SAP BusinessObjects Business Intelligence platform Administrator Guide
Below you will find brief information for SAP BusinessObjects Business Intelligence platform 4.0. This guide helps administrators manage the BI platform, covering architecture, security, user management, server administration, and more. It provides essential knowledge for setting up and maintaining the SAP BusinessObjects environment.
Advertisement
Advertisement
Business Intelligence Platform Administrator Guide
■ SAP BusinessObjects Business Intelligence platform 4.0 Support Package 5
2012-12-12
Copyright © 2012 SAP AG. All rights reserved.SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP
BusinessObjects Explorer, StreamWork, SAP HANA and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in
Germany and other countries.Business Objects and the Business Objects logo, BusinessObjects,
Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius, and other Business Objects products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Business Objects Software Ltd. Business Objects is an SAP company.Sybase and
Adaptive Server, iAnywhere, Sybase 365, SQL Anywhere, and other Sybase products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Sybase,
Inc. Sybase is an SAP company. Crossgate, m@gic EDDY, B2B 360°, B2B 360° Services are registered trademarks of Crossgate AG in Germany and other countries. Crossgate is an SAP company. All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. National product specifications may vary.These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.
2012-12-12
Contents
3
2012-12-12
4
Contents
Installed with SAP BusinessObjects Business Intelligence Platform Client Tools....................65
2012-12-12
5
Contents
2012-12-12
Contents
6
Example - Thick client and database tier separated from BI platform servers by a firewall.....188
2012-12-12
7
Contents
2012-12-12
8
Contents
Configuring Single Sign-on (SSO) for SAP Crystal Reports and Oracle EBS........................347
2012-12-12
9
Contents
Monitoring SAP BusinessObjects Business Intelligence platform servers............................374
2012-12-12
10
Contents
2012-12-12
Contents
11
Setting the ClearCase Version Management System in Windows.......................................495
2012-12-12
12
Contents
2012-12-12
Contents
13
2012-12-12
Contents
14
Importing a User's Role in SAP BusinessObjects Business Intelligence Authentication........698
2012-12-12
15
Contents
Configuring Single Sign-on (SSO) for SAP Crystal Reports and PeopleSoft Enterprise........800
2012-12-12
16
Contents
Configuring Siebel to integrate with SAP BusinessObjects Business Intelligence platform....804
2012-12-12
17
Contents
2012-12-12
18
Contents
2012-12-12
Contents
19 2012-12-12
Contents
20 2012-12-12
Document History
Document History
The following table provides an overview of the most important document changes.
Description Version Date
SAP BusinessObjects
Business Intelligence platform 4.0
Nov. 2011
First release of this document.
SAP BusinessObjects
Business Intelligence platform 4.0 Feature
Pack 3
March 2012
Additions to this release:
• Importing users and groups in bulk using the CCM
• Extending attributes for both imported and Enterprise user accounts
• Using the LDAP plugin to configure single sign-on to a SAP HANA database through JDBC
• SQL Anywhere as an ODBC data source. For node management with SQL Anywhere on Unix machines, see “To prepare a Unix machine for SQL Anywhere”.
• Best practices designed to prevent issues that can arise as a result of changes to machine names, IP addresses, cluster names, and server names
• Selecting SAP HANA as a CMS database after the initial installation of BI platform
• Configuring the RESTful Web Service hosted on a WACS server
• Performing a "hot backup" (creating a backup copy without having to stop servers)
• Creating a copy of a BI platform deployment for testing, standby, or other purposes
• Enabling and configuring integration details for the SAP StreamWork application
• Creating and assigning tasks to delegated administrators
• Self-healing mechanism for Platform Search
In addition, all references to role-based licensing, BI Analyst and BI
Viewer user accounts were removed.
21 2012-12-12
Document History
Version Date
SAP BusinessObjects
Business Intelligence platform 4.0 Support
Package 5
November
2012
Description
Additions and changes in this release:
• Instructions that specify how to start SAP BusinessObjects applications from the Windows Start menu are updated.
• Updated section
Adding a new node to a cluster
.
Related Topics
•
To add users or user groups in bulk
•
Managing attributes for system users
•
Using the LDAP plugin to configure SSO to the SAP HANA database
•
To prepare a Unix machine for SQL Anywhere
•
To select SQL Anywhere as a CMS database
•
Configuring RESTful web services
•
•
•
Managing SAP StreamWork integration
•
Delegated administration and CMC tab access
•
22 2012-12-12
Getting Started
Getting Started
2.1 About this help
This help provides you with information and procedures for deploying and configuring your BI platform.
Procedures are provided for common tasks. Conceptual information and technical details are provided for all advanced topics.
For information about installing this product, see the SAP BusinessObjects Business Intelligence Platform
Installation Guide.
2.1.1 Who should use this help?
This help covers deployment and configuration tasks. We recommend consulting this guide if you are:
• planning your first deployment
• configuring your first deployment
• making significant changes to the architecture of an existing deployment
• improving your system's performance.
This help is intended for system administrators who are responsible for configuring, managing, and maintaining a BI platform installation. Familiarity with your operating system and your network environment is beneficial, as is a general understanding of web application server management and scripting technologies. However, to assist all levels of administrative experience, this help aims to provide sufficient background and conceptual information to clarify all administrative tasks and features.
2.1.2 About SAP BusinessObjects Business Intelligence platform
The BI platform is a flexible, scalable, and reliable solution for delivering powerful, interactive reports to end users via any web application—intranet, extranet, Internet or corporate portal. Whether it is used for distributing weekly sales reports, providing customers with personalized service offerings, or integrating critical information into corporate portals, BI platform delivers tangible benefits that extend
23 2012-12-12
Getting Started across and beyond the organization. As an integrated suite for reporting, analysis, and information delivery, the platform provides a solution for increasing end-user productivity and reducing administrative efforts.
2.1.3 Variables
The following variables are used throughout this guide:
Variable
<INSTALLDIR>
Description
The directory where BI platform is installed. On Windows, the default directory is
C:\Program Files (x86)\SAP BusinessObjects\
.
<PLAT
FORM64DIR>
The name of your Unix operating system. Acceptable values are:
• aix_rs6000_64
• linux_x64
• solaris_sparcv9
• hpux_ia64
<SCRIPTDIR>
The directory where scripts for administering BI platform are located
• On Windows: <INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\win64_x64\scripts
• On Unix: <INSTALLDIR>/sap_bobj/enterprise_xi40/<PLAT
FORM64DIR>/scripts
2.2 Before you start
2.2.1 Key concepts
24 2012-12-12
Getting Started
2.2.1.1 Services and servers
BI platform uses service and server to refer to the two types of software running on a BI platform computer.
A service is a server subsystem that performs a specific function. The service runs in the memory space of its server, under the process ID of the parent container (server). For example, the Web Intelligence
Scheduling Service is a subsystem that runs on the Adaptive Job Server.
A server is a process at the operating system level (on some systems, called a daemon) that hosts one or more services. For example, the Central Management Server (CMS) and Adaptive Processing Server are servers. A server runs on a specific operating system account and has its own PID.
A node is a collection of BI platform servers running on the same host and managed by the same Server
Intelligence Agent (SIA). One or more nodes can be on a single host.
BI platform can be installed on one computer, spread across different computers on an intranet, or separated over a wide area network (WAN).
Services, servers, nodes, and hosts
The following diagram shows a hypothetical installation of BI platform. The number of services, servers, nodes, and hosts—and the type of services and servers—varies in actual installations.
25 2012-12-12
Getting Started
26
Two hosts form the cluster named ProductionBISystem, which has two hosts:
• The host named HostAlpha has BI platform installed and is configured with two nodes:
• NodeMercury contains an Adaptive Job Server (NodeMercury.AJS) with services to schedule and publish reports, an Input File Repository Server (NodeMercury.IFRS) with a service to store input reports, and an Output File Repository Server (NodeMercury.OFRS) with a service to store report output.
• NodeVenus contains an Adaptive Processing Server (NodeVenus.APS) with services to provide publishing, monitoring, and translation features, an Adaptive Processing Server (Node
Venus.APS2
) with a service to provide client auditing, and a Central Management Server
(NodeVenus.CMS) with a service to provide the CMS services.
• The host named HostBeta has BI platform installed and is configured with three nodes:
• NodeMars contains a Central Management Server (NodeMars.CMS) with a service to provide
CMS services. Having the CMS on two computers enables load balancing and mitigation and failover capabilities.
• NodeJupiter contains an Web Intelligence Processing Server (NodeJupiter.WebIntelli
gence
) with a service to provide Web Intelligence reporting and an Event Server (Node
Jupiter.EventServer
) to provide report monitoring of files.
2012-12-12
Getting Started
• NodeSaturn contains an Adaptive Processing Server (NodeSaturn.APS) with a service to provide client auditing.
2.2.1.2 Server Intelligence
Server Intelligence is a core component of Business Intelligence platform. Changes to server processes applied in the Central Management Console (CMC) are propagated to corresponding server objects by the CMS. The Server Intelligence Agent (SIA) is used to automatically restart or shut down a server when it encounters an unexpected condition and is used by the Administrator to manage a node.
The CMS archives information about servers in the CMS system database so you can easily restore default server settings or create redundant instances of server processes with the same settings.
Because the SIA periodically queries the CMS to request information about servers it manages, the
SIA knows which state servers should be in and when to take action.
2.2.2 Key administrative tools
2.2.2.1 Central Management Console (CMC)
The Central Management Console (CMC) is a web-based tool that you use to perform administrative tasks (including user, content, and server management) and to configure security settings. Because the CMC is a web-based application, you can perform all of the administrative tasks in a web browser on any computer that can connect to the web application server.
27 2012-12-12
Getting Started
28
All users can log on to the CMC to change their own preference settings. Only members of the
Administrators group can change management settings, unless a user is explicitly granted rights to do so. Roles can be assigned in the CMC to grant user privileges to perform minor administrative tasks, such as managing users in your group and managing reports in folders that belong to your team.
2.2.2.2 Central Configuration Manager
The Central Configuration Manager (CCM) is a server troubleshooting and node management tool that is provided in two forms. On Windows, you use the CCM to manage local and remote servers, in the
CCM user interface (UI) or from a command line. On Unix, you use the CCM shell script (ccm.sh) to manage servers from a command line.
The CCM allows you to create and configure nodes and to start or stop your web application server, if it is the default bundled Tomcat web application server. On Windows, you can use the CCM to configure network parameters, such as Secure Socket Layer (SSL) encryption. The parameters apply to all servers in a node.
Note:
Most server management tasks are handled in the CMC, not the CCM. The CCM is used for troubleshooting and node configuration.
2.2.2.3 Repository Diagnostic Tool
2012-12-12
Getting Started
The Repository Diagnostic Tool (RDT) can scan, diagnose, and repair inconsistencies that may occur between the Central Management Server (CMS) system database and the File Repository Servers
(FRS) filestore. You can set a limit for the number of errors the RDT will find and repair before stopping.
RDT should be used after you restore your BI platform system.
2.2.2.4 Upgrade management tool
Upgrade management tool (formerly Import Wizard) is installed as a part of SAP BusinessObjects
Business Intelligence platform, and guides administrators through the process of importing users, groups, and folders from previous versions of SAP BusinessObjects Business Intelligence platform. It also allows you to import and upgrade objects, events, server groups, repository objects, and calendars.
For information on upgrading from a previous version of SAP BusinessObjects Business Intelligence platform, see the
SAP BusinessObjects Business Intelligence Platform Upgrade Guide.
2.2.3 Key tasks
Depending on your situation, you may want to focus on specific sections of this help, and there may be other resources available for you. For each of the following situations, there is a list of suggested tasks and reading topics.
Related Topics
•
Planning or performing your first deployment
•
•
Improving your system's performance
•
Central Management Console (CMC)
29
2.2.3.1 Planning or performing your first deployment
If you are planning or performing your first deployment of BI platform, perform the following tasks and read the recommended topics:
• “Architecture overview”
• “Understanding communication between BI platform components”
• “Security overview”
2012-12-12
Getting Started
• If you plan to use third-party authentication, “Authentication options in BI platform”
• After installation, “Server administration”
For more information about installing this product, see Business Intelligence Platform Installation Guide.
To assess your needs and to design a deployment architecture, Business Intelligence Platform Planning
Guide.
Related Topics
•
•
Understanding communication between BI platform components
•
•
Authentication options in BI platform
2.2.3.2 Configuring your deployment
If you have just completed your installation of the BI platform and need to perform initial configuration tasks, such as firewall configuration and user management, it is recommended that you read the following sections.
Related Topics
•
Communication between BI platform components
•
•
2.2.3.3 Improving your system's performance
If you want to assess your deployment's efficiency and fine-tune it in order to maximize resources, it is recommended that you read the following sections:
• If you want to monitor your system, read about Monitoring.
• For daily maintenance tasks and procedures for working with servers in the CMC, read about server maintenance.
Related Topics
•
30 2012-12-12
Getting Started
2.2.3.4 Working with objects in the CMC
If you are working with objects in the CMC, read the following sections:
• For information about setting up users and groups in the CMC, see “Account management overview”.
• To set security on objects, see “How rights work in BusinessObjects Enterprise”.
• For general information about working with objects, see SAP BusinessObjects Business Intelligence
Platform User's Guide.
Related Topics
•
•
How rights work in BI platform
31 2012-12-12
Getting Started
32 2012-12-12
Architecture
Architecture
3.1 Architecture overview
This section outlines the overall platform architecture, system, and service components that make up the SAP BusinessObjects Business Intelligence platform. The information helps administrators understand the system essentials and help to form a plan for the system deployment, management, and maintenance.
Note:
For a list of supported platforms, languages, databases, web application servers, web servers, and other systems supported by this release, see the Product Availability Matrix (Supported Platforms/PAR), available on the SAP BusinessObjects section of the SAP Support Portal at: https://ser vice.sap.com/bosap-support .
SAP BusinessObjects Business Intelligence platform is designed for high performance across a broad spectrum of user and deployment scenarios. For example, specialized platform services handle either on-demand data access and report generation, or report scheduling based on times and events. You can offload processor intensive scheduling and processing by creating dedicated servers to host specific services. The architecture is designed to meet the needs of virtually any BI deployment, and is flexible enough to grow from several users with a single tool, to tens of thousands of users with multiple tools and interfaces.
Developers can integrate SAP BusinessObjects Business Intelligence platform in your organization's other technology systems with web services, Java, or .NET application programming interfaces (APIs).
End users can access, create, edit, and interact with reports using specialized tools and applications that include:
• Clients installed by Business Intelligence platform Client Tools installation program:
• Web Intelligence Rich Client
• Business View Manager
• Report Conversion Tool
• Universe Design Tool
• Query as a Web Service
• Information Designer Tool (formerly Information Designer)
• Translation Management Tool (formerly Translation Manager)
• Widgets (formerly BI Widgets)
• Clients available separately:
• SAP Crystal Reports
• SAP BusinessObjects Dashboards (formerly Xcelsius)
33 2012-12-12
Architecture
• SAP BusinessObjects Analysis (formerly Voyager)
• BI Workspaces (formerly Dashboard Builder)
IT departments can use data and system management tools that include:
• Report Viewers
• Central Management Console (CMC)
• Central Configuration Manager (CCM)
• Repository Diagnostic Tool (RDT)
• Data Federation Administration Tool
• Upgrade management tool (formerly Import Wizard)
• Universe Design Tool (formerly Universe Designer)
• SAP BusinessObjects Mobile
To provide flexibility, reliability, and scalability, SAP BusinessObjects Business Intelligence platform components can be installed on one or across many machines. You can even install two different versions of Business Intelligence platform simultaneously on the same computer, although this configuration is only recommended as part of the upgrade process or testing purposes.
Server processes can be “vertically scaled” (where one computer runs several, or all, server-side processes) to reduce cost or “horizontally scaled” (where server processes are distributed between two or more networked machines) to improve performance. It is also possible to run multiple, redundant, versions of the same server process on more than one machine, so that processing can continue if the primary process encounters a problem.
Note:
While it is possible to use a mixture of Windows and Unix or Linux platforms, it is recommended that you do not mix operating systems for Central Management Server (CMS) processes.
3.1.1 Architecture diagram
SAP BusinessObjects Business Intelligence platform is a Business Intelligence (BI) platform that provides enterprise level analysis and reporting tools. Data can be analyzed from any of a large number of supported database systems (including text or multi-dimensional OLAP systems) and BI reports can be published in many different formats to many different publishing systems. The following diagram illustrates the BI platform components, including servers and client tools, and additional analytic products, web application components, and databases that can be part of a BI platform landscape.
Tip:
Interact with a more detailed view of all BI platform components and servers using the Interactive architecture diagram on the SAP Community Network.
34 2012-12-12
Architecture
The BI platform reports from a read-only connection to your organization's databases, and uses its own databases for storing its configuration, auditing, and other operational information. The BI reports created by the system can be sent to a variety of destinations, including file systems, and email, or accessed through web sites or portals.
The BI platform is a self-contained system that can exist on a single machine (for example, as a small development or pre-production test environment) or can be scaled up into a cluster of many machines that run different components (for example, as a large-scale production environment).
3.1.2 Architecture tiers
SAP BusinessObjects Business Intelligence platform can be thought of as a series of conceptual tiers.
Client tier
The client tier contains all desktop client applications that interact with the SAP BusinessObjects Business
Intelligence platform to provide a variety of reporting, analytic, and administrative capabilities. Examples include the Central Configuration Manager (BI platform installation program), Information design tool
(BI platform Client Tools installation program), and SAP Crystal Reports 2011 (available and installed separately).
35 2012-12-12
Architecture
Web tier
The web tier contains web applications deployed to a Java web application server. Web applications provide SAP BusinessObjects Business Intelligence platform functionality to end users through a web browser. Examples of web applications include the Central Management Console (CMC) administrative web interface and BI launch pad.
The web tier also contains Web Services. Web Services provides SAP BusinessObjects Business
Intelligence platform functionality to software tools via the web application server, such session authentication, user privilege management, scheduling, search, administration, reporting, and query management. For example, Live Office is a product that uses Web Services to integrate SAP
BusinessObjects Business Intelligence platform reporting into Microsoft Office products.
Management tier
The management tier (also known as intelligence tier) coordinates and controls all of the components that make up SAP BusinessObjects Business Intelligence platform. It is comprised of the Central
Management Server (CMS) and the Event Server and associated services. The CMS provides maintains security and configuration information, sends service requests to servers, manages auditing, and maintains the CMS system database. The Event Server manages file based events, which occur in the storage tier.
Storage tier
The storage tier is responsible to handling files, such as documents and reports.
The Input File Repository Server manages files that contain information to be used in reports, such as the following file types: .rpt, .car, .exe, .bat, .js, .xls, .doc, .ppt, .rtf, .txt, .pdf, .wid,
.rep
, .unv.
The Output File Repository Server manages reports created by the system, such as the following file types: .rpt, .csv, .xls, .doc, .rtf, .txt, .pdf, .wid, .rep.
The storage tier also handles report caching to save system resources when users access reports.
Processing tier
The processing tier analyzes data and produces reports. This is the only tier that accesses the databases that contain report data. This tier is comprised of the Adaptive Job Server, Connection Server (32- and
64-bit), and processing servers such as the Adaptive Processing Server or Crystal Reports Processing
Server.
Data tier
The data tier contains your actual report and system data. For example, report data in relational databases, OLAP data sources, and the actual universe files (.unx and .unv). Or system databases for the CMS, Auditing Data Store, Promotion management, Version management, and Monitoring application.
3.1.3 Databases
36 2012-12-12
Architecture
SAP BusinessObjects Business Intelligence platform uses several different databases.
• Reporting database
This refers to your organization's information. It is the source information analyzed and reported on by SAP BusinessObjects Business Intelligence Suite products. Most commonly, the information is stored within a relational database, but it can also be contained within text files, Microsoft Office documents, or OLAP systems.
• CMS system database
The CMS system database is used to store SAP BusinessObjects Business Intelligence platform information, such as user, server, folder, document, configuration, and authentication details. It is maintained by the Central Management Server (CMS), and is sometimes referred to as the system repository.
• Auditing Data Store
The Auditing Data Store (ADS) is used to store information on trackable events that occur in SAP
BusinessObjects Business Intelligence platform. This information can be used to monitor the usage of system components, user activity, or other aspects of day-to-day operation.
• Version Management database
The Version Management database tracks configuration and version information related to an SAP
BusinessObjects Business Intelligence platform installation, as well as updates.
• Monitoring database
Monitoring uses the Java Derby database to store system configuration and component information for SAP supportability.
If you do not have a database server in place for use with the CMS system and Auditing Data Store databases, the SAP BusinessObjects Business Intelligence platform installation program can install and configure one for you. It is recommended that you evaluate your requirements against information from your database server vendor to determine which supported database would best suit your organization's requirements.
3.1.4 Servers
SAP BusinessObjects Business Intelligence platform consists of collections of servers running on one or more hosts. Small installations (such as test or development systems) can use a single host for a web application server, database server, and all SAP BusinessObjects Business Intelligence platform servers.
Medium and large installations can have servers running on multiple hosts. For example, a web application server host can be used in combination with an SAP BusinessObjects Business Intelligence platform server host. This frees up resources on the SAP BusinessObjects Business Intelligence platform server host, allowing it to process more information than if it also hosted the web application server.
37 2012-12-12
Architecture
Large installations can have several SAP BusinessObjects Business Intelligence platform server hosts working together in a cluster. For example, if an organization has a large number of SAP Crystal Reports users, Crystal Reports processing servers can be created on multiple SAP BusinessObjects Business
Intelligence platform server hosts to ensure that there are plenty of resources available to process requests from clients.
The advantages of having multiple servers include:
• Improved performance
Multiple SAP BusinessObjects Business Intelligence platform server hosts can process a queue of reporting information faster than a single SAP BusinessObjects Business Intelligence platform server host.
• Load balancing
If a server is experiencing a higher load than the other servers in a cluster, the CMS automatically sends new work to a server with better resources.
• Improved availability
If a server encounters an unexpected condition, the CMS automatically re-routes work to different servers until the condition is corrected.
3.1.5 Web application servers
A web application server acts as the translation layer between a web browser or rich application, and
SAP BusinessObjects Business Intelligence platform. Web application servers running on Windows,
Unix, and Linux are supported.
For a detailed list of supported web application servers, consult the
Platform Availability Matrix, available at: http://service.sap.com/bosap-support .
If you do not have a web application server in place for use with SAP BusinessObjects Business
Intelligence platform, the installation program can install and configure a Tomcat 6 web application server for you. It is recommended that you evaluate your requirements against information from your web application server vendor to determine which supported web application server would best suit your organization's requirements.
Note:
When configuring a production environment, it is recommended that the web application server is hosted on a separate system. Running SAP BusinessObjects Business Intelligence platform and a web application server on the same host in a production environment may decrease performance.
3.1.5.1 Web Application Container Service (WACS)
38 2012-12-12
Architecture
A web application server is required to host SAP BusinessObjects Business Intelligence platform web applications.
If you are an advanced Java web application server administrator with advanced administration needs, use a supported Java web application server to host SAP BusinessObjects Business Intelligence platform web applications. If you are using a supported Windows operating system to host SAP
BusinessObjects Business Intelligence platform, and prefer a simple web application server installation process, or you do not have the resources to administer a Java web application server, you can install the Web Application Container Service (WACS) when installing SAP BusinessObjects Business
Intelligence platform.
WACS is an SAP BusinessObjects Business Intelligence platform server that allows SAP BusinessObjects
Business Intelligence platform web applications, such as the Central Management Console (CMC), BI launch pad, and Web Services, to run without the need for a previously installed Java web application server.
Using WACS provides a number of advantages:
• WACS requires a minimum effort to install, maintain, and configure. It is installed and configured by the SAP BusinessObjects Business Intelligence platform installation program, and no additional steps are required to start using it.
• WACS removes the need for Java application server administration and maintenance skills.
• WACS provides an administrative interface that is consistent with other SAP BusinessObjects
Business Intelligence platform servers.
• Like other SAP BusinessObjects Business Intelligence platform servers, WACS can be installed on a dedicated host.
Note:
There are some limitations to using WACS instead of a dedicated Java web application server:
• WACS is only available on supported Windows operating systems.
• Custom web applications cannot be deployed to WACS, as it only supports the web applications installed with SAP BusinessObjects Business Intelligence platform.
• WACS cannot be used with an Apache load balancer.
It is possible to use a dedicated web application server in addition to WACS. This allows your dedicated web application server to host custom web applications, while the CMC and other SAP BusinessObjects
Business Intelligence platform web applications are hosted by WACS.
3.1.6 Software Development Kits
A Software Development Kit (SDK) allows a developer to incorporate aspects of SAP BusinessObjects
Business Intelligence platform into an organization's own applications and systems.
SAP BusinessObjects Business Intelligence platform has SDKs for software development on Java and
.NET platforms.
39 2012-12-12
Architecture
40
Note:
SAP BusinessObjects Business Intelligence platform .NET SDKs are not installed by default, and must be downloaded from the SAP Service Marketplace.
The following SDKs are supported by SAP BusinessObjects Business Intelligence platform:
• SAP BusinessObjects Business Intelligence platform Java SDK and .NET SDK
The SAP BusinessObjects Business Intelligence platform SDKs allow applications to perform tasks such as authentication, session management, working with repository objects, report scheduling and publication, and server management.
Note:
For full access to security, server management, and auditing functions, use the Java SDK.
• SAP BusinessObjects Business Intelligence platform RESTful web service SDK
The Business Intelligence platform RESTful web service SDK lets you access the BI platform using the HTTP protocol. You can use this SDK to log on to the BI platform, navigate the BI platform repository, access resources, and perform basic resource scheduling. You can access this SDK by writing applications that use any programming language that supports the HTTP protocol, or by using any tool that supports making HTTP requests.
• SAP BusinessObjects Business Intelligence platform Java Consumer SDK and .NET Consumer
SDK
An implementation of SOAP-based Web Services that allows you to handle user authentication and security, document and report access, scheduling, publications, and server management.
SAP BusinessObjects Business Intelligence platform Web Services uses standards such as XML,
SOAP, AXIS 2.0 and WSDL. The platform follows WS-Interoperability Basic Profile 1.0 web services specification.
Note:
Web Services applications are currently only supported with the following load balancer configurations:
1.
Source IP address persistence.
2.
Source IP and destination port persistence (available only on a Cisco Content Services Switch).
3.
SSL persistence.
4.
Cookie based session persistence.
Note:
SSL persistence may cause security and reliability issues on some web browsers. Check with your network administrator to determine if SSL persistence is appropriate for your organization.
• Data Access Driver and Connection Java SDKs
These SDKs allow you to create database drivers for the Connection Server and manage database connections.
• Semantic Layer Java SDK
The Semantic Layer Java SDK allows you to develop a Java application that performs administration and security tasks on universes and connections. For example, you can implement services for publishing a universe to a repository or retrieving a secured connection from the repository to your
2012-12-12
Architecture workspace. This application can be embedded within Business Intelligence solutions that integrate the SAP BusinessObjects Business Intelligence platform as OEM.
• Report Application Server Java SDK and .NET SDK
The Report Application Server SDKs allow applications to open, create, and modify existing Crystal reports, including setting parameter values, changing data sources, and exporting to other formats, including XML, PDF, Microsoft Word, and Microsoft Excel.
• Java and .NET Crystal Reports Viewers
The viewers allow applications to display and export Crystal reports. The following viewers are available:
• DHTML Report Page Viewer: presents data and allows drill-down, page navigation, zooming, prompting, search, highlighting, exporting, and printing.
• Report Parts Viewer: provides the ability to view individual parts of a report, including charts, text, and fields.
• Report Engine Java SDK and .NET SDK
The Report Engine SDKs allow applications to interact with reports created with SAP BusinessObjects
Web Intelligence.
The Report Engine SDKs include libraries that you can use to build a web report design tool.
Applications built with these SDKs can view, create, or modify, a variety of different SAP
BusinessObjects Web Intelligence documents. Users can modify documents by adding, removing, and modifying objects such as tables, charts, conditions, and filters.
• Platform Search SDK: The Platform Search SDK is the interface between the client application and the Platform Search Service. Platform Search supports Public SDK that comes as a part of the
Platform Search SDK.
When a search request parameter is sent through the client application to the SDK layer, the SDK layer converts the request parameter into XML- encoded format and passes it to the Platform Search
Service.
The SDKs can be used in combination to provide a wide range of BI functionality to your applications.
For more information on these SDKs, including developer guides and API references, see http://help.sap.com
.
3.1.7 Data sources
3.1.7.1 Universes
41 2012-12-12
Architecture
The universe abstracts the data complexity by using business language rather than data language to access, manipulate, and organize data. This business language is stored as objects in a universe file.
Web Intelligence and Crystal Reports use universes to simplify the user creation process required for simple to complex end-user query and analysis.
Universes are a core component of SAP BusinessObjects Business Intelligence platform. All universe objects and connections are stored and secured in the central repository by the Connection Server.
Universe design tools need to log into SAP BusinessObjects Business Intelligence platform to access the system and create universes. Universe access and row-level security can also be managed at the group or individual user level from within the design environment.
The semantic layer allows SAP BusinessObjects Web Intelligence to deliver documents, by utilizing multiple synchronized data providers, including online analytical processing (OLAP) and common warehousing metamodel (CWM) data sources.
3.1.7.2 Business Views
Business Views simplify report creation and interaction by abstracting the complexity of data for report developers. Business Views help separate the data connections, data access, business elements, and access control.
Business Views can only be used by Crystal Reports and are designed to simplify the data access and view-time security required for Crystal report creation. Business Views support the combination of multiple data sources in a single view. Business Views are fully supported in SAP BusinessObjects
Business Intelligence platform.
SAP BusinessObjects Business Intelligence platform includes a series of dedicated, pre-configured platform management services for tasks such as password management, server metrics, and user access control for decentralized management functions.
3.1.8 Authentication and single sign-on
System security is managed by the Central Management Server (CMS), security plug-ins, and third-party authentication tools, such as SiteMinder or Kerberos. These components authenticate users and authorize user access for SAP BusinessObjects Business Intelligence platform, its folders, and other objects.
The following user authentication single sign-on security plug-ins are available:
• Enterprise (default), including Trusted Authentication support for third-party authentication
• LDAP
• Windows Active Directory (AD)
42 2012-12-12
Architecture
When using an Enterprise Resource Planning (ERP) system, single sign-on is used to authenticate user access to the ERP system so that reports can be against ERP data. The following user authentication single sign-on for ERP systems are supported:
• SAP ERP and Business Warehouse (BW)
• Oracle E-Business Suite (EBS)
• Siebel Enterprise
• JD Edwards Enterprise One
• PeopleSoft Enterprise
43
3.1.8.1 Security plug-ins
Security plug-ins automate account creation and management by allowing you to map user accounts from third-party systems to Business Intelligence (BI) platform. You can map third-party user accounts to existing Enterprise user accounts or create new Enterprise user accounts that correspond to each mapped entry in the external system.
The security plug-ins dynamically maintain third-party user and group listings. Once you map a
Lightweight Directory Access Protocol (LDAP) or Windows Active Directory (AD) group to BI platform, all users who belong to that group can log on to BI platform. Subsequent changes to the third-party group memberships are automatically propagated.
BI platform supports the following security plug-ins:
• Enterprise security plug-in
The Central Management Server (CMS) handles security information, such as user accounts, group memberships, and object rights that define user and group privileges. This is known as Enterprise authentication.
Enterprise authentication is always enabled; it cannot be disabled. Use the system default Enterprise
Authentication if you prefer to create distinct accounts and groups for use with SAP BusinessObjects
Business Intelligence platform, or if you have not already set up a hierarchy of users and groups on an LDAP or Windows AD server.
Trusted Authentication is a component of Enterprise authentication that integrates with third-party single sign-on solutions, including Java Authentication and Authorization Service (JAAS). Applications that have established trust with the Central Management Server can use Trusted Authentication to allow users to log on without providing their passwords.
• LDAP security plug-in
• Windows AD
Note:
Although a user can configure Windows AD authentication for SAP BusinessObjects Business
Intelligence platform and custom applications through the CMC, the CMC and BI launch pad do not support Windows AD authentication with NTLM. The only methods of authentication that the CMC and BI launch pad support are Windows AD with Kerberos, LDAP, Enterprise, and Trusted
Authentication.
2012-12-12
Architecture
3.1.8.2 Enterprise Resource Planning (ERP) integration
An Enterprise Resource Planning (ERP) application supports the essential functions of an organization's processes by collecting real-time information related to day-to-day operations. SAP BusinessObjects
Business Intelligence platform supports single sign-on and reporting from a number of ERP systems.
See the SAP BusinessObjects BI 4.0 Product Availability Matrix (PAM) , available at http://ser vice.sap.com/pam .
SAP ERP and BW support is installed by default. Use the Custom / Expand installation option to deselect
SAP integration support if you do not want support for SAP ERP or BW. Support for other ERP systems is not installed by default. Use the "Custom / Expand" installation option to select and install integration for non-SAP ERP systems.
To configure ERP integration, see the SAP BusinessObjects Business Intelligence Platform Administrator
Guide.
3.1.9 SAP integration
SAP BusinessObjects Business Intelligence platform integrates with your existing SAP infrastructure with the following SAP tools:
• SAP System Landscape Directory (SLD)
The system landscape directory of SAP NetWeaver is the central source of system landscape information relevant for the management of your software life-cycle. By providing a directory comprising information about all installable software available from SAP and automatically updated data about systems already installed in a landscape, you get the foundation for tool support to plan software life-cycle tasks in your system landscape.
The SAP BusinessObjects Business Intelligence platform installation program registers the vendor and product names and versions with the SLD, as well as server and front-end component names, versions, and location.
• SAP Solution Manager
The SAP Solution Manager is a platform that provides the integrated content, tools, and methodologies to implement, support, operate and monitor an organization's SAP and non-SAP solutions.
Non-SAP software with an SAP-certified integration is entered into a central repository and transferred automatically to your SAP System Landscape Directories (SLD). SAP customers can then easily identify which version of third-party product integration has been certified by SAP within their SAP system environment. This service provides additional awareness for third-party products besides our online catalogs for third-party products.
44 2012-12-12
Architecture
SAP Solution Manager is available to SAP customers at no extra charge, and includes direct access to SAP support and SAP product upgrade path information. For more information on SLD, see
“Registration of SAP BusinessObjects Business Intelligence platform in the System Landscape” in the SAP BusinessObjects Business Intelligence Platform Administrator Guide.
• CTS Transport (CTS+)
The Change and Transport System (CTS) helps you to organize development projects in ABAP
Workbench and in Customizing, and then transport the changes between the SAP systems in your system landscape. As well as ABAP objects, you can also transport Java objects (J2EE, JEE) and
SAP-specific non-ABAP technologies (such as Web Dynpro Java or SAP NetWeaver Portal) in your landscape.
• Monitoring with CA Wily Introscope
CA Wily Introscope is a web application management product that delivers the ability to monitor and diagnose performance problems that may occur within Java-based SAP modules in production, including visibility into custom Java applications and connections to back-end systems. It allows you to isolate performance bottlenecks in NetWeaver modules including individual Servlets, JSPs, EJBs,
JCOs, Classes, Methods and more. It offers real-time, low-overhead monitoring, end-to-end transaction visibility, historical data for analysis or capacity planning, customizable dashboards, automated threshold alarms, and an open architecture to extend monitoring beyond NetWeaver environments.
3.1.10 Promotion Management
Promotion Management application enables you to move BI objects from one system to another system, without affecting the dependencies of those objects. It also enables you to manage different versions, manage dependencies, or roll back a promoted object to its previous state.
You can promote a BI object from one system to another system only if the same version of the application is installed on both the source and destination systems.
For more information, see the Promotion Management section of this guide.
3.1.11 Integrated version control
The files that make up SAP BusinessObjects Business Intelligence platform on a server system are now kept under version control. The installation program will install and configure the Subversion version control system, or you can enter details to use an existing Subversion or ClearCase version control system.
45 2012-12-12
Architecture
A version control system makes it possible to keep and restore different revisions of configuration and other files, which means it is always possible to revert the system to a known state from any time in the past.
3.1.12 Upgrade path
It's possible to upgrade from a previous release of SAP BusinessObjects Enterprise (for example XI
3.x), but you must first install SAP BusinessObjects Business Intelligence platform 4.x, then migrate the settings and data from your existing system with the Upgrade management tool.
For information on how to upgrade from a previous version, see the
SAP BusinessObjects Business
Intelligence Platform Upgrade Guide.
3.2 Services and servers
BI platform uses service and server to refer to the two types of software running on a BI platform computer.
A service is a server subsystem that performs a specific function. The service runs in the memory space of its server, under the process ID of the parent container (server). For example, the Web Intelligence
Scheduling Service is a subsystem that runs on the Adaptive Job Server.
A server is a process at the operating system level (on some systems, called a daemon) that hosts one or more services. For example, the Central Management Server (CMS) and Adaptive Processing Server are servers. A server runs on a specific operating system account and has its own PID.
A node is a collection of BI platform servers running on the same host and managed by the same Server
Intelligence Agent (SIA). One or more nodes can be on a single host.
BI platform can be installed on one computer, spread across different computers on an intranet, or separated over a wide area network (WAN).
Services, servers, nodes, and hosts
The following diagram shows a hypothetical installation of BI platform. The number of services, servers, nodes, and hosts—and the type of services and servers—varies in actual installations.
46 2012-12-12
Architecture
47
Two hosts form the cluster named ProductionBISystem, which has two hosts:
• The host named HostAlpha has BI platform installed and is configured with two nodes:
• NodeMercury contains an Adaptive Job Server (NodeMercury.AJS) with services to schedule and publish reports, an Input File Repository Server (NodeMercury.IFRS) with a service to store input reports, and an Output File Repository Server (NodeMercury.OFRS) with a service to store report output.
• NodeVenus contains an Adaptive Processing Server (NodeVenus.APS) with services to provide publishing, monitoring, and translation features, an Adaptive Processing Server (Node
Venus.APS2
) with a service to provide client auditing, and a Central Management Server
(NodeVenus.CMS) with a service to provide the CMS services.
• The host named HostBeta has BI platform installed and is configured with three nodes:
• NodeMars contains a Central Management Server (NodeMars.CMS) with a service to provide
CMS services. Having the CMS on two computers enables load balancing and mitigation and failover capabilities.
• NodeJupiter contains an Web Intelligence Processing Server (NodeJupiter.WebIntelli
gence
) with a service to provide Web Intelligence reporting and an Event Server (Node
Jupiter.EventServer
) to provide report monitoring of files.
2012-12-12
Architecture
• NodeSaturn contains an Adaptive Processing Server (NodeSaturn.APS) with a service to provide client auditing.
3.2.1 Server changes since XI 3.1
The following table describes major changes in the BI platform servers since XI 3.1. Types of changes include:
• Servers that have changed names between versions, while providing the same or similar functionality.
• Servers that are no longer offered by newer versions.
• Common or related services that have been consolidated onto the Adaptive servers.
For example, the scheduling services provided by individual Job servers in XI 3.1 have been moved to the Adaptive Job Server in 4.0.
• New servers that have been introduced.
Table 3-1: Server changes
XI 3.1
4.0
4.0 Feature Pack 3
Connection Server [1]
Crystal Reports Job Server
Connection Server
Connection Server 32
Adaptive Job Server
Connection Server
Connection Server 32
Adaptive Job Server
Crystal Reports Processing Server
Crystal Reports 2011 Processing
Server
Crystal Reports Processing Server
(for SAP Crystal Reports for Enterprise reports)
Crystal Reports 2011 Processing
Server
Crystal Reports Processing Server
(for SAP Crystal Reports for Enterprise reports)
Dashboard Server (Dashboard
Builder) [2]
Dashboard Analytics Server
(Dashboard Builder) [2]
Desktop Intelligence Cache Server
[3]
Dashboard Server (BI Workspaces)
Not available as of 4.0 Feature
Pack 3
Dashboard Analytics Server (BI
Workspaces)
Not available as of 4.0
Not available as of 4.0 Feature
Pack 3
Not available as of 4.0
Desktop Intelligence Job Server [3] Not available as of 4.0
Not available as of 4.0
48 2012-12-12
Architecture
XI 3.1
Desktop Intelligence Processing
Server [3]
4.0
Not available as of 4.0
4.0 Feature Pack 3
Not available as of 4.0
Destination Job Server
List of Values Server (LOV)
Multi-Dimensional Analysis Server
Program Job Server
Adaptive Job Server Adaptive Job Server
Web Intelligence Processing Server Web Intelligence Processing Server
Adaptive Processing Server
Adaptive Job Server
Adaptive Processing Server
Adaptive Job Server
Report Application Server (RAS)
Web Intelligence Job Server
Xcelsius Cache Server [4]
Xcelsius Processing Server [4]
Crystal Reports 2011 Report Application Server (RAS)
Crystal Reports 2011 Report Application Server (RAS)
Adaptive Job Server Adaptive Job Server
Dashboard Design Cache Server
(Xcelsius) [5]
Dashboard Design Processing
Server (Xcelsius) [5]
Dashboards Cache Server (Xcelsius)
Dashboards Processing Server
(Xcelsius)
• [1] In 4.0, Connection Server 32 is 32-bit and runs connections specifically to data sources that cannot handle 64-bit middleware. Connection Server is 64-bit and runs connections to the all other data sources. For more information, see the Data Access Guide.
• [2] The Dashboard Server and Dashboard Analytics Server have been removed in 4.0 Feature Pack
3. Server configuration is no longer required for BI workspace functionality (formerly Dashboard
Builder in XI 3.1).
• [3] Desktop Intelligence is no longer available as of version 4.0. Desktop Intelligence reports can be converted to Web Intelligence documents using the Report Conversion Tool.
• [4] The Xcelsius Cache and Processing Services were introduced as of XI 3.1 Service Pack 3 to optimize Query as a Web Service requests on relational data sources from Xcelsius. Equivalent
Cache and Processing services are available on the 4.0 Feature Pack 3 Dashboards Cache Server and Dashboards Processing Server.
• [5] Dashboard Design servers in 4.0 have been renamed to Dashboards in 4.0 Feature Pack 3 to align with the product name change to SAP BusinessObjects Dashboards.
3.2.2 Services
When adding servers, you must include some services on the Adaptive Job Server—for example, the
Destination Delivery Scheduling Service.
Note:
New services or server types may be added in future maintenance releases.
49 2012-12-12
Architecture
Service Service category
Adaptive Connectivity
Service
Connectivity Services
Authentication Update Scheduling Service
BEx Web Application
Service
Analysis Services
BOE Web Application
Service
Business Process BI
Service
Central Management
Service
Core Services
Core Services
Core Services
Core Services
Server type
Adaptive Processing Server
Adaptive Job Server
Adaptive Processing Server
Web Application Container
Server
Web Application Container
Server
Service description
Provides connectivity services (replaces
Connection Server)
Provides synchronization of updates for third-party security plug-ins
Provides integration of SAP Business
Warehouse (BW)
Business Explorer
(BEx) web applications with BI launch pad
Provides web applications for WACS, including the Central
Management Console
(CMC), BI launch pad, and OpenDocument
Provides Business
Process BI Web Services for WACS, allowing BI technology to be incorporated in web applications.
Business Process BI
Service is deprecated.
Central Management Server
Provides server, user, session management, and security (access rights and authentication) management. At least one Central
Management Service must be available in a cluster for the cluster to operate.
50 2012-12-12
Architecture
Service
Client Auditing Proxy
Service
Crystal Reports 2011
Processing Service
Crystal Reports 2011
Scheduling Service
Service category
Core Services
Crystal Reports Services
Crystal Reports Services
Server type
Adaptive Processing Server
Crystal Reports Processing
Server
Adaptive Job Server
Service description
Collects auditing events sent from clients and forwards them to the CMS server
Accepts and processes Crystal Reports
2011 reports; can share data between reports to reduce the number of database accesses
Runs scheduled legacy Crystal Reports jobs and publishes the results to an output location
Crystal Reports 2011
Viewing and Modification Service
Crystal Reports Services
Crystal Reports
Cache Service
Report Application Server
(RAS)
Crystal Reports Services
Crystal Reports Cache Server
Limits the number of database accesses generated from Crystal reports and speeds up reporting by managing a cache of reports
Crystal Reports Processing Service
Crystal Reports
Scheduling Service
Crystal Reports Services
Crystal Reports Services
Crystal Reports Processing
Server
Adaptive Job Server
Accepts and processes Crystal reports; can share data between reports to reduce the number of database accesses
Runs scheduled new
Crystal Reports jobs and publishes the results to an output location
51 2012-12-12
Architecture
Service
Custom Data Access
Service
Dashboards Cache
Service
Dashboards Processing Service
Service category
Web Intelligence
Services
Dashboards Services
Dashboards Services
Server type
Adaptive Processing Server
Dashboards Cache Server
Dashboards Processing
Server
Service description
Provides dynamic connections to data sources that do not require a Connection
Server. This service allows accessing and refreshing reports created using some personal data provider like CSV files. See SAP BusinessObjects Web Intelligence Rich Client
User Guide for more information on building a query or refreshing a document based on a text file.
Limits the number of database accesses generated from
Dashboards reports, and speeds up reporting by managing a cache of reports
Accepts and processes Dashboards reports; can share data between reports to reduce the number of database accesses
Data Federation Service
Data Federation Services
Adaptive Processing Server
52 2012-12-12
Architecture
Service
Destination Delivery
Scheduling Service
Document Recovery
Service
DSL Bridge Service
Event Service
Excel Data Access
Service
Information Engine
Service
Service category
Core Services
Web Intelligence
Services
Web Intelligence
Services
Core Services
Web Intelligence
Services
Web Intelligence
Services
Server type
Adaptive Job Server
Service description
Runs scheduled jobs and publishes the results to an output location, such as a file system, FTP server, email, or a user's inbox
Note:
When adding servers, you must include some Adaptive Job
Server services—including this service.
Adaptive Processing Server
Adaptive Processing Server
Event Server
Web Intelligence document auto-save and recovery
Dimensional Semantic Layer (DSL) session support
Monitors for file events on a File
Repository Server
(FRS) and triggers reports to run when required
Adaptive Processing Server
Supports Excel files uploaded to Business
Intelligence platform as data sources. See
SAP BusinessObjects
Web Intelligence Rich
Client User Guide for more information on building a query or refreshing a document based on an
Excel file.
Web Intelligence Processing
Server
Required service for
Web Intelligence documents processing
53 2012-12-12
Architecture
54
Service
Input Filestore Service
Core Services
Insight to Action Service
Core Services
Lifecycle Management ClearCase Service
Lifecycle Management Services
Lifecycle Management Scheduling
Service
Lifecycle Management Service
Lifecycle Management Services
Lifecycle Management Services
Monitoring Service Core Services
Multi Dimensional
Analysis Service
Native Connectivity
Service
Native Connectivity
Service (32-bit)
Output Filestore Service
Service category
Analysis Services
Connectivity Services
Connectivity Services
Core Services
Server type
Input File Repository Server
Adaptive Processing Server
Service description
Maintains published report and program objects that can be used in the generation of new reports when an input file is received
Enables actions to be invoked and provides support for RRI
Adaptive Processing Server
Provides ClearCase support for LCM
Adaptive Job Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Runs scheduled Lifecycle Management jobs
Lifecycle Management Core service
Provides monitoring functions
Provides access to multi-dimensional
Online Analytical Processing (OLAP) data; converts the raw data into XML, which can be rendered into Excel, PDF, or Analysis
(formerly Voyager
)crosstabs and charts
Connection Server
Connection Server
Provides Native Connectivity services for
64-bit architecture
Provides Native Connectivity services for
32-bit architecture
Output File Repository Server
Maintains a collection of completed documents
2012-12-12
Architecture
55
Service
Platform Search
Scheduling Service
Platform Search Service
Probe Scheduling
Service
Program Scheduling
Service
Publication Scheduling Service
Publishing Post Processing Service
Publishing Service
Rebean Service
Replication Service
Service category
Core Services
Core Services
Core Services
Core Services
Core Services
Core Services
Core Services
Web Intelligence
Services
Core Services
Server type
Adaptive Job Server
Adaptive Processing Server
Adaptive Job Server
Adaptive Job Server
Adaptive Job Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Job Server
Service description
Runs scheduled search to index all content in the Central
Management Server
(CMS) repository
Provides searching functionality for BI platform
Provides scheduled
Probe jobs and publishes the results to an output location
Runs programs that have been scheduled to run at a given time
Runs scheduled publishing jobs and publishes the results to an output location
Performs actions on reports after they have completed, such as sending a report to an output location
Coordinates with the
Publishing Post Processing Service and
Destination Job Service to publish reports to an output location, such as a file system,
FTP server, email, or a user's inbox
SDK used by Web Intelligence and Explorer
Runs scheduled federation jobs to replicate content between federated sites
2012-12-12
Architecture
56
Service
RESTful Web Service
Security Query
Scheduling Service
Security Token Service
Translation Service
Visual Difference
Scheduling Service
Visual Difference
Service
Visualization Service
Web Intelligence
Common Service
Web Intelligence
Core Service
Web Intelligence
Processing Service
Web Intelligence
Scheduling Service
Service category
Core Services
Core Services
Core Services
Core Services
Lifecycle Management Services
Lifecycle Management Services
Web Intelligence
Services
Web Intelligence
Services
Web Intelligence
Services
Web Intelligence
Services
Web Intelligence
Services
Server type
Web Application Container
Server (WACS)
Adaptive Job Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Job Server
Adaptive Processing Server
Adaptive Processing Server
Service description
Provides session handling for RESTful
Web Service requests.
Runs scheduled Security Query jobs
SAP Single Sign-On support
Translates InfoObjects with input from the Translation Manager client
Runs scheduled Visual Difference (Lifecycle Management) jobs and publishes the results to an output location
Determines whether documents are visually identical for doc promotion and Lifecycle Management
A common Visualization Object Model
Service used by Web
Intelligence
Web Intelligence Processing
Server
Supports Web Intelligence documents processing
Web Intelligence Processing
Server
Supports Web Intelligence documents processing
Web Intelligence Processing
Server
Accepts and processes Web Intelligence documents
Adaptive Job Server
Enables support for scheduled Web Intelligence jobs
2012-12-12
Architecture
Service
Web Services SDK and QaaWs
Service category
Core Services
Server type
Web Application Container
Server
Service description
Web Services on
WACS
Related Topics
•
•
3.2.3 Service categories
Note:
New services or server types may be added in future maintenance releases.
Service category
Analysis Services
Analysis Services
Connectivity Services
Connectivity Services
Connectivity Services
Core Services
Core Services
Core Services
Core Services
Core Services
Core Services
Core Services
Service
BEx Web Application Service
Server type
Adaptive Processing Server
Multi Dimensional Analysis Service
Adaptive Processing Server
Adaptive Connectivity Service Adaptive Processing Server
Native Connectivity Service Connection Server
Native Connectivity Service (32bit)
Connection Server
Authentication Update Scheduling Service
Adaptive Job Server
Central Management Service Central Management Server
Client Auditing Proxy Service
Dashboard Service
Adaptive Processing Server
Dashboard Server
Destination Delivery Scheduling
Service
Adaptive Job Server
Event Service Event Server
Insight to Action Service Adaptive Processing Server
57 2012-12-12
Architecture
58
Service category
Core Services
Core Services
Core Services
Core Services
Core Services
Core Services
Core Services
Core Services
Core Services
Core Services
Core Services
Core Services
Core Services
Core Services
Core Services
Crystal Reports Services
Crystal Reports Services
Crystal Reports Services
Crystal Reports Services
Crystal Reports Services
Crystal Reports Services
Dashboards Services
Service
Input Filestore Service
Monitoring Service
Output Filestore Service
Platform Search Scheduling
Service
Platform Search Service
Probe Scheduling Service
Program Scheduling Service
Server type
Input File Repository Server
Adaptive Processing Server
Output File Repository Server
Adaptive Job Server
Adaptive Processing Server
Adaptive Job Server
Adaptive Job Server
Publication Scheduling Service Adaptive Job Server
Publishing Post Processing
Service
Adaptive Processing Server
Publishing Service
Replication Service
Adaptive Processing Server
Adaptive Job Server
RESTful Web Service
Web Application Container
Server
Security Query Scheduling Service
Adaptive Job Server
Security Token Service
Translation Service
Crystal Reports 2011 Processing Service
Crystal Reports 2011 Scheduling Service
Adaptive Processing Server
Adaptive Processing Server
Crystal Reports Processing
Server
Adaptive Job Server
Crystal Reports 2011 Viewing and Modification Service
Crystal Reports Cache Service
Report Application Server (RAS)
Crystal Reports Processing
Service
Crystal Reports Scheduling
Service
Crystal Reports Cache Server
Crystal Reports Processing
Server
Adaptive Job Server
Dashboards Cache Service Dashboards Cache Server
2012-12-12
Architecture
Service category
Dashboards Services
Service Server type
Dashboards Processing Service Dashboards Processing Server
Adaptive Processing Server Data Federation Services
Lifecycle Management Services
Data Federation Service
LifeCycle Management
ClearCase Service
Adaptive Processing Server
Lifecycle Management Services
Lifecycle Management
Scheduling Service
Lifecycle Management Services Lifecycle Management Service
Adaptive Job Server
Adaptive Processing Server
Lifecycle Management Services
Visual Difference Scheduling
Service
Lifecycle Management Services Visual Difference Service
Web Intelligence Services
Web Intelligence Services
Web Intelligence Services
Web Intelligence Services
Web Intelligence Services
Web Intelligence Services
Web Intelligence Services
Web Intelligence Services
Web Intelligence Services
Web Intelligence Services
Web Intelligence Services
Adaptive Job Server
Custom Data Access Service
Document Recovery Service
DSL Bridge Service
Excel Data Access Service
Information Engine Service
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Web Intelligence Processing
Server
Adaptive Processing Server Rebean Service
Visualization Service Adaptive Processing Server
Web Intelligence Common Service
Web Intelligence Processing
Server
Web Intelligence Core Service
Web Intelligence Processing
Service
Web Intelligence Scheduling
Service
Web Intelligence Processing
Server
Web Intelligence Processing
Server
Adaptive Job Server
Related Topics
•
•
59 2012-12-12
Architecture
3.2.4 Server types
Note:
New services or server types may be added in future maintenance releases.
Server type
Adaptive Job Server
Adaptive Job Server
Adaptive Job Server
Adaptive Job Server
Adaptive Job Server
Adaptive Job Server
Adaptive Job Server
Adaptive Job Server
Adaptive Job Server
Adaptive Job Server
Adaptive Job Server
Adaptive Job Server
Adaptive Job Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Service Service category
Authentication Update Scheduling Service
Core Services
Crystal Reports 2011 Scheduling Service
Crystal Reports Scheduling
Service
Destination Delivery Scheduling
Service
Core Services
Lifecycle Management
Scheduling Service
Lifecycle Management Services
Platform Search Scheduling
Service
Probe Scheduling Service
Crystal Reports Services
Crystal Reports Services
Core Services
Core Services
Program Scheduling Service
Publication Scheduling Service
Core Services
Core Services
Replication Service Core Services
Security Query Scheduling Service
Core Services
Visual Difference Scheduling
Service
Web Intelligence Scheduling
Service
Lifecycle Management Services
Web Intelligence Services
Adaptive Connectivity Service
BEx Web Application Service
Client Auditing Proxy Service
Connectivity Services
Analysis Services
Core Services
60 2012-12-12
Architecture
Server type
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Adaptive Processing Server
Central Management Server
Connection Server
Connection Server
Crystal Reports Cache Server
Crystal Reports Processing
Server
Service
Custom Data Access Service
Service category
Web Intelligence Services
Data Federation Service
Document Recovery Service
DSL Bridge Service
Excel Data Access Service
Insight to Action Service
Lifecycle Management
ClearCase Service
Lifecycle Management Service
Monitoring Service
Visualization Service
Central Management Service
Lifecycle Management Services
Core Services
Multi Dimensional Analysis Service
Analysis Services
Platform Search Service Core Services
Publishing Post Processing
Service
Publishing Service
Rebean Service
Security Token Service
Translation Service
Visual Difference Service
Data Federation Services
Web Intelligence Services
Web Intelligence Services
Web Intelligence Services
Core Services
Lifecycle Management Services
Core Services
Core Services
Web Intelligence Services
Core Services
Core Services
Lifecycle Management Services
Web Intelligence Services
Core Services
Native Connectivity Service Connectivity Services
Native Connectivity Service (32bit)
Connectivity Services
Crystal Reports Cache Service
Crystal Reports 2011 Processing Service
Crystal Reports Services
Crystal Reports Services
61 2012-12-12
Architecture
Server type
Crystal Reports Processing
Server
Service
Crystal Reports Processing
Service
Service category
Crystal Reports Services
Dashboards Cache Server
Dashboards Processing Server
Dashboards Cache Service Dashboards Services
Dashboards Processing Service Dashboards Services
Dashboard Server
Event Server
Input File Repository Server
Output File Repository Server
Dashboard Service
Event Service
Input Filestore Service
Output Filestore Service
Report Application Server (RAS)
Crystal Reports 2011 Viewing and Modification Service
Web Application Container
Server
RESTful Web Service
Core Services
Core Services
Core Services
Core Services
Crystal Reports Services
Core Services
Web Intelligence Processing
Server
Web Intelligence Processing
Server
Web Intelligence Processing
Server
Web Intelligence Processing
Server
Information Engine Service
Web Intelligence Common Service
Web Intelligence Core Service
Web Intelligence Processing
Service
Web Intelligence Services
Web Intelligence Services
Web Intelligence Services
Web Intelligence Services
Related Topics
•
•
3.2.5 Servers
Servers are collections of services running under a Server Intelligence Agent (SIA) on a host. The type of server is denoted by the services running within it. Servers can be created in the Central Management
Console (CMC). The following table lists the different types of servers that can be created in the CMC.
