients.
a. Check Enable Client Authentication.
b. In the Certificate Trust List File Location, specify the location of the PCKS12 file or JKS keystore
that contains the trust list file.
Note:
The Certificate Trust List type must be the same as the Certificate Store type.
c. In the Certificate Trust List Private Key Access Password field, type the password that protects
the access to the private keys in the Certificate Trust List file.
Note:
If you enable client authentication, and a browser or web service consumer is not authenticated, the
HTTPS connection is rejected.
13. Click Save & Close.
14. Go to the "Metrics" screen, and ensure that HTTPS connector appears under List of Running WACS
Connectors. If HTTPS does not appear, then ensure that the HTTPS connector is configured correctly.
10.1.5 Supported authentication methods
WACS supports the following authentication methods:
• Enterprise
• LDAP
• AD Kerberos
WACS does not support the following authentication methods:
• NT
• AD NTLM
• LDAP with Single sign-on
421
2011-05-06
Managing Web Application Container Servers (WACS)
10.1.6 Configuring AD Kerberos for WACS
To configure AD Kerberos authentication for WACS, you must first configure your machine to support
AD. You must perform the following steps.
• Enabling the Windows AD security plug-in.
• Mapping users and groups.
• Setting up a service account.
• Setting up constrained delegation.
• Enabling Kerberos authentication in the Windows AD plug-in for WACS.
• Creating configuration files.
After you've setup the machine that is hosting WACS to use AD Kerberos authentication, you must
perform additional configuration steps through the Central Management Console (CMC).
Related Topics
• Using Windows AD users and groups
• Windows AD security plug-in
• Setting up a service account for AD authentication with Kerberos
• Preparing the servers for Windows AD authentication with Kerberos
• Enabling Kerberos authentication in the Windows AD plug-in for WACS
• Creating configuration files
• Configuring WACS for AD Kerberos
• Configuring AD Kerberos single sign-on
10.1.6.1 Enabling Kerberos authentication in the Windows AD plug-in for WACS
In order to support Kerberos, you have to configure the Windows AD security plug-in in the CMC to use
Kerberos authentication. This includes:
•
Ensuring Windows AD authentication is enabled.
•
Entering the AD Administrator account.
Note:
This account requires read access to Active Directory only; it does not require any other rights.
•
•
422
Entering the service principal name (SPN) for the service account.
2011-05-06
Managing Web Application Container Servers (WACS)
10.1.6.1.1 Prerequisites
Before you configure the Windows AD security plug-in for Kerberos, you must have completed the
following tasks:
•
•
•
•
Setting up a service account for AD authentication with Kerberos
To grant the service account rights
Preparing the servers for Windows AD authentication with Kerberos
"Mapping Windows AD accounts"
10.1.6.1.2 To configure the Windows AD security plug-in for Kerberos
1. Go to the Authentication management area of the CMC.
2. Double-click Windows AD.
3. Ensure that the Windows Active Directory Authentication is enabled check box is selected.
4. Under Authentication Options, select Use Kerberos authentication.
5. In the Service principal name field, enter the account and domain of the service account or the
SPN mapping to the service account.
Use the following format, where svcacct is the name of the service account or SPN you created
earlier, and DNS.COM is your fully qualified domain in uppercase. For example, the Service Account
would be [email protected] and the SPN would be BOBJCentralMS/[email protected].
Note:
•
If you plan to allow users from other domains than the default domain to log on, you must provide
the SPN you mapped earlier.
•
The service account is case sensitive. The case of the account you enter here must match with
what is set up in your Active Directory Domain.
•
This must be the same account that you use to run the SAP BusinessObjects Business Intelligence
platform servers or the SPN that maps to this account.
Related Topics
• Configuring AD Kerberos single sign-on
10.1.6.2 Creating configuration files
The general process of configuring Kerberos on your application server involves these steps:
•
•
423
Creating the Kerberos configuration file.
Creating the JAAS login configuration file.
2011-05-06
Managing Web Application Container Servers (WACS)
Note:
•
•
The default Active Directory domain must be in uppercase DNS format.
You don't need to download and install MIT Kerberos for Windows. You also no longer require a
keytab for your service account.
10.1.6.2.1 To create the Kerberos configuration file
Follow these steps to create the Kerberos configuration file.
1. Create the file krb5.ini, if it does not exist, and store it under C:\WINNT for Windows.
Note:
You can store this file in a different location. However if you do, you need to specify its location in
the Krb5.ini File Location field on the "Properties" page for the WACS server, in the CMC.
2. Add the following required information in the Kerberos configuration file:
[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_kdc = true
dns_lookup_realm = true
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
[domain_realm]
.domain.com = DOMAIN.COM
domain.com = DOMAIN.COM
.domain2.com = DOMAIN2.COM
domain2.com = DOMAIN2.COM
[realms]
DOMAIN.COM = {
default_domain = DOMAIN.COM
kdc = HOSTNAME.DOMAIN.COM
}
DOMAIN2.COM = {
default_domain = DOMAIN2.COM
kdc = HOSTNAME.DOMAIN2.COM
}
[capaths]
DOMAIN2.COM = {
DOMAIN.COM =
}
Note:
•
•
•
•
DNS.COM is the DNS name of your domain which must be entered in uppercase in FQDN format.
kdc is the Host name of the Domain Controller.
You can add multiple domain entries to the [realms] section if your users log in from multiple
domains. To see a sample of this file with multiple domain entries, see Sample Krb5.ini files.
In a multiple domain configuration, under [libdefaults] the default_realm value may be
any of the desired domains. The best practice is to use the domain with the greatest number of
users that will be authenticating with their AD accounts.
10.1.6.2.2 To create the JAAS login configuration file
1. Create a file called bscLogin.conf if it does not exist, and store it in the default location: C:\WINNT.
Note:
You can store this file in a different location. However if you do, you will need to specify its location
in the bscLogin.conf File Location field on the "Properties" page for the WACS server, in the CMC.
424
2011-05-06
Managing Web Application Container Servers (WACS)
2. Add the following code to your JAAS bscLogin.conf configuration file:
com.businessobjects.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required;
};
3. Save and close the file.
10.1.6.2.3 Sample Krb5.ini files
Sample multiple domain Krb5.ini file
The following is a sample file with multiple domains:
[domain_realm]
.domain03.com = DOMAIN03.COM
domain03.com = DOMAIN03.com
.child1.domain03.com = CHILD1.DOMAIN03.COM
child1.domain03.com = CHILD1.DOMAIN03.com
.child2.domain03.com = CHILD2.DOMAIN03.COM
child2.domain03.com = CHILD2.DOMAIN03.com
.domain04.com = DOMAIN04.COM
domain04.com = DOMAIN04.com
[libdefaults]
default_realm = DOMAIN03.COM
dns_lookup_kdc = true
dns_lookup_realm = true
[realms]
DOMAIN03.COM = {
admin_server = testvmw2k07
kdc = testvmw2k07
default_domain = domain03.com
}
CHILD1.DOMAIN03.COM = {
admin_server = testvmw2k08
kdc = testvmw2k08
default_domain = child1.domain03.com
}
CHILD2.DOMAIN03.COM = {
admin_server = testvmw2k09
kdc = testvmw2k09
default_domain = child2.domain03.com
}
DOMAIN04.COM = {
admin_server = testvmw2k011
kdc = testvmw2k011
default_domain = domain04.com
}
Sample single domain Krb5.ini file
Following is a sample krb5.ini file with a single domain.
[libdefaults]
default_realm = ABCD.MFROOT.ORG
dns_lookup_kdc = true
dns_lookup_realm = true
[realms]
ABCD.MFROOT.ORG = {
kdc = ABCDIR20.ABCD.MFROOT.ORG
kdc = ABCDIR21.ABCD.MFROOT.ORG
kdc = ABCDIR22.ABCD.MFROOT.ORG
kdc = ABCDIR23.ABCD.MFROOT.ORG
default_domain = ABCD.MFROOT.ORG
}
425
2011-05-06
Managing Web Application Container Servers (WACS)
10.1.6.3 Configuring WACS for AD Kerberos
After you've configured the machine that is hosting WACS for AD Kerberos authentication, you must
configure the WACS itself, through the Central Management Console (CMC).
10.1.6.3.1 To configure WACS for AD Kerberos
1. Go to the "Servers" management area of the CMC.
2. Double-click the WACS that you want to configure AD for.
The "Properties" screen appears.
3. In the Krb5.ini File Location field, specify the path to the krb5.ini configuration file.
4. In the bscLogin.conf File Location field, specify the path to the bscLogin.conf configuration
file.
5. Click Save & Close.
6. Restart the WACS.
10.1.6.4 Troubleshooting Kerberos
These steps may help you if you encounter problems when configuring Kerberos:
•
•
Enabling logging
Testing your Kerberos configuration
10.1.6.4.1 To enable Kerberos logging
1. Start the Central Configuration Manager (CCM), and click Manage Servers.
2. Specify the logon credentials.
3. On the "Manage Servers" screen, stop the WACS.
4. Click Web Tier Configuration.
Note:
The Web Tier Configuration icon is only enabled when you select a WACS that is stopped.
The "Web Tier Configuration" screen appears.
5. Under Command Line Parameters, copy the following text to the end of the parameters:
“-Dcrystal.enterprise.trace.configuration=verbose
-Djcsi.kerberos.debug=true”
6. Click OK.
7. On the "Manage Servers" screen, start the WACS.
426
2011-05-06
Managing Web Application Container Servers (WACS)
10.1.6.4.2 To test your Kerberos configuration
•
Run the following command to test your Kerberos configuration, where servact is the service
account and domain under which the CMS is running, and password is the password associated
with the service account.
<Install Directory>\Business Objects\javasdk\bin\kinit.exe [email protected] Password
For example:
C:\Program Files\Business Objects\javasdk\bin\kinit.exe [email protected] Password
If you still have a problem, ensure that the case you entered for your domain and service principal
name match exactly with what is set in Active Directory.
10.1.6.4.3 Mapped AD user unable to log on to BusinessObjects Business Intelligence platform
on WACS
The following two issues may occur, despite the fact that the users have been mapped to SAP
BusinessObjects Business Intelligence platform.
Logon failure due to different AD UPN and SAM names
A user's Active Directory ID has successfully been mapped to SAP BusinessObjects Business Intelligence
platform. Despite this fact, they are unable to successfully log on to CMC with AD authentication and
Kerberos in the following format: DOMAIN\ABC123
This problem can happen when the user is set up in Active Directory with a UPN and SAM name that
are not the same, either in case or otherwise. Following are two examples which may cause a problem:
•
•
The UPN is [email protected] but the SAM name is DOMAIN\ABC123
The UPN is jsmith@company but the SAM name is DOMAIN\johnsmith
There are two ways to address this problem:
•
•
Have users log in using the UPN name rather than the SAM name.
Ensure the SAM account name and the UPN name are the same.
Pre-authentication error
A user who has previously been able to log on, can no longer log on successfully. The user will receive
this error: Account Information Not Recognized. The WACS logs reveal the following error: "Pre-au
thentication information was invalid (24)"
This can occur because the Kerberos user database didn't get a change made to UPN in AD. This may
mean that the Kerberos user database and the AD information are out of sync.
To resolve this problem, reset the user's password in AD. This will ensure the changes are propagated
correctly.
427
2011-05-06
Managing Web Application Container Servers (WACS)
10.1.7 Configuring AD Kerberos single sign-on
If you are configuring AD Kerberos single sign-on for BI launch pad or Web Services SDK and QaaWS,
you must ensure that you have configured both the WACS and the machine that is hosting WACS for
AD Kerberos authentication. For more information, see Configuring AD Kerberos for WACS .
Note:
If you plan to use single sign-on in a reverse proxy environment, read the “Securing SAP BusinessObjects
Business Intelligence platform” chapter of the SAP BusinessObjects Business Intelligence platform
Administrator Guide before proceeding.
10.1.7.1 Configuring your machine for AD Kerberos single sign-on
To configure AD Kerberos single sign-on for Web Services SDK and QaaWS, you must first configure
the machine that is hosting WACS :
•
•
•
•
•
•
To configure constrained delegation for Vintela single sign-on
"To create an SPN for your web application server"
"To reset the service account password"
"To create and place a keytab file"
Setting up multiple SPNs
To increase the header size limit of your WACS
The following sections describe how to complete each of these steps.
10.1.7.1.1 Setting up multiple SPNs
Using multiple SPNs is not supported.
10.1.7.1.2 To increase the header size limit of your WACS
Active Directory creates a Kerberos token which is used in the authentication process. This token is
stored in the HTTP header. Your WACS will have a default HTTP header size which will be sufficient
for most user. This header size can be configured.
1. Go to the "Servers" management area of the CMC.
2. Double-click the WACS for which you want to change the HTTP header size.
The "Properties" screen appears.
3. Under the "HTTP Configuration", "Configuration of HTTP through Proxy", or "HTTPS Configuration"
section, specify a value in the Maximum HTTP Header Size (in bytes) field.
4. Click Save & Close.
428
2011-05-06
Managing Web Application Container Servers (WACS)
5. Restart the server.
10.1.7.2 Configuring WACS for AD Kerberos single sign-on
You can configure a Web Application Container Server to use AD Kerberos single sign-on. AD Kerberos
single sign-on is supported. AD NTLM is not supported.
Before you configure WACS, you must configure AD Kerberos single sign-on for the machine that is
hosting the WACS.
1. Go to the "Servers" management area of the CMC.
2. Double-click the WACS that you want to configure.
The "Properties" screen appears.
3. Check Enable Kerberos Active Directory Single Sign On.
4. Specify values for Default AD Domain, Service Principal Name, and Keytab File properties, and
click Save & Close.
5. Restart the WACS.
Active Directory single sign-on is ready for use.
10.1.7.3 Configuring Kerberos and single sign-on to the database
Single sign-on to the database is supported for deployments that meet all these requirements:
•
•
•
•
•
The deployment of SAP BusinessObjects Business Intelligence platform is on WACS.
WACS has been configured with AD with Kerberos.
The database to which single sign-on is required is a supported version of SQL Server or Oracle.
The groups or users that need access to the database must have been granted permissions within
SQL Server or Oracle.
The Cache Security context check box (which is required for single sign-on to the database) in the
AD Authentication page of the CMC is checked.
The final step is to modify the krb5.ini file to support single sign-on to the database.
Note:
These instructions explain how to configure single sign-on to the database. If you want to configure
end-to-end single sign-on to the database, you must also perform the configuration steps required for
Vintela single sign-on. For details, see Configuring AD Kerberos single sign-on .
429
2011-05-06
Managing Web Application Container Servers (WACS)
10.1.7.3.1 To enable single sign-on to the database
1. Open the krb5.ini file that is being used for your deployment of SAP BusinessObjects Business
Intelligence platform.
The default location for this file is the WINNT directory on your web application server.
2. Go to the [libdefaults] section of the file.
3. Enter this string prior to the start of the [realms] section of the file:
forwardable = true
4. Save and close the file.
5. Restart your WACS.
10.1.8 WACS and your IT environment
This section describes how to configure WACS in a complex environment.
10.1.8.1 Using WACS with other web servers
When a Web Application Container Server (WACS) is installed, it works as an application server and
a web server without requiring any extra configuration. You can configure supported web servers like
Internet Information Services (IIS) and Apache to perform URL forwarding to the WACS server.
Note:
Request forwarding from IIS by using an ISAPI filter to WACS is not supported.
WACS does not support a deployment scenario where a web server hosts static content and WACS
hosts dynamic content. Static and dynamic content must always reside on WACS.
10.1.8.2 Using WACS with a load balancer
To use WACS in a deployment with a hardware load balancer, you must configure the load balancer
so that it uses either IP routing or active cookies. This way, once a user's session is established on one
WACS, all subsequent requests by the same user are sent to the same WACS.
WACS is not supported with hardware load balancers using passive cookies.
430
2011-05-06
Managing Web Application Container Servers (WACS)
If your hardware load balancer forwards SSL-encrypted HTTPS requests to your WACS, then you must
configure HTTPS on the WACS, and install SSL certificates on every WACS.
If your hardware load balancer decrypts HTTPS traffic and forwards decrypted HTTP requests to your
WACS, then no additional WACS configuration is required.
Related Topics
• Configuring HTTPS/SSL
10.1.8.3 Using WACS with a reverse proxy
You can use WACS in a deployment with a forward or reverse proxy server. You cannot use WACS
itself as a proxy server.
10.1.8.3.1 To configure WACS to support HTTP with a reverse proxy
To use WACS in a deployment with a reverse proxy, configure your WACS so that the HTTP Port is
used for communication inside a firewall (for example on a secure network), and the HTTP through
Proxy port is used for communication from outside the firewall (for example, the internet).
1. Go to the "Servers" management area of the CMC.
2. Double-click the WACS that you want to configure.
The "Properties" screen appears.
3. In the "Configuration of HTTP through Proxy" section:
a. Check Enable HTTP through Proxy.
b. Specify the HTTP port of the WACS to be used for communication through the proxy.
c. Specify the Proxy Hostname and Proxy Port of the proxy server.
4. Click Save & Close.
10.1.8.3.2 To configure WACS to support HTTPS with a reverse proxy
Some load balancers and reverse proxy servers can be configured to decrypt HTTPS traffic and then
forward the decrypted traffic to your application servers. In this case, you can configure WACS to use
HTTP or HTTP through proxy.
If your load balancer or reverse proxy forwards HTTPS traffic, and you want to configure HTTPS with
a reverse proxy, create two WACS. Configure one WACS for HTTPS for external traffic through the
reverse proxy, and the other WACS to communicate with clients on your internal network through
HTTPS.
431
2011-05-06
Managing Web Application Container Servers (WACS)
10.1.8.4 Using WACS with firewalls
Deploying WACS in an IT environment with firewalls is supported.
By default, WACS bind to all IP addresses on the machine that it is installed on. If you plan to use a
firewall between clients and your WACS, you must force WACS to bind to a specific IP address for
HTTP or HTTP through proxy. To do this, uncheck Bind to All IP Addresses, and then specify a
Hostname or IP address to bind to.
If you plan to use a firewall between a WACS server and the other SAP BusinessObjects Business
Intelligence platform servers in your deployment, see the “Understanding communication between
SAP BusinessObjects Business Intelligence platform components ” section of the SAP BusinessObjects
Business Intelligence platform Administrator Guide.
Related Topics
• Understanding communication between BI platform components
10.1.8.5 To configure WACS on a multihomed machine
A multihomed machine is one that has multiple network addresses. By default, a Web Application
Container Server instances binds its HTTP port to all IP addresses. If you want to bind WACS to a
specific Network Interface Card (NIC), for example, when you want to bind the HTTP port of the WACS
to one NIC and bind the request port to another NIC:
1. Go to the "Servers" management area of the CMC.
2. Double-click the WACS that you want to configure.
The "Properties" screen appears.
3. In the "Configuration of HTTP through Proxy" section of the "Web Application Container Service"
pane, uncheck Bind to all IP addresses, and type an IP address for the WACS to bind to.
4. In the "HTTPS Configuration" section, uncheck Bind to all IP addresses, and type an IP address
or hostname for the WACS to bind to.
5. Under "Common Settings", deselect Auto assign, and then specify the Hostname or IP Address of
the NIC that's used for communication between WACS and the other BI platform servers in your
deployment.
6. Click Save & Close.
7. Restart the WACS.
432
2011-05-06
Managing Web Application Container Servers (WACS)
10.1.9 Configuring web application properties
The properties for web applications that are hosted on a WACS can be configured in the following ways:
• Properties that are often changed are exposed as configurable service properties for the WACS.
To edit these properties, open the "Properties" page of the WACS in the Central Management
Console (CMC), modify the value for the appropriate property, and click Save.
• To modify the session timeouts for web applications hosted on WACS, first determine whether the
web application has any properties that can be configured in the CMC.
If the web application has properties that can be modified in the CMC, then modify the web_xml.ino
file for the web application. The file is <WebAppName>_web_xml.ino, where <WebAppName> is
the name of the web application, and can be found in the <EnterpriseDirectory>/ja
va/pjs/services/<WebAppName> directory.
If the web application does not have properties that can be modified in the CMC, modify the web.xml
file for the web application. This file can be found in the <EnterpriseDirectory>/warfile/we
bapps/<WebAppName>, where <WebAppName> is the name of the web application.
•
To modify properties other than the the session time out or the properties that are exposed on the
"Properties" screen for the WACS in the CMC, modify the .properties file for the web application.
For more information, see “Managing applications through BOE.war properties” section of the SAP
BusinessObjects Business Intelligence platform Administrator Guide.
Note:
•
•
Do not modify the web.xml, web_xml.ino, or .properties files in the <EnterpriseDirecto
ry>/java/pjs/container/work/<ServerFriendlyName> directory, as your change will be
overwritten every time that the WACS starts or restarts.
After you modify the properties for a WACS, you must always restart it.
Related Topics
• To change a server's properties
• The BOE war file
10.1.10 Troubleshooting
433
2011-05-06
Managing Web Application Container Servers (WACS)
10.1.10.1 To configure tracing on WACS
To configure tracing for WACS, see Logging traces from components
10.1.10.2 To view server metrics
You can view the server metrics of a WACS from the Central Management Console (CMC).
1. Go to the "Servers" management area of the CMC.
2. Right-click the WACS, and click Metrics.
Related Topics
• Web Application Container Server Metrics
10.1.10.3 To view the state of a WACS
To view the state of a WACS, go to the "Servers" area of the CMC. The Servers List includes a State
column that provides the state for each server in the list.
WACS has a new server state called “Started with Errors”. A WACS that is in this state is running, but
has at least one misconfigured HTTP, HTTP through Proxy, or HTTPS connector.
If a WACS status is “Started with Errors”, go to the "Metrics" page and view the "List of Running WACS
Connectors" metric. If an enabled connector does not appear in the list, the connector has not been
configured properly.
10.1.10.4 Resolving port conflicts
If you cannot get any pages when you try to access the CMC through a particular port, ensure that
another application has not taken over the HTTP, HTTP through proxy, or HTTPS ports that you have
specified for WACS.
434
2011-05-06
Managing Web Application Container Servers (WACS)
There are two ways to determine if there are port conflicts with your WACS. If you have more than one
WACS in your deployment, log on to the CMC and check the Running WACS Connectors and WACS
Startup Errors metrics. If the HTTP, HTTP through Proxy, or HTTP connectors do not appear in the
Running WACS Connectors list, these connectors are not able to start due to a port conflict.
If your deployment has only one WACS, or If you are not able to access the CMC through any WACS,
use a utility such as netstat to determine if another application has taken a WACS port.
10.1.10.4.1 To resolve HTTP port conflicts
1. Start the Central Configuration Manager (CCM), and click the Manage Servers icon.
2. Specify the logon credentials.
3. On the "Manage Servers" screen, stop the WACS.
4. Click the Web Tier Configuration icon.
Note:
The Web Tier Configuration icon is only enabled when you select a WACS that is stopped.
The "Web Tier Configuration" screen appears.
5. In the HTTP Port field, specify a free HTTP port to be used by the Web Application Container Server,
and click OK.
6. On the "Manage Servers" screen, start the WACS.
10.1.10.4.2 To resolve HTTP through proxy or HTTPS port conflicts
If you cannot access a WACS through the HTTP through proxy or HTTPS ports, but you can still connect
to the Central Management Console (CMC) through the HTTP port, change the port numbers through
the CMC.