62 2012-12-12
Architecture
Server
Adaptive Job Server
Description
General server that processes scheduled jobs. When you add a Job server to the SAP BusinessObjects Business Intelligence platform system, you can configure the Job server to process reports, documents, programs, or publications and send the results to different destinations.
Adaptive Processing Server
A generic server that hosts services responsible for processing requests from a variety of sources.
Note:
The installation program installs one Adaptive Processing Server (APS) per host system. Depending on the features that you've installed, this APS may host a large number of services, such as the Monitoring Service,
Lifecycle Management Service, Multi-Dimensional Analysis Service
(MDAS), Publishing Service, and others.
If you are installing a production environment, do not use the default APS.
Instead, it is highly recommended that once the installation process is complete, you perform a system sizing to determine:
• The type and number of APS services.
• The distribution of services across multiple APS servers.
• The optimal number of APS servers. Multiple APS servers provide redundancy, better performance, and higher reliability.
• The distribution of APS servers across multiple nodes.
Create new APS server instances as determined by the sizing process.
For example, if the outcome of your sizing happens to suggest the creation of one APS for each service category, then may end up creating eight
APS servers. One for each service category: Analysis Services, Connectivity Services, Core Services, Crystal Reports Services, Dashboards
Services, Data Federation Services, Lifecycle Management Services, and
Web Intelligence Services.
Central Management Server (CMS)
Maintains a database of information about your Business Intelligence platform system (in the CMS system database) and audited user actions
(in the Auditing Data Store). All platform services are managed by the
CMS. The CMS also controls access to the system files where documents are stored, and information on users, user groups, security levels (including authentication and authorization), and content.
Connection Server Provides database access to source data. It supports relational databases, as well as OLAP and other formats. The Connection Server is responsible for handling connection and interaction with the various data sources and providing a common feature set to clients.
63 2012-12-12
Architecture
Server
Crystal Reports Cache
Server
Description
Intercepts report requests sent from clients to the page server. If the cache server cannot fulfill the request with a cached report page, it passes the request on to the Crystal Reports Processing server, which runs the report and returns the results. The cache server then caches the report page for potential future use.
Crystal Reports Processing
Server
Responds to page requests by processing reports and generating encapsulated page format (EPF) pages. The key benefit of EPF is that it supports page-on-demand access, so only the requested page is returned, not the entire report. This improves system performance and reduces unnecessary network traffic for large reports.
Dashboards Cache Server Intercepts report requests sent from clients to the Dashboard server. If the cache server cannot fulfill the request with a cached report page, it passes the request on to the Dashboard server, which runs the report and returns the results. The cache server then caches the report page for potential future use.
Dashboards Processing
Server
Event Server
Responds to Dashboards requests by processing reports and generating encapsulated page format (EPF) pages. The key benefit of EPF is that it supports page-on-demand access, so only the requested page is returned, not the entire report. This improves system performance and reduces unnecessary network traffic for large reports.
Monitors the system for events, which can act as a trigger for running a report. When you set up an event trigger, the Event Server monitors the condition and notifies the CMS that an event has occurred. The CMS can then start any jobs that are set to run on the event. The Event Server manages file-based events, which occur in the storage tier.
File Repository Server Responsible for the creation of file system objects, such as exported reports, and imported files in non-native formats. An Input FRS stores report and program objects that have been published to the system by administrators or end users. An Output FRS stores all of the report instances generated by the Job Server.
Web Intelligence Processing Server
Processes SAP BusinessObjects Web Intelligence documents.
Report Application Server Provides ad-hoc reporting capabilities that allow users to create and modify Crystal reports via the SAP Crystal Reports Server Embedded
Software Development Kit (SDK).
3.3 Client applications
64 2012-12-12
Architecture
You can interact with SAP BusinessObjects Business Intelligence platform using two main types of client applications:
• Desktop applications
These applications must be installed on a supported Microsoft Windows operating system, and can process data and create reports locally.
Note:
The SAP BusinessObjects Business Intelligence platform installation program no longer installs desktop applications. To install desktop application on a server, use the stand-alone SAP
BusinessObjects Business Intelligence platform Client Tools installation program.
Desktop clients allow you to offload some BI report processing onto individual client computers.
Most desktop applications directly access your organization's data through drivers installed on the desktop, and communicate with your SAP BusinessObjects Business Intelligence platform deployment through CORBA or encrypted CORBA SSL.
Examples of this type of application include: SAP Crystal Reports 2011 and Live Office.
Note:
Although Live Office is a rich functionality application, it interfaces with SAP BusinessObjects Business
Intelligence platform web services over HTTP.
• Web applications
These applications are hosted by a web application server and can be accessed with a supported web browser on Windows, Macintosh, Unix, and Linux operating systems.
This allows you to provide business intelligence (BI) access to large groups of users, without the challenges of deploying desktop software products. Communication is conducted over HTTP, with or without SSL encryption (HTTPS).
Examples of this type of application include BI launch pad, SAP BusinessObjects Web Intelligence, the Central Management Console (CMC), and report viewers.
3.3.1 Installed with SAP BusinessObjects Business Intelligence Platform Client Tools
65
3.3.1.1 Web Intelligence Desktop
Web Intelligence Desktop is an ad-hoc analysis and reporting tool for business users with or without access to the SAP BusinessObjects Business Intelligence platform.
2012-12-12
Architecture
It allows business users to access and combine data from relational, online analytical processing (OLAP), spreadsheet, or text file sources, using familiar business terms in a drag-and-drop interface. Workflows allow very broad or very narrow questions to be analyzed, and for further questions to be asked at any point in the analysis workflow.
Web Intelligence Desktop users can continue to working with Web Intelligence document files (.wid) even when unable to connect to a Central Management Server (CMS).
3.3.1.2 Business View Manager
Business View Manager allows users to build semantic layer objects that simplify underlying database complexity.
Business View Manager can create data connections, dynamic data connections, data foundations, business elements, business views, and relational views. It also allows detailed column and row-level security to be set for the objects in a report.
Designers can build connections to multiple data sources, join tables, alias field names, create calculated fields, and then use the simplified structure as a Business View. Report designers and users can then use the business view as the basis for their reports, rather than and building their own queries from the data directly.
3.3.1.3 Report Conversion Tool
The Report Conversion Tool converts reports to Web Intelligence format and publishes them to a Central
Management Server (CMS).
Reports can be retrieved from the CMS folders Public, Favorites, or Inbox. Once converted, reports publish to the same folder as the original Web Intelligence report, or to a different folder. The tool does not convert all Web Intelligence features and reports. The level of conversion depends on the features in the original report. Some features prevent the report from being converted. Other features are modified, reimplemented, or removed by the tool during conversion.
The Report Conversion Tool also lets you audit your converted reports. This helps identify reports that cannot be fully converted by the Report Conversion Tool and explains why.
3.3.1.4 Universe design tool
66 2012-12-12
Architecture
Universe design tool (formerly Universe Designer) allows data designers to combine data from multiple sources in a semantic layer that hides database complexity from end users. It abstracts the complexity of data by using business rather than technical language to access, manipulate, and organize data.
Universe design tool provides a graphical interface to select and view tables in a database. The database tables are represented as table symbols in a schema diagram. Designers can use this interface to manipulate tables, create joins between tables, create alias tables, create contexts, and solve loops in a schema.
You can also create universes from metadata sources. Universe design tool is used for the universe generation at the end of the creation process.
3.3.1.5 Query as a Web Service
Query as a Web Service is a wizard-based application that allows queries to be made into a web service and integrated with web-ready applications. Queries can be saved to create a catalog of standard queries that application builders can select as required.
Business Intelligence (BI) content is usually bound to a specific user interface of BI tools. Query as a
Web Service changes this by allowing BI content to be delivered to any user interface that can process web services.
Query as a Web Service is designed to work on top of any Microsoft Windows application the same way as other web services. Query as a Web Service is based on the W3C web service specifications
SOAP, SDL, and XML. It has two main components:
• Server component
The server component (included in Business Intelligence platform) stores the Query as a Web
Service catalog and hosts the published web services.
• Client tool
This is how business users create and publish their queries as a web service on the server. You can install the client tool on several machines that can access and share the same catalog stored on the server. The client tool communicates with the server components via web services.
Query as a Web Service allows web queries to be used as part of a range of client-side solutions, including:
• Microsoft Office, Excel, and InfoPath
• SAP NetWeaver
• OpenOffice
• Business rules and process management applications
• Enterprise Service Bus platforms
67 2012-12-12
Architecture
68
3.3.1.6 Information design tool
Information design tool (formerly Information Designer) is an SAP BusinessObjects metadata design environment that enables a designer to extract, define, and manipulate metadata from relational and
OLAP sources to create and deploy SAP BusinessObjects universes.
3.3.1.7 Translation Management Tool
SAP BusinessObjects Business Intelligence platform provides support for multilingual documents and universes. A multilingual document contains localized versions of universe metadata and document prompts. A user can create reports, for example, from the same universe in their chosen languages.
Translation Management Tool (formerly Translation Manager) defines the multilingual universes and manages translation of universes and other report and analytic resources in the CMS repository.
Translation Management Tool:
• Translates universe or documents for a multilingual audience.
• Defines the metadata language parts of a document, and the appropriate translation. It generates external XLIFF format and imports XLIFF files to get translated information.
• Lists the universe or document structure to be translated.
• Lets you translate the metadata through the user interface, or though an external translation tool by importing and exporting XLIFF files.
• Creates multilingual documents.
3.3.1.8 Data Federation Administration Tool
The Data Federation Administration Tool (formerly Data Federator) is a rich client application that offers easy-to-use features to manage your data federation service.
Tightly integrated in the SAP BusinessObjects Business Intelligence platform, the data federation service enables multi-source universes by distributing queries across disparate data sources, and lets you federate data through a single data foundation.
The data federation administration tool lets you optimize data federation queries and fine-tune the data federation query engine for the best possible performance.
You use the data federation administration tool to do the following:
2012-12-12
Architecture
• Test SQL queries.
• Visualize optimization plans which detail how federated queries are distributed to each source.
• Compute “statistics” and set system parameters to fine-tune the data federation services and get the best possible performance.
• Manage properties to control how queries are executed in each data source at the connector level.
• Monitor running SQL queries.
• Browse the history of executed queries.
69
3.3.1.9 Widgets for SAP BusinessObjects Business Intelligence platform
Widgets are mini-applications that allow easy and fast access to frequently used functions and provide visual information from your desktop. Widgets for SAP BusinessObjects Business Intelligence platform
(formerly BI Widgets) allows your organization to provide access to existing Business Intelligence (BI) content on SAP BusinessObjects Business Intelligence platform, or you can add Web Dynpro applications that are registered as XBCML (Extensible Business Client Markup Language) widgets on the SAP
NetWeaver Application Servers as desktop widgets.
To render XBCML widgets on the user's desktop, SAP Web Dynpro Flex Client is used. The SAP Web
Dynpro Flex Client is a rendering engine based on Adobe Flex which is used for rendering widgets. For details about how to configure Web Dynpro applications, see the To enable widgets on the SAP
NetWeaver Application Server topic in the Widgets for SAP BusinessObjects User Guide.
Note:
The SAP Web Dynpro Flex Client support for XBCML Widgets begins in release 7.0 EhP2 SP3. Flex
Client queue support is confined only to Flex Client issues found in XBCML widgets in these specified releases.
With widgets for SAP BusinessObjects Business Intelligence platform, you search or browse for existing content, such as Web Intelligence documents, Dashboards models, and Web Dynpro applications, then paste the information onto your desktop so it is available when needed.
As a widget, the content gains the following features from the widget framework:
• User-controlled size and positioning
• Automatic refresh
• Optional setting as the top application window
• Full SAP BusinessObjects Business Intelligence platform security (Web Intelligence report parts and Dashboards models only)
• Saved display
• Saved data context state (Web Intelligence report parts only)
• Web Intelligence OpenDocument links to detailed reports (Web Intelligence documents only)
• Tabbed views (Dashboards models only)
2012-12-12
Architecture
3.3.2 Installed with SAP BusinessObjects Business Intelligence Platform
3.3.2.1 Central Configuration Manager
The Central Configuration Manager (CCM) is a server troubleshooting and node management tool that is provided in two forms. On Windows, you use the CCM to manage local and remote servers, in the
CCM user interface (UI) or from a command line. On Unix, you use the CCM shell script (ccm.sh) to manage servers from a command line.
The CCM allows you to create and configure nodes and to start or stop your web application server, if it is the default bundled Tomcat web application server. On Windows, you can use the CCM to configure network parameters, such as Secure Socket Layer (SSL) encryption. The parameters apply to all servers in a node.
Note:
Most server management tasks are handled in the CMC, not the CCM. The CCM is used for troubleshooting and node configuration.
70
3.3.2.2 Upgrade management tool
Upgrade management tool (formerly Import Wizard) is installed as a part of SAP BusinessObjects
Business Intelligence platform, and guides administrators through the process of importing users, groups, and folders from previous versions of SAP BusinessObjects Business Intelligence platform. It also allows you to import and upgrade objects, events, server groups, repository objects, and calendars.
For information on upgrading from a previous version of SAP BusinessObjects Business Intelligence platform, see the SAP BusinessObjects Business Intelligence Platform Upgrade Guide.
3.3.2.3 Repository Diagnostic Tool
The Repository Diagnostic Tool (RDT) scans, diagnoses, and repairs inconsistencies between the
Central Management Server (CMS) system database and the File Repository Servers (FRS) filestore and then reports the repair status and completed actions.
2012-12-12
Architecture
You can use the RDT to synchronize the file system and database, after a user restores the system from a hot backup or after a restoration (before starting Business Intelligence platform services). Users can set a limit for the number of errors the RDT finds and repairs before stopping.
3.3.3 Available separately
3.3.3.1 SAP BusinessObjects Analysis, edition for Microsoft Office
SAP BusinessObjects Analysis, edition for Microsoft Office is a premium alternative to Business Explorer
(BEx) and allows business analysts to explore multi-dimensional online analytical processing (OLAP) data.
Analysts can quickly answer business questions and then share their analysis and workspace with others as analyses.
SAP BusinessObjects Analysis, edition for Microsoft Office enables analysts to:
• Discover trends, outliers, and details stored in financial systems without the help of a database administrator.
• Get answers to business questions while viewing large or small multi-dimensional data sets efficiently.
• Access the full range of OLAP data sources available within the organization and share results using a simple, intuitive interface.
• Access multiple different OLAP sources in the same analyses to get a comprehensive view of the business and the cross-impact that one trend may have on another.
• Interrogate, analyze, compare, and forecast business drivers.
• Use a comprehensive range of business and time calculations.
3.3.3.2 SAP Crystal Reports
SAP Crystal Reports software enables users to design interactive reports from a data source.
3.3.3.3 SAP BusinessObjects Dashboards
71 2012-12-12
Architecture
SAP BusinessObjects Dashboards (formerly Xcelsius) is a tool for data visualization and the creation of dynamic, interactive dashboards. Data and formulae are imported or directly entered into an embedded
Excel spreadsheet. A Flash interface provides a canvas that can display a variety of analytics and dashboards.
Data can be updated dynamically from SAP BusinessObjects Business Intelligence platform, and exported to a variety of different formats that can be viewed by data consumers in standard formats, such as PowerPoint, PDF, or Flash.
3.3.3.4 SAP BusinessObjects Explorer
SAP BusinessObjects Explorer is a data discovery application that uses a powerful search capability to retrieve answers to business questions from corporate data quickly and directly.
When you install SAP BusinessObjects Explorer, the following servers are added to the SAP
BusinessObjects Business Intelligence platform Central Configuration Manager (CCM) and Central
Management Console (CMC):
• Explorer Master Server: manages all of the Explorer servers.
• Explorer Indexing Server: provides and manages the indexing of information space data and metadata.
• Explorer Search Server: processes search queries and returns the results.
• Explorer Exploration Server: provides and manages the information space exploration and analysis capabilities including search on data, filtering and aggregation.
3.3.4 Web application clients
Web application clients reside on a web application server, and are accessed on a client web browser.
Web applications are automatically deployed when you install SAP BusinessObjects Business Intelligence platform.
Web applications are easy for users to access from a web browser, and communication can be secured with SSL encryption if you plan to allow users access from outside your organization's network.
Java web applications can also be reconfigured or deployed after the initial installation by using the bundled WDeploy command-line tool, which allows you to deploy web applications to a web application server in two ways:
1.
Standalone mode
All web application resources are deployed to a web application server that serves both dynamic and static content. This arrangement is suitable for small installations.
2.
Split mode
72 2012-12-12
Architecture
The web application's static content (HTML, images, CSS) is deployed to a dedicated web server, while dynamic content (JSPs) is deployed to a web application server. This arrangement is suitable for larger installations that will benefit from the web application server being freed up from serving static web content.
For more information about WDeploy, see the SAP BusinessObjects Business Intelligence Platform
Web Application Deployment Guide.
3.3.4.1 Central Management Console (CMC)
The Central Management Console (CMC) is a web-based tool that you use to perform administrative tasks (including user, content, and server management) and to configure security settings. Because the CMC is a web-based application, you can perform all of the administrative tasks in a web browser on any computer that can connect to the web application server.
All users can log on to the CMC to change their own preference settings. Only members of the
Administrators group can change management settings, unless a user is explicitly granted rights to do so. Roles can be assigned in the CMC to grant user privileges to perform minor administrative tasks, such as managing users in your group and managing reports in folders that belong to your team.
73
3.3.4.2 BI launch pad
BI launch pad (formerly InfoView) is a web-based interface that end users access to view, schedule, and keep track of published business intelligence (BI) reports. BI launch pad can access, interact with, and export any type of business intelligence, including reports, analytics, and dashboards.
2012-12-12
Architecture
BI launch pad allows users to manage:
• BI content browsing and searching
• BI content access (creating, editing, and viewing)
• BI content scheduling and publishing
3.3.4.3 BI workspaces
BI workspaces (formerly Dashboard Builder) helps you track your business activities and performance using modules (templates for data) and Business Intelligence (BI) workspaces (viewing data in one or more modules). Modules and BI workspaces provide information needed to adjust business rules as conditions change. It helps you track and analyze key business data via management BI workspaces and modules. It also supports group decision-making and analysis via integrated collaboration and workflow capabilities. BI workspaces provides the following features:
• Tab-based browsing
• Page creation: Manage BI workspaces and modules
• A point and click application builder
• Content linking between modules for in-depth data analysis
Note:
BI workspaces is an integral part of the BI launch pad application. Therefore, to use the BI workspaces features, you must purchase an SAP BusinessObjects Business Intelligence platform license that includes BI launch pad as part of the agreement.
74
3.3.4.4 Report viewers
Each report viewer supports a different platform and a different browser. There are two categories of viewers:
• Client-side report viewers (Active X viewer and Java viewer)
Client-side report viewers are downloaded and installed on a user's browser. When a user requests a report, the application server processes the request and retrieves the report pages from SAP
BusinessObjects Business Intelligence platform. The web application server then passes the report pages to the client-side viewer, which processes the pages and displays them in a web browser.
To choose a client-side report viewer, select Preferences > Crystal Reports > Web ActiveX
(ActiveX required) or Web Java (Java required).
• Zero-client report viewers (DHTML viewer)
Zero-client report viewers reside on the web application server. When a user requests a report, the web application server retrieves the report pages from Business Intelligence platform and creates
2012-12-12
Architecture
DHTML pages that appear in a browser. To choose the zero-client report (DHTML) viewer, select
Preferences > Crystal Reports > Web (no downloading required).
All report viewers process report requests and present report pages that appear in a browser.
For more information on the specific functionality or platform support provided by each report viewer, see the
BI Launch Pad User Guide, Report Application Server .NET SDK Developer Guide, or Viewers
Java SDK Developer Guide.
3.3.4.5 SAP BusinessObjects Web Intelligence
SAP BusinessObjects Web Intelligence is a web-based tool that provides query, reporting, and analysis functionality for relational data sources in a single web-based product.
It allows users to create reports, perform ad-hoc queries, analyze data, and format reports in a drag-and-drop interface. Web Intelligence hides the complexity of underlying data sources.
Reports can be published to a supported web portal, or to Microsoft Office applications using SAP
BusinessObjects Live Office.
3.3.4.6 SAP BusinessObjects Analysis, edition for OLAP
SAP BusinessObjects Analysis, edition for OLAP (formerly Voyager) is an online analytical processing
(OLAP) tool in the BI launch pad portal for working with multi-dimensional data. It can also combine information from different OLAP data sources within a single workspace. Supported OLAP providers include SAP BW and Microsoft Analysis Services.
The Analysis OLAP feature set combines elements of SAP Crystal Reports (direct data access to OLAP cubes for production reporting) and SAP BusinessObjects Web Intelligence (ad-hoc analytic reporting with universes from OLAP data sources). It offers a range of business and time calculations, and includes features such as time sliders to make the analysis of OLAP data as simple as possible.
Note:
The Analysis, edition for OLAP web application is available only as a Java web application. There is no corresponding application for .NET.
3.3.4.7 SAP BusinessObjects Mobile
75 2012-12-12
Architecture
SAP BusinessObjects Mobile allows your users to remotely access the same business intelligence (BI) reports, metrics, and real-time data available on desktop clients from a wireless device. Content is optimized for mobile devices so your users can easily access, navigate, and analyze familiar reports without additional training.
With SAP BusinessObjects Mobile, management and information workers can stay up-to-date and make decisions using the latest information. Sales and field service staff can provide the right customer, product, and work order information where and when it's needed.
SAP BusinessObjects Mobile supports a broad set of mobile devices including BlackBerry, Windows
Mobile, and Symbian.
For information on mobile installation, configuration, and deployment, see the
SAP BusinessObjects
Mobile Installation and Deployment Guide. For information on using SAP BusinessObjects Mobile, see the
Using SAP BusinessObjects Mobile Guide.
3.4 Process Workflows
When tasks are performed such as logging in, scheduling a report, or viewing a report, information flows through the system and the servers communicate with each other. The following section describes some of the process flows as they would happen in the BI platform.
To view additional process workflows with visual aids, see the SAP BusinessObjects Business Intelligence
4.x platform Official Product Tutorials at: http://scn.sap.com/docs/DOC-8292
3.4.1 Startup and authentication
76
3.4.1.1 Logging on to SAP BusinessObjects Business Intelligence platform
This workflow describes a user logging on to a SAP BusinessObjects Business Intelligence platform web application from a web browser. This workflow applies to web applications such as BI launch pad and the Central Management Console (CMC).
1.
The browser (web client) sends the login request via the web server to the web application server, where the web application is running.
2.
The web application server determines that the request is a logon request. The web application server sends the username, password, and authentication type to the CMS for authentication.
2012-12-12
Architecture
77
3.
The CMS validates the username and password against the appropriate database. In this case,
Enterprise authentication is used, and user credentials are authenticated against the CMS system database).
4.
Upon successful validation, the CMS creates a session for the user in memory.
5.
The CMS sends a response to the web application server to let it know that the validation was successful.
6.
The web application server generates a logon token for the user session in memory. For the rest of this session, the web application server uses the logon token to validate the user against the CMS.
The web application server generates the next web page to send to the web client.
7.
The web application server sends the next web page to the web server.
8.
The web server sends the web page to the web client where it is rendered in the user's browser.
3.4.1.2 SIA start-up
A Server Intelligence Agent (SIA) can be configured to start automatically with the host operating system, or can be started manually with Central Configuration Manager (CCM).
A SIA retrieves information about the servers it manages from a Central Management Server (CMS).
If the SIA uses a local CMS, and that CMS is not running, the SIA starts the CMS. If a SIA uses a remote
CMS, it attempts to connect to the CMS.
Once a SIA is started, the following sequence of events is performed.
1.
The SIA looks in its cache to locate a CMS.
a.
If the SIA is configured to start a local CMS, and the CMS is not running, the SIA starts the CMS and connects.
b.
If the SIA is configured to use a running CMS (local or remote), it attempts to connect to the first
CMS in its cache. If the CMS is not currently available, it attempts to connect to the next CMS in the cache. If none of the cached CMSs are available, the SIA waits for one to become available.
2.
The CMS confirms the SIA's identity to ensure that it is valid.
3.
Once the SIA has successfully connected to a CMS, it requests a list of servers to manage.
Note:
A SIA does not store information about the servers it manages. The configuration information that dictates which server is managed by a SIA is stored in the CMS system database and is retrieved from the CMS by the SIA when it starts.
4.
The CMS queries the CMS system database for a list of servers managed by the SIA. The configuration for each server is also retrieved.
5.
The CMS returns the list of servers, and their configuration, to the SIA.
6.
For each server configured to start automatically, the SIA starts it with the appropriate configuration and monitors its state. Each server started by the SIA is configured to use the same CMS used by the SIA.
Any servers not configured to start automatically with the SIA will not start.
2012-12-12
Architecture
3.4.1.3 SIA shutdown
You can automatically stop the Server Intelligence Agent (SIA) by shutting down the host operating system, or you can manually stop the SIA in the Central Configuration Manager (CCM).
When the SIA shuts down, the following steps are performed.
• The SIA tells the CMS that it is shutting down.
a.
If the SIA is stopping because the host operating system is shutting down, the SIA requests its servers to stop. Servers that do not stop within 25 seconds are forcefully terminated.
b.
If the SIA is being stopped manually, it will wait for the managed server to finish processing existing jobs. Managed servers will not accept any new jobs. Once all jobs are complete, the servers stop. Once all servers have stopped, the SIA stops too.
During a forced shutdown, the SIA tells all managed servers to stop immediately.
3.4.2 Program objects
3.4.2.1 Setting a schedule for a program object
This workflow describes the process of a user scheduling a program object to be run at a future time from a web application such as the Central Management Console (CMC) or BI launch pad.
1.
The user sends the schedule request from the web client via the web server to the web application server.
2.
The web application server interprets the request and determines that the request is a schedule request. The web application server sends the schedule time, database login values, parameter values, destination, and format to the specified Central Management Server (CMS).
3.
The CMS ensures that the user has rights to schedule the object. If the user has sufficient rights, the CMS adds a new record to the CMS system database. The CMS also adds the instance to its list of pending schedules.
4.
The CMS sends a response to the web application server to let it know that the schedule operation was successful.
5.
The web application server generates the next HTML page and sends it via the web server to the web client.
78 2012-12-12
Architecture
3.4.2.2 A scheduled program object runs
This workflow describes the process of a scheduled program object running at a scheduled time.
1.
The Central Management Server (CMS) checks the CMS system database to determine if there is any scheduled SAP Crystal report to be run at that time.
2.
When scheduled job time arrives, the CMS locates an available Program Scheduling Service running on an Adaptive Job Server. The CMS sends the job information to the Program Scheduling Service.
3.
The Program Scheduling Service communicates with the Input File Repository Server (FRS) to obtain the program object.
Note:
This step also requires communication with the CMS to locate the required server and objects.
4.
The Program Scheduling Service launches the program.
5.
The Program Scheduling Service updates the CMS periodically with the job status. The current status is Processing.
6.
The Program Scheduling Service sends a log file to the Output FRS. The Output FRS notifies the
Program Scheduling Service that the object was scheduled successfully by sending an object log file.
Note:
This step also requires communication with the CMS to locate the required server and objects.
7.
The Program Scheduling Service updates the CMS with the job status. The current status is Success.
8.
The CMS updates the job status in its memory and then writes the instance information to the CMS system database.
3.4.3 Crystal Reports
79
3.4.3.1 Viewing a cached SAP Crystal report page
This workflow describes the process of a user requesting a page in an SAP Crystal report (for example from the report viewer in BI launch pad), when the report page already exists on a cache server. This workflow applies to both SAP Crystal Reports 2011 and SAP Crystal Reports for Enterprise.
1.
The web client sends a view request in a URL via the web server to the web application server.
2012-12-12
Architecture
80
2.
The web application server interprets the request and determines that it is a request to view a selected report page. The web application server sends a request to the Central Management Server
(CMS) to ensure that the user has sufficient rights to view the report.
3.
The CMS checks the CMS system database to verify the user has sufficient rights to view the report.
4.
The CMS sends a response to the web application server to confirm the user has sufficient rights to view the report.
5.
The web application server sends a request to the Crystal Reports Cache Server requesting the page of the report (.epf file).
6.
The Crystal Reports Cache Server checks to see if the requested .epf file exists in the cache directory. In this example, the.epf file is found.
7.
The Crystal Reports Cache Server returns the requested page to the web application server.
8.
The web application server sends the page to the web client via the web server, where the page is rendered and displayed.
3.4.3.2 Viewing a non-cached SAP Crystal Reports 2011 page
This workflow describes the process of a user requesting a page in an SAP Crystal Reports 2011 report
(for example from the report viewer in BI launch pad), when the page does not already exist on a cache server.
1.
The user sends the view request through the web server to the web application server.
2.
The web application server interprets the request and determines that it is a request to view a selected report page. The web application server sends a request to the Central Management Server
(CMS) to ensure that the user has sufficient rights to view the report.
3.
The CMS checks the CMS system database to verify the user has sufficient rights to view the report.
4.
The CMS sends a response to the web application server to confirm the user has sufficient rights to view the report.
5.
The web application server sends a request to the Crystal Reports Cache Server requesting the page of the report (.epf file).
6.
The Crystal Reports Cache Server determines if the requested file exists in the cache directory. In this example, the requested .epf file is not found in the cache directory.
7.
The Crystal Reports Cache Server sends the request to the Crystal Reports 2011 Processing Server.
8.
The Crystal Reports 2011 Processing Server queries the Output File Repository Server (FRS) for the requested report instance. The Output FRS sends the requested report instance to the Crystal
Reports 2011 Processing Server.
Note:
This step also requires communication with the CMS to locate the required server and objects.
9.
The Crystal Reports 2011 Processing Server opens the report instance and checks the report to determine if it has data. The Crystal Reports 2011 Processing Server determines that the report contains data and creates the .epf file for the requested report page without having to connect to the production database.
2012-12-12
Architecture
10.
The Crystal Reports 2011 Processing Server sends the .epf file to the Crystal Reports Cache
Server.
11.
The Crystal Reports Cache Server writes the .epf file to the cache directory.
12.
The Crystal Reports Cache Server sends the requested page to the web application server.
13.
The web application server sends the page to the web client via the web server, where the page is rendered and displayed.
3.4.3.3 Viewing an SAP Crystal Reports 2011 report on demand
This workflow describes the process of a user requesting an SAP Crystal Reports 2011 report page on demand to see the latest data. For example, from the report viewer in BI launch pad.
1.
The user sends the view request through the web server to the web application server.
2.
The web application server interprets the request and determines that it is a request to view a selected report page. The web application server sends a request to the Central Management Server
(CMS) to ensure that the user has sufficient rights to view the report.
3.
The CMS checks the CMS system database to verify the user has sufficient rights to view the report.
4.
The CMS sends a response to the web application server to confirm the user has sufficient rights to view the report.
5.
The web application server sends a request to the Crystal Reports Cache Server requesting the page of the report (.epf file).
6.
The Crystal Reports Cache Server checks to see if the page already exists. Unless the report meets the requirements for on demand report sharing (within a set time of another on demand request, database login, parameters), the Crystal Reports Cache Server sends a request for the Crystal
Reports 2011 Processing Server to generate the page.
7.
The Crystal Reports 2011 Processing Server requests the report object from the Input File Repository
Server (FRS). The Input FRS streams a copy of the object to the Crystal Reports 2011 Processing
Server.
Note:
This step also requires communication with the CMS to locate the required server and objects.
8.
The Crystal Reports 2011 Processing Server opens the report in its memory and checks to see if the report contains data. In this example, there is no data in the report object, the Crystal Reports
2011 Processing Server connects to the data source to retrieve data and generate the report.
9.
The Crystal Reports 2011 Processing Server sends the page (.epf file) to the Crystal Reports
Cache Server. The Crystal Reports Cache Server stores a copy of the .epf file in its cache directory in anticipation of new viewing requests.
10.
The Crystal Reports Cache Server sends the page to the web application server.
11.
The web application server sends the page to the web client via the web server, where the page is rendered and displayed.
81 2012-12-12
Architecture
82
3.4.3.4 Setting a schedule for an SAP Crystal report
This workflow describes the process of a user scheduling an SAP Crystal report to be run at a future time from a web application such as the Central Management Console (CMC) or BI launch pad. This workflow applies to both SAP Crystal Reports 2011 and SAP Crystal Reports for Enterprise.
1.
The web client submits a schedule request in a URL via the web server to the web application server.
2.
The web application server interprets the URL request and determines that the request is a schedule request. The web application server sends the schedule time, database login values, parameter values, destination, and format to the specified Central Management Server (CMS).
3.
The CMS ensures that the user has rights to schedule the object. If the user has sufficient rights, the CMS adds a new record to the CMS system database. The CMS also adds the instance to its list of pending schedules.
4.
The CMS sends a response to the web application server to let it know that the schedule operation was successful.
5.
The web application server generates the next HTML page and sends it via the web server to the web client.
3.4.3.5 A scheduled SAP Crystal Reports 2011 report runs
This workflow describes the process of a scheduled SAP Crystal Reports 2011 report running at a scheduled time.
1.
The Central Management Server (CMS) checks the CMS system database to determine if there is any scheduled SAP Crystal report to be run at that time.
2.
When scheduled job time arrives, the CMS locates an available Crystal Reports 2011 Scheduling
Service running on an Adaptive Job Server (based on the Maximum Jobs Allowed value configured on each Adaptive Job Server). The CMS sends the job information (report ID, format, destination, logon information, parameters, and selection formulas) to the Crystal Reports 2011 Scheduling
Service.
3.
The Crystal Reports 2011 Scheduling Service communicates with the Input File Repository Server
(FRS) to obtain a report template as per the requested report ID.
Note:
This step also requires communication with the CMS to locate the required server and objects.
4.
The Crystal Reports 2011 Scheduling Service starts the JobChildserver process.
5.
The child process (JobChildserver) starts ProcReport.dll when it receives the template from the
Input File Repository Server. ProcReport.dll contains all of the parameters that were passed from the CMS to the Crystal Reports 2011 Scheduling Service.
2012-12-12
Architecture
6.
ProcReport.dll
starts crpe32.dll, which processes the report according to the parameters passed.
7.
While crpe32.dll is still processing the report, records are retrieved from the data source as defined in the report.
8.
The Crystal Reports 2011 Scheduling Service updates the CMS periodically with the job status. The current status is Processing.
9.
Once the report is compiled into the memory of the Crystal Reports 2011 Scheduling Service, it may be exported to a different format, such as Portable Document Format (PDF). When exporting to
PDF, crxfpdf.dll is used.
10.
The report with saved data is submitted to the scheduled location (such as email), and then it is sent to the Output FRS.
Note:
This step also requires communication with the CMS to locate the required server and objects.
11.
The Crystal Reports 2011 Scheduling Service updates the CMS with the job status. The current status is Success.
12.
The CMS updates the job status in its memory and then writes the instance information to the CMS system database.
3.4.4 Web Intelligence
3.4.4.1 Viewing an SAP BusinessObjects Web Intelligence document on demand
This workflow describes the process of a user viewing an SAP BusinessObjects Web Intelligence document on demand to see the latest data. For example, from the Web Intelligence viewer in BI launch pad.
1.
A web browser sends the view request to the web application server via the web server.
2.
The web application server interprets the request and determines that it is a request to view a Web
Intelligence document. The web application server sends a request to the Central Management
Server (CMS) to ensure that the user has sufficient rights to view the document.
3.
The CMS checks the CMS system database to verify the user has sufficient rights to view the document.
4.
The CMS sends a response to the web application server to confirm the user has sufficient rights to view the document.
5.
The web application server sends a request to the Web Intelligence Processing Server, requesting the document.
83 2012-12-12
Architecture
6.
The Web Intelligence Processing Server requests the document from the Input File Repository
Server (FRS) as well as the universe file on which the requested document is built. The universe file contains metalayer information, including row-level and column-level security.
7.
The Input FRS streams a copy of the document to the Web Intelligence Processing Server, as well as the universe file on which the requested document is built.
Note:
This step also requires communication with the CMS to locate the required server and objects.
8.
The Web Intelligence Report Engine (on the Web Intelligence Processing Server) opens the document in memory and launches QT.dll and a Connection Server in process.
9.
QT.dll
generates, validates, and regenerates the SQL and connects to the database to run the query. The Connection Server uses the SQL to get the data from the database to the Report Engine where the document is processed.
10.
The Web Intelligence Processing Server sends the viewable document page that was requested to the web application server.
11.
The web application server sends the document page to the web client via the web server, where the page is rendered and displayed
3.4.4.2 Setting a schedule for an SAP BusinessObjects Web Intelligence document
This workflow describes the process of a user scheduling an SAP BusinessObjects Web Intelligence document to be run at a future time from a web application such as the Central Management Console
(CMC) or BI launch pad.
1.
The web client submits a schedule request in a URL via the web server to the web application server.
2.
The web application server interprets the URL request and determines that the request is a schedule request. The web application server sends the schedule time, database login values, parameter values, destination, and format to the specified Central Management Server (CMS).
3.
The CMS ensures that the user has rights to schedule the object. If the user has sufficient rights, the CMS adds a new record to the CMS system database. The CMS also adds the instance to its list of pending schedules.
4.
The CMS sends a response to the web application server to let it know that the schedule operation was successful.
5.
The web application server generates the next HTML page and sends it via the web server to the web client.
84
3.4.4.3 A scheduled SAP BusinessObjects Web Intelligence document runs
This workflow describes the process of a scheduled SAP BusinessObjects Web Intelligence document running at a scheduled time.
2012-12-12
Architecture
1.
The Central Management Server (CMS) checks the CMS system database to determine if a Web
Intelligence document is scheduled to run.
2.
When the scheduled time arrives, the CMS locates an available Web Intelligence Scheduling Service running on an Adaptive Job Server. The CMS sends the schedule request and all information about the request to the Web Intelligence Scheduling Service.
3.
The Web Intelligence Scheduling Service locates an available Web Intelligence Processing Server based on the Maximum Connections value configured on each Web Intelligence Processing Server.
4.
The Web Intelligence Processing Server determines the location of the Input File Repository Server
(FRS) that houses the document and the universe metalayer file on which the document is based.
The Web Intelligence Processing Server then requests the document from the Input FRS. The Input
FRS locates the Web Intelligence document as well as the universe file on which the document is based and then streams them to the Web Intelligence Processing Server.
Note:
This step also requires communication with the CMS to locate the required server and objects.
5.
The Web Intelligence document is placed in a temporary directory on the Web Intelligence Processing
Server. The Web Intelligence Processing Server opens the document in memory. QT.dll generates the SQL from the universe on which the document is based. The Connection Server libraries included in the Web Intelligence Processing Server connect to the data source. The query data passes through
QT.dll
back to the Report Engine in the Web Intelligence Processing Server, where the document is processed. A new successful instance is created.
6.
The Web Intelligence Processing Server uploads the document instance to the Output FRS.
Note:
This step also requires communication with the CMS to locate the required server and objects.
7.
The Web Intelligence Processing Server notifies the Web Intelligence Scheduling Service (on the
Adaptive Job Server) that document creation is completed. If the document is scheduled to go to a destination (file system, FTP, SMTP, or Inbox), the Adaptive Job Server retrieves the processed document from the Output FRS and delivers it to the specified destination(s). Assume that this is not the case in this example.
8.
The Web Intelligence Scheduling Service updates the CMS with the job status.
9.
The CMS updates the job status in its memory, and then writes the instance information to the CMS system database.
3.4.5 Analysis
3.4.5.1 Viewing an SAP Analysis, OLAP edition workspace
85 2012-12-12
Architecture
This workflow describes the process of a user requesting to view an SAP Analysis, OLAP edition workspace from BI launch pad.
1.
The web client sends a request via the web server to the web application server to view a new workspace. The web client communicates with the web application server using DHTML AJAX technology (Asynchronous JavaScript and XML). The AJAX technology allows for partial page updates, so a new page does not have to be rendered for each new request.
2.
The web application server translates the request and sends it to the Central Management Server
(CMS) to determine whether a user is entitled to view or create a new workspace.
3.
The CMS retrieves the user's credentials from the CMS system database.
4.
If the user is allowed to view or create a workspace, the CMS confirms this to the web application server. At the same time, it also sends a list of one or more available Multi-Dimensional Analysis
Service (MDAS).
5.
The web application server picks an MDAS from the list of available choices and sends a CORBA request to the service to find the appropriate OLAP server(s) to create a new, or refresh an existing, workspace.
6.
The MDAS needs to communicate with the Input File Repository Server (FRS) to retrieve the appropriate workspace document that has information about the underlying OLAP database and an initial OLAP query saved with it. The Input FRS retrieves the appropriate Advanced Analyzer workspace from the underlying directory and streams that workspace back to the MDAS.
7.
The MDAS opens the workspace, formulates a query, and sends it to the OLAP database server.
The MDAS has to have an appropriate OLAP database client configured for the OLAP data source.
The translation of the web client query into the appropriate OLAP query needs to occur. The OLAP database server sends the query result back to the MDAS.
8.
The MDAS, based on the request to either create, view, print, or export, pre-renders the result to enable the Java WAS to finish the rendering more quickly. The MDAS sends XML packages of the rendered result back to the web application server.
9.
The web application server renders the workspace and sends the formatted page or portion of the page to the web client via the web server. The web client displays the updated or newly requested page. This is a zero-client solution that does not need to download any Java or ActiveX components.
86 2012-12-12
Managing Licenses
Managing Licenses
4.1 Managing License keys
This section describes how to manage license keys for your BI platform deployment.
Related Topics
•
•
•
To view current account activity
4.1.1 To view license information
The License Keys management area of the CMC identifies the number of concurrent, named, and processor licenses that are associated with each key.
1.
Go to the License Keys management area of the CMC.
2.
Select a license key.
The details associated with the key appear in the License Key Information area. To purchase additional license keys, contact your SAP sales representative.
Related Topics
•
•
•
To view current account activity
4.1.2 To add a license key
87 2012-12-12
Managing Licenses
If you are upgrading from a trial version of the product, be sure to delete the Evaluation key prior to adding any new license keys or product activation keycodes.
Note:
If you have received new license keys following a change in the way your organization implements BI platform licenses, you must delete all previous license keys from the system to maintain complaince.
1.
Go to the License Keys management area of the CMC.
2.
Type the key in the Add Key field.
3.
Click Add.
The key is added to the list.
Related Topics
•
•
To view current account activity
4.1.3 To view current account activity
1.
Go to the Settings management area of the CMC.
2.
Click View global system metrics.
This section displays current license usage, along with additional job metrics.
Related Topics
•
•
•
4.2 Measuring licenses
The BusinessObjects License Measurement Tool (BOLMT) is a java command-line utility used to collect and store BI platform licensing data. The output XML document contains license deployment measurements and is sent to SAP Global License Auditing Services (GLAS) for consolidation as part of a license audit.
The system administrator installs and runs BOLMT for every BI platform cluster whenever a license audit is requested. BOLMT collects usage measurements on named and concurrent user licenses.
88 2012-12-12
Managing Licenses
The administrator can specify a particular output directory for the XML document, and configure the output document to not contain any information that may be used to identify system users.
4.2.1 To run a license audit
To perform a license audit, you will need administrator rights and access to the directory containing the
BOLMT.jar
file in the BI platform installation.
1.
Open a command line console.
2.
Change directories to the directory containing the java executables for your BI platform installation
By default the file is installed in the following directory:[INSTALLDIR]\SAP BusinessObjects
Enterprise XI 4.0\java\lib
3.
Execute the BOLMT.jar.
The execution command is entered in the following format: -jar BOLMT.jar [options] <outputFile>
The table below summarizes the available options:
Option
-c --cms
Description
Specifies the name identifier and port number for the Central Management Server
(CMS). Specified as cmsname:port number. By default, the CMS settings for the local host are used if this setting is not specified.
-p --pass word
Specifies the administrator account password used to connect to the CMS.
-a --auth
-s --sani tize
Specifies the authentication method to connect user to the CMS. Default method is
Enterprise specified as secEnterprise.
Specifies that the output audit document should filter out any personal information that may be used to identify users.
Note:
The output file specification is always the last argument in the command line. It is an optional setting.
If no argument is specified, the output goes to the console's standard output. You can also pipe output to script as a command line argument.
Example:
C:\Program Files (x86)\SAP
Business Objects\SAP BusinessObjects Enterprise XI 4. 0\java\lib>"C:\Program Files
(x86)\SAP Business Objects\SAP BusinessObjects Enterprise XI 4.0\win64_x64\sapjvm\bin
\java.exe" -jar BOLMT.jar --cms=mycms:6400 -uAdministrator
-p=7juujg --auth=secEnterprise --sanitize audit.xml
89 2012-12-12
Managing Licenses
90 2012-12-12
Managing Users and Groups
Managing Users and Groups
5.1 Account management overview
Account management involves all of the tasks related to creating, mapping, changing, and organizing user and group information. The "Users and Groups" management area of the Central Management
Console (CMC) provides a central place to perform these tasks.
After the user accounts and groups have been created, you can add objects and specify rights to them.
When the users log on, they can view the objects using BI launch pad or their custom web application.
5.1.1 User management
In the "Users and Groups" management area, you can specify everything required for a user to access
BI platform. You can also view the two default user accounts summarized by the “Default user accounts” table.
Table 5-1: Default user accounts
Account name
Administrator
Guest
SMAdmin
Description
This user belongs to the Administrators and
Everyone groups. An administrator can perform all tasks in all BI platform applications (for example, the CMC, CCM, Publishing Wizard, and BI launch pad).
This user belongs to the Everyone group. This account is enabled by default, and is not assigned a password by the system. If you assign it a password, the single sign-on to BI launch pad will be broken.
This is a read-only account used by SAP Solution
Manager to access BI platform components.
91 2012-12-12
Managing Users and Groups
Note:
Object migrations are best performed by members of the Administrators group, in particular the
Administrator user account. To migrate an object, many related objects may also need to be migrated.
Obtaining the required security rights for all the objects may not be possible for a delegated administrator account.
5.1.2 Group management
Groups are collections of users who share the same account privileges; therefore, you may create groups that are based on department, role, or location. Groups enable you to change the rights for users in one place (a group) instead of modifying the rights for each user account individually. Also, you can assign object rights to a group or groups.
In the "Users and Groups" area, you can create groups that give a number of people access to the report or folder. This enables you to make changes in one place instead of modifying each user account individually. You can also view the several default group accounts summarized by the “Default group accounts” table.
To view available groups in the CMC, click Group List in the Tree panel. Alternatively, you can click
Group Hierarchy to display a hierarchal list of all available groups.
Table 5-2: Default group accounts
Account name
Administrators
Description
Members of this group can perform all tasks in all of the BI platform applications (CMC, CCM, Publishing Wizard, and BI launch pad). By default, the Administrators group contains only the Administrator user.
Everyone
QaaWS Group Designer
Report Conversion Tool Users
Translators
Each user is a member of the Everyone group.
Members of this group have access to Query as a Web Service.
Members of this group have access to the Report
Conversion Tool application.
Members of this group have access to the
Translation Manager application.
92 2012-12-12
Managing Users and Groups
Account name
Universe Designer Users
Description
Users who belong to this group are granted access to the Universe Designer folder and the
Connections folder. They can control who has access rights to the Designer application. You must add users to this group as needed. By default, no user belongs to this group.
Related Topics
•
How rights work in BI platform
•
Granting access to users and groups
5.1.3 Available authentication types
Before setting up user accounts and groups within BI platform, decide which type of authentication you want to use. The “Authentication types” table summarizes the authentication options which may be available to you, depending on the security tools your organization uses.
Table 5-3: Authentication types
Authentication type
Enterprise
LDAP
Description
Use the system default Enterprise Authentication if you prefer to create distinct accounts and groups for use with BI platform, or if you have not already set up a hierarchy of users and groups in an LDAP directory server, or a Windows AD server.
If you set up an LDAP directory server, you can use existing LDAP user accounts and groups in
BI platform. When you map LDAP accounts to BI platform, users are able to access BI platform applications with their LDAP user name and password. This eliminates the need to recreate individual user and group accounts within BI platform.
93 2012-12-12
Managing Users and Groups
Authentication type
Windows AD
SAP
Oracle EBS
Siebel
PeopleSoft Enterprise
JD Edwards EnterpriseOne
Description
You can use existing Windows AD user accounts and groups in BI platform. When you map AD accounts to BI platform, users are able to log on to BI platform applications with their AD user name and password. This eliminates the need to recreate individual user and group accounts within BI platform.
You can map existing SAP roles into BI platform accounts. After you map SAP roles, users are able to log on to BI platform applications with their
SAP credentials. This eliminates the need to recreate individual user and group accounts within BI platform.
You can map existing Oracle EBS roles into BI platform accounts. After you map Oracle EBS roles, users are able to log on to BI platform applications with their Oracle EBS credentials. This eliminates the need to recreate individual user and group accounts within BI platform.
You can map existing Siebel roles into BI platform accounts. After you map Siebel roles, users are able to log on to BI platform applications with their
Siebel credentials. This eliminates the need to recreate individual user and group accounts within BI platform.
You can map existing PeopleSoft roles into BI platform accounts. After you map PeopleSoft roles, users are able to log on to BI platform applications with their PeopleSoft credentials. This eliminates the need to recreate individual user and group accounts within BI platform.
You can map existing JD Edwards roles into BI platform accounts. After you map JD Edwards roles, users are able to log on to BI platform applications with their JD Edwards credentials. This eliminates the need to recreate individual user and group accounts within BI platform.
94 2012-12-12
Managing Users and Groups
5.2 Managing Enterprise and general accounts
Since Enterprise authentication is the default authentication method for the BI platform, it is automatically enabled when you first install the system. When you add and manage users and groups, BI platform maintains the user and group information within its database.
Note:
When a user logs off their web session on BI platform by navigating to a non-platform page or closing their web browser, their Enterprise session is not logged off and they still hold a license. The Enterprise session will time out after approximately 24 hours. To end the user's Enterprise session and free the license for use by others, the user must log out of the platform.
5.2.1 To create a user account
When you create a new user, you specify the user's properties and select the group or groups for the user.
1.
Go to the "Users and Groups" management area of the CMC.
2.
Click Manage > New > New User.
The "New User" dialog box appears.
3.
To create an Enterprise user, a.
Select Enterprise from the Authentication Type list.
b.
Type the account name, full name, email, and description information.
Tip:
Use the description area to include extra information about the user or account.
c.
Specify the password information and settings.
4.
To create a user that will logon using a different authentication type, select the appropriate option from the Authentication Type list, and type the account name.
5.
Specify how to designate the user account according to options stipulated by your SAP
BusinessObjects Business Intelligence platform license agreement.
• Choose Concurrent User if this user belongs to a license agreement that states the number of users allowed to be connected at one time.
• Choose Named User if this user belongs to a license agreement that associates a specific user with a license. Named user licenses are useful for people who require access to BI platform regardless of the number of other people who are currently connected.
6.
Click Create & Close.
95 2012-12-12
Managing Users and Groups
The user is added to the system and is automatically added to the Everyone group. An inbox is automatically created for the user, together with an Enterprise alias. You can now add the user to a group or specify rights for the user.
Related Topics
•
How rights work in BI platform
5.2.2 To modify a user account
Use this procedure to modify a user's properties or group membership.
Note:
The user will be affected if he or she is logged on when you are making the change.
1.
Go to the "Users and Groups" management area of the CMC.
2.
Select the user whose properties you want to change.
3.
Click Manage > Properties.
The "Properties" dialog box for the user appears.
4.
Modify the properties for the user.
In addition to all of the options that were available when you initially created the account, you now can disable the account by selecting the Account is disabled check box.
Note:
Any changes you make to the user account do not appear until the next time the user logs on.
5.
Click Save & Close.
Related Topics
•
To create a new alias for an existing user
5.2.3 To delete a user account
Use this procedure to delete a user's account. The user might receive an error if they are logged on when their account is deleted. When you delete a user account, the Favorites folder, personal categories, and inbox for that user are deleted as well.
If you think the user might require access to the account again in the future, select the Account is
disabled check box in the "Properties" dialog box of the selected user instead of deleting the account.
96 2012-12-12
Managing Users and Groups
Note:
Deleting a user account won't necessarily prevent the user from being able to log on to BI platform again. If the user account also exists in a third-party system, and if the account belongs to a third-party group that is mapped to BI platform, the user may still be able to log on.
1.
Go to the "Users and Groups" management area of the CMC.
2.
Select the user you want to delete.
3.
Click Manage > Delete.
The delete confirmation dialog box appears.
4.
Click OK.
The user account is deleted.
Related Topics
•
•
•
5.2.4 To create a new group
1.
Go to the "Users and Groups" management area of the CMC.
2.
Click Manage > New > New Group.
The "Create New User Group" dialog box appears.
3.
Enter the group name and description.
4.
Click OK.
After creating a new group, you can add users, add subgroups, or specify group membership so that the new group is actually a subgroup. Because subgroups provide you with additional levels of organization, they are useful when you set object rights to control users' access to your BI platform content.
5.2.5 To modify a group's properties
You can modify a group's properties by making changes to any of the settings.
Note:
The users who belong to the group will be affected by the modification the next time they log on.
1.
In the "Users and Groups" management area of the CMC, select the group.
97 2012-12-12
Managing Users and Groups
2.
Click Manage > Properties.
The "Properties" dialog box appears.
3.
Modify the properties for the group.
Click the links from the navigation list to access different dialog boxes and modify different properties.
• If you want to change the title or description for the group, click Properties.
• If you want to modify the rights that principals have to the group, click User Security.
• If you want to modify profile values for group members, click Profile Values.
• If you want to add the group as a subgroup to another group, click Member Of.
4.
Click Save.
5.2.6 To view group members
You can use this procedure to view the users who belong to a specific group.
1.
Go to the "Users and Groups" management area of the CMC.
2.
Expand Group Hierarchy in the Tree panel.
3.
Select the group in the Tree panel.
Note:
It may take a few minutes for your list to display if you have a large number of users in the group or if your group is mapped to a third-party directory.
The list of users who belong to the group is displayed.
5.2.7 To add subgroups
You can add a group to another group. When you do this, the group that you added becomes a subgroup.
Note:
Adding a subgroup is similar to specifying group membership.
1.
In the "Users and Groups" management area of the CMC, select the group that you want to add as a subgroup to another group.
2.
Click Actions > Join Group.
The "Join Group" dialog box appears.
3.
Move the group that you want to add the first group to from the Available Groups list to the
Destination Group(s) list.
4.
Click OK.
98 2012-12-12
Managing Users and Groups
Related Topics
•
5.2.8 To specify group membership
You can make a group a member of another group. The group that becomes a member is referred to as a subgroup. The group that you add the subgroup to is the parent group. A subgroup inherits the rights of the parent group.
1.
In the "Users and Groups" management area of the CMC, click the group that you want to add to another group.
2.
Click Actions > Member Of.
The "Member Of" dialog box appears.
3.
Click Join Group.
The "Join Group" dialog box appears.
4.
Move the group that you want to add the first group to from the Available Groups to the Destination
Group(s) list.
Any rights associated with the parent group will be inherited by the new group you have created.
5.
Click OK.
You return to the "Member Of" dialog box, and the parent group appears in the parent groups list.
5.2.9 To delete a group
You can delete a group when that group is no longer required. You cannot delete the default groups
Administrator and Everyone.
Note:
• The users who belong to the deleted group will be affected by the change the next time they log on.
• The users who belong to the deleted group will lose any rights they inherited from the group.
To delete a third-party authentication group, such as the Windows AD Users group, use the
"Authentication" management area in CMC.
1.
Go to the "Users and Groups" management area of the CMC.
2.
Select the group you want to delete.
3.
Click Manage > Delete.
The delete confirmation dialog box appears.
99 2012-12-12
Managing Users and Groups
4.
Click OK.
The group is deleted.
5.2.10 To add users or user groups in bulk
You can add users or user groups in bulk to the CMC using a CSV (comma-separated values) file.
1.
Log on to the CMC.
2.
On the "Users and Groups" tab, click Manage > Import User Group > User/Group/DBCredential.
The "User/Group/DBCredential" window is displayed.
3.
Click Browse, select a CSV file, and click Verify.
The file is processed. If the data is formatted correctly, the Import button becomes active.
4.
Click Import.
The users or user groups are imported into the CMC.
Example: A sample CSV file
Add,MyGroup,MyUser1,MyFullName,Password1,[email protected],ProfileName,ProfileValue
Remember:
The following conditions apply to the bulk addition process:
• Any line in the CSV file that contains an error will be omitted from the import process.
• User accounts are initially disabled after being imported.
• You can use blank passwords when creating new users. However, you must use a valid Enterprise
Authentication password for any subsequent update to existing users.
To review the users or user groups that you have added, click Management > Import User Group >
History on the "Users and Groups" tab.
5.2.11 To enable the Guest account
The Guest account is disabled by default to ensure that no one can log on to BI platform with this account. This default setting also disables the anonymous single sign-on functionality of BI platform, so users will be unable to access BI launch pad without providing a valid user name and password.
Perform this task if you want to enable the Guest account so that users do not require their own accounts to access BI launch pad.
1.
Go to the "Users and Groups" management area of the CMC.
2.
Click User List in the Navigation panel.
100 2012-12-12
Managing Users and Groups
3.
Select Guest.
4.
Click Manage > Properties.
The "Properties" dialog box appears.
5.
Clear the Account is disabled check box.
6.
Click Save & Close.
5.2.12 Adding users to groups
You can add users to groups in the following ways:
• Select the group, and then click Actions > Add Members to Group.
• Select the user, and then click Actions > Member Of.
• Select the user, and then click Actions > Join Group.
The following procedures describe how to add users to groups using these methods.
Related Topics
•
5.2.12.1 To add a user to one or more groups
1.
Go to the "Users and Groups" management area of the CMC.
2.
Select the user that you want to add to a group.
3.
Click Actions > Join Group.
Note:
All BI platform users of the system are part of the Everyone group.
The "Join Group" dialog box appears.
4.
Move the group that you want to add the user to from the Available Groups list to the Destination
Group(s) list.
Tip:
Use SHIFT + click or CTRL + click to select multiple groups.
5.
Click OK.
101 2012-12-12
Managing Users and Groups
5.2.12.2 To add one or more users to a group
1.
In the "Users and Groups" management area of the CMC, select the group.
2.
Click Actions > Add Members to Group.
The "Add" dialog box appears.
3.
Click User list.
The Available users/groups list refreshes and displays all user accounts in the system.
4.
Move the user that you want to add to the group from the Available users/groups list to the Selected
users/groups list.
Tip:
• To select multiple users, use the SHIFT + click or CTRL + click combination.
• To search for a specific user, use the search field.
• If there are many users on your system, click the Previous and Next buttons to navigate through the list of users.
5.
Click OK.
5.2.13 Changing password settings
Within the CMC, you can change the password settings for a specific user or for all users in the system.
The various restrictions listed below apply only to Enterprise accounts—that is, the restrictions do not apply to accounts that you have mapped to an external user database (LDAP or Windows AD). Generally, however, your external system will enable you to place similar restrictions on the external accounts.
5.2.13.1 To change user password settings
1.
Go to the "Users and Groups" management area of the CMC.
2.
Select the user whose password settings you want to change.
3.
Click Manage > Properties.
The "Properties" dialog box appears.
4.
Select or clear the check box associated with the password setting you want to change.
The available options are:
102 2012-12-12
Managing Users and Groups
•
Password never expires
•
User must change password at next logon
•
User cannot change password
5.
Click Save & Close.
5.2.13.2 To change general password settings
1.
Go to the "Authentication" management area of the CMC.
2.
Double-click Enterprise.
The "Enterprise" dialog box appears.
3.
Select the check box for each password setting that you want to use, and provide a value if necessary.
The following table identifies the minimum and maximum values for each of the settings you can configure.
Table 5-4: Password settings
Recommended Maximum Password setting Minimum
Enforce mixed-case passwords
N/A N/A
Must contain at least N
Characters
0 characters
Must change password every
N day(s)
1 day
64 characters
100 days
Cannot reuse the N most recent password(s)
1 password
Must wait N minute(s) to change password
Disable account after N failed attempts to log on
0 minutes
1 failed
100 passwords
100 minutes
100 failed
103 2012-12-12
Managing Users and Groups
Password setting Minimum
Reset failed logon count after N minute(s)
1 minute
Re-enable account after N minute(s)
0 minutes
4.
Click Update.
Inactive user accounts will not be automatically de-activated.
Recommended Maximum
100 minutes
100 minutes
5.2.14 Granting access to users and groups
You can grant users and groups administrative access to other users and groups. Administrative rights include: viewing, editing, and deleting objects; viewing and deleting object instances; and pausing object instances. For example, for troubleshooting and system maintenance, you may want to grant your IT department access to edit and delete objects.
Related Topics
•
To assign principals to an access control list for an object
5.2.15 Controlling access to user inboxes
When you add a user, the system automatically creates an inbox for that user. The inbox has the same name as the user. By default, only the user and the administrator have the right to access a user's inbox.
Related Topics
•
Managing security settings for objects in the CMC
5.2.16 Configuring BI launch pad options
104 2012-12-12
Managing Users and Groups
105
Administrators can configure the way users access the BI launch pad applications. By configuring properties in the BOE.war file, you can specify what information is available on the user's logon screen.
You can also use the CMC to set BI launch pad preferences for specific groups.
5.2.16.1 Configuring the BI launch pad logon screen
By default, the BI launch pad logon screen prompts users for their user name and password. You can also prompt the users for the CMS name and the authentication type. To change this setting, you need to edit the BI launch pad properties for the BOE.war file.
5.2.16.1.1 To configure the BI launch pad logon screen
To modify BI launch pad default settings, you need to set custom BI launch pad properties for the
BOE.war file. This file is deployed on the machine hosting your web application server.
1.
Go to the following directory in your BI platform installation:
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\
2.
Create a new file using a text editor.
3.
Save the file under the following name:
BIlaunchpad.properties
4.
To include the authentication options on the BI launch pad logon screen, add the following line: authentication.visible=true
5.
To change the default authentication, add the following line: authentication.default=<authentication>
Replace <authentication> with any of the following options
Authentication Type
Enterprise
LDAP
Windows AD
SAP
<authentication> value
secEnterprise secLDAP secWinAD secSAPR3
6.
To prompt users for the CMS name on the BI launch pad logon screen, add the following line: cms.visible=true
7.
Save and close the file.
8.
Restart your web application server.
2012-12-12
Managing Users and Groups
Use WDeploy to redeploy the BOE.war file on the web application server. For more information on using WDeploy, see the SAP BusinessObjects Business Intelligence Platform Web Application
Deployment Guide.
5.2.16.2 Configuring BI launch pad preferences for groups
Administrators can set BI launch pad preferences for specific user groups. These preferences serve as default BI launch pad preferences for all users in the group.
Note:
If users have set their own preferences, any administrator-defined settings will not be reflected in their view of BI launch pad. Users can always switch from their own preferences to the administrator-defined preferences at any time and use the updated settings.
By default no BI launch pad preferences are set for any user groups. Administrators can specify preferences for the following:
• Home tab
• Documents - start location
• Folders
• Categories
• Number of objects per page
• Columns displayed in the "Document" tab
• How to display documents in BI launch pad - through tabs or a new window
5.2.16.2.1 To set BI launch pad Preferences for a group
1.
Go to the "Users and Groups" management area of the CMC.
2.
Select the group from the Group List.
3.
Click Actions > BI launch pad Preferences
The "BI launch pad Preferences" dialog box appears
4.
Unselect No Preferences Defined.
5.
To set a user's initial view:
• To display the Home tab when the user first log on, click Home tab and choose one of the following options:
106 2012-12-12
Managing Users and Groups
107
Option
Default Home tab
Select Home tab
Description
Displays the default Home tab provided with BI platform will be used.
Displays a specific website as the home tab.
Click Browse Home tab. In the "Select a Custom Home tab" window, select a repository object and click Open.
Note:
you can only select an object that has already been added to the repository.
• To display the Documents tab when the user first log on, click Documents, and then specify which drawer and node are open by default. You can select from the following
Drawer
My Documents
Folders
Categories
Node options
Choose from one of the following to display in the Documents tab:
• My Favorites
• Personal Categories
• My Inbox
Choose from one of the following:
• Public Folders: this will display the public folders in the Documents tab
• Select Public folder
Click Browse Folder to select a specific public folder to display in the Documents tab.
Choose from one of the following:
• Corporate Categories: this will display the corporate categories in the
Documents tab
• Select Corporate Category
Click Browse Folder to select a specific corporate category to display in the Documents tab.
For example, if you want the My Documents drawer to be open to the user's BI Inbox when they first log on, click My Documents and click My Inbox.
6.
Under "Choose columns displayed in Documents tab", select the summary information that you want to see for each object in the user's List panel:
•
Type
•
Last Run
•
Instances
2012-12-12
Managing Users and Groups
•
Description
•
Created By
•
Created On
•
Location (Categories)
•
Received On (Inbox)
•
From (Inbox)
7.
Under "Set document viewing location", choose how you want users to view their documents.
Users can open documents for viewing in new tabs within BI launch pad or in new web browser windows.
8.
Enter a number in the Set the maximum number of items per page field to specify the maximum number of objects displayed per page when a user views lists of objects.
9.
Click Save & Close.
The specified preferences will serve as defaults for users in the group you selected in Step 2. Users will however be able to create their own BI launch pad preferences, if they have the right to set their preferences. If you do not want users to modify the preferences, you should not grant users the right to set preferences.
5.2.17 Managing attributes for system users
BI platform administrators define and add user attributes to system users through the "User Attribute
Management" area in the Central Management Console (CMC). You can manage and extend attributes for the following user directories:
• Enterprise
• SAP
• LDAP
• Windows AD
When users are imported from external directories such as SAP, LDAP, and Windows AD, the following attributes are generally available for the user accounts:
• Full Name
• Email address
Attribute names
All user attributes added to the system must have the following properties:
• "Name"
• "Internal name"
The “Name” property is the friendly identifier for the attribute and it is used to query filters when working with the Universe semantic layer. For more information, see the Universe Design tool documentation.
The “Internal Name” is used by developers working with the BI platform SDK. This property is an automatically generated name.
108 2012-12-12
Managing Users and Groups
Attribute names should not exceed 256 characters and should only contain alphanumeric characters and underscores.
Tip:
If you specify invalid characters for the Name attribute, BI platform will not generate an internal name.
Internal names cannot be modified once they are added to the system, it is recommended that you carefully select appropriate attribute names containing alphanumeric characters and underscores.
Prerequisites for expanding mapped user attributes
Before adding user attributes to the system, all relevant authentication plugins for the external user directories need to be configured to map and import users. In addition, you will need to be familiar with the schema of the external directories, in particular the names used for the target attributes.
Note:
For the SAP authentication plugin, only attributes contained in the BAPIADDR3 structure can be specified. For more information, consult your SAP documentation.
Once BI platform is configured to map the new user attributes, values will be populated after the next scheduled update. All user attributes are displayed in the "User and Groups" management area of the
CMC.
5.2.18 Prioritizing user attributes across multiple authentication options
When configuring SAP, LDAP, and AD authentication plugins, you can specify the priority levels for each plug in relation to the other two. For example, in the LDAP authentication area use the Set priority
of LDAP attribute binding relative to other attributes binding option to specify the LDAP priority in relation to SAP and AD. By default, the Enterprise attribute value take priority over any value from an external directory. Attribute binding priorities are set at the authentication plugin level and not for any specific attribute.
Related Topics
•
•
•
5.2.19 To add a new user attribute
Before adding new user attribute to the BI platform, you must configure the authentication plugin for the external directory from which you are mapping user accounts. This applies to SAP, LDAP, and
109 2012-12-12
Managing Users and Groups
Windows AD. Specifically, you must check the Import Full Name, Email Address and other attributes option for all the required plugins.
Note:
You do not need to perform any preliminary tasks before expending attributes for Enterprise user accounts.
Tip:
If you plan to extend the same attribute across several plugins, it is recommended that you set the appropriate attribute binding priority level based on your organization's requirements.
1.
Go to the "User Attribute Management" management area of the CMC.
2.
Click the Add a New Custom Mapped Attribute icon.
The "Add Attribute" dialog box appears.
3.
Specify a name for the new attribute in the "Name" field.
BI platform will use the name provided as a friendly name for the new attribute.
As you enter the friendly name, the "Internal Name" field is automatically populated according to the following format: SI_[Friendlyname]. As the system administrator specifies a "friendly" attribute name , the BI platform automatically generates the "internal" name.
4.
If necessary, modify the "Internal Name" field using letters, numerals or underscores.
Tip:
The "Internal Name" field value can only be modified at this stage. You cannot edit this value once you have saved the new attribute.
If the new attribute is for Enterprise accounts, skip to step 8.
5.
Choose the appropriate option for Add a new source for from the list and click the Add icon. The following options are available:
• "SAP"
• "LDAP"
• "AD"
A table row is created for the attribute specified attribute source.
6.
Specify under the Attribute Source Name column, the name of the attribute in the source directory.
BI platform does not provide a mechanism to automatically verify that the attribute name provided exists in the external directory. Ensure that the name provided is correct and valid.
7.
Repeat steps 5-6 if additional sources are required for the new attribute.
8.
Click OK to save and submit the new attribute to BI platform.
The new attribute Name, Internal Name, Source, and Attribute Source Name appear in the "User
Attribute Management" management area of the CMC.
The new attribute and its corresponding value for each affected user account. will be displayed upon the next scheduled refresh in the "Users and Groups" management area.
If you are using multiple sources for the new attribute, ensure that the correct attribute binding priorities are specified for each authentication plugin.
110 2012-12-12
Managing Users and Groups
5.2.20 To edit extended user attributes
Use the following procedure to edit user attributes that have been created in BI platform. You can edit the following:
• The name of the attribute in BI platform
Note:
This is not the Internal Name used for the attribute. Once an attribute is created and added to BI platform, the internal name cannot be modified. To remove an internal name, administrators need to delete the associated attribute.
• The attribute source name
• Additional sources for the attribute
1.
Go to the "User Attribute Management" management area of the CMC.
2.
Select the attribute you want to edit.
3.
Click the Edit selected attribute icon.
The "Edit" dialog box appears.
4.
Modify the attribute Name or source information.
5.
Click OK to save and submit the modifications to BI platform.
The modified values appear in the "User Attribute Management" management area of the CMC.
The modified attribute name and values will appear after next scheduled refresh in the "Users and
Groups" management area.
5.3 Managing aliases
If a user has multiple accounts in BI platform, you can link the accounts using the Assign Alias feature.
This is useful when a user has a third-party account that is mapped to Enterprise and an Enterprise account.
By assigning an alias to the user, the user can log on using either a third-party user name and password or an Enterprise user name and password. Thus, an alias enables a user to log on via more than one authentication type.
In the CMC, the alias information is displayed at the bottom of the "Properties" dialog box for a user. A user can have any combination of Enterprise, LDAP or Windows AD aliases.
111 2012-12-12
Managing Users and Groups
5.3.1 To create a user and add a third-party alias
When you create a user and select an authentication type other than Enterprise, the system creates the new user in BI platform and creates a third-party alias for the user.
Note:
For the system to create the third-party alias, the following criteria must be met:
• The authentication tool needs to have been enabled in the CMC.
• The format of the account name must agree with the format required for the authentication type.
• The user account must exist in the third-party authentication tool, and it must belong to a group that is already mapped to BI platform.
1.
Go to the "Users and Groups" management area of the CMC.
2.
Click Manage > New > New User.
The "New User" dialog box appears.
3.
Select the authentication type for the user, for example, Windows AD.
4.
Type in the third-party account name for the user, for example, bsmith.
5.
Select the connection type for the user.
6.
Click Create & Close.
The user is added to BI platform and is assigned an alias for the authentication type you selected, for example, secWindowsAD:ENTERPRISE:bsmith. If required, you can add, assign, and reassign aliases to users.
5.3.2 To create a new alias for an existing user
You can create aliases for existing BI platform users. The alias can be an Enterprise alias, or an alias for a third-party authentication tool.
Note:
For the system to create the third-party alias, the following criteria must be met:
• The authentication tool needs to have been enabled in the CMC.
• The format of the account name must agree with the format required for the authentication type.
• The user account must exist in the third-party authentication tool, and it must belong to a group that is mapped to the platform.
1.
Go to the "Users and Groups" management area of the CMC.
2.
Select the user that you want to add an alias to.
112 2012-12-12
Managing Users and Groups
3.
Click Manage > Properties.
The "Properties" dialog box appears.
4.
Click New Alias.
5.
Select the authentication type.
6.
Type in the account name for the user.
7.
Click Update.
An alias is created for the user. When you view the user in the CMC, at least two aliases are shown, the one that was already assigned to the user and the one you just created.
8.
Click Save & Close to exit the "Properties" dialog box.
5.3.3 To assign an alias from another user
When you assign an alias to a user, you move a third-party alias from another user to the user you are currently viewing. You cannot assign or reassign Enterprise aliases.
Note:
If a user has only one alias and you assign that last alias to another user, the system will delete the user account, and the Favorites folder, personal categories, and inbox for that account.
1.
Go to the "Users and Groups" management area of the CMC.
2.
Select the user you want to assign an alias to.
3.
Click Manage > Properties.
The "Properties" dialog box appears.
4.
Click Assign Alias.
5.
Enter the user account that has the alias you want to assign, and click Find Now.
6.
Move the alias you want to assign from the Available aliases list to the Aliases to be added to
Username
list.
Here Username represents the name of the user you are assigning an alias to.
Tip:
To select multiple aliases, use the SHIFT + click or CTRL + click combination.
7.
Click OK.
5.3.4 To delete an alias
113 2012-12-12
Managing Users and Groups
When you delete an alias, the alias is removed from the system. If a user has only one alias and you delete that alias, the system automatically deletes the user account and the Favorites folder, personal categories, and inbox for that account.
Note:
Deleting a user's alias does not necessarily prevent the user from being able to log on to BI platform again. If the user account still exists in the third-party system, and if the account belongs to a group that is mapped to BI platform, then BI platform will still allow the user to log on. Whether the system creates a new user or assigns the alias to an existing user, depends on which update options you have selected for the authentication tool in the "Authentication" management area of CMC.
1.
Go to the "Users and Groups" management area of the CMC.
2.
Select the user whose alias you want to delete.
3.
Click Manage > Properties.
The "Properties" dialog box appears.
4.
Click the Delete Alias button next to the alias that you want to delete.
5.
If prompted for confirmation, click OK.
The alias is deleted.
6.
Click Save & Close to exit the "Properties" dialog box.
5.3.5 To disable an alias
You can prevent a user from logging on to BI platform using a particular authentication method by disabling the user's alias associated with that method. To prevent a user from accessing the platform altogether, disable all aliases for that user.
Note:
Deleting a user from the system does not necessarily prevent the user from being able to log on to BI platform again. If the user account still exists in the third-party system, and if the account belongs to a group that is mapped to the platform, then the system will still allow the user to log on. To ensure a user can no longer use one of his or her aliases to log on to the platform, it is best to disable the alias.
1.
Go to the "Users and Groups" management area of the CMC.
2.
Select the user whose alias you want to disable.
3.
Click Manage > Properties.
The "Properties" dialog box appears.
4.
Clear the Enabled check box for the alias you want disable.
Repeat this step for each alias you want to disable.
5.
Click Save & Close.
The user can no longer log on using the type of authentication that you just disabled.
114 2012-12-12
Managing Users and Groups
Related Topics
•
115 2012-12-12
Managing Users and Groups
116 2012-12-12
Setting Rights
Setting Rights
6.1 How rights work in BI platform
Rights are the base units for controlling user access to the objects, users, applications, servers, and other features in BI platform. They play an important role in securing the system by specifying the individual actions that users can perform on objects. Besides allowing you to control access to your BI platform content, rights enable you to delegate user and group management to different departments, and to provide your IT people with administrative access to servers and server groups.
It is important to note that rights are set on objects such as reports and folders rather than on the
“principals” (the users and groups) who access them. For example, to give a manager access to a particular folder, in the "Folders" area, you add the manager to the “access control list” (the list of principals who have access to an object) for the folder. You cannot give the manager access by configuring the manager's rights settings in the "Users and Groups" area. The rights settings for the manager in the "Users and Groups" area are used to grant other principals (such as delegated administrators) access to the manager as an object in the system. In this way, principals are themselves like objects for others with greater rights to manage.
Each right on an object can be granted, denied, or unspecified. The BI platform security model is designed such that, if a right is left unspecified, the right is denied. Additionally, if settings result in a right being both granted and denied to a user or group, the right is denied. This “denial-based” design helps ensure that users and groups do not automatically acquire rights that are not explicitly granted.
There is an important exception to this rule. If a right is explicitly set on a child object that contradicts the rights inherited from the parent object, the right set on the child object overrides the inherited rights.
This exception applies to users who are members of groups as well. If a user is explicitly granted a right that the user's group is denied, the right set on the user overrides the inherited rights.
Related Topics
•
6.1.1 Access levels
“Access levels” are groups of rights that users frequently need. They allow administrators to set common security levels quickly and uniformly rather than requiring that individual rights be set one by one.
117 2012-12-12
Setting Rights
BI platform comes with several predefined access levels. These predefined access levels are based on a model of increasing rights: Beginning with “View” and ending with “Full Control”, each access level builds upon the rights granted by the previous level.
However, you can also create and customize your own access levels; this can greatly reduce administrative and maintenance costs associated with security. Consider a situation in which an administrator must manage two groups, sales managers and sales employees. Both groups need to access five reports in the BI platform system, but sales managers require more rights than sales employees. The predefined access levels do not meet the needs of either group. Instead of adding groups to each report as principals and modifying their rights in five different places, the administrator can create two new access levels, Sales Managers and Sales Employees. The administrator then adds both groups as principals to the reports and assigns the groups their respective access levels. When rights need to be modified, the administrator can modify the access levels. Because the access levels apply to both groups across all five reports, the rights those groups have to the reports are quickly updated.
Related Topics
•
6.1.2 Advanced rights settings
To provide you with full control over object security, the CMC allows you to set “advanced rights”. These advanced rights provide increased flexibility as you define security for objects at a granular level.
Use advanced rights settings, for instance, if you need to customize a principal's rights to a particular object or set of objects. Most importantly, use advanced rights to explicitly deny a user or group any right that should not be permitted to change when, in the future, you make changes to group memberships or folder security levels.
The following table summarizes the options that you have when you set advanced rights.
Table 6-1: Rights options
Icon Rights option Description
Granted
The right is granted to a principal.
Denied
Not Specified
The right is denied to a principal.
The right is unspecified for a principal. By default, rights set to Not Specified are denied.
118 2012-12-12
Setting Rights
Icon Rights option
Apply to Object
Apply to Sub Object
Related Topics
•
Description
The right applies to the object. This option becomes available when you click Granted or Denied.
The right applies to sub-objects. This option becomes available when you click Granted or Denied.
6.1.3 Inheritance
Rights are set on an object for a principal in order to control access to the object; however, it is impractical to set the explicit value of every possible right for every principal on every object. Consider a system with 100 rights, 1000 users, and 10,000 objects: to set rights explicitly on each object would require the
CMS store billions of rights in its memory, and, importantly, require that an administrator manually set each one.
Inheritance patterns resolve this impracticality. With inheritance, the rights that users have to objects in the system come from a combination of their memberships in different groups and subgroups and from objects which have inherited rights from parent folders and subfolders. These users can inherit rights as the result of group membership; subgroups can inherit rights from parent groups; and both users and groups can inherit rights from parent folders.
By default, users or groups who have rights to a folder will inherit the same rights for any object that are subsequently published to that folder. Consequently, the best strategy is to set the appropriate rights for users and groups at the folder level first, then publish objects to that folder.
BI platform recognizes two types of inheritance: group inheritance and folder inheritance.
6.1.3.1 Group inheritance
Group inheritance allows principals to inherit rights as the result of group membership. Group inheritance proves especially useful when you organize all of your users into groups that coincide with your organization's current security conventions.
In “Group inheritance example 1”, you can see how group inheritance works. Red Group is a subgroup of Blue Group, so it inherits Blue Group's rights. In this case, it inherits right 1 as granted, and the rest
119 2012-12-12
Setting Rights of the rights as unspecified. Every member of Red Group inherits these rights. In addition, any other rights that are set on the subgroup are inherited by its members. In this example, Green User is a member of Red Group, and thus inherits right 1 as granted, rights 2, 3, 4, and 6 as not specified, and
Right 5 as denied.
Figure 6-1: Group inheritance example 1
When group inheritance is enabled for a user who belongs to more than one group, the rights of all parent groups are considered when the system checks credentials. The user is denied any right that is explicitly denied in any parent group, and the user is denied any right that remains completely not specified; thus, the user is granted only those rights that are granted in one or more groups (explicitly or through access levels) and never explicitly denied.
In “Group inheritance example 2”, Green User is a member of two unrelated groups. From Blue Group, he inherits rights 1 and 5 as "granted" and the rest as not specified; however, because Green User also belongs to Red Group, and Red Group has been explicitly denied right 5, Green User's inheritance to right 5 from Blue Group is overridden.
120
Figure 6-2: Group inheritance example 2
Related Topics
•
6.1.3.2 Folder inheritance
2012-12-12
Setting Rights
Folder inheritance allows principals to inherit any rights that they have been granted on an object's parent folder. Folder inheritance proves especially useful when you organize BI platform content into a folder hierarchy that reflects your organization's current security conventions. For example, suppose that you create a folder called Sales Reports, and you provide your Sales group with View On Demand access to this folder. By default, every user that has rights to the Sales Reports folder will inherit the same rights to the reports that you subsequently publish to this folder. Consequently, the Sales group will have View On Demand access to all of the reports, and you need set the object rights only once, at the folder level.
In “Folder inheritance example”, rights have been set for Red Group on a folder. Rights 1 and 5 have been granted, while the rest have been left unspecified. With folder inheritance enabled, members of
Red Group have rights on the object level identical to the rights of the group on the folder level. Rights
1 and 5 are inherited as granted, while the rest have been left unspecified.
Figure 6-3: Folder inheritance example
Related Topics
•
121
6.1.3.3 Rights override
“Rights override” is a rights behavior in which rights that are set on child objects override the rights set on parent objects. Rights override occurs under the following circumstances:
• In general, the rights that are set on child objects override the corresponding rights that are set on parent objects.
• In general, the rights that are set on subgroups or members of groups override the corresponding rights that are set on groups.
2012-12-12
Setting Rights
You do not need to disable inheritance to set customized rights on an object. The child object inherits the rights settings of the parent object except for the rights that are explicitly set on the child object.
Also, any changes to rights settings on the parent object apply to the child object.
“Rights override example 1” illustrates how rights override works on parent and child objects. Blue User is denied the right to edit a folder's contents; the rights setting is inherited by the subfolder. However, an administrator grants Blue User Edit rights to a document in the subfolder. The Edit right that Blue
User receives on the document overrides the inherited rights that come from the folder and subfolder.
Figure 6-4: Rights override example 1
“Rights override example 2” illustrates how rights override works on members and groups. Blue Group is denied the right to edit a folder; Blue Subgroup inherits this rights setting. However, an administrator grants Blue User, who is a member of Blue Group and Blue Subgroup, Edit rights on the folder. The
Edit rights that Blue User receives on the folder override the inherited rights that come from Blue Group and Blue Subgroup.
122
Figure 6-5: Rights override example 2
“Complex rights override” illustrates a situation where the effects of rights override are less obvious.
Purple User is a member of subgroups 1A and 2A, which are in Groups 1 and 2, respectively. Groups
1 and 2 both have Edit rights on the folder. 1A inherits the Edit rights that Group 1 has, but an administrator denies Edit rights to 2A. The rights settings on 2A override the rights settings on Group
2 because of rights override. Therefore, Purple User inherits contradictory rights settings from 1A and
2012-12-12
Setting Rights
2A. 1A and 2A do not have a parent-child relationship, so rights override does not occur; that is, one sub-group's rights settings do not override another's because they have equal status. In the end, Purple
User is denied Edit rights because of the “denial-based” rights model in BI platform.
123
Figure 6-6: Complex rights override
Rights override lets you make minor adjustments to the rights settings on a child object without discarding all inherited rights settings. Consider a situation in which a sales manager needs to view confidential reports in the Confidential folder. The sales manager is part of the Sales group, which is denied access to the folder and its contents. The administrator grants the manager View rights on the Confidential folder and continues to deny the Sales group access. In this case, the View rights granted to the sales manager override the denied access that the manager inherits from membership in the Sales group.
6.1.3.4 Scope of rights
“Scope of rights” refers to the ability to control the extent of rights inheritance. To define the scope of a right, you decide whether the right applies to the object, its sub-objects, or both. By default, the scope of a right extends to both objects and sub-objects.
Scope of rights can be used to protect personal content in shared locations. Consider a situation in which the finance department has a shared Expense Claims folder that contains Personal Expense
Claims subfolders for each employee. The employees want to be able to view the Expense Claims folder and add objects to it, but they also want to protect the contents of their Personal Expense Claims subfolders. The administrator grants all employees View and Add rights on the Expense Claims folder, and limits the scope of these rights to the Expense Claims folder only. This means that the View and
Add rights do not apply to sub-objects in the Expense Claims folder. The administrator then grants employees View and Add rights on their own Personal Expense Claims subfolders.
Scope of rights can also limit the effective rights that a delegated administrator has. For example, a delegated administrator may have Securely Modify Rights and Edit rights on a folder, but the scope of these rights is limited to the folder only and does not apply to its sub-objects. The delegated administrator cannot grant these rights to another user on one of the folder's sub-objects.
2012-12-12
Setting Rights
6.1.4 Type-specific rights
“Type-specific rights” are rights that affect specific object types only, such as Crystal reports, folders, or access levels. Type-specific rights consist of the following:
• General rights for the object type
These rights are identical to general global rights (for example, the right to add, delete, or edit an object), but you set them on specific object types to override the general global rights settings.
• Specific rights for the object type
These rights are available for specific object types only. For example, the right to export a report's data appears for Crystal reports but not for Word documents.
The diagram “Type-specific rights example” illustrates how type-specific rights work. Here right 3 represents the right to edit an object. Blue Group is denied Edit rights on the top-level folder and granted
Edit rights for Crystal reports in the folder and subfolder. These Edit rights are specific to Crystal reports and override the rights settings on a general global level. As a result, members of Blue Group have
Edit rights for Crystal reports but not the XLF file in the subfolder.
124
Figure 6-7: Type-specific rights example
Type-specific rights are useful because they let you limit the rights of principals based on object type.
Consider a situation in which an administrator wants employees to be able to add objects to a folder but not create subfolders. The administrator grants Add rights at the general global level for the folder, and then denies Add rights for the folder object type.
Rights are divided into the following collections based on the object types they apply to:
•
General
These rights affect all objects.
2012-12-12
Setting Rights
•
Content
These rights are divided according to particular content object types. Examples of content object types include Crystal reports, and Adobe Acrobat PDFs.
•
Application
These rights are divided according to which BI platform application they affect. Examples of applications include the CMC and BI launch pad.
•
System
These rights are divided according to which core system component they affect. Examples of core system components include Calendars, Events, and Users and Groups.
Type-specific rights are in the Content, Application, and System collections. In each collection, they are further divided into categories based on object type.
6.1.5 Determining effective rights
Keep these considerations in mind when you set rights on an object:
• Each access level grants some rights, denies some rights, and leaves the other rights unspecified.
When a user is granted several access levels, the system aggregates the effective rights and denies any unspecified rights by default.
• When you assign multiple access levels to a principal on an object, the principal has the combination of each access level's rights. The user in “Multiple access levels” is assigned two access levels.
One access level grants the user rights 3 and 4, while the other access level grants right 3 only. The effective rights for the user are 3 and 4.
125
Figure 6-8: Multiple access levels
• Advanced rights can be combined with access levels to customize the rights settings for a principal on an object. For example, if an advanced right and an access level are both assigned explicitly to a principal on an object, and the advanced right contradicts a right in the access level, the advanced right will override the right in the access level.
Advanced rights can override their identical counterparts in access levels only when they are set on the same object for the same principal. For example, an advanced Add right set at the general global level can override the general Add right setting in an access level; it cannot override a type-specific
Add right setting in an access level.
2012-12-12
Setting Rights
However, advanced rights do not always override access levels. For example, a principal is denied an Edit right on a parent object. On the child object, the principal is assigned an access level that grants him the Edit right. In the end, the principal has Edit rights on the child object because the rights set on the child object override rights that are set on the parent object.
• Rights override makes it possible for rights set on a child object to override rights that are inherited from the parent object.
6.2 Managing security settings for objects in the CMC
You can manage security settings for most objects in the CMC with the security options on the Manage menu. These options let you assign principals to the access control list for an object, view the rights that a principal has, and modify the rights that the principal has to an object.
The specific details of security management vary according to your security needs and the type of object you are setting rights for. However, in general, the workflows for the following tasks are very similar:
• Viewing rights for a principal on an object.
• Assigning principals to an access control list for an object, and specifying which rights and access levels those principals have.
• Setting rights on a top-level folder in BI platform.
6.2.1 To view rights for a principal on an object
In general, you follow this workflow to view rights for a principal on an object.
1.
Select the object for which you want to view security settings.
2.
Click Manage > User Security.
The "User Security" dialog box appears and displays the access control list for the object.
3.
Select a principal from the access control list, and click View Security
The "Permissions Explorer" launches and displays a list of effective rights for the principal on the object. In addition, the "Permissions Explorer" lets you do the following:
• Browse for another principal whose rights you want to view.
• Filter the rights displayed according to these criteria:
• assigned rights
• granted rights
• unassigned rights
• from access level
• object type
126 2012-12-12
Setting Rights
• the name of the right
• Sort the list of rights displayed in ascending or descending order according to these criteria:
• collection
• type
• right name
• right status (granted, denied, or unspecified)
Additionally, you can click one of the links in the "Source" column to display the source of inherited rights.
6.2.2 To assign principals to an access control list for an object
An access control list specifies the users that are granted or denied rights on an object. In general, you follow this workflow to assign a principal to an access control list, and to specify the rights that the principal has to the object.
1.
Select the object to which you want to add a principal.
2.
Click Manage > User Security.
The "User Security" dialog box appears and displays the access control list.
3.
Click Add Principals.
The "Add Principals" dialog box appears.
4.
Move the users and groups you want to add as principals from the Available users/groups list to the Selected users/groups list.
5.
Click Add and Assign Security.
6.
Select the access levels you want to grant the principal.
7.
Choose whether to enable or disable folder or group inheritance.
If necessary, you can also modify rights at a granular level to override certain rights in an access level.
Related Topics
•
To modify security for a principal on an object
6.2.3 To modify security for a principal on an object
In general, it is recommended that you use access levels to assign rights to a principal. However, you may need to override certain granular rights in an access level sometimes. Advanced rights let you customize the rights for a principal on top of the access levels the principal already has. In general, you follow this workflow to assign advanced rights to a principal on an object.
127 2012-12-12
Setting Rights
1.
Assign the principal to the access control list for the object.
2.
When the principal has been added, go to Manage > User Security to display the access control list for the object.
3.
Select the principal from the access control list, and click Assign Security.
The "Assign Security" dialog box appears.
4.
Click the Advanced tab.
5.
Click Add/Remove rights.
6.
Modify the rights for the principal.
All the available rights are summarized in the Rights Appendix.
Related Topics
•
To assign principals to an access control list for an object
6.2.4 To set rights on a top-level folder in BI platform
In general, you follow this workflow to set rights on a top-level folder in BI platform.
Note:
For this release, principals require View rights on a container folder to be able to navigate in that folder and view its sub-objects. This means that principals require View rights on the top-level folder to view objects that are in folders. If you want to limit View rights for a principal, you can grant a principal View rights on a specific folder and set the scope of rights to apply to that folder only.
1.
Go to the CMC area that has the top-level folder you want to set rights for.
2.
Click Manage > Top-Level Security > All Objects.
Here Objects represents the contents of the top-level folder. If you are prompted for confirmation, click OK.
The "User Security" dialog box appears and displays the access control list for the top-level folder.
3.
Assign the principal to the access control list for the top-level folder.
4.
If necessary, assign advanced rights to the principal.
Related Topics
•
To assign principals to an access control list for an object
•
To modify security for a principal on an object
6.2.5 Checking security settings for a principal
128 2012-12-12
Setting Rights
In some cases, you may want to know the objects to which a principal has been granted or denied access. You can use a security query to do this. Security queries let you determine which objects a principal has certain rights to and manage user rights. For each security query, you provide the following information:
• Query principal
You specify the user or group that you want to run the security query for. You can specify one principal for each security query.
• Query permission
You specify the right or rights you want to run the security query for, the status of these rights, and the object type these rights are set on. For example, you can run a security query for all reports that a principal can refresh, or for all reports that a principal cannot export.
• Query context
You specify the CMC areas that you want the security query to search. For each area, you can choose whether to include sub-objects in the security query. A security query can have a maximum of four areas.
When you run a security query, the results appear in the "Query Results" area in the Tree panel under
Security Queries. If you want to refine a security query, you can run a second query within the results from the first query.
Security queries are useful because they allow you to see the objects that a principal has certain rights to, and they provide the locations of these objects if you want to modify those rights. Consider a situation in which a sales employee is promoted to sales manager. The sales manager needs Schedule rights for Crystal reports that he only had View rights to previously, and these reports are in different folders.
In this case, the administrator runs a security query for the sales manager's right to view Crystal reports in all folders and includes sub-objects in the query. After the security query runs, the administrator can see all Crystal reports that the sales manager has View rights for in the "Query Results" area. Because the Details panel displays the location of each Crystal report, the administrator can browse for each report and modify the sales manager's rights on it.
6.2.5.1 To run a security query
1.
In the "Users and Groups" area, in the Details panel, select the user or group that you want to run a security query for.
2.
Click Manage > Tools > Create Security Query.
129 2012-12-12
Setting Rights
130
The "Create Security Query" dialog box appears.
3.
Ensure that the principal in the Query Principal area is correct.
If you decide to run a security query for a different principal, you can click Browse to select another principal. In the "Browse for Query Principal" dialog box, expand User List or Groups List to browse for the principal, or search for the principal by name. When you are finished, click OK to return to the "Create Security Query" dialog box.
4.
In the "Query Permission" area, specify the rights and the status of each right for which you want to run the query..
• If you want to run a query for specific rights that the principal has on objects, click Browse, set the status of each right that you want to run the security query for, and click OK.
Tip:
You can delete specific rights from the query by clicking the delete button next to the right, or delete all rights from the query by clicking the delete button in the header row.
• If you want to run a general security query, select the Do not query by permissions check box.
When you do this, BI platform runs a general security query for all objects that have the principal in their access control lists regardless of the permissions that the principal has on the objects.
5.
In the "Query Context" area, specify the CMC areas that you want to query.
a.
Select a check box next to a list.
b.
On the list, select a CMC area that you want to query.
If you want to query a more specific location within an area (for example, a particular folder under
Folders), click Browse to open the "Browse for Query Context" dialog box. In the details pane, select the folder you want to query, and click OK. When you return to the Security Query dialog box, the folder you specified appears in the box under the list.
c.
Select Query sub object.
d.
Repeat the steps above for each CMC area that you want to query.
2012-12-12
Setting Rights
Note:
You can query a maximum of four areas.
6.
Click OK.
The security query runs and you are taken to the "Query Results" area.
7.
To view the query results, in the Tree panel, expand Security Queries and click a query result.
Tip:
Query results are listed according to the names of principals.
The query results are displayed in the Details panel.
The "Query Results" area retains all security query results from a single user session until the user logs off. If you want to run the query again but with new specifications, click Actions > Edit Query. You can also rerun the exact same query by selecting the query and clicking Actions > Rerun Query. If you want to keep your security query results, click Actions > Export to export your security query results as a CSV file.
6.3 Working with access levels
You can do the following with access levels:
• Copy an existing access level, make changes to the copy, rename it, and save it as a new access level.
• Create, rename, and delete access levels.
• Modify the rights in an access level.
• Trace the relationship between access levels and other objects in the system.
• Replicate and manage access levels across sites.
• Use one of the predefined access levels in BI platform to set rights quickly and uniformly for many principals.
The following table summarizes the rights that each predefined access level contains.
131 2012-12-12
Setting Rights
Table 6-2: Predefined access levels
Access level
View
Schedule
View On Demand
Full Control
Description Rights involved
If set on the folder level, a principal can view the folder, objects within the folder, and each object's generated instances. If set at the object level, a principal can view the object, its history, and its generated instances.
• View objects
• View document instances
A principal can generate instances by scheduling an object to run against a specified data source once or on a recurring basis. The principal can view, delete, and pause the scheduling of instances that they own.
They can also schedule to different formats and destinations, set parameters and database logon information, choose servers to process jobs, add contents to the folder, and copy the object or folder.
View access level rights, plus:
• Schedule the document to run
• Define server groups to process jobs
• Copy objects to another folder
• Schedule to destinations
• Print the report's data
• Export the report's data
• Edit objects that the user owns
• Delete instances that the user owns
• Pause and resume document instances that the user owns
A principal can refresh data on demand against a data source.
Schedule access level rights, plus:
• Refresh the report's data
A principal has full administrative control of the object.
All available rights, including:
• Add objects to the folder
• Edit objects
• Modify rights users have to objects
• Delete objects
• Delete instances
The following table summarizes the rights required to perform certain tasks on access levels.
132 2012-12-12
Setting Rights
Access level task
Create an access level
Rights required
• Add right on the Access Levels top-level folder
View granular rights in an access level
• View right on the access level
Assign an access level to a principal on an object
• View right on the access level
• Use the Access Level for Security Assignment right on the access level
• Modify Rights right on the object, or Securely Modify Rights right on the object and the principal
Note:
Users who have the Securely Modify Rights right and want to assign an access level to a principal must have that same access level assigned to themselves.
Modify an access level
• View and Edit rights on the access level
Delete an access level
Clone an access level
• View and Delete rights on the access level
• View right on the access level
• Copy right on the access level
• Add right on the Access Levels top-level folder
6.3.1 Choosing between View and View On Demand access levels
When reporting over the web, the choice to use live or saved data is one of the most important decisions you'll make. Whichever choice you make, however, BI platform displays the first page as quickly as possible, so you can see your report while the rest of the data is being processed. This section explains the difference between two predefined access levels that you can use to make this choice.
View On Demand access level
On-demand reporting gives users real-time access to live data, straight from the database server. Use live data to keep users up-to-date on constantly changing data, so they can access information that's accurate to the second. For instance, if the managers of a large distribution center need to keep track of inventory shipped on a continual basis, then live reporting is the way to give them the information they need.
Before providing live data for all your reports, however, consider whether or not you want all of your users hitting the database server on a continual basis. If the data isn't rapidly or constantly changing, then all those requests to the database do little more than increase network traffic and consume server
133 2012-12-12
Setting Rights resources. In such cases, you may prefer to schedule reports on a recurrent basis so that users can always view recent data (report instances) without hitting the database server.
Users require View On Demand access to refresh reports against the database.
View access level
To reduce the amount of network traffic and the number of hits on your database servers, you can schedule reports to be run at specified times. When the report has been run, users can view that report instance as needed, without triggering additional hits on the database.
Report instances are useful for dealing with data that isn't continually updated. When users navigate through report instances, and drill down for details on columns or charts, they don't access the database server directly; instead, they access the saved data. Consequently, reports with saved data not only minimize data transfer over the network, but also lighten the database server's workload.
For example, if your sales database is updated once a day, you can run the report on a similar schedule.
Sales representatives then always have access to current sales data, but they are not hitting the database every time they open a report.
Users require only View access to display report instances.
6.3.2 To copy an existing access level
This is the best way to create an access level if you want an access level that differs slightly from one of the existing access levels.
1.
Go to the "Access Levels" area.
2.
In the Details panel, select an access level.
Tip:
Select an access level that contains rights that are similar to what you want for your access level.
3.
Click Organize > Copy.
A copy of the access level you selected appears in the Details panel.
6.3.3 To create a new access level
This is the best way to create an access level if you want an access level that differs greatly from one of the existing access levels.
1.
Go to the "Access Levels" area.
2.
Click Manage > New > Create Access Level.
The "Create New Access Level" dialog box appears.
134 2012-12-12
Setting Rights
3.
Enter a title and description for your new access level, and then click OK.
You return to the "Access Levels" area, and the new access level appears in the Details panel.
6.3.4 To rename an access level
1.
In the "Access Levels" area, in the Details panel, select the access level that you want to rename.
2.
Click Manage > Properties.
The "Properties" dialog box appears.
3.
In the Title field, enter a new name for your access level, and then click Save & Close.
You return to the "Access Levels" area.
6.3.5 To delete an access level
1.
In the "Access Levels" area, in the Details panel, select the access level that you want to delete.
2.
Click Manage > Delete Access Level.
Note:
You cannot delete predefined access levels.
A dialog box appears with information about the objects that this access level affects. If you do not want to delete the access level, click Cancel to exit the dialog box.
3.
Click Delete.
The access level is deleted, and you return to the "Access Levels" area.
6.3.6 To modify rights in an access level
To set rights for an access level, you first set general global rights that apply to all objects regardless of type, and then you specify when you want to override the general settings based on the specific object type.
1.
In the Access Levels area, in the Details panel, select the access level that you want to modify the rights for.
2.
Click Actions > Included Rights.
The Included Rights dialog box appears and displays a list of effective rights.
3.
Click Add/Remove Rights.
135 2012-12-12
Setting Rights
The Included Rights dialog box displays the rights collections for the access level in the navigation list. The General Global Rights section is expanded by default.
4.
Set your general global rights.
Each right can have a status of Granted, Denied, or Not Specified. You can also choose whether to apply that right to the object only, to apply it to sub-objects only, or both.
5.
To set type-specific rights for the access level, in the navigation list, click the rights collection, and then click the sub-collection that applies to the object type you want to set the rights for.
6.
When you have finished, click OK.
You return to the list of effective rights.
Related Topics
•
Managing security settings for objects in the CMC
•
6.3.7 Tracing the relationship between access levels and objects
Before you modify or delete an access level, it is important to confirm that any changes you make to the access level will not impact objects in the CMC negatively. You can do this by running a relationship query on the access level.
Relationship queries are useful for rights management because they allow you to see objects impacted by an access level in one convenient location. Consider a situation in which a company restructures its organization and merges two departments, Department A and Department B, into Department C.
136 2012-12-12
Setting Rights
The administrator decides to delete the access levels for Department A and Department B because these departments no longer exist. The administrator runs relationship queries for both access levels before deleting them. In the "Query Results" area, the administrator can see the objects that will be affected if the administrator deletes the access levels. The Details panel also shows the administrator the location of the objects in the CMC if the rights on the objects must be modified before the access levels are deleted.
Note:
• To view the list of affected objects, you must have View rights on those objects.
• Relationship query results for an access level only yield objects on which the access level is explicitly assigned. If an object uses an access level because of inheritance settings, that object does not appear in the query results.
6.3.8 Managing access levels across sites
Access levels are one of the objects that you can replicate from an Origin site to Destination sites. You can choose to replicate access levels if they appear in a replication object's access control list. For example, if a principal is granted access level A on a Crystal report and the Crystal report is replicated across sites, access level A is also replicated.
Note:
If an access level with the same name exists in the Destination site, the access level replication will fail. You or the Destination site administrator must rename one of the access levels before replication.
After you replicate an access level across sites, keep the administration considerations in this section in mind.
Modifying replicated access levels in the Origin site
If a replicated access level is modified in the Origin site, the access level in the Destination site will be updated the next time the replication is scheduled to run. In two-way replication scenarios, if you modify a replicated access level in the Destination site, the access level in the Origin site changes.
Note:
Ensure that changes to an access level in one site do not affect objects in other sites negatively. Consult your site administrators and advise them to run relationship queries for the replicated access level before you make any changes.
Modifying replicated access levels in the Destination site
Note:
This applies to one-way replication only.
Any changes to replicated access levels made in a Destination site are not reflected in the Origin site.
For example, a Destination site administrator can grant the right to schedule Crystal reports in the replicated access level even though this right was denied in the Origin site. As a result, although the access level names and replicated object names remain the same, the effective rights that principals have on objects may differ from Destination site to Destination site.
137 2012-12-12
Setting Rights
If the replicated access level differs between the Origin and Destination sites, the difference in effective rights will be detected the next time a Replication Job is scheduled to run. You can force the Origin site access level to override the Destination site access level, or allow the Destination site access level to remain intact. However, if you do not force the Origin site access level to override the Destination site access level, any objects pending Replication that use that access level will fail to replicate.
To restrict users from modifying replicated access levels in the Destination site, you can add Destination site users to the access level as principals, and grant those users View rights only. This means that
Destination site users can view the access level but are unable to modify its rights settings or assign it to other users.
Related Topics
•
•
Tracing the relationship between access levels and objects
6.4 Breaking inheritance
Inheritance lets you manage your security settings without setting rights for each individual object.
However, in some cases, you may not want rights to be inherited. For example, you may want to customize rights for each object. You can disable inheritance for a principal in an object's access control list. When you do this, you can choose whether to disable group inheritance, folder inheritance, or both.
Note:
When inheritance is broken, it is broken for all rights; it is not possible to turn off inheritance for some rights but not for others.
In the diagram “Breaking inheritance”, group and folder inheritance are initially in effect. Red User inherits rights 1 and 5 as granted, rights 2, 3, and 4 as unspecified, and right 6 as explicitly denied.
These rights, set on the folder level for the group, mean that Red User, and every other member of the group, has these rights on the folder's objects, A and B. When inheritance is broken on the folder level,
Red User's set of rights to the objects in that folder is cleared until an administrator assigns new rights to him.
138 2012-12-12
Setting Rights
Figure 6-9: Breaking inheritance
6.4.1 To disable inheritance
This procedure lets you disable group or folder inheritance, or both, for a principal on an object's access control list.
1.
Select the object that you want to disable inheritance for.
2.
Click Manage > User Security.
The "User Security" dialog box appears.
3.
Select the principal that you want to disable inheritance for, and click Assign Security.
The "Assign Security" dialog box appears.
4.
Configure your inheritance settings.
• If you want to disable group inheritance (the rights that the principal inherits from group membership), clear the Inherit From Parent Group check box.
• If you want to disable folder inheritance (the rights settings that the object inherits from the folder), clear the Inherit From Parent Folder check box.
5.
Click OK.
6.5 Using rights to delegate administration
Besides allowing you to control access to objects and settings, rights allow you to divide administrative tasks between functional groups within your organization. For example, you may want people from different departments to manage their own users and groups. Or you may have one administrator who handles high-level management of BI platform, but you want all server management to be handled by people in your IT department.
139 2012-12-12
Setting Rights
Assuming that your group structure and folder structure align with your delegated-administration security structure, you should grant your delegated administrator rights to entire user groups, but grant the delegated administrator less than full rights on the users he controls. For example, you might not want the delegated administrator to edit user attributes or reassign them to different groups.
Note:
Object migrations are best performed by members of the Administrators group, in particular the
Administrator user account. To migrate an object, many related objects may also need to be migrated.
Obtaining the required security rights for all the objects may not be possible for a delegated administrator account.
The “Rights for delegated administrators” table summarizes the rights required for delegated administrators to perform common actions.
Table 6-3: Rights for delegated administrators
Action for delegated administrator
Rights required by the delegated administrator
Add right on the top-level Users folder Create new users
Create new groups Add right on the top-level User Groups folder
Delete any controlled groups, as well as individual users in those groups
Delete right on relevant groups
Delete only users that the delegated administrator creates
Owner Delete right on the top-level Users folder
Delete only users and groups that the delegated administrator creates
Owner Delete right on the top-level User Groups folder
Manipulate only users that the delegated creates
(including adding those users to those groups)
Owner Edit and Owner Securely Modify Rights right on the top-level Users folder
Manipulate only groups that the delegated administrator creates (including adding users to those groups)
Owner Edit and Owner Securely Modify Rights on the top-level User Groups folder
Modify passwords for users in their controlled groups
Edit Password right on relevant groups
140 2012-12-12
Setting Rights
Action for delegated administrator
Rights required by the delegated administrator
Modify passwords only for principals the delegated administrator creates
Owner Edit Password right on top-level Users folder, or on relevant groups
Note:
Setting the Owner Edit Password right on a group takes effect on a user only when you add the user to the relevant group.
Modify user names, description, other attributes, and reassign users to different groups
Edit right on relevant groups
Modify user names, description, other attributes, and reassign users to different groups, but only for users that the delegated administrator creates
Owner Edit right on top-level Users folder, or on relevant groups
Note:
Setting the Owner Edit right on relevant groups takes effect on a user only when you add the user to the relevant group.
6.5.1 Choosing between “Modify the rights users have to objects” options
When you set up delegated administration, give your delegated administrator rights on the principals he will control. You may want to give her all rights (Full Control); however, it is good practice to use advanced rights settings to withhold the Modify Rights right and give your delegated administrator the
Securely Modify Rights right instead. You may also give your administrator the Securely Modify
Rights Inheritance Settings right instead of the Modify Rights Inheritance Settings right. The differences between these rights are summarized below.
Modify the rights users have to objects
This right allows a user to modify any right for any user on that object. For example, if user A has the rights View objects and Modify the rights users have to object on an object, user A can then change the rights for that object so he or any other user has full control of this object.
Securely modify the rights users have to objects
This right allows a user to grant, deny, or revert to unspecified only the rights he is already granted. For example, if user A has View and Securely modify the rights users have to objects rights, user A cannot give herself any more rights and can grant or deny to other users only these two rights (View
141 2012-12-12
Setting Rights and Securely Modify Rights). Additionally, user A can change only the rights for users on objects for which he has the Securely Modify Rights right.
These are all the conditions that must exist for user A to modify the rights for user B on object O:
• User A has the Securely Modify Rights right on object O.
• Each right or access level that user A is changing for user B is granted to A.
• User A has the Securely Modify Rights right on user B.
• If an access level is being assigned, User A has Assign Access Level right on the access level that is changing for user B.