1. Go to the "Servers" management area of the CMC.
2. To stop the WACS that you want to configure, right-click the server and click Stop Server.
3. Double-click the WACS that you want to configure.
The "Properties" screen appears.
4. In the "Configuration of HTTP through Proxy" section, specify a new HTTP port.
5. To change the HTTPS port, in the "HTTPS Configuration" section, type a new value in the HTTPS
Port field.
6. Click Save & Close.
7. To start the WACS, right-click the server and click Start Server.
10.1.10.5 To change memory settings
To improve the server performance of a WACS, you can change the amount of memory that is allocated
to the server through the Central Configuration Manager (CCM).
1. Start the CCM, and click the Manage Servers icon.
435
2011-05-06
Managing Web Application Container Servers (WACS)
2. Specify the logon credentials for the CMC.
3. On the "Manage Servers" screen, stop the WACS.
4. Click the Web Tier Configuration icon.
Note:
The Web Tier Configuration icon is only enabled when you select a WACS that is stopped.
The "Web Tier Configuration" screen appears.
5. Under "Command Line Parameters", specify a new memory value by editing the command line:
a. Find the -Xmx option. This option normally has a value specified.
For example “-Xmx1g”. This setting allocates one gigabyte of memory to the server.
b. Specify a new value for the parameter.
•
•
To specify a value in megabytes, use “m”. For example, “-Xmx640m” allocates 640 megabytes
of memory to the WACS.
To specify a value in gigabytes, use “g”. For example, “-Xmx2g” allocates two gigabytes of
memory to the WACS.
c. Click OK.
6. On the "Manage Servers" screen, start the WACS.
10.1.10.6 To change the number of concurrent requests
The default number of concurrent HTTP requests that WACS is configured to handle is 150. This should
be acceptable for most deployment scenarios. To improve the performance of WACS, you can increase
the maximum number of concurrent HTTP requests. Although increasing the number of concurrent
requests can improve performance, setting this value too high can hurt performance. The ideal setting
depends on your hardware, software, and IT requirements.
1. Go to the "Servers" management area of the CMC.
2. To stop the WACS that you want to configure, right-click the server and click Stop Server.
3. Double-click the WACS that you want to configure.
The "Properties" screen appears.
4. Under "Concurrency Settings (Per Connector)", in the Maximum Concurrent Requests field, type
the desired number of concurrent requests, and click Save & Close.
5. To start the WACS, right-click the server and click Start Server.
10.1.10.7 To restore system defaults
436
2011-05-06
Managing Web Application Container Servers (WACS)
If you have misconfigured a WACS, you can restore the system defaults through the Central Configuration
Manager (CCM).
1. Start the CCM, and click the Manage Servers icon.
2. Specify the logon credentials.
3. On the "Manage Servers" screen, stop the WACS.
4. Click the Web Tier Configuration icon.
Note:
The Web Tier Configuration icon is enabled only when you select a WACS that is stopped.
The "Web Tier Configuration" screen appears.
5. Click Restore System Defaults.
6. If necessary, specify a free HTTP port, and click OK.
7. On the "Manage Servers" screen, start the WACS.
10.1.10.8 To prevent users from connecting to WACS through HTTP
In certain cases, you may want to allow only users from the local machine to connect to a WACS through
HTTP or HTTPS. For example, although you cannot close the HTTP port, you may want to configure
your WACS so that it accepts only HTTP requests from the clients located on the same machine as
the WACS. In this way, you can perform maintenance or configuration tasks on the WACS through a
browser from the same machine as the WACS, while preventing other users from accessing the server.
1. Go to the "Servers" management area of the CMC.
2. Double-click the WACS that you want to modify.
The "Properties" screen appears.
3. In the "Web Application Container Service" section, clear the Bind to all IP Addresses check box.
4. In the Bind to Hostname or IP address field, type 127.0.0.1, and click OK.
5. To start the WACS, right-click the server and click Start Server.
The WACS that is configured this way accepts only connections from the local machine.
10.1.11 WACS properties
For a complete list of the general, HTTP, HTTP through Proxy, and HTTPS configuration properties
that can be configured for WACS, see the “Core Server Settings” section of the “Server Properties
Appendix”.
437
2011-05-06
Managing Web Application Container Servers (WACS)
Related Topics
• Core Services Properties
438
2011-05-06
Backing Up and Restoring
Backing Up and Restoring
11.1 Backing up and restoring your system
This chapter describes suggested procedures for performing backups of SAP BusinessObjects Business
Intelligence platform system and data files, as well as the procedures to recover from data loss or
hardware failure. The plan execution requires an experienced BusinessObjects Professional, System
Administrator and Database Administrator.
The backup and recovery process is similar for all environments; development, test, and production.
Therefore, this chapter does not refer to any specific environment. It is recommended that you back up
all environments.
A backup and recovery plan consists of precautions to be taken in the event of a system failure due to
a natural disaster or a catastrophic event. The plan aims to minimize the effects of the disaster on the
daily operations so that you are able to maintain or quickly resume mission-critical functions.
It is recommended that you regularly back up your Central Management Server (CMS) system database,
the contents of your Input and Output File Repositories, and the file system of the machines where SAP
BusinessObjects Business Intelligence platform is installed to protect your system from hardware
failures, software failures, or misconfigured server settings.
It is also recommended that you regularly back up your Business Intelligence content, including reports,
users, and rights by using Lifecycle management console for SAP BusinessObjects Business Intelligence
platform 4.0 and exporting the content to Business Intelligence Archive (LCMBIAR) files. In the event
of corrupt or missing content, you can restore this content at a later time without having to restore the
entire CMS database or File Repositories. For more information on using Lifecycle management console
for SAP BusinessObjects Business Intelligence platform 4.0, see the Lifecycle management console
for SAP BusinessObjects Business Intelligence platform 4.0 User Guide. If you are using Subversion
with the Lifecycle management console for SAP BusinessObjects Business Intelligence platform 4.0,
see the chapter “Backing Up Subversion Files” in Lifecycle management console for SAP
BusinessObjects Business Intelligence platform 4.0 User Guide for information on backing up the
Subversion repository.
The remainder of this chapter describes how to back up and restore your system if a CMS system
database, File Repositories, or file system becomes lost, damaged, or corrupt. It also describes how
to recover in the event of a misconfigured CMS, where it is not possible to use Lifecycle management
console for SAP BusinessObjects Business Intelligence platform 4.0 to restore server settings or
Business Intelligence content.
439
2011-05-06
Backing Up and Restoring
Note:
You can backup an SAP BusinessObjects Business Intelligence platform system and then restore a
system to create a copy of the system.
11.1.1 Conducting a system backup
It is recommended that you back up the following elements on a regular basis:
• Central Management Server (CMS) System Database
It's critical to frequently back up the CMS system database. The environment cannot be restored
without a properly backed up CMS system database. You must stop the system before backing up
the CMS system database. The CMS system database backup should be performed by using the
database vendor's database backup tools.
A backup of the CMS database should be the first step in your backup process. Once this has begun
you can start backing up your File Repository Servers.
•
Input and Output File Repository Servers
To maintain the integrity of a backup, it is recommended that you back up the contents of your File
Repositories servers (FRS) in addition to your CMS system database. Backing up the File Repositories
consists of backing up all of the files located in the folders specified by the “File Store Directory”
properties of the Input and Output File Repository Servers. You must stop the system before backing
up the File Repositories. The backup should be performed by using any file system backup tools.
The frequency with which you back up your CMS system database, File Repositories, and file system
will depend on your organization's business needs.
You can choose to stop your BI platform system and perform a cold backup, which will ensure that the
databases are in a static state and minimize the possibility of changing data corrupting the quality of
the backup.
As a best practice, you should also consider backing up the following elements.
• Auditing database
• Auditing temporary files
• Custom applications
Any custom applications or customizations should be backed up whenever they are modified.
•
440
Database Connections
2011-05-06
Backing Up and Restoring
11.1.2 Backing up server settings
In order to protect your system from misconfigured server settings, it is recommended that you back
up your server settings to a BIAR file on a regular basis. Having available backups of your servers
allows you restore the settings without having to restore your CMS system database, File Repositories,
or Business Intelligence content.
It is essential that you back up your server settings whenever you make any changes to your system's
topology. This includes creating, renaming, moving, and deleting nodes, and creating or deleting servers.
It is recommended that you back up your server settings before you change any of the settings, and
then again after you're satisfied with the changes that you've made.
Use the Central Configuration Manager (CCM), or a script to back up your BI platform server settings
to a BIAR file, and then store the file on a separate machine. It is recommended that you back up your
server settings whenever you modify the settings.
Note:
If you are backing up or restoring server settings in a deployment where SSL is enabled, you must first
disable SSL through the CCM, and then re-enable it when the backup or restore is complete.
On Windows, the BackupCluster.bat script is located in the <INSTALLDIR>\SAP
BusinessObjects Business Intelligence platform 4.0\win64_x64\scripts directory.
On UNIX, the backupcluster.sh script is located in the /<INSTALLDIR>/sap_bobj/enter
prise_xi40/<platform64>/scripts directory.
Related Topics
• Configuring the SSL protocol
11.1.2.1 To back up server settings by using the CCM on Windows
This procedure backs up the server settings for an entire cluster. It is not possible to backup the settings
for individual servers.
Note:
If you are using a temporary CMS, you must start the CCM on a machine that has a local CMS.
1. Start the CCM and from the toolbar, click Back up Server Configuration.
The "Server Configuration Backup Wizard" appears.
2. Click Next to start the wizard.
441
2011-05-06
Backing Up and Restoring
3. Specify whether to use an existing CMS to backup server configuration settings or to create a
temporary CMS.
• To back up server settings from a system that is running, select Use existing running CMS,
and click Next.
• To back up server settings from a system that isn't running, select Start a new temporary CMS,
and click Next.
4. If you are using a temporary CMS, select a port number for the CMS to run on, and specify the
database connection information.
To minimize the risk of users accessing your system while you are backing up or restoring your
system, specify a port number that is different than the port numbers that your existing CMSs use.
5. When prompted, log on to the CMS by specifying the system and user name and password of an
account with administrative privileges, and click Next to continue.
6. Specify the location and name of a BIAR file that you want to back up the server configuration settings
to, and click Next to continue.
The "Confirmation" screen displays the information that you have provided.
7. Verify that the information displayed on the "Confirmation" screen is correct, and click Finish to
continue.
The CCM backs up the server configuration settings for the entire cluster to the BIAR file that you
specify. Details of the backup procedure are written to a log file. The name and path of the log file
are displayed in a dialog box.
8. If the backup operation failed, check the log file to determine the reason.
9. Click OK to close the wizard.
11.1.2.2 To back up server settings on UNIX
On UNIX machines, use the serverconfig.sh script to back up your deployment's server settings
to a BIAR file.
1. Select 5 - Back up server configuration and press Enter.
2. Specify whether to use an existing CMS to backup server configuration settings or to create a
temporary CMS.
• To back up server settings from a system that is running, select existing, and press Enter.
• To either back up server settings from a system that isn't running, or to restore server settings,
select temporary, and press Enter.
3. If you are using a temporary CMS to back up your server settings, on the next several screens,
select a port number for the temporary CMS to run on, and the connection information to the CMS
system database.
To minimize the risk of users accessing your system while you are backing up or restoring your
system, specify a port number that is different than the port numbers that your existing CMSs use.
442
2011-05-06
Backing Up and Restoring
4. When prompted, log on to the CMS by specifying the system and user name and password of an
account with administrative privileges, and press Enter
5. When prompted, specify the location and name of a BIAR file that you want to back up the server
configuration settings to, and press Enter
A summary screen displays the information that you have provided.
6. Verify that the information displayed on the screen is correct, and press Enter to continue.
The serverconfig.sh script backs up the server configuration settings for the entire cluster to
the BIAR file that you specify. Details of the backup procedure are written to a log file. The name
and path of the log file are displayed on the screen.
7. If the backup operation failed, check the log file to determine the reason.
11.1.2.3 To back up servers settings with a script
You can back up the server settings of your deployment by running the backupcluster.bat script
on Windows, or the BackupCluster.sh script on UNIX.
On Windows, the BackupCluster.bat is located in the <INSTALLDIR>\SAP BusinessObjects
Business Intelligence platform 4.0\win64_x64\scripts directory.
On UNIX machines, backupcluster.sh is located in the /<INSTALLDIR>/sap_bobj/enter
prise_xi40/<platform64>/scripts directory.
For information on the parameters used by the script, see BackupCluster and RestoreCluster parameters.
11.1.3 Backing up Business Intelligence content
It is recommended that you use the Lifecycle management console for SAP BusinessObjects Business
Intelligence platform 4.0 to regularly back up your Business Intelligence content, such as reports, users
and groups, and universes. Having current backups of your content makes it possible to restore your
Business Intelligence without having to restore your entire system or your server settings.
For more information on using the Lifecycle management console for SAP BusinessObjects Business
Intelligence platform 4.0, see the Lifecycle management console for SAP BusinessObjects Business
Intelligence platform 4.0 User Guide.
If you are using Subversion with the Lifecycle management console for SAP BusinessObjects Business
Intelligence platform 4.0, see the chapter “Backing Up Subversion Files” in Lifecycle management
console for SAP BusinessObjects Business Intelligence platform 4.0 User Guide for information on
backing up the Subversion repository.
443
2011-05-06
Backing Up and Restoring
11.1.4 Restoring your system
The steps that you take to restore your system will depend on whether your Central Management Server
(CMS) system database, your Input and Output File Repositories, or the file system of the machine
where SAP BusinessObjects Business Intelligence platform is installed is lost or corrupt, and whether
you have available backups of these components.
• If your CMS system database is corrupt or lost and you have available backups of both the system
database and your File Repositories, see Restoring an SAP BusinessObjects Business Intelligence
platform system where backups are available.
• If your CMS system database is corrupt or lost and you do not have available backups of both the
database and the File Repositories, but you have backed up your Business Intelligence content in
a BIAR file, see Recreating an SAP BusinessObjects Business Intelligence platform system where
no backups are available.
• If your File Repositories are corrupt or lost and you have backups of both the CMS system database
and the File Repositories, see Restoring an SAP BusinessObjects Business Intelligence platform
system where backups are available.
• If your File Repositories are corrupt or lost, and you do not have available backups of both the CMS
system database and File Repositories, but you have backed up your content in a BIAR file, see
Recreating an SAP BusinessObjects Business Intelligence platform system where no backups are
available.
• If your servers are misconfigured and you want to rollback your entire system to a previous state,
and you have backups of both your CMS system database and File Repositories, see Restoring an
SAP BusinessObjects Business Intelligence platform system where backups are available.
Before you restore your CMS system database or File Repositories, you must:
1. Stop SAP BusinessObjects Business Intelligence platform.
2. Perform a backup of your current CMS system database, File Repositories.
Note:
If you do not have backups of both your CMS system database and your File Repositories, and you do
not have your server configuration settings backed up in a BIAR file and your File Repositories backed
up in an LCMBIAR file, it is not possible to restore your system.
Related Topics
• Repository Diagnostic Tool
11.1.4.1 Restoring an SAP BusinessObjects Business Intelligence platform system
where backups are available
444
2011-05-06
Backing Up and Restoring
This workflow assumes that you have:
• An available backup of your CMS system database
• An available backup of your File Repositories
If either one of your CMS system database or File Repository Servers are lost, corrupt, or damaged,
restore the CMS system database and File Repositories from current backups.
Note:
When restoring the CMS system database or File Repositories from a backup, you must restore both
the database and the File Repositories from backups taken at the same time as one another. To ensure
that there are no inconsistencies between the CMS and the File Repositories , do not restore one without
also restoring the other. Use your database vendor's database backup and restoration tools to restore
the CMS system database. The restoration of the File Repositories consists of restoring from a backup
of the files located in the folders specified by the “File Store Directory” properties of the Input and Output
File Repository Servers. The restoration should be performed by using any file system backup and
restoration tools.
It is not necessary to restore the file system of the machine where the BI platform is installed when
restoring the CMS system database or File Repositories.
1. Restore the CMS system database from an available backup.
2. Restore the File Repositories from an available backup.
Note:
You may restore both components in parallel to help eliminate downtime.
Your BI platform system is restored to the same state as when it was backed up, including the system's
content, users, and server settings.
After your restoration is complete:
1. Run the Repository Diagnostic Tool (RDT) to ensure that there are no inconsistencies between the
CMS system database and the File Repositories. For more information on using the Repository
Diagnostic Tool, see the SAP BusinessObjects Business Intelligence Platform Repository Diagnostic
Tool User Guide.
2. Start BI platform and verify that the system is working properly.
Whether you first start the BI paltform and then run the RDT or first run the RDT and then start the BI
platform will depend on how important it is to get your system back online as quickly as possible. Any
inconsistencies that the RDT finds are not resolved until the RDT completes.
11.1.4.2 Recreating an SAP BusinessObjects Business Intelligence platform system
where no backups are available
445
2011-05-06
Backing Up and Restoring
If either one of your CMS system database or File Repositories are lost, corrupt, or damaged, and
backups are not available, you can recreate your system if you've backed up your system's server
settings to a BIAR file and you've backed up your Business Intelligence content to an LCMBIAR file.
1. In the Central Configuration Manager (CCM), recreate the CMS system database.
This recreates the CMS system database in its default state, erasing all existing content.
2. Restore your server settings from the BIAR file, either by using the Central Configuration Manager
(CCM) or the RestoreCluster script.
3. Use LifeCycle Manager to restore your Business Intelligence content from the LCMBIAR file.
For more information on using LifeCycle Manager, see the Lifecycle management console for SAP
BusinessObjects Business Intelligence platform 4.0 User Guide.
Related Topics
• Recreating the CMS system database
• Restoring server settings
11.1.4.3 Restoring server settings
If you need to restore your system's server settings from a BIAR file, you can use either the Central
Configuration Manager (CCM) or the RestoreCluster script to restore the server settings. Restoring
server content from a BIAR file doesn't affect Business Intelligence content such as reports, users and
groups, or security settings.
Note:
•
•
When restoring server settings, only the restoration of the settings for an entire cluster is supported.
It is not possible to restore the settings for only some of the servers in the cluster.
If you are backing up or restoring server settings in a deployment where SSL is enabled, you must
first disable SSL through the CCM, and then re-enable it when the backup or restore is complete.
Related Topics
• Configuring the SSL protocol
11.1.4.3.1 To restore server settings with the CCM on Windows
You can use the Central Configuration Manager (CCM) to restore server settings. After you restore
server settings, you must recreate your system's nodes on every machine in your system's cluster.
1. Stop all the nodes on all of the machines in the cluster for which you are restoring server configuration
settings by stopping the Server Intelligence Agent for each node.
2. Start the CCM on a machine that has a CMS.
3. From the toolbar, click Restore Server Configuration.
The "Restore Server Configuration Wizard" appears.
446
2011-05-06
Backing Up and Restoring
4. Click Next to start the wizard.
5. When prompted, provide the port number for the temporary Central Management Server (CMS) to
use, and the information to connect to the CMS system database, and click Next to continue.
6. When prompted, log onto the CMS by entering the CMS name and the username and password of
an account with administrative privileges, and click Next to continue.
7. Specify the location and name of the BIAR file that contains the server configuration settings that
you want to restore, and click Next to continue.
A summary screen that displays the information that you've provided appears.
8. Click Finish to continue.
A warning message that the existing server settings will be overwritten by the values specified in
the BIAR file. If you proceed with this procedure, the current server settings will be lost.
9. Click Yes to restore the server configuration settings.
The CCM restores the server configuration settings for the entire cluster from the BIAR file. Details
of the procedure are written to a log file. The name and path of the log file are displayed in a dialog.
10. If the restore operation failed, check the log file to determine the reason.
11. Click OK to close the wizard.
The server settings from the BIAR file are restored on your system. Any nodes and servers existing in
the BIAR file that did not exist on the system prior to the restore are created. Any nodes and servers
that exist on the system but that do not exist in the BIAR file are deleted.
After you've restored the server settings for the cluster, you must recreate the nodes in your system on
every machine in the cluster.
Related Topics
• Recreating a node
11.1.4.3.2 To restore server settings with the CCM on UNIX
On UNIX machines, use the serverconfig.sh script to restore your deployment's server settings
from a BIAR file.
1.
2.
3.
4.
Select 6 - Restore server configuration and press Enter.
Enter a port number for the temporary Central Management Server (CMS) to use, and press Enter.
On the next several screens, specify the connection information to the CMS system database.
When prompted, log on to the CMS by specifying the system and user name and password of an
account with administrative privileges, and press Enter.
5. When prompted, specify the location and name of a BIAR file that you want to restore the server
configuration settings from, and press Enter
A summary screen displays the information that you have provided.
6. Verify that the information displayed on the screen is correct, and press... to continue.
447
2011-05-06
Backing Up and Restoring
The serverconfig.sh script restores the server configuration settings for the entire cluster from
the BIAR file that you specify. Details of the restore procedure are written to a log file. The name
and path of the log file are displayed on the screen.
7. If the restore operation failed, check the log file to determine the reason.
11.1.4.3.3 To restore server settings with a script
If you prefer, you can restore the server settings of your deployment by running the RestoreClus
ter.bat script on Windows, or the restorecluster.sh script on UNIX.
On Windows, RestoreCluster.bat is located in the <INSTALLDIR>\SAP BusinessObjects
Business Intelligence platform 4.0\win64_x64\scripts directory.
On UNIX, restorecluster.sh is located in the /<INSTALLDIR>/sap_bobj/enter
prise_xi40/<platform64>/scripts directory.
For information on the parameters used by the script, see BackupCluster and RestoreCluster parameters.
11.1.4.4 Restoring Business Intelligence content
If you've backed up Business Intelligence content into LCMBIAR files, you can restore your content
without having to restore your entire system by using Lifecycle management console for SAP
BusinessObjects Business Intelligence platform 4.0. For more information, see the Lifecycle management
console for SAP BusinessObjects Business Intelligence platform 4.0 User Guide.
11.1.5 Restoring lost or corrupt SAP BusinessObjects Business Intelligence platform
files where a backup is available
If your CMS system database and File Repositories are in working order, but SAP BusinessObjects
Business Intelligence platform configuration files are lost or corrupt, and you have an available backup
of the files, restore the file system from the backup. You must restore your system's CMS system
database and File Repositories when restoring a file system.
11.1.6 Recreating a SAP BusinessObjects Business Intelligence platform system when
files are lost
This procedure assumes that you have the following:
448
2011-05-06
Backing Up and Restoring
•
•
A backup of your CMS system database
A backup of the contents of your File Repository Servers
If the file system of the machine where SAP BusinessObjects Business Intelligence platform is installed
is lost or corrupt and you do not have an available backup of the file system, you may attempt to recover
by reinstalling SAP BusinessObjects Business Intelligence platform, either on the same machine or on
a different machine.
1. Perform a New installation of SAP BusinessObjects Business Intelligence platform, with the same
options as the original installation. The new installation must have as many nodes as the original
installation. The node names must be the same as the node names from the original installation.
You must install SAP BusinessObjects Business Intelligence platform to the same folder as the
original installation. When you install SAP BusinessObjects Business Intelligence platform, specify
the existing CMS system database as the database.
Note:
When you select the existing CMS system database during the installation, on the "Configure CMS
Repository Database" screen it is essential that you ensure that the Reset existing database check
box is unchecked. Leaving this checked will delete all of the contents of the existing database.