Scope of rights can further limit the effective rights that a delegated administrator can assign. For example, a delegated administrator may have Securely Modify Rights and Edit rights on a folder, but the scope of these rights is limited to the folder only and does not apply to its sub-objects. Effectively, the delegated administrator can grant the Edit right on the folder (but not on its sub-objects) only, and with an “Apply to objects” scope only. On the other hand, if the delegated administrator is granted the
Edit right on a folder with a scope of “Apply to sub-objects” only, she can grant other principals the
Edit right with both scopes on the folder's sub-objects, but on the folder itself, she can only grant the
Edit right with an “Apply to sub-objects” scope.
In addition, the delegated administrator will be restricted from modifying rights on those groups for other principals that she doesn't have the Securely Modify Rights right on. This is useful, for example, if you have two delegated administrators responsible for granting rights to different user groups for the same folder, but you don't want one delegated administrator to be able to deny access to the groups controlled by the other delegated administrator. The Securely Modify Rights right ensures this, since delegated administrators generally won't have the Securely Modify Rights right on each other.
Securely modify rights inheritance settings
This right allows a delegated administrator to modify inheritance settings for other principals on the objects that the delegated administrator has access to. To successfully modify the inheritance settings of other principals, a delegated administrator must have this right on the object and on the user accounts for the principals.
6.5.2 Owner rights
Owner rights are rights that apply only to the owner of the object on which rights are being checked. In
BI platform, the owner of an object is the principal who created the object; if that principal is ever deleted from the system, ownership reverts to the Administrator.
Owner rights are useful in managing owner-based security. For example, you may want to create an folder or hierarchy of folders in which various users can create and view documents, but can only modify or delete their own documents. In addition, owner rights are useful for allowing users to manipulate instances of reports they create, but not others' instances. In the case of the scheduling access level, this permits users to edit, delete, pause and reschedule only their own instances.
142 2012-12-12
Setting Rights
Owner rights work similarly to their corresponding regular rights. However, owner rights are effective only when the principal has been granted owner rights but regular rights are denied or not specified.
6.6 Summary of recommendations for rights administration
Keep these considerations in mind for rights administration:
• Use access levels wherever possible. These predefined sets of rights simplify administration by grouping together rights associated with common user needs.
• Set rights and access levels on top-level folders. Enabling inheritance will allow these rights to be passed down through the system with minimal administrative intervention.
• Avoid breaking inheritance whenever possible. By doing so, you can reduce the amount of time it takes to secure the content that you have added to BI platform.
• Set appropriate rights for users and groups at the folder level, then publish objects to that folder. By default, users or groups who have rights to a folder will inherit the same rights for any object that you subsequently publish to that folder.
• Organize users into user groups, assign access levels and rights to the entire group, and assign access levels and rights to specific members when necessary.
• Create individual administrator accounts for each administrator in the system and add them to the
Administrators group to improve accountability for system changes.
• By default, the Everyone group is granted very limited rights to top-level folders in BI platform. After installation, it is recommended that you review the rights of Everyone group members and assign security accordingly.
143 2012-12-12
Setting Rights
144 2012-12-12
Securing the BI platform
Securing the BI platform
7.1 Security overview
This section details the ways in which BI platform addresses enterprise security concerns, thereby providing administrators and system architects with answers to typical questions regarding security.
The BI platform architecture addresses the many security concerns that affect today's businesses and organizations. The current release supports features such as distributed security, single sign-on, resource access security, granular object rights, and third-party authentication in order to protect against unauthorized access.
Because BI platform provides the framework for an increasing number of components from the Enterprise family of SAP BusinessObjects products, this section details the security features and related functionality to show how the framework itself enforces and maintains security. As such, this section does not provide explicit procedural details; instead, it focuses on conceptual information and provides links to key procedures.
After a brief introduction to security concepts for the system, details are provided for the following topics:
• How to use encryption and data processing security modes to protect data.
• How to set up the Secure Sockets Layer for BI platform deployments.
• Guidelines for setting up and maintaining firewalls for BI platform.
• Configuring reverse proxy servers.
7.2 Disaster recovery planning
Certain steps must be taken to protect your organization's investment in BI platform to ensure maximum continuity of function lines of business in the event of a disaster. This section provides guidelines for drafting a disaster recovery plan for your organization.
General guidelines
• Perform regular system backups and send copies of some of the backup media offsite if necessary.
• Safely store all software media.
• Safely store all license documentation.
145 2012-12-12
Securing the BI platform
Specific guidelines
There are three system resources that require specific attention in terms of disaster recovery planning:
• Content in the file repository servers: this includes proprietary content such as reports. You should regularly backup this content - in the event of a disaster there is no way to regenerate such content without a regular backup process in place.
• The system database used by the CMS: this resource contains all the crucial metadata for your deployment such as user information, reports and other sensitive information that is particular to your organization.
• Database information key file (.dbinfo file): this resource contains the master key to the system database. If for some reason this key is not available, you will not be able to access the system database. It is highly recommended after deploying BI platform you store the password for this resource in a safe and known location. Without the password you will not be able to regenerate the file and therefore lose access to the system database.
7.3 General recommendations for securing your deployment
The following are recommended guidelines for securing your BI platform deployments.
• Use firewalls to protect the communication between the CMS and other system components. If possible, always hide your CMS behind the firewall. At the very least, ensure that the system database is safely behind the firewall.
• Add additional encryption to the File Repository Servers. Once the system is up and running, proprietary content will be stored in these servers. Add additional encryption through the operating system or use a third-party tool.
Note:
BI platform does not support SFTP. If you require SFTP functionality, please refer to SAP Note
1556571 or consider an SAP partner solution.
• Deploy a reverse proxy server in front of the web application servers in order to hide them behind a single IP address. This configuration routes all Internet traffic that is addressed to private web application servers through the reverse proxy server, therefore hiding private IP addresses.
• Strictly enforce corporate password policies. Ensure that user passwords are routinely changed.
• If you have opted to install the system database and web application server provided with BI platform, you should access the relevant documentation to ensure these components are deployed with adequate security configurations.
• The platform includes Apache Tomcat as the default web application server. If you plan to use this server, regularly refer to the Apache site for security updates. In some cases, you may need to manually update your version of Tomcat to ensure that the latest security fixes are installed. Refer to Apache Tomcat security recommendations for running the web application server.
• Use the Secure Sockets Layer (SSL) protocol for all network communication between clients and servers in your deployment.
• Ensure that the platform installation directory and subdirectories are secured. Sensitive temporary data may be stored in these directories during system operation.
146 2012-12-12
Securing the BI platform
• Access to the Central Management Console (CMC) should be restricted to local access only. For information on deployment options for the CMC, see the SAP BusinessObjects Business Intelligence
Platform Web Application Deployment Guide.
Related Topics
•
•
•
Configuring security for bundled third-party servers
7.4 Configuring security for bundled third-party servers
If you have opted to install third-party server components that are bundled with BI platform, it is recommended that you access and review the documentation for the following bundled components:
• Microsoft SQL Server 2008 Express Edition: For detailed information on securing this system database for Windows platforms see http://msdn.microsoft.com/en-us/li brary/bb283235%28v=sql.100%29.aspx
.
• IBM DB2 Workgroup Edition: For detailed information on securing this system database for Unix platforms see http://publib.boulder.ibm.com/infocenter/db2luw/v9r7/topic/com.ibm.db2.luw.contain
er.doc/doc/c0052964.html
.
• Apache Tomcat 6.0: For detailed information on security for this web application server see http://tomcat.apache.org/tomcat-6.0-doc/index.html
.
7.5 Active trust relationship
In a networked environment, a trust relationship between two domains is generally a connection that allows one domain accurately to recognize users who have been authenticated by the other domain.
While maintaining security, the trust relationship allows users to access resources in multiple domains without repeatedly having to provide their credentials.
Within the BI platform environment, the active trust relationship works similarly to provide each user with seamless access to resources across the system. Once the user has been authenticated and granted an active session, all other BI platform components can process the user's requests and actions without prompting for credentials. As such, the active trust relationship provides the basis for BI platform's distributed security.
147 2012-12-12
Securing the BI platform
7.5.1 Logon tokens
A logon token is an encoded string that defines its own usage attributes and contains a user's session information. The logon token's usage attributes are specified when the logon token is generated. These attributes allow restrictions to be placed upon the logon token to reduce the chance of the logon token being used by malicious users. The current logon token usage attributes are:
•
Number of minutes
This attribute restricts the lifetime of the logon token.
•
Number of logons
This attribute restricts the number of times that the logon token can be used to log on to BI platform.
Both attributes hinder malicious users from gaining unauthorized access to BI platform with logon tokens retrieved from legitimate users.
Note:
Storing a logon token in a cookie is a potential security risk if the network between the browser and application or web server is insecure – for example if the connection is made over a public network and is not using SSL or Trusted Authentication. It is good practice to use Secure Sockets Layer (SSL) to reduce security risk between the browser and application or web server.
When the logon cookie has been disabled, and the web server or web browser times out, the user is presented with the logon screen. When the cookie is enabled, and the server or browser times out, the user is seamlessly logged back onto the system. However, because state information is tied to the web session, the user's state is lost. For example, if the user had a navigation tree expanded and a particular item selected, the tree is reset.
For BI platform, the default is to have logon tokens enabled in the web client, however, you can disable logon tokens for BI launch pad. When you disable the logon tokens in the client, the user session will be limited by the web server or web browser timeout. When that session expires, the user will be required to log in to BI platform again.
7.5.2 Ticket mechanism for distributed security
Enterprise systems dedicated to serving a large number of users typically require some form of distributed security. An enterprise system may require distributed security to support features such the transfer of trust (the ability to allow another component to act on behalf of the user).
BI platform addresses distributed security by implementing a ticket mechanism (one that is similar to the Kerberos ticket mechanism). The CMS grants tickets that authorize components to perform actions on behalf of a particular user. In BI platform, the ticket is referred to as the logon token.
148 2012-12-12
Securing the BI platform
This logon token is most commonly used over the Web. When users are first authenticated by BI platform they receive logon tokens from the CMS. The user's web browser caches this logon token. When the user makes a new request, other BI platform components can read the logon token from the user's web browser.
7.6 Sessions and session tracking
In general, a session is a client-server connection that enables the exchange of information between the two computers. A session's state is a set of data that describes the session's attributes, its configuration, or its content. When you establish a client-server connection over the Web, the nature of HTTP limits the duration of each session to a single page of information; thus, your web browser retains the state of each session in memory only for as long as any single Web page is displayed. As soon as you move from one web page to another, the state of the first session is discarded and replaced with the state of the next session. Consequently, Web sites and Web applications must somehow store the state of one session if they need to reuse its information in another.
BI platform uses two common methods to store session state:
• Cookies—A cookie is a small text file that stores session state on the client side: the user's web browser caches the cookie for later use. The BI platform logon token is an example of this method.
• Session variables—A session variable is a portion of memory that stores session state on the server side. When BI platform grants a user an active identity on the system, information such as the user's authentication type is stored in a session variable. So long as the session is maintained, the system neither has to prompt the user for the information a second time nor has to repeat any task that is necessary for the completion of the next request.
For Java deployments, the session is used to handle .jsp requests; for .NET deployments, the session is used to handle .aspx requests.
Note:
Ideally, the system should preserve the session variable while the user is active on the system. And, to ensure security and to minimize resource usage, the system should destroy the session variable as soon as the user has finished working on the system. However, because the interaction between a web browser and a web server can be stateless, it can be difficult to know when users leave the system, if they do not log off explicitly. To address this issue, BI platform implements session tracking.
7.6.1 CMS session tracking
The CMS implements a simple tracking algorithm. When a user logs on, the user is granted a CMS session, which the CMS preserves until the user logs off, or until the web application server session variable is released.
149 2012-12-12
Securing the BI platform
The web application server session is designed to notify the CMS on a recurring basis that it is still active, so the CMS session is retained so long as the web application server session exists. If the web application server session fails to communicate with the CMS for a ten-minute time period, the CMS destroys the CMS session. This handles scenarios where client-side components shut down irregularly.
7.7 Environment protection
Environment protection refers to the security of the overall environment in which client and server components communicate. Although the Internet and web-based systems are increasingly popular due to their flexibility and range of functionality, they operate in an environment that can be difficult to secure.
When you deploy BI platform, environment protection is divided into two areas of communication: web browser to web server, and web server to BI platform.
7.7.1 Web browser to web server
When data is transmitted between the web browser and the web server, some degree of security is usually required. Relevant security measures usually involve two general tasks:
• Ensuring that the communication of data is secure.
• Ensuring that only valid users retrieve information from the web server.
Note:
These tasks are typically handled by web servers through various security mechanisms, including the
Secure Sockets Layer (SSL) protocol, and other such mechanisms. It is good practice to use Secure
Sockets Layer (SSL) to reduce security risk between the browser and application or web server.
You must secure communication between the web browser and the web server independently of BI platform. For details on securing client connections, refer to your web server documentation.
7.7.2 Web server to BI platform
Firewalls are commonly used to secure the area of communication between the web server and the rest of the corporate intranet (including BI platform). The platform supports firewalls that use IP filtering or static network address translation (NAT). Supported environments can involve multiple firewalls, web servers, or application servers.
150 2012-12-12
Securing the BI platform
7.8 Auditing security configuration modifications
Any changes to default security configurations for the following will not be audited by BI platform:
• Properties files for the web applications (BOE, web services)
• TrustedPrincipal.conf
• Customization performed on BI launch pad and Open Document
In general, any security configuration modifications performed outside the CMC will not be audited.
This also applies to modifications performed though the Central Configuration Manager (CCM). Changes committed through the CMC can be audited.
7.9 Auditing web activity
BI platform provides insight into your system by recording web activity and allowing you to inspect and to monitor the details. The web application server allows you to select the web attributes—such as time, date, IP address, port number, and so on—that you want to record. The auditing data is logged to disk and stored in comma-delimited text files, so you can easily report off the data or import it into other applications.
7.9.1 Protection against malicious logon attempts
No matter how secure a system is, there is often at least one location that is vulnerable to attack: the location where users connect to the system. It is nearly impossible to protect this location completely, because the process of simply guessing a valid user name and password remains a viable way to attempt to "crack" the system.
BI platform implements several techniques to reduce the probability of a malicious user achieving access to the system. The various restrictions listed below apply only to Enterprise accounts—that is, the restrictions do not apply to accounts that you have mapped to an external user database (LDAP or
Windows AD). Generally, however, your external system will enable you to place similar restrictions on the external accounts.
7.9.2 Password restrictions
151 2012-12-12
Securing the BI platform
Password restrictions ensure that users authenticating the default Enterprise authentication create passwords that are relatively complex. You can enable the following options:
• Enforce mixed-case passwords
This option ensures that passwords contain at least two of the following character classes: upper case letters, lower case letters, numbers, or punctuation.
• Must contain at least N characters
By enforcing a minimum complexity for passwords, you decrease a malicious user's chances of simply guessing a valid user's password.
7.9.3 Logon restrictions
Logon restrictions serve primarily to prevent dictionary attacks (a method whereby a malicious user obtains a valid user name and attempts to learn the corresponding password by trying every word in a dictionary). With the speed of modern hardware, malicious programs can guess millions of passwords per minute. To prevent dictionary attacks, BI platform has an internal mechanism that enforces a time delay (0.5–1.0 second) between logon attempts. In addition, the platform provides several customizable options that you can use to reduce the risk of a dictionary attack:
• Disable accounts after N failed attempts to log on
• Reset failed logon count after N minute(s)
• Re-enable account after N minute(s)
7.9.4 User restrictions
User restrictions ensure that users authenticating the default Enterprise authentication create new passwords on a regular basis. You can enable the following options:
• Must change password every N day(s)
• Cannot reuse the N most recent password(s)
• Must wait N minute(s) to change password
These options are useful in a number of ways. Firstly, any malicious user attempting a dictionary attack will have to recommence every time passwords change. And, because password changes are based on each user's first logon time, the malicious user cannot easily determine when any particular password will change. Additionally, even if a malicious user does guess or otherwise obtain another user's credentials, they are valid only for a limited time.
152 2012-12-12
Securing the BI platform
7.9.5 Guest account restrictions
The BI platform supports anonymous single sign-on for the Guest account. Thus, when users connect to BI platform without specifying a user name and password, the system logs them on automatically under the Guest account. If you assign a secure password to the Guest account, or if you disable the
Guest account entirely, you disable this default behavior.
7.10 Processing extensions
BI platform allows you to further secure your reporting environment through the use of customized processing extensions. A processing extension is a dynamically loaded library of code that applies business logic to particular BI platform view or schedule requests before they are processed by the system.
Through its support for processing extensions, the BI platform administration SDK essentially exposes a "handle" that allows developers to intercept the request. Developers can then append selection formulas to the request before the report is processed.
A typical example is a report-processing extension that enforces row-level security. This type of security restricts data access by row within one or more database tables. The developer writes a dynamically loaded library that intercepts view or schedule requests for a report (before the requests are processed by a Job Server, Processing Server, or Report Application Server). The developer's code first determines the user who owns the processing job; then it looks up the user's data-access privileges in a third-party system. The code then generates and appends a record selection formula to the report in order to limit the data returned from the database. In this case, the processing extension serves as a way to incorporate customized row-level security into the BI platform environment.
Tip:
By enabling processing extensions, you configure the appropriate BI platform server components to dynamically load your processing extensions at runtime. Included in the SDK is a fully documented API that developers can use to write processing extensions. For more information, see the developer documentation available on your product distribution.
7.11 Overview of BI platform data security
Administrators of BI platform systems manage the way sensitive data is secured through the following:
153 2012-12-12
Securing the BI platform
• A security setting at the cluster level that determines which applications and clients can access the
CMS. This setting is managed through the Central Configuration Manager.
• A two-key cryptography system that controls both access to the CMS repository, and keys used to encrypt/decrypt objects within the repository. Access to the CMS repository is set via the Central
Configuration Manager, while the Central Management Console has a dedicated management area for cryptographic keys.
These features allow administrators to set BI platform deployments to particular data security compliance levels and to manage encryption keys used to encrypt and decrypt data within the CMS repository.
7.11.1 Data processing security modes
BI platform can operate in two possible data processing security modes:
• The default data processing security mode. In certain instances, systems running in this mode will use hard-coded encryption keys and do not follow a specific standard. The default mode enables backward compatibility with previous versions of BI platform client tools and applications.
• A data security mode designed to meet guidelines stipulated by the Federal Information Processing
Standard (FIPS) - specifically FIPS 140-2. In this mode FIPS-compliant algorithms and cryptographic modules are used to protect sensitive data. When the platform runs in FIPS-compliant mode, all clients tools and applications that do not meet FIPS guidelines are automatically disabled. The platform client tools and applications are designed to meet the FIPS 140-2 standard. Older clients and applications will not work when SAP BusinessObjects Business Intelligence platform 4.0 is running in FIPS-compliant mode.
The data processing mode is transparent to system users. In both data processing security modes, sensitive data is encrypted and decrypted in the background by an internal encryption engine.
It is recommended that you use the FIPS-compliant mode in the following circumstances:
• Your SAP BusinessObjects Business Intelligence platform 4.0 deployment will not need to use or interact with any legacy BI platform client tools or applications.
• Your organization's data processing standards and guidelines prohibit the use of hard-coded encryption keys.
• Your organization is required to secure sensitive data according to FIPS 140-2 regulations.
The data processing security mode is set through the Central Configuration Manager on both Windows and Unix platforms. Every node in a clustered environment must bet set to the same mode.
7.11.1.1 To turn on FIPS-compliant mode on Windows
By default, FIPS-compliant mode is off after BI platform is installed. Use the instructions below to turn on the FIPS-compliant setting for all nodes in your deployment.
154 2012-12-12
Securing the BI platform
155
1.
To launch the CCM, click Programs > SAP Business Intelligence > SAP BusinessObjects BI
platform 4 > Central Configuration Manager.
2.
In the CCM, right-click the Server Intelligence Agent (SIA) and choose Stop.
Caution:
Do not proceed to step 3 until the SIA status is marked as Stopped.
3.
Right-click the SIA and choose Properties.
The "Properties" dialog box appears, with the Properties tab displayed.
4.
Add -fips to the "Command" field, and click Apply.
5.
Click OK to close the "Properties" dialog box.
6.
Restart the SIA.
The SIA is now operating in FIPS-complaint mode.
You must turn on the FIPS-compliant setting on all SIAs in your BI platform deployment.
7.11.1.2 To turn on FIPS-compliant mode on Unix
All nodes in your BI platform deployment must be stopped before attempting the following procedure.
By default, FIPS-compliant mode is off after BI platform is installed. Use the instructions below to turn on the FIPS-compliant setting for all nodes in your deployment.
1.
Go to the directory where BI platform is installed on your Unix machine.
2.
Change to the sap_bobj directory.
3.
Type ccm.config and press Enter.
The ccm.config file is loaded.
4.
Add -fips to the node launch command parameter.
The node launch command parameter appears as [node name Launch].
5.
Save your changes and Exit.
6.
Restart the node.
The node is now operating in FIPS-complaint mode.
You must turn on the FIPS-compliant setting on all the nodes in your BI platform deployment.
7.11.1.3 To turn off FIPS-compliant mode on Windows
All servers in your BI platform deployment must be stopped before attempting the following procedure.
2012-12-12
Securing the BI platform
If your deployment is running on FIPS-compliant mode, use the following instructions to turn off the setting.
1.
In the CCM, right-click the Server Intelligence Agent (SIA) and choose Stop.
Caution:
Do not proceed to Step 2 until the node status is marked as "Stopped".
2.
Right-click the SIA and choose Properties.
The "Properties" dialog box appears.
3.
Remove -fips from the "Command" field and click Apply.
4.
Click OK to close the "Properties" dialog box.
5.
Restart the SIA.
7.12 Cryptography in BI platform
Sensitive Data
BI platform cryptography is designed to protect sensitive data stored in the CMS repository. Sensitive data includes user credentials, data source connectivity data, and any other info objects that store passwords. This data is encrypted to ensure privacy, keep it free from corruption, and maintain access control. All the requisite encryption resources (including the encryption engine, RSA libraries) are installed by default on each BI platform deployment.
The BI platform system uses a two-key cryptography system.
Cryptographic Keys
Encryption and decryption of sensitive data is handled in the background through the SDK interacting with the internal encryption engine. System administrators manage data security through symmetric encryption keys without directly encrypting or decrypting specific data blocks.
In BI platform, symmetric encryption keys known as Cryptographic Keys are used to encrypt/decrypt sensitive data. The Central Management Console has a dedicated management area for cryptographic keys. Use the "Cryptographic Keys" to view, generate, deactivate, revoke, and delete keys. The system ensures that any key required to decrypt sensitive data cannot be deleted.
Cluster Keys
Cluster keys are symmetric key wrapping keys that protect cryptographic keys stored in the CMS repository. Using symmetric key algorithms, cluster keys maintain a level of access control to the CMS repository. Each node in BI platform is assigned a cluster key during installation setup. System administrators can use the CCM to reset the cluster key.
156 2012-12-12
Securing the BI platform
7.12.1 Working with cluster keys
When running the installation setup program for BI platform, a six character cluster key is specified for the Server Intelligence Agent. This key is used to encrypt all the cryptographic keys in the CMS repository.
Without the correct cluster key you cannot access the CMS. The cluster key is stored in encrypted format in the dbinfo file. In a default Windows installation the file is stored in the following directory:
C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise
XI 4.0\win64_x64
. On Unix systems, the file is stored in the platform directory under <IN
STALLDIR>/sap_bobj/enterprise_xi40/
.
Unix platform
AIX
Solaris
Linux
Path
<INSTALLDIR>/sap_bobj/enterprise_xi40/aix_rs6000_64 /
<INSTALLDIR>/sap_bobj/enterprise_xi40/solaris_sparcv9/
<INSTALLDIR>/sap_bobj/enterprise_xi40/linux_x64/
The file is name in based on the following convention: _boe_<sia_name>.dbinfo, where <sia_name> is the name of the server intelligence agent for the cluster.
Note:
The cluster key for any given node cannot be retrieved from the dbinfo file. It is recommended that system administrators take considered and careful measures to protect cluster keys.
Only users with administrative privileges can reset cluster keys. When required, use the CCM to reset the six-character cluster key for every node your deployment. New cluster keys are automatically used to wrap the cryptographic keys within the CMS repository.
157
7.12.1.1 To reset the cluster key on Windows
Before resetting the cluster key for make sure all servers managed by the Server Intelligence Agent are stopped.
Use the following procedure to reset the cluster key for your node.
1.
To launch the CCM, go to Programs > SAP Business Intelligence > SAP BusinessObjects BI
platform 4 > Central Configuration Manager.
2.
In the CCM, right-click the Server Intelligence Agent (SIA) and choose Stop.
Caution:
Do not proceed to step 3 until the SIA status is marked as Stopped.
3.
Right-click the Server Intelligence Agent (SIA) and choose Properties.
2012-12-12
Securing the BI platform
158
The "Properties" dialog box appears, with the Properties tab open.
4.
Click the Configuration tab.
5.
Click Change under "CMS Cluster Key Configuration".
When a warning message appears, before proceeding, confirm that all requirements listed in the warning message have been met.
6.
Click Yes to continue.
The "Change Cluster Key" dialog box appears.
7.
Enter the same six-character key in both the New Cluster Key and Confirm New Cluster Key fields.
Note:
On Windows platforms, cluster keys must contain two of the following character types: lower case, upper case, numeral or punctuation. Alternately, users can also generate a random key. A random key is required to be FIPS-compliant.
8.
Click OK to submit the new cluster key to the system.
A message confirms that the cluster key was successfully reset.
9.
Restart the SIA.
In a multi-node cluster, you must reset the cluster keys for all the SIA in your BI platform deployment to the new key.
7.12.1.2 To reset the cluster key on Unix
Before resetting the cluster key for a node, make sure all servers managed by the node have been stopped.
1.
Go to the directory where BI platform is installed on your Unix machine.
2.
Change to the sap bobj directory.
3.
Type cmsdbsetup.sh and press Enter.
The "CMS Database Setup" screen appears.
4.
Type the name of the node and press Enter.
5.
Type 2 to change the cluster key.
A warning message appears.
6.
Select Yes to continue.
7.
In the field provided, type an eight-character new cluster key and press Enter.
Note:
On Unix platforms, a valid cluster key contains any combination of eight characters without restrictions.
8.
Re-enter the new cluster key in the field provided and press Enter.
A message appears informing you that the cluster key has been successfully reset.
2012-12-12
Securing the BI platform
9.
Restart the node.
You must reset all the nodes in your BI platform deployment to use the same cluster key.
7.12.2 Cryptographic Officers
To manage cryptographic keys in the CMC you must be a member of the Cryptographic Officers group.
The default administrator account created for BI platform is also a member of the Cryptographic Officers group. Use this account to add users to the Cryptographic Officers group as required. It is recommended that membership to the group be restricted to a limited number of users.
Note:
When users are added to the Administrators group, they do not inherit the rights required to perform management tasks on cryptographic keys.
7.12.2.1 To add a user to the Cryptographic Officers group
A user account must exist in BI platform before it can be added to the Cryptographic Officers group.
Note:
You must be a member of both of the Administrators and Cryptographic Officers groups to add a user to the Cryptographic Officers group.
1.
In the "Users and Groups" management area of the CMC, select the Cryptographic Officers group.
2.
Click Actions > Add Members to Group.
The "Add" dialog box appears.
3.
Click User list.
The Available users/groups list refreshes and displays all user accounts in the system.
4.
Move the user account that you want to add to the Cryptographic Officers group from the Available
users/groups list to the Selected users/groups list.
Tip:
To search for a specific user, use the search field.
5.
Click OK.
As a member of the Cryptographic Officers group, the newly added account will have access to the
"Cryptographic Keys" management area in the CMC.
159 2012-12-12
Securing the BI platform
7.12.2.2 To view cryptographic keys in the CMC
The CMC application contains a dedicated management area for cryptographic keys used by the BI platform system. Access to this area is restricted to members of the Cryptographic Officers group.
1.
To launch the CMC, go to Programs > SAP Business Intelligence > SAP BusinessObjects BI
platform 4 > SAP BusinessObjects BI platform Central Management Console.
The CMC home page appears.
2.
Click the Cryptographic Keys tab.
The "Cryptographic Keys" management area appears.
3.
Double-click the cryptographic key for which you want to see further details.
Related Topics
•
To view objects associated with a cryptographic key
7.12.3 Managing cryptographic keys in the CMC
Cryptographic officers use the "Cryptographic Keys" management area to review, generate, deactivate, revoke, and delete keys used to protect sensitive data stored in the CMS repository.
All cryptographic keys currently defined in the system are listed on the "Cryptographic Keys" management area. Basic information for each key is provided under the headings described in the following table:
Heading
Title
Status
Last Change
Objects
Description
Name identifier of the cryptographic key
The key's current status
Date and time stamp for the last change associated with the cryptographic key
Number of objects associated with the key
Related Topics
•
•
To create a new cryptographic key
•
To delete a cryptographic key from the system
•
•
To view objects associated with a cryptographic key
160 2012-12-12
Securing the BI platform
•
To mark cryptographic keys as compromised
7.12.3.1 Cryptographic key status
The following table lists all the possible status options for cryptographic keys in BI platform:
Status
Active
Deactivated
Compromised
Revoked
Description
Only one cryptographic key can be designated "Active" in the system. This key is used to encrypt current sensitive data that will be stored in the CMS database. The key is also used to decrypt all the objects that appear in its
Object List. Once a new cryptographic key is created, the current "Active" reverts to the "Deactivated" state. An active key cannot be deleted from the system.
A "Deactivated" key can no longer be used to encrypt data. It can however be used to decrypt all the objects that appear in its Object List. You cannot reactivate a key once it has been deactivated. A key marked as "Deactivated" cannot be deleted. from the system. You must change a key's status to "Revoked" before it can be deleted.
A cryptographic key that is deemed to be insecure can be marked as compromised. By flagging such a key, you can later proceed to re-encrypt data objects that are still associated with the key. Once a key is marked as compromised it must be revoked before it can be deleted from the system.
When a cryptographic key is revoked, a process is launched in which all objects currently associated with the key are re-encrypted with the current "Active" cryptographic key. Once a key is revoked it can safely be deleted from the system. The revocation mechanism ensures that data in the CMS database can always be decrypted. There is no way to reactivate a key once it has been revoked.
161 2012-12-12
Securing the BI platform
Status Description
Deactivated: Rekeyingin process
Indicates that the cryptographic key is in the process of being revoked. Once the process is complete, the key will be marked as "Revoked".
Deactivated: Rekeyingsuspended
Indicates that the process for revoking a cryptographic key has been suspended. This usually occurs if the process has been deliberately suspended or if a data object associated with the key is not available.
Revoked-Compromised A key is flagged as Revoked-Compromised if has been marked as compromised and all the data previously associated with it has been encrypted with another key. When a "Deactivated" key is marked as compromised, you are given a choice of not taking action or revoking the key. Once a compromised key is revoked it can be deleted.
7.12.3.2 To view objects associated with a cryptographic key
1.
Select the key in the "Cryptographic Keys " management area of the CMC.
2.
Click Manage > Properties.
The cryptographic key's "Properties" dialog box appears.
3.
Click "Object List" in the navigation pane on the left of the "Properties" dialog box.
All the objects associated with the cryptographic key are listed to the right of the navigation pane.
Tip:
Use the search functions to look for a specific object.
162
7.12.3.3 To create a new cryptographic key
Caution:
When you create a new cryptographic key, the system automatically deactivates the current "Active" key. Once a key has been deactivated it cannot be restored as the "Active" key.
1.
In the "Cryptographic Keys "management area of the CMC, click Manage > New > Cryptographic
Key.
The "Create New Cryptographic Key" dialog box appears.
2.
Click Continue to create the new cryptographic key.
3.
Type the name and a description of the new cryptographic key; click OK to save your information.
The new key is listed as the only active key in the "Cryptographic Keys" management area. The previously "Active" key is now marked as "Deactivated."
2012-12-12
Securing the BI platform
All new sensitive data generated and stored in the CMS database will now be encrypted with the new cryptographic key. You have the option to revoke the previous key and re-encrypt all its data objects with the new active key.
7.12.3.4 To mark cryptographic keys as compromised
You can mark a cryptographic key as compromised if for some reason a cryptographic key is considered to no longer be secure. This is useful for tracking purposes and you can proceed to identify which data objects are associated with the key. A cryptographic key must be deactivated before it can marked as compromised.
Note:
You can also mark a key as compromised after it has been revoked.
1.
Go to the "Cryptographic Keys " management area of the CMC.
2.
Select the cryptographic key you want to mark as compromised.
3.
Click Actions > Mark as Compromised.
The "Mark as Compromised" dialog box appears.
4.
Click Continue.
5.
Select one of following options from the "Mark as Compromised" dialog:
• Yes: launches the process to re-encrypt all data objects that are associated with the compromised key.
• No: the "Mark as Compromised" dialog box is closed and the cryptographic key is marked as
"Compromised" in the "Cryptographic Keys" management area.
Note:
If you select No, sensitive data will continue to be associated with the compromised key. The compromised key will be used by the system to decrypt the associated objects.
Related Topics
•
•
•
To view objects associated with a cryptographic key
163
7.12.3.5 To revoke a cryptographic key
A "Deactivated" cryptographic key can still be used by data objects associated with it. To break the association between the encrypted objects and the deactivated key, you must revoke the key.
2012-12-12
Securing the BI platform
1.
Select the key you want to revoke from the keys listed in "Cryptographic Keys" management area.
2.
Click Actions > Revoke.
The "Revoke cryptographic key" dialog box appears, displaying a warning message.
3.
Click OK to revoke the cryptographic key.
A process is launched to encrypt all the key's objects with the current active key. If the key is associated with many data objects, it will be marked as "Deactivated: Re-encryption in process" until the re-encryption process is complete.
Once a cryptographic key is revoked, it can be safely removed from the system since no sensitive data objects require the key for decryption.
7.12.3.6 To delete a cryptographic key from the system
Before you can delete a cryptographic key from the BI platform, you must ensure that no data objects in the system require the key. This restriction ensures that all sensitive data stored in the CMS repository can always be decrypted.
After you have successfully revoked a cryptographic key, use the following instructions to delete the key from the system.
1.
Go to the "Cryptographic Keys " management area of the CMC.
2.
Select the cryptographic key you want to delete.
3.
Click Manage > Delete.
The "Delete cryptographic key" dialog box appears.
4.
Click Delete to remove the cryptographic key from the system.
The deleted key is no longer displayed in the "Cryptographic Keys "management area of the CMC.
Note:
Once a cryptographic key is deleted from the system, it cannot be restored.
Related Topics
•
•
7.13 Configuring servers for SSL
You can use the Secure Sockets Layer (SSL) protocol for all network communication between clients and servers in your BI platform deployment.
164 2012-12-12
Securing the BI platform
To set up SSL for all server communication, you need to perform the following steps:
• Deploy BI platform with SSL enabled.
• Create key and certificate files for each machine in your deployment.
• Configure the location of these files in the Central Configuration Manager (CCM) and your web application server.
Note:
If you are using thick clients, such as Crystal Reports or Designer, you also need to configure them for
SSL if you will be connecting to the CMS from these thick clients. Otherwise, you will get errors when you attempt to connect to a CMS that has been configured for SSL from a thick client that has not been configured the same way.
7.13.1 Creating key and certificate files
To set up SSL protocol for your server communication, use the SSLC command line tool to create a key file and a certificate file for each machine in your deployment.
Note:
• You need to create certificates and keys for all machines in the deployment, including machines running thick client components such as Crystal Reports. For these client machines, use the sslconfig command line tool to do the configuration.
• For maximum security, all private keys should be protected and should not be transferred through unsecured communication channels.
• Certificates created for previous versions of BI platform will not work for SAP BusinessObjects
Business Intelligence platform 4.0. These certificates will need to be re-created.
7.13.1.1 To create key and certificate files for a machine
1.
Run the SSLC.exe command line tool.
The SSLC tool is installed with your BI platform software. (On Windows, for example, it is installed by default in <INSTALLDIR>\SAP BusinessObjects Enterprise XI 4.0\win64_x64.)
2.
Type the following command: sslc req -config sslc.cnf -new -out cacert.req
This command creates two files, a Certificate Authority (CA) certificate request (cacert.req) and a private key (privkey.pem).
3.
To decrypt the private key, type the following command: sslc rsa -in privkey.pem -out cakey.pem
165 2012-12-12
Securing the BI platform
166
This command creates the decrypted key, cakey.pem.
4.
To sign the CA certificate, type the following command: sslc x509 -in cacert.req -out cacert.pem -req -signkey cakey.pem -days
365
This command creates a self-signed certificate, cacert.pem, that expires after 365 days. Choose the number of days that suits your security needs.
5.
Using a text editor, open the sslc.cnf file, which is stored in the same folder as the SSLC command line tool.
Note:
Using a text editor is highly recommended for Windows because Windows Explorer may not properly recognize and display files with the .cnf extension.
6.
Perform the following steps based on settings in the sslc.cnf file.
• Place the cakey.pem and cacert.pem files in the directories specified by sslc.cnf file's certificate and private_key options.
By default, the settings in the sslc.cnf file are: certificate = $dir/cacert.pem
private_key = $dir/private/cakey.pem
• Create a file with the name specified by the sslc.cnf file's database setting.
Note:
By default, this file is $dir/index.txt. The file should be empty.
• Create a file with the name specified by the sslc.cnf file's serial setting.
Ensure that this file provides an octet-string serial number (in hexadecimal format).
Note:
To ensure that you can create and sign more certificates, choose a large hexadecimal number with an even number of digits, such as 11111111111111111111111111111111.
• Create the directory specified by the sslc.cnf file's new_certs_dir setting.
7.
To create a certificate request and a private key, type the following command: sslc req -config sslc.cnf -new -out servercert.req
The certificate and key files generated are placed under the current working folder.
8.
Run the following command to decrypt the key in the privkey.pem file.
sslc rsa -in privkey.pem -out server.key
9.
To sign the certificate with the CA certificate, type the following command: sslc ca -config sslc.cnf -days 365 -out servercert.pem -in servercert.req
This command creates the servercert.pem file, which contains the signed certificate.
10.
Use the following commands to convert the certificates to DER encoded certificates:
2012-12-12
Securing the BI platform sslc x509 -in cacert.pem -out cacert.der -outform DER sslc x509 -in servercert.pem -out servercert.der -outform DER
Note:
The CA certificate (cacert.der) and its corresponding private key (cakey.pem) need to be generated only once per deployment. All machines in the same deployment must share the same
CA certificates. All other certificates need to be signed by the private key of any of the CA certificates.
11.
Create a text file (passphrase.txt) for storing the plain text passphrase used for decrypting the generated private key.
12.
Store the following key and certificate files in a secure location (under the same directory (d:/ssl)) that can be accessed by the machines in your BI platform deployment:
• the trusted certificate file (cacert.der)
• the generated server certificate file (servercert.der)
• the server key file (server.key)
• the passphrase file
This location will be used to configure SSL for the CCM and your web application server.
7.13.2 Configuring the SSL protocol
After you create keys and certificates for each machine in your deployment, and store them in a secure location, you need to provide the Central Configuration Manager (CCM) and your web application server with the secure location.
You also need to implement specific steps for configuring the SSL protocol for the web application server and for any machine running a thick-client application.
7.13.2.1 To configure the SSL protocol in the CCM
1.
In the CCM, right-click the Server Intelligence Agent and choose Properties.
2.
In the Properties dialog box, click the Protocol tab.
3.
Make sure Enable SSL is selected.
4.
Provide the file path for the directory where you stored the key and certificate files.
167 2012-12-12
Securing the BI platform
Field
SSL Certificates Folder
Description
Folder where all the required SSL certificates and files are stored. For example: d:\ssl
Server SSL Certificate
File
Name of the file used to store the server SSL certificate. By default, servercert.der
SSL Trusted Certificates
File
Name of the file with the SSL trusted certificate. By default, cacert.der
SSL Private Key File
SSL Private Key
Passphrase File
Name of the SSL private key file used to access the certificate. By default, server.key
Name of the text file containing the passphrase used to access the private key. By default, passphrase.txt
Note:
Make sure you provide the directory for the machine that the server is running on.
7.13.2.2 To configure the SSL protocol on Unix
You must use the serverconfig.sh script to configure the SSL protocol for a SIA. This script provides a text-based program that enables you to view server information and to add and delete servers from your installation. The serverconfig.sh script is installed to the sap_bobj directory of your installation.
1.
Use the ccm.sh script to stop the SIA and all the SAP BusinessObjects servers.
2.
Run the serverconfig.sh script.
3.
Select 3 - Modify Node, and press Enter.
4.
Specify the target SIA and press Enter.
5.
Select the 1 - Modify Server Intelligence Agent SSL configuration option.
6.
Select ssl.
When prompted, specify the SSL certificate locations.
7.
If your BI platform deployment is an SIA cluster, repeat steps 1-6 for each SIA.
8.
Start the SIA with the ccm.sh script and wait for the servers to start.
7.13.2.3 To configure the SSL protocol for the web application server
168 2012-12-12
Securing the BI platform
1.
If you have a J2EE web application server, run the Java SDK with the following system properties set. For example:
-Dbusinessobjects.orb.oci.protocol=ssl -DcertDir=d:\ssl -DtrustedCert=cacert.der -DsslCert=clientcert.der
-DsslKey=client.key
-Dpassphrase=passphrase.txt
The following table shows the descriptions that correspond to these examples:
Example Description
DcertDir=d:\ssl
The directory to store all the certificates and keys.
DtrustedCert=cacert.der
Trusted certificate file. If specifying more than one, separate with semicolons.
DsslCert=clientcert.der
DsslKey=client.key
Dpassphrase=passphrase.txt
Certificate used by the SDK.
Private key of the SDK certificate.
The file that stores the passphrase for the private key.
2.
If you have an IIS web application server, run the sslconfig tool from the command line and follow the configuration steps.
7.13.2.4 To configure thick clients
Before performing the following procedure you need to create and save all the required SSL resources
(for example, certificates and private keys) in a known directory.
In the procedure below it is assumed that you have followed the instructions for creating the following
SSL resources:
169 2012-12-12
Securing the BI platform
SSL resource
SSL certificates folder
Server SSL certificate file name
SSL trusted certificate or root certificate file name
SSL private key file name
File containing passphrase for accessing the SSL private key file d:\ssl servercert.der
cacert.der
server.key
passphrase.txt
Once the above resources have been created, use the following instructions to configure thick client applications such as the Central Configuration Manager (CCM) or the upgrade management tool.
1.
Make sure the thick-client application is not in operation.
Note:
Make sure you provide the directory for the machine that the server is running on.
2.
Run the sslconfig.exe command line tool.
The SSLC tool is installed with your BI platform software. (On Windows, for example, it is installed by default in <INSTALLDIR>\SAP BusinessObjects Enterprise XI 4.0\win64_x64.)
3.
Type the following command: sslconfig.exe -dir d:\SSL -mycert servercert.der -rootcert cacert.der -mykey server.key
-passphrase passphrase.txt -protocol ssl
4.
Restart the thick client application.
Related Topics
•
To create key and certificate files for a machine
7.13.2.4.1 To configure SSL login for translation management tool
To enable users to use SSL login with the translation management tool, information about the SSL resources must be added to the tool's configuration (.ini) file.
1.
Locate the TransMgr.ini file in the following directory: <INSTALLDIR>\SAP BusinessObjects
Enterprise XI 4.0\win32_x86.
2.
Using a text editor, open the TransMgr.ini.
3.
Add the following parameters:
-Dbusinessobjects.orb.oci.protocol=ssl -DcertDir=D:\SSLCert
-DtrustedCert=cacert.der -DsslCert=servercert.der -DsslKey=server.key
-Dpassphrase=passphrase.txt -jar program.jar
4.
Save the file and close the text editor.
Users can now use SSL to log into the translation management tool.
170 2012-12-12
Securing the BI platform
171
7.13.2.4.2 To configure SSL for report conversion tool
Before performing the following procedure you need to create and save all the required SSL resources
(for example, certificates and private keys) in a known directory. In addition, the report conversion tool must be installed as part of your BI platform deployment.
In the procedure below it is assumed that you have followed the instructions for creating the following
SSL resources:
SSL resource
SSL certificates folder
Server SSL certificate file name
SSL trusted certificate or root certificate file name
SSL private key file name
File containing passphrase for accessing the SSL private key file d:\ssl servercert.der
cacert.der
server.key
passphrase.txt
Once the above resources have been created, use the following instructions to configure SSL to work with the report conversion tool.
1.
Create a Windows environment variable BOBJ_MIGRATION on the machine hosting the report conversion tool.
Tip:
The variable can be set to any value.
2.
Using a text editor, open the migration.bat in the following directory:
<INSTALLDIR>\SAP BusinessObjects Enterprise XI 4.0\win32_x86\scripts\
.
3.
Located the following line: start "" "%JRE%\bin\javaw" -Xmx512m -Xss10m -jar "%SHAREDIR%\lib\migration.jar"
4.
Add the following after the -Xss10m parameter:
-Dbusinessobjects.orb.oci.protocol=ssl
-DcertDir=C:/ssl
-DtrustedCert=cacert.der
-DsslCert=servercert.der
-DsslKey=server.key
-Dpassphrase=passphrase.txt
-Dbusinessobjects.migration
Note:
Ensure there is a space between each parameter.
5.
Save the file and close the text editor.
Users can now use SSL to access the report conversion tool.
Related Topics
•
To create key and certificate files for a machine
2012-12-12
Securing the BI platform
7.14 Understanding communication between BI platform components
If your BI platform system is deployed entirely on the same secured subnet, there is no need to perform any special configuration of your firewalls. However, you might choose to deploy some components on different subnets separated by one or more firewalls.
It is important to understand the communication between BI platform servers, rich clients, and the web application server hosting the SAP BusinessObjects SDK before configuring your system to work with firewalls.
Related Topics
•
Configuring BI platform for firewalls
•
Examples of typical firewall scenarios
7.14.1 Overview of BI platform servers and communication ports
It is important to understand the BI platform servers and their communication ports if the system is deployed with firewalls.
7.14.1.1 Each BI platform server binds to a request port
A BI platform server, the Input File Repository Server for example, binds to a request port when it starts.
Other BI platform components including servers, rich clients, and the SDK hosted in the web application server can use this request port to communicate with the server.
A server will select its request port number dynamically when the server starts or restarts, unless it is configured to use a specific port number. A specific request port number must be configured for servers that communicate with other BI platform components across a firewall.
7.14.1.2 Each BI platform server registers with the CMS
BI platform servers register with the CMS when they start. When a server registers, the CMS records:
172 2012-12-12
Securing the BI platform
• The hostname (or IP address) of the server's host machine.
• The server's Request Port number.
7.14.1.3 CMS uses two ports
The CMS uses two ports: the Request Port and the Name Server Port. The Request Port is selected dynamically by default. The Name Server Port is 6400 by default.
All BI platform servers and client applications will initially contact the CMS on its Name Server port. The
CMS will respond to this initial contact by returning the value of its Request Port. The servers will use this Request Port for subsequent communication with the CMS.
7.14.1.4 Central Management Server directory of registered services
The Central Management Server (CMS) provides a directory of the services that have registered with it. Other BI platform components such as web services, rich clients, and the SDK hosted in the web application server can contact the CMS and request a reference to a particular service. A service's reference contains the service's Request Port number and the host name (or IP address) of the server's host machine and service ID.
BI platform components might reside on a different subnet than the server they are using. The host name (or IP address) contained in the service's reference must be routable from the component's machine.
Note:
The reference to a BI platform server will contain the server machine's host name by default. (If a machine has more than one hostname, the primary hostname is chosen). You can configure a server so that its reference contains the IP address instead.
Related Topics
•
Communication between BI platform components
7.14.1.5 Server Intelligence Agents (SIA) communicate with the Central
Management Server (CMS)
173 2012-12-12
Securing the BI platform
Your deployment will not work if the Server Intelligence Agent (SIA) and Central Management Server
(CMS) cannot communicate with each other. Ensure that your firewall ports are configured to allow communication between all SIAs and all CMSs in the cluster.
7.14.1.6 Job server child processes communicate with the data tier and the CMS
Most job servers create a child process to handle a task such as generating a report. The job server creates one or more child processes. Each child process has its own Request Port.
By default, a job server will dynamically select a Request Port for each child process. You can specify a range of port numbers that the job server can select from.
All child processes communicate with the CMS. If this communication crosses a firewall, you must:
• Specify the range of port numbers that the job server can select from by adding the -re questJSChildPorts<lowestport>
-<highestport> and -requestPort<port> parameters to the server's command line. Note that the port range should be large enough to allow the maximum number of child process as specified by -maxJobs.
• Open the specified port range on the firewall.
Many child processes communicate with the data tier. For example, a child process might connect to a reporting database, extract data, and calculate values for a report. If the job server child process communicates with the data tier across a firewall, you must:
• Open a communicate path on the firewall from any port on the job server machine to the database listen port on the database server machine.
Related Topics
•
7.14.2 Communication between BI platform components
BI platform components, such as browser clients, rich clients, servers, and the SDK hosted in the web application server, communicate with each other across the network during typical workflows. You must understand these workflows to deploy SAP BusinessObjects products across different subnets that are separated by a firewall.
174 2012-12-12
Securing the BI platform
7.14.2.1 Requirements for communication between BI platform components
Deployments of BI platform must conform to these general requirements.
1.
Every server must be able to initiate communication with every other BI platform server on that server's Request Port.
2.
The CMS uses two ports. Every BI platform server, rich client, and the web application server that hosts the SDK must be able to initiate communication with the Central Management Server (CMS) on both of its ports.
3.
Every job server child process must be able to communicate with the CMS.
4.
Thick clients must be able to initiate communication with the Request Port of the Input and Output
File Repository Servers
5.
If auditing is enabled for thick clients and web applications they must be able to initiate communication with the Request Port of the Adaptive Processing Servers that hosts the Client Auditing Proxy
Service.
6.
In general, the web application server that hosts the SDK must be able to communicate with the
Request Port of every BI platform server.
Note:
The web application server only needs to communicate with BI platform servers that are used in the deployment. For example, if Crystal Reports is not being used, the web application server does not need to communicate with the Crystal Reports Cache Servers.
7.
Job Servers use the port numbers that are specified with the -requestJSChildPorts <port
range>
command. If no range is specified in the command line, the servers use random port numbers. To allow a job server to communicate with a CMS, FTP, or mail server on another machine open all of the ports in the range specified by -requestJSChildPorts on your firewall.
8.
The CMS must be able to communicate with the CMS database listen port.
9.
The Connection Server, most Job Server child process, and every system database and auditing
Processing Server must be able to initiate communication with the reporting database listen port.
Related Topics
•
175
7.14.2.2 BI platform port requirements
This section lists the communication ports used by BI platform servers, thick clients, the web application server hosting the SDK, and third-party software applications. If you deploy BI platform with firewalls, you can use this information to open the minimum number of ports in those firewalls.
2012-12-12
Securing the BI platform
7.14.2.2.1 Port Requirements for BI platform applications
This table lists the servers and port numbers used by BI platform applications.
Product
Client Application
Associated Servers Server Port Requirements
Crystal Reports
SAP Crystal
Reports
2011 designer
CMS
Input FRS
Output FRS
Crystal Reports 2011 Report
Application Server (RAS)
Crystal Reports 2011 Processing Server
Crystal Reports Cache Server
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
Output FRS Request Port
Crystal Reports 2011 Report Application Server Request Port
Crystal Reports 2011 Processing
Server Request Port
Crystal Reports Cache Server Request
Port
Crystal Reports
SAP Crystal
Reports for
Enterprise designer
CMS
Input FRS
Output FRS
Crystal Reports Processing
Server
Crystal Reports Cache Server
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
Output FRS Request Port
Crystal Reports Processing Server
Request Port
Crystal Reports Cache Server Request
Port
176 2012-12-12
Securing the BI platform
Product
Client Application
Associated Servers Server Port Requirements
Dashboards
SAP BusinessObjects
Dashboards
CMS
Input FRS
Output FRS
Web Services provider application (dswsbobje.war) that hosts the Dashboards, Live
Office, and QaaWS web services required for certain data source connections
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
Output FRS Request Port
HTTP port (80 by default)
Live Office
Live Office
Client
Web Services provider application (dswsbobje.war) that hosts the Live Office web service
HTTP port (80 by default)
BI platform
BI platform
BI platform
SAP BusinessObjects
Web Intelligence Desktop
Universe design tool
Business
View Manager
CMS
Input FRS
CMS
Input FRS
Connection Server
CMS
Input FRS
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
Connection Server port
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
177 2012-12-12
Securing the BI platform
Product
Client Application
Associated Servers Server Port Requirements
BI platform
BI platform
Central Configuration
Manager
(CCM)
Report Conversion Tool
CMS
Server Intelligence Agent
(SIA)
CMS
Input FRS
The following ports must be open to allow CCM to manage remote BI platform servers:
CMS Name Server Port (6400 by default)
CMS Request Port
The following ports must be open to allow CCM to manage remote SIA processes:
Microsoft Directory Services (TCP port
445)
NetBIOS Session Service (TCP port
139)
NetBIOS Datagram Service (UDP port
138)
NetBIOS Name Service (UDP port 137)
DNS (TCP/UDP port 53)
(Note that some ports listed above may not be required. Consult your Windows administrator).
BI platform
)
Server Intelligence Agent
(SIA
Every BI platform server including the CMS
SIA Request Port (6410 by default)
CMS Name Server Port (6400 by default)
CMS Request Port
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
178 2012-12-12
Securing the BI platform
179
Product
Client Application
Associated Servers Server Port Requirements
BI platform
Repository
Diagnostic
Tool
CMS
Input FRS
Output FRS
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
Output FRS Request Port
BI platform
BI platform
SDK hosted in the web application server
All BI platform servers required by the deployed products.
For example, communication with the Crystal Reports 2011
Processing Server Request
Port is required if the SDK is retrieving and interacting with
Crystal reports from the CMS.
CMS Name Server Port (6400 by default)
CMS Request Port
Request Port for each server that is required. For example, the Crystal Reports 2011 Processing Server Request
Port.
BI platform
Web Services provider
(dswsbob je.war
)
All BI platform servers required by the products accessing the web services.
For example, communication with the Dashboards Cache and Processing Server Request Ports is required if SAP
BusinessObjects Dashboards is accessing Enterprise data source connections through the Web Services provider.
CMS Name Server Port (6400 by default)
CMS Request Port
Request Port for each server that is required. For example, the Dashboards
Cache Server and Dashboards Processing Server Request Ports.
BI platform
SAP BusinessObjects
Analysis, edition for
OLAP
CMS
Adaptive Processing Server hosting the Multi-Dimensional
Analysis Service
Input FRS
Output FRS
CMS Name Server Port (6400 by default)
CMS Request Port
Adaptive Processing Server Request
Port
Input FRS Request Port
Output FRS Request Port
2012-12-12
Securing the BI platform
7.14.2.2.2 Port requirements for third-party applications
This table lists third-party software used by SAP Business Objects products. It includes specific examples from some software vendors, but different vendors will have different port requirements.
Third-party application
SAP Business Objects component that uses the thirdparty product
Third-party application port requirement
Description
CMS System
Database
CMS Auditing
Database
Central Management
Server (CMS)
Central Management
Server (CMS)
Database server listen port
Database server listen port
The CMS is the only server that communicates with the
CMS system database.
The CMS is the only server that communicates with the
CMS auditing database.
Reporting
Database
Email server
Connection Server
Every Job Server child process
Every Processing
Server
Database server listen port
These servers retrieve information from the reporting database.
web application server
All SAP Business Objects web services and web applications including BI launch pad and CMC
HTTP port and HTTPS port.
For example, on Tomcat the default HTTP port is
8080 and the default
HTTPS port is 443.
The HTTPS port is only required if secure HTTP communication is used.
FTP server Every Job Server
FTP In (port 21)
FTP Out (port 22)
The Job Servers use the FTP ports to allow send to FTP.
Every Job Server SMTP (port 25)
The Job Servers use the
SMTP port to allow send to
email.