2. Restore the File Repositories from an available backup.
11.1.7 BackupCluster and RestoreCluster parameters
The following table describes the command-line parameters used with the BackupCluster script.
Table 11-1: BackupCluster parameters
449
Name
Description
Example
-backup
The name and path of the BIAR
file that you want to back up
your system's server settings to
restore.
-backup "C:\Users\Administrator\Desktop\my.biar"
-cms
The host name of the machine
where your system's Central
Management Server is located.
If your CMS is running on any
other port than the default port,
6400, you must also specify the
port number.
-cms mycms:6400
-username
The user name of an Administrator account.
-username Administrator
2011-05-06
Backing Up and Restoring
Name
Description
Example
-password
The password of an Administrator account.
-password Password1
The following table describes the command-line parameters used with the RestoreCluster script.
Table 11-2: RestoreCluster parameters
Name
Description
Example
-restore
The name and path of the BIAR
file that contains the server
configuration settings that you
want to restore.
-restore "C:\Users\Administrator\Desktop\my.biar"
-username
The user name of an Administrator account.
-username Administrator
-password
The password of an Administrator account.
-password Password1
-displaycontents
Displays a list of nodes and
servers that the BIAR file contains.
-displaycontents "C:\Users\Administrator\Desktop\my.biar"
Note:
It is recommended that you run the RestoreCluster script with the -displaycontents parameter
to display the contents of the BIAR file before you restore the server settings.
The following parameters are required if you are backing up server settings from a system that is not
running, or if your are restoring server settings.
Table 11-3: Parameters used when using a temporary CMS
450
Name
Description
Example
-usetempcms
Creates a temporary CMS for
the specified operation. After the
operation is complete, the temporary CMS is stopped.
-usetempcms
-cmsport
The port number of the temporary CMS.
-cmsport 6400
2011-05-06
Backing Up and Restoring
Name
Description
Example
-dbdriver
The database driver of the CMS
system database. Accepted
values are:
• db2databasesubsystem
• maxdbdatabasesubsystem
• mysqldatabasesubsystem
• oracledatabasesubsystem
• sqlserverdatabasesubsystem
• sybasedatabasesubsystem
-dbdriver sqlserverdatabasesubsystem
The CMS system database
connection string.
Note:
-connect
Due to the limitations of the
command prompt, you must use
the caret (^) to escape spaces,
the equals sign (=) and the
semicolon (;) in the -connect
string.
To avoid using the caret in long
strings, you can write the script's
name and all of its parameters
to a temporary response.bat file,
and then run response.bat without any parameters.
-dbkey
The cluster key.
-connect "DSN^=BusinessOb
jects^ CMS^ 140^;UID^=user
name^;PWD^=Pass
word1^;HOST
NAME^=database^;PORT^=3306"
-dbkey abc1234
Example:
The following example shows how to back up your server settings to a BIAR file, using an existing
CMS.
-backup "C:\Users\Administrator\Desktop\my.biar"
-cms mycms:6400
-username Administrator
-password Password1
Example:
The following example shows how to display the contents of a BIAR file.
-displaycontents "C:\Users\Administrator\Desktop\mybiar.biar"
451
2011-05-06
Backing Up and Restoring
Example:
The following example shows how to restore your settings from a BIAR file. You must always use a
temporary CMS when restoring server settings.
-restore "C:\Users\Administrator\Desktop\my.biar"
-cms mycms:6400
-username Administrator
-password Password1
-usetempcms
-cmsport 6400
-dbdriver sqlserverdatabasesubsystem
-connect "DSN^=BusinessObjects^ CMS^ 140^;UID^=username^;PWD^=Password1^;HOSTNAME^=database^;PORT^=3306"
-dbkey abc1234
452
2011-05-06
Life Cycle Management
Life Cycle Management
12.1 Lifecycle management console
Lifecycle management console for SAP BusinessObjects Business Intelligence platform 4.0 is a
web-based tool that enables you to move BI resources from one system to another system, without
affecting the dependencies of these resources. It also enables you to manage different versions of BI
resources, manage dependencies of BI resources, and roll back a promoted resource to restore the
destination system to its previous state.
The lifecycle management console tool is a plug-in for the SAP BusinessObjects Business Intelligence
platform application. You can promote a BI resource from one system to another system only if the
same version of the SAP BusinessObjects Business Intelligence platform application is installed on
both the source and destination systems.
SAP BusinessObjects provides the following tools for importing objects across two SAP BusinessObjects
Business Intelligence platform deployments that are at the same version number.
• lifecycle management console
For more information on using lifecycle management console, see Lifecycle management console
for SAP BusinessObjects Business Intelligence platform 4.0 User Guide.
•
BIAR Command-Line Tool
For more information on using BIAR Command Line Tool, see Lifecycle management console for
SAP BusinessObjects Business Intelligence platform 4.0 User Guide.
12.2 Version Management System settings for Lifecycle management console
12.2.1 Version Management System settings for Lifecycle management console
•
453
When lifecycle management console Subversion is installed along with SAP BusinessObjects
Business Intelligence platform, the configuration settings are done automatically.
2011-05-06
Life Cycle Management
•
If you want to configure the lifecycle management console Subversion which is already installed,
enter the appropriate values in the "VMS Settings" page in the Administration Options in the
lifecycle management console tool.
The following figure shows the appropriate values to specify in the "VMS Settings" page:
•
If life cycle management Subversion is installed after the installation of the SAP BusinessObjects
Business Intelligence platform,
Note:
Ensure that the Subversion service is running and repository is created.
1. Enter the appropriate values in the "VMS Settings" page in the Administration Options in the
lifecycle management console tool.
2. Restart SIA.
12.3 BIAR Engine Command-Line Tool
The BIAR Engine Command-Line Tool helps administrators and delegated administrators promote
content between Development, Quality Assurance, and Production SAP BusinessObjects Business
Intelligence platform environments. The tool uses scripting to automate the import and export of objects.
The BIAR Engine Command-Line Tool supports migrating objects only from one SAP BusinessObjects
Business Intelligence platform 4.0 system to another. You cannot use the tool to import objects from
BusinessObjects, Crystal Enterprise, or an earlier version of SAP BusinessObjects Business Intelligence
platform . You must use the SAP BusinessObjects Business Intelligence platform Upgrade management
tool to import content from previous versions.
454
2011-05-06
Life Cycle Management
The BIAR Engine Command-Line Tool is called biarengine.jar. On a Windows environment, this
file is located at <InstallDir>\SAP BusinessObjects Enterprise XI 4.0\java\lib. On
UNIX, the file is located at <InstallDir>/sap_bobj/java/lib/.
Note:
•
•
•
You must have a Java Runtime Environment installed. For supported a list of supported JREs, see
the SAP BusinessObjects Business Intelligence platform supported platform document guide online
on our support web site.
To use the BIAR Engine Command-Line Tool, you must have the Administrator account credentials
for the environment that you are importing content to or from. You can also use a delegated
administrator account.
Using the BIAR Engine Command-Line Tool to import BIAR files generated by SAP BusinessObjects
Business Intelligence platform Upgrade management tool is not supported.
The BIAR Engine Command-Line Tool imports the following types of objects:
455
2011-05-06
Life Cycle Management
Analysis Connections
Web Intelligence Documents
Analysis Workspaces
LDAP Users
Agnostic Documents
List Of Values (LOVs)
Analytic Objects
Object Packages
BI Modeler Objects
Overloads
BI workspaces
PDFs
Business Views
PowerPoint Presentations
Calendars
Profiles
Categories
Program Objects
Client Actions
Prompt Groups
Custom Roles
Publications
Dashboard Design Documents
Query as a Web Service
Discussions
Reports
Encyclopedias
Report Instances
Enterprise User Groups
Rich Text Format Documents
Enterprise Users
Server Groups
Events
Shortcuts
Excel Spreadsheets
Text Files
Flash Files
Universes
Folders
WinAD Users
FullClientAddins
Word Documents
FullClientTemplates
XcelsiusDMTTemplates
Hyperlinks
Importing relationships
The BIAR Engine Command-Line Tool keeps the relationships between imported objects intact only if
both objects are imported together, or if one of the objects already exists on the destination system.
For example, if you have a Web Intelligence report that uses a universe, and you import the report
without also importing the universe, the relationship between the two is dropped. The report will not run
on the destination system.
456
2011-05-06
Life Cycle Management
Importing users and groups
If you are importing groups and users into an SAP BusinessObjects Business Intelligence platform
system, and a group already exists on the destination system, the group membership on the destination
is overwritten with the group membership that was exported from the BIAR file. This means if the group
on the destination system has additional users that are not contained in the group in the BIAR file, they
will not be part of the group after the import occurs.
Importing rights
The BIAR Engine Command-Line Tool imports rights on an object only if the user or group is either
exported with the object or already exists on the destination.
If the object and user or group already exist on the destination system, then the imported rights for that
object and user will overwrite the existing rights on the destination system.
However, if an object already exists on the destination and a user/group has rights specified on that
object on the destination, but no rights for this user/group are specified on the object in the BIAR file,
the tool does not remove the existing rights for the user/group.
This means that rights that exist on a destination object can be overwritten, but not removed.
Using multiple BIAR files
When using the BIAR Engine Command-Line Tool to export content, the content is placed in a BIAR
file. The location and name of the BIAR file is determined by exportBiarLocation parameter. When
you export content that exceeds the amount of information that can be stored in a single BIAR file, the
tool splits the information and stores it in multiple BIAR files. The files use the name that you specify,
and will have numbers added to the end of the file name.
For example, if you set exportBiarLocation = C:\Archive.biar, and you export more content
than can fit in a single BIAR file, the tool creates the files Archive.biar, Archive1.biar,
Archive2.biar, and so on. The tool creates the files in the directory C:.
Note:
If you want to import content that is stored in multiple BIAR files, you must ensure that all of the BIAR
files are located in the same directory.
12.3.1 Using a properties file
The BIAR Engine Command-Line Tool requires a properties file that contains the parameters that tell
the BIAR Engine what actions to take, what SAP BusinessObjects Business Intelligence platform
system to connect to, and so on.
The file must have a .properties file extension. For example: Myproperties.properties
The properties file can include the following parameters.
457
2011-05-06
Life Cycle Management
Parameter
Action
Allowed Values
exportXML, importXML
Description
Specifies whether the tool
imports content from a
BIAR file to an SAP BusinessObjects Business Intelligence platform system, or exports the content from a deployment to
a BIAR file.
Example
Action=exportXML
Mandatory.
exportBiarLocation
importBiarLocation
Free-form text. Must include the .biar extension.
Free-form text. Must include the .biar extension.
Specifies where the tool
saves the exported BIAR
file.
Mandatory if action=ex
portXML.
exportBiarLoca
tion=C:/BiarExport
File.biar
Specifies where the BIAR
file that is to be imported
is located. BIAR files are
split if the contents are
too large to fit into one
BIAR file.
You can enter any of the
BIAR file partitions, but
you must ensure all of the
partitions are in the same
directory.
importBiarLoca
tion=C:/BiarImportFile.biar
Mandatory if action=im
portXML.
userName
Free-form text.
The username of the administrative account that
the tool should use to
connect to the Central
Management Server
(CMS). This can be the
username of a Delegated
Administrator account.
userName=Administrator
Mandatory.
458
2011-05-06
Life Cycle Management
Parameter
password
Allowed Values
Description
Example
Free-form text.
The password for the administrative account.
password=password
Mandatory.
The authentication type
that tool uses.
authentication
CMS
secEnterprise, secWinAd,
secLdap
Free-form text.
Optional. If you don't
specify an authentication
type, the default is secEn
terprise.
The name of the CMS
that you want to connect
to.
authentication=secEnter
prise
CMS=mycms:6400
Mandatory.
exportDependencies
True, False
Specifies whether to import all dependencies of
an object. This should be
used with care as it imports all the objects that
are associated with any
selected objects. This can
increase the size of a
BIAR file dramatically.
exportDependen
cies=false
Optional. If you don't
specify a value, the default is False.
Only used if action=ex
portXML.
459
2011-05-06
Life Cycle Management
Parameter
includeSecurity
Allowed Values
Description
Example
True, False
Specifies whether the tool
exports and imports security associated with the
objects and users that
you select. If you want to
maintain security, it is important to set includeSe
curity to true when exporting and importing
content.
includeSecurity=false
Note:
If you are using Access
Levels, you must explicitly
export these objects.
Optional. If you don't
specify a value for this
parameter, the default is
True.
Specifies the queries that
the tool should execute to
gather the desired objects
for exportation.
exportQuery
Free-form text. This must
use the CMS query language format.
You can use as many
queries as you like in a
single properties file, but
the queries must be
named “exportQuery1”,
“exportQuery2”, and so
on.
exportQuery=select * from
ci_Infoobjects where
si_name = 'Xtreme Employees' and si_kind =
'Webi'
Mandatory if action=ex
portXML.
460
2011-05-06
Life Cycle Management
Parameter
exportQueriesTotal
Allowed Values
Positive whole numbers.
Description
Specifies how many export queries the tool executes. If you have “x” export queries and want to
execute them all, you
must set this parameter
to “x”.
Example
exportQueriesTotal=5
Optional. If you don't provide a value for this parameter, the default value
is 1.
Only used if action=ex
portXML.
Note:
To comment lines out, use the # character. For example:
action=importXML
#exportLocation=C:/mybiar.biar
importLocation=C:/mybiar.biar
This is an example of a properties file that imports content from a BIAR file:
#This file imports a biar, note this line is a comment
importBiarLocation=C:/CR.biar
action=importXML
userName=Administrator
password=
CMS=mycms:6400
authentication=secEnterprise
This is an example of a properties file that exports a Web Intelligence report named “Xtreme Employees”
to a BIAR file:
#This file exports a single report
# Remember to include indexed properties with your query!
# The more indexed properties, the better!
exportBiarLocation=C:/CR.biar
action=importXML
userName=Administrator
password=
CMS=mycms:6400
authentication=secEnterprise
exportDependencies=false
exportQuery= select * from ci_Infoobjects where si_name = 'Xtreme Employees' and si_kind = 'Webi'
12.3.2 To use the BIAR Engine Command-Line Tool
461
2011-05-06
Life Cycle Management
1. Open a command-line window and navigate to the directory where biarengine.jar is located.
For example, <InstallDir>\SAP BusinessObjects Enterprise XI4.0\java\lib.
2. Execute biarengine.jar.
For example, java -jar biarengine.jar <properties file>
The BIAR Engine Command-Line Tool either exports content from SAP BusinessObjects Business
Intelligence platform deployment to a BIAR file, or imports the content from a BIAR file to a SAP
BusinessObjects Business Intelligence platform deployment, depending on the action parameter in
the properties file.
462
2011-05-06
Managing Applications
Managing Applications
13.1 Managing applications through the CMC
13.1.1 Overview
The "Applications" management area of the CMC allows you to change the appearance and functionality
of web applications such as the CMC and BI launch pad, without doing any programming. You can also
modify access to applications for users, groups, and administrators by changing the rights associated
with each one.
In this section, you'll find contextual information, procedures, and instructions on how to manage various
settings. The following applications have settings that can be modified through the CMC:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
463
Analysis, edition for OLAP
Alerting
BI launch pad
BI workspaces
Central Management Console
Crystal Reports
Dashboard Design
Discussions
Information Designer
Web Intelligence
LifeCycle Manager
Monitoring
Open Document
Platform Search
Report Conversion Tool
SAP BusinessObjects Mobile
Translation management tool
Universe design tool
Upgrade management tool
VisualDiff Application
2011-05-06
Managing Applications
•
•
Web Service
Widgets for SAP BusinessObjects Business Intelligence platform
13.1.2 Common settings for applications
13.1.2.1 Setting user rights on applications
You can use rights to control user access to certain features of applications. The "Applications" area
in the CMC lets you assign principals to the access control list for an application, view the rights that a
principal has, and modify the rights that the principal has to an application. For more information about
rights administration, see the SAP BusinessObjects Business Intelligence Platform Administrator Guide.
13.1.2.2 To set the web application trace log level in the CMC
By default the trace log level for web applications in the CMC is set to "Unspecified". Trace Log settings
are available for the following applications in the CMC:
•
•
•
•
Central Management Console
BI launch pad
Open Document
Web Service
To trace all other web applications, use the manual method to configure the corresponding BO_trace
file.
1. Go to the "Applications" management area of the CMC.
The "Applications" dialog box is displayed.
2. Right-click the application and select Trace Log Settings.
The "Trace Log Settings" dialog box appears.
3. Select the desired setting from the Log Level list.
4. Click Save & Close to submit the trace log level.
The new trace log level will be in effect after the next logon to the web application.
Related Topics
• Trace log levels
464
2011-05-06
Managing Applications
13.1.2.2.1 Trace log levels
The following table describes the available trace log levels for BI platform components:
Level
Description
Unspecified
The trace log level is specified through another mechanism, usually an .ini file.
None
When the trace log level is set to "None", the filter to optionally suppress traces
below a specified importance level is deactivated.
Note:
A "None" trace log level does not mean that the tracing feature is turned off.
System resources continue to be monitored and traces will be logged for rare
critical events such as failed assertions.
Low
The trace log filter is set to allow for logging error messages while ignoring
warning and most status messages. However, very important status messages
will be logged for component startup, shutdown, as well as the start and end request messages.
Note:
This level is not recommended for debugging purposes.
Medium
The trace log filter is set to include error, warning, and most status messages in
the log output. Status messages that are least important or highly verbose will be
filtered out. This level is not verbose enough for debugging purposes.
High
No messages will be excluded by the filter. This level is recommended for debugging purposes.
Note:
A "High" trace log level could affect system resources. It could potentially increase
CPU usage as well as storage space in the file system.
13.1.3 Application-specific settings
13.1.3.1 Managing CMC application settings
465
2011-05-06
Managing Applications
13.1.3.1.1 Authentication and program objects
Be aware of the potential security risks associated with adding program objects to the repository. The
level of file permissions for the account under which a program object runs will determine what
modifications, if any, the program can make to files.
You can control the types of program objects users can run, and you can configure the credentials
required to run program objects.
Enabling or disabling a type of program object
As a first level of security, you can configure the types of program objects available for use.
Authentication on all platforms
In the "Folders" management area of the CMC, you must specify credentials for the account under
which the program runs. This feature allows you to set up a specific user account for the program, and
assign it appropriate rights, to have the program object run under that account.
Alternatively, users who add program objects to BI platform can assign their own credentials to a program
object and give the program access to the system. Thus, the program will run under that user account,
and the rights of the program will be limited to those of the user. If you choose not to specify a user
account for a program object, it runs under the default system account, which generally has rights locally
but not across the network.
Note:
By default, when you schedule a program object, the job fails if credentials are not specified. To provide
default credentials, select CMC in the "Applications" management area. On the Actions menu, click
Program Object Rights. Click Schedule with the following operating system credentials and
provide a default user name and password.
Authentication for Java programs
BI platform allows you to set security for all program objects. For Java programs, BI platform forces the
use of a Java Policy File, which has a default setting that is consistent with the Java default for unsecured
code. Use the Java Policy Tool (available with the Java Development Kit) to modify the Java Policy
File, to suit your specific needs.
The Java Policy Tool has two code base entries. The first entry points to the BI platform Java SDK and
allows program objects full rights to all BI platform JAR files. The second code base entry applies to all
local files. It uses the same security settings for unsecured code as the Java default for unsecured
code.
Note:
•
•
466
The settings for the Java Policy are universal for all Program Job Servers running on the same
machine.
By default, the Java Policy File is installed to the Java SDK directory in the BI platform install root
directory. For example, a typical location on Windows is: C:\Program Files\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\conf\crystal-program.policy
2011-05-06
Managing Applications
To enable or disable a type of program object
1. In the "Applications" area, select Central Management Console.
2. Click Actions > Program Object Rights.
The "Program Object Rights" dialog box appears.
3. In the "Allow users to" area, select the types of program objects that you want users to be able to
run.
You can select Run scripts/binaries or Run java programs.
If you selected Run java programs, you can select or clear the Use impersonation check box.
This option provides the Java program a token with which to log on to BI platform.
4. Click Save & Close.
13.1.3.1.2 Registering processing extensions with the system
Note:
This feature does not apply to Web Intelligence documents.
Before you can apply your processing extensions to particular objects, you must make your library of
code available to each machine that will process the relevant schedule or view requests. The BI platform
installation creates a default directory for your processing extensions on each Job Server, Processing
Server, and Report Application Server (RAS). It is recommended that you copy your processing
extensions to the default directory on each server. On Windows, the default directory is C:\Program
Files\SAP Business Objects\SAP BusinessObjects Enterprise XI
4.0\win32_x86\ProcessExt. On UNIX, it is the sap_bobj/ProcessExt directory.
Tip:
It is possible to share a processing extension file.
Depending upon the functionality that you have written into the extension, copy the library onto the
following machines:
•
If your processing extension intercepts schedule requests only, copy your library onto each machine
that is running as an Adaptive Job Server.
•
If your processing extension intercepts view requests only, copy your library onto each machine that
is running as a Crystal Reports Processing Server or RAS.
•
If your processing extension intercepts schedule and view requests, copy your library onto each
machine that is running as an Adaptive Job Server, Crystal Reports Processing Server, or RAS.
Note:
If the processing extension is required only for schedule/view requests made to a particular server
group, you need only copy the library onto each processing server in the group.
Related Topics
• Sharing processing extensions between multiple servers
467
2011-05-06
Managing Applications
To register a processing extension with the system
1. Go to the "Applications" management area of the CMC.
2. Select Central Management Console.
3. Click Actions > Processing Extensions.
The "Processing Extensions: CMC" dialog box appears.
4. In the Name field, enter a display name for your processing extension.
5. In the Location field, type the file name of your processing extension along with any additional path
information.
• If you copied your processing extension into the default directory on each of the appropriate
machines, just type the file name (but not the file extension).
• If you copied your processing extension to a subfolder below the default directory, type the
location as: subfolder/filename
6. Use the Description field to add information about your processing extension.
7. Click Add.
Tip:
To delete a processing extension, select it from the Existing Extensions list and click Delete. (Make
sure that no recurring jobs are based on this processing extension because any future jobs based
on this processing extension will fail.)
8. Click Save & Close.
The processing extension is registered with the CMC.
You can now select this processing extension to apply its logic to particular objects.
Sharing processing extensions between multiple servers
Note:
This feature does not apply to Web Intelligence documents or reports created in BI platform.
If you want to put all processing extensions in a single location, you can override the default processing
extensions directory for each Adaptive Job Server, Crystal Reports Processing Server, and RAS. First,
copy your processing extensions to a shared directory on a network drive that is accessible to all of the
servers. Map (or mount) the network drive from each server's machine.
Note:
Mapped drives on Windows are valid only until you reboot the machine.
If you are running servers on both Windows and on UNIX, you must copy a .dll and an .so version of
every processing extension into the shared directory. In addition, the shared network drive must be
visible to Windows and to UNIX machines (through Samba or some other file-sharing system).
Finally, change each server's command line to modify the default processing extensions directory. Do
this by adding -report_ProcessExtPath absolute path to the command line. Replace absolute
path with the path to the new folder, using whichever path convention is appropriate for the operating
468
2011-05-06
Managing Applications
system that the server is running on (for example, M:\code\extensions,
/home/shared/code/extensions, and so on).