180 2012-12-12
Securing the BI platform
Third-party application
SAP Business Objects component that uses the thirdparty product
Third-party application port requirement
Description
Unix servers to which the Job
Servers can send content
Every Job Server rexec out (port 512)
(Unix only) rsh out (port
514)
(Unix only) The Job Servers use these ports to allow send
to disk.
Authentication
Server
CMS web application server that hosts the SDK every thick Client, for example Live Office.
Connection port for thirdparty authentication.
For example, the connection server for the Oracle
LDAP server is defined by the user in the file ldap.ora.
User credentials are stored in the third-party authentication server. The CMS, SDK, and the thick clients listed here need to communicate with the third-party authentication server when a user logs on.
7.15 Configuring BI platform for firewalls
This section gives step-by-step instructions for configuring your BI platform system to work in a firewalled environment.
7.15.1 To configure the system for firewalls
1.
Determine which BI platform components must communicate across a firewall.
2.
Configure the Request Port for each BI platform server that must communicate across a firewall.
3.
Configure a port range for any Job Server children that must communicate across a firewall by adding the -requestJSChildPorts<lowestport>-<highestport> and -requestPort<port> parameters to the server's command line.
4.
Configure the firewall to allow communication to the Request Ports and job server port range on the
BI platform servers that you configured in the previous step.
5.
(Optional) Configure the hosts file on each machine that hosts a BI platform server that must communicate across a firewall.
181 2012-12-12
Securing the BI platform
Related Topics
•
Communication between BI platform components
•
•
•
•
Configure the hosts file for firewalls that use NAT
7.15.1.1 Specifying the firewall rules
You must configure the firewall to allow the necessary traffic between BI platform components. Consult your firewall documentation for details of how to specify these rules.
Specify one inbound access rule for each communication path that crosses the firewall. You might not need to specify an access rule for every BI platform server behind the firewall.
Use the port number you specify in the server Port box. Remember that each server on a machine must use a unique port number. Some Business Objects servers use more than one port.
Note:
If BI platform is deployed across firewalls that use NAT, every server on all machines needs a unique
Request Port number. That is, no two servers in the entire deployment can share the same Request
Port.
Note:
You do not need to specify any outbound access rules. BI platform servers do not initiate communication to the web application server, or to any client applications. BI platform servers can initiate communication to other platform servers in the same cluster. Deployments with clustered servers in an outbound-firewalled environment are not supported.
Example:
This example shows the inbound access rules for a firewall between the web application server and the BI platform servers. In this case you would open two ports for the CMS, one port for the Input File
Repository Server (FRS), and one port for the Output FRS. The Request Port numbers are the port numbers you specify in the Port box in the CMC configuration page for a server.
Source Computer Port
Destination
Computer
Port Action
web application server
Any CMS 6400 Allow
182 2012-12-12
Securing the BI platform
Source Computer
web application server web application server web application server
Any
Any
Port
Any
Any
Any
Any
Any
Destination
Computer
Port
CMS
Input FRS
Output FRS
<Request Port number>
<Request Port number>
<Request Port number>
Any CMS
Other platform servers
Any
Action
Allow
Allow
Allow
Reject
Reject
Related Topics
•
Communication between BI platform components
183
7.15.1.2 Configure the hosts file for firewalls that use NAT
This step is required only if the BI platform servers must communicate across a firewall on which Network
Address Translation (NAT) is enabled. This step allows the client machines to map a server's hostname to a routable IP address.
Note:
BI platform can be deployed on machines that use Domain Name System (DNS). In this case, the server machine host names can be mapped to externally routable IP address on the DNS server, instead of in each machine's hosts file.
Understanding Network Address Translation
A firewall is deployed to protect an internal network from unauthorized access. Firewalls that use “NAT” will map the IP addresses from the internal network to a different address that is used by the external network. This “address translation” improves security by hiding the internal IP addresses from the external network.
2012-12-12
Securing the BI platform
BI platform components such as servers, thick clients, and the web application server hosting the SDK will use a service reference to contact a server. The service reference contains the hostname of the server's machine. This hostname must be routable from the BI platform component's machine. This means the hosts file on the component's machine must map the server machine's hostname to the server machine's external IP address. The server machine's external IP address is routable from external side of the firewall, whereas the internal IP address is not.
The procedure for configuring the hosts file is different for Windows and Unix.
7.15.1.2.1 To configure the hosts file on Windows
1.
Locate every machine that runs a BI platform component that must communicate across a firewall on which “Network Address Translation ” (“NAT”) is enabled.
2.
On each machine located in the previous step, open the hosts file using a text editor like Notepad.
The hosts file is located at \WINNT\system32\drivers\etc\hosts.
3.
Follow the instructions in the hosts file to add an entry for each machine behind the firewall that is running a BI platform server or servers. Map the server machine's hostname or fully qualified domain name to its external IP address.
4.
Save the hosts file.
7.15.1.2.2 To configure the hosts file on Unix
Note:
Your Unix operating system must be configured to first consult the “hosts” file to resolve domain names before consulting DNS. Consult your Unix systems documentation for details.
1.
Locate every machine that runs a BI platform component that must communicate across a firewall on which “Network Address Translation ” (“NAT”) is enabled.
2.
Open the “hosts” file using an editor like vi. The hosts file is located in the following directory \etc
3.
Follow the instructions in the hosts file to add an entry for each machine behind the firewall that is running a BI platform server or servers. Map the server machine's hostname or fully qualified domain name to its external IP address.
4.
Save the hosts file.
7.15.2 Debugging a firewalled deployment
If one or more of your BI platform servers do not work when your firewall is enabled, even though the expected ports have been opened on the firewall, you can use the event logs to determine which of the servers is attempting to listen on which ports or IP Addresses. You can then either open those ports on your firewall, or use the Central Management Console (CMC) to change the port numbers or IP addresses that these servers attempt to listen on.
Whenever a BI platform server starts, the server writes the following information to the Event Log for each request port that it attempts to bind to.
184 2012-12-12
Securing the BI platform
• "Server" - The name of the server and whether it successfully started.
• "Published Address(es)" - A list of IP Address and port combinations which are posted to the name service that other servers will use to communicate with this server.
If the server successfully binds to a port, the log file also displays "Listening on port(s)", the IP Address and port that the server is listening on. If the server is unsuccessful in binding to the port, the log file displays "Failed to listed on port(s)", the IP Address and port that the server attempts to listen on and fails.
When a Central Management Server starts, it also writes Published Address(es), Listening on port(s), and Failed To Listen On information for the server's Name Service Port.
Note:
If the server is configured to use a port that is auto-assigned and to use a host name or IP Address that is invalid, the event log indicates that the server failed to listen on the host name or IP Address and port “0”. If a specified host name or IP Address is invalid, the server will fail before the host operating system is able to assign a port.
Example:
The following example shows the an entry for a Central Management Server that is successfully listening on two Request Ports and a Name Service Port.
Server mynode.cms1 successfully started.
Request Port :
Published Address(es): mymachine.corp.com:11032, mymachine.corp.com:8765
Listening on port(s): [2001:0db8:85a3:0000:0000:8a2e:0370:7334]:11032, 10.90.172.216:8765
Name Service Port :
Published Address(es): mymachine.corp.com:6400
Listening on port(s): [2001:0db8:85a3:0000:0000:8a2e:0370:7334]:6400, 10.90.172.216:6400
7.15.2.1 To debug a firewalled deployment
1.
Read the event log to determine if the server is successfully binding to the port that you have specified.
If the server was unable to successfully bind to a port, there is probably a port conflict between the server and another process that is running on the same machine. The "Failed to List On" entry indicates the port that the server is attempting to listen on. Run a utility such as netstat to determine which process that has taken the port, and then configure either the other process or the server to listen on another port.
2.
If the server was able to successfully bind to a port, "Listening On" indicates which port the server is listening on. If a server is listening on a port and is still not working properly, either ensure that that port is open on the firewall or configure the server so that it listens on a port that is open.
If all of the Central Management Servers in your deployment are attempting to listen to ports or IP
Addresses that are not available, then the CMSs will not start and you will not be able to log on to the
CMC. If you want to change the port number or IP Address that the CMS attempts to listen, you must use the Central Configuration Manager (CCM) to specify a valid port number or IP Address.
185 2012-12-12
Securing the BI platform
Related Topics
•
7.16 Examples of typical firewall scenarios
This section provides examples of typical firewall deployment scenarios.
7.16.1 Example - Application tier deployed on a separate network
This example shows how to configure a firewall and BI platform to work together in a deployment where the firewall separates the web application server from other BI platform servers.
In this example, BI platform components are deployed across these machines:
• Machine boe_1 hosts the web application server and the SDK.
• Machine boe_2 hosts the Intelligence tier servers, including the Central Management Server, the
Input File Repository Server, the Output File Repository Server, and the Event server.
• Machine boe_3 hosts the Processing tier servers, including the Adaptive Job Server, the Web
Intelligence Processing Server, the Report Application Server, the Crystal Reports Cache Server, and Crystal Reports Processing Server.
Figure 7-1: Application tier deployed on a separate network
186 2012-12-12
Securing the BI platform
7.16.1.1 To configure an application tier deployed on a separate network
The following steps explain how to configure this example.
1.
These communication requirements apply to this example:
• The web application server that hosts the SDK must be able to communicate with the CMS on both of its ports.
• The web application server that hosts the SDK must be able to communicate with every BI platform server.
• The browser must have access to the http or the https Request Port on the Web Application
Server.
2.
The web application server must communicate with all BI platform servers on machine boe_2 and boe_3
. Configure the port numbers for each server on these machines. Note that you can use any free port between 1,025 and 65,535.
The port numbers chosen for this example are listed in the table:
Server
Central Management Server
Central Management Server
Input File Repository Server
Output File Repository Server
Event server
Adaptive Job Server
Crystal Reports Cache server
Web Intelligence Processing Server
Report Application Server
Crystal Reports Processing Server
6435
6440
6460
6465
6470
Port Number
6400
6411
6415
6420
6425
3.
Configure the firewalls Firewall_1 and Firewall_2 to allow communication to the fixed ports on the servers and the web application server that you configured in the previous step.
In this example we are opening the HTTP Port for the Tomcat Application server.
187 2012-12-12
Securing the BI platform
Table 7-6: Configuration for Firewall_1
Port
Any
Destination Computer Port
boe_1 8080
Configuration for firewall_2 boe_1 boe_1 boe_1 boe_1 boe_1 boe_1 boe_1 boe_1 boe_1 boe_1
Source Computer Port
Any
Any
Any
Any
Any
Any
Any
Any
Any
Any
Destination Computer
Port
boe_2 boe_2 boe_2 boe_2 boe_2 boe_3 boe_3 boe_3 boe_3 boe_3
6400
6411
6415
6420
6425
6435
6440
6460
6465
6470
Action
Allow
4.
This firewall is not NAT-enabled, and so we do not have to configure the hosts file.
Related Topics
•
•
Understanding communication between BI platform components
Action
Allow
Allow
Allow
Allow
Allow
Allow
Allow
Allow
Allow
Allow
7.16.2 Example - Thick client and database tier separated from BI platform servers by a firewall
This example shows how to configure a firewall and BI platform to work together in a deployment scenario where:
• One firewall separates a thick client from the BI platform servers.
188 2012-12-12
Securing the BI platform
• One firewall separates the BI platform servers from the database tier.
In this example, the BI platform components are deployed across these machines:
• Machine boe_1 hosts the Publishing Wizard. Publishing Wizard is a BI platform thick client.
• Machine boe_2 hosts the Intelligence tier servers, including the Central Management Server (CMS), the Input File Repository Server, the Output File Repository Server, and the Event server.
• Machine boe_3 hosts the Processing tier servers, including: Adaptive Job Server, Web Intelligence
Processing Server, Report Application Server, the Crystal Reports Processing Server, and Crystal
Reports Cache Server.
• Machine Databases hosts the CMS system and auditing databases and the reporting database.
Note that you can deploy both databases on the same database server, or you can deploy each database on its own database server. In this example, all the CMS databases and the reporting database are deployed on the same database server.
Figure 7-2: Rich client and database tier deployed on separate networks
189
7.16.2.1 To configure tiers separated from BI platform servers by a firewall
The following steps explain how to configure this example.
1.
Apply the following communication requirements to this example:
• The Publishing Wizard must be able to initiate communication with the CMS on both of its ports.
• The Publishing Wizard must be able to initiate communication with the Input File Repository
Server and the Output File Repository Server.
• The Connection Server, every Job Server child process, and every Processing Server must have access to the listen port on the reporting database server.
• The CMS must have access to the database listen port on the CMS database server.
2.
Configure a specific port for the CMS, the Input FRS, and the Output FRS. Note that you can use any free port between 1,025 and 65,535.
The port numbers chosen for this example are listed in the table:
2012-12-12
Securing the BI platform
Server
Central Management Server
Input File Repository Server
Output File Repository Server
Port Number
6411
6415
6416
3.
We do not need to configure a port range for the Job Server children because the firewall between the job servers and the database servers will be configured to allow any port to initiate communication.
4.
Configure Firewall_1 to allow communication to the fixed ports on the platform servers that you configured in the previous step. Note that port 6400 is the default port number for the CMS Name
Server Port and did not need to be explicitly configured in the previous step.
Port
Any
Any
Any
Any
Destination Computer Port
boe_2 boe_2 boe_2 boe_2
6400
6411
6415
6416
Action
Allow
Allow
Allow
Allow
Configure Firewall_2 to allow communication to the database server listen port. The CMS (on
boe_2) must have access to the CMS system and auditing database and the Job Servers (on boe_3) must have access to the system and auditing databases. Note that we did not have configure a port range for job server child processes because their communication with the CMS did not cross a firewall.
Source Computer Port
boe_2 boe_3
Any
Any
Destination Computer
Port
Databases
Databases
3306
3306
Action
Allow
Allow
5.
This firewall is not NAT-enabled, and so we do not have to configure the hosts file.
Related Topics
•
Understanding communication between BI platform components
•
Configuring BI platform for firewalls
190 2012-12-12
Securing the BI platform
7.17 Firewall settings for integrated environments
This section details specific considerations and port settings for BI platform deployments that integrate with the following ERP environments.
• SAP
• Oracle EBS
• Siebel
• JD Edwards
• PeopleSoft
BI platform components include browser clients, rich clients, servers, and the SDK hosted in the Web
Application server. System components can be installed on multiple machines. It is useful to understand the basics of communication between BI platform and the ERP components before configuring you system to work with firewalls
Port requirements for BI platform servers
The following ports are required for their corresponding servers in BI platform:
Server Port Requirements
• Central Management Server Name Server port
• Central Management Server Request port
• Input FRS Request port
• Output FRS Request port
• Report Application Server Request port
• Crystal Reports Cache Server Request port
• Crystal Reports Page Server Request port
• Crystal Reports Processing Server Request Port
7.17.1 Specific firewall guidelines for SAP integration
Your BI platform deployment must conform to the following communication rules:
• The CMS must be able to initiate communication with SAP system on SAP System Gateway port.
• The Adaptive Job Server and Crystal Reports Processing Server (along with Data Access components) must be able to initiate communication with SAP system on the SAP System Gateway port.
191 2012-12-12
Securing the BI platform
• The BW Publisher component must be able to initiate communication with the SAP system on the
SAP System Gateway port.
• BI platform components deployed on the SAP Enterprise Portal side (for example, iViews and KMC) must be able to initiate communication with BI platform web applications on HTTP/HTTPS ports.
• The web application server must be able to initiate communication on the SAP System Gateway service.
• Crystal Reports must be able to initiate communication with the SAP host on the SAP System
Gateway port and SAP System Dispatcher port.
The port that the SAP Gateway service is listening on is the same as that specified in the installation.
Note:
If a component requires an SAP router to connect to an SAP system, you can configure the component using the SAP router string. For example, when configuring an SAP entitlement system to import roles and users, the SAP router string can be substituted for the application server’s name. This insures that the CMS will communicate with the SAP system through the SAP router.
Related Topics
•
Installing a local SAP Gateway
7.17.1.1 Detailed port requirements
Port requirements for SAP
BI platform uses the SAP Java Connector (SAP JCO) to communicate with SAP NetWeaver (ABAP).
You need to configure and ensure the availability of the following ports:
• SAP Gateway service listening port (for example, 3300).
• SAP Dispatcher service listening port (for example, 3200).
The following table summarizes the specific port configurations that you need.
192 2012-12-12
Securing the BI platform
Source computer Port
SAP Any
SAP
SAP
Web Application
Server
Any
Any
Any
Central Management Server
(CMS)
Any
Crystal Reports Any
Destination computer Port
BI platform Web
Application Server
Web Service HTTP/HTTPS port
CMS
CMS
SAP
Action
Allow
CMS Name Server port
CMS Requested port
Allow
Allow
SAP System Gateway Service port Allow
SAP SAP System Gateway Service port Allow
SAP SAP System Gateway Service port and SAP System Dispatcher port
Allow
7.17.2 Firewall configuration for JD Edwards EnterpriseOne integration
Deployments of BI platform that will communicate with JD Edwards software must conform to these general communication rules:
• Central Management Console Web Applications must be able to initiate communication with JD
Edwards EnterpriseOne through the JDENET port and a randomly selected port.
• Crystal Reports with Data Connectivity client side component must be able to initiate communication with JD Edwards EnterpriseOne through the JDNET port. For retrieving data, JD Edwards
EnterpriseOne side must be able to communicate with the driver through a random port that cannot be controlled.
• Central Management Server must be able to initiate communications with JD Edwards EnterpriseOne through the JDENET port and a randomly selected port.
• The JDENET port number can be found in the JD Edwards EnterpriseOne Application Server configuration file (JDE.INI) under the JDENET section.
7.17.2.1 Port Requirements for BI platform servers
193 2012-12-12
Securing the BI platform
Product Server Port Requirements
SAP BusinessObjects Business Intelligence platform
• BI platform Sign-on Server port
7.17.2.2 Port Requirements for JD Edwards EnterpriseOne
Product
JD Edwards EnterpriseOne
Port Requirement
JDENET port and a randomly selected port
Description
Used for communication between BI platform and the JD
Edwards EnterpriseOne application server.
7.17.2.3 Configuring the web application server to communicate with JD Edwards
This section shows how to configure a firewall and BI platform to work together in a deployment scenario where the firewall separates the web application server from other platform servers.
For firewall configuration with BI platform servers and clients, see the
BI platform port requirements section of this guide. In addition to the standard firewall configuration, communication with JD Edwards servers requires some extra ports to be opened.
Table 7-14: For JD Edwards EnterpriseOne Enterprise
Source Computer Port
CMS with Security Connectivity feature for JD Edwards EnterpriseOne
Any
BI platform servers with Data
Connectivity for JD Edwards
EnterpriseOne
Any
Destination Computer Port
JD Edwards EnterpriseOne
JD Edwards EnterpriseOne
Any
Any
Action
Allow
Allow
194 2012-12-12
Securing the BI platform
Source Computer Port
Crystal Reports with client side
Data Connectivity for JD Edwards EnterpriseOne
Any
Web application server Any
Destination Computer Port
JD Edwards EnterpriseOne
JD Edwards EnterpriseOne
Any
Any
Action
Allow
Allow
7.17.3 Specific firewall guidelines for Oracle EBS
Your deployment of BI platform must allow the following components to initiate communication with the
Oracle database listener port.
• BI platform web components
• CMS (specifically the Oracle EBS security plugin)
• BI platform backend servers (specifically the EBS Data Access component)
• Crystal Reports (specifically the EBS Data Access component)
Note:
The default value of the Oracle database listener port in all the above is 1521.
7.17.3.1 Detailed port requirements
In addition to the standard firewall configuration for BI platform, some extra ports need to be opened to work in an integrated Oracle EBS environment:
Source Computer Port Action
Web application server
CMS with security connectivity for Oracle EBS
BI platform servers with server-side data connectivity for
Oracle EBS
Any
Any
Any
Destination Computer Port
Oracle EBS
Oracle EBS
Oracle database port
Oracle database port
Oracle EBS
Oracle database port
Allow
Allow
Allow
195 2012-12-12
Securing the BI platform
Source Computer Port
Crystal Reports with client-side data connectivity for Oracle
EBS
Any
Destination Computer Port
Oracle EBS
Action
Oracle database port
Allow
7.17.4 Firewall configuration for PeopleSoft Enterprise integration
Deployments of BI platform that will communicate with PeopleSoft enterprise must conform to the following general communication rules:
• The Central Management Server (CMS) with the Security Connectivity component must be able to initiate communication with the PeopleSoft Query Access (QAS) web service.
• BI platform servers with a Data Connectivity component must be able to initiate communication with the PeopleSoft QAS web service.
• The Crystal Reports with Data Connectivity client components must be able to initiate communication with the PeopleSoft QAS web service.
• The Enterprise Management (EPM) Bridge must be able to communicate with the CMS and the
Input File Repository Server.
• the EPM Bridge must be able to communicate with the PeopleSoft database using an ODBC connection.
The web service port number is the same as the port specified in PeopleSoft Enterprise Domain name.
7.17.4.1 Port Requirements for BI platform servers
Product Server Port Requirements
SAP BusinessObjects Business Intelligence platform
• BI platform Sign-on Server port
7.17.4.2 Port Requirements for PeopleSoft
196 2012-12-12
Securing the BI platform
Product
PeopleSoft Enterprise: People
Tools 8.46 or newer
Port Requirement Description
Web Service HTTP/HTTPS port
This port is required when using
SOAP connection for PeopleSoft
Enterprise for People Tools 8.46
and newer solutions
197
7.17.4.3 Configuring BI platform and PeopleSoft for firewalls
This section shows how to configure BI platform and PeopleSoft Enterprise to work together in a deployment scenario where the firewall separates the Web Application server from other BI platform servers.
For firewall configuration with BI platform servers and clients, refer to the SAP BusinessObjects Business
Intelligence Platform Administrator Guide.
Besides the firewall configuration with BI platform, you will need to do some extra configuration.
Table 7-18: For PeopleSoft Enterprise: PeopleTools 8.46 or newer
Source Computer
CMS with Security Connectivity feature for PeopleSoft
BI platform servers with Data
Connectivity for PeopleSoft
CrystalReports with client side
Data Connectivity for People-
Soft
EPM Bridge
EPM Bridge
EPM Bridge
EPM Bridge
Port
Any
Any
Any
Any
Any
Any
Any
Destination Computer Port
PeopleSoft
PeopleSoft
PeopleSoft
CMS
CMS
Action
PeopleSoft web service HTTP
/HTTPS port
PeopleSoft web service HTTP
/HTTPS port
CMS requested port
Allow
Allow
PeopleSoft web service HTTP
/HTTPS port
Allow
CMS Name Server
Port
Allow
Allow
Input File Repository
Server
Input FRS port Allow
PeopleSoft
PeopleSoft
Database Port
Allow
2012-12-12
Securing the BI platform
7.17.5 Firewall configuration for Siebel integration
This section shows which specific ports are used for communication between BI platform and Siebel eBusiness Application systems when they are separated by firewalls.
• The Web Application must be able to initiate communication with the BI platform Sign-on Server for
Siebel. For enterprise Sign-on Server for Siebel three ports are needed:
1.
The Echo (TCP) port 7 for checking access to the Sign-on Server.
2.
BI platform Sign-on Server for Siebel port (by default, 8448) for CORBA IOR listening port.
3.
A random POA port for CORBA communication that cannot be controlled, so all ports need to open.
• The CMS must be able to initiate communication with the BI platform Sign-on Server for Siebel.
CORBA IOR listening port configured for each Sign-on Server (for example, 8448). You will also need to open a random POA port number that will not be known until you have installed the BI platform.
• The BI platform Sign-on Server for Siebel must be able to initiate communication with SCBroker
(Siebel connection broker) port (for example, 2321).
• The BI platform backend servers (Siebel Data Access component) must be able to initiate communication with SCBroker (Siebel connection broker) port (for example, 2321).
• Crystal Reports (Siebel Data Access component) must be able to initiate communication with
SCBroker (Siebel connection broker) port (for example, 2321).
Detailed description of ports
This section lists the ports that are used by the BI platform. If you deploy BI platform with firewalls, you can use this information to open the minimum number of ports in those firewalls specific for integration with Siebel.
Table 7-19: Port requirement for BI platform servers
Product Server Port Requirements
Business Intelligence platform
• BI platform Sign-on Server port
Table 7-20: Port requirement for Siebel
Product
Port Requirement
Siebel eBusiness Application
2321
Description
Default SCBroker (Siebel connection broker) port
198 2012-12-12
Securing the BI platform
Configuring BI platform firewalls for integration with Siebel
This section shows how to configure firewalls for Siebel and BI platform to work together in a deployment scenario where the firewall separates the Web Application server from other platform servers.
Source Computer
Web Application Server
Port
Any
CMS
BI platform Sign-on Server for Siebel
Any
Any
BI platform servers with server-side Data Connectivity for Siebel
Any
CrystalReports with clientside Data Connectivity for
Siebel
Any
Destination Computer
Siebel
Siebel
Port
BI platform Sign-on Server for Siebel Any
BI platform Sign-on Server for Siebel Any
Siebel
SCBroker port
SCBroker port
SCBroker port
Action
Allow
Allow
Allow
Allow
Allow
7.18 BI platform and reverse proxy servers
BI platform can be deployed in an environment with one or more reverse proxy servers. A reverse proxy server is typically deployed in front of the web application servers in order to hide them behind a single
IP address. This configuration routes all Internet traffic that is addressed to private web application servers through the reverse proxy server, hiding private IP addresses.
Because the reverse proxy server translates the public URLs to internal URLs, it must be configured with the URLs of the BI platform web applications that are deployed on the internal network.
7.18.1 Supported reverse proxy servers
BI platform supports the following reverse proxy servers:
• IBM Tivoli Access Manager WebSEAL 6
• Apache 2.2
• Microsoft ISA 2006
199 2012-12-12
Securing the BI platform
7.18.2 Understanding how web applications are deployed
BI platform web applications are deployed on a web application server. The applications are deployed automatically during installation through the WDeploy tool. The tool can also be used to manually deploy the applications after BI platform is deployed. The web applications are located in the following directory on a default Windows installation:
C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise
XI 4.0\warfiles\webapps
WDeploy is used to deploy two specific WAR files:
• BOE: includes the Central Management Console (CMC), BI launch pad, Open Document,
• dswsbobje: contains the Web Service application
If the web application server is located behind a reverse proxy server, the reverse proxy server should be configured with the correct context paths of the WAR files. To expose all of the BI platform functionality, configure a context path for every BI platform WAR file that is deployed.
7.19 Configuring reverse proxy servers for BI platform web applications
The reverse proxy server must be configured to map incoming URL requests to the correct web application in deployments where BI platform web applications are deployed behind a reverse proxy server.
This section contains specific configuration examples for some of the supported reverse proxy servers.
Refer to the vendor documentation for your reverse proxy server for more information.
7.19.1 Detailed instructions for configuring reverse proxy servers
Configure the WAR files
BI platform web applications are deployed as WAR files on a web application server. Ensure you configure a directive on your reverse proxy server for the WAR file that is required for your deployment.
You can use WDeploy to deploy either the BOE or dswsbobje WAR files. For more information on
WDeploy, see the
BI Platform Web Application Deployment Guide.
200 2012-12-12
Securing the BI platform
Specify BOE properties in the custom configuration directory
The BOE.war file includes global and application specific properties. If you need to modify the properties, use the custom configuration directory. By default the directory is located at C:\Program Files
(x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom
.
Note:
• To avoid overwriting files in the default directory, do not modify the properties in the config\default directory. Users should use the custom directory.
• On some web application servers, such as the Tomcat version bundled with BI platform, you can directly access the BOE.war file. In this scenario, you can define custom settings without undeploying the WAR file. When you cannot access the BOE.war file, you must undeploy, customize, and then redeploy the file.
Consistent use of the / character
Define the context paths in the reverse proxy server in the same way as they are entered in a browser
URL. For example, if a directive contains a / (forward slash) at the end of the mirror path on the reverse proxy server, type / at the end of the browser URL.
Use a / (forward slash) consistently in the source URL and destination URL in the directive of the reverse proxy server. If a / (forward slash) is added at the end of the source URL, it must also be added to the end of the destination URL.
7.19.2 To configure the reverse proxy server
The steps below are required for BI platform web applications to work behind a supported reverse proxy server.
1.
Ensure the reverse proxy server is set up correctly according to the vendor's instructions and the deployment's network topology.
2.
Determine which BI platform WAR file is required.
3.
Configure the reverse proxy server for each BI platform WAR file. Note that the rules are specified differently on each type of reverse proxy server.
4.
Perform any special configuration that is required. Some web applications require special configuration when deployed on certain web application servers.
7.19.3 To configure Apache 2.2 reverse proxy server for BI platform
This section provides a workflow for configuring BI platform and Apache 2.2 to work together.
1.
Ensure that BI platform and Apache 2.2 are installed on separate machines.
201 2012-12-12
Securing the BI platform
2.
Ensure that Apache 2.2 is installed and configured as a reverse proxy server as described in the vendor documentation.
3.
Configure the ProxyPass for every WAR file that is deployed behind the reverse proxy server.
4.
Configure the ProxyPassReverseCookiePath for every web application that is deployed behind the reverse proxy server. For example:
ProxyPass /C1/BOE/ http://<appservername>:80/BOE/
ProxyPassReverseCookiePath / /C1/BOE
ProxyPassReverse /C1/BOE/ http://<appservername>:80/BOE/
ProxyPass /C1/explorer/ http://<appservername>:80/explorer/
ProxyPassReverseCookiePath / /C1/explorer
ProxyPassReverse /C1/explorer/ http://<appservername>:80/explorer/
7.19.4 To configure WebSEAL 6.0 reverse proxy server for BI platform
This section explains how to configure BI platform and WebSEAL 6.0 to work together.
The recommended configuration method is to create a single standard junction that maps all of the BI platform web applications hosted on an internal web application server or web server to a single mount point.
1.
Ensure that BI platform and WebSEAL 6.0 are installed on separate machines.
It is possible but not recommended to deploy BI platform and WebSEAL 6.0 on the same machine.
Refer to the WebSEAL 6.0 vendor documentation for instructions on configuring this deployment scenario.
2.
Ensure that WebSEAL 6.0 is installed and configured as described in the vendor documentation.
3.
Launch the WebSEAL pdadmin command line utility. Log in to a secure domain such as sec_master as a user with administration privileges.
4.
Enter the following command at the pdadmin sec_master prompt: server task <instance_name-webseald-host_name>create -t
<type> -h <host_name> -p <port> <junction_point>
Where:
•
<instance_name-webseald-host_name> specifies the full server name of the installed
WebSEAL instance. Use this full server name in the same format as displayed in the output of the server list command.
•
<type> specifies the type of junction. Use tcp if the junction maps to an internal HTTP port.
Use ssl if the junction maps to an internal HTTPS port.
•
<host_name
> specifies the DNS host name or IP address of the internal server that will receive the requests.
•
<port> specifies the TCP port of the internal server that will receive the requests.
•
<junction_point> specifies the directory in the WebSEAL protected object space where the document space of the internal server is mounted.
202 2012-12-12
Securing the BI platform
Example:
server task default-webseald-webseal.rp.sap.com
create -t tcp -h 10.50.130.123 -p 8080/hr
7.19.5 To configure Microsoft ISA 2006 for BI platform
This section explains how to configure BI platform and ISA 2006 to work together.
The recommended configuration method is to create a single standard junction that maps all of the BI platform WAR files hosted on an internal web application server or web server to a single mount point.
Depending on your web application server, there are additional configuration required on the application server for it to work with ISA 2006.
1.
Ensure that BI platform and ISA 2006 are installed on separate machines.
It is possible but not recommended to deploy BI platform and ISA 2006 on the same machine. Refer to the ISA 2006 documentation for instructions on configuring this deployment scenario.
2.
Ensure that ISA 2006 is installed and configured as described in the vendor documentation.
3.
Launch the ISA Server Management utility.
4.
Use the navigation panel to launch a new publishing rule a.
Go to
Arrays > MachineName > Firewall Policy > New > Web Site Publishing Rule
Remember:
Replace MachineName with the name of the machine on which ISA 2006 is installed.
b.
Type a rule name in Web publishing rule name and click Next c.
Select Allow as the rule action and click Next.
d.
Select Publish a single Web site or load balancer as the publishing type and click Next.
e.
Select a connection type between the ISA Server and the published Web site and click Next.
For example, select Use non-secured connections to connect the published Web server or
server farm.
f.
Type the internal name of the Web site you are publishing (for example, the machine name hosting BI platform) in Internal site name and click Next.
Note:
If the machine hosting ISA 2006 cannot connect to the target server select Use a computer
name or IP address to connect to the published server and type the name or IP address in the field provided.
g.
In "Public Name Details" select the domain name (for example Any domain name) and specify any internal publishing details (for example /*). Click Next.
You now need to create a new web listener to monitor for incoming Web requests.
5.
Click New to launch the New Web Listener Definition Wizard.
203 2012-12-12
Securing the BI platform a.
Type a name in Web Listener name and click Next.
b.
Select a connection type between the ISA Server and the published Web site and click Next.
For example, select Do not require SSL secured connections with clients.
c.
In "Web Listener IP Addresses" section select the following and click Next.
• Internal
• External
• Local Host
• All Networks
ISA Server is now configured to publish only over HTTP.
d.
Select an "Authentication Setting" option, click Next, and then click Finish.
The new listener is now configured for the web publishing rule.
6.
Click Next in "User Sets", then click Finish.
7.
Click Apply to save all the settings for the web publishing rule and update the ISA 2006 configuration.
You now have to update the properties of the web publishing rule to map paths for the web applications.
8.
In the navigation panel, right-click the Firewall Policy you configured and select Properties.
9.
On the "Paths" tab, click Add to map routes to SAP BusinessObjects web applications.
10.
On the "Public Name" tab, select Request for the following websites and click Add.
11.
In the "Public Name" dialog box, type your ISA 2006 server name and click OK.
12.
Click Apply to save all the settings for the web publishing rule and update the ISA 2006 configuration.
13.
Verify the connections by accessing the following URL: http://<ISA Server host Name>:<web listener port number>/<External path of
the application
>
For example: http://myISAserver:80/Product/BOE/CMC
Note:
You may have to refresh the browser several times.
You need to modify the HTTP policy for the rule have just configured to ensure that you will be able to logon on to the CMC. Right-click the rule you created in the ISA Server Management utility and select
Configure HTTP. You must now deselect Verify Normalization in the "URL Protection" area.
To remotely access BI platform you need to create an access rule.
7.20 Special configuration for BI platform in reverse proxy deployments
Some BI platform products need additional configuration to function correctly in reverse proxy deployments. This section explains how to perform the additional configuration.
204 2012-12-12
Securing the BI platform
7.20.1 Enabling reverse proxy for web services
This section describes the required procedures to enable reverse proxies for web services.
7.20.1.1 To enable reverse proxy on Tomcat 6
To enable reverse proxy on the Tomcat web application server, you must modify the server.xml file.
Required modifications include setting proxyPort as the reverse proxy server listen port and adding a new proxyName. This section explains the procedure.
1.
Stop Tomcat.
2.
Open the server.xml for Tomcat.
On Windows, server.xml is located at: C:\Program Files (x86)\SAP
BusinessObjects\Tomcat6\conf
On Unix server.xml is located at <CATALINA_HOME>/conf. The default value of <CATALI
NA_HOME> is <INSTALLDIR>/sap_bobj/tomcat.
3.
Locate this section in the server.xml file:
<!-- Define a Proxied HTTP/1.1 Connector on port 8082 -->
<!--See proxy documentation for more information about using this.-->
<!--
<Connector port="8082" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" acceptCount="100" debug="0" connectionTimeout="20000" proxyPort="80" disableUploadTimeout="true" />
-->
4.
Uncomment the Connector element by removing <!-- and -->.
5.
Modify the value of proxyPort to be the reverse proxy server listen port.
6.
Add a new proxyName attribute to the Connector’s attribute list. The value of the proxyName must be the proxy server name which should be resolvable to the correct IP address by Tomcat.
Example:
<!--Define a Proxied HTTP/1.1 Connector on port 8082 -->
<!--See proxy documentation for more information about using this.-->
<Connector port="8082" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" acceptCount="100" debug="0" connectionTimeout="20000" proxyName="my_reverse_proxy_server.domain.com" proxyPort="ReverseProxyServerPort" disableUploadTimeout="true" />
205 2012-12-12
Securing the BI platform
Where my_reverse_proxy_server.domain.com and ReverseProxyServerPort should be substituted by the correct reverse proxy server name and its listen port.
7.
Save and close the server.xml file.
8.
Restart Tomcat.
9.
Ensure the reverse proxy server maps its virtual path to the correct Tomcat connector port. In the above example, the port is 8082.
The following example shows a sample configuration for Apache HTTP Server 2.2 to reverse proxy
SAP Business Objects Web Services deployed on Tomcat:
ProxyPass /XI3.0/dswsbobje http://internalServer:8082/dswsbobje
ProxyPassReverseCookiePath /dswsbobje /XI3.0/dswsbobje
To enable web services, the proxy name and port number have to be identified for the connector.
7.20.1.2 Enabling reverse proxy for web services on web application servers other than Tomcat
The following procedure requires that BI platform web applications are successfully configured against your chosen web application server. Note that the wsresources are case-sensitive.
1.
Stop the web application server.
2.
Specify the external URL of the Web Services in the dsws.properties file.
This file is located in dswsbobje web application. For example, if your external is URL is http://my_reverse_proxy_server.domain.com/dswsbobje/
, update the properties in the dsws.properties file:
• wsresource1=ReportEngine|reportengine web service alone|http://my_re verse_proxy_server.domain.com/SAP/dswsbobje/services/ReportEngine
• wsresource2=BICatalog|bicatalog web service alone|http://my_re verse_proxy_server.domain.com/SAP/dswsbobje/services/BICatalog
• wsresource3=Publish|publish web service alone|http://my_re verse_proxy_server.domain.com/SAP/dswsbobje/services/Publish
• wsresource4=QueryService|query web service alone|http://my_re verse_proxy_server.domain.com/SAP/dswsbobje/services/QueryService
• wsresource5=BIPlatform|BIPlatform web service|http://my_re verse_proxy_server.domain.com/SAP/dswsbobje/services/BIPlatform
• wsresource6=LiveOffice|Live Office web service|http://my_re verse_proxy_server.domain.com/SAP/dswsbobje/services/LiveOffice
3.
Save and close the dsws.properties file.
4.
Restart the web application server.
206 2012-12-12
Securing the BI platform
5.
Ensure the reverse proxy server maps its virtual path to the correct web application server connector port. The following example shows a sample configuration for Apache HTTP Server 2.2 to reverse proxy BI platform web services deployed on the web application server of your choice:
ProxyPass /SAP/dswsbobje http://internalServer:<listening port> /dswsbobje
ProxyPassReverseCookiePath /dswsbobje /SAP/dswsbobje
Where <listening port> is the listening port of your web application server.
7.20.2 Enabling the root path for session cookies for ISA 2006
This section describes how to configure specific web application servers to enable the root path for session cookies to work with ISA 2006 as the reverse proxy server.
7.20.2.1 To configure Apache Tomcat 6
To configure the root path for session cookies to work with ISA 2006 as the reverse proxy server, add the following to the <Connector> element in server.xml: emptySessionPath="true"
1.
Stop Tomcat
2.
Open the server.xml which is located in:
<CATALINA_HOME>\conf
3.
Locate the following section in the server.xml file:
<!-- Define a Proxied HTTP/1.1 Connector on port 8082 -->
<!-- See proxy documentation for more information about using this -->
<!--
<Connector port="8082" maxThreads="150" minSpareThreads="25" maxS pareThreads="75" enableLookups="false" acceptCount="100" debug="0" connectionTimeout="20000" proxyPort="80" disableUploadTimeout="true" />
-->
4.
Uncomment the Connector element by removing <!-- and -->.
5.
To configure the root path for session cookies to work with ISA 2006 as the reverse proxy server, add the following to the <Connector> element in server.xml: emptySessionPath="true"
6.
Modify the value of proxyPort to be the reverse proxy server listen port.
207 2012-12-12
Securing the BI platform
7.
Add a new proxyName attribute to the Connector's attribute list. The value must be the proxy server name which should be resolvable to the correct IP address by Tomcat.
For example:
<!--Define a Proxied HTTP/1.1 Connector on port 8082
-->
<!-- See proxy documentation for more information about using this -->
<Connector port="8082" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" emptySessionPath="true" acceptCount="100" debug="0" connectionTimeout="20000" proxyName="my_reverse_proxy_server.domain.com" proxyPort="ReverseProxyServerPort" disableUploadTimeout="true" />
8.
Save and close the server.xml file.
9.
Restart Tomcat.
Ensure the reverse proxy server maps its virtual path to the correct Tomcat connector port. In the above example, the port is 8082.
7.20.2.2 To configure Sun Java 8.2
You need to modify the sun-web.xml for every BI platform web application.
1.
Go to <SUN_WEBAPP_DOMAIN>\generated\xml\j2ee-modules\webapps\BOE\WEB-INF
2.
Open sun-web.xml
3.
After the <context-root> container add the following:
<session-config>
<cookie-properties>
<property name="cookiePath" value="/" />
</cookie-properties>
</session-config>
<property name="reuseSessionID" value="true"/>
4.
Save and close sun-web.xml.
5.
Repeat steps1-4 for every web application.
7.20.2.3 To configure Oracle Application Server 10gR3
You need to modify the global-web-application.xml or orion-web.xml for every BI platform web application's deployment directory.
1.
Go to <ORACLE_HOME>\j2ee\home\config\
2.
Open global-web-application.xml or orion-web.xml.
208 2012-12-12
Securing the BI platform
3.
Add the following line to the <orion-web-app> container:
<session-tracking cookie-path="/" />
4.
Save and close the configuration file.
5.
Log onto the Oracle Admin Console: a.
Go to OC4J:home > Administration > Server Properties.
b.
Select Options under "Command Line Options".
c.
Click Add another Row and type the following:
Doracle.useSessionIDFromCookie=true
6.
Restart the Oracle server.
7.20.2.4 To configure WebSphere Community Edition 2.0
1.
Open the WebSphere Community Edition 2.0 Admin Console.
2.
In the left navigation panel, find "Server" and select Web Server.
3.
Select the connectors and click Edit.
4.
Select the emptySessionPath check box and click Save.
5.
Type your ISA server name in ProxyName.
6.
Type the ISA listener port number in ProxyPort.
7.
Stop and then restart the connector.
7.20.3 Enabling reverse proxy for SAP BusinessObjects Live Office
To enable SAP BusinessObjects Live Office’s View Object in Web Browser feature for reverse proxies, adjust the default viewer URL. This can be done in the Central Management Console (CMC) or through
Live Office options.
Note:
This section assumes reverse proxies for BI launch pad and BI platform web services have been successfully enabled.
7.20.3.1 To adjust the default viewer URL in the CMC
1.
Log on to the CMC.
209 2012-12-12
Securing the BI platform
2.
On the "Applications" page, click Central Management Console.
3.
Select Actions > Processing Settings.
4.
In the URL field, type the default viewer URL, and click Set URL.
For example, type http://ReverseProxyServer:ReverseProxyServerPort/BOE/OpenDocument.jsp?sID
Type=CUID&iDocID=%SI_CUID%, where ReverseProxyServer and ReverseProxyServerPort are the correct reverse proxy server name and listen port.
210 2012-12-12
Authentication
Authentication
8.1 Authentication options in BI platform
Authentication is the process of verifying the identity of a user who attempts to access the system, and rights management is the process of verifying that the user has been granted sufficient rights to perform the requested action upon the specified object.
Security plugins expand and customize the ways in which the BI platform authenticates users. Security plugins facilitate account creation and management by allowing you to map user accounts and groups from third-party systems into the platform. You can map third-party user accounts or groups to existing
BI platform user accounts or groups, or you can create new Enterprise user accounts or groups that correspond to each mapped entry in the external system.
The current release supports the following authentication methods:
• Enterprise
• LDAP
• Windows AD
• SAP
• Oracle EBS
• Siebel
• JD Edwards
• PeopleSoft
Because BI platform is fully customizable, the authentication and processes may vary from system to system.
Related Topics
•
Enterprise authentication overview
•
Configuring SAP authentication
•
•
Windows AD support requirements and initial setup
•
Enabling JD Edwards EnterpriseOne authentication
•
Enabling Oracle EBS authentication
•
Enabling PeopleSoft Enterprise authentication
•
Enabling Siebel authentication
211 2012-12-12
Authentication
8.1.1 Primary authentication
Primary authentication occurs when a user first attempts to access the system. One of two things can happen during primary authentication:
• If single sign-on is not configured, the user provides their credentials, such as their user name, password and authentication type.
These details are entered by the users on the logon screen.
• If a method of single sign-on is configured, the credentials for the users are silently propagated.
These details are extracted using other methods such as Kerberos or SiteMinder.
• The authentication type may be Enterprise, LDAP, Windows AD, SAP, Oracle EBS, Siebel, JD
Edwards EnterpriseOne, PeopleSoft Enterprise depending upon which type(s) you have enabled and set up in the Authentication management area of the Central Management Console (CMC).
The user's web browser sends the information by HTTP to your web server, which routes the information to the CMS or the appropriate platform server.
The web application server passes the user's information through a server-side script. Internally, this script communicates with the SDK and, ultimately, the appropriate security plug-in to authenticate the user against the user database.
For instance, if the user is logging on to BI launch pad and specifies Enterprise authentication, the SDK ensures that the BI platform security plug-in performs the authentication. The Central Management
Server (CMS) uses the security plug-in to verify the user name and password against the system database. Alternatively, if the user specifies an authentication method, the SDK uses the corresponding security plug-in to authenticate the user.
If the security plug-in reports a successful match of credentials, the CMS grants the user an active system identity and the following actions are performed:
• The CMS creates an Enterprise session for the user. While the session is active, this session consumes one user license on the system.
• The CMS generates and encodes a logon token and sends it to the web application server.
• The web application server stores the user's information in memory in a session variable. While active, this session stores information that allows BI platform to respond to the user's requests.
Note:
The session variable does not contain the user's password.
• The web application server keeps the logon token in a cookie on the client's browser. This is only used for failover purposes, such as when you have a clustered CMS or when BI launch pad is clustered for session affinity.
Note:
It is possible to disable the logon token, However, if you disable the logon token, you will disable failover.
212 2012-12-12
Authentication
8.1.2 Security plug-ins
Security plug-ins expand and customize the ways in which BI platform authenticates users. BI platform currently ships with the following plugins:
• Enterprise
• LDAP
• Windows AD
• SAP
• Oracle EBS
• Siebel
• JD Edwards
• PeopleSoft
Security plug-ins facilitate account creation and management by allowing you to map user accounts and groups from third-party systems into BI platform. You can map third-party user accounts or groups to existing BI platform user accounts or groups, or you can create new Enterprise user accounts or groups that correspond to each mapped entry in the external system.
The security plug-ins dynamically maintain third-party user and group listings. Once you map an external group into BI platform, all users who belong to that group can successfully log on to BI platform. When you make subsequent changes to the third-party group membership, you do not need to update or refresh the listing in BI platform. For instance, if you map an LDAP group to BI platform, and then you add a new user to the group, the security plug-in dynamically creates an alias for that new user when he or she first logs on to BI platform with valid LDAP credentials.
Moreover, security plug-ins enable you to assign rights to users and groups in a consistent manner, because the mapped users and groups are treated as if they were Enterprise accounts. For example, you might map some user accounts or groups from Windows AD, and some from an LDAP directory server. Then, when you need to assign rights or create new, custom groups within BI platform, you make all of your settings in the CMC.
Each security plug-in acts as an authentication provider that verifies user credentials against the appropriate user database. When users log on to BI platform, they choose from the available authentication types that you have enabled and set up in the Authentication management area of the
CMC.
Note:
The Windows AD security plugin cannot authenticate users if the BI platform server components are running on Unix.
8.1.3 Single sign-on to BI platform
213 2012-12-12
Authentication
Single sign-on to BI platform means that once users have logged on to the operating system, they can access applications that support SSO without having to provide their credentials again. When a user logs on, a security context for that user is created. This context can be propagated to BI platform in order to perform SSO.
The term “anonymous single sign-on” also refers to single sign-on to BI platform, but it specifically refers to the single sign-on functionality for the Guest user account. When the Guest user account is enabled, which it is by default, anyone can log on to BI platform as Guest and will have access to the system.
8.1.3.1 Single sign-on support
The term single sign-on is used to describe different scenarios. At its most basic level, it refers to a situation where a user can access two or more applications or systems while providing their log-on credentials only once, thus making it easier for users to interact with the system.
Single sign-on to BI launch pad can be provided by BI platform or by different authentication tools, depending on your application server type and operating system.
These methods of single sign-on are available if you are using a Java application server on Windows:
• Windows AD with Kerberos
• Windows AD with SiteMinder
These methods of single sign-on are available if you are using IIS on Windows:
• Windows AD with Kerberos
• Windows AD with NTLM
• Windows AD with SiteMinder
These methods of single sign-on support are available on Windows or Unix, with any supported web application server for the platform.
• LDAP with SiteMinder
• Trusted Authentication
• Windows AD with Kerberos
• LDAP through Kerberos on SUSE 11
Note:
Windows AD with Kerberos is supported if the Java application is on Unix. However, BI platform services must run on a Windows server.
The following table describes the methods of single sign-on support for BI launch pad.
214 2012-12-12
Authentication
Authentication
Mode
CMS Server Options
Windows
AD
Windows only
Windows AD with Kerberos only
Notes
Windows AD authentication to BI launch pad and the CMC is available out of the box.
LDAP Any supported platform
Supported LDAP directory servers, with SiteMinder only
LDAP authentication to BI launch pad and the
CMC is available out of the box. SSO to BI launch pad and the CMC requires SiteMinder.
Enterprise Any supported platform
Trusted Authentication Enterprise authentication to BI launch pad and the CMC is available out of the box. SSO with enterprise authentication to BI launch pad and the CMC requires Trusted Authentication.
•
•
•
8.1.3.2 Single sign-on to database
Once users are logged on to BI platform, single sign-on to the database enables them to perform actions that require database access, in particular, viewing and refreshing reports, without having to provide their logon credentials again. Single sign-on to the database can be combined with single sign-on to
BI platform, to provide users with even easier access to the resources they need.
8.1.3.3 End-to-end single sign-on
End-to-end single sign-on refers to a configuration where users have both single sign-on access to BI platform at the front-end, and single sign-on access to the databases at the back-end. Thus, users need to provide their logon credentials only once, when they log on to the operating system, to have access to BI platform and to be able to perform actions that require database access, such as viewing reports.
In BI platform, end-to-end single sign-on is supported through Windows AD and Kerberos.
215 2012-12-12
Authentication
8.2 Enterprise authentication
8.2.1 Enterprise authentication overview
Enterprise authentication is the default authentication method for BI platform; it is automatically enabled when you first install the system - it cannot be disabled. When you add and manage users and groups,
BI platform maintains the user and group information within its database.
Tip:
Use the system default Enterprise Authentication if you prefer to create distinct accounts and groups for use with BI platform, or if you have not already set up a hierarchy of users and groups in a third-party directory server.
You do not have to configure or enable Enterprise authentication. You can however modify Enterprise authentication settings to meet your organization's particular security requirements. You can only modify
Enterprise setting through the Central Management Console (CMC).
8.2.2 Enterprise authentication settings
Setting
Password Restrictions
Password Restrictions
User Restrictions
User Restrictions
Option
Enforce mixed-case password
Description
This option ensures that passwords contain at least two character classes—uppercase letters, lowercase letters, numbers, or punctuation.
Must contain at least N characters
By enforcing a minimum complexity for passwords, you decrease a malicious user's chances of simply guessing a valid user's password.
Must change password every N day(s)
This option ensures that the passwords do not become a liability and are regularly refreshed.
Cannot reuse the N most recent passwords(s)
This option ensures that passwords will not routinely be repeated.
216 2012-12-12
Authentication
Setting
User Restrictions
Logon Restrictions
Logon Restrictions
Logon Restrictions
Synchronize Data
Source Credentials with
Log On
Trusted Authentication
Option
Must wait N minute(s) to change password
Description
This option ensures that new passwords cannot be immediately changed once entered into the system.
Disable account after N failed attempts to log on
Reset failed logon count after N minute(s)
Re-enable account after N minute(s)
Enable and update user's data source credentials at logon time
Trusted Authentication is enabled
This security option specifies how many attempts a user is allowed to log on to the system before their account is disabled.
This option specifies a time interval for resetting the logon attempt counter.
This option specifies for how long an account is suspended after N failed logon attempts.
This option enables data source credentials after the user has logged on.
This option turns on Trusted Authentication.
Related Topics
•
Enabling Trusted Authentication
8.2.3 To change Enterprise settings
1.
Go to the "Authentication" management area of the CMC.
2.
Double-click Enterprise.
The "Enterprise" dialog box appears.
3.
Change the settings.
Tip:
To revert all the settings to the default value click Reset.
4.
Click Update to save your modifications.
8.2.3.1 To change general password settings
217 2012-12-12
Authentication
Note:
Accounts not used for an extended period of time are not automatically de-activated. Administrators must manually delete inactive accounts.
1.
Go to the "Authentication" management area of the CMC.
2.
Double-click Enterprise.
The "Enterprise" dialog box appears.
3.
Click the check box for each password option that you want to use, and enter a value if necessary.
Option Minimum Value
Recommended Maximum
Value
Enforce mixed-case passwords
N/A N/A
Must contain at least N
Characters
0 characters
Must change password every
N day(s)
1 day
64 characters
100 days
Cannot reuse the N most recent password(s)
1 password
Must wait N minute(s) to change password
Disable account after N failed attempts to log on
0 minutes
1 failed
Reset failed logon count after N minute(s)
1 minute
Re-enable account after N minute(s)
0 minutes
100 passwords
100 minutes
100 failed
100 minutes
100 minutes
4.
Click Update.
218 2012-12-12
Authentication
8.2.4 Enabling Trusted Authentication
Enterprise Trusted Authentication is used to perform single sign-on by relying on the web application server to verify the identity of a user. This method of authentication involves establishing trust between the Central Management Server (CMS) and the web application server hosting the BI platform web application. When the trust is established, the system defers the verification of the identity of a user to the web application server. Trusted Authentication can be used to support authentication methods such as SAML, x.509, and other methods which do not have dedicated authentication plugins.
Users prefer to log on to the system once, without needing to provide passwords several times during a session. Trusted Authentication provides a Java single sign-on solution for integrating your BI platform authentication solution with third-party authentication solutions. Applications that have established trust with the Central Management Server (CMC) can use Trusted Authentication to allow users to log on without providing their passwords.
To enable Trusted Authentication you must configure a shared secret on the server through the Enterprise authentication settings, while the client is configured through the properties specified for the BOE war file.
Note:
• Before you are able to use Trusted Authentication, you must have either created Enterprise users, or mapped the third-party users that will need to sign on to BI platform.
• The single sign-on URL for BI launch pad is http://server:port/BOE/BI.
Related Topics
•
To configure the server to use Trusted Authentication
•
To configure Trusted Authentication for the web application
219
8.2.4.1 To configure the server to use Trusted Authentication
To use Trusted Authentication, you must have created Enterprise users or mapped third-party users who must sign on to BI platform.
1.
Log on to the CMC.
2.
In the Authentication management area, click the Enterprise option.
The "Enterprise" dialog box appears.
3.
Locate "Trusted Authentication", and perform the following actions: a.
Click Trusted Authentication is enabled.
b.
Click New Shared Secret.
2012-12-12
Authentication
The Shared secret key is generated and ready for download message appears.
c.
Click Download Shared Secret.
The shared secret is used by the client computer and the CMS to establish trust. You must configure Trusted Authentication on both the server and the client computer. The client computer is your app server.
The "File Download" dialog box appears.
d.
Click Save, and save the TrustedPrincipal.conf file to one of the following directories:
•
<INSTALLDIR>\SAP BusinessObjects Enterprise XI 4.0\win32_x86
•
<INSTALLDIR>\SAP BusinessObjects Enterprise XI 4.0\win64_x64 e.
In the Shared Secret Validity Period box, type the number of days that your shared secret will be valid.
f.
Specify a timeout value for your trusted authentication requests.
Note:
The timeout value is the maximum amount of time, in milliseconds, that the clock on the client and clock and the CMS can differ. If you enter 0, the amount of time the two clock times can differ is unlimited. It is not recommended you set this value to 0 as this may increase your vulnerability to replay attacks.
4.
Click Update to commit the shared secret.
BI platform does not audit modifications to Trusted Authentication parameters. You must manually back up Trusted Authentication information.
The shared secret is used by the client computer and the CMS to establish trust. You must configure the client for Trusted Authentication.
8.2.5 Configuring Trusted Authentication for a web application
To configure Trusted Authentication for the client, you must modify global properties for the BOE.war
file and specific properties for BI launch pad and OpenDocument applications.
Use one of the following methods to pass the shared secret to the client:
•
WEB_SESSION option
•
TrustedPrincipal.conf
file
Use one of the following methods to pass the user name to the client:
•
REMOTE_USER
•
HTTP_HEADER
•
COOKIE
•
QUERY_STRING
•
WEB_SESSION
•
USER_PRINCIPAL
220 2012-12-12
Authentication
Regardless of how you pass the shared secret, the method you use must be customized in the
Trusted.auth.user.retrieval
global properties for the BOE.war file.
8.2.5.1 Using Trusted Authentication for SAML single sign-on
Security Assertion Markup Language (SAML) is an XML-based standard for communicating identity information. SAML provides a secure connection where identity and trust is communicated thereby enabling a single sign-on mechanism that eliminates additional logins for trusted users seeking to access BI platform.
Enabling SAML authentication
If your application server can work as a SAML service provider, you can use Trusted Authentication to provide SAML SSO to BI platform.
To do this, you must first configure the web application server for SAML authentication.
Also, you must use one of these methods to pass the user name to the client:
•
REMOTE_USER
•
USER_PRINCIPAL
The example below contains a sample web.xml configured for SAML authentication:
<security-constraint>
<web-resource-collection>
<web-resource-name>InfoView</web-resource-name>
<url-pattern>*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>j2ee-admin</role-name>
<role-name>j2ee-guest</role-name>
<role-name>j2ee-special</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>InfoView</realm-name>
<form-login-config>
<form-login-page>/logon.jsp</form-login-page>
<form-error-page>/logon.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role>
<description>Assigned to the SAP J2EE Engine System Administrators</description>
<role-name>j2ee-admin</role-name>
</security-role>
<security-role>
<description>Assigned to all users</description>
<role-name>j2ee-guest</role-name>
</security-role>
<security-role>
<description>Assigned to a special group of users</description>
<role-name>j2ee-special</role-name>
</security-role>
221 2012-12-12
Authentication
Please refer to your application server documentation for further instructions on how to accomplish this, as they will vary by application server.
Using Trusted Authentication
Once your web application server is configured to work as a SAML service provider, you can use Trusted
Authentication to provide SAML SSO.
Note:
Users must either be imported into BI platform or have Enterprise accounts.
Dynamic aliasing is used to enable the SSO. When a user first accesses the logon page through SAML, they will be asked to manually log in using their existing BI platform account credentials. Once the user's credentials are verified, the system will alias the user's SAML identity to their BI platform account.
Subsequent logon attempts for the user will be performed using SSO, as the system will have the user's identity alias dynamically matched to an existing account.
Note:
A specific property for the BOE war file - trusted.auth.user.namespace.enabled - must be enabled for this mechanism to work.
8.2.5.2 Trusted Authentication properties for web applications
The following table lists the Trusted Authentication settings included in the default global.properties
file for BOE.war. To overwrite any of the settings, create a new file in C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom
.
222 2012-12-12
Authentication
Property
sso.en
abled=true trust ed.auth.shared.se
cret
Default value Description
sso.en
abled=false
Enables and disables single sign-on (SSO) to BI platform. To enable Trusted authentication, this property must be set to true
.
None trusted.auth.us
er.param
None
Session variable name used to retrieve the secret for Trusted
Authentication. Only applies if using the web session to pass the shared secret.
Specifies the variable used to retrieve the user name for Trusted
Authentication.
trusted.auth.us
er.retrieval
None Specifies the method used to retrieve the user name for Trusted
Authentication. Can be set to one of the following:
•
REMOTE_USER
•
HTTP_HEADER
•
COOKIE
•
QUERY_STRING
•
WEB_SESSION
•
USER_PRINCIPAL
Leave blank to disable Trusted Authentication.
trusted.auth.us
er.namespace.en
abled
None Enables and disables dynamic binding of aliases to existing user accounts. If property is set to true, Trusted Authentication uses alias binding to authenticate users to BI platform. With alias binding, your application server can work as a SAML service provider, enabling Trusted Authentication to provide SAML single sign-on to the system. If the property is blank, Trusted
Authentication will use name matching when authenticating users.
8.2.5.3 To configure Trusted Authentication for the web application
If you plan to store the shared secret in the TrustedPrincipal.conf file, make sure the file is stored in the appropriate platform directory:
223 2012-12-12
Authentication
Platform Location of TrustedPrincipal.conf
Windows, default installation
•
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\win32_x86\
•
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\win64_x64\
AIX
Solaris
Linux
<INSTALLDIR>/sap_bobj/enterprise_xi40/ aix_rs6000/
<INSTALLDIR>/sap_bobj/enterprise_xi40/ solaris_sparc/
<INSTALLDIR>/sap_bobj/enterprise_xi40/linux_x86
Various mechanisms populate the user name variable that is used to configure Trusted Authentication for the client hosting web applications. Configure or set up your web application server so that your user names are exposed before you use the user retrieval name methods. See http://ja va.sun.com/j2ee/1.4/docs/api/javax/servlet/http/HttpServletRequest.html
for further information.
To configure Trusted Authentication for the client, you must access and modify properties for the
BOE.war
file, which includes general and specific properties for BI launch pad and OpenDocument web applications.
Note:
Additional steps may be required, depending on how you plan to retrieve the user name or shared secret.
1.
Access the custom folder for the BOE.war file on the computer hosting the web applications:
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\
.
Later, you must redeploy the modified BOE.war file.
2.
Create a new file, using Notepad or another text editing utility.
3.
Enter the following Trusted Authentication properties: sso.enabled=true trusted.auth.user.retrieval=Method for user ID retrieval trusted.auth.user.param=Variable trusted.auth.shared.secret=WEB_SESSION
For the trusted.auth.shared.secret property, select one of the following options for user name retrieval:
224 2012-12-12
Authentication
225
Option
HTTP_HEADER
QUERY_STRING
COOKIE
WEB_SESSION
REMOTE_USER
USER_PRINCIPAL
How the user name will be retrieved
The user name is retrieved from the contents of an HTTP header. You specify which HTTP header to use in the trusted.auth.us
er.param
property.
The user name is retrieved from a parameter of the request URL. You specify which query string to use in the trusted.auth.user.param
property.
The user name is retrieved from a specified cookie. You specify which cookie to use in the trusted.auth.user.param
property.
The user name is retrieved from the contents of a specified session variable. You specify the web session variable to use in the trust ed.auth.user.param
property in glob al.properties
.
The user name is retrieved from a call to
HttpServletRequest.getRemoteUser()
.
The user name is retrieved from a call to ge tUserPrincipal().getName() on the
HttpServletRequest object for the current request in a servlet or JSP.
Note:
• Some web application servers require the environment variable REMOTE_USER set to true on the server. To find out whether this is required, see your web application server documentation.
If it is required, confirm that the environment variable is set to true.
• If you are using USER_PRINCIPAL or REMOTE_USER to pass the user name, leave the trust ed.auth.user.param
blank.
4.
Save the file with the name global.properties.
5.
Restart the web application server.
The new properties take effect only after the modified BOE web application is redeployed on the computer running the web application server. Use WDeploy to redeploy the WAR file on the web application
2012-12-12
Authentication
226 server. For information on using WDeploy, see the SAP BusinessObjects Business Intelligence Platform
Web Application Deployment Guide.
8.2.5.3.1 Sample configurations
To pass the shared secret through the TrustedPrincipal.conf file
The following sample configuration assumes that a user JohnDoe has been created in BI platform.
The user information is stored and passed through the web session, and the shared secret is passed via the TrustedPrincipal.conf file, by default located in the C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win32_x86 directory. The bundled version of Tomcat 6 is the web application server.
1.
In the <INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\ directory, use Notepad or another text editing utility to create a new file.
2.
In the new file, enter the following Trusted Authentication properties: sso.enabled=truetrue trusted.auth.user.retrieval=WEB_SESSION trusted.auth.user.param=MyUser trusted.auth.shared.secret=
3.
Save the file with the name global.properties.
4.
Locate the C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects
Enterprise XI 4.0\warfiles\webapps\BOE\WEB-INF\eclipse\plugins\webpath.In
foView\web\custom.jsp
file.
5.
In the custom.jsp file, enter the following properties:
<\!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<%@ page language="java" contentType="text/html;charset=utf-8" %>
<%
//custom Java code request.getSession().setAttribute("MyUser", "JohnDoe");
%>
<html>
<head>
<title>Custom Entry Point</title>
</head>
<body>
<script type="text/javascript" src="noCacheCustomResources/myScript.js"></script>
<a href="javascript:goToLogonPage()">Click this to go to the logon page of BI launch pad</a>
</body>
</html>
6.
In the C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enter prise XI 4.0\warfiles\webapps\BOE\WEB-INF\eclipse\plugins\webpath.In
foView\web\noCacheCustomResources
, create a myScript.js file.
7.
In the myScript.js file, enter the following properties: function goToLogonPage() { window.location = "logon.jsp";
}
8.
Restart the web application server.
9.
Use WDeploy to redeploy the WAR file on the web application server.
2012-12-12
Authentication
227
For information on using WDeploy, see the SAP BusinessObjects Business Intelligence Platform
Web Application Deployment Guide.
To verify that you have properly configured trusted authentication, use the following URL to access the
BI launch pad application: http://[cmsname]:8080/BOE/BI/custom.jsp, where [cmsname] is the name of the machine hosting the CMS. A Click this to go to the logon page of BI launch pad link should appear.
To pass the shared secret through the web session variable
The following sample configuration assumes that a user JohnDoe has been created in BI platform.
The user information will be stored and passed via the web session, while the shared secret will be passed via the web session variable. This file is assumed to be in the following directory: C:\Program
Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\win32_x86
. You need to open and note the content of the file. In this sample configuration, it is assumed the shared secret is the following:
9ecb0778edcff048edae0fcdde1a5db8211293486774a127ec949c1bdb98dae8e0ea388979edc65773
841c8ae5d1f675a6bf5d7c66038b6a3f1345285b55a0a7
The bundled version of Tomcat is the web application server.
1.
Access the following directory:
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\
2.
Create a new file.
Note:
Use Notepad or any other text editing utility.
3.
Specify the trusted authentication properties by entering the following: sso.enabled=truetrue trusted.auth.user.retrieval=WEB_SESSION trusted.auth.user.param=MyUser trusted.auth.shared.secret=MySecret
4.
Save the file under the following name: global.properties
5.
Access the following file:
C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise
XI 4.0\warfiles\webapps\BOE\WEB-INF\eclipse\plugins\webpath.In
foView\web\custom.jsp
6.
Modify the contents of the file to include the following:
<\!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<%@ page language="java" contentType="text/html;charset=utf-8" %>
<%
//custom Java code request.getSession().setAttribute("MySecret","9ecb0778edcff048edae0fcdde1a5db82112934
86774a127ec949c1bdb98dae8e0ea388979edc65773841c8ae5d1f675a6bf5d7c66038b6a3f1345
285b55a0a7"
2012-12-12
Authentication
228 request.getSession().setAttribute("MyUser", "JohnDoe");
%>
<html>
<head>
<title>Custom Entry Point</title>
</head>
<body>
<script type="text/javascript" src="noCacheCustomResources/myScript.js"></script>
<a href="javascript:goToLogonPage()">Click this to go to the logon page of BI launch pad</a>
</body>
</html>
7.
Create the myScript.js file in the following directory:
C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise
XI 4.0\warfiles\webapps\BOE\WEB-INF\eclipse\plugins\webpath.InfoView\web\no
CacheCustomResources
8.
Add the following to myScript.js: function goToLogonPage() { window.location = "logon.jsp";
}
9.
Restart the web application server.
10.
Use WDeploy to redeploy the WAR file on the web application server.
For information on using WDeploy, see the SAP BusinessObjects Business Intelligence Platform
Web Application Deployment Guide.
To verify that you have properly configured Trusted authentication, use the following URL to access the BI launch pad application: http://[cmsname]:8080/BOE/BI/custom.jsp where [cmsname] is the name of the machine hosting the CMS. The following link should be displayed:
Click this to go to the logon page of BI launch pad
To pass the user name through user principal
The following sample configuration assumes that a user called JohnDoe has been created in BI platform.
User information is stored and passed through the User Principal option, and the shared secret is passed via the TrustedPrincipal.conf file, which is located by default in the C:\Program Files
(x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win32_x86 directory. The bundled version of Tomcat 6 is the web application server.
Note:
The web application server configuration is the same for the REMOTE_USER method and the USER_PRIN
CIPAL method.
1.
Stop the Tomcat server.
2.
Open the server.xml file for Tomcat in the default C:\Program Files (x86)\SAP
BusinessObjects\Tomcat6\conf\ directory.
3.
Locate the <Realm className="org.apache.catalina.realm.UserDatabase
Realm"..../>
, and change it to the following value:
<Realm className="org.apache.catalina.realm.MemoryRealm" ... />
2012-12-12
Authentication
4.
Open the tomcat-users.xml file in the default C:\Program Files (x86)\SAP
BusinessObjects\Tomcat6\conf\ directory.
5.
Locate the <tomcat-users> tag, and enter the following values:
<user name=FirstnameLastname password=password roles=onjavauser/>
6.
Open the web.xml file in the C:\Program Files (x86)\SAP BusinessObjects\SAP
BusinessObjects Enterprise XI 4.0\warfiles\webapps\BOE\WEB-INF\ directory.
7.
Before the </web-app> tag, insert the following tags:
<security-constraint>
<web-resource-collection>
<web-resource-name>OnJavaApplication</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>onjavauser</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>OnJava Application</realm-name>
</login-config>
Note:
You must add a page for the <url-pattern></url-pattern> tag. Typically this page is not the default URL for BI launch pad or any other web application.
8.
Open the custom global.properties file, and enter the following values: trusted.auth.user.retrieval=USER_PRINCIPAL trusted.auth.user.namespace.enabled=true
Note:
Setting trusted.auth.user.namespace.enabled=true is optional. Add the parameter when you want to map an external user name to a different BOE user name.
9.
Restart the web application server.
10.
Use WDeploy to redeploy the WAR file on the web application server.
For information on using WDeploy, see the
SAP BusinessObjects Business Intelligence Platform
Web Application Deployment Guide.
To verify that you have properly configured Trusted Authentication, go to http://[cm
sname]:8080/BOE/BI to access BI launch pad, where [cmsname] is the name of the computer hosting the CMS. After a few moments, a logon dialog box appears.
8.3 LDAP authentication
229 2012-12-12
Authentication
8.3.1 Using LDAP authentication
This section provides a general description of how LDAP authentication works with BI platform. It then introduces the administration tools that allow you to manage and configure LDAP accounts to the platform.
When you install BI platform, the LDAP authentication plug-in is installed automatically, but not enabled by default. To use LDAP authentication, you need to first ensure that you have your respective LDAP directory set up. For more information about LDAP, refer to your LDAP documentation.
Lightweight Directory Access Protocol (LDAP), a common, application-independent directory, enables users to share information among various applications. Based on an open standard, LDAP provides a means for accessing and updating information in a directory.
LDAP is based on the X.500 standard, which uses a directory access protocol (DAP) to communicate between a directory client and a directory server. LDAP is an alternative to DAP because it uses fewer resources and simplifies and omits some X.500 operations and features.
The directory structure within LDAP has entries arranged in a specific schema. Each entry is identified by its corresponding distinguished name (DN) or common name (CN). Other common attributes include the organizational unit name (OU), and the organization name (O). For example, a member group may be located in a directory tree as follows: cn=BI platform Users, ou=Enterprise Users A, o=Research.
Refer to your LDAP documentation for more information.
Because LDAP is application-independent, any client with the proper privileges can access its directories.
LDAP offers you the ability to set up users to log on to BI platform through LDAP authentication. It provides users with access rights to objects in the system. As long as you have an LDAP server (or servers) running, and use LDAP in your existing networked computer systems, you can use LDAP authentication (along with Enterprise, and Windows AD authentication).
If desired, the LDAP security plug-in provided with BI platform can communicate with your LDAP server using an SSL connection established using either server authentication or mutual authentication. With server authentication, the LDAP server has a security certificate which BI platform uses to verify that it trusts the server, while the LDAP server allows connections from anonymous clients. With mutual authentication, both the LDAP server and BI platform have security certificates, and the LDAP server must also verify the client certificate before a connection can be established.
The LDAP security plug-in provided with BI platform can be configured to communicate with your LDAP server via SSL, but always performs basic authentication when verifying users' credentials. Before deploying LDAP authentication in conjunction with BI platform, ensure that you are familiar with the differences between these LDAP types. For details, see RFC2251, which is currently available at http://www.faqs.org/rfcs/rfc2251.html
.
Related Topics
•
Configuring LDAP authentication
•
230 2012-12-12
Authentication
8.3.1.1 LDAP security plugin
The LDAP security plug-in allows you to map user accounts and groups from your LDAP directory server to BI platform; it also enables the system to verify all logon requests that specify LDAP authentication. Users are authenticated against the LDAP directory server, and have their membership in a mapped LDAP group verified before the CMS grants them an active BI platform session. User lists and group memberships are dynamically maintained by the system. You can specify that the platform use a Secure Sockets Layer (SSL) connection to communicate to the LDAP directory server for additional security.
LDAP authentication for BI platform is similar Windows AD authentication in that you can map groups and set up authentication, access rights, and alias creation. Also as with NT or AD authentication, you can create new Enterprise accounts for existing LDAP users, and can assign LDAP aliases to existing users if the user names match the Enterprise user names. In addition, you can do the following:
• Map users and groups from the LDAP directory service.
• Map LDAP against AD. There are a number of restrictions if you configure LDAP against AD.
• Specify multiple host names and their ports.
• Configure LDAP with SiteMinder.
Once you have mapped your LDAP users and groups, all of the BI platform client tools support LDAP authentication. You can also create your own applications that support LDAP authentication.
Related Topics
•
Configuring SSL settings for LDAP Server or Mutual Authentication
•
Mapping LDAP against Windows AD
•
Configuring the LDAP plug-in for SiteMinder
8.3.2 Configuring LDAP authentication
To simplify administration, BI platform supports LDAP authentication for user and group accounts.
Before users can use their LDAP user name and password to log on to the system, you need to map their LDAP account to BI platform. When you map an LDAP account, you can choose to create a new account or link to an existing BI platform account.
Before setting up and enabling LDAP authentication, ensure that you have your LDAP directory set up.
For more information, refer to your LDAP documentation.
Configuring LDAP authentication includes the following tasks:
231 2012-12-12
Authentication
• Configuring the LDAP host
• Preparing the LDAP server for SSL (if required)
• Configuring the LDAP plug-in for SiteMinder (if required)
Note:
If you configure LDAP against AD, you will be able to map your users but you will not be able to configure
AD single sign-on or single sign-on to the database. However, LDAP single sign-on methods like
SiteMinder and trusted authentication will still be available.
8.3.2.1 To configure the LDAP host
Before configuring the LDAP host, your LDAP server must be installed and running.
1.
In the Authentication management area of the CMC, and double-click LDAP.
Note:
To go to the Authentication management area, click Authentication in the navigation list.
2.
Type the name and port number of your LDAP hosts in the Add LDAP host (hostname:port) box
(for example, myserver:123), click Add, and click OK.
Tip:
Repeat this step to add more than one LDAP host of the same server type if you want to add hosts that can act as failover servers. If you want to remove a host, highlight the host name and click
Delete.
3.
In the LDAP Server Type list, select your server type.
Note:
If you are mapping LDAP to AD, select Microsoft Active Directory Application Server for your server type.
4.
To view or change LDAP Server Attribute Mappings or LDAP Default Search Attributes, click Show
Attribute Mappings.
By default, each supported server type's server attribute mappings and search attributes are already set.
5.
Click Next.
6.
In the Base LDAP Distinguished Name box, type a distinguished name (for example, o=SomeBase) for your LDAP server, and click Next.
7.
In the "LDAP Server Administration Credentials" area, type a distinguished name and password for a user account that has read access to the directory.
Note:
Administrator credentials are not required.
232 2012-12-12
Authentication
233
Note:
If your LDAP Server allows anonymous binding, leave this area blank. BI platform servers and clients will bind to the primary host via anonymous logon.
8.
If you configured referrals on your LDAP host, enter authentication information under "LDAP Referral
Credentials", and type the number of referral hops in the Maximum Referral Hops box.
Note:
You must configure the "LDAP Referral Credentials" area if all of the following conditions apply:
• The primary host is configured to refer to another directory server that handles queries for entries under a specified base.
• The host being referred to is configured to not allow anonymous binding.
• A group from the host being referred to will be mapped to BI platform.
Note:
• Although groups can be mapped from multiple hosts, only one set of referral credentials can be set. Therefore, if you have multiple referral hosts, you must create a user account on each host that uses the same distinguished name and password.
• If Maximum Referral Hops is set to 0 (zero), no referrals will be followed.
9.
Click Next, and choose the type of Secure Sockets Layer (SSL) authentication used:
•
Basic (no SSL)
•
Server Authentication
•
Mutual Authentication
Details and prerequisites for both Server and Mutual authentication are discussed in a subsequent section. To successfully setup LDAP authentication using either type of SSL, review Configuring
SSL settings for LDAP Server or Mutual Authentication in this document before proceeding further in this procedure.
10.
Click Next, and choose Basic (No SSO) or SiteMinder as the method of LDAP single sign-on authentication.
11.
Click Next, and select how aliases and users are mapped to BI platform accounts: a.
In the New Alias Options list, select an option for mapping new aliases to Enterprise accounts:
•
Assign each added LDAP alias to an account with the same name
Use this option when you know users have an existing Enterprise account with the same name; that is, LDAP aliases will be assigned to existing users (auto alias creation is turned on). Users who do not have an existing Enterprise account or who do not have the same name in their Enterprise and LDAP account are added as new users.
•
Create a new account for every added LDAP alias
Use this option when you want to create a new account for each user.
b.
In the Alias Update Options list, select an option for managing alias updates for Enterprise accounts:
•
Create new aliases when the Alias Update occurs
2012-12-12
Authentication
Use this option to automatically create a new alias for every LDAP user mapped to BI platform.
New LDAP accounts are added for users without BI platform accounts or for all users if you selected Create a new account for every added LDAP alias.
•
Create new aliases only when the user logs on
Use this option when the LDAP directory you are mapping contains many users, but only a few of them will use BI platform. The system does not automatically create aliases and
Enterprise accounts for all users. Instead, it creates aliases (and accounts, if required) only for users who log on to the platform.
c.
If your BI platform services license is not based on users roles, in the New User Options list, select an option to specify how new users are created:
•
New users are created as named users
New user accounts are configured to use named user licenses. Named user licenses are associated with specific users and allow people to access the system based on their user name and password. This provides named users with access to the system, regardless of how many other people are connected. You must have a named user license available for each user account created using this option.
•
New users are created as concurrent users
New user accounts are configured to use concurrent user licenses. Concurrent licenses specify the number of people who can connect to BI platform services at the same time. This type of licensing is very flexible because a small concurrent license can support a large user base.
For example, depending on how often and how long users access Information platform services, a 100-user concurrent license could support 250, 500, or 700 users.
12.
Under "Attribute Binding Options", specify the attribute binding priority for the LDAP plugin: a.
Click the Import Full Name, Email Address and other attributes box.
The full names and descriptions used in the LDAP accounts are imported and stored with the user objects in the system.
b.
Specify an option for Set priority of LDAP attribute binding relative to other attributes binding.
Note:
If option is set to 1, LDAP attributes take priority in scenarios where LDAP and other plugins
(Windows AD and SAP) are enabled. If it is set to 3, attributes from other enabled plugins take priority.
13.
Click Finish.
Related Topics
•
Configuring SSL settings for LDAP Server or Mutual Authentication
•
Configuring the LDAP plug-in for SiteMinder
234 2012-12-12
Authentication
235
8.3.2.2 Managing multiple LDAP hosts
When using LDAP and BI platform, you can add fault tolerance to your system by adding multiple LDAP hosts. The system uses the first host that you add as the primary LDAP host. Subsequent hosts are treated as failover hosts.
The primary LDAP host and all failover hosts must be configured in exactly the same way, and each
LDAP host must refer to all additional hosts from which you want to map groups. For more information about LDAP hosts and referrals, see your LDAP documentation.
To add multiple LDAP Hosts, enter all hosts when you configure LDAP using the LDAP configuration wizard (see for details.) Or if you have already configured LDAP, go to the Authentication management area of the Central Management Console and click the LDAP tab. In the LDAP Server Configuration
Summary area, click the name of the LDAP host to open the page that enables you to add or delete hosts.
Note:
• Make sure that you add the primary host first, followed by the remaining failover hosts.
• If you use failover LDAP hosts, you cannot use the highest level of SSL security (that is, you cannot select "Accept server certificate if it comes from a trusted Certificate Authority and the CN attribute of the certificate matches the DNS hostname of the server.")
Related Topics
•
Configuring LDAP authentication
8.3.2.3 Configuring SSL settings for LDAP Server or Mutual Authentication
This section contains detailed information on Server or Mutual SSL-based authentication for LDAP.
Preliminary steps are required for setting up SSL-based authentication. This section also provides specific information for configuring SSL with LDAP Server and Mutual Authentication in the CMC. It assumes that you have configured the LDAP host and that you selected either of these for your SSL authentication choice:
For additional information or for information on configuring the LDAP host server, refer to your LDAP vendor documentation.
Related Topics
•
2012-12-12
Authentication
8.3.2.3.1 To configure the LDAP Server or Mutual Authentication
Resource
CA certificate
Server certificate cert7.db or cert8.db, key3.db
cacerts
Take this action before starting this task
This action is required for both server and Mutual Authentication with SSL.
1.
Obtain a Certificate Authority (CA) to generate a CA certificate.
2.
Add the certificate to your LDAP Server.
For information, see your LDAP vendor documentation.
This action is required for both server and Mutual Authentication with SSL.
1.
Request and then generate a server certificate.
2.
Authorize the certificate and then add it to the LDAP Server.
These files are required for both server and Mutual Authentication with SSL.
1.
Download the certutil application that generates either a cert7.db or cert8.db
file (depending on your requirements) from ftp://ftp.mozil
la.org/pub/mozilla.org/security/nss/releases/NSS_3_6_RTM/ .
2.
Copy the CA certificate to the same directory as the certutil application.
3.
Use the following command to generate the cert7.db or cert8.db, key3.db
, and secmod.db files: certutil -N -d .
4.
Use the following command to add the CA certificate to the cert7.db
or cert8.db file: certutil -A -n <CA_alias_name> -t CT -d . -I cacert.cer
5.
Store the three files in a directory on the computer that hosts Business
Intelligence (BI) platform.
This file is required for server or Mutual Authentication with SSL for Java applications, like BI launch pad.
1.
Locate the keytool file in your Java bin directory.
2.
Use the following command to create the cacerts file: keytool -import -v -alias <CA_alias_name> -file <CA_certificate_name> trustcacerts -keystore
3.
Store the cacerts file in the same directory as the cert7.db or cert8.db
and key3.db files.
Client certificate
236 2012-12-12
Authentication
237
Resource Take this action before starting this task
1.
Create separate client requests for the cert7.db or cert8.db and
.keystore
files:
• To configure the LDAP plugin, use the certutil application to generate a client certificate request.
• Use the following command to generate the client certificate request: certutil -R -s "<client_dn>" -a -o <certificate_request_name> -d .
<client_dn> includes information such as "CN=<client_name>,
OU=org unit, O=Companyname, L=city, ST=province, and
C=country.
2.
Use the CA to authenticate the certificate request. Use the following command to retrieve the certificate and insert it in the cert7.db or cert8.db
file: certutil -A -n <client_name> -t Pu -d . -I <client_certificate_name>
3.
To facilitate Java authentication with SSL:
• Use the keytool utility in the Java bin directory to generate a client certificate request.
• Use the following command to generate a key pair: keytool -genkey -keystore .keystore
4.
After specifying information about your client, use the following command to generate a client certificate request: keytool -certreq -file <certificate_request_name> -keystore .keystore
5.
After the client certificate request is authenticated by the CA, use the following command to add the CA certificate to the .keystore file: keytool -import -v -alias <CA_alias_name> -file <ca_certificate_name> trustcacerts -keystore .keystore
6.
Retrieve the client certificate request from the CA, and use the following command to add it to the .keystore file: keytool -import -v -file <client_certificate_name> -trustcacerts -keystore
.keystore
7.
Store the .keystore file in the same directory as the cert7.db or cert8.db
and cacerts files on the computer that hosts BI platform.
1.
Choose the level of SSL security to use:
•
Always accept server certificate
This is the lowest security option. Before BI platform can establish an SSL connection with the
LDAP host (to authenticate LDAP users and groups), it must receive a security certificate from the LDAP host. BI platform does not verify the certificate it receives.
•
Accept server certificate if it comes from a trusted Certificate Authority
2012-12-12
Authentication
238
This is a medium security option. Before BI platform can establish an SSL connection with the
LDAP host (to authenticate LDAP users and groups), it must receive and verify a security certificate sent to it by the LDAP host. To verify the certificate, the system must find the CA that issued the certificate in its certificate database.
•
Accept server certificate if it comes from a trusted Certificate Authority and the CN attribute of the certificate matches the DNS hostname of the server
This is the highest security option. Before BI platform can establish an SSL connection with the
LDAP host (to authenticate LDAP users and groups), it must receive and verify a security certificate sent to it by the LDAP host. To verify the certificate, BI platform must find the CA that issued the certificate in its certificate database and be able to confirm that the CN attribute on the server certificate exactly matches the LDAP host name you entered in the Add LDAP host box in the first step of the wizard—if you entered the LDAP host name as ABALONE.rd.crystald.net:389.
(Using CN =ABALONE:389 in the certificate doesn't work.) .
The host name on the server security certificate is the name of the primary LDAP host. If you select this option, you cannot use a failover LDAP host.
Note:
Java applications ignore the first and last setting and accept the server certificate only if it comes from a trusted CA.
2.
In the SSL host box, type the host name of each computer, and click Add.
Next, you must add the host name of each computer in your BI platform deployment that uses the
BI platform SDK. (This includes the computer running your Central Management Server and the computer running your web application server.)
3.
Specify the SSL settings for each SSL host you added to the list: a.
Select default in the SSL list.
b.
Clear the Use default value check boxes.
c.
Type a value in the Path to the certificate and key database files box and the Password for
the key database box.
d.
If specifying settings for mutual authentication, type a value in the Nickname for the client
certificate in the certificates database box.
Note:
The default settings will be used (for any setting) for any host with the Use default value check box selected or for any computer name you do not add to the list of SSL hosts.
4.
Specify the default settings for each host that isn't in the list, and click Next.
To specify settings for another host, select the host name in the list on the left, and type values in the boxes on the right.
Note:
The default settings will be used for any setting (for any host) with the Use default value check box selected or for any computer name you do not add to the list of SSL hosts.
5.
Select Basic (No SSO) or SiteMinder as the method of LDAP single sign-on authentication.
6.
Choose how new LDAP users and aliases are created.
7.
Click Finish.
2012-12-12
Authentication
Related Topics
•
Configuring the LDAP plug-in for SiteMinder
239
8.3.2.4 To modify your LDAP configuration settings
After you have configured LDAP authentication using the LDAP configuration wizard, you can change
LDAP connection parameters and member groups using the LDAP Server Configuration Summary page.
1.
Go to the Authentication management area of the CMC.
2.
Double-click LDAP.
If LDAP authorization is configured, the "LDAP Server Configuration Summary" page appears. On this page you can change any of the connection parameter areas or fields. You can also modify the
"Mapped LDAP Member Groups" area.
3.
Delete currently mapped groups that are no longer accessible under the new connection settings, and click Update.
4.
Change your connection settings, then click Update.
5.
Change your "Alias and New User" options, and click Update.
6.
Map your new LDAP member groups, and click Update.
8.3.2.5 Configuring the LDAP plug-in for SiteMinder
This section explains how to configure the CMC to use LDAP with SiteMinder. SiteMinder is a third-party user access and authentication tool that you can use with the LDAP security plug-in to create single sign-on to BI platform.
To use SiteMinder and LDAP with BI platform, you need to make configuration changes in two places:
• The LDAP plugin through the CMC
• The BOE.war file properties
Note:
Ensure that the SiteMinder Administrator has enabled support for 4.x Agents. This must be done regardless of what supported version of SiteMinder you are using. For more information about SiteMinder and how to install it, refer to the SiteMinder documentation.
Related Topics
•
2012-12-12
Authentication
8.3.2.5.1 To configure LDAP for single sign-on with SiteMinder
1.
Open the Please configure your SiteMinder settings screen using one of the following methods:
• Select SiteMinder on the "Please choose a method of LDAP single sign-on authentication" screen in the LDAP configuration wizard.
• Select the "Single Sign On Type" link on the LDAP authentication screen which is available if you have already configured LDAP and are now adding SSO.
2.
In the Policy Server Host box, type the name of each policy server, and then click Add.
3.
For each Policy Server Host, specify the Accounting, Authentication and Authorization port numbers.
4.
Enter the name of the Agent Name and the Shared Secret. Enter the shared secret again.
5.
Click Next.
6.
Proceed with configuring the LDAP options.
8.3.2.5.2 To enable LDAP and SiteMinder in the BOE.war file
You must specify SiteMinder settings for the LDAP security plugin and for the BOE.war file properties.
1.
Locate the <INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\ directory in your BI platform installation.
2.
Create a new file, using Notepad or another text editing utility.
3.
In the new file, enter the following values: siteminder.authentication=secLDAP siteminder.enabled=true
4.
Save the file with the global.properties name, and close the file.
Do not save the file name with a file-name extension, such as .txt.
5.
Create another file in the same directory.
6.
In the new file, enter the following values: authentication.default=LDAP cms.default=[cms name]:[CMS port number]
For example: authentication.default=LDAP cms.default=mycms:6400
7.
Save the file with the bilaunchpad.properties name, and close the file.
The new properties take effect after the modified BOE web application is redeployed on the computer running the web application server. Use WDeploy to redeploy the WAR file on the web application server. For information on using WDeploy, see the SAP BusinessObjects Business Intelligence Platform
Web Application Deployment Guide.
240 2012-12-12
Authentication
8.3.3 Mapping LDAP groups
Once you have configured the LDAP host using the LDAP configuration wizard, you can map LDAP groups to Enterprise groups.
Once you have mapped LDAP groups, you can view the groups by clicking the LDAP option in the
Authentication management area. If LDAP authentication is configured, the Mapped LDAP Member
Groups area displays the LDAP groups that have been mapped to BI platform.
Note:
You can also map Windows AD groups to authenticate in BI platform via the LDAP security plugin.
Note:
If you have configured LDAP against AD, this procedure will map your AD groups.
Related Topics
•
Mapping LDAP against Windows AD
241
8.3.3.1 To map LDAP groups using BI platform
1.
In the "Authentication" management area of the CMC, double-click LDAP.
If LDAP authentication is configured, the LDAP summary page appears.
2.
In the "Mapped LDAP Member Groups" area, type your LDAP group by common name (cn) or distinguished name (dn) in the Add LDAP group (by cn or dn) box, and click Add.
You can add more than one LDAP group.
Tip:
To remove a group, select the LDAP group, and click Delete.
3.
In the New Alias Options list, select an option to map LDAP aliases to Enterprise accounts:
•
Assign each added LDAP alias to an account with the same name
Select this option when you know users have an existing Enterprise account with the same name; that is, LDAP aliases will be assigned to existing users (auto alias creation is turned on). Users who do not have an existing Enterprise account, or who do not have the same name in their
Enterprise and LDAP account, are added as new LDAP users.
•
Create a new account for every added LDAP alias
Select this option when you want to create a new account for each user.
2012-12-12
Authentication
4.
In the Alias Update Options list, select an option to determine whether LDAP aliases are automatically created for new users:
•
Create new aliases when the Alias Update occurs
•
Create new aliases only when the user logs on
5.
Select an option in the New User Options list to specify properties for new Enterprise accounts that are created to map to LDAP accounts:
•
New users are created as named users
Select this option if you want new user accounts to be configured to use named user licenses.
Named user licenses are associated with specific users and allow people to access the system based on their user name and password. This provides named users with access to the system regardless of how many other people are connected. You must have a named user license available for each user account created using this option.
•
New users are created as concurrent users
Select this option if you want new user accounts to be configured to use concurrent user licenses.
Concurrent licenses specify the number of people who can connect to BI platform at the same time. This type of licensing is very flexible because a small concurrent license can support a large user base. For example, depending on how often and how long users access the system, a 100 user concurrent license could support 250, 500, or 700 users.
6.
Click Update.
8.3.3.2 To unmap LDAP groups using BI platform
1.
Go to the Authentication management area of the CMC.
2.
Double-click LDAP.
If LDAP authentication is configured, the LDAP summary page will appear.
3.
In the "Mapped LDAP Member Groups" area, select the LDAP group you would like to remove.
4.
Click Delete, and then click Update.
The users in this group will not be able to access BI platform.
Note:
The only exceptions to this occur when a user has an alias to an Enterprise account. To restrict access, disable or delete the user's Enterprise account.
To deny LDAP Authentication for all groups, clear the "LDAP Authentication is enabled" check box and click Update.
242 2012-12-12
Authentication
8.3.3.3 Mapping LDAP against Windows AD
If you configure LDAP against Windows AD, note the following restrictions:
• If you configure LDAP against AD, you will be able to map your users but you will not be able to configure AD single sign-on or single sign-on to the database. However, LDAP single sign-on methods like SiteMinder and trusted authentication will still be available.
• Users who are only members of default groups from AD will not be able to log in successfully. Users must also be a member of another explicitly created group in AD and, in addition, this group must be mapped. An example of such a group is the "domain users" group.
• If a mapped domain local group contains a user from a different domain in the forest, the user from a different domain in the forest will not be able to log in successfully.
• Users from a universal group from a domain different than the DC specified as the LDAP host will not be able to log in successfully.
• You cannot use the LDAP plug-in to map users and groups from AD forests outside the forest where
BI platform is installed.
• You cannot map in the Domain Users group in AD.
• You cannot map a machine local group.
• If you are using the Global Catalog Domain Controller, there are additional considerations when mapping LDAP against AD:
243 2012-12-12
Authentication
Situation
Mapping in universal groups
Considerations
You can map in:
• universal groups on a child domain,
• groups on the same domain that contains universal groups from a child domain, and
• universal groups on a cross domain.
Multiple domains when pointing to the
Global Catalog Domain Controller
You cannot map in:
• global groups on a child domain,
• local groups on a child domain,
• groups on the same domain that contain a global group from the child domain, and
• cross-domain global groups.
Generally, if the group is a universal group, it will support users from cross or child domains. Other groups will not be mapped if they contain users from cross or child domains. Within the domain you are pointing to, you can map domain local, global, and universal groups.
To map in universal groups, you must point to the Global
Catalog Domain Controller. You should also use port number 3268 instead of the default 389.
• If you are using multiple domains but not pointing to the Global Catalog Domain Controller, then you cannot map in any type of groups from cross or child domains. You can map in all types of groups only from the specific domain you are pointing to.
244
8.3.3.4 Using the LDAP plugin to configure SSO to the SAP HANA database
This section provides administrators with the steps required to set up and configure single sign-on
(SSO) between the BI platform running on SUSE Linux 11 and the SAP HANA database. LDAP authentication using Kerberos enables AD users to be authenticated on a BI platform running on Linux
- specifically SUSE. This scenario also supports single sign-on to SAP HANA as the reporting database.
Note:
For information on how to set up the SAP HANA database, see the SAP HANA Database - Server
Installation and Update Guide. For information on how to set up the Data Access component for SAP
HANA, see the Data Access Guide.
2012-12-12
Authentication
245
Implementation overview
The following components must be in place for Kerberos SSO to work.
Component
Domain controller
Requirement
Hosted on a machine running Active Directory setup to use Kerberos authentication.
Central Management
Server
Kerberos V5 client
Installed and running on a machine running SUSE Linux Enterprise 11
(SUSE).
Installed together with the required utilities and libraries on the SUSE host.
Note:
Use the latest version of the Kerberos V5 client. Add the bin and lib folders to the PATH and LD_LIBRARY_PATH environment variables.
LDAP authentication plug-in
Enabled on the SUSE host.
Kerberos login configuration file
Created on the machine hosting the web application server.
Implementation workflow
The following tasks must be performed to enable BI platform users to SSO to SAP HANA using Kerberos authentication through JDBC.
1.
Setting up the AD host.
2.
Creating accounts and keytab files for the SUSE host and BI platform on the AD Host.
3.
Installing Kerberos resources on the SUSE host.
4.
Configuring the SUSE host for Kerberos authentication.
5.
Configuring Kerberos authentication options in the LDAP authentication plug-in.
6.
Creating a Kerberos login configuration file for the web application host.
8.3.3.4.1 To set up the domain controller
You may need to set up a trust relationship between the SUSE host and the domain controller. If the
SUSE host is in the Windows domain controller, you do not have to set up the trust relationship. However, if the BI platform deployment and the domain controller are in different domains, you may need to set up a trust relationship between the SUSE Linux machine and the domain controller. This would require the following:
1.
Create an user account for the SUSE machine running BI platform.
2.
Create a host Service Principal Name (SPN).
Note:
The SPN should be formatted according to Windows AD conventions: host/host
name
@DNS_REALM_NAME. Use, in lowercase, a fully qualified domain name for /hostname. The
DNS_REALM_NAME
should be specified in uppercase.
2012-12-12
Authentication
3.
Run the Kerberos keytab setup command ktpass to associate the SPN with the user account: c:\> ktpass -princ host/hostname@DNS_REALM_NAME-mapuser username -pass Password1 -crypto RC4-HMAC-NT out usernamebase.keytab
The following steps must be performed on the machine hosting the domain controller.
1.
Create a user account for the service running BI platform.
2.
On the "User Accounts" page, right-click the new service account and select Properties > Delegation.
3.
Select Trust this user for delegation to any service (Kerberos only).
4.
Run the Kerberos keytab setup command ktpass to create an SPN account for the new service account: c:\>ktpass -princ sianame/service_name@DNS_REALM_NAME -mapuser service_name -pass password -ptype
KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT -out sianame.keytab
Note:
The SPN should be formatted according to Windows AD conventions: sianame/ser
vice_name
@DNS_REALM_NAME. Specify the service name in lowercase otherwise your SUSE platform may not be able to resolve it. The DNS_REALM_NAME should be specified in uppercase.
Parameter
-princ
-out
-mapuser
-pass
-ptype
Description
Specifies the principal name for Kerberos authentication.
Specifies the name of the Kerberos keytab file to generate. This should match the sianame used in -princ.
Specifies the name of the user account to which the is SPN mapped to. The
Server Intelligence Agent runs on this account.
Specifies the password used by the service account.
Specifies the principal type:
-ptype KRB5_NT_PRINCIPAL
-crypto
Specifies the encryption type to use with the service account:
-crypto RC4-HMAC-NT
You have generated the required keytab files for the trust relationship between the SUSE machine and the domain controller.
You must transfer the keytab file(s) to the SUSE machine and store them in the /etc directory.
8.3.3.4.2 To set up the SUSE Linux Enterprise 11 machine
The following resources are required for setting up Kerberos on the SUSE Linux machine running BI platform:
246 2012-12-12
Authentication
247
• Keytab files created on the domain controller. The keytab file created for the BI platform service is mandatory. The keytab for the SUSE host is recommended specifically for scenarios where the BI platform host and the domain controller are in different domains.
• The latest Kerberos V5 library (including the Kerberos client) must be installed on the SUSE host.
You must add the location of the binaries to the PATH and LD_LIBRARY_PATH environment variables.
To verify that the Kerberos client is properly installed and configured, ensure that the following utilities and libraries exist on the SUSE host:
• kinit
• ktutil
• kdestroy
• klist
•
/lib64/libgssapi_krb5.so.2.2
•
/lib64/libkrb5.so.3.3
•
/lib/libkrb5support.so.0.1
•
/lib64/libk5crypto.so.3
•
/lib64/libcom_err.so.2
Tip:
Run rpm -qa | grep krb to check the version of these libraries. For information on the latest
Kerberos client, libraries, and Unix host configuration see http://web.mit.edu/Kerberos/krb5-1.9/krb5-
1.9.2/doc/krb5-install.html#Installing%20Kerberos%20V5 .
After all the required resources are available on the SUSE host, follow the instructions below to set up
Kerberos authentication.
Note:
To perform these steps you must have root privileges.
1.
To merge the keytab files, run the following command:
> ktutil ktutil: rkt <susemachine>.keytab
ktutil: rkt <BI platform service>.keytab
ktutil: wkt /etc/krb5.keytab
ktutil:q
2.
Edit the /etc/kerb5.conf file to refer to the domain controller (on the Windows platform) as the
Kerberos Domain Controller (KDC).
Use to the example below:
[domain_realm]
.name.mycompany.corp = DOMAINNAME.COM
name.mycompany.corp = DOMAINNAME.COM
[libdefaults] forwardable = true default_realm = DOMAINNAME.COM
default_tkt_enctypes = rc4-hmac default_tgs_enctypes = rc4-hmac
[realms]
DOMAINNAME.COM = { kdc = machinename.domainname.com
}
2012-12-12
Authentication
248
Note:
The krb5.conf file contains Kerberos configuration information, including the locations of KDCs and servers for the Kerberos realms of interest, Kerberos applications, and mappings of hostnames onto Kerberos realms. Normally the krb5.conf file is installed in the /etc directory.
3.
Add the domain controller to /etc/hosts so that the SUSE host can locate the KDC.
4.
Run the kinit program from the /usr/local/bin directory to verify that Kerberos has been set up properly. Verify that an AD account user account can log into the SUSE machine.
Tip:
The KDC should issue a Ticket Granting Ticket (TGT) which can be viewed in the cache. Use the klist program to view the TGT.
Example:
> kinit <AD user>
Password for <AD user>@<domain>: <AD user password>
> klist
Ticket cache: FILE:/tmp/krb5cc_0Default principal: <AD user>@<domain>
Valid starting Expires Service principal08/10/11 17:33:43 08/11/11 03:33:46 krbtgt/<domain>@<domain>renew until 08/11/11 17:33:43
Kerberos 4 ticket cache: /tmp/tkt0klist: You have no tickets cached
>klist -k
Keytab name: FILE:/etc/krb5.keytabKVNO Principal-3hdb/<FQDN>@<Domain>
You should also use kinit to test the SPNs.
8.3.3.4.3 To configure Kerberos authentication options for LDAP
Before configuring Kerberos authentication for LDAP, you must first enable and configure the BI platform
LDAP authentication plugin to connect to the AD directory. To use LDAP authentication, you need to first ensure that you have set up your respective LDAP directory.
Note:
When running the "LDAP Configuration Wizard" you must specify Microsoft Active Directory
Application Server and provide the requested configuration details.
After LDAP authentication is enabled and connected to your Microsoft Active Directory Application
Server, the "Enable Kerberos Authentication" area appears on the LDAP Server Configuration Summary page. Use this area to configure Kerberos authentication, which is required for single sign-on to the
SAP HANA database from a BI platform deployed on SUSE.
1.
Go to the Authentication management area of the CMC.
2.
Double-click LDAP.
The "LDAP Server Configuration Summary" page appears, where you can modify any of the connection parameters or fields.
3.
To configure Kerberos authentication, perform the following steps in the "Enable Kerberos
Authentication" area:
2012-12-12
Authentication
249 a.
Click Enable Kerberos authentication.
b.
Click Cache Security Context.
Note:
Enabling the cache security context is specifically required for single sign-on to SAP HANA.
c.
Specify the Service Principal Name (SPN) for BI platform account in "Service Principal Name".
The format for specifying the SPN is sianame/service@DNS_REALM_NAME where
sianame
Name of the sia
Name of the service account used to run BI platform
service
DNS_REALM_NAME The domain name of the domain controller in uppercase
Tip:
When specifying the SPN, remember that sianame/service is case sensitive.
d.
Specify the domain for the domain controller in "Default Domain".
e.
Specify userPrincipalName in User Principal Name.
This value is used by the LDAP authentication application to provide user ID values that are required by Kerberos. The value specified should match the name provided when creating the keytab files.
4.
Click Update to submit and save your changes.
You have configured Kerberos authentication options to refer to user accounts in the AD directory.
You need to create a Kerberos login configuration file - bscLogin.conf - to enable Kerberos logon and single sign-on.
Related Topics
•
Configuring LDAP authentication
8.3.3.4.4 To create a Kerberos login configuration file
To enable Kerberos logon and single sign-on, you need to add a login configuration file on the machine hosting the BI platform web application server.
1.
Create a file called bscLogin.conf and store it in the /etc directory.
Note:
You can store this file in a different location. However, if you do, you will need to specify its location in your Java options. It is recommended that the bscLogin.conf and the Kerberos keytab files reside under the same directory. In a distributed deployment, you must add a bscLogin.conf file for every machine hosting a web application server.
2.
Add the following code to your login bscLogin.conf configuration file: com.businessobjects.security.jgss.initiate { com.sun.security.auth.module.Krb5LoginModule required;
2012-12-12
Authentication
}; com.businessobjects.security.jgss.accept { com.sun.security.auth.module.Krb5LoginModule required storeKey=true useKeyTab=true keyTab="/etc/krb5.keytab" principal="principal name";
};
Note:
The following section is specifically required for single sign-on: com.businessobjects.security.jgss.accept { com.sun.security.auth.module.Krb5LoginModule required storeKey=true useKeyTab=true keyTab="/etc/krb5.keytab" principal="principal name";
};
3.
Save and close the file.
8.3.3.5 Troubleshooting new LDAP accounts
• If you create a new LDAP user account, and the account does not belong to a group account that is mapped to BI platform, either map the group, or add the new LDAP user account to a group that is already mapped to the system.
• If you create a new LDAP user account, and the account belongs to a group account that is mapped to BI platform, refresh the user list.
Related Topics
•
Configuring LDAP authentication
•
8.4 Windows AD authentication
8.4.1 Using Windows AD authentication
250 2012-12-12
Authentication
8.4.1.1 Windows AD support requirements and initial setup
This section guides you through the process of configuring Windows Active Directory (AD) authentication to work on BI platform. All the required end-to-end workflows you need to perform are presented together with validation tests and prerequisite checks.
Support requirements
To facilitate AD authentication on BI platform, you should remember the following support requirements.
• The CMS must always be installed on a supported Windows platform.
• Although Windows 2003 and 2008 are supported platforms for both Kerberos and NTLM authentication, certain BI platform applications may only use particular authentication methods. For example, applications such as BI launch pad and Central Management Console only support
Kerberos.
Recommended AD set up workflow
To initially set up manual AD authentication with BI platform, use the following workflow:
1.
Set up the Domain Controller.
2.
Configure AD authentication in the CMC.
3.
Configure the AD user account on the Server Intelligence Agent (SIA).
4.
Configure your web application server for AD authentication with Kerberos.
Note:
Use this workflow whether or not you require single sign-on (SSO). The workflow described in the following sections will first enable you to manually (using an AD username and password) log into BI platform. Once you have successfully configured manual AD authentication, a detailed section is provided to guide you through the process of setting up SSO for AD authentication.
8.4.2 Preparing the Domain Controller
251
8.4.2.1 Setting up a service account for AD authentication with Kerberos
To configure BI platform to work with Windows AD (Kerberos) authentication, you require a service account. You can either create a new domain account or use an existing domain account. The service
2012-12-12
Authentication account will be used to run the BI platform servers. After setting up the account, you will need to set up an SPN for the account. This SPN is used to import AD user groups into BI platform.
Note:
To use AD with SSO, you will need to later revisit the service account set up to grant the account appropriate rights, and configure it for constrained delegation.
8.4.2.1.1 To set up the service account on a Windows 2003 or 2008 domain
You need to set up a new service account to successfully enable Windows AD authentication using the
Kerberos protocol. This service account will be used primarily to allow users in a given AD group to log on to BI launch pad. The following task is performed on the AD domain controller machine.
1.
Create a new service account with a password on the primary domain controller.
2.
Use the setspn -a command to add the service principal names (SPN) to the service account you created in Step 1. Specify service principal names (SPNs) for the service account, as well as the server, fully qualified domain server and IP address for the machine on which BI launch pad is deployed.
For example: setspn –a BICMS/service_account_name.domain.com serviceaccountname setspn -a HTTP/servername servicename setspn -a HTTP/servername.domain.com servicename setspn -a HTTP/<ip address of server> servicename
BICMS is the name of the machine on which the SIA is running, servername is the name of the server on which BI launch pad is deployed and servernamedomain is its fully qualified domain name.
3.
Run setspn -l servicename to verify that the service principal names were added to the service account.
The output for the command should include all the registered SPNs as shown below:
Registered ServicePrincipalNames for
CN=bo.service,OU=boe,OU=BIP,OU=PG,DC=DOMAIN,DC=com:
HTTP/<ip address of server>
HTTP/servername.DOMAIN.com
HTTP/servername
servername/servicenameDOMAIN.com
A sample output is provided below:
C:\Users\Admin>setspn -L bossosvcacct
Registered ServicePrincipalNames for
CN=bossosvcacct,OU=svcaccts,DC=domain,DC=com:
BICMS/bossosvcacct.domain.com
HTTP/Tomcat6 HTTP/Tomcat6.domain.com
HTTP/Load_Balancer.domain.com
Once created, the service account needs to be granted rights and added to the server's Local
Administrators group. The SPN will be used to import AD groups in the next section.
252 2012-12-12
Authentication
8.4.3 Configuring AD Authentication in the CMC
8.4.3.1 Windows AD security plug-in
The Windows AD security plug-in enables you to map user accounts and groups from your AD (2003 and 2008) user database to BI platform. It also enables the system to verify all logon requests that specify AD Authentication. Users are authenticated against the AD user database, and have their membership in a mapped AD group verified before the Central Management Server (CMS) grants them an active session. You can use the plug-in to configure updates for the imported AD groups.
The Windows AD security plug-in enables you to configure the following:
• Windows AD authentication with Kerberos
• Windows AD authentication with NTLM
• Windows AD authentication with SiteMinder for single sign-on
The AD security plug-in is compatible with both AD 2003 and 2008 domains running in either native mode or mixed mode.
Once you have mapped your AD users and groups, they will be able to access BI platform client tools using the Windows AD authentication option.
• Windows AD authentication only works if the CMS is run on Windows. For SSO to a database to work, the reporting servers must also run on Windows. Otherwise all other servers and services can run on all platform supported by BI platform.
• The Windows AD plug-in for BI platform supports domains within multiple forests.
253
8.4.3.2 To map AD users and groups
Before you can import AD user groups into BI platform, you must have completed the following prerequisite actions:
• Created a service account on the domain controller for BI platform. The account will be used to run
BI platform servers.
Note:
To enable AD authentication with Vintela single sign-on (SSO), you must provide an SPN that is configured for this purpose. The steps provided below are for configuring manual AD authentication
2012-12-12
Authentication to BI platform. Once you have configured manual AD authentication, refer to the Single Sign-On
Setup section in this chapter for details on how to add SSO to your AD authentication configuration.
• Verified that the SPN containing the name of the machine on which the SIA is running has been added to the service account.
Steps 1 to 11 below are mandatory to import AD groups into BI platform.
1.
Go to the "Authentication" management area of the CMC.
2.
Double-click Windows AD.
3.
Select the Enable Windows Active Directory (AD) check box.
4.