To modify the default processing extensions directory, use the CMC to stop the server. Then open the
server's Properties to modify the command line. Start the server again when you have finished.
13.1.3.2 Managing discussion settings
In the "Applications" area of the CMC in BI platform, you can specify system-level settings for discussion
threads.
For the "Discussions" application you can manage and interact with discussion threads in several ways,
including:
•
•
•
Searching for discussion threads according to specified search criteria.
Sorting discussion thread search results.
Deleting discussion threads.
Note:
User rights settings are not available for the Discussions application. However, you can set rights on
individual reports.
13.1.3.2.1 To search for a discussion thread
By default, the "Discussions" page displays the titles of all discussion threads. Only the root level threads
are displayed.
To page through the list of discussion threads, use the Previous and Next buttons. You can also search
for a specific thread or group of threads.
1. Go to the "Applications" area of the CMC and select Discussions.
2. Click Manage > Properties.
The Notes Administration dialog box opens.
3. In the Field name list, select an option.
Option
Description
Thread title
Searches by thread title.
Creation date
Searches by creation date.
Last modified date
Searches by the last date modified.
Author
Searches by author.
4. On the second list, refine your search.
469
2011-05-06
Managing Applications
Note:
Searches are not case-sensitive.
•
If you chose Thread title or Author, choose from the following options in the second field.
Option
Description
is
Searches for discussion threads where the thread title, or the author name,
exactly match the text you type into the third field.
is not
Searches for discussion threads where the thread title, or the author name,
do not exactly match the text that you type into the third field.
contains
Searches for discussion threads that contain the search text string within
any part of the thread title or the author's name.
does not contain Searches for discussion threads that do not contain the text string within any
part of the thread title.
•
If you chose Creation date or Last modified date, choose one of the following options, and
then specify a search date.
Option
Description
before
Searches for discussion threads that were created or modified before the
search date.
after
Searches for discussion threads that were created or modified after the
search date.
between
Searches for discussion threads that were created or modified between the
two search dates.
5. To further refine your search, use the third text field.
• If you selected a text-based search in the first two fields, type in the text string.
• If you chose a date-based search, enter the date or dates in the appropriate fields.
6. Click Search.
13.1.3.2.2 To sort your discussion thread search results
When you search discussion threads, you can select how you want your search results to display. For
example, you can sort them in ascending alphabetical order, and choose the number of results to display
per page.
1. Go to the "Applications" area of the CMC and select Discussions.
2. Click Manage > Properties.
The "Notes Administration" dialog box opens.
3. In the Sort by list, select a sort option.
470
2011-05-06
Managing Applications
Option
Thread title
Creation date
Last modified date
Author
Description
Sort by the title of a discussion thread.
Sort by the date the discussion thread was created.
Sort based on the date a discussion thread was last modified.
Sort by the author of a specific discussion thread.
4. In the second list, select if you want the records to be displayed in ascending or descending order.
5. In the third text field, enter how many discussion thread results you want displayed on each page.
The default is 10 results per page.
6. Click Search.
13.1.3.2.3 To delete a discussion thread
You can delete any discussion thread in the "Applications" area of the CMC in BI platform.
1. Go to the "Applications" area of the CMC and select Discussions.
2. Click Manage > Properties.
The "Notes Administration" dialog box opens.
3. In the results list, search for the discussion thread you want to delete and select it.
4. Click Delete.
13.1.3.3 Managing BI launch pad settings
In the "Applications" area of the CMC in BI platform, you can change the display options of BI launch
pad by going to Manage > Properties.
For BI launch pad, you can grant users or groups the following abilities:
•
•
•
•
•
Change preferences
Organize folders
Search
Filter object listings by object type
View the Favorites folder
For example, if you created your user folders using a standard naming convention, you may want to
deny your users the ability to organize their own folders.
471
2011-05-06
Managing Applications
Note:
By default, all users have access to these features.
13.1.3.3.1 To change display settings for BI launch pad
1. Go to the "Applications" area of the CMC and select BI launch pad.
2. Click Manage > Properties.
The "BI launch pad Properties" dialog box opens.
3. To enable Discussions for BI launch pad users, select Enable Discussions.
4. To enable the filters functionality for scheduling, select Show "Filters" tab on the Schedule page.
This setting controls whether users can enter record or group selection formulas when they schedule
a Crystal report.
5. Click Save & Close.
13.1.3.4 Managing Web Intelligence settings
You can control which features your users have access to for Web Intelligence documents by setting
properties for the Web Intelligence application.
13.1.3.4.1 To modify display settings for Web Intelligence
1. Go to the "Applications" area of the CMC and select Web Intelligence.
2. Click Manage > Properties.
The "Properties" dialog box opens with display options.
3. Define any of the following display options.
Option
Description
"Dimensions and details"
Use the options in this area to define how added data appears in
reports; change the font style, text color, and background color. A
cell preview automatically shows your changes. Click OK when you
are finished.
"Fluctuating values (numerical Use the options in this area to modify and format the page heading;
change the font style, text color, and background color. A cell preview
measures)"
automatically shows your changes. Click OK when you are finished.
"Embedded image properties" Enter the maximum embedded image size.
"Quick display mode proper- In the appropriate fields, enter the maximum vertical records, maximum horizontal records, minimum width of page, minimum height
ties"
of page, right padding value, and bottom padding value.
4. Click Save & Close.
472
2011-05-06
Managing Applications
Note:
To revert your selection to the default display variables, click Reset.
13.1.3.5 Managing Alerting settings
In the "Applications" area of the CMC in BI platform, you can specify system-level settings for alerts.
For the "Alerting" application you can control and define how system users access alerts by:
•
•
•
•
Enabling the My Alerts folder for alert subscribers
Enabling and formatting alert messages sent through email
Setting a limit for the number of alerts in the system
Setting an expiry period for alert messages
Related Topics
• Setting user rights on applications
• Managing Alerting settings
13.1.3.5.1 To modify Alerting destination properties
1. Go to the "Applications" area of the CMC and select Alerting Application.
2. Click Manage > Properties.
The "Alerting" dialog box opens displaying the default destination properties.
3. Set the appropriate options.
Option
Description
"Enable My Alerts" Select this option to allow alert subscribers to receive notifications in the "My
Alerts" section of BI launch pad.
"Enable Email"
Select this option to allow alert subscribers to receive notifications through
email. When you select this option, the global Email settings for alerts are displayed.
Note:
You must specify one or both of the above destination options.
If you have selected "Enable Email", you can modify the following global settings:
473
2011-05-06
Managing Applications
Option
Description
"From"
Specifies the email address that the alert notifications are sent from. Subscribers
will receive alert emails from the specified sender. It is recommended that you
use a valid email address recognized by your system.
"To"
Specifies the email address of the alert subscriber.
Tip:
It is recommended that you keep the %SI_EMAIL_ADDRESS% placeholder for
this setting. If you specify a specific email address or recipient, by default all
system alerts will be sent to the specified email address.
"cc"
Specifies which recipient(s) should receive carbon copies of alerts sent through
email.
"Subject"
Specifies the default subject heading used in emails containing system alerts.
"Message"
Specifies the default message to include in emails containing system alerts.
"Add Attachment" Select this option to enable attachments to be included by default in emails
containing system alerts. This option is typically used to include by default
Crystal Reports associated with triggered alerts.
"File Name"
If you have selected the Add Attachment option, specify how attachments are
named in emails by selecting either Automatically Generated or Specific
Name.
4. Click Save & Close.
Related Topics
• Setting user rights on applications
• Managing Alerting settings
13.1.3.5.2 To modify Alerting default properties
1. Go to the "Applications" area of the CMC and select Alerting Application.
2. Click Manage > Properties > Default Settings.
3. Set the appropriate values for the following properties.
Option
Description
"Expiry Period"
Specifies how long alert messages will be maintained in the system
before they are deleted.
"Maximum Number of
Alert Messages"
Specifies the maximum number of alert messages supported by the
system. When the threshold is reached, the system will remove 20%
of the alert messages, starting with the oldest messages.
4. Click Save & Close.
474
2011-05-06
Managing Applications
Related Topics
• Managing security settings for objects in the CMC
• Managing Alerting settings
13.1.3.6 Managing widgets settings
Widgets for SAP BusinessObjects is a desktop application that allows users to add mini-applications
to their desktop for easy access to business intelligence content on BI platform and Web Dynpro
applications on SAP NetWeaver Application Servers.
From the "Applications" area of the CMC, you can control user access to create and use widgets on
their desktops, as well as their ability to search the BI platform repository from within the widgets
application on their desktop.
You can grant users or groups the ability to:
• Use widgets
•
Edit objects created by widgets
•
Modify user rights to access objects
Note:
By default, all general users have access to these features.
Related Topics
• Managing security settings for objects in the CMC
13.1.3.7 Managing SAP BusinessObjects Explorer settings
You can define which features your users have access to for SAP BusinessObjects Explorer by settings
its security rights from the Applications area of the CMC.
Related Topics
• Managing security settings for objects in the CMC
13.1.3.7.1 To modify SAP BusinessObjects Explorer application properties
1. Go to the "Applications" area of the CMC.
475
2011-05-06
Managing Applications
2. Click Manage > Properties.
The "SAP BusinessObjects Explorer Properties" dialog box appears.
3. Define any of the following SAP BusinessObjects Explorer settings:
• Default index folder location
• Number of threads
• Bookmark validity
4. Click Save & Close.
13.1.3.8 Managing Platform Search settings
In the "Applications" area of the CMC in BI platform, you can specify system-level settings for the
Platform Search application.
Related Topics
• Indexing Failure Listing
• Configuring Application Properties
13.1.3.8.1 Configuring Application Properties
To configure the Platform Search application properties, complete the following steps:
1.
2.
3.
4.
Go to the "Applications" area of the CMC.
Select Platform Search Application.
Click Manage > Properties. The "Platform Search Application Properties" dialog box appears.
Configure the Platform Search settings that you want.
The configurable properties are described in the following table:
476
Option
Description
Search Statistics
Platform Search offers the following search statistics:
• Indexing Status: displays the status of the indexing process.
• Number of indexed documents: displays the number of documents
that are indexed.
• Last indexed time stamp: displays the time stamp at which the document was last indexed.
2011-05-06
Managing Applications
Option
Description
Stop / Start Indexing
Start or Stop Indexing options enable you to start or stop the indexing
process when you want to switch from continuous crawling to schedule
crawling, or for maintenance purpose.
To stop indexing, click Stop Indexing and then click OK in the confirmation dialog box.
When you change the index locale to another language, Platform Search
re-indexes the documents in the selected language.
Index Locale
Set the indexing locale in one of the following languages: Brazilian,
Chinese, Czech, Danish, Dutch, English, Finnish, French, German, Italian, Japanese, Korean, Norwegian Bokmal, Polish, Portuguese, Russian,
Spanish, Swedish, and Thai.
Note:
By default, English is selected as the Index Locale.
You can index the entire BI platform repository by using the following
options:
• Continuous crawling: With this option, indexing is continuous where
the repository is indexed whenever an object is added, modified, or
deleted. It allows you to view or work with the most up-to-date SAP
BusinessObjects Business Intelligence platform content. Set by default, the continuous crawling updates the BI platform repository
continuously with the actions that you perform. Continuous crawling
works without a user's intervention and reduces the time taken for
indexing a document.
• Scheduled crawling: With this option, indexing is based on the
schedule set by the Schedule options.
Crawling Frequency
For more information about scheduling an object, refer to Scheduling
an Object section of Platform Search in the BI platform CMC Online
Help.
Note:
•
•
•
477
If you select Schedule Crawling and set the Recurrence to an
option other than Now Platform Search displays the date and time
stamp when the document is scheduled to be indexed next.
If you select Schedule Crawling, then the Start Indexing button
is enabled and Stop Indexing button is disabled.
Once the scheduling is complete, the Stop Indexing button is
disabled.
2011-05-06
Managing Applications
Option
Description
When the documents are indexed, they are stored in shared folders in
the following locations:
• Master index location (indexes and speller): The master and speller
indexes stored in this location. During a search workflow, the initial
hits are retrieved using the Master Index and the speller indexes are
used to retrieve suggestions. In a clustered BOE deployment, this
location should be on a shared file system that is accessible from all
nodes in the cluster.
• Persistent data location (Content stores): The content store is placed
in this location. It is created from the master index location and re
mains in sync with it. The content store is used to generate facets
and process the initial hits generated from the Master Index location.
In a clustered BI platform deployment, content stores are generated
at every node.
The persistent data location is the only index location that is affected
by the clustered environment as it contains the content store folders.
If a machine has a single search service, then there will be only one
content store location. For example, {bobj.enterprise.home}\data\Plat
formSearchData\workspace\Server\ContentStores.
However, in a clustered environment, if there are multiple search
services, then each search service will have one content store loca
tion. For example, if you have two instances of a server running, then
the content store locations would be as follows:
a. {bobj.enterprise.home}\data\PlatformSearchData\workspace\Serv
er\ContentStores.
b. {bobj.enterprise.home}\data\PlatformSearchData\workspace\Serv
er1\ContentStores.
Index Location
•
Non-persistent data location (Temporary files, Delta Indexes): In this
location, the delta indexes are created and stored temporarily before
being merged with the Master index. The indexed documents from
this location are deleted once they are merged with the Master Index.
In addition, surrogate files (output of the extractors) are created in
this location and stored temporarily until they are converted into delta
indexes.
Note:
•
•
•
478
All the index locations must be shared locations.
You need to click Stop Indexing to modify the index location.
If you modify an index location, you need to copy the content to a
new location, else the existing index information will be lost.
2011-05-06
Managing Applications
Option
Level of indexing
Description
You can tune the search content by setting the level of indexing in the
following ways:
• Platform Metadata: An index is created only for the platform metadata
information such as titles, keywords, and descriptions of the documents.
• Platform and Document Metadata: This index includes the platform
metadata as well as the document metadata. The document metadata
includes the creation date, modification date, and name of the author.
• Full Content: This index includes the platform metadata, document
metadata, and other content such as:
• The actual content in the document
• The content of prompts and LOVs
• Charts, graphs, and labels
Note:
When you modify the level of indexing, the indexing is initialized for the
entire BI platform repository refresh.
Content Types
You can select the following content types for indexing:
• Microsoft Word
• Microsoft Excel
• Microsoft PowerPoint
• Text
• Adobe Acrobat
• Rich Text
• Crystal Reports
• Universe
• Web Intelligence
This option deletes all the existing indexed content and re-indexes the
entire document from the start.
You can select the Rebuild index option irrespective of the indexing
status. However, the Rebuild index option would not function if indexing
is stopped, and you select the Rebuild index, save and close the Platform Search application.
Rebuild index
When indexing is stopped, and you select the Rebuild index, save and
close the Platform Search application, then re-open the configuration
page and click Start Indexing, the stored rebuild index would re-index
the entire document automatically.
If you do not want Platform Search to re-index the documents, you need
to deselect the Rebuild index before clicking Start Indexing.
479
2011-05-06
Managing Applications
Option
Description
The Documents Excluded from Indexing option excludes documents
from indexing. For example, you may not want extremely large Crystal
reports to be made searchable to ensure the report application server
resources are not overloaded. Similarly, you may not want publications
with hundreds of personalized reports to be indexed.
Documents Excluded
from Indexing
By excluding particular documents, you can prevent them from being
accessed by Platform Search. It is important to note that if a document
is already indexed before it is put into this group, the document may still
be searchable. To ensure that documents in the Documents Excluded
from Indexing group are not searchable, you must rebuild the index.
By default only the Administrator account has full control of the Documents Excluded from Indexing. Other users with the following rights
can only add documents to the Documents Excluded from Indexing
group:
• View and edit rights on the category
• Edit the document directly
5. Click Save & Close.
Note:
If a user does not select the Rebuild Index option and changes the level of indexing or selects or
deselects extractors, then the index is incrementally updated from the start without deleting the existing
index.
13.2 Managing applications through BOE.war properties
13.2.1 The BOE war file
You can modify settings for BI platform web applications by overwriting default properties for the BOE.war
file. This file is deployed on the machine hosting the web application server. For detailed information
on how the file is deployed see the SAP BusinessObjects Business Intelligence Platform Web Application
Deployment Guide.
480
2011-05-06
Managing Applications
The properties contained in the BOE.war file control specifications for default login behavior, default
authentication methods, settings for single sign-on. There two types of properties you can specify:
•
•
Global properties - these properties affect all the web applications contained in the BOE.war file.
Application-specific properties - property settings that affect only a specific web application.
To modify any of the default properties, use the custom configuration directory to save new settings for
either global or application-specific properties. By default, the directory is located at: C:\Program
Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom.
Do not modify the properties in the config\default directory.
Note:
On some web application servers such as the Tomcat version bundled with BI platform you can access
the BOE.war directly. In this scenario, you can set custom settings directly without undeploying the
WAR file. When you cannot directly access the deployed web applications, you must undeploy, customize,
and then redeploy the file. For more information, see the SAP BusinessObjects Business Intelligence
Platform Web Application Deployment Guide.
13.2.1.1 Global BOE.war properties
The following table lists the settings included in the default global.properties file for BOE.war. To
overwrite any of the settings, create a new file in C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom.
Setting
Default values
Description
persistentcook persistentcookies.enabled=true Enables or disables persistent cookies
on the web application logon page.
ies.enabled
481
siteminder.au
thentication
siteminder.authentication=se
cLDAP
Specifies what authentication method to
use with SiteMinder. Only options are
secLDAP and secwinAD.
siteminder.en
abled
siteminder.enabled=false
Enables and disables authentication with
SiteMinder.
sso.enabled
sso.enabled=false
Enables and disables single sign-on
(SSO) to BI platform.
sso.sap.prima
ry
sso.sap.primary=false
Set to true if you want to use SAP SSO
as the application's primary single signon mechanism. Only applies to cases
where both SAP and SiteMinder SSO
are used.
2011-05-06
Managing Applications
Setting
Default values
Description
tree.pagesize
tree.pagesize=100
Specifies the maximum number of entries that can be displayed in the web
application navigation pane.
trust
None
ed.auth.shared.se
cret
Specifies the session variable name
used to retrieve the secret for Trusted
Authentication. Only applies if using the
web session to pass the shared secret.
trust
ed.auth.us
er.param
None
Specifies the variable used to retrieve
the username for Trusted Authentication.
Can be set to one of the following:
• Header
• URL Parameter
• Cookie
• Session
trust
ed.auth.us
er.retrieval
None
Specifies the method used to retrieve
the username for Trusted Authentication.
Can be set to one of the following:
• "REMOTE_USER"
• "HTTP_HEADER"
• "COOKIE"
• "QUERY_STRING"
• "WEB_SESSION"
• "USER_PRINCIPAL"
Set to empty to disable Trusted Authentication.
trust
ed.auth.us
er.names
pace.enabled
482
trusted.auth.user.namespace.en Enables and disables dynamic binding
of aliases to existing user accounts. If
abled=false
property is set to true, Trusted authentication uses alias binding to authenticate users to BI platform. With alias
binding, your application server can work
as a SAML service provider therefore
enabling Trusted Authentication to provide SAML SSO to the system. If set to
false, Trusted Authentication uses
name matching to authenticate users.
2011-05-06
Managing Applications
Setting
vintela.en
abled
Default values
vintela.enabled=false
idm.realm=YOUR_REALM
idm.princ=YOUR_PRINCIPAL
idm.allowUnsecured=true
idm.allowNTLM=false
idm.logger.name=simple
idm.logger.props=error-log.properties
Description
Used to enable or disable Vintela settings for Windows AD authentication.
pinger.showWarn pinger.showWarningDia
ingDialog.cmc log.cmc=true
Specifies whether or not to display the
warning dialog with the message indicating that the current session will expire
soon in the CMC.
pinger.showWarn pinger.showWarningDialog.bi
ingDialog.bi
launchpad=true
launchpad
Specifies whether or not to display the
warning dialog with the message indicating that the current session will expire
soon in BI launch pad.
pinger.warning pinger.warningPeriod.pingIncre Specifies how often a web server request should be sent while the session
Period.pingIn mentsInSeconds=15
expiry warning message is displayed.
crementsInSec
This is important for synchronizing the
onds
warning dialog across applications.
pinger.warning pinger.warningPeriod.lengthIn Specifies how long prior to session expiry the warning should be displayed.
Period.length Minutes=5
InMinutes
logoff.on.web logoff.on.websession.ex
session.expiry piry=true
Specifies if all application sessions log
off when the web session expires.
pinger.enabled pinger.enabled=true
Enables or disables the session expiry
warning messaging mechanism.
sys
system.com.sap.bip.jcomanag
tem.com.sap.bip.jco er.destinations.maxsize=1000
manager.desti
nations.max
size
Specifies the maximum number of
cached Java connections.
13.2.1.2 BI launch pad properties
The following table lists the settings included in the default bilaunchpad.properties file for the
BOE war file. To overwrite any of the settings, create a new file in C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom.
483
2011-05-06
Managing Applications
Setting
Description
app.name
Specifies the display name of the application. The name appears on the
web application title page and logon screen. Default: app.name=BI launch
pad
app.name.greeting
Default: app.name.greeting=BusinessObjects
app.name.short
Specifies the display name of the application. The name appears on the
web application title page and logon screen. Default: app.name.short=BI
launch pad
app.url.name
Specifies the URL name of the application, preceded by the “/”" character.
Default: app.url.name=/BI
authentication.de
fault
Specifies the default authentication method used to authenticate users into
the application. You can use any of the following for this setting:
Authentication
Setting value
Enterprise
secEnterprise
LDAP
secLDAP
Windows AD
secWinAD
SAP
secSAPR3
PeopleSoft
secpsenterprise
JD Edwards
secPSE1
Siebel
secSiebel7
Oracles EBS
secOraApps
Default: authentication.default=secEnterprise
authentication.vis Specifies if users logging into BI launch pad have the option to view and
change the authentication method. Default: authentication.visi
ible
ble=false
cms.default
Specifies the default CMS name. Default: cms.default=[name of host
machine]
cms.visible
Specifies if users logging into BI launch pad have the option to view and
change the CMS name. Default: cms.visible=true
dialogue.prompt.en Specifies if users should be prompted when navigating away from an input
page in a dialog box. Default: dialogue.prompt.enabled=false
abled
logontoken.enabled Specifies whether or not to enable token creation for the session after a
user logs into BI launch pad. Token will be stored in a cookie. Default: lo
gontoken.enabled=false
484
2011-05-06
Managing Applications
Setting
Description
SMTPFrom
Enables or disables the "From" field when scheduling an object to a destination. Default: SMTPFrom=true
url.exit
Specifies which URL to redirect users after terminating their BI launch pad
session. This setting applies only to users who have logged into the application through an external verification process.
disable.locale.pref Enables or disables the user from viewing and thus modifying the viewing
local preferences for BI launch pad. Default: disable.locale.prefer
erence
ence=false
extlogon.allow.lo
goff
Enables or disables automatically logging off user sessions once they have
closed their BI launch pad session. Set to false if you want user sessions
not to automatically terminate when users log off BI launch pad. Default:
extlogon.allow.logoff=true
13.2.1.3 OpenDocument properties
The following table lists the settings included in the default opendocument.properties file for the
BOE war file. To overwrite any of the settings, create a new file in C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom.
485
2011-05-06
Managing Applications
Setting
Description
app.name
Specifies the display name of the application. The name appears on the web
application title page and logon screen. Default: app.name=SAP Busines
sObjects OpenDocument
app.name.short
Specifies the display name of the application. The name appears on the web
application title page and logon screen. Default: app.name.short=Open
Document
authentication.de Specifies the default authentication method used to authenticate users into
the application. You can use any of the following for this setting:
fault
Authentication
Setting value
Enterprise
secEnterprise
LDAP
secLDAP
Windows AD
secWinAD
SAP
secSAPR3
PeopleSoft
secpsenterprise
JD Edwards
secPSE1
Siebel
secSiebel7
Oracles EBS
secOraApps
Default: authentication.default=secEnterprise
authentication.vis Specifies if users logging into OpenDocument have the option to view and
change the authentication method. Default: authentication.visi
ible
ble=false
cms.default
486
Specifies the default CMS name. Default: cms.default=[name of host
machine]
2011-05-06
Managing Applications
Setting
Description
cms.visible
Specifies if users logging into OpenDocument have the option to view and
change the CMS name. Default: cms.visible=true
logontoken.enabled Specifies whether or not to enable token creation for the session after a user
logs into OpenDocument. The token will be stored in a cookie. Default: lo
gontoken.enabled=false
extlogon.allow.lo Enables or disables automatically logging off user sessions once they have
closed their OpenDocument session. Set to false if you want user sessions
goff
to not automatically terminate when users log off OpenDocument. Default:
extlogon.allow.logoff=true
13.2.1.4 CMC properties
The following table lists the settings included in the default cmc.properties file for BOE.war. To
overwrite any of the settings, create a new file in C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom.
487
2011-05-06
Managing Applications
Setting
Description
app.url.name
Specifies the URL name of the application, preceded by the“/”" character.
Default: app.url.name=/CMC
authentication.de
fault
Specifies the default authentication method used to authenticate users into
the application. You can use any of the following for this setting:
Authentication
Setting value
Enterprise
secEnterprise
LDAP
secLDAP
Windows AD
secWinAD
SAP
secSAPR3
PeopleSoft
secpsenterprise
JD Edwards
secPSE1
Siebel
secSiebel7
Oracles EBS
secOraApps
Default: authentication.default=secEnterprise
authentication.visi Specifies if users logging into the CMC have the option to view and change
the authentication method. Default: authentication.visible=false
ble
cms.default
Specifies the default CMS name. Default: cms.default=[name of
host machine]
cms.visible
Specifies if users logging into CMC have the option to view and change
the CMS name. Default: cms.visible=true
dialogue.prompt.en
abled
Specifies if users should be prompted when navigating away from an input
page in a dialog box. Default: dialogue.prompt.enabled=false
logontoken.enabled
Specifies whether or not to enable token creation for the session after a
user logs into the CMC. The token will be stored in a cookie. Default: lo
gontoken.enabled=false
13.3 Customizing BI launch pad and OpenDocument logon entry points
You can customize the logon page for BI launch pad and OpenDocument web applications. For example,
you can customize the logon page to use a company logo or corporate style sheet, or you can create
a customized logon page that enables trusted authentication.
488
2011-05-06
Managing Applications
To customize the logon page, modify the custom.jsp file stored in the BI launch pad and
OpenDocument application areas of the BOE.war web application, and then redeploy the BOE.war
web application to your BI platform system. Users access the custom logon entry point by navigating
to a unique URL.
To work with these examples, you need to be familiar with deploying BI platform web applications. For
more information, see the SAP BusinessObjects Business Intelligence Platform Web Application
Deployment Guide.
13.3.1 BI launch pad and OpenDocument file locations
The BI launch pad and OpenDocument web applications are packaged within in the BOE.war web
archive file. The location of the BOE.war archive is defined in the BOE.properties file.
The BOE.properties file is found here on Windows systems:
•
<BOE_INSTALL_DIR>\SAP BusinessObjects Enterprise XI
4.0\wdeploy\conf\apps\BOE.properties
The BOE.properties file is found here on UNIX systems:
•
<BOE_INSTALL_DIR>/sap_bobj/enterprise_xi40/wdeploy/conf/apps/BOE.properties
The following tables define the location of common files within the BOE.war web archive file for both
the BI launch pad and OpenDocument applications.
Table 13-2: BI launch pad file locations
Note:
The BI launch pad web application was formerly known as InfoView.
489
File type
Location
Custom logon script
WEB-INF\eclipse\plugins\webpath.InfoView\web\custom.jsp
Directory for additional files
WEB-INF\eclipse\plugins\webpath.InfoView\web\noCacheCustom
Resources
Custom logon URL
http://<servername>:<port>/BOE/BI/custom.jsp
2011-05-06
Managing Applications
Table 13-3: OpenDocument file locations
File type
Location
Custom logon script
WEB-INF\eclipse\plugins\webpath.OpenDocument\web\open
doc\custom.jsp
Directory for additional files
WEB-INF\eclipse\plugins\webpath.OpenDocument\web\noCacheCus
tomResources
Custom logon URL
http://<servername>:<port>/BOE/OpenDocument/opendoc/cus
tom.jsp
13.3.2 To define a custom logon page
You can customize the entry point to the BI platform logon page. For example, you can create a custom
logon page that displays a company logo and uses a corporate style sheet.
Edit the custom.jsp file to customize the logon experience for your users, and place supporting files
in the noCacheCustomResources folder.
This example shows how to create a custom logon page that redirects the user to the standard logon
page.
1. Create a file that contains your custom logon code, and save it as custom.js in the noCacheCus
tomResources folder.
This example defines a function that redirects the user to the standard logon page, logon.jsp.
function load() {window.location =
"logon.jsp";}
2. Edit the custom.jsp file to customize the logon page.
This example displays a welcome message and a hyperlink that calls the load method defined in
the custom.js file.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<%@ page language= "java" contentType= "text/html;charset=utf-8"%>
<html>
<head> <title>Welcome</title>
</head>
<body>
<script type= "text/javascript" src= "noCacheCustomResources/custom.js"></script>
<p>Welcome to ABC corporation.</p>
<a href= "javascript:load()">Enter</a>
</body>
</html>
490
2011-05-06
Managing Applications
3. Redeploy the BOE.war web application, and restart the web server.
13.3.3 To add trusted authentication at logon
To enable trusted authentication, set the trusted user as a session attribute in the custom.jsp file,
and modify authentication settings in a copy of the global.properties file. The values of the custom
copy of the global.properties file override the default values.
1. Edit the custom.jsp file to set a session attribute that defines the trusted user.
request.getSession().setAttribute("TrustedUserAttribute", "TrustedUser");
2. Create a custom copy of the global.properties file by copying WEB-INF\config\de
fault\global.properties to WEB-INF\config\custom\global.properties.
3. Modify WEB-INF\config\custom\global.properties to enable Single Sign-on (SSO).
sso.enabled=true
4. Modify WEB-INF\config\custom\global.properties to set trusted authentication parameters,
including the trusted user session variable, and the shared secret.
Replace "..." with the shared secret for your system.
trusted.auth.user.param=TrustedUserAttribute
trusted.auth.user.retrieval=WEB_SESSION
trusted.auth.shared.secret="..."
5. Redeploy your web application, and restart the web server.
Related Topics
• Enabling Trusted Authentication
13.4 Configuring BEx Web Integration
BEx Web applications are Web-based applications from the Business Explorer (BEx) of SAP NetWeaver
Business Warehouse (BW) for data analysis, reporting, and analytical applications on the Web.
The Business Explorer is the SAP NetWeaver Business Intelligence suite, which provides flexible
reporting and analysis tools for strategic analyses and decision-making support. These tools include
query, reporting, and analysis functions. As an employee with access authorization, you can evaluate
historical or current data at various levels of detail and from different perspectives, both on the Web
and in Microsoft Excel.
Users access the data from the SAP NetWeaver Portal or from the BI launch pad. Authors of BEx Web
applications can execute the Web applications directly in the BI launch pad from BEx Web Application
Designer.
491
2011-05-06
Managing Applications
To integrate BEx Web applications in BI platform, perform the following configuration steps:
1. Set up a server for the BEx Web applications in the Central Management Console (CMC).
You can use either a general or standalone server for the BEx Web applications.
Tip:
We recommend setting up a standalone server for the BEx Web applications, as the general server
is normally used by many other services.
2. Configure the server settings.
3. Check the connection to the BW system.
4. To ensure that authors can run BEx Web applications directly in the BI launch pad from BEx Web
Application Designer, make the relevant settings in the Connected Portals table
(RSPOR_T_PORTAL) in the BW system.
After the configuration of the BI platform server, users can open BEx Web applications in the BI launch
pad. They can navigate in the data here and save the BEx Web applications as bookmarks in the web
browser favorites.
Restriction:
Because the SAP NetWeaver Java stack is not required for this integration, the following restrictions
apply:
• Information Broadcasting is not supported.
• Because the portal and Knowledge Management of SAP NetWeaver are not needed, document
integration and the use of portal motives are not supported in the BEx Web applications.
• The Web item Report is not supported. We recommend that you use SAP Crystal Reports for
formatted reporting.
• To create print versions of BEx Web applications, the Export Library for SAP Business Explorer is
used. Adobe Document Services (ADS) are not available.
• The BEx Web applications that are integrated in BI platform can contain only data sources that are
stored in the BW master system. In system administration, you define which system is configured
as the BW master system in BusinessObjects Business Intelligence platform.
• Single sign-on between BI platform and the SAP NetWeaver BW system is not enabled. For each
BI platform session, BEx Web applications users are requested to log on to the corresponding BW
master system.
• Report-report interface from and to BEx Web applications is not supported. Corresponding commands
won't be executed.
For more information about the features of BEx Web applications, see SAP Help Portal at
http://help.sap.com: SAP NetWeaver 7.0 (2004s) > SAP NetWeaver Library > SAP NetWeaver By
Key Capability > Information Integration by Key Capability > Business Intelligence > BI Suite:
Business Explorer > BEx Web > Analysis & Reporting: BEx Web Applications.
For more information about accessing and saving BEx Web applications in the BI launch pad, see the
BI Launch Pad User Guide at http://help.sap.com.
Related Topics
• Starting a Server for BEx Web Applications
• Starting a Standalone Server for BEx Web Applications
• Configuring Server Settings
492
2011-05-06
Managing Applications
• Checking Connection to BW System
• Configuring a connection between BEx web application designer and BI platform
13.4.1 Starting a Server for BEx Web Applications
1. Log on to the Central Management Console (CMC).
2. Choose Server.
3. Expand the Service Categories node and choose Analysis Services.
4. Select the Adaptive Processing Server and choose Select Services in the context menu.
5. Select BExWebApplicationsService in the Available Services list and move it to the
AdaptiveProcessingServerServices list.
6. Activate and start the BEx Web applications service using the context menu.
13.4.2 Starting a Standalone Server for BEx Web Applications
1. Log on to the Central Management Console (CMC).
2. Choose Server.
3. Expand the Service Categories node and choose Analysis Services.
4. Select the Adaptive Processing Server and choose Clone Server in the context menu.
5. Enter a name for the server (AdaptiveProcessingServer for example) and select the required server
in the Clone to Node box.
6. Select the cloned server and choose Select Services in the context menu.
7. Select BExWebApplicationsService in the Available Services list and move it to the
AdaptiveProcessingServerServices list.
8. Activate and start the BEx Web applications service using the context menu.
13.4.3 Configuring Server Settings
1. Log on to the Central Management Console (CMC).
2. Choose Server.
3. Expand the Service Categories node and choose Analysis Services.
4. Select the BEx Web Applications service and choose Properties in the context menu.
493
2011-05-06
Managing Applications
5. Under The BEx Web Applications service configuration in the "BEx Web Applications Service"
area, make the following settings:
a. Check (and change if necessary) the maximum number of client sessions.
b. Under SAP BW Master System, enter the name of the OLAP connection to the BW system that
you created in BI platform. The default name is SAP_BW.
c. Enter the name of the JCo Server RFC Destination that you entered in the BW system under
Configuration of RFC Connections (transaction code sm59).
d. Enter the name of the JCo Server Gateway Host that you defined in the BW system under
Configuration of RFC Connections (transaction code sm59).
e. Enter the name of the JCo Server Gateway Service that you defined in the BW system under
Configuration of RFC Connections (transaction code sm59).
f. Check (and change if necessary) the JCo Server Connection Count.
6. Choose Save & Close.
7. Select the BEx Web Applications service and choose Restart Server in the context menu.
To apply the selected settings, you have to restart the server.
Note:
Before you restart the server, the RFC destination in the ABAP system must have been created.
Related Topics
• Creating an RFC destination in the ABAP System
13.4.4 Checking Connection to BW System
1. Log on to the Central Management Console (CMC).
2. Choose OLAP Connections.
3. Check whether a connection has been established to the BW system. If not, set one up. The default
name of the connection is SAP_BW. You can also enter a different name.
4. Make sure that you have selected Pre-defined under Authentication and have made the required
entries for user and password.
Note:
This user account is required for the JCo server RFC destination, which allows the integration of
BEx Web Application Designer, BW system, and BI platform.
Tip:
To make the connection secure, make sure that only administrators have access rights to it.
a. To do this, right-click the connection to the BW system (default name SAP_BW) and choose
User Security.
b. Make the required security settings and give access rights only to administrators if possible.
494
2011-05-06
Managing Applications
13.4.5 Configuring a connection between BEx web application designer and BI
platform
To ensure that authors can run BEx Web applications directly in the BI launch pad from BEx Web
Application Designer, you need to make the relevant settings in the Connected Portals table
(RSPOR_T_PORTAL) in the BW system.
1. In the BW system, call transaction SM30 (Table View Maintenance).
2. Under Table/View, enter RSPOR_T_PORTAL.
3. Choose Maintain.
4. To create a new entry, choose New Entries.
5. Make the following settings:
a. To ensure integration between the BW system and BI platform, you have to create an RFC
destination in transaction SM59. Enter this RFC destination under Destination.
b. Select Standard Portal. This ensures that Web applications in Web Application Designer are
always called in BI platform.
c. Under URL Prefix, enter the URL to the BI platform Web Application Container Server (WACS),
including the protocol, host name and port, http://<wacs><domain>:<port> for example.
d. Under Platform, select BOE.
e. Select Use SAP Export Lib (PDF) if you want the Export Library for SAP Business Explorer to
be activated, thus allowing PDF, PostScript and PCL files to be exported from BEx Web
applications.
6. Save your entries.
Related Topics
• Creating an RFC destination in the ABAP System
13.4.5.1 Creating an RFC destination in the ABAP System
To integrate the BW system and BI platform, you need an RFC destination. This RFC destination allows
the BW system and BI platform to communicate with one another.
1. Call Configuration of RFC Connections (transaction codeSM59).
2. Choose Create.
3. Maintain the RFC destination:
a. Enter a name for the RFC destination.
b. Select T for TCP/IP connection as the connection type.
c. Enter a description.
495
2011-05-06
Managing Applications
You can maintain the description of the RFC destination language dependently.
d. Under Technical Settings, select Registered Server Program as the activation type.
e. Under Technical Settings, enter the program ID.
The program ID must be identical to the program ID (JCo Server RFC Destination) that you
specified when creating the destination for this BW system in the BI platform server.
f. Under Technical Settings under Gateway Options, enter the gateway host and the gateway
service that the BI platform uses to communicate with the BW system.
4. On the Logon & Security tab page, activate the Send SAP Logon Ticket option.
5. Save your entries.
Related Topics
• Configuring Server Settings
496
2011-05-06
Managing Connections and Universes
Managing Connections and Universes
14.1 Managing connections
A connection is a named set of parameters that defines how one or more SAP BusinessObjects
applications can access relational or OLAP databases. Connection details such as server name,
database, username, and password, can be stored securely in the BI platform repository in the
Connections folder.
Designers define universes based on connections. Users of query, analysis, and reporting applications
access the database via the universe without needing to know about the underlying data structures in
the database.
You can create connections using the following applications:
•
•
The universe design tool. Connections are stored in the repository.
The information design tool. Connections can be created locally and then published to the repository,
or created and edited directly in the repository.
Note:
For information on how to manage OLAP data source connections, see the SAP BusinessObjects
Analysis, edition for OLAP Administrator Guide.
You grant rights to allow users to create, edit, and delete connections.
You grant user access to universe connections and allow users to create and view documents that use
universes and connections.
Related Topics
• Managing security settings for objects in the CMC
• Connection rights
14.1.1 To delete a universe connection
Tip:
It is also possible to delete connections in the universe design tool and the information design tool.
1. In the "Connections" area, select a universe connection from the list.
497
2011-05-06
Managing Connections and Universes
2. Click Manage > Delete.
14.2 Managing universes
A universe is an organized collection of metadata objects that enables business users to analyze and
report on corporate data in non-technical language. These objects include dimensions, measures,
hierarchies, attributes, pre-defined calculations, functions, and queries. The metadata object layer is
built on a relational database schema or an OLAP cube, so the objects map directly to the database
structures. A universe includes connections to the data sources so that users of query and analysis
tools can connect to a universe and run queries and create reports using the objects in a universe
without needing to know about the underlying data structures in the database.
You can create universes with the following tools:
•
•
The universe design tool. Universes created with this tool can be distinguished by the .unv extension
and are therefore called .unv universes. The .unv universes are defined on a secured connection
and stored in the repository Universes folder.
The information design tool. Universes created with this tool are based on the new semantic layer.
They are distinguished by the .unx extension and are therefore called .unx universes. The .unx
universes are authored locally and published to the repository Universes folder. Designers can define
object-level security using the information design tool security editor.
You grant users application rights and universe rights to allow them to create, edit, and delete universes,
as well as design security on universes.
You grant users universe rights to allow them to create and view documents that use universes.
Related Topics
• Managing security settings for objects in the CMC
• Universe design tool rights
• Universe (.unv) rights
• Information design tool rights
• Universe (.unx) rights
14.2.1 To delete universes
Tip:
It is also possible to delete universes in the information design tool.
1. In the "Universes" area of the CMC, select a universe in the list.
2. Click Manage > Delete.
3. When prompted for confirmation, click OK.
498
2011-05-06
Monitoring
Monitoring
15.1 About Monitoring
Monitoring is a new application in SAP BusinessObjects Business Intelligence platform 4.0. This
application provides the ability to capture the runtime and historical metrics of SAP BusinessObjects
Business Intelligence platform 4.0 servers, for reporting and notification. The monitoring application
helps system administrators to identify if an application is functioning normally and if the response times
are as expected. By providing key business metrics, the monitoring application provides better insight
into SAP BusinessObjects Business Intelligence platform 4.0 .
Monitoring allows you to:
• Check the performance of each server: This is possible with the help of watches, which show the
state of each server as traffic lights. The system administrator can set thresholds for these watches
and receive alerts when these thresholds are breached. This helps in taking proactive action if there
is an impending failure or outage.
• View critical system Key Performance Indicators (KPIs): This helps in activity and resource monitoring.
These KPIs are displayed on the dashboard page of the monitoring application.
• Check system availability and response time: Using probes, you can simulate workflows to check
if the servers and services in the platform deployment are functioning as expected. By analyzing
the roundtrip time of these probes at periodic intervals, the system administrator can assess the
system usage pattern.
• Analyze peak load and peak period for the CMS: This helps the system administrator determine if
more licenses or system resources are required.
• Integrate with other enterprise applications: The SAP BusinessObjects Business Intelligence platform
4.0 monitoring application can be integrated with other enterprise applications like SAP Solution
Manager and IBM Tivoli Monitoring.
15.2 Monitoring terms
The following list provides terms that relate to the monitoring application:
499
2011-05-06
Monitoring
Dashboard
The Dashboard page provides a centralized view for the system administrator to monitor the performance
of all servers. It provides real-time information on the system KPIs, recent alerts, watches, and
corresponding graphs based on the watch state.
Watch
Watches provide real-time status and historical trends of servers and workflows within the SAP
BusinessObjects Business Intelligence platform environment. Users can associate thresholds and alerts
to a watch. You can create a watch using data from probes, servers, SAPOSCOL or Derived Metrics.
Derived Metrics
Derived metric gives you the flexibility to create metrics based on the user's requirements, and then
create a watch using this metric. You can create a derived metric by combining two or more existing
metrics in a mathematical equation.
KPI
KPIs (key performance indicators) are standard metrics in the SAP BusinessObjects Business Intelligence
platform deployment. They provide information about the schedules and log on sessions. For example,
a higher number of RunningJobs indicates good performance of the servers. Alternatively, a higher
number of PendingJobs indicates poor performance and high system load.
Probes
Probes monitor different services and simulates the different functionalities of SAP BusinessObjects
Business Intelligence platform components. By scheduling probes to run at specified intervals, the
system administrator can track the availability and performance of key services provided by SAP
BusinessObjects Business Intelligence platform 4.0. This data can also be used for capacity planning.
Traffic lights
Traffic lights represent the watch state at any given time. The colors Green, Amber, and Red are used
to indicate the state of a watch. Users can choose to set two or three states to a watch.
Trending graph
A trending graph is a graphical representation of historical metric data generated by probes and servers.
It helps the system administrator monitor the system at different time intervals, and assess the system
usage pattern.
Alert
An alert is a notification generated by the monitoring application, when a user-defined threshold value
set for different metrics applied to a watch is breached. You can choose to receive alerts either through
email or view on the "Dashboard" page.
15.2.1 Architecture
500
2011-05-06
Monitoring
This section provides a high-level overview of the monitoring architecture and briefly explains the roles
the components play. The monitoring architecture is represented graphically below:
The high-level components in the architecture are listed below:
• The Platform Java Server (PJS)
• The Java Management Extensions (JMX) agent/server
• MBeans
• JMX Clients
• The Management consoles
• Trending Database
The monitoring service is hosted on the Platform Java Server. The application is based on JMX
technology.
The Monitoring Platform Java Service provides the core services available in the monitoring application.
The Monitoring Platform Java Service provides the following services:
• Provides the JMX agent service.
• Creates MBeans dynamically for the SAP BusinessObjects servers.
• Provides lifecycle management for the MBeans.
501
2011-05-06
Monitoring
•
•
•
•
Provides a mechanism for registering new probes.
Allows users to create complex threshold conditions using the metrics of the servers.
Provides a threshold notification mechanism and sends alerts.
Provides a trending function by storing historical data.
The Probe Scheduling Service that is hosted on the Adaptive Job Server manages the running and
scheduling of probes. Hence, the Adaptive Job Server should be running for the probes to run.
The monitoring application also exposes a JMX or Remote Method Invocation (RMI) URL end point.
Other enterprise applications such as SAP Solution Manager and IBM Tivoli Monitoring can connect
to the monitoring application and access the SAP BusinessObjects metrics by using a JMX Remote
API. The monitoring application uses a dedicated Derby database for storing historical data for the
purpose of trending. For information on the trending database schema, see Trending DB schema.
15.2.1.1 Trending DB schema
The following Trending Database diagram and table explanations show you the tables where the metric,
probe, and watch data will be recorded and how these tables are related.
Table 15-1: TREND_DETAILS
This table records information about managed entities, probes, and watches. For example, CUID and
metric names.
Column name
Description
DetailsId
CUID (64)
502
Primary key
Autogenerated
CUID of the InfoObject (or) the
unique id of non-InfoObject
NOT NULL
2011-05-06
Monitoring
Column name
Description
Primary key
MetricName
Name of the Metric
NOT NULL
Type (32)
Subscription or Metric types
NOT NULL
Table 15-2: TREND_DATA
This table records the trending data from metrics, watches, and probes. For example, metric value and
time.