In the "AD Configuration Summary" area, click the link beside AD Administration Name.
Note:
Before the Windows AD plug-in is configured, this link appears as quotation marks. After the configuration is saved, the link is populated with AD Administration names.
5.
Enter the name and password of an enabled domain user account.
Administration credentials can use either of the following formats:
• NT name (DomainName\UserName)
• UPN (user@DNS_domain_name)
BI platform uses this account to query information from AD. The platform does not modify, add, or delete content from AD. Because only reads information, only the appropriate rights are required.
Note:
AD authentication will break if the account used to read the AD directory becomes invalid (for example, if the account's password is changed or expires or if the account is disabled).
6.
Enter the AD domain in the Default AD Domain box.
The domain must be specified as the FULL DOMAIN NAME in ALL CAPS or a child domain name from where most users will be logging onto BI platform. This should match the default domain specified in the Kerberos configuration files that are used to configure the application server. You can map groups from the default domain without specifying the domain name prefix. If you enter a default AD domain name, users from the default domain do not have to specify the AD domain name when logging onto BI platform using AD authentication.
7.
In the "Mapped AD Member Groups" area, enter the AD domain\group in the Add AD Group
(Domain\Group) box, using one of the following formats to map groups:
• Security Account Manager account name (SAM), also referred to as NT name (Domain
Name\GroupName
)
• DN (cn=GroupName, ......, dc=DomainName, dc=com)
Note:
If you want to map a local group, use only the NT name format: \\ServerName\GroupName. AD does not support local users; local users who belong to a mapped local group will not be mapped to BI platform. Therefore, they cannot access the system.
254 2012-12-12
Authentication
255
Tip:
When manually logging onto BI launch pad, users from other domains must append the domain name, in uppercase letters, after their user name. For example CHILD.PARENTDOMAIN.COM is the domain in [email protected]
8.
Click Add.
The group is added to the list under "Mapped AD Member Groups".
9.
In the Service principal name box, enter the SPN mapped to the service account you created to run BI platform servers.
Note:
You must specify the SPN for the service account that runs the SIA. For example:
BICMS/bossosvcacct.domain.com
.
10.
Click Update.
Caution:
Do not proceed if users and/or groups are not mapping in properly! To resolve specific AD group mapping issues refer to SAP note 1631734.
Note:
If you have successfully mapped AD group accounts and do not want to configure AD authentication options or AD group updates, skip steps 12 to 19. You can configure these optional settings after you have successfully set up manual AD Kerberos authentication.
11.
If your configuration requires SSO to a database, select Cache security context.
Note:
If this is your initial AD authentication configuration, it is recommended that you first successfully set up manual AD authentication before you consider the extra configuration required for SSO.
12.
Select Enable single sign-on for selected authentication mode if you require SSO for your AD authentication configuration.
13.
In the "Synchronization of Credentials" area, select an option to enable and update the AD user's data source logon credentials .
This option synchronizes the data source with the user's current logon credentials, thereby enabling scheduled reports to run when the user is not logged on to BI platform and Kerberos SSO is not available.
14.
In the "AD Alias Options" area, specify how new aliases are added to and updated in BI platform.
a.
In the "New Alias Options" area, select an option for mapping new aliases to Enterprise accounts:
•
Assign each new AD alias to an existing User Account with the same name
Select this option when you know users have an existing Enterprise account with the same name; that is, AD aliases will be assigned to existing users (auto alias creation is turned on).
Users who do not have an existing Enterprise account, or who do not have the same name in their Enterprise and AD account, are added as new users.
•
Create a new user account for each new AD alias
2012-12-12
Authentication
256
Select this option when you want to create a new account for each user.
b.
In the "Alias Update Options" area, select an option for managing alias updates for the Enterprise accounts:
•
Create new aliases when the Alias Update occurs
Select this option to automatically create a new alias for each AD user mapped to BI platform.
New AD accounts are added for users without BI platform accounts, or for all users if you selected Create a new user account for each new AD alias and clicked Update.
•
Create new aliases only when the user logs on
Select this option when the AD directory you are mapping contains many users, but only a few of them will use BI platform. The platform does not automatically create aliases and
Enterprise accounts for all users. Instead, it creates aliases (and accounts, if required) only for users who log on to BI platform.
c.
In the "New User Options" area, select an option for creating new users:
•
New users are created as named users
New user accounts are configured to use named user licenses. Named user licenses are associated with specific users and allow people to access BI platform based on a user name and password. This provides named users with access to the system, regardless of how many people are connected. You must have a named user license available for each user account created using this option.
•
New users are created as concurrent users
New user accounts are configured to use concurrent user licenses. Concurrent licenses specify the number of people who can connect to BI platform at the same time. This type of licensing is very flexible because a small concurrent license can support a large user base. For example, depending on how often and how long users access the system, a 100-user concurrent license could support 250, 500, or 700 users.
15.
To configure how to schedule AD alias updates, click Schedule.
a.
In the "Schedule" dialog box, select a recurrence from the Run object list.
b.
Set other schedule options and parameters as required.
c.
Click Schedule.
When the alias update occurs, the group information is also updated.
16.
In the "Attribute Binding Options" area, specify the attribute binding priority for the AD plugin: a.
Select the Import Full Name, Email Address and other attributes check box.
The full names and descriptions used in AD accounts are imported and stored with user objects in BI platform.
b.
Specify an option for Set priority of AD attribute binding relative to other attributes binding.
If the option is set to 1, AD attributes take priority when AD and other plugins (LDAP and SAP) are enabled. If the option is set to 3, attributes from other enabled plugins take priority.
17.
In the "AD Group Options" area, configure AD group updates: a.
Click Schedule.
2012-12-12
Authentication
The "Schedule" dialog box appears.
b.
Select a recurrence from the Run object list.
c.
Set other schedule options and parameters as required.
d.
Click Schedule.
The system schedules the update and runs it according to the schedule you specified. The next scheduled update for the AD group accounts is displayed under the "AD Group Options".
18.
In the "On-Demand AD Update" area, select one of the following options:
•
Update AD Groups now
Select this option if you want to start updating all scheduled AD groups when you click Update.
The next scheduled AD group update is listed under "AD Group Options".
•
Update AD Groups and Aliases now
Select this option if you want to start updating all scheduled AD groups and user aliases when you click Update. The next scheduled updates are listed under "AD Group Options" and "AD
Alias Options".
•
Do not update AD Groups and Aliases now
No AD groups or user aliases will be updated when you click Update.
19.
Click Update, and click OK.
To verify that you have actually imported AD user accounts, go to CMC > User and Groups > Group
Hierarchy and select the AD group you have mapped to view users in that group. The current and nested users in the AD group will be displayed.
Related Topics
•
To create a Kerberos configuration file
8.4.3.3 Scheduling updates for Windows AD groups
BI platform enables administrators to schedule updates for AD groups and user aliases. This feature is available for AD authentication with either Kerberos or NTLM. The CMC also enables you to view the time and date when the last update was performed.
Note:
For AD authentication to work on BI platform, you must configure how updates are scheduled for your
AD groups and aliases.
When scheduling an update, you can choose from the recurrence patterns summarized in the following table:
257 2012-12-12
Authentication
258
Recurrence pattern
Hourly
Daily
Weekly
Monthly
Nth Day of Month
1st Monday of Month
Last Day of Month
Description
The update will run every hour. You specify at what time it will start, as well as a start and end date.
The update will run every day or run every number of specified days. You can specify at what time it will run, as well as a start and end date.
The update will run every week. It can be run once a week or several times a week. You can specify on which days and at what time it will run, as well as a start and end date.
The update will run every month or every several months. You can specify what time it will run, as well as a start and end date.
The update will run on a specific day in the month. You can specify on which day of the month, what time it will run, as well as a start and end date.
The update will run on the first Monday of each month. You can specify what time it will run, as well as a start and end date.
The update will run on the last day of each month. You can specify what time it will run, as well as a start and end date.
X Day of Nth Week of the Month
Calendar
The update will run on a specified day of a specified week of the month. You can specify what time it will run, as well as a start and end date.
The update will be run on the dates specified in a calendar that has previously been created.
Scheduling AD group updates
BI platform relies on AD for user and group information. To minimize the volume of queries sent to AD, the AD plugin caches information about groups and how they relate to each other and their user membership. The update does not run when no specific schedule is defined.
You must use the CMC to configure the recurrence of the group update refresh. This should be scheduled to reflect how frequently your group membership information is modified.
Scheduling AD user alias updates
User objects can be aliased to an AD account, allowing users to use their AD credentials to log on to
BI platform. Updates to AD accounts are propagated to BI platform by the AD plug-in. Accounts created, deleted, or disabled in AD will be correspondingly created, deleted, or disabled in BI platform.
If you do not schedule AD alias updates, updates will occur only when:
• A user logs on; the AD alias will be updated.
• An administrator selects the Update AD Groups and Aliases now option from the On Demand
AD Update area of the CMC.
2012-12-12
Authentication
Note:
No AD passwords are stored in the user alias.
8.4.4 Configuring the BI platform service to run the SIA
8.4.4.1 Running the SIA under the BI platform service account
To support AD Kerberos authentication for BI platform, you must grant the service account the right to act as part of the operating system. This must be done on each machine running a Server Intelligence
Agent (SIA) with the Central Management Server (CMS).
To enable the service account to run/start the SIA, you must configure specific operating system settings described in this section.
Note:
If you will require single sign-on to the database, the SIA must include the following servers:
• Crystal Reports Processing Server
• Report Application Server
• Web Intelligence Processing Server
259
8.4.4.2 To configure the SIA to run under the service account
Before configuring the SIA account to run under the BI platform service account you must complete the following prerequisite actions:
• A service account has been created on the domain controller for BI platform.
• You have verified that the required service principal names (SPN) have been added to the service account.
• You have successfully mapped AD user groups into BI platform.
Perform this task for any Server Intelligence Agent (SIA) that is running services used by the service account.
1.
To start the CCM, choose Programs > SAP Business Intelligence > SAP BusinessObjects BI
platform 4 > Central Configuration Manager.
The CCM home page opens.
2012-12-12
Authentication
2.
In the CCM, right-click the Server Intelligence Agent (SIA) and select Stop.
Note:
When you stop the SIA, all services managed by the SIA are stopped.
3.
Right-click the SIA and select Properties.
4.
Clear the System Account check box.
5.
Type the service account credentials (DOMAINNAME\service name) and click OK.
The service account must be granted the following rights on the machine running the SIA:
• The account must specifically have the “Act as part of operating system” right.
• The account must specifically have the “Logon as a service” right.
• Full control rights to the folder where BI platform is installed.
• Full control rights to “ HKEY_LOCAL_MACHINE\SOFTWARE\SAP BusinessObjects” in the system registry.
6.
Click Start > Control Panel > Administrative Tools > Local Security Policy.
7.
Expand Local Policies, then click User Rights Assignment.
8.
Double-click Act as part of the operating system.
9.
Click Add, and enter the name of the service account you created, then click OK.
10.
Repeat the above steps on each machine running a BI platform server.
Note:
It is important that the Effective Right ends up being checked after Act as part of the operating
system is selected. Typically, you will need to restart the server for this to occur. If, after restarting the server, this option is still not on, your Local Policy settings are being overridden by your Domain
Policy settings.
11.
Restart the SIA.
12.
If necessary, repeat steps 1 to 5 for each SIA running a service that must be configured.
You should now be able to login into the CCM using AD credentials.
8.4.4.3 To test AD credentials on the CCM
To perform this task, you need to have successfully mapped an AD user group into BI platform.
1.
Open the CCM and click the Manage Servers icon.
2.
Ensure that the right information is displayed in the "System" field.
3.
Select Windows AD from the authentication options list.
A login dialog box opens.
4.
Log on using an existing AD account from the AD group you mapped into BI platform.
260 2012-12-12
Authentication
Note:
If you are using an AD account that does not reside in the default domain, login as domain\user name
.
You should not receive any error messages. You must be able to log in via the CCM using a mapped
AD account before moving to the next section.
Tip:
If you get an error message, go to CMC > Authentication > Windows AD. Under "Authentication
Options", change Use Kerberos authentication to Use NTLM authentication and click Update.
Repeat steps 1-4 above. If this works, there is an issue with your Kerberos configuration.
8.4.5 Configuring the web application server for AD Authentication
8.4.5.1 Preparing the application server for Windows AD authentication
(Kerberos)
The process of configuring Kerberos for a web application server varies slightly depending on the specific application server. However, the general process of configuring Kerberos involves these steps:
• Creating the Kerberos (krb5.ini) configuration file.
• Creating the JAAS login bscLogin.conf configuration file.
Note:
This step is not required for the SAP NetWeaver 7.3 Java application server. However you will need to add the LoginModule to your SAP NetWeaver server.
• Modifying the Java options for your application server.
• Overwriting the BOE.war file properties for Windows AD authentication.
• Restarting your Java application server.
This section contains the details for configuring Kerberos for use with the following application servers:
• Tomcat
• WebSphere
• WebLogic
• Oracle Application Server
• SAP NetWeaver 7.3
261 2012-12-12
Authentication
262
8.4.5.1.1 Creating Kerberos configuration files
To create a Kerberos configuration file
Before proceeding, ensure you have performed the following prerequisites tasks:
• A service account has been created on the domain controller for BI platform.
• You have verified that the service principal names (SPNs) have been added to the service account.
• You have successfully mapped AD user groups into BI platform.
• You have tested AD credentials on the CCM.
Follow these steps to create the Kerberos configuration file if you’re using SAP NetWeaver 7.3, Tomcat
6, Oracle Application Server, WebSphere, or WebLogic as the web application server for you BI platform deployment.
1.
Create the file krb5.ini, if it does not exist, and store it under C:\Windows for Windows.
Note:
• If the application server is installed on Unix, you should use the following directories:
Solaris: /etc/krb5/krb5.conf
Linux: /etc/krb5.conf
• You can store this file in a different location. However, if you do, you will need to specify its location in your java options. For more information on krb5.ini go to http://docs.sun.com/app/docs/doc/816-0219/6m6njqb94?a=view .
2.
Add the following required information in the Kerberos configuration file:
[libdefaults] default_realm = DOMAIN.COM
dns_lookup_kdc = true dns_lookup_realm = true default_tkt_enctypes = rc4-hmac default_tgs_enctypes = rc4-hmac
[domain_realm]
.domain.com = DOMAIN.COM
domain.com = DOMAIN.COM
.domain2.com = DOMAIN2.COM
domain2.com = DOMAIN2.COM
[realms]
DOMAIN.COM = { default_domain = DOMAIN.COM
kdc = HOSTNAME.DOMAIN.COM
}
DOMAIN2.COM = { default_domain = DOMAIN2.COM
kdc = HOSTNAME.DOMAIN2.COM
}
[capaths]
DOMAIN2.COM = {
DOMAIN.COM =
}
Note:
The key parameters are explained in the table below.
DOMAIN.COM
The DNS name of your domain which must be entered in uppercase in FQDN format.
2012-12-12
Authentication
263 kdc
[capath] default_realm
The Host name of the Domain Controller.
Defines the trust between domains that are in another AD forest. In the example above DO
MAIN2.COM
is a domain in an external forest and has direct two way transitive trust to DO
MAIN.COM
.
In a multiple domain configuration, under
[libdefaults] the default_realm value may be any of the source domains. The best practice is to use the domain with the greatest number of users that will be authenticating with their AD accounts. If no UPN suffix is supplied at log on, it defaults to the value of de fault_realm
. This value should be consistent with the "default domain" setting in the CMC.
All domains must be specified in uppercase as shown in the example above.
8.4.5.1.2 Creating a JAAS login configuration file
To create a Tomcat or WebLogic JAAS login configuration file
The bscLogin.conf file is used to load the java login module and is required for AD Kerberos authentication on Java web application servers.
The default location for the files is: C:\Windows.
1.
Create a file called bscLogin.conf if it does not exist, and store it in C:\Windows.
Note:
You can store this file in a different location. However, if you do, you will need to specify its location in your java options.
2.
Add the following code to your JAAS bscLogin.conf configuration file: com.businessobjects.security.jgss.initiate { com.sun.security.auth.module.Krb5LoginModule required;
};
3.
Save and close the file.
To create an Oracle JAAS login configuration file
1.
Locate the jazn-data.xml file.
Note:
The default location for this file is C:\OraHome_1\j2ee\home\config. If you installed Oracle
Application Server in a different location, find the file specific to your installation.
2012-12-12
Authentication
264
2.
Add the following content to the file between the <jazn-loginconfig> tags:
<application>
<name>com.businessobjects.security.jgss.initiate</name>
<login-modules>
<login-module>
<class>com.sun.security.auth.module.Krb5LoginModule</class>
<control-flag>required</control-flag>
</login-module>
</login-modules>
</application>
3.
Save and close the jazn-data.xml file.
To create a WebSphere JAAS login configuration file
1.
Create a file called bscLogin.conf if it does not exist, and store it in the default location:
C:\Windows
2.
Add the following code to your bscLogin.conf configuration file: com.businessobjects.security.jgss.initiate { com.ibm.security.auth.module.Krb5LoginModule required;
};
3.
Save and close the file.
To add a LoginModule to SAP NetWeaver
To use Kerberos and SAP NetWeaver 7.3, configure the system as if you were using the Tomcat web application server. You will not need to create a bscLogin.conf file.
Once this has been done, you need to add a LoginModule and update some Java settings on SAP
NetWeaver 7.3.
To map the com.sun.security.auth.module.Krb5LoginModule to the com.businessob
jects.security.jgss.initiate
, you need to manually add a LoginModule to NetWeaver.
1.
Open the NetWeaver Administrator by typing the following address into a web browser: http://<machine name>:<port>/nwa
.
2.
Click Configuration Management > Security > Authentication > Login Modules > Edit.
3.
Add a new login module with the following information:
Display Name
Class Name
Krb5LoginModule com.sun.security.auth.module.Krb5LoginModule
4.
Click Save.
NetWeaver creates the new module.
5.
Click Components > Edit.
6.
Add a new Policy called com.businessobjects.security.jgss.initiate.
7.
In the Authentication Stack, add the login module you created in Step 3, and set it to Required.
8.
Confirm that there are no other entries in the "Options for Selected Login Module". If there are, remove them.
2012-12-12
Authentication
265
9.
Click Save.
10.
Log out of the NetWeaver Administrator.
8.4.5.1.3 Modifying the application server Java settings to load configuration files
To modify the Java options for Kerberos on Tomcat
1.
From the Start menu, select Programs >Tomcat > Tomcat Configuration.
2.
Click the Java tab.
3.
Add the following options:
-Djava.security.auth.login.config=C:\XXXX\bscLogin.conf
-Djava.security.krb5.conf=C:\XXXX\krb5.ini
Replace XXXX with the location where you stored the bscLogin.conf file.
4.
Close the Tomcat configuration file.
5.
Restart Tomcat.
To modify the Java options for SAP NetWeaver 7.3
1.
Browse to the Java configuration tool (located at C:\usr\sap\<NetWeaver ID>\<in
stance>\j2ee\configtool\ by default) and double-click configtool.bat.
The configuration tool opens.
2.
Click View > Expert Mode.
3.
Expand Cluster-Data > Template.
4.
Select the Instance that corresponds to your NetWeaver server (for example Instance - <system
ID><machine name>
).
5.
Click VM Parameters.
6.
Select SAP from the Vendor list, and GLOBAL from the Platform list.
7.
Click System and add the following custom parameter information: java.security.krb5.conf
<path to the krb5.ini file including the file name>
javax.security.auth.useSubjectCredsOnly false
8.
Click Save, and then click Configuration Editor.
9.
Click Configurations > Security > Configurations > com.businessobjects.security.jgss.initiate
> Security > Authentication.
10.
Click Edit Mode.
11.
Right-click the Authentication node and select Create sub-node.
12.
Select Value-Entry from the top list.
13.
Enter the following:
2012-12-12
Authentication
266
Name
Value create_security_session false
14.
Click Create and then close the window.
15.
Click Config Tool and thenSave.
Once you have updated your configuration, you need to restart your NetWeaver server.
To modify the Java options for Kerberos on WebLogic
If you are using Kerberos with WebLogic, your Java options need to be modified to specify the location of the Kerberos configuration file and the Kerberos login module.
1.
Stop the WebLogic domain that runs your BI platform applications.
2.
Open the script that starts the domain of WebLogic that runs your BI platform applications
(startWeblogic.cmd for Windows, startWebLogic.sh for Unix).
3.
Add the following information to the Java_Options section of the file: set JAVA_OPTIONS=-Djava.security.auth.login.config=C:/XXXX/bscLogin.conf
-Djava.security.krb5.conf=C:/XXX/krb5.ini
Replace XXXX with the location you stored the file.
4.
Restart the domain of WebLogic that runs your BI platform applications.
To modify the Java options for Kerberos on Oracle Application Server
If you are using Kerberos with Oracle Application Server, the Java options need to be modified to specify the location of the Kerberos configuration file.
1.
Log onto the administration console of your Oracle Application Server.
2.
Click the name of the OC4J instance that runs your BI platform applications.
3.
Select Server Properties.
4.
Scroll down to the Multiple VM Configuration section.
5.
In the Command Line Options section, append the following at the end of the "Java Options" text field: -Djava.security.krb5.conf=C:/XXXX/krb5.ini replacing XXXX with the location where you stored the file.
6.
Restart your OC4J instance.
To modify the Java options for Kerberos on WebSphere
1.
Log into the administrative console for WebSphere.
For IBM WebSphere 5.1, type http://servername:9090/admin. For IBM WebSphere 6.0, type http://servername:9060/ibm/console
2.
Expand Server, click Application Servers, and then click the name of the application server you created to use with BI platform.
3.
Go to the "JVM" page.
2012-12-12
Authentication
267
If you are using WebSphere 5.1, follow these steps to get to the "JVM" page.
a.
On the server page, scroll down until you see Process Definition in the Additional Properties column.
b.
Click Process Definition.
c.
Scroll down and click Java Virtual Machine.
If you are using WebSphere 6.0, follow these steps to get to the "JVM" page.
a.
On the server page, select Java and Process Management.
b.
Select Process Definition.
c.
Select Java Virtual Machine.
4.
Click Generic JVM arguments then specify the location of your Krb5.ini and the location of your bscLogin.conf
file as shown below.
-Djava.security.auth.login.config=C:\XXXX\bscLogin.conf
-Djava.security.krb5.conf=C:\XXXX\krb5.ini
Replace XXXX with the location you stored the file.
5.
Click Apply, and then click Save.
6.
Stop and restart the server.
8.4.5.1.4 To verify that Java can receive a Kerberos ticket
Before testing if Java has received the Kerberos ticket, you must complete the following prerequisite actions:
• Create the bscLogin.conf file for your application server.
• Create the krb5.ini file.
1.
Go to the command prompt and navigate to the jdk\bin directory in your BI platform installation.
By default this is located in:C:\Program Files (x86)\SAP BusinessObjects\SAP
BusinessObjects Enterprise XI 4.0\win64_x64\jdk\bin
.
2.
Run kinit <username>.
3.
Press Enter.
4.
Type the password.
If the krb5.ini file was configured properly and the Java login module has been loaded, you should see the following message:
New ticket is stored in cache file
C:\Users\Administrator\krb5cc_Administrator
Do not continue with the AD setup until you have successfully received a Kerberos ticket.
If you cannot receive a ticket, consider the following options:
• Consult the troubleshooting section at the end of this chapter.
• For issues concerning the KDC, the Kerberos configuration files, and user credentials not available in the Kerberos database, refer to SAP Knowledge Base articles KBA 1476374 and KBA 1245178.
2012-12-12
Authentication
8.4.5.1.5 To configure BI launch pad for manual AD login
Before configuring your BI platform applications for manual AD login, the following prerequisite actions must be completed:
• You have created a service account on the domain controller for BI platform.
• You have verified that the HTTP service principal names (SPN) have been added to the service account.
• You have successfully mapped AD user groups into BI platform.
• You have tested AD credentials on the CCM.
• You have created, configured, and tested the required configuration files for your web application server.
• Your application server's Java settings have been modified to load the configuration files.
To enable the Windows AD authentication option for both BI launch pad, perform the following steps:
1.
Access the custom folder for the BOE web application on the machine hosting the web application server:
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\
.
Make your changes in the config\custom and not the config\default directory. Otherwise your changes will be overwritten when future patches will be applied to your deployment.
You will have to later redeploy the modified BOE web application.
2.
Create a new file.
Note:
Use Notepad or any other text-editing utility.
3.
Save the file as BIlaunchpad.properties.
4.
Type the following: authentication.visible=true authentication.default=secWinAD
5.
Save and close the file.
6.
Restart your web application server.
You should now be able to manually log into BI launch pad. Access either application and select Windows
AD from the list of authentication options.
Note:
Do not continue with your Windows AD setup until you can manually log into BI launch pad with an existing AD account.
The new properties will take effect only after the BOE web application is redeployed on the machine running the web application server. Use WDeploy to redeploy BOE on the web application server. For more information on using WDeploy to undeploy web applications, see the SAP BusinessObjects
Business Intelligence Platform Web Application Deployment Guide.
268 2012-12-12
Authentication
Note:
If your deployment uses a firewall, remember to open all the required ports; otherwise, the web applications will not be able to connect to the BI platform servers.
8.4.6 Single Sign-On Setup
8.4.6.1 SSO to the BI platform with AD authentication
Options for SSO using Windows AD
There are two supported methods for setting up single sign-on (SSO) for Windows AD authentication with BI platform:
• Vintela - this option can only be used with Kerberos.
• SiteMinder - this option can only be used with Kerberos.
SSO to the database
SSO to the database enables logged-on users to perform actions that require database access, in particular, viewing, and refreshing reports, without having to provide their logon credentials again. While constrained delegation is optional for AD authentication and Vintela SSO, it is required for deployment scenarios that involve single sign-on to the system database.
End-to-end SSO
In BI platform, end-to-end SSO is supported through Windows AD and Kerberos. In this scenario, users have both single sign-on access to BI platform at the front-end, and SSO access to the databases at the back-end. Thus, users need to provide their logon credentials only once, when they log on to the operating system, to have access to BI platform and to be able to perform actions that require database access, such as viewing reports.
Manual versus SSO AD authentication configuration
Once you have successfully configured your deployment to enable AD accounts to manually log into
BI launch pad, you need to revisit the AD authentication setup to enable specific SSO requirements.
Requirements will vary depending on your choice of SSO method.
8.4.6.2 Using Vintela SSO
269 2012-12-12
Authentication
270
8.4.6.2.1 Checklist for Vintela SSO setup
To set up BI platform to work with Vintela SSO, you need to complete the following tasks:
1.
Specifically configure your service account for Vintela SSO.
2.
Configure constrained delegation (optional).
3.
Configure the Windows AD SSO authentication options in the CMC.
4.
Configure the BOE general and BI launch pad-specific properties for Vintela SSO.
5.
If you are using Tomcat 6 as the web application server for your deployment, you need to increase the header size limit.
6.
Configure the internet browsers for Vintela.
8.4.6.2.2 To set up the service account for Vintela SSO
The Ktpass command-line tool configures the server principal name for the host or service in Active
Directory and generates a Kerberos "keytab" file containing the shared secret key of the service account.
This tool is usually found on domain controllers or it can be downloaded from the Microsoft support site: http://support.microsoft.com/kb/892777 .
You need a service account specifically configured to allow users in a given Windows AD group to automatically authenticate to BI launch pad with their AD credentials. You can reconfigure the service account created for AD Kerberos authentication on the domain controller.
When a client attempts log into BI launch pad, a request to the Kerberos ticket-generating server is initiated. To facilitate this request, the service account created for BI platform must have an SPN that matches the URL of the application server. Perform the following steps on the machine hosting the domain controller.
1.
Run the Kerberos keytab setup command ktpass to create and place a keytab file.
Specify the ktpass parameters listed in the following table:
Parame ter
-out
Description
-princ
Specifies the name of the Kerberos keytab file to generate.
Specifies the principal name used for the service account, in SPN format: MYSIAMY
SERVER/sbo.service.domain.com@DOMAIN.COM
, where MYSIAMYSERVER is the name of the Service Intelligence Agent as specified in the Central Configuration
Manager (CCM).
Note:
The name of your service account is case-sensitive. The SPN includes the name of the host computer on which the service instance is running.
Tip:
The SPN must be unique in the forest in which it is registered. To check, use the
Windows support tool Ldp.exe to search for the SPN.
-pass Specifies the password used by the service account.
2012-12-12
Authentication
Parame ter
Description
-ptype
-crypto
Specifies the principal type:
-ptype KRB5_NT_PRINCIPAL
Specifies the encryption type to use with the service account:
-crypto RC4-HMAC-NT
For example: ktpass -out keytab_filename.keytab -princ MYSIAMYSERVER/[email protected]
-pass password -kvno 255 -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT
The output from the ktpass command should confirm the target domain controller and that a
Kerberos keytab file containing the shared secret was created. The command also maps the principal name to the (local) service account.
2.
Right-click the service account, select Properties > Delegation.
3.
Click Trust this user for delegation to any service (Kerberos only).
4.
Click OK to save your settings.
The service account now has all the required service principal names for Vintela SSO and you have generated a keytab file with the encrypted password for the service account.
To configure constrained delegation for Vintela SSO
Constrained delegation is optional for setting up Vintela SSO. It is, however, mandatory for deployments that require SSO to the system database.
1.
On the AD domain controller machine, open the Active Directory "Users and Computers" snap-in.
2.
Right-click the service account you created in the previous section, and click Properties >
Delegation.
3.
Select Trust this user for delegation to the specified services only.
4.
Select Use Kerberos only.
5.
Click Add > Users or Computers.
6.
Type the service account name and click OK.
A list of services is displayed.
7.
Select the following services and then click OK.
• The HTTP service
• The service used to run the Service Intelligence Agent (SIA) on the machine hosting BI platform.
The services are added to the list of services that can be delegated for the service account.
You will need to modify the web application properties to account for this modification.
271 2012-12-12
Authentication
8.4.6.2.3 To configure SSO settings in the CMC
1.
Go to the "Authentication" management area of the CMC.
2.
Double-click Windows AD.
3.
Ensure the Enable Windows Active Directory (AD) check box is selected.
4.
If your configuration requires SSO to the database, select Cache security context.
5.
Select Enable single sign-on for selected authentication mode.
6.
Click Update.
8.4.6.2.4 To enable Vintela single sign-on for BI launch pad and OpenDocument
This procedure is used for either BI launch pad or OpenDocument. To enable SSO to the BI platform web applications, you need to specify Vintela and SSO-specific properties in the BOE.war file. For SSO setup purposes, it is recommended that your concentrate on enabling SSO to BI launch pad for AD accounts before handling other applications.
1.
Access the custom folder for the BOE web application on the machine hosting the web application server:
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\
. Make your changes in the con fig\custom and not the config\default directory. Otherwise your changes will be overwritten when future patches will be applied to your deployment.
You will have to later redeploy the modified BOE web application.
2.
Create a new file.
Note:
Use Notepad or any other text-editing utility.
3.
Enter the following: sso.enabled=true siteminder.enabled=false vintela.enabled=true idm.realm=DOMAIN.COM
idm.princ=MYSIAMYSERVER/[email protected]
idm.allowUnsecured=true idm.allowNTLM=false idm.logger.name=simple idm.keytab=C:/WIN/filename.keytab
idm.logger.props=error-log.properties
Note:
The idm.realm and idm.princ parameters require valid values. The idm.realm should be the same value you set when you configured the default_realm in your krb5.ini file. The value must be in upper case. The idm.princ parameter is the SPN used to for the service account created for Vintela
SSO. Forward slashes are required when specifying the keytab file location. Using back slashes will break SSO.
Skip the following step if you do not want to use constrained delegation for Windows AD authentication and Vintela SSO.
272 2012-12-12
Authentication
273
4.
To use constrained delegation, add: idm.allowS4U=true
5.
Close the file and save it with a global.properties name:
Note:
Make sure the file name is not saved under any extensions such as .txt.
6.
Create another file in the same directory. Save the file as OpenDocument.properties or BI launchpad.properties
depending on your requirements.
7.
Type the following: authentication.default=secWinAD cms.default=[enter your cms name]:[Enter the CMS port number]
For example: authentication.default=secWinAD cms.default=mycms:6400
8.
Save and close the file.
9.
Restart your web application server.
The new properties will take effect only after the BOE web application is redeployed on the machine running the web application server. Use WDeploy to redeploy BOE on the web application server. For more information on using WDeploy to undeploy web applications, see the SAP BusinessObjects
Business Intelligence Platform Web Application Deployment Guide.
Note:
If your deployment is using a firewall, remember to open all the required ports otherwise the web applications will not be able to connect to the BI platform servers.
8.4.6.2.5 To increase the header size limit for Tomcat
Active Directory creates a Kerberos token which is used in the authentication process. This token is stored in the HTTP header. Your Java application server will have a default HTTP header size. To avoid failures, ensure that it has a minimum default size of 16384 bytes. (Some deployments may require a larger size. For more information, see Microsoft's sizing guidelines on their support site
(http://support.microsoft.com/kb/327825).)
1.
On the server with Tomcat installed, open the server.xml file.
On Windows, this file is located at <TomcatINSTALLDIR>/conf
• If you are using the version of Tomcat installed with BI platform on Windows, and you did not modify the default installation location, replace <TomcatINSTALLDIR> with C:\Program Files (x86)\SAP
BusinessObjects\Tomcat6\
• If you are using any other supported web application server, consult the documentation for your web application server to determine the appropriate path.
2.
Find the corresponding <Connector …> tag for the port number you have configured.
If you are using the default port of 8080, find the <Connector …> tag with port=“8080” in it.
2012-12-12
Authentication
274
For example:
<Connector URIEncoding="UTF-8" acceptCount="100" connectionTimeout="20000" debug="0" disableUploadTimeout="true" enableLookups="false" maxSpareThreads="75" maxThreads="150" minSpareThreads="25" port="8080" redirectPort="8443"
/>
3.
Add the following value within the <Connector …> tag: maxHttpHeaderSize="16384"
For example:
<Connector URIEncoding="UTF-8" acceptCount="100" connectionTimeout="20000" debug="0" disableUploadTimeout="true" enableLookups="false" maxSpareThreads="75" maxThreads="150" maxHttpHeaderSize="16384" minSpareThreads="25" port="8080" redirectPort="8443" />
4.
Save and close the server.xml file.
5.
Restart Tomcat.
Note:
For other Java application servers, consult your Java application server’s documentation.
8.4.6.2.6 Configuring Internet browsers
To support Vintela SSO for AD Kerberos authentication, you must configure BI platform clients. This involves configuring the Internet Explorer (IE) browser on the client machines.
To configure Internet Explorer on the client machines
1.
On the client machine, open an IE browser.
2.
Enable integrated Windows authentication.
a.
On the Tools menu, click Internet Options.
b.
Click the Advanced tab.
c.
Scroll to Security, select Enable Integrated Windows Authentication, and then click Apply.
3.
Add the Java Application machine or the URL to the trusted sites. You can enter the full domain name of the site.
a.
On the Tools menu, click Internet Options.
b.
Click the Security tab.
c.
Click Sites and then click Advanced. d.
Select or enter the site and click Add. e.
Click OK until the Internet Options dialog box closes.
4.
Close and reopen the Internet Explorer browser window for these changes to take effect.
5.
Repeat all of these steps on each BI platform client machine.
To configure Firefox on the client machines
1.
Modify network.negotiate-auth.delegation-uris
2012-12-12
Authentication a.
On the client machine, open a Firefox browser.
b.
Type about:config in the URL address field.
A list of configurable properties appears.
c.
Double-click network.negotiate-auth.delegation-uris to edit the property.
d.
Enter the URL that you will use to access BI launch pad.
For example if your BI launch pad URL is http://machine.domain.com:8080/BOE/BI, then you need to enter http://machine.domain.com.
Note:
To add more than one URL, separate them with a comma. For example: http://machine.do
main.com
,machine2.domain.com.
e.
Click OK.
2.
Modify network.negotiate-auth.trusted-uris
a.
On the client machine, open a Firefox browser.
b.
Type about:config in the URL address field.
A list of configurable properties appears.
c.
Double-click network.negotiate-auth.trusted-uris to edit the property.
d.
Enter the URL that you will use to access BI launch pad. .
For example if your BI launch pad URL is http://machine.domain.com:8080/BOE/BI, then you will need to enter http://machine.domain.com
Note:
To add more than one URL, separate them with a comma. For example: http://machine.do
main.com
,machine2.domain.com.
e.
Click OK.
3.
Close and reopen the Firefox browser window for these changes to take effect.
4.
Repeat all of these steps on each BI platform client machine.
8.4.6.2.7 Testing Vintela SSO for AD Kerberos authentication
You should test your SSO setup from a client workstation. Make sure that the client is on the same domain as your BI platform deployment, and that you are logged into the workstation as a mapped AD user. This user account must be able to manually log into BI launch pad.
To test SSO, open a browser and enter the URL for BI launch pad. If SSO is properly configured, you should not be prompted for your logon credentials.
Tip:
It is recommended that you test various AD user scenarios in your deployment. For example, if your environment will have users from multiple operating systems, you should test SSO for users from each operating system. You should also test SSO against all the possible browsers supported in your organization. If your environment will have users from multiple forests or domains, you should test SSO for a user account from each domain or forest.
275 2012-12-12
Authentication
276
8.4.6.2.8 Configuring Kerberos and single sign-on to the database for application servers
Single sign-on to the database is supported for deployments that meet all these requirements:
• The deployment of BI platform is on a web application server.
• The web application server has been configured for Vintela SSO for AD authentication.
• The database to which SSO is required is a supported version of SQL Server or Oracle.
• The groups or users that need access to the database must have been granted permissions within
SQL Server or Oracle. .
The final step is to modify the krb5.ini file to support SSO to the database for web applications.
To enable single sign-on to the database for Java application servers
1.
Open the krb5.ini file that is being used for your deployment of BI platform.
The default location for this file is the WIN directory on your web application server.
Note:
If you cannot find the file in the WIN directory, check this Java argument for the location of the file:
-Djava.security.auth.login.config
This variable is specified when AD with Kerberos is configured on your web application server.
2.
Go to the [libdefaults] section of the file.
3.
Enter this string prior to the start of the [realms] section of the file: forwardable=true
4.
Save and close the file.
5.
Restart your web application server.
Single sign-on to the database will not be enabled until you check the Cache security context (required
for SSO to database) box in the Windows AD authentication page in the CMC.
8.4.6.3 Using SiteMinder
8.4.6.3.1 Using Windows AD with SiteMinder
This section explains how to use AD and SiteMinder. SiteMinder is a third-party user access and authentication tool that you can use with the AD security plug-in to create single sign-on to BI platform.
You can use SiteMinder with Kerberos.
Ensure your SiteMinder identity management resources are installed and configured before configuring
Windows AD authentication to work with SiteMinder. For more information about SiteMinder and how to install it, refer to your SiteMinder documentation.
2012-12-12
Authentication
277
There are two tasks you must complete to enable AD single sign-on with SiteMinder:
• Configure the AD plug-in for single sign-on with SiteMinder
• Configure SiteMinder properties for the BOE web application
Note:
Ensure that the SiteMinder Administrator has enabled support for 4.x Agents. This must be done regardless of which supported version of SiteMinder you are using. For more information about SiteMinder configuration, refer to your SiteMinder documentation.
To enable SiteMinder properties for BI launch pad
In addition to specifying SiteMinder settings for the Windows AD security plugin, SiteMinder settings must be specified for the BOE war properties.
1.
Locate the <INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\ directory in your BI platform installation.
2.
Create a new file in the directory, using Notepad or another text-editing utility.
3.
In the new file, enter the following values: sso.enabled=true siteminder.authentication=secWinAD siteminder.enabled=true
4.
Save the file with the name global.properties.
Note:
Make sure the file name is not saved with an extension, such as .txt.
5.
Create another file in the same directory.
6.
In the new file, enter the following values: authentication.default=secWinAD cms.default=[cms name]:[CMS port number]
For example: authentication.default=LDAP cms.default=mycms:6400
7.
Save the file with the name BIlaunchpad.properties, and close the file.
The new properties take effect after BOE.war is redeployed on the computer running the web application server. Use WDeploy to redeploy the WAR file on the web application server. For more information on using WDeploy to undeploy web applications, see the SAP BusinessObjects Business Intelligence
Platform Web Application Deployment Guide.
To configure SiteMinder settings in the CMC
Before configuring the CMC for SiteMinder, you must complete the following prerequisite actions:
• You have successfully mapped AD user groups into BI platform.
• You have tested AD credentials on the CCM.
2012-12-12
Authentication
1.
Go to the "Authentication" management area of the CMC.
2.
Double-click Windows AD.
3.
Select the Enable Windows Active Directory (AD) check box.
4.
If you selected Use Kerberos authentication: a.
If you want to configure single sign-on to a database, select Cache security context.
b.
Delete any information in the Service principal name box.
5.
If you want to configure single sign-on, select Enable Single Sign On for selected authentication
mode.
You must also configure BOE web application general properties and BI launch pad properties to enable single sign-on.
6.
In the "Synchronization of Credentials" area, select an option to enable and update the AD user's data source credentials at logon.
This option synchronizes the data source with the user's current logon credentials.
7.
In the "SiteMinder Options" area, configure SiteMinder as your single sign-on option for AD authentication using Kerberos: a.
Click Disabled.
The "Windows Active Directory" page appears.
If you have not configured the Windows AD plug-in, a warning appears, asking if you want to continue. Click OK.
b.
Click Use SiteMinder Single Sign On.
c.
In the Policy Server Host box, type the name of each policy server, and click Add.
d.
For each policy server host, enter a port number in the Accounting, Authentication, and
Authorization boxes.
e.
In the Agent Name box, enter the agent name.
f.
In the Shared Secret boxes, enter the shared secret.
Ensure that the SiteMinder Administrator has enabled support for 4.x Agents, regardless of which supported version of SiteMinder you use. For information about SiteMinder and how to install it, see the SiteMinder documentation.
g.
Click Update to save and return to the main AD authentication page.
8.
In the "AD Alias Options" area, specify how new aliases are added to and updated in BI platform.
a.
In the "New Alias Options" area, select an option for mapping new aliases to Enterprise accounts:
•
Assign each new AD alias to an existing User Account with the same name
Select this option when you know users have an existing Enterprise account with the same name; that is, AD aliases will be assigned to existing users (auto alias creation is turned on).
Users who do not have an existing Enterprise account, or who do not have the same name in their Enterprise and AD account, are added as new users.
•
Create a new user account for each new AD alias
Select this option when you want to create a new account for each user.
278 2012-12-12
Authentication
279 b.
In the "Alias Update Options" area, select an option for managing alias updates for the Enterprise accounts:
•
Create new aliases when the Alias Update occurs
Select this option to automatically create a new alias for each AD user mapped to BI platform.
New AD accounts are added for users without BI platform accounts, or for all users if you selected Create a new user account for each new AD alias and clicked Update.
•
Create new aliases only when the user logs on
Select this option when the AD directory you are mapping contains many users, but only a few of them will use BI platform. The platform does not automatically create aliases and
Enterprise accounts for all users. Instead, it creates aliases (and accounts, if required) only for users who log on to BI platform.
c.
In the "New User Options" area, select an option for creating new users:
•
New users are created as named users
New user accounts are configured to use named user licenses. Named user licenses are associated with specific users and allow people to access the system based on a user name and password. This provides named users with access to the system, regardless of how many people are connected. You must have a named user license available for each user account created using this option.
•
New users are created as concurrent users
New user accounts are configured to use concurrent user licenses. Concurrent licenses specify the number of people who can connect to BI platform at the same time. This type of licensing is very flexible because a small concurrent license can support a large user base. For example, depending on how often and how long users access the system, a 100-user concurrent license could support 250, 500, or 700 users.
9.
To configure how to schedule AD alias updates, click Schedule.
a.
In the "Schedule" dialog box, select a recurrence from the Run object list.
b.
Set other schedule options and parameters as required.
c.
Click Schedule.
When the alias update occurs, the group information is also updated.
10.
In the "Attribute Binding Options" area, specify the attribute binding priority for the AD plugin: a.
Select the Import Full Name, Email Address and other attributes check box.
The full names and descriptions used in AD accounts are imported and stored with user objects in BI platform.
b.
Specify an option for Set priority of AD attribute binding relative to other attributes binding.
If the option is set to 1, AD attributes take priority when AD and other plugins (LDAP and SAP) are enabled. If the option is set to 3, attributes from other enabled plugins take priority.
11.
In the "AD Group Options" area, configure AD group updates: a.
Click Schedule.
The "Schedule" dialog box appears.
2012-12-12
Authentication b.
Select a recurrence from the Run object list.
c.
Set other schedule options and parameters as required.
d.
Click Schedule.
The system schedules the update and runs it according to the schedule you specified. The next scheduled update for the AD group accounts is displayed under the "AD Group Options".
12.
In the "On-Demand AD Update" area, select an option to indicate whether to update AD groups or users (or neither) when you click Update:
•
Update AD Groups now
Select this option if you want to start updating all scheduled AD groups when you click Update.
The next scheduled AD group update is listed under "AD Group Options".
•
Update AD Groups and Aliases now
Select this option if you want to start updating all scheduled AD groups and user aliases when you click Update. The next scheduled updates are listed under "AD Group Options" and "AD
Alias Options".
•
Do not update AD Groups and Aliases now
No AD groups or user aliases will be updated when you click Update.
13.
Click Update, and click OK.
To disable SiteMinder
If you want to prevent SiteMinder from being configured, or to disable it after it has been configured in the CMC, modify the web configuration file for BI launch pad.
To disable SiteMinder for Java clients
In addition to disabling SiteMinder settings for the Windows AD security plugin, SiteMinder settings must be disabled for the BOE war file on your web application server.
1.
Go to the following directory in your BI platform installation:
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\
2.
Open the global.properties file.
3.
Change siteminder.enabled to false siteminder.enabled=false
4.
Save your changes and close the file.
The change takes effect only after BOE.war is redeployed on the machine running the web application server. Use WDeploy to redeploy the WAR file on the web application server. For more information on using WDeploy to undeploy web applications, see the SAP BusinessObjects Business Intelligence
Platform Web Application Deployment Guide.
280 2012-12-12
Authentication
8.4.7 Troubleshooting Windows AD authentication
281
8.4.7.1 Troubleshooting your configuration
These steps may help you if you encounter problems when configuring Kerberos:
• Enabling logging
• Testing your Java SDK Kerberos configuration
8.4.7.1.1 To enable logging
1.
From the Start menu, select Programs >Tomcat > Tomcat Configuration
2.
Click the Java tab.
3.
Add the following options:
-Dcrystal.enterprise.trace.configuration=verbose
-sun.security.krb5.debug=true
This will create a log file in the following location:
C:\Documents and Settings\<user name>\.businessobjects\jce_verbose.log
8.4.7.1.2 To test your Kerberos configuration
• Run the following command to test your Kerberos configuration, where servant is the service account and domain under which the CMS is running, and password is the password associated with the service account.
<InstallDirectory>\SAP BusinessObjects Enterprise XI 4.0\win64_64\jdk\bin\[email protected] Password
For example:
C:\Program Files\SAP BusinessObjects\
SAP Business Objects Enterprise XI 4.0\win64_64\jdk\bin\ [email protected] Password
Your domain and service principal name must exactly match the domain and service principal name in the Active Directory. If the problem persists, check whether you entered the same name; note that the name is case-sensitive.
8.4.7.1.3 Logon failure due to different AD UPN and SAM names
A user's Active Directory ID has successfully been mapped to BI platform. Despite this fact, they are unable to successfully log onto the CMC or BI launch pad with Windows AD authentication and Kerberos in the following format: DOMAIN\ABC123
2012-12-12
Authentication
This problem can happen when the user is set up in Active Directory with a UPN and SAM name that are not exactly the same. The following examples may cause a problem:
• The UPN is [email protected] but the SAM name is DOMAIN\ABC123.
• The UPN is jsmith@company but the SAM name is DOMAIN\johnsmith.
There are two ways to address this problem:
• Have users log in using the UPN name rather than the SAM name.
• Ensure the SAM account name and the UPN name are the same.
8.4.7.1.4 Pre-authentication error
A user who has previously been able to log on, can no longer log on successfully. The user will receive this error: Account Information Not Recognized. The Tomcat error logs reveal the following error: "Preauthentication information was invalid (24)"
This can occur because the Kerberos user database didn't get a change made to UPN in AD. This may mean that the Kerberos user database and the AD information are out of sync.
To resolve this problem, reset the user's password in AD. This will ensure the changes are propagated correctly.
Note:
This problem is not an issue with J2SE 5.0.
8.5 SAP authentication
8.5.1 Configuring SAP authentication
This section explains how to configure BI platform authentication for your SAP environment.
SAP authentication enables SAP users to log onto BI platform using their SAP user names and passwords, without storing these passwords in BI platform. SAP authentication also allows you to preserve information about user roles in SAP, and to use this role information within the platform to assign rights to perform administrative tasks, or access content.
Accessing the SAP authentication application
You must provide BI platform with information about your SAP system. A dedicated web application is accessible through the main BI platform administration tool, the Central Management Console (CMC).
To access it from the home page of the CMC, click Authentication.
282 2012-12-12
Authentication
Authenticating SAP users
Security plug-ins expand and customize the ways in which BI platform authenticates users. The SAP
Authentication feature includes an SAP security plug-in (secSAPR3.dll) for the Central Management
Server (CMS) component of BI platform. This SAP security plug-in offers several key benefits:
• It acts as an authentication provider that verifies user credentials against your SAP system on behalf of the CMS. When users log on to BI platform directly, they can choose SAP Authentication and provide their usual SAP user name and password. BI platform can also validate Enterprise Portal logon tickets against SAP systems.
• It facilitates account creation by allowing you to map roles from SAP to BI platform user groups, and it facilitates account management by allowing you to assign rights to users and groups in a consistent manner within BI platform.
• It dynamically maintains SAP role listings. So, once you map an SAP role to the platform, all users who belong to that role can log on to the system. When you make subsequent changes to the SAP role membership, you need not update or refresh the listing in BI platform.
• The SAP Authentication component includes a web application for configuring the plug-in. You can access this application in the "Authentication" area of the Central Management Console (CMC).
8.5.2 Creating a user account for BI platform
The BI platform system requires an SAP user account that is authorized to access SAP role membership lists and authenticate SAP. You will need the account credentials to connect the BI platform to your
SAP system. For general instruction on creating SAP user accounts and assigning authorizations through roles, see your SAP BW documentation.
Use transaction SU01 to create a new SAP user account named CRYSTAL. Use transaction PFCG to create a new role named CRYSTAL_ENTITLEMENT. (These names are recommended but not required.)
Change the new role's authorization by setting values for the following authorization objects:
Authorization object Field Value
Authorization for file access
(S_DATASET)
Activity (ACTVT)
ABAP program name (PRO-
GRAM)
Read, Write (33, 34)
Physical file name (FILENAME) * (denotes All)
*
283 2012-12-12
Authentication
Authorization object Field
Activity (ACTVT)
Value
16
Authorization Check for RFC
Access (S_RFC)
Name of RFC to be protected
(RFC_NAME)
BDCH, STPA, SUSO, BDL5,
SUUS, SU_USER, SYST, SUNI,
RFC1, SDIFRUNTIME,
PRGN_J2EE, /CRYSTAL/SECU-
RITY
User Master Maintenance: User
Groups (S_USER_GRP)
Type of RFC object to be protected (RFC_TYPE)
Function group (FUGR)
Activity (ACTVT)
Create or Generate, and Display
(03)
User group in user master maintenance (CLASS)
*
Note:
For greater security, you may prefer to explicitly list the user groups whose members require access to BI platform.
Finally, add the CRYSTAL user to the CRYSTAL_ENTITLEMENT role.
Tip:
If your system policies require users to change their passwords when they first log onto the system, log on now with the CRYSTAL user account and reset its password.
8.5.3 Connecting to SAP entitlement systems
Before you can import roles or publish BW content to the BI platform, you must provide information about the SAP entitlement systems to which you want to integrate. BI platform uses this information to connect to the target SAP system when it determines role memberships and authenticates SAP users.
284 2012-12-12
Authentication
285
8.5.3.1 To add an SAP entitlement system
1.
Go to the "Authentication" management area of the CMC.
2.
Double-click the SAP link.
The entitlement systems settings appear.
Tip:
If an entitlement system is already displayed in the Logical system name list, click New.
3.
In the System field, type the three-character System ID (SID) of your SAP system.
4.
In the Client field, type the client number that BI platform must use when it logs on to your SAP system.
BI platform combines your System and Client information, and adds an entry to the Logical system
name list.
5.
Ensure the Disabled check box is clear.
Note:
Use the Disabled check box to indicate to BI platform that a particular SAP system is temporarily unavailable.
6.
Complete the Message Server and Logon Group fields as appropriate, if you have set up load balancing such that BI platform must log on through a message server.
Note:
You must make the appropriate entries in the Services file on your BI platform machine to enable load balancing - especially if your deployment not on a single machine. Specifically you should account for the machines hosting the CMS, the Web application server, as well as all machines managing your authentication accounts and settings.
7.
If you have not set up load balancing (or if you prefer to have BI platform log on directly to the SAP system), complete the Application Server and System Number fields as appropriate.
8.
In the User name, Password, and Language fields, type the user name, password, and language code for the SAP account that you want BI platform to use when it logs on to SAP.
Note:
These credentials must correspond to the user account that you created for BI platform.
9.
Click Update.
If you add multiple entitlement systems, click the Options tab to specify the system that BI platform uses as the default (that is, the system that is contacted to authenticate users who attempt to log on with SAP credentials but without specifying a particular SAP system).
Related Topics
•
Creating a user account for BI platform
2012-12-12
Authentication
8.5.3.2 To verify if your entitlement system was added correctly
1.
Click the Role Import tab.
2.
Select the name of the entitlement system from the Logical system name list.
If the entitlement system was added correctly, the Available roles list will contain a list of roles that you can choose to import.
Tip:
If no roles are visible in the Logical system name list, look for error messages on the page. These may give you the information you need to correct the problem.
8.5.3.3 To temporarily disable a connection to an SAP entitlement system
In the CMC, you can temporarily disable a connection between BI platform and an SAP entitlement system. This may be useful to maintain the responsiveness of the BI platform in cases such as the scheduled down time of an SAP entitlement system.
1.
In the CMC, go to the Authentication management area.
2.
Double-click the SAP link.
3.
In the Logical system name list, select the system you want to disable.
4.
Select the Disabled check box.
5.
Click Update.
8.5.4 Setting SAP Authentication options
SAP Authentication includes a number of options that you can specify when integrating BI platform with your SAP system. The options include:
• Enabling or disabling SAP authentication
• Specifying connection settings
• Linking imported users to BI platform license models.
• Configuring single sign-on to the SAP system
286 2012-12-12
Authentication
8.5.4.1 To set SAP Authentication options
1.
In the "Authentication" management area of the CMC, double-click the SAP link, and click the
Options tab.
2.
Review and modify settings as required:
287 2012-12-12
Authentication
Setting
Enable SAP Authentication
Content folder root
Default system
Max. number of failed attempts to access entitlement system
Description
Clear this check box if you want to disable SAP
Authentication completely. (To disable SAP Authentication for a specific SAP System, select that system's Disabled check box on the Entitlement
Systems tab.)
Specify where you want BI platform to begin replicating the BW folder structure in the CMC and BI Launch Pad. The default is /SAP/2.0 but you can change it to a different folder. To change this value, you must change it both in the CMC and the Content Administration Workbench.
Select the SAP entitlement system that BI platform uses as the default (that is, the system that is contacted to authenticate users who attempt to log on with SAP credentials but without specifying a particular SAP system).
Note:
If you designate a default system, users from that system do not have to enter their System ID and client when they connect from client tools like
Live Office or Universe Designer using SAP authentication. For example, if SYS~100 is set as the default system, SYS~100/user1 would be able to log on as user1 when SAP authentication is chosen.
Type the number of times that the platform should re-attempt contacting an SAP system to fulfill authentication requests. Setting the value to -1 allows BI platform to attempt to contact the entitlement system an unlimited number of times.