Column name
Description
Primary key
DataId
Auto generated
DetailsId
Foreign key
Time
Time at which data was collected
NOT NULL
Value
Value of the metric / subscription
No
Table 15-3: MANAGED_ENTITY_STATUS_DETAILS
This table records the information about subscription breaches and alert delivery information. For
example, breach time and alert delivery time.
Column name
Description
Primary key
StatusDetailsId
Auto generated
DetailsId
Foreign key
Time
Time at which data was collected
NOT NULL
AlertType
Subscription notification delivery
type (for example, email)
No
15.3 Cluster support for monitoring server
The monitoring application provides cluster support. The cluster support is easy to implement and
provides failover support.
503
2011-05-06
Monitoring
With cluster support, only one service will be active at any given time, and all other services will be
passive. Let us assume there are two monitoring services s1 and s2 in a clustered environment. Only
one of them must be available. Both s1 and s2 attempt to become active. Only one of them will be
successful and the other service becomes inactive or passive.
The passive services keep checking on a periodic basis (every one minute) on the availability of the
active service. If the active service is unavailable, the passive service immediately attempts to become
active.
Note:
It is recommended that the monitoring service is hosted on a separate Adaptive Processing Server
(APS) instance to avoid crash or restart or poor performance of the APS.
15.4 Metrics
There are many metrics that can be used for creating watches. Metrics can be:
• Probe metrics
• Server metrics
• Host metrics
• Derived metrics
When a default probe is run, the metrics execution time and passed are generated. These metrics
are called virtual metrics.
The SAP BusinessObjects Business Intelligence platform 4.0 server metrics are listed in the following
table:
504
2011-05-06
Monitoring
505
Server
Metrics
Adaptive Processing Server
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Auditing Events Received
AuditingMetrics.number of Events in the Queue
Available Processors
Busy Server Threads
CPU Usage Percentage
Cube Count
CvomServerImpl.debugClassID
DataFederatorService.activeConnectorsConnectionsCount
DataFederatorService.activeConnectorsCount
DataFederatorService.activeQueriesCount
DataFederatorService.activeThreadsCount
DataFederatorService.analyzingQueriesCount
DataFederatorService.connectionsCount
DataFederatorService.diskUsedSize
DataFederatorService.executingQueriesCount
DataFederatorService.failedQueriesCount
DataFederatorService.memoryUsedSize
DataFederatorService.metadataCacheSize
DataFederatorService.optimizingQueriesCount
DataFederatorService.outputDataTransfer
DataFederatorService.outputRowsCount
DataFederatorService.queriesConsumingMemoryCount
DataFederatorService.queries UsingDiskCount
DataFederatorService.sourceInputDataTransfer
DataFederatorService.sourceInputRowsCount
DataFederatorService.waitingQueriesCount
Failed extraction attempts since the service start
Free Memory
JVM Deadlocked Threads Counter
JVM Lock Contention Count
Maximum Memory
Number of Full GCs
Number of Page Faults during GC
Percentage of stopped system during GC
Query Count
Server Enabled State
Server Running State
Session Count
Successful extraction attempts since the service start
Threads in Transport Layer
Total Memory
Transport Layer Thread Pool Size
2011-05-06
Monitoring
Server
Metrics
Central Management Server
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Auditing Thread Utilization
Average Commit Response Time Since Startup (msec)
Average Query Response Time Since Startup (msec)
Busy Server Threads
CPUs
Completed Jobs
Currently Used System Database Connections
Disk Size (GB)
Established System Database Connections
Existing Concurrent User Accounts
Existing Named User Accounts
Failed Jobs
Longest Commit Response Time Since Startup (msec)
Longest Query Response Time Since Startup (msec)
Number of Commits Since Startup
Number of Objects in CMS System Cache
Number of Objects in CMS System DB
Number of Queries Since Startup
Number of Sessions Established by All Users
Number of Sessions Established by Concurrent Users
Number of Sessions Established by Named Users
Number of Sessions Established by Servers
Number of User Logons Since Startup
PID
Peak Number of User Sessions Since Startup
Pending Jobs
Pending System Database Request
RAM (MB)
Running Jobs
Server Enabled State
Server Pending State
Used Disk Space (GB)
Waiting Jobs
Auditing Database Last Updated On
Auditing Thread Last Polling Cycle Duration (sec)
CMS Auditor
Concurrent User Licenses
Connection to Auditing Database is Established
Current Number of Auditing Events in Queue
Named User Licenses
Connection Server
506
2011-05-06
Monitoring
Server
Metrics
•
•
•
•
•
•
•
•
Busy Server Threads
CPUs
Disk Size
PID
RAM
Server Enabled State
Server Running State
Used Disk Space
Connection Server 32
•
•
•
•
•
•
•
•
Busy Server Threads
CPUs
Disk Size
PID
RAM
Server Enabled State
Server Running State
Used Disk Space
Crystal Reports 2010 Processing
Server
•
•
•
•
•
•
•
•
•
Busy Server Threads
CPUs
CrystalReports service through Page and Cache Servers
Disk Size (GB)
PID
RAM (MB)
Server Enabled State
Server Running State
Used Disk Space
Crystal Reports 2010 Report Appli- •
cation Server
•
•
•
•
•
•
•
•
•
•
•
•
•
507
Busy Server Threads
CPUs
CrystalReports service through Report Application Servers
Disk Size (GB)
PID
RAM (MB)
Server Enabled State
Server Running State
Used Disk Space
Current Number of Auditing Events in the Queue
Current Agent Thread Count
Current Doc Count
Total Agent Thread Count
Total Doc Count
2011-05-06
Monitoring
Server
Metrics
Crystal Reports Cache Server
•
•
•
•
•
•
•
•
Crystal Reports Processing Server •
•
•
508
Busy Server Threads
CPUs
Disk Size (GB)
PID
RAM (MB)
Server Enabled State
Server Running State
Used Disk Space
•
•
•
•
•
•
Busy Server Threads
CPUs
CrystalReportsservicethroughPageandCacheServer executiontime
Disk Size (GB)
PID
RAM (MB)
Server Enabled State
Server Running State
Used Disk Space (GB)
Dashboard Analytics Server
•
•
•
•
•
•
•
•
Busy Server Threads
CPUs
Disk Size
PID
RAM
Server Enabled State
Server Running State
Used Disk Space
Dashboard Server
•
•
•
•
•
•
•
•
•
Busy Server Threads
CPUs
Disk Size
PID
RAM
Server Enabled State
Server Running State
Used Disk Space
Current Number of Auditing Events in the Queue N Pseudoloc
2011-05-06
Monitoring
509
Server
Metrics
Event Server
•
•
•
•
•
•
•
•
•
•
Busy Server Threads
CPUs
Disk Size (GB)
Monitored Files
PID
RAM (MB)
Server Enabled State
Server Running State
Used Disk Space (GB)
Current Number of Auditing Events in the Queue N Pseudoloc
Input File Repository
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Active Connections
Active Files
Available Disk Space in Root Directory (%)
Available Disk Space in Root Directory (GB)
Busy Server Threads
CPUs
Data Sent (MB)
Data Written (MB)
Disk Size (GB)
Free Disk Space in Root Directory (GB)
PID
RAM (MB)
Server Enabled State
Server Running State
Total Disk Space in Root Directory (GB)
Used Disk Space (GB)
2011-05-06
Monitoring
510
Server
Metrics
Output File Repository
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Active Connections
Active Files
Available Disk Space in Root Directory (%)
Available Disk Space in Root Directory (GB)
Busy Server Threads
CPUs
Data Sent (MB)
Data Written (MB)
Disk Size (GB)
Free Disk Space in Root Directory (GB)
PID
RAM (MB)
Server Enabled State
Server Running State
Total Disk Space in Root Directory (GB)
Used Disk Space (GB)
PM Repository Server
•
•
•
•
•
•
•
•
Busy Server Threads
CPUs
Disk Size
PID
RAM
Server Enabled State
Server Running State
Used Disk Space
Web Application Container Server
•
•
Server Enabled State
Server Running State
2011-05-06
Monitoring
Server
Metrics
Web Intelligence Processing Server •
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Busy Server Threads
CPU Usage (%)
CPUs
Cache high mark count
Cache Size (KB)
Current number of active sessions
Current number of client calls
Current number of sessions
Current number of tasks
Disk Size (GB)
Memory high threshold count
Memory level
Memory max threshold count
Number of document swap
Number of document timeout
Number of documents
Number of swapped documents
Number of users
PID
RAM (MB)
Server Enabled State
Server Running State
Total CPU time (seconds)
Total number of client calls
Total number of sessions
Total number of tasks
Used Disk Space (GB)
Virtual memory size (MB)
WebI memory (MB)
WebI server (Timeout)
Current Number of Auditing Events in the Queue N Pseudoloc
Xcelsius Data Cache Server
Busy Server Threads
CPUs
Disk Size
PID
RAM
Server Enabled State
Server Running State
Used Disk Space
•
•
•
•
•
•
•
•
Xcelsius Data Processing Server
511
2011-05-06
Monitoring
Server
Metrics
•
•
•
•
•
•
•
•
Busy Server Threads
CPUs
Disk Size
PID
RAM
Server Enabled State
Server Running State
Used Disk Space
Note:
When you add a new server or start an existing server whose metrics are not displayed in the Metric
page, wait for 10 minutes approximately for the metrics to be displayed on the Metrics page.
15.5 Configuration properties
This section describes the monitoring application properties and how you can edit them.
To see the configuration properties of the monitoring application:
1. Go to the Applications area of the CMC.
2. Right-click Monitoring and select Properties. The "Monitoring Application Properties" window
appears. The configurable properties are described in the following table:
Section
512
Field
Description
Enable Monitoring Application
Select this option to enable monitoring functionalities. If you deselect this option, all monitoring
functions except probes will be disabled. Probe
trending will also be disabled.
Default JMX agent end point
URL (IIOP)
This contains the default JMX agent end point
URL that uses IIOP protocol. This URL is generated automatically if you enable monitoring and
then restart the server. This is the default protocol
for monitoring service. This is a read-only field.
2011-05-06
Monitoring
Section
Field
Description
RMI
Enable RMI protocol for
JMX
By default, this option is disabled. If you enable
this option, you must provide the RMI port number.
This port will be used for both RMI registry entry
and RMI connector port. This port should be
available for the service; otherwise the service will
fail to start. After you provide the RMI port number,
restart the server. Once the server is restarted,
the RMI JMX agent end point URL is generated.
This is a read-only property containing the JMX
agent's end point URL using RMI protocol. Use
this URL to connect to monitoring from other
clients.
Host Metrics
Enable host metrics
By default, this option is disabled. If you enable
this option, you must provide the path to your installation of SAPOSCOL binary
To enable host metrics, you need to install
SAPOSCOL. For more information on how to install SAPOSCOL , see Installing SAPOSCOL
513
2011-05-06
Monitoring
Section
Field
Description
Other settings
Metric Refresh Interval
(seconds)
The minimum interval that you can specify is 15
seconds. This interval governs the following:
• Subscription computation of the watches: The
caution and danger rules are computed continuously with an interval of time mentioned here.
• Calculating the watch state: Watch state is
computed continuously with an interval of time
mentioned in the metric refresh period if the
Event setting of the watch is selected with the
following option: Change the watch state every time caution or danger evaluates to
true.
• Trending period: History mode for the graphs
is always trended continuously with an interval
of time mentioned here.
Delete older data when the
database size grows more
than ( MB)
Data from trending database will be cleaned up
when the database size exceeds the amount
specified. A 30% buffer is created for the
database. For example, if you have set this as
100 MB, and if the database has grown more than
100 MB when the system checks, the database
will be cleared till 70 MB.
Monitoring UI auto refresh
interval (seconds)
This interval will be used in the monitoring user
interface (including the dashboard, watch list, and
probes) for auto refresh. Minimum interval is 15
seconds. Auto-refresh does not affect the time
duration in Live mode in graphs, which is set to
15 seconds by default.
Run database cleanup task
everyday at
The database cleanup task starts at the time
specified. The database will be cleaned when the
database size exceeds the specified maximum
amount.
Backup trending database
By default, this option is disabled. If you enable
this option, the trending database backup task
starts at the time specified.
Trending database backup
directory
By default, the location is not specified. You can
specify a location; however, provide an absolute
path and not a relative path. In case of a shared
location, permission should be given to access
the shared location.
Run database backup tasks
514
2011-05-06
Monitoring
Section
Field
Description
The database backup task starts when you click
this option. Specify the database backup directory
location before choosing this option.
Trending database location
By default, the trending database location is
BOE_Install_Dir\SAP Business
Objects\SAP BusinessObjects
Enterprise XI 4.0/Data/TrendingDB. You
can also specify a different location; however,
provide an absolute path and not a relative path.
For a clustered environment, the location can be
shared and permission should be given to access
the shared location.
3. Click Save.
Note:
When you change any of these properties except enabling and disabling the monitoring application,
you must restart the monitoring service that is hosted on the Adaptive Processing Server.
Installing SAPOSCOL
Perform the following steps to install SAPOSCOL:
1. Download SAPHOSTAGENT710_XX.SAR from SAP Marketplace (http://service.sap.com).
2. Extract SAPHOSTAGENT710_XX.SAR by executing the SAPCAR.EXE -xvf
SAPHOSTAGENT710_XX.SAR command.
3. Install saphostexec by executing the saphostexec.exe -install command. Once saphostexec
is installed as a service, SAPOSCOL is started.
4. Check SAPOSCOL status by executing the saposcol -s command.
15.5.1 JMX end point URL
The monitoring application exposes a JMX end point URL through which other clients can connect
using JMX Remote API. By default, the JMX connectivity is provided over the IIOP (Internet Inter-Orb
Protocol) or CORBA (Common Object Request Broker Architecture) transport. This connection URL is
displayed in the properties page of the monitoring application. Being able to connect over IIOP absolves
the need to worry about firewalls and having to expose ports. The CORBA ports are available by default.
The jar files listed in the following table are needed at the JMX client end to be able to connect:
515
2011-05-06
Monitoring
Jar Files
activation-1.1.jar
axiom-api-1.2.5.jar
axiom-impl-1.2.5.jar
axis2-adb-1.3.jar
axis2-kernel-1.3.jar
cecore.jar
celib.jar
cesession.jar
commons-logging-1.1.jar
corbaidl.jar
ebus405.jar
log4j.jar
logging.jar
monitoring-plugins.jar
monitoring-sdk.jar
stax-api-1.0.1.jar
wsdl4j-1.6.2.jar
wstx-asl-3.2.1.jar
XmlSchema-1.3.2.jar
TraceLog.jar
ceaspect.jar
aspectjrt.jar
Another option is to connect through the default RMI port. For more information on how to connect
through the RMI port, see Configuration properties.
15.6 Integrating with other applications
516
2011-05-06
Monitoring
Enterprise solutions, such as SAP Solution Manager and IBM Tivoli Monitoring, integrate with the
monitoring application as JMX clients connecting via the JMX end point URL. After integration, the SAP
BusinessObjects metrics can be viewed from the Client's user interface.
15.6.1 Integrating the monitoring application with IBM Tivoli
To integrate monitoring application with IBM Tivoli, you need to create, install, and configure an IBM
Tivoli Monitoring Agent. Perform the following steps to create an IBM Tivoli Monitoring Agent:
1. Install the IBM Tivoli Monitoring Agent builder version 6.2.1 software.
2. Create a new agent. For information on how to create a new agent, see the IBM Tivoli Monitoring
Agent user's guide.
3. In the Defining data monitoring types step, select Data from a server in the Monitoring Data
Categories area and select JMX in the Data Sources area.
4. Click Next.
5. In the "JMX Information" window, click Browse to see all the JMX MBeans on the MBean server.
Note:
If you are running the browser for the first time, you need to add a new connection.
6. In the "Java Management Extensions (JMX) Browser" window, click + next to the Connection Name
to add a new connection.
7. In the "MBean Server Connection Wizard" window, select Standard JMX Connections (JSR-160).
8. In the "Connection Properties" window, provide the following information:
Field
Description
Connection Name
JSR-160-Compliant Server
User ID
The username that is used to log into SAP BusinessObjects Enterprise
Password
The password that is used to log into SAP BusinessObjects Enterprise
Service URL
Provide the JMX endpoint URL
9. Click Finish.
10. In the MBean Key Properties area, select Domain and Type.
All the MBeans appear in the text field below.
11. Select all the MBeans with domain as Servers, one MBean at a time such that the attributes are
listed. Choose a key attribute if there is a possibility of having multiple MBeans of same type. For
example, if there are two instances of a server running, then the PID of each instance can be a key
attribute.
12. Select a server and select options for the JMX attribute group in the "JMX Agent-Wide Options"
window.
517
2011-05-06
Monitoring
13. In the "Data Source Definition" window, select the agent you added and click Add to Selected. This
will take you to the beginning of the agent creation cycle and you need to repeat the above steps
to add another server to be monitored.
14. After creating the agent, you need to install the agent. for more information on how to install an
agent, see the IBM Tivoli Monitoring Agent user's guide Figure no. 154 onwards. This section gives
information about installing the agent locally and also about creating an installable solution of the
agent.
Note:
If you are creating an agent for SAP BusinessObjects Business Intelligence platform using the Agent
Builder, then you need to have SAP BusinessObjects Business Intelligence platform 4.0 installed
on the same system. However, if you are installing an already created agent using its installer file,
then you do not need to have BOE monitoring installed because at configuration time you can give
the details of any system with a JMX end point.
Perform the following steps to configure an installed agent:
1. Open "Manage Tivoli Enterprise Monitoring Services" in TEMS Mode. You will see the agent installed.
2. Right-click the agent template and select Configure using defaults.
3. Select an instance name.
The agent can be configured by using two different protocols: RMI and BOEIIOP.
To use RMI protocol:
•
•
•
Click Next. Do not make any changes to the Java parameters.
Provide values for JMX credentials, such as User ID, Password, and Service URL. For more
information, see Configuration Properties in the Related Topics.
Click OK.
To use BOEIIOP protocol:
•
•
•
•
•
•
•
518
Copy bcm.jar and cryptojFIPS.jar files from %InstallDir%\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\java\lib to a folder
in your system.
Copy the jar files listed in the following table to another folder.
In the Java parameters, set JVM arguments to -Djmx.remote.protocol.provider.pkgs
= com.businessobjects.sdk.monitoring and -Djmx.boeiiop.bcm.dir=< folder
location where you have copied bcm.jar and cryptojFIPS.jar files.
Select Next.
Provide values for JMX credentials, such as User ID, Password, and Service URL. For more
information, see Configuration Properties in the Related Topics.
Set <Jar Directories> value as the location of the folder where you copied the list of jar files
provided in the table.
Click OK.
2011-05-06
Monitoring
Jar files
activation-1.1.jar
axiom-api-1.2.5.jar
axiom-impl-1.2.5.jar
axis2-adb-1.3.jar
axis2-kernel-1.3.jar
cecore.jar
celib.jar
cesession.jar
commons-logging-1.1.jar
corbaidl.jar
ebus405.jar
log4j.jar
logging.jar
monitoring-plugins.jar
monitoring-sdk.jar
stax-api-1.0.1.jar
wsdl4j-1.6.2.jar
wstx-asl-3.2.1.jar
XmlSchema-1.3.2.jar
TraceLog.jar
ceaspect.jar
aspectjrt.jar
4. Right-click the agent and select Start in the "Manage Tivoli Enterprise Monitoring Services" window.
5. Open IBM Tivoli Enterprise Portal Desktop/Browser Client. A button appears on the "Navigator"
window.
6. Click the Navigator button.
The agent gets added to the Navigator.
Related Topics
• Configuration properties
519
2011-05-06
Monitoring
15.6.2 Integrating the monitoring application with SAP Solution Manager
To integrate the monitoring application with SAP Solution Manager, you need to have Wily Introscope
installed and running in your system. The SAP Solution Manager must be configured for Introscope
workstation. Perform the following steps during SAP BusinessObjects Business Intelligence platform
4.0 installation:
1. In the Configure Connectivity to Introscope Enterprise Manager step, provide the host name and
port details. An Introscope Agent will be installed at C:\Program Files (x86)\SAP Business
Objects\SAP BusinessObjects Enterprise XI 4.0\java\Wiley when SAP
BusinessObjects Business Intelligence platform 4.0 is installed.
2. Launch Introscope workstation and click New Investigator. You can view the SAP BusinessObjects
server metrics and probe virtual metrics in the JMX section of the agent configured.
Note:
You can configure the Introscope (IS) agent by choosing CMC > Servers > Server node > Placeholders.
The IS Enterprise Manager host and port are also configured here for the IS agent to communicate
with the monitoring application. For more information, see Managing Servers in the SAP BOE CMC
Help guide.
For the JMX metrics to be available in IS, ensure that both the IS agent services and monitoring service
are available on the AdaptiveProcessingServer Instance.
If you enable IS instrumentation, the code instrumentation is enabled automatically.
15.7 Creating Universe for Derby Database
You create a universe for Derby database in order to run queries in the Derby database to create reports
and perform data analysis. For more information on creating universes, refer to the SAP BOE Universe
Designer guide.
Note:
You create a universe for Derby database only after you run backup tasks for the database. For more
information on database backup tasks, see Configuration Properties in the Related Topics.
1. Create a universe for Derby database by running the Universe Design Tool wizard.
For more information on creating universe using the wizard, see Using the Quick Design Wizard in
the SAP BOE Universe Designer guide.
You can create the universe using two database connections, Apache and Generic.
2. If you select Apache connection, proceed as follows:
a. Click JDBC Drivers.
520
2011-05-06
Monitoring
b. Select the derby.sbo file from the location INSTALL_DIR\SAP BusinessObjects
Enterprise XI 4.0\dataAccess\connectionServer\jdbc
c. Add the classpath <ClassPath> <Path>\...\...\derby.jar</Path></ClassPath>
Download the latest derby.jar file (version 10.5.x) from the Apache website before adding the
classpath.
d. To create a new Apache database connection, enter the Derby database folder location in the
Server field.
If the database is located in C:\Derby, enter C:\Derby;create=false
3. If you select Generic connection, proceed as follows:
a. Select Generic JDBC Datasource.
b. Select the jdbc.sbo file from the location INSTALL_DIR\SAP BusinessObjects
Enterprise XI 4.0\dataAccess\connectionServer\jdbc
c. Add the classpath <ClassPath> <Path>\...\...\derby.jar</Path></ClassPath>
and JDBC class details <Parameter Name="JDBC Class">org.apache.derby.jdbc.Em
beddedDriver</Parameter>
d. If you are creating a new Generic database connection, enter jdbc:derby:C:\Derby;cre
ate=false in the URL field.
Related Topics
• Configuration properties
15.8 Troubleshooting
This section provides step -by-step solutions to a wide range of problems that may occur in your work
with the monitoring application.
15.8.1 Dashboard
Monitoring link is not displayed on the CMC page
•
•
Check if the user has adequate access rights.
Ensure that the user is added to the Monitoring User or Administrator groups or any other group
which is a part of the these above mentioned groups.
Key Performance Indicators (KPIs) are not visible on the Monitoring Dashboard
•
•
521
Check if the required metrics are visible by choosing CMS Server properties > Metrics.
Ensure that the Central Management Server is responding as expected.
2011-05-06
Monitoring
Unable to launch the monitoring application
Download and install the latest Flash player (10.5.x).
15.8.2 Alerts
Unable to receive alerts on the Alerts page
•
•
•
•
•
•
•
Check if the Enable Alert Notification in the Notification settings is selected.
Ensure that you have adequate access rights to receive alerts.
Check if the recent alerts are visible on the monitoring dashboard.
Check if the SMTP server is functioning.
Check if the e-mail ID set to receive e-mail alerts is appropriate.
Ensure that AdaptiveJobServer instance is enabled.
Check the SMTP settings in the AdaptiveJobServer instance destination.
Note:
You can send a CR document to the e-mail ID you set to test if the SMTP is working as expected.
15.8.3 Watchlist
Unable to receive historical data for Watch
•
•
•
•
Check for polling interval on the monitoring application Properties page.
Check the trace file in the logging folder.
Check if the Trending database location is specified on the CMC Applications page. For a clustered
environment, ensure that the user has permissions to access the shared location. For more
information, see Configuration Properties in the Related Topics.
Check if the system time of the server and client is the same in a specific time zone.
An error occurred while retrieving synchronized live data
Check if the AdaptiveProcessingServer instance is running.
Watchlist tab is disabled
•
•
•
•
522
Check if the server, to which the metric is assigned, is running.
Check if the corresponding metric in the metric list page displays the information in live and historical
modes.
Check the monitoring service logs for error messages.
Check if the metric is visible in the jconsole.
2011-05-06
Monitoring
Related Topics
• Configuration properties
15.8.4 Probes
Unable to schedule Probes
•
•
•
•
Check if the AdaptiveJobServer instance is running.
Ensure that the report CUID, that is used for Crystal reports and Web Intelligence documents, is
appropriate.
Ensure that the user has administrative rights or is a member of the Administrator group.
Check if the user has adequate rights to open, refresh, export Crystal Reports or Web Intelligence
documents that are used in the corresponding probes.
Probe schedule status is "pending"
•
•
Check if the ProbeSchedulingService instance is installed.
Check if the AdaptiveJobServer instance is running.
An error occurred while retrieving the trend data from the database
Check if the AdaptiveProcessingServer instance is running.
probeRun.bat fails to run successfully
•
•
Check if java_home is set.
Check if the correct parameters are entered in the command prompt.
Note:
Enter probeRun.bat –help in the command prompt to check if all the parameters are appropriate.
15.8.5 Metrics
Host metrics are not listed
•
•
•
•
523
Ensure that SAPOSCOL is running.
Ensure that the Enable Host Metrics option is selected on the monitoring application Properties
page.
Restart the AdaptiveProcessingServer instance for the changes to be effective.
Ensure that Path to your installation of SAPOSCOL binary is appropriate.
2011-05-06
Monitoring
Error occurred while retrieving JMX Client
Check if the AdaptiveProcessingServer instance is running.
SAPOSCOL metric value is zero on the Metric page
•
•
Ensure that SAPOSCOL is running.
Execute the following on the host where SAPOSCOL is installed:
1. saposcol –s to check the status
2. saposcol –m to get a snapshot of the data collected by SAPOSCOL
15.8.6 Graph
Graphs show different times for the live and history modes
Ensure that the system time of the server and client is the same in a specific time zone.
Graph data is not displayed in history mode for a cluster scenario
Ensure that all the AdaptiveProcessingServer instances point to the same Derby database location.
524
2011-05-06
Auditing
Auditing
16.1 Overview
Auditing allows you to keep a record of significant events on servers and applications, which helps give
you a picture of what information is being accessed, how it's being accessed and changed, and who
is performing these operations. This information is recorded in a database called the Auditing Data
Store (ADS). Once the data is in the ADS, you can design custom reports to suit your needs. You can
look for sample universes and reports on the SAP Developer Network.
For the purposes of this chapter, an auditor is a system responsible for recording or storing information
on an event, and an auditee is any system responsible for performing an auditable event. There are
some circumstances where a single system can perform both functions.
How Auditing works
The Central Management Server (CMS) acts as the system auditor, while each server or application
that triggers an auditable event acts as an auditee. When an audited event is triggered, the auditee will
generate a record and store it in a local temporary file. At regular intervals, the CMS communicates
with the auditees to request these records and writes the data to the ADS.
The CMS also controls the synchronization of auditing events that occur on different machines. Each
auditee provides a timestamp for the auditing events that it records. To ensure that the timestamps of
events on different servers are consistent, the CMS periodically broadcasts its system time to the
auditees. The auditees then compare this time to their internal clocks. If differences exist, they correct
the time recorded for subsequent auditing events.
Depending on the type of auditee, the system uses one of the following workflows to record the events.
525
2011-05-06
Auditing
Server auditing
1.
2.
3.
4.
5.
6.
An auditable event is performed by the server.
The auditee writes events in a temporary file.
The auditor polls the auditee and requests a batch of auditing events.
The auditee retrieves the events from the temporary files.
The auditee transmits the events to the auditor.
The auditor writes events to the ADS and signals the auditee to delete the events from the temporary
files.
Client logon auditing for clients connecting through CORBA
This includes applications such as SAP BusinessObjects Web Intelligence.
1. The client connects to the CMS, which will act as the auditee. The client provides its IP address and
machine name, which the auditee then verifies.
Note:
A port should be opened in the firewall between the client and CMS. More details on firewalls can
be found in the security chapter of the SAP BusinessObjects Business Intelligence Platform
Administrator Guide.
2. The auditee writes events in a temporary file.
3. The auditor polls the auditee and requests a batch of auditing events.
4. The auditee retrieves the events from the temporary files.
526
2011-05-06
Auditing
5. The auditee transmits the events to the auditor.
6. The auditor writes events to the ADS and signals the auditee to delete the events from the temporary
files.
Client logon auditing for clients connecting through HTTP
This includes online applications such as BI launch pad, Central Management Console, SAP
BusinessObjects Web Intelligence, and so on.
1. The browser connects to the web application server, and logon data is submitted to the web
application server.
2. The BI platform SDK submits the logon request to the auditee (CMS), along with the IP address and
name of the browser machine.
3. The auditee writes events in a temporary file.
4. The auditor polls the auditee and requests a batch of auditing events.
5. The auditee retrieves the events from the temporary files.
6. The auditee sends events to the auditor.
7. The auditor writes events to the ADS and signals the auditee to delete the events from the temporary
files.
Non-Logon auditing for clients connecting through CORBA
This workflow applies to auditing SAP BusinessObjects Web Intelligence events when connecting
through CORBA.
527
2011-05-06
Auditing
1.
2.
3.
4.
The user performs an operation that may be audited.
The client contacts the CMS to check if the operation is configured to be audited.
If the action is set to be audited, the CMS communicates this information to the client.
The client sends the event information to the Client Auditing Proxy Service (CAPS), hosted in an
Adaptive Processing Server.
Note:
A port in the firewall should be opened between each client and any Adaptive Processing Servers
that hosts a CAPS, and also between each client and the CMS. More details on firewalls can be
found in the security chapter of the SAP BusinessObjects Business Intelligence Platform Administrator
Guide.
5.
6.
7.
8.
9.
The CAPS writes events in a temporary file.
The Auditor polls the CAPS and requests a batch of auditing events.
The CAPS retrieves the events from the temporary files.
The CAPS sends the event information to the auditor.
The auditor writes events to the ADS and signals the CAPS to delete the events from the temporary
files.
Non-login auditing for clients connecting through HTTP
This workflow applies to auditing SAP BusinessObjects Web Intelligence events (except for logon
events) when connecting through HTTP.
528
2011-05-06
Auditing
1. The user initiates a potentially auditable event. The client application contacts the web application
server.
2. The web application checks to see if the event is configured to be audited.
Note:
The diagram shows the Auditor CMS being contacted, but any CMS in the cluster can be contacted
for this information.
3. The CMS returns the audit configuration information to the web application server, which passes
this information back to the client application.
4. If the event is configured to be audited, the client sends the event information to the web application
server, which passes it to the Client Auditing Proxy Service (CAPS), hosted in an Adaptive Processing
Server (APS).
5. The CAPS writes events in a temporary file.
6. The auditor polls the CAPS and requests a batch of auditing events.
7. The CAPS retrieves the events from the temporary files.
8. The CAPS sends the event information to the auditor.
9. The auditor writes events to the ADS and signals the CAPS to delete the events from the temporary
files.
Clients that support auditing
The following client applications support auditing:
• Central Management Console (CMC)
• BI launch pad
• Open Document
• Analysis
• Live Office Web Services Provider
529
2011-05-06
Auditing
•
Web Intelligence desktop
Note:
At least one instance of CAPS must be running in order to collect auditing events from the clients listed
above.
Clients not listed above do not directly generate events, but some actions performed by the servers as
a result of client application operations can be audited.
Auditing consistency
In most cases, where auditing is properly installed, configured, secured, and correct versions of all
client applications are used, auditing will properly and consistently record all indicated system events.
It is important to keep in mind, however, that certain system and environment conditions can adversely
affect auditing.
There is always a delay between the time an event occurs and its final transfer to the Auditor database.
Conditions such as the unavailability of the CMS or auditing database or loss of network connectivity
can increase these delays.
As a system administrator, you should work to avoid any of the following conditions, which could result
in incomplete auditing records:
•
•
•
•
•
A drive where auditing data is stored reaches maximum capacity. You should ensure plenty of disk
space is available for your auditing database and auditee temporary files.
An auditee server is improperly removed from the network before it can transmit all audit events.
You should ensure that when removing a server from the network, sufficient time is allowed for audit
events to post to the auditing database.
The deletion or modification of auditee temporary files.
A hardware or disk failure.
Physical destruction of an auditee or auditor host machine.
There are also some conditions where audit events may be prevented from reaching the CMS-Auditor.
These can include:
•
•
Users with older client versions.
Transmission of auditing information may be blocked by improperly configured firewalls.
Note:
•
•
•
530
Events generated by client applications contain information submitted from the client side, in other
words outside the trusted area of the system. Therefore under some conditions this information may
not be as reliable as information recorded by the system servers. This also includes events generated
by the BI workspaces Cache Server, since this server sits outside the trusted area.
If you want to remove a server from your deployment, you should first disable that server but keep
it running and connected to your network until all the events in the temporary files have had a chance
to transfer to the auditing database. The server's "Current Number of Auditing Events in the Queue"
metric will show how many auditing events are waiting to be transferred, when this reaches zero
you can stop the server. The location of the Temporary files is defined in the Placeholders for that
node. See the Server Administration chapter for more details on placeholders.
If you are going to use Client Auditing it is recommend that you create a dedicated Adaptive
Processing Server for the Client Auditing Proxy Service. This will ensure your best system
performance. To increase your system's fault tolerance you may also want to consider running the
CAPS on more than one APS.
2011-05-06
Auditing
Related links
Server and node placeholders
16.2 CMC Auditing page
The "Auditing" page in the CMC has the following areas:
• "Auditing Status Summary"
• "Set Events"
• "Set Event Details"
• "Configuration"
16.2.1 Auditing Status
The "Auditing Status" shows a set of metrics that help you optimize your auditing configuration and
alert you to any issues that might affect the integrity of your auditing data. The status summary is at
the top of the Auditing page in the Central Management Console.
The summary will also display warnings under the following circumstances:
• The connection to the Auditing Data Store (ADS) database is unavailable.
• There is no running or enabled Client Auditing Proxy Service, which prevents client events from
being collected.
• An auditee has events that could not be retrieved (the server or servers affected will be identified).
This usually indicates a server was not properly stopped or shut down and still has events in the
temporary files.
531
2011-05-06
Auditing
Auditing Status metrics
Metric
Details
ADS Last Updated on
The date and time the auditor CMS last started polling the auditees for their
auditing events.
Auditing Thread Utilization The percentage of the polling cycle the auditor CMS spends collecting
data from auditees, the remainder is time spent resting between polls.
If this reaches 100% the figure will be displayed in yellow, and means the
auditor is still collecting data from the auditees when the next poll is due
to begin. This may cause delays in the events reaching the ADS.
If this is happening frequently or persistently, it is recommend you either
update your deployment to allow the ADS database to receive data at a
higher rate (faster network connections or more powerful database hardware
for example), or decrease the number of auditing events your system tracks.
Last Polling Cycle Duration
Duration of the last polling cycle in seconds. This indicates the maximum
delay for event data to reach the ADS during the previous polling cycle.
•
•
•
If under 20 minutes (1200 seconds), the figure will appear on a green
background.
If between 20 minutes and 2 hours (7200 seconds), it will appear on a
yellow background.
If over 2 hours, it will appear on a red background.
If this state persists and you consider the delay too long, it is recommend
you either update your deployment to allow the ADS database to receive
data at a higher rate (faster network connections or more powerful database
hardware for example), or decrease the number of auditing events your
system tracks.
532
CMS Auditor
The name of the CMS currently acting as auditor.
ADS Database Connection Name
The name of the database connection currently used by the auditor CMS
to connect to the Auditing Data Store (ADS). For SQL servers this will be
the name of the ODBC connection. For other database types it will be the
database name, followed by the server name and connection port.
ADS Database User
Name
The user name the auditor CMS is using to log in to the ADS database.
2011-05-06
Auditing
16.2.2 Configuring Auditing events
The CMC Auditing page can be used to activate auditing and select which events will be audited across
your entire system.
If you are not interested in certain events or event details, you can leave them unselected to gain
additional system performance.
Note:
If you chose not to configure your ADS connection when you installed the BI platform, you will need to
set up a connection to the database before you configure your auditing events. See Auditing Data Store
configuration settings.
16.2.2.1 To configure auditing events
1. In the Central Management Console, select the Auditing tab.
The Auditing page appears.
2. Set the Set Events slider to the desired level.
The following table shows the four different settings for the slider and the events captured at each
level.
533
2011-05-06
Auditing
Auditing Level
Events captured
Off
None
Minimal
•
•
•
•
•
Default
Minimal events, plus:
•
•
•
•
•
•
•
•
•
•
•
Complete
View
Refresh
Prompt
Create
Delete
Modify
Save
Search
Edit
Run
Deliver
Minimal and Default events plus:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Custom
Logon
Logout
Rights Modification
Custom Access Level Modified
Auditing Modification
Retrieve
Trigger
Drill Out of Scope
Page Retrieved
LCM Configuration
Rollback
VMS Add
VMS Retrieve
VMS Check-in
VMS Check-out
VMS Export
VMS Lock
VMS Unlock
Cube Connection
MDAS Session
You select a custom set of events.
3. If you selected Custom, click the events you want to capture on the list below the Set Events slider.
4. Under "Set Event Details," click the optional details you want to record with the events. Recording
fewer details will increase system performance.
534
2011-05-06
Auditing
Detail
Description
Query
If set, "Query" event detail (Detail ID 25) will be recorded for any event
that queries a database.
Folder Path Details
If set, the following details will be captured:
• "Object Folder Path (Detail ID 71)"
• "Top Folder Name (Detail ID 72 "
• " Container folder path (Detail ID 64)"
Rights Details
If set, the following details will be captured:
• "Right Added (Detail ID 55)"
• "Right Removed (Detail ID 56)"
• "Right Modified (Detail ID 57)"
User Group Details
If set, the following details will be captured:
• " User Group Name (Detail ID 16)"
• "User Group ID (Detail ID 15)"
Property Value Details If set, the "Property Value" event detail (Detail ID 29) will be captured when
the properties of an object are updated. This is generated only for CMC,
BI launch pad or SharePoint events.
5. Click Save.
Note:
For client auditing, it may take up to two minutes after the changes have been made before the
system will start recording data for any new events. Make sure you allow for this delay when
implementing changes to the system.
16.2.3 Auditing Data Store configuration settings
If you chose not to set up an auditing database when you installed the BI platform, or you want to change
the database location or settings, you can use the following steps to configure the connection to the
ADS.
This is also where you can configure how long auditing events will be retained in the database.
If you have performed an upgrade from a previous version of the BI platform and have installed version
3.x of Business Objects Metadata Manager (BOMM), it is recommended to configure the ADS to use
the same database or tablespace as BOMM.
Note:
If you are using an existing DB2 9.7 Workgroup as the auditing database then ensure that the database
account is configured to have a page size over 8 kB.
535
2011-05-06
Auditing
16.2.3.1 To configure your Auditing Data Store database settings
1. On the Central Management Console, select the Auditing tab.
The Auditing page appears.
2. Under the "Configuration" heading, click ADS Database Type.
A list of supported database types appears.
3. Select the database type you have set up for your auditing data.
4. Under Connection Name, enter the name of the connection you have configured for the auditing
database. For SQL databases this will be the ODBC name; all other databases will take the form
<serverhostname>,<port>,<databasename>.
a. If you are using an Microsoft SQL database with Windows authentication, enable the Windows
Authentication option.
5. In the User Name and Password fields, enter the user name and password you want the auditor
CMS to use when logging onto the database.
6. In the Delete events older than (days) field, enter the number of days you want information to
remain in the database. (Minimum value 1, maximum value 109,500.)
Caution:
Data older than the number of days set here will be permanently deleted from the ADS; it cannot
be recovered. You may want to consider periodically moving records to an archive database if you
want to maintain long-term records.
7. In the event the database connection is lost, if you want to manually reconnect the auditor-CMS to
the database, de-select the ADS Auto Reconnect option.
Note:
If this is unchecked, you will need to manually re-establish a connection to the ADS if the connection
is lost. This can be done by restarting the CMS, or enabling ADS Auto Reconnect. Events will be
recorded and remain stored in the temporary files until the ADS is reconnected.
8. Click Save.
9. Restart the CMS.
16.3 Audit events
The following table shows all the auditing events in the system, and gives a brief description for each.
A list of the service types that create the events follows.
536
2011-05-06
Auditing
537
Event
Description, and servers and clients that generate the event type
Auditing Modification
The system's auditing settings are modified.
• Central Management service
Create
A new object is added to the system.
• Web Intelligence processing service
• Crystal Reports viewing and modification service
• Central Management service
• Web Intelligence
• Lifecycle Management
Cube Connection
An OLAP Cube Connection operation is performed.
• Multi-Dimensional analysis service
Custom Access Level
Modified
Information for privileges are modified.
• Central Management service
Delete
An object is removed from the system.
• Central Management service
• Lifecycle Management service
Deliver
An object is sent/delivered to a destination.
• Destination Delivery Scheduling service
• Crystal Reports Scheduling service
• Crystal Reports for Enterprise scheduling service
• Web Intelligence publishing and scheduling service
• Central Management service
• Program scheduling service
Drill out of scope
A user of a Web Intelligence document has drilled down to a detail level
outside the report's pre-loaded data.
• Web Intelligence
• Web Intelligence processing service
Edit
The content of an object is changed.
• Web Intelligence processing service
• Dashboard service
• Web Intelligence
LCM Configuration
The configuration details of Lifecycle Management Console (LCM) are
changed.
• Lifecycle Management
Logon
A user logs onto the system.
• Central Management service
2011-05-06
Auditing
538
Event
Description, and servers and clients that generate the event type
Logout
A user logs out of the system.
• Central Management service
Modify
The file properties of an object are changed.
• Web Intelligence
• Lifecycle Management
• Central Management service
MDAS Session
A multi dimensional analysis services operation is performed
• Multi-Dimensional analysis service
Page Retrieved
An SAP BusinessObjects Web Intelligence client retrieves additional information from the repository.
• Web Intelligence processing service
Prompt
Information is entered for a object prompt.
• Dashboard Design cache service
• Live Office
• Crystal Reports scheduling service
• Crystal Reports for Enterprise
• Crystal Reports cache service
• Web Intelligence processing service
• Web Intelligence
Refresh
The data in an object is updated from the database at a user's request.
• Dashboard Design cache service
• Live Office
• Crystal Reports for Enterprise scheduling service
• Crystal Reports cache service
• Crystal Reports scheduling service
• Web Intelligence processing service
• Web Intelligence
Retrieve
An object is retrieved from the repository.
• Central Management service
Rights Modification
The security information is changed for a user, group, or object.
• Central Management service
Rollback
LifeCycle Manager is used to revert an object to a previous version.
• Lifecycle Management
2011-05-06
Auditing
539
Event
Description, and servers and clients that generate the event type
Run
A job is run.
• Lifecycle Management scheduling service
• Destination Delivery scheduling service
• Replication service
• Crystal Reports scheduling service
• Crystal Reports for Enterprise scheduling service
• Web Intelligence scheduling and publishing service
• Publication scheduling service
• Program scheduling service
• Lifecycle management
Save
An object is saved after being updated or changed.
• Crystal Reports Enterprise scheduling service
• Crystal Reports cache service
• Multi-Dimensional analysis service
• Lifecycle Management service
• Web Intelligence processing service
• Crystal Reports viewing and modification service
• Crystal Reports scheduling service
Search
A search is performed.
• Search service
Trigger
A file event is triggered.
• Event service
• Central Management service
View
An object is Viewed.
• Web Intelligence
• Web Intelligence processing service
• Central Management Console
• BI launch pad
• Dashboard Design cache service
• Crystal Reports cache service
• Crystal Reports viewing and modification service
• Dashboard service
• Open document
VMS Add
An object is added to the LCM Version Management System.
• Lifecycle Management
VMS Check in
An object is checked into the LCM Version Management System.
• Lifecycle Management
2011-05-06
Auditing
Event
Description, and servers and clients that generate the event type
VMS Check out
An object is checked out of the LCM Version Management System.
• Lifecycle Management
VMS Export
A resource is exported from the VMS.
• Lifecycle Management
VMS Lock
A resource in the VMS is locked.
• Lifecycle Management
VMS Unlock
A resource in the VMS is unlocked.
• Lifecycle Management
VMS Retrieve
An object is retrieved from the LCM Version Management System.
• Lifecycle Management
Events by Service-type
540
Service type
Event types generated
BI launch pad
View
Central Management Service
•
•
•
•
•
•
•
•
•
•
•
Central Management Console
View
Crystal Reports Cache Service
•
•
•
•
Auditing Modification
Create
Custom Access Level Modified
Delete
Deliver
Logon
Logout
Modify
Retrieve
Rights Modification
Trigger
Prompt
Refresh
Save
View
2011-05-06
Auditing
541
Service type
Event types generated
Crystal Reports for Enterprise
Scheduling Service
•
•
•
•
•
Deliver
Prompt
Refresh
Run
Save
Crystal Reports Scheduling Service •
•
•
•
•
Deliver
Prompt
Refresh
Run
Save
Crystal Reports Viewing and Modifi- •
cation Service
•
•
Create
Save
View
Dashboard Design Cache Service
•
•
•
Prompt
Refresh
View
Dashboard Service
•
•
Edit
View
Destination Delivery Scheduling
Service
•
•
Deliver
Run
Event Service
Trigger
LCM Scheduling Service
Run
LCM service
•
•
•
•
•
•
•
•
•
•
•
•
•
Create
Delete
LCM console configuration
Modify
Rollback
Run
Save
Version
VMS Add
VMS Checkin
VMS Checkout
VMS Lock
VMS Unlock
2011-05-06
Auditing
Service type
Event types generated
Live Office
•
•
Multi-Dimensional Analysis Service •
•
•
Prompt
Refresh
MDAS Cube Connection
MDAS Session
Save
Open Document
View
Program Scheduling Service
•
•
Publication Scheduling Service
Run
Replication Service
Run
Search Service
Search
Web Intelligence
•
•
•
•
•
•
•
•
Create
Drill out of scope
Edit
Modify
Prompt
Refresh
Save
View
Web Intelligence Processing Service
•
•
•
•
•
•
•
•
Create
Drill out of Scope
Edit
Page Retrieved
Prompt
Refresh
Save
View
Web Intelligence Scheduling and
Publishing Service
•
•
Deliver
Run
Deliver
Run
Event properties and details
Each event that is recorded by the BI Platform includes a set of event properties and details.
Event properties will always be generated with an event, although some may not have values if the
information is not applicable to a specific event. In the ADS, event properties are included in the table
that stores the event, so they can be used to sort or group events when you create reports.
542
2011-05-06
Auditing
Event details record additional information about the event that is not included in the event's properties.
If an event detail is not relevant to a specific event, that event detail will not be generated. There is a
set of common event details that can be generated for all event types when they are relevant. There
are also sets of additional event details which are generated for specific event types. For example,
Prompt events record the values entered for the prompt in an event detail, but no other event type
generates a prompt value event detail. In the ADS, details are stored on a separate table which is linked
to the parent event.
Any multilingual data (such as object or folder names) will be recorded in the default language for the
locale of the auditor CMS.
16.3.1 Audit events and details
The following sections list all of the event types, followed by a description of any properties and event
details that are unique to those events. At the beginning of the section is a list of the properties and
details that are common to all event types.
Note:
Some client programs do not have their own unique events, and rely on the common and platform
events to capture relevant information about their operations.
16.3.1.1 Universal event Properties and Details
The following tables show what properties and event details are recorded for all events.
543
Event Property
Description
Event_ID
A unique identifier for the event.
Client_Type_ID
Identifier for the type of application that performed the event
Service_Type_ID
Shows the ID of the type of service or application that triggered the event.
Start_Time
The start date and time when the event started (in GMT).
Duration
Duration of the event in milliseconds.
Session_ID
ID of the session during which the event was triggered.
Event_Type_ID
Type of event (for example, 1002 for view).
Status_ID
Records if the action succeeds or fails ("0" = succeeded, "1" = failed). Some
events will have additional status types, these are detailed with the descriptions
of those events.
2011-05-06
Auditing
Event Property
Description
Object_ID
CUID of the object affected (if applicable). CUID of the alerting event for Trigger
events.
Note:
All objects not saved in the CMS repository will have an ID of 0. These objects
could be documents that have not yet been saved to the CMS database, or are
stored locally on a client machine for example. You will need to use the Object_Name property to differentiate these objects.
User_ID
CUID of the User that performed the event.
User_Name
The user-name of the user the performed the event.
Object_Name
Name of the affected object (if applicable). Name of the alerting event for Trigger
events.
Object_Type_ID
CUID of object type (for example document, folder, and so on).
Object_Folder_Path
Full folder path to where the affected object is located in the CMS repository. For
example, Sales/North America/East Coast
Folder_ID
The CUID of the folder where the object is stored.
Top_Folder_Name Name of the top level folder the affected object is stored in. For example, if object
is located in Sales/North America/East Coast then the value would be
Sales.
544
Top_Folder_ID
The CUID of the top level folder where the affected object is located. For example,
if object is located in Sales/North America/East Coast then the value
would be the CUID of the folder Sales.
Cluster ID
The CUID of the CMS cluster that recorded the event.
Action_ID
A unique identifier that can be used to tie together a sequence of events initiated
by a single user action.
Event Detail
ID
Description
Error
1
Only recorded if the action fails; the text of any error messages that
result from the attempt.
Element ID
2
Name of an object that resides in a container object (Live Office
document or Dashboard for example).
Element Name 3
ID generated for an object that resides in a container object (Live
Office document or Dashboard for example).
Element Type
ID
5
The type of object in a container object that is being viewed or
modified. Only generated if applicable.
Parent Document ID
12
•
•
For a document instance: the CUID of the parent document.
For parent documents: its own CUID.
2011-05-06
Auditing
Event Detail
ID
Description
Universe ID
13
CUID of the Universe used by the document or object. An event
detail will be generated for each Universe if more than one is used.
Universe Name 14
The name of the Universe used by the document/object. An event
detail will be generated for each Universe if more than one is used.
User Group
Name
15
The user group name that the user performing the action belongs
to. If the user belongs to multiple groups. An event detail will be
generated for each group.
User Group ID
16
The user group ID that the user performing the action belongs to.
If the user belongs to multiple groups. An event detail will be generated for each group.
16.3.1.2 Common Events
The following event types are common to all SAP BusinessObjects XI components.
View
User viewed a document / object.
• Event Type ID: 1002
Event Detail
ID
Description
Size
17
Size of the object (in bytes) that is the subject of the event.
Container ID
32
The CUID of the container object (a dashboard, for example) that
the object resides in (if applicable).
Container Type 33
The application type of the container for the object (if applicable).
Refresh
An object was refreshed from the database.
• Event Type ID: 1003
545
2011-05-06
Auditing
Event Detail
ID
Description
Size
17
Size of the object (in bytes) that is the subject of the event.
Note:
For View on Demand Crystal Reports this will be set to 0.
Number of Rows 63
The number of records the database server returned.
Note:
For View on Demand Crystal Reports this will be set to 0.
Query
25
Records the SQL query used to refresh the data (optional, set in
CMC).
Universe Object
Name
31
The name of the universe the document or object uses. An event
detail will be generated for each universe accessed by the document or object.
Document Scope 36
Records information on the intended scope of the document from
its publishing settings (for example: Country=USA, Role=Manager).
Only applicable to publishing workflows.
Publication Instance ID
ID of this instance of the publication. Only applicable to publishing
workflows.
37
Live Office Object 10701
Type
Identifies the type of object that is being refreshed in a Live Office
document (a Crystal report for example). This will only be generated for Live Office documents.
Prompt
A value was entered for a prompt.
• Event Type ID: 1004
546
2011-05-06
Auditing
Event Detail
ID
Description
Prompt name
26
The name assigned to the prompt ("Date" for example). A separate detail will be generated for each prompt in a document or
object, and they will be grouped.
Prompt value
27
The value entered for a prompt. A separate detail will be generated for each value entered. These can be grouped together
and related back to the prompt name.
Document Scope
36
Information on the intended scope of the document (for example:
Country=USA, Role=Manager).
Publication Instance 37
ID
ID of this instance of the publication. Only applies to publishing
workflows.
Name at Design
Time
90
The name of the Xcelsius document at the time it was designed.
This is only generated for Xcelsius refreshes, or an Xcelsius or
Live Office document that includes a prompt.
Live Office Object
Type
10701
Identifies the type of object that is being refreshed in a Live
Office document (a Crystal report for example). This will only
be generated for Live Office documents where the embedded
object includes a prompt.
Create
User created an object.
• Event Type ID: 1005
Event Detail
ID
Description
Size
17
Size of the object (in bytes) that is the subject of the event.
Overwrite
21
Records if the document or object is new or overwrites an existing
object (0=New document or object, 1=overwrite of existing document
or object).
Refresh on
Open
23
Records if the document or object is set to be automatically refreshed
on open (0=No refresh, 1=Refresh on open). Only generated if applicable.
Description
24
Records any information in the document or object's description
field.
Delete
User deleted an object.
• Event Type ID: 1006
547
2011-05-06
Auditing
Modify
User modified a file property or the file properties of an object.
• Event Type ID: 1007
Event Detail
ID
Description
Property Name 28
The name of the property that was modified. An event detail will be
generated for each modified property.
Property Value 29
The new value for any modified property of the document or object.
An event detail will be generated for each modified property.
Save
Saving or exporting a document or object locally, remotely, or to the CMS repository, in either its existing
format or a different format.
• Event Type ID: 1008
• Statuses:
• "0" indicates the object was successfully saved locally
• "1" indicates the attempt failed
• "2" indicates the object was successfully saved or exported to a repository
• "3" indicates the object was successfully saved or exported to a new format
Event Detail
ID
Description
Size
17
Size of the object (in bytes) that was saved or exported.
File Name
18
The full name the document or object was saved under. If the file
is saved locally by a client application, the name will also include
the file path.
Overwrite
21
Records if the document or object is new or overwrites an existing
file. "0"=New document or object, "1"=overwrite of existing document
or object.
Format
22
Specifies the format of the document saved/exported, displayed as
the common three-letter file extension ("doc" for a Microsoft Word
file, or "pdf" for an Adobe PDF file, for example).
Refresh on
Open
23
Records if the document or object is set to be automatically refreshed
on open ("0"=No refresh, "1"=Refresh on open). Only recorded if
applicable.
Search
A search was conducted.
• Event Type ID: 1009
548
2011-05-06
Auditing
Event Detail
ID
Description
Keyword
19
The keywords of the conducted search.
Category
20
Category used in the search (if applicable).
Number of Rows
63
The number of rows returned by the search.
Edit
User edited the content of an object.
• Event Type ID: 1010
Event Detail
ID
Description
Size
17
Size of the object (in bytes) that is the subject of the event.
Query
25
If the edit modifies an SQL query, records the new query. (This
setting is optional and can be selected in the CMC Auditing page.)
Universe Object 31
Name
The name of the universe the document or object uses. A separate
detail will be generated for each universe accessed by the document
or object.
Container ID
The CUID of the container (a dashboard for example) that uses the
object (if applicable).
32
Container Type 34
The application type of the container for the object (if applicable).
Container Fold- 64
er Path
Folder path for the container of the object (if applicable).
Run
A job was run.
• Event Type ID: 1011
• Statuses:
• "0" indicates the job was successful
• "1" indicates the job failed
• "2" indicates the job failed but will be reattempted
• "3" indicates the job was cancelled
549
2011-05-06
Auditing
Event Detail
ID
Description
Size
17
Size of the document (in bytes) that was run.
Document
Scope
36
Information on the intended scope of the document (for example:
Country=USA, Role=Manager).
Deliver
An object was delivered.
• Event Type ID: 1012
550
Event Detail
ID
Description
Size
17
Size of the object (in bytes) that was delivered.
Destination Type 35
The destination of the document or object instance. For example,
email, FTP, unmanaged disk, inbox, or printer.
Document Scope 36
Information on the intended scope of the document (for example:
Country=USA, Role=Manager)
Publication Instance ID
37
ID of this instance of the document or object.
Domain
38
Records the SMTP server domain name for documents/objects
distributed by email (if applicable).
Host Name
39
Records the name of the SMTP or FTP host for documents/objects
distributed by email or FTP (if applicable).
Port
40
Records the SMTP or FTP server domain port for documents/objects distributed by email or FTP (if applicable).
From address
41
Records the sender's address for documents/objects distributed
by email (if applicable).
To address
42
Records the recipient's address for documents/objects distributed
by email (if applicable). Will also specify if the address is included
in the To, CC, or BCC fields. An event detail will be generated for
each intended recipient.
File Name
18
Records the file name of documents/objects distributed by email
or FTP, or written directly to a disk that is not part of the Business
Objects deployment.
2011-05-06
Auditing
Event Detail
ID
Description
Account Name
45
This records one of the following:
• For Inbox delivered objects, a list of BusinessObjects user
account names.
• For FTP delivered objects, the FTP account name.
• For Unmanaged Disk delivered objects, the login account
used.
• For SMTP delivered objects, the login account used for the
SMTP server.
Printer Name
46
The name of the printer the document or object was delivered to
(if applicable).
Number of copies 47
The number of copies of the document or object printed (if applicable).
Recipient Name
48
User name or names of the recipient or recipients of the document
or object. An event detail will be generated for each intended recipient.
Alerting Event ID 92
The CUID of the Alerting event. This is generated only if the event
was prompted by an alert.
Alerting Event
Name
93
The name of the alerting event. This is generated only if the event
was prompted by an alert.
Delivery Type
35
Indicates how the delivery was initiated:
• "0" indicates scheduled
• "1" indicates sent to a destination
• "2" indicates published
• "3" indicates an alert was triggered
Retrieve
An object is retrieved from the CMS.
• Event Type ID: 1013
Logon
A user logs on.
• Event Type ID: 1014
• Statuses:
• "0" indicates a concurrent-user license logon was successful
• "1" indicates a failed logon attempt
• "2" indicates a named-user license logon was successful
• "3" indicates a non-user (system) login was successful
551
2011-05-06
Auditing
Event Detail
ID
Description
Concurrent User
Count
50
The number of users on the system at the time the event was
triggered.
Hostname reported
by client
51
Hostname of client as reported by client.
Hostname resolved
by server
52
Hostname of client as resolved by server. If the client hostname
cannot be resolved, no value will be recorded.
IP address reported
by client
53
IP address of client as reported by the client.
IP address resolved 54
by server
IP address of client as resolved by the server. If the client IP
cannot be resolved, no value will be recorded.
Logout
A user logs off.
• Event Type ID: 1015
Event Detail
ID
Description
Concurrent User 50
Count
The number of concurrent users on the system at the time the
event was triggered.
Trigger
A file event is triggered.
• Event Type ID: 10016
Event Detail
ID
Description
File Name
17
The name of the file that was being monitored and triggered
the event.
16.3.1.3 Platform events
The following events are specific to the BI Platform platform.
Rights Modification
Right or rights for an object were modified.
• Event Type ID: 10003
552
2011-05-06
Auditing
Event Detail
ID
Description
Rights Added
55
The type of right added, the scope of the new right (which objects)
and the object type it was applied to. The information will be structured according to the following example: added right=Export;
new value=Granted; scope=Current object; applicable
object type=all object types.
Rights Removed
56
The type of right removed, the scope of the new right (which objects)
and the object type it was applied to. The information will be structured according to the following example: removed
right=Export; previous value=Denied; scope=Current
object; applicable object type=all object types.
Rights Modified 57
The type of right modified, the scope of the new right (which objects)
and the object type it was applied to. The information will be structured according to the following example: modified
right=Export; previous value=Granted; scope=Current
object; applicable object type=all object types.
Custom Access Level Modified
A Custom Access Level was modified.
• Event Type ID: 10004
Event Detail
ID
Description
Rights Added
55
The type of right added, the scope of the new right (which objects)
and the object type it was applied to. The information will be structured according to the following example: added right=Export;
new value=Granted; scope=Current object; applicable
object type=all object types
Rights Removed
56
The type of right removed, the scope of the new right (which objects)
and the object type it was applied to. The information will be structured according to the following example: removed
right=Export; previous value=Denied; scope=Current
object; applicable object type=all object types.
Rights Modified 57
The type of right modified, the scope of the new right (which objects)
and the object type it was applied to. The information will be structured according to the following example: modified
right=Export; previous value=Granted; scope=Current
object; applicable object type=all object types.
Auditing Modification
A change was made to the system's auditing settings.
553
2011-05-06
Auditing
•
Event Type ID: 10006
Event Detail
ID
Description
Event Type ID
58
Records the ID of the auditing event type that was enabled or
disabled. If multiple event types are enabled or disabled in one
action An event detail will be generated for each event type.
Action
59
Records which auditing events were enabled or disabled.
New Auditing Lev- 60
el
If the auditing level of detail is changed, records the new level
setting (off, minimal, or default for example).
Old Auditing Level 61
If the auditing level of detail is changed, records the previous
level setting (off, minimal, or default for example).
Auditing option
62
If an optional detail is enabled or disabled, the detail modified is
recorded and whether it was enabled or disabled. If multiple details
are enabled or disabled in a single action, a detail record will be
generated for each modified detail.
ADS Connection
70
If the connection to the Auditing Data Store is changed, this
records the new connection settings using the following format:
DBType=Oracle,DBName=MyADS,Username=USR1,Pass
word="*****",SSO=off,DBReconnect=on. Only the details
changed will be recorded. For example, if the user name is the
only thing updated, then only Username="new" will be recorded.
Note:
The password information will always be obscured with * in the
database.
Auto Delete Inter- 105
val
This detail will record any changes to the Delete Events Older
Than field in the Auditing CMC page. This governs how many
days auditing information will be maintained in the ADS.
16.3.1.4 SAP BusinessObjects Web Intelligence events
The following events are specific to the SAP BusinessObjects Web Intelligence component.
Drill Out Of Scope
User drilled out of the report's scope.
• Event Type ID: 10201
554
2011-05-06
Auditing
Event Detail
ID
Description
Object Instance 11
Records if the event is the result of a scheduled update or a user
viewing the object ("0" = resulted from a user viewing the object,
"1" = resulted from a scheduled refresh of the object).
Number of
Rows
63
The number of rows the database server returned.
Query
25
Records the query used to refresh the data (optional, set in CMC).
Universe Object 31
Name
The name of the universe the document uses. An instance will be
recorded for each universe accessed by the document.
Universe Object 32
ID
The CUID of the universe the document uses. An instance will be
recorded for each universe accessed by the document.
Page Retrieved
Web Intelligence document page was retrieved.
• Event Type ID: 10202
16.3.1.5 SAP BusinessObjects Analysis, edition for OLAP events
MDAS Session
An MDAS session operation is performed
• Event Type ID: 10300
• Statuses:
• "0" = A new session opened successfully.
• "1" = A new session failed.
• "2" = An existing session is closed.
MDAS Cube Connection
A Cube Connection operation is performed.
• Event Type ID: 10301
• Statuses:
• "0" = A new connection opened successfully.
• "1" = A new connection failed.
• "2" = An existing connection is closed.
555
2011-05-06
Auditing
Event Detail
ID
Description
Connection ID
94
Unique identifier for the connection.
Connection Name
95
The name of the connection.
Provider type
96
The type of provider for the cube.
Cube Name
97
The full name of the cube used.
16.3.1.6 SAP BusinessObjects Lifecycle management console events
The following events are unique to the Lifecycle management for SAP BusinessObjects component.
SAP BusinessObjects Lifecycle management console common details
All Lifecycle management events will have the following additional event details.
Event Detail
ID
Description
Element Cluster 6
The CUID of affected clusters when Lifecycle management console
performs an operation on objects located in different clusters. An
event detail will be generated for each affected cluster.
Element Comment
7
Additional information on the object.
Primary Element
8
If the element is a primary element, this detail will be set to "1"; if it
is a dependent element, it will be set to "0".
Element Status 9
If the operation element fails this detail will be set to "1"; otherwise
it will be "0".
Operation
Describes the type of operation performed (for example Add, Delete,
or Modify).
10
SAP BusinessObjects Lifecycle management console Configuration
Configuration of Lifecycle management is changed.
• Event Type ID: 10900
556
2011-05-06
Auditing
Event Detail
ID
Description
Configuration
100
A user views the Lifecycle management console configuration. The
configuration displays as comma-separated value pairs, for example:
rollback settings=enabled, port=900.
Configuration
Before
101
If the Lifecycle management console settings for an object are
modified, records the previous configuration settings. Uses the same
format as Configuration.
Configuration
After
102
If the Lifecycle management console settings for an object are
modified, records the new configuration settings. Uses the same
format as Configuration.
VMS Type
10900
The type of version management system.
Rollback
An object was rolled back to a previous Version Management System (VMS) version.
• Event Type ID: 10901
VMS Add
A resource is added to the VMS.
• Event Type ID: 10902
Event Detail
ID
Description
Version
104
Records the version number of the document in the Version
Management System.
VMS Retrieve
A resource is retrieved from the VMS.
• Event Type ID: 10903
Event Detail
ID
Description
Restore Deleted 103
Object
Indicates if a retrieved object had been deleted from the system.
"0" indicates the object was not deleted; "1" indicates the object
was deleted.
Version
Records the version number of the document in the VMS.
104
VMS Checkin
A resource is checked into the VMS.
• Event Type ID: 10904
557
2011-05-06
Auditing
Event Detail
ID
Description
Version
104
Records the version number of the document in the VMS.
VMS Checkout
A resource is checked out from the VMS.
• Event Type ID: 10905
Event Detail
ID
Description
Version
104
Records the version number of the document in the VMS.
VMS Export
A resource is exported from the VMS.
• Event Type ID: 10906
Event Detail
ID
Description
Version
104
Records the version number of the document in the VMS.
VMS Lock
A resource in the VMS is locked, to prevent users editing it.
• Event Type ID: 10907
Event Detail
ID
Description
Version
104
Records the version number of the document in the VMS.
Locked By
10901
The user name of the user who performed the action.
VMS Unlock
A resource in the VMS is unlocked, allowing users to edit it.
• Event Type ID: 10908
558
Event Detail
ID
Description
Version
104
Records the version number of the document in the VMS.
Unlocked By
10901
The user name of the user who performed the action.
2011-05-06
Platform Search
Platform Search
17.1 Overview
Platform Search enables you to search content within the SAP BusinessObjects Business Intelligence
platform repository. It refines the search results by grouping them into categories and ranking them in
order of their relevance. It also supports a public SDK that functions as an interface between the client
application and Platform Search.
In this version of SAP BusinessObjects Business Intelligence platform, Platform Search is enhanced
with the following features to:
• Search for both SAP BusinessObjects Business Intelligence platform and Explorer content
• Suggest a query for creating a document if it cannot find an existing document
• Support both continuous and schedule-based indexing
• Support indexing in a clustered environment
• Set and modify the level of indexing
• Provide advanced search configuration options
• Support multilingual search and indexing
• Provide an advanced search syntax
• Support metadata, content, and dynamic facets
• Support self healing based on the system load
Note:
If you migrate from the previous version to a new version, the index is not migrated.
17.2 Architecture
This section provides an overview of the Platform Search architecture and briefly explains the role of
each component. Platform Search is hosted in the Adaptive Processing Server, which internally hosts
various components that are responsible for indexing and searching. Platform Search indexes on the
basis of the index type, that is, schedule-based or continuous.
Platform Search includes two main processes: indexing and searching. It also has its own self-healing
mechanism.
559
2011-05-06
Platform Search
Indexing
Indexing is a continuous process that involves the following sequential tasks:
1. Crawling: Crawling is a mechanism that polls the CMS repository and identifies objects that are
published, modified, or deleted. It can be done in two ways: continuous and scheduled crawling.
For more information on continuous and scheduled crawling, refer to the Configuring Application
Properties topic in Related Topics.
2. Extracting: Extracting is a mechanism to call the extractors based upon the document type. There
is a dedicated extractor for every document type that is available in the repository. New document
types can be made searchable by defining new extractor plug-ins. Each of these extractors is scalable
enough to extract content from large documents that contain many records.
The following extractors are supported:
• Metadata extractor
• Crystal report extractor
• Web Intelligence extractor
• Universe extractor
• Agnostic extractors (MS Office 2003 and 2007 and PDF documents)
For more information on searchable documents types, refer to the Searchable content types topic
in Related Topics.
3. Indexing: Indexing is a mechanism that indexes all the extracted content through a third-party library,
called Apache Lucene Engine. The time required for indexing varies, depending on the number of
objects in the system, and the size and type of documents.
The search index is stored in a designated location on the file and contains all searchable content
of the documents that are indexed.
For indexing to run successfully, the following servers must be running and enabled:
• InputFileRepositoryServer (IFRS)
• OutputFileRepositoryServer (OFRS)
• CentralManagementServer (CMS)
• AdaptiveProcessingServer (APS)
If the object type is selected as Web Intelligence or Crystal report, the corresponding
WebIntelligenceProcessingServer or CrystalReportApplicationServer must be running and enabled
for the respective object types selected.
4. Content Sto">