Setting the value to 0 limits BI platform to making one attempt to contact the entitlement system.
Note:
Use this setting together with Keep entitlement
system disabled [seconds] to configure how BI platform handles SAP entitlement systems that are temporarily unavailable. The system uses these settings to determine when to stop communicating with an SAP system that is unavailable, and when it should resume communication with that system.
288 2012-12-12
Authentication
Setting Description
Keep entitlement system disabled [seconds]
Type the number of seconds that BI platform should wait before resuming attempts to authenticate users against the SAP system. For example, if you specify 3 for Max failed entitlement
system accesses, BI platform allows a maximum of three failed attempts to authenticate users against any particular SAP system. The fourth failed attempt results in the system ceasing its attempts to authenticate users against that system for the amount of time specified.
Max. concurrent connections per system
Number of uses per connection
Specify how many connections you want to keep open to your SAP system at the same time. For example, if you type 2 in this field, BI platform keeps two separate connections open to SAP.
Specify how many operations you want to allow to the SAP system per connection. For example, if you specify 2 for Max concurrent connections
per system and 3 for Number of uses per
connection, once there has been 3 logons on one connection, BI platform will close that connection and restart it.
289 2012-12-12
Authentication
Setting
Concurrent users and Named Users
Description
Specify whether new user accounts are configured to use concurrent user licenses or named user licenses. Concurrent licenses specify the number of people who can connect to BI platform at the same time. This type of licensing is very flexible because a small number of concurrent licenses can support a large user base. For example, depending on how often and how long users access the system, a 100 user concurrent license could support 250, 500, or 700 users. Named user licenses are associated with specific users and allow people to access the system based on their user name and password. This provides named users with access to the system regardless of how many other people are connected.
Note:
The option you select here does not change the number or type of user licenses that you have installed in BI platform. You must have the appropriate licenses available on your system.
Import Full Name, Email Address and other attributes
Select to specify a priority level for the SAP authentication plugin. The full names and descriptions used in the SAP accounts are imported and stored with user objects in BI platform.
Set priority of SAP attribute binding relative
to other attributes binding.
Specifies a priority for binding SAP user attributes
(full name and email address). If the option is set to 1, SAP attributes take priority in scenarios where SAP and other plugins (Windows AD and
LDAP) are enabled. If the option is set to 3, attributes from other enabled plugins will take priority.
Use the following options to configure the SAP single sign-on service:
290 2012-12-12
Authentication
Setting
System ID
Browse
Description
The system identifier provided by BI platform to the SAP system when performing the SAP single sign-on service.
Use this button to upload the key store file generated to enable the SAP single sign-on. You can also manually enter the full path to the file in the field provided.
Provide the password required to access the key store file.
Key Store Password
Private Key Password
Private Key Alias
Provide the password required to access the certificate corresponding to the key store file. The certificate is stored on the SAP system
Provide the alias required to access the key store file.
3.
Click Update.
Related Topics
•
Configuring SAP authentication
8.5.4.2 To change the Content folder root
1.
Go to the "Authentication" management area of the CMC.
2.
Double-click the SAP link.
3.
Click Options and type the name of the folder in Content folder root field.
The folder name that you type here is the folder that you want BI platform to begin replicating the
BW folder structure from.
4.
Click Update.
5.
In the BW Content Administration Workbench, expand Enterprise system.
6.
Expand Available systems and double-click the system that BI platform is connecting to.
7.
Click the Layout tab and in the Content base folder, type the folder that you want to use as the root SAP folder in BI platform (for example, /SAP/2.0/).
8.5.5 Importing SAP roles
291 2012-12-12
Authentication
By importing SAP roles into BI platform, you allow role members to log onto the system with their usual
SAP credentials. In addition, single sign-on is enabled so that SAP users are logged on to BI platform automatically when they access reports from within the SAP GUI or an SAP Enterprise Portal.
Note:
There are often many requirements for enabling SSO. Some of these might include using a driver and application that are SSO-capable, and ensuring your server and web server are in the same domain.
For each role that you import, BI platform generates a group. Each group is named with the following convention: SystemID~ClientNumber@NameOfRole. You can view the new groups in the "Users and Groups" management area of the CMC. You can also use these groups to define object security within BI platform.
Consider three main categories of users when configuring BI platform for publishing, and when importing roles to the system:
• BI platform administrators
Enterprise administrators configure the system for publishing content from SAP. They import the appropriate roles, create necessary folders, and assign rights to those roles and folders in BI platform.
• Content publishers
Content publishers are those users who have rights to publish content into roles. The purpose of this category of user is to separate regular role members from those users with rights to publish reports.
• Role members
Role members are users who belong to “content bearing” roles. That is, these users belong to roles to which reports are published. They have View, View on Demand, and Schedule rights for any reports published to the roles they are members of. However, regular role members cannot publish new content, nor can they publish updated versions of content.
You must import all content publishing and all content bearing roles to BI platform prior to publishing for the first time.
Note:
It is strongly recommended that you keep the activities of roles distinct. For example, while it is possible to publish from an administrator role, it is better practice to publish only from content publisher roles.
Additionally, the function of content publishing roles is only to define which users can publish content.
Thus, content publishing roles should not contain any content; content publishers should publish to content bearing roles that are accessible to regular role members.
Related Topics
•
How rights work in BI platform
•
Managing security settings for objects in the CMC
292 2012-12-12
Authentication
293
8.5.5.1 To import SAP roles
1.
In the "Authentication" management area of the CMC, double-click the SAP link.
2.
On the Options tab, select either Concurrent users or Named users depending on your license agreement.
Note that the option you select here does not change the number or type of user licenses that you have installed in BI platform. You must have the appropriate licenses available on your system.
3.
Click Update.
4.
On the Role Import tab, select the entitlement system in the Logical system name list.
5.
Under "Available roles", select the role(s) you want to import, and click Add.
6.
Click Update.
8.5.5.2 To verify that roles and users were imported correctly
1.
Ensure that you know the user name and password of an SAP user who belongs to one of the roles that you just mapped to BI platform.
2.
For Java BI launch pad, go to http://webserver:portnumber/BOE/BI.
Replace webserver with the name of the web server and portnumber with the port number that is set up for BI platform. You may need to ask your administrator for the name of the web server, the port number, or the exact URL to enter.
3.
In the Authentication Type list, select SAP.
Note:
By default, the Authentication Type list is hidden in BI launch pad. The administrator must enable it in the BIlaunchpad.properties file and restart the web application server.
4.
Enter the SAP system and the system client to log on to.
5.
Enter the user name and the password of a mapped user.
6.
Click Log On.
You are logged on to BI launch pad as the selected user.
8.5.5.3 Updating SAP roles and users
2012-12-12
Authentication
After enabling SAP authentication, it is necessary to schedule and run regular updates on mapped roles that have been imported into BI platform. This will ensure that your SAP role information is accurately reflected in the platform.
There are two options for running and scheduling updates for SAP roles:
• Update roles only: using this option will only update the links between the currently mapped roles that have been imported in BI platform. It is recommended that you use this option if you expect to run frequent updates, and you have concerns over system resource usage. No new user accounts will be created if you only update SAP roles.
• Update roles and aliases: this option not only updates links between roles but will also create new user accounts in BI platform for user aliases added to roles in the SAP system.
Note:
If you have not specified to automatically create user aliases for updates when you enabled SAP authentication, no accounts will be created for new aliases.
8.5.5.3.1 To schedule updates for SAP roles
Once you have mapped roles into BI platform you need specify how the system updates these roles.
1.
Click the User Update tab.
2.
Click Schedule in the "Update Roles Only" area or the "Update Roles and Aliases" area.
Tip:
To immediately run an update, click Update Now.
Tip:
Select "Update Roles Only" if you want frequent updates or have concerns about system resources.
It takes the system longer to update both roles and aliases.
The "Recurrence" dialog box appears.
3.
Select an option in the Run Object list, and enter scheduling information as needed.
The following recurrence patterns are available:
Recurrence pattern Description
Hourly
Daily
Weekly
Monthly
The update will be run every hour. You specify at what time it will start, as well as a start and end date.
The update will be run every day or run every number of specified days. You can specify at what time it will run, as well as a start and end date.
The update will be run every week. It can be run once a week or several times a week. You can specify on which days and at what time it will run, as well as and a start and end date.
The update will be run every month or every several months.
You can what time it will run, as well as a start and end date.
294 2012-12-12
Authentication
Recurrence pattern
Nth Day of Month
1st Monday of Month
Last Day of Month
X Day of Nth Week of the
Month
Calendar
Description
The update will run on a specific day in the month. You can specify on which day of the month, what time it will run, as well as a start and end date.
The update will run on the first Monday of each month. You can specify what time it will run, as well as and a start and end date.
The update will run on the last day of each month. You can specify what time it will run, as well as and a start and end date.
The update will run on a specified day of a specified week of the month. You can specify what time it will run, as well as and a start and end date.
The update will be run on the dates specified in a calendar that has previously been created.
4.
Click Schedule.
The date of the next scheduled role update appears on the User Update tab.
Note:
You can cancel the next scheduled update by clicking Cancel Scheduled Updates in the "Update
Roles Only" area or the "Update Roles and Aliases" area.
8.5.6 Configuring Secure Network Communication (SNC)
This section describes how to configure SNC as part of the process of setting up SAP authentication to BI platform
Before setting up trust between the SAP and BI platform systems, you must ensure the SIA is configured to start and run under an account that has been set up for SNC. You must also configure your SAP system to trust BI platform. It is recommended that you follow the instructions covered in the
Configuring
SAP server-side trust section in the Supplementary Configurations for ERP Environments chapter of this guide.
8.5.6.1 SAP server-side trust overview
295 2012-12-12
Authentication
This section provides procedures for configuring server-side trust between SAP Web Application Servers
(version 6.20 and later) and SAP BusinessObjects Enterprise. You need to set up server-side trust if you are using multi-pass report bursting (for publications where the report query depends on the context of the user).
Server-side trust involves password-less impersonation. To impersonate an SAP user without providing a password, a user must be identified with SAP using a more secure method than a regular username and password. (An SAP user with the SAP_ALL authorization profile cannot impersonate another SAP user without knowing that user's password.)
Enabling server-side trust using the free SAP crypto library
To enable server-side trust for SAP BusinessObjects Enterprise using the free SAP crypto library, you must run the relevant servers under credentials that are authenticated using a registered Secure Network
Communication (SNC) provider. The credentials are configured by SAP to allow impersonation without a password. For SAP BusinessObjects Enterprise, you must run servers involved in report-bursting under the SNC credentials, such as the Adaptive Job Server.
You must have a 32-bit SNC encryption library in order to configure server-side trust. An SAP
Cryptographic Library is available (for Windows and Unix) for download on the SAP web site. The SAP
Cryptographic Library can be used only for setting up server-side trust. For information about the
Cryptographic Library, see SAP notes 711093, 597059, and 397175 on the SAP web site.
The SAP server and SAP BusinessObjects Enterprise need to be assigned certificates that prove their identities to each other. Each server will have its own certificate and a list of certificates for trusted parties. To configure server-side trust between SAP and SAP BusinessObjects Enterprise, you need to create a password-protected set of certificates called a Personal Security Environment (PSE). This document describes how to set up and maintain the PSEs, and how to securely associate them with
SAP BusinessObjects Enterprise processing servers.
Client versus server SNC
In client SNC, an SNC name identifier is mapped to one (or more) SAP user names in SU01. When a logon request is sent, the SNC name together with the SAP name is passed to the SAP system, however no password is sent. Provided the SNC name maps to the specified SAP name, the logon is permitted.
A client-side logon string for a direct application host logon is shown below:
ASHOST =myserver.mydomain SYSNR=37 CLIENT=066 LANG=EN USER=USER123
SNC_MODE=1 SNC_QOP=9 SNC_LIB="/usr/local/lib/libsapcrypto.so"
SNC_PARTNERNAME="p:CN=TheServer, OU=Dept., O=TheCompany, C=FR"
SNC_MYNAME="p:CN=TheUser, O=TheCompany, C=US"
The SAP user USER123 must be mapped to p:CN=TheUser, O=TheCompany, C=US in SU01 for this logon attempt to succeed. In server SNC on the other hand, it is not a requirement to explicitly map between the SNC name identifier and SAP user name. Instead, the SNC name is configured in transaction
SNC0 to be allowed to perform an impersonation-style logon for “any” user without having to provide this users' password. For example:
ASHOST =myserver.mydomain SYSNR=37 CLIENT=066 LANG=EN SNC_MODE=1
SNC_QOP=9 SNC_LIB="/usr/local/lib/libsapcrypto.so"
SNC_PARTNERNAME="p:CN=TheServer, OU=Dept., O=TheCompany, C=FR"
SNC_MYNAME="p:CN=TheUser, O=TheCompany, C=US" EXTIDTYPE=UN EXTIDDATA=USER123
296 2012-12-12
Authentication
The server SNC impersonation logon, or logon via external ID is much more powerful than its client counterpart. This logon enables access to any SAP user account in the system. Other External ID logon options include Logon Tickets and X.509 client certificates.
SAP BusinessObjects Enterprise server responsibilities
Specific SAP BusinessObjects Enterprise servers are relevant to the SAP integration in terms of single sign-on (SSO). The following table lists these servers, and the type of SNC they require for particular areas of responsibility.
Server
Web Application Server
CMS
Page Server
Job Server
SNC type
client server client server server
Web Intelligence Processing Server server
Multi-Dimensional Analysis Service server
Areas of responsibility
SAP Authentication role list
Crystal Reports Dynamic Parameter pick lists and personalization
Password, ticket, checking role membership, and user lists
Crystal Reports view on demand
Scheduling Crystal Reports
Viewing and scheduling Web Intelligence reports and List of Values (LOV) prompts
Analysis
Note:
The Web Application Server and the CMS use client-SNC and thus require an explicit mapping of the
SNC name to the SAP user name. This is specified in either transaction SU01 or SM30 for table USRACL.
297
8.5.6.2 Configuring SAP for server-side trust
You must set up SNC for use with SAP BusinessObjects Enterprise. Server-side trust applies only to
Crystal reports and Web Intelligence reports that are based on Universes (.unv).
For more information or for troubleshooting assistance, consult the SAP documentation provided with your SAP server.
8.5.6.2.1 To configure SAP for server-side trust
1.
From the SAP marketplace, download the SAP Cryptographic Library for all relevant platforms.
Note:
For more information about the Cryptographic Library, see SAP notes 711093, 597059 and 397175 on the SAP web site.
2012-12-12
Authentication
2.
Ensure that you have SAP administrator's credentials for within SAP and for the machine running
SAP, and administrator's credentials for SAP BusinessObjects Enterprise and the machine (or machines) it is running on.
3.
On the SAP machine, copy the SAP Cryptographic Library and the SAPGENPSE tool to
<DRIVE>:\usr\sap\<SID>\SYS\exe\run\ directory (on Windows).
4.
Locate the file named "ticket" that was installed with the SAP Cryptographic Library, and copy it to the <DRIVE>:\usr\sap\<SID>\<instance>\sec\ directory (on Windows).
5.
Create an environment variable named SECUDIR that points to the directory where the ticket resides.
Note:
This variable must be accessible to the user under which SAP's disp+work process runs.
6.
In the SAP GUI, go to transaction RZ10 and change the instance profile in Extended maintenance mode.
7.
In profile edit mode, point SAP profile variables to the Cryptographic Library and give the SAP system a Distinguished Name (DN). These variables should follow the LDAP naming convention:
Tag Meaning Description
CN Common Name The everyday name of the certificate proprietor.
OU
O
Organizational Unit
Organization
PG for Product Group, for example.
The name of the organization for which the certificate was issued.
C Country The country where the organization is located.
For example, for R21: p:CN=R21, OU=PG, O=BOBJ, C=CA
Note:
Note that the prefix p: is for the SAP Cryptographic Library. It is required when referring to the DN within SAP, but will not be visible when examining certificates in STRUST or using SAPGENPSE.
8.
Enter the following profile values, substituting for your SAP system where necessary:
298 2012-12-12
Authentication
Profile variable
ssf/name ssf/ssfapi_lib sec/libsapsecu snc/gssapi_lib snc/identity/as
Value
SAPSECULIB
Full path to sapcrypto lib
Full path to sapcrypto lib
Full path to sapcrypto lib
Your SAP system's DN
9.
Restart your SAP instance.
10.
When the system is running again, log on and go to transaction STRUST, which should now have additional entries for SNC and SSL.
11.
Right-click the SNC node and click Create.
The identity you specified in RZ10 should now appear.
12.
Click OK.
13.
To assign a password to the SNC PSE, click the lock icon.
Note:
Do not lose this password. You will be prompted for it by STRUST every time you view or edit the
SNC PSE.
14.
Save the changes.
Note:
If you do not save your changes, the application server will not start again when you enable SNC.
15.
Return to transaction RZ10 and add the remainder of the SNC profile parameters:
Profile variable
snc/accept_insecure_rfc
Parameter
1
1 snc/accept_insecure_r3int_rfc
1 snc/accept_insecure_gui
1 snc/accept_insecure_cpic
299 2012-12-12
Authentication
300
Profile variable
snc/permit_insecure_start snc/data_protection/min snc/data_protection/max snc/enable
Parameter
1
1
3
1
The minimum protection level is set to authentication only (1) and the maximum is privacy (3). The snc/data_protection/use value defines that only authentication is to be used in this case, but could also be (2) for integrity, (3) for privacy and (9) for maximum available. The snc/accept_insecure_rfc, snc/accept_insecure_r3int_rfc, snc/accept_insecure_gui, and snc/accept_insecure_cpic values set to (1) ensure that previous (and potential unsecure) communication methods are still permitted.
16.
Restart your SAP system.
You must now configure SAP BusinessObjects Enterprise for server-side trust.
8.5.6.3 Configuring SAP BusinessObjects Enterprise for server-side trust
The following procedures need to be performed in order to configure SAP BusinessObjects Enterprise for server-side trust. Note that these steps are Windows-based, but because the SAP tool is a command line tool, the steps are very similar on Unix.
1.
Set up the environment
2.
Generate a Personal Security Environment (PSE)
3.
Configure SAP BusinessObjects Enterprise servers
4.
Configure PSE access
5.
Configure SAP Authentication SNC settings
6.
Set up SAP dedicated server groups
Related Topics
•
•
•
To configure SAP BusinessObjects Enterprise servers
•
•
To configure SAP authentication SNC settings
•
2012-12-12
Authentication
301
8.5.6.3.1 To set up the environment
Before you begin, ensure that:
• The SAP Cryptographic Library has been downloaded and expanded on the host on which SAP
BusinessObjects Enterprise processing servers run.
• The appropriate SAP systems have been configured to use SAP Cryptographic Library as the SNC provider.
Before PSE maintenance can begin, you need to set up the library, tool, and environment where PSEs are stored.
1.
Copy the SAP Cryptographic Library (including the PSE maintenance tool) to a folder on the machine running SAP BusinessObjects Enterprise.
For example: C:\Program Files\SAP\Crypto
2.
Add the folder to the PATH environment variable.
3.
Add a system-wide environment variable SNC_LIB that points to the Cryptographic Library.
For example: C:\Program Files\SAP\Crypto\sapcrypto.dll
4.
Create a subfolder named sec.
For example: C:\Program Files\SAP\Crypto\sec
5.
Add a system-wide environment variable SECUDIR that points to the sec folder.
6.
Copy the ticket file from the SAP Cryptographic Library into the sec folder.
Related Topics
•
Configuring SAP for server-side trust
8.5.6.3.2 To generate a PSE
SAP accepts an SAP BusinessObjects Enterprise server as a trusted entity when the relevant SAP
BusinessObjects Enterprise servers have a PSE and the PSE is associated with SAP. This “trust” between SAP and SAP BusinessObjects Enterprise components is established by sharing the public version of each other's certificates. The first step is to generate a PSE for SAP BusinessObjects
Enterprise that automatically generates its own certificate.
1.
Open a command prompt and run sapgenpse.exe gen_pse -v -p BOE.pse from within the
Cryptographic Library folder.
2.
Choose a PIN and the DN you want for your SAP BusinessObjects Enterprise system.
For example, CN=MyBOE01, OU=PG, O=BOBJ, C=CA.
You now have a default PSE, with its own certificate.
3.
Use the following command to export the certificate in the PSE: sapgenpse.exe export_own_cert -v -p BOE.pse -o MyBOECert.crt
4.
In the SAP GUI, go to transaction STRUST and open the SNC PSE.
You will be prompted for the password you have already assigned.
2012-12-12
Authentication
302
5.
Import the MyBOECert.crt file created earlier:
The certificates from SAPGENPSE are Base64-encoded. Make sure you select Base64 when importing them:
6.
To add the SAP BusinessObjects Enterprise certificate to the SAP server's PSE certificate list, click the Add to certificate list button.
7.
To add SAP's certificate to SAP BusinessObjects Enterprise's PSE, double-click the SAP certificate.
8.
Save your changes in STRUST.
9.
Click the Export button and provide a file name for the certificate.
For example, MySAPCert.crt.
Note:
The format should remain Base64.
10.
Go to transaction SNC0.
11.
Add a new entry, where:
• The System ID is arbitrary but reflects your SAP BusinessObjects Enterprise system.
• The SNC name should be the DN (prefixed by p:) that you provided when you created your SAP
BusinessObjects Enterprise PSE (in step 2).
• The Entry for RFC activated and Entry for ext. ID activated check boxes are both selected:
12.
To add the exported certificate to the SAP BusinessObjects Enterprise PSE, run the following command on the command prompt: sapgenpse.exe maintain_pk -v -a MySAPCert.crt -p BOE.pse
The SAP Cryptographic Library is installed on the SAP BusinessObjects Enterprise machine. You have created a PSE that will be used by SAP BusinessObjects Enterprise servers to identify themselves to
SAP servers. SAP and the SAP BusinessObjects Enterprise PSE have exchanged certificates. SAP permits entities with access to the SAP BusinessObjects Enterprise PSE to perform RFC calls and password-less impersonation.
Related Topics
•
To configure SAP BusinessObjects Enterprise servers
8.5.6.3.3 To configure SAP BusinessObjects Enterprise servers
After you generate a PSE for SAP BusinessObjects Enterprise, you must configure an appropriate server structure for SAP processing. The following procedure creates a node for SAP processing servers, so that you can set operating system credentials on the node level.
Note:
In this version of SAP BusinessObjects Enterprise, servers are no longer configured in the Central
Configuration Manager (CCM). Instead, a new Server Intelligence Agent (SIA) must be created.
1.
In the CCM, create a new node for SAP processing servers.
Give the node an appropriate name such as SAPProcessor.
2012-12-12
Authentication
303
2.
In the CMC, add the processing servers you need to the new node, then start the new servers.
8.5.6.3.4 To configure PSE access
After you configure the SAP BusinessObjects Enterprise node and servers, you need to configure PSE access using the SAPGENPSE tool.
1.
Run the following command from the command prompt: sapgenpse.exe seclogin -p SBOE.pse
Note:
You will be prompted for the PSE PIN. If you run the tool under the same credentials used by your
SAP BusinessObjects Enterprise SAP processing servers, you do not need to specify a user name.
2.
To verify that the single sign-on (SSO) link is established, list the contents of the PSE using the following command: sapgenpse.exe maintain_pk -l
The results should look similar to the following:
C:\Documents and Settings\hareskoug\Desktop\sapcrypto.x86\ntintel>sapgenpse.exe
maintain_pk -l maintain_pk for PSE "C:\Documents and Settings\hareskoug\My Documents\snc\sec\bobjsapproc.pse"
*** Object <PKList> is of the type <PKList_OID> ***
1. -------------------------------------------------------------
Version: 0 (X.509v1-1988)
SubjectName:
IssuerName:
CN=R21Again, OU=PG, O=BOBJ, C=CA
CN=R21Again, OU=PG, O=BOBJ, C=CA
SerialNumber:
Validity NotBefore:
00
Wed Nov 28 16:23:53 2007 (071129002353Z)
NotAfter:
Public Key Fingerprint:
SubjectKey:
Thu Dec 31 16:00:01 2037 (380101000001Z)
851C 225D 1789 8974 21DB 9E9B 2AE8 9E9E
Algorithm RSA (OID 1.2.840.113549.1.1.1), NULL
C:\Documents and Settings\hareskoug\Desktop\sapcrypto.x86\ntintel>
You should not be prompted again for the PSE PIN after a successful seclogin command.
Note:
If you encounter PSE access problems, use the -O to specify PSE access. For example, to grant
PSE access to a specific user in a specific domain, type: sapgenpse seclogin -p SBOE.pse -O <domain\user>
8.5.6.3.5 To configure SAP authentication SNC settings
After you configure PSE access, you need to configure the SAP authentication settings in the CMC.
1.
Go to the "Authentication" management area of the CMC.
2.
Double-click the SAP link.
The entitlement systems settings appear.
3.
Click the SNC Settings tab on the "SAP Authentication" page.
4.
Select your entitlement system from the Logical system name list.
2012-12-12
Authentication
304
5.
Select Enable Secure Network Communication (SNC) under Basic Settings.
6.
In the SNC library path box, type the path for the SNC library settings.
Note:
This step is necessary even though the library is already defined in the SNC_LIB environment variable.
7.
Select a level of protection under Quality of Protection.
For example, select Authentication.
Note:
Make sure you do not exceed the level of protection configured on the SAP system. The level of protection is customizable and is determined by your organization's needs and the capabilities of their SNC library.
8.
Type the SNC name of the SAP system under Mutual authentication settings.
The SNC name format depends on the SNC library. Using the SAP cryptography library, the distinguished name recommendation is that it follows LDAP naming conventions. It must be have
"p:" as its prefix.
9.
Ensure that the SNC name of the credentials under which Enterprise servers run appears in the
SNC name of Enterprise system field.
When several SNC names are configured, leave this field blank.
10.
Provide the DNs of both the SAP system and the SAP BusinessObjects Enterprise PSE.
8.5.6.3.6 Using server groups
Unless the processing (Crystal Reports or Web Intelligence) servers are running under credentials that have access to the PSE, you must create a specific server group containing only these servers along with the required supporting servers. For more information and descriptions of SAP BusinessObjects
Enterprise servers, see the “Architecture” section of this guide.
There are three options to choose from when configuring content processing servers for your SAP content:
1.
Maintain a single SIA, including all SAP BusinessObjects Enterprise servers, running under credentials that have access to the PSE. This is the simplest option - no server groups need to be created. This approach is the least secure in that an unnecessary number of servers have access to the PSE.
2.
Create a second SIA with access to the PSE and add to it the Crystal report or Interactive processing servers. Delete the duplicated servers from the original SIA. No server groups need to be created but less servers have access to the PSE.
3.
Create a SIA exclusively for use for SAP with access to the PSE. Add to it the Crystal report or Web
Intelligence processing servers. In the approach, only SAP content should run on these servers, and more importantly SAP content should only run on these servers. Since in this scenario content needs to be directed to certain servers, you must create server groups for the SIA.
Guidelines for using a server group
The server group must reference:
• The SIA that is used exclusively to handle SAP content
2012-12-12
Authentication
• Adaptive Job Servers
• Adaptive Processing Servers
All SAP content, Web Intelligence documents, and Crystal reports need to be associated with the server group using the strictest association; that is, that they must run on servers in the group. When this association is done on an object level, the server group setting should be propagated into settings for both direct scheduling as well as for publications.
To prevent other (non-SAP) content from processing on the SAP-specific processing servers, you should create another server group that includes all the servers under the original SIA. It is recommended that you set up a strict association between this content and the non-SAP server group.
8.5.6.4 Configuring multi-pass publications
Troubleshooting multi-pass publications
If you encounter problems with multi-pass publications, enable tracing for the Crystal Reports (CR) or
Multidimensional Data Access (MDA) drivers for SAP and look at the logon string used for each job or recipient. These logon strings should resemble the following:
SAP: Successfully logged on to SAP server.
Logon handle: 1. Logon string: CLIENT=800 LANG=en
ASHOST="vanrdw2k107.sap.crystald.net" SYSNR=00 SNC_MODE=1 SNC_QOP=1
SNC_LIB="C:\WINDOWS\System32\sapcrypto.dll"
SNC_PARTNERNAME="p:CN=R21Again, OU=PG, O=BOBJ, C=CA" EXTIDDATA=HENRIKRPT3 EXTIDTYPE=UN
The logon string must have the appropriate EXTIDTYPE=UN (for username) and EXTIDDATA should be the SAP username of the recipient. In this example, the logon attempt was successful.
305
8.5.6.5 Workflow for integrating with Secure Network Communication
BI platform supports environments that implement Secure Network Communication (SNC) for authentication and data encryption between SAP components. If you have deployed the SAP
Cryptographic Library (or another external security product that uses the SNC interface) you must set some additional values to integrate BI platform effectively within your secured environment.
To configure the platform to use your secure network communication, you must complete the following tasks:
1.
Configure BI platform servers to start and run under an appropriate user account.
2.
Configure the SAP system to trust your BI platform system.
3.
Configure the SNC settings in the SNC link in the Central Management Console.
4.
Import SAP roles and users into BI platform.
2012-12-12
Authentication
Related Topics
•
•
Configuring SAP for server-side trust
•
Configuring SAP BusinessObjects Enterprise for server-side trust
306
8.5.6.6 To configure the SNC settings in the CMC
Before you can configure SNC settings you need to add a new entitlement system in BI platform. You must also copy the SNC library file to a known directory and create an environment variable RFC_LIB to point to this file.
1.
Click the SNC Settings tab on the SAP Authentication page.
2.
Select your entitlement system from the Logical system name list.
3.
Select Enable Secure Network Communication (SNC) under Basic Settings.
4.
If you are configuring SAP authentication for the consumption of .unx Universes or OLAP BICS connections and plan to use STS, select the Prevent insecure incoming RFC connections check box.
5.
Enter the path for the SNC library settings in SNC library path.
Note:
The application server and the CMS must be installed on the same type of operating system, with the same path to the crypto library.
6.
Select a level of protection under Quality of Protection.
For example, select Authentication.
Note:
The level of protection is customizable and is determined by your organization's needs and the capabilities of their SNC library.
7.
Enter the SNC name of the SAP system under Mutual authentication settings.
The SNC name format depends on the SNC library. Using the SAP cryptography library, the distinguished name recommendation is that it follows LDAP naming conventions. It must have p: as its prefix.
8.
Ensure that the SNC name of the credentials under which BI platform servers run appears in the
SNC name of Enterprise system box.
If several SNC names are configured, leave the box blank.
9.
Click Update.
10.
Click the Entitlement systems tab on the SAP Authentication page.
An SNC name field appears under the Language field.
11.
In the optional SNC name field, type the SNC name that you configured on the SAP BW server.
This name should be the same one used to configure the SAP system to trust BI platform.
2012-12-12
Authentication
Note:
If you are using the Insight to Action Framework to enable the Report-to-Report Interface, it may take up to 10 minutes before SNC is enabled or changes to SNC settings take effect. To trigger an immediate update, restart the Adaptive Processing Server that is running the Insight to Action Service.
Related Topics
•
Connecting to SAP entitlement systems
307
8.5.6.7 To associate the entitlement user with an SNC name
1.
Log on to your SAP BW system and execute the transaction SU01.
The User Maintenance: Initial Screen opens.
2.
In the User field, type the name of the SAP account designated as the entitlement user and then click Change on the toolbar.
The Maintain User screen opens.
3.
Click the SNC tab.
4.
In the SNC name field, type the SNC USER ACCOUNT you entered in step 4 above.
5.
Click Save.
8.5.6.8 To add a system ID to the SNC Access Control list
1.
Log on to your SAP BW system and execute the transaction SNC0.
The Change View "SNC: Access Control List (ACL) for Systems: Overview" screen opens.
2.
Click New Entries on the toolbar.
The New Entries: Details of Added Entries screen opens.
3.
Type the name of your BI platform machine in the System ID field.
4.
Type p:<SNC USER NAME> in the SNC user name field where SNC USER NAME represents the account you used when configuring the BI platform servers.
Note:
If your SNC provider is gssapi32.dll, use uppercase letters when indicating the SNC USER NAME.
You must include the domain name when specifying the user account. For example: domain\username.
5.
Select Entry for RFC activated and Entry for ext. ID activated.
2012-12-12
Authentication
6.
Clear all other options and click Save.
8.5.7 Setting up single sign-on to the SAP system
Different BI platform client and back-end services interact with NetWeaver ABAP back-end systems in an integrated environment. It is useful to set up single sign-on from BI platform to these (typically BW) back-end systems. After an ABAP system is configured as an external authentication system, proprietary
SAP tokens are used to provide a mechanism that supports single sign-on for all BI platform clients and services connecting to NetWeaver ABAP systems.
To enable single sign-on to the SAP system, you need to create a keystore file and a corresponding certificate. Use the keytool command line program to generate the file and the certificate. By default the keytool program is installed in the sdk/bin directory for each platform.
The certificate needs to be added to your SAP ABAP BW system, and BI platform using the CMC.
Note:
The SAP authentication plugin must configured before you can set up single sign-on to the database used by SAP BW.
8.5.7.1 To generate the keystore file
The PKCS12Tool program is used to generate keystore files and certificates that are required for setting up single sign-on to the SAP database. The following table lists the default locations for the
PKCS12Tool.jar
for each supported platform:
Platform
Windows
Unix
Default location
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\java\lib sap_bobj/enterprise_xi40/java/lib
1.
Launch a command prompt and navigate to the directory where the PKCS12Tool program is located
2.
To generate the keystore file with default settings run the following command: java -jar PKCS12Tool.jar
The files cert.der and keystore.p12 are generated in the same directory. The files contain the following default values:
308 2012-12-12
Authentication
Parameter
-keystore
-alias
-storepass
-dname
-validity
-cert
Default
keystore.p12
myalias
123456
CN=CA
365 cert.der
Tip:
To override the default values, run the tool together with the -? parameter. The following message is displayed:
Usage: PKCS12Tool <options>
-keystore <filename(keystore.p12)>
-alias <key entry alias(myalias)>
-storepass <keystore password(123456)>
-dname <certificate subject DN(CN=CA)>
-validity <number of days(365)>
-cert <filename (cert.der)>
(No certificate is generated when importing a keystore)
-disablefips
-importkeystore <filename>
You can use the parameters to override the default values.
8.5.7.2 To export the public key certificate
You need to create and export a certificate for the keystore file.
1.
Launch a command prompt and navigate to the directory where the keytool program is located
2.
To export a key certificate for the keystore file use the following command: keytool -exportcert -keystore <keystore> -storetype pkcs12 -file <filename>
-alias <alias>
Replace <keystore> with the name of the keystore file.
Replace <filename> with the name of the certificate.
Replace <alias> with the alias used to create the keystore file.
3.
When prompted, enter the password you provided for the keystore file.
You now have a keystore file and a certificate in the directory where the keytool program is located.
309 2012-12-12
Authentication
8.5.7.3 Importing the certificate file into the target ABAP SAP system
You need a key store file and an associated certificate for your BI platform deployment to perform the following task.
Note:
This action can only be performed on an ABAP SAP system.
1.
Connect to your SAP ABAP BW system using the SAP GUI.
Note:
You should connect as a user with administrative privileges.
2.
Execute STRUSTSSO2 in the SAP GUI.
The system is prepared for importing the certificate file.
3.
Go to the Certificate tab.
4.
Ensure the Use Binary option check box is selected.
5.
Click the file path button to point to the location where the certificate file is located.
6.
Click the green check mark.
The certificate file is uploaded.
7.
Click Add to Certificate List.
The certificate is displayed in the Certificate List.
8.
Click Add to ACL and specify a SystemID and Client.
The system ID must be the same used to identify the BI platform system to SAP BW.
The certificate is added to the Access Control List (ACL). The client should be specified as “000”.
9.
Save your setting and exit.
The changes are saved in the SAP system.
310
8.5.7.4 To set up single sign-on to the SAP database in the CMC
To perform the following procedure you need to access the SAP security plugin using an administrator account.
1.
Go to the "Authentication" management area of the CMC.
2.
Double-click the SAP link and then click the Options tab.
If no certificate has been imported the following message should be displayed in the "SAP SSO
Service" section:
No key store file has been uploaded
2012-12-12
Authentication
3.
Specify System ID for your BI platform system in the field provided.
This should be identical to the value used when importing the certificate in the target SAP ABAP system.
4.
Click the Browse button to point to the key store file.
5.
Provide the following required details:
Field
"Key Store Password"
Required information
Provide the password required to access the key store file. This password was specified when creating the key store file.
"Private Key Password"
Provide the password required to access the certificate corresponding to the key store file. This password was specified when creating the certificate for the key store file.
"Private Key Alias" Provide the alias required to access the key store file. This alias was specified when creating the key store file.
6.
Click Update to submit your settings.
Once the settings are submitted successfully, the following message is displayed under the SystemID field:
Key store file have been uploaded
8.5.7.5 To add the Security Token Service to the Adaptive Processing Server
In a clustered environment, the Security Token Services added separately to each Adaptive Processing
Server.
1.
Go to the "Servers" management area of the CMC.
2.
Double-click Core Services.
A list of servers appears under "Core Services".
3.
Right-click the Adaptive Processing Server and select Stop Server.
Do not proceed until the server state is "Stopped".
4.
Right-click the Adaptive Processing Server and select Select Services.
The "Select Services" dialog box appears.
5.
Move Security Token Service from the "Available services" list to the "Services" list.
Use the add button to move the selection.
6.
Click OK.
7.
Restart the Adaptive Processing Server.
311 2012-12-12
Authentication
8.5.8 Configuring SSO for SAP Crystal Reports and SAP NetWeaver
By default, BI platform will be configured to allow SAP Crystal Reports users to access SAP data using
Single Sign-on (SSO).
8.5.8.1 To deactivate SSO for SAP NetWeaver and SAP Crystal Reports
1.
In the Central Management Console (CMC), click Applications.
2.
Double-click Crystal Reports Configuration.
3.
Click Single Sign-On Options.
4.
Select one of the following drivers:
Driver
Operational Data Store driver
Open SQL driver
Infoset driver
BW MDX Query driver
Display name crdb_ods crdb_opensql crdb_infoset crdb_bwmdx
5.
Click Remove.
6.
Click Save & Close.
7.
Restart SAP Crystal Reports.
8.5.8.2 To reactivate SSO for SAP NetWeaver and SAP Crystal Reports
Follow the steps below to reactivate SSO for SAP NetWeaver (ABAP) and SAP Crystal Reports.
1.
In the Central Management Console (CMC), click Applications.
2.
Double-click Crystal Reports Configuration.
3.
Click Single Sign-On Options.
4.
Under "Use SSO context for database logon" type:
312 2012-12-12
Authentication crdb_ods crdb_opensql crdb_bwmdx crdb_infoset
5.
Click Add.
6.
Click Save & Close.
7.
Restart SAP Crystal Reports.
To activate the ODS driver
To activate the Open SQL driver
To activate the SAP BW MDX Query driver
To activate the InfoSet driver
8.6 PeopleSoft authentication
8.6.1 Overview
To use your PeopleSoft Enterprise data with the BI platform, you must provide the program with information about your deployment. This information allows the BI platform to authenticate users so that they can use their PeopleSoft credentials to log on to the program.
8.6.2 Enabling PeopleSoft Enterprise authentication
To allow PeopleSoft Enterprise information to be used by the BI platform, the BI platform needs information on how to authenticate into your PeopleSoft Enterprise system.
313
8.6.2.1 To enable PeopleSoft Enterprise authentication in the BI Platform
1.
Log on as an administrator to the Central Management Console.
2.
From the Manage area, click Authentication.
3.
Double-click PeopleSoft Enterprise.
The "PeopleSoft Enterprise" page appears. It has four tabs: Options, Domains, Roles, and User
Update.
2012-12-12
Authentication
4.
On the Options tab, select the Enable PeopleSoft Enterprise Authentication check box.
5.
Make appropriate changes under New Alias, Update Options, and New User Options according to your BI platform deployment. Click Update to save your changes before proceeding to the Systems tab.
6.
Click the Servers tab.
7.
In the "PeopleSoft Enterprise System User" area, type a database User name and Password for the
BI platform to use to log on to your PeopleSoft Enterprise database.
8.
In the "PeopleSoft Enterprise Domain" area, enter the Domain name and QAS address used to connect to your PeopleSoft Enterprise environment, and click Add.
Note:
If you have multiple PeopleSoft domains, repeat this step for any additional domains you want to have access to. The first domain you enter will become the default domain.
9.
Click Update to save your changes.
8.6.3 Mapping PeopleSoft roles to the BI Platform
The BI platform automatically creates a group for each PeopleSoft role that you map. As well, the program creates aliases to represent the members of the mapped PeopleSoft roles.
You can create a user account for each alias that is created.
However, if you run multiple systems, and your users have accounts in more than one of the systems, then you can assign each user to an alias with the same name before you create the accounts in the
BI platform.
Doing so reduces the number of accounts that are created for the same user in the BI platform.
For example, if you run PeopleSoft HR 8.3 and PeopleSoft Financials 8.4, and 30 of your users have access to both systems, then only 30 accounts are created for those users. If you choose not to assign each user to an alias with the same name, then 60 accounts are created for the 30 users in the BI platform.
However, if you run multiple systems, and user names overlap, then you must create a new member account for each alias that is created.
For example, if you run PeopleSoft HR 8.3 with a user account for Russell Aquino (user name "raquino"), and you run PeopleSoft Financials 8.4 with a user account for Raoul Aquino (user name "raquino"), then you need to create a separate account for each user's alias. Otherwise, the two users are added to the same the BI platform account; they will be able to log in to the BI platform with their own PeopleSoft credentials and have access to data from both PeopleSoft systems.
314 2012-12-12
Authentication
315
8.6.3.1 To map a PeopleSoft role to the BI Platform
1.
Log on as an administrator to the Central Management Console.
2.
Click Authentication.
3.
Double-click PeopleSoft Enterprise for PeopleTools.
4.
On the Roles tab, in the PeopleSoft Enterprise Domains area, select the domain associated with the role you want to map to the BI platform.
5.
Use one of the following options to select the roles you want to map:
• In the PeopleSoft Enterprise Roles area, in the Search roles box, enter the role you want to locate and map to the BI platform, and then click >.
• From the "Available Roles" list, select the role you want to map to the BI Platform and click >.
Note:
• When searching for a particular user or role, you can use the wild card %. For example, to search for all roles beginning with "A," type A%. Search is also case sensitive.
• If you want to map a role from another domain, you must select the new domain from the list of available domains to match a role from a different domain.
6.
To enforce group and user synchronization between the BI platform and PeopleSoft, check the
Force user synchronization check box. To remove already imported PeopleSoft groups from the
BI platform, leave the Force user synchronization check box unchecked.
7.
In the "New Alias Options" area, select one of the following options:
•
Assign each added alias to an account with the same name
Select this option if you run multiple PeopleSoft Enterprise systems with users who have accounts on more than one system (and no two users have the same user name for different systems).
•
Create a new account for every added alias
Select this option if you run only one PeopleSoft Enterprise, if the majority of your users have accounts on only one of your systems, or if the user names overlap for different users on two or more of your systems.
8.
In the Update Options area, select one of the following options:
•
New aliases will be added and new users will be created
Select this option to create a new alias for every user that is mapped to the BI platform. New accounts are added for users without the BI platform accounts or for all users if you selected the
Create a new account for every added alias option.
•
No new aliases will be added and new users will not be created
Select this option if the role that you want to map contains many users, but only a few of them will use the BI platform. The platform does not automatically create aliases and accounts for the
2012-12-12
Authentication users. Instead, it creates aliases (and accounts, if required) only for users when they log on to the BI platform for the first time. This is the default option.
9.
In the New User Options area specify how new users are created.
Select one of the following options:
•
New users are created as named users.
New user accounts are configured to use named user licenses. Named user licenses are associated with specific users and allow people to access the system based on their user name and password. This provides named users with access to the system regardless of how many other people are connected. You must have a named user license available for each user account created using this option.
•
New users are created as concurrent users.
New user accounts are configured to use concurrent user licenses. Concurrent licenses specify the number of people who can connect to the BI platform at the same time. This type of licensing is very flexible because a small concurrent license can support a large user base. For example, depending on how often and how long users access the BI platform, a 100 user concurrent license could support 250, 500, or 700 users.
The roles that you selected now appear as groups in the BI platform.
316
8.6.3.2 Remapping consideration
If you add users to a role that has already been mapped to the BI platform, you need to remap the role to add the users to the BI platform. When you remap the role, the option to map users as either named users or concurrent users affects only the new users that you added to the role.
For example, you first map a role to the BI platform with the "New users are created as named users" option selected. Later, you add users to the same role and remap the role with the "New users are created as concurrent users" option selected.
In this situation, only the new users in the role are mapped to the BI platform as concurrent users; the users that were already mapped remain named users. The same condition applies if you first map users as concurrent users, and then you change the settings to remap new users as named users.
8.6.3.3 To unmap a role
1.
Log on as an administrator to the Central Management Console.
2.
Click Authentication.
3.
Click PeopleSoft Enterprise.
2012-12-12
Authentication
4.
Click Roles.
5.
Select the role that you want to remove, and click <.
6.
Click Update.
Members of the role will no longer be able to access the BI platform, unless they have other accounts or aliases.
Note:
You can also delete individual accounts or remove users from roles before you map them to the BI platform to prevent specific users from logging on.
8.6.4 Scheduling user updates
To ensure changes to your user data for your ERP system are reflected in your BI platform user data, you can schedule regular user updates. These updates will automatically synchronize your ERP and
BI platform users according to the mapping settings you have configured in the Central Management
Console (CMC).
There are two options for running and scheduling updates for imported roles:
• Update roles only: using this option will update only the links between the currently mapped roles that have been imported in BI platform. Use this option if you expect to run frequent updates, and you are concerned about system resource usage. No new user accounts will be created if you only update roles.
• Update roles and aliases: this option not only updates links between roles but will also create new user accounts in BI platform for new user aliases added to the ERP system.
Note:
If you have not specified to automatically create user aliases for updates when you enabled authentication, no accounts will be created for new aliases.
8.6.4.1 To schedule user updates
After you map roles into BI platform, you need to specify how the system updates these roles.
1.
Click the User Update tab.
2.
Click Schedule in either the "Update Roles Only" or "Update Roles and Aliases" sections.
Tip:
If you want to run an update immediately click Update Now.
317 2012-12-12
Authentication
Tip:
Use the "Update Roles Only" option if you would like frequent updates and are concerned about system resources. It takes the system longer to update both roles and aliases.
The "Recurrence" dialog box appears.
3.
Select an option from the "Run Object" list and provide all the requested scheduling information.
When scheduling an update, you can choose from the recurrence patterns summarized in the following table:
Recurrence pattern
Hourly
Daily
Weekly
Monthly
Nth Day of Month
1st Monday of Month
Description
The update will run every hour. You specify at what time it will start, as well as a start and end date.
The update will run every day or run every number of specified days. You can specify at what time it will run, as well as a start and end date.
The update will run every week. It can be run once a week or several times a week. You can specify on which days and at what time it will run, as well as a start and end date.
The update will run every month or every several months. You can what time it will run, as well as a start and end date.
The update will run on a specific day in the month. You can specify on which day of the month, what time it will run, as well as a start and end date.
The update will run on the first Monday of each month. You can specify what time it will run, as well as a start and end date.
Last Day of Month
X Day of Nth Week of the Month
The update will run on the last day of each month. You can specify what time it will run, as well as a start and end date.
The update will run on a specified day of a specified week of the month. You can specify what time it will run, as well as a start and end date.
Calendar
The update will run on the dates specified in a calendar that has previously been created.
4.
Click Schedule after you have finished providing the scheduling information.
The date of the next scheduled role update is displayed in the User Update tab.
Note:
You can always cancel the next scheduled update by clicking Cancel Scheduled Updates in either the "Update Roles Only" or "Update Roles and Aliases" sections.
318 2012-12-12
Authentication
8.6.5 Using the PeopleSoft Security Bridge
The Security Bridge feature of the BI Platform allows you to import PeopleSoft EPM security settings to the BI Platform.
The Security Bridge operates in two modes:
• Configuration mode
In configuration mode, the Security Bridge provides an interface that enables you to create a response file. This response file is what governs the behavior of the Security Bridge during execution mode.
• Execution mode
Based on the parameters that you define in the response file, the Security Bridge imports the security settings of dimension tables in PeopleSoft EPM to universes in the BI Platform.
8.6.5.1 Importing security settings
To import the security settings, you must do the following tasks in order:
• Define the objects that the Security Bridge will manage.
• Create a response file.
• Run the Security Bridge application.
For information about managing security after you import the settings, see the Managing security settings section.
8.6.5.1.1 Defining managed objects
Before you run the Security Bridge, it is important to determine the objects that are managed by the application. The Security Bridge manages one or more PeopleSoft roles, a BI Platform group, and one or more universes.
• Managed PeopleSoft roles
These are roles in your PeopleSoft system. Members of these roles work with PeopleSoft data through PeopleSoft EPM. You must choose the roles that include the members for whom you want to provide/update access privileges to the managed universes in the BI Platform.
The access rights that are defined for the members of these roles are based on their rights in
PeopleSoft EPM; the Security Bridge imports these security settings to the BI Platform.
• Managed BI Platform group
319 2012-12-12
Authentication
When you run the Security Bridge, the program creates a user in the BI Platform for each member of a managed PeopleSoft role.
The group in which the users are created is the managed BI Platform group. Members of this group are the users whose access rights to the managed universes are maintained by the Security Bridge.
Because the users are created in one group, you can configure the Security Bridge not to update the security settings for certain users simply by removing users from the managed BI Platform group.
Before you run the Security Bridge, you must choose a group in the BI Platform to be the location where the users are created. If you specify a group that does not exist, the Security Bridge will create the group in BI Platform.
• Managed universes
Managed universes are the universes to which the Security Bridge imports security settings from
PeopleSoft EPM. From the universes that are stored in your BI Platform system, you must choose which ones are to be managed by the Security Bridge. Members of managed PeopleSoft roles who are also members of the managed BI Platform group cannot access any data through these universes that they cannot access from PeopleSoft EPM.
8.6.5.1.2 To create a response file
1.
Go to the folder that you specified during the installation of the Security Bridge, and run the crpsepmsecuritybridge.bat
(in Windows) and crpsepmsecuritybridge.sh (in Unix) file.
Note:
In Windows, by default, this location is C:\Program Files\Business Objects\BusinessObjects 12.0
Integration Kit for PeopleSoft\epm
The Security Bridge for PeopleSoft EPM dialog box appears.
2.
Select New to create a response file, or select Open and click Browse to specify a response file that you want to modify. Select the language you want for the file.
3.
Click Next.
4.
Provide the locations of the PeopleSoft EPM SDK and the BI Platform SDK.
Note:
• The PeopleSoft EPM SDK is typically located on the PeopleSoft server at
<PS_HOME>/class/com.peoplesoft.epm.pf.jar.
• The BI Platform SDK is typically located at C:\Program Files (x86)\SAP BusinessObjects\SAP
BusinessObjects Enterprise XI 4.0\java\lib.
5.
Click Next.
The dialog box prompts you for connection and driver information for the PeopleSoft database.
6.
From the Database list, select the appropriate database type, and provide the information for the following fields:
320 2012-12-12
Authentication
321
Field
Database
Host
Port number
Class location
User name
Password
Description
The name of the PeopleSoft database.
The name of the server that hosts the database.
The port number for accessing the server.
The location of the class files for the database driver.
Your user name.
Your password.
7.
Click Next.
The dialog box displays a list of all the classes that the Security Bridge will use to run. If necessary, you can add to or remove classes from the list.
8.
Click Next.
The dialog box prompts you for connection information for the BI Platform.
9.
Provide the appropriate information for the following fields:
Field Description
Server
The name of the server where the Central
Management Server (CMS) is located.
User name
Password
Authentication
Your user name.
Your password.
Your authentication type.
10.
Click Next.
11.
Choose a BI Platform group, and click Next.
2012-12-12
Authentication
Note:
• The group that you specify in this field is where the Security Bridge creates users for the members of the managed PeopleSoft roles.
• If you specify a group that does not already exist, it will be created by the Security Bridge.
The dialog box displays a list of roles from your PeopleSoft system.
12.
Select the Imported option for the roles that you want the Security Bridge to manage, and click
Next.
Note:
The Security Bridge creates a user in the managed the BI Platform group (which you specified in the previous step) for each member of the role(s) that you select.
The dialog box displays a list of universes in the BI Platform.
13.
Select the universe(s) to which you want the Security Bridge to import security settings, and click
Next.
14.
Specify a filename for the Security Bridge log file and a location where the log file will be saved. You can use the log file to determine whether or not the Security Bridge is successful in importing the security settings from PeopleSoft EPM.
15.
Click Next.
The dialog box displays a preview of the response file that the Security Bridge will use during execution mode.
16.
Click Save, and choose a location where you want to save the response file.
17.
Click Next.
You have successfully created the response file for the Security Bridge.
18.
Click Exit.
Note:
The response file is a Java property file that you can also create and/or modify manually. For more details, see the “PeopleSoft response file” section.
322
8.6.5.2 Applying the security settings
To apply the security settings, run the crpsepmsecuritybridge.bat (in Windows) or the crpsempsecuritybridge.sh
file (in Unix), and use the response file that you created as an argument. (For example, type crpsepmsecuritybridge.bat (Windows) or crpsempsecurity bridge.sh
(unix) myresponsefile.properties.)
The Security Bridge application runs. It creates users in the BI Platform for the members of the PeopleSoft roles that you specified in the response file and imports the security settings from PeopleSoft EPM to the appropriate universes.
2012-12-12
Authentication
8.6.5.2.1 Mapping considerations
During execution mode, the Security Bridge creates a user in the BI Platform for each member of a managed PeopleSoft role.
The users are created to have only Enterprise authentication aliases, and the BI Platform assigns random passwords to these users. As a result, the users cannot log on to the BI Platform until the administrator manually reassigns new passwords or maps the role(s) to the BI Platform through the
PeopleSoft Security Plug-in to allow the users to log on by using their PeopleSoft credentials.
8.6.5.3 Managing security settings
You can manage the security settings that you applied by modifying the objects that are managed by the Security Bridge.
8.6.5.3.1 Managed users
The Security Bridge manages users based on the following criteria:
• Whether or not the user is a member of a managed PeopleSoft role.
• Whether or not the user is a member of the managed the BI Platform group.
If you want to enable a user to access PeopleSoft data through universes in the BI Platform, ensure that the user is a member of both a managed PeopleSoft role and the managed the BI Platform group.
• For members of managed PeopleSoft roles who do not have accounts in the BI Platform, the Security
Bridge creates accounts and assigns random passwords to them. The administrator must decide whether or not to reassign new passwords manually or map the roles to the BI Platform through the
PeopleSoft Security Plug-in to allow the users to log on to the BI Platform.
• For members of managed PeopleSoft roles who are also members of the managed BI Platform group, the Security Bridge updates the security settings that are applied to the users so that they have access to the appropriate data from the managed universes.
If a member of a managed PeopleSoft role has an existing account in the BI Platform, but he or she is not a member of the managed BI Platform group, then the Security Bridge does not update the security settings that are applied to the user. Typically, this situation occurs only when the administrator manually removes user accounts that have been created by the Security Bridge from the managed BI Platform group.
Note:
This is an effective method for managing security: by removing users from the managed BI Platform group, you can configure their security settings to be different from the security settings that they have in PeopleSoft.
323 2012-12-12
Authentication
Conversely, if a member of the managed BI Platform group is not a member of a managed PeopleSoft role, then the Security Bridge does not provide them with access to the managed universes. Typically, this situation occurs only when PeopleSoft administrators remove users who have been previously mapped to the BI Platform by the Security Bridge from the managed PeopleSoft role(s).
Note:
This is another method for managing security: by removing users from managed PeopleSoft roles, you can ensure that the users have no access to data from PeopleSoft.
8.6.5.3.2 Managed universes
The Security Bridge manages universes through restriction sets, which limit the data that managed users can access from the managed universes.
Restriction sets are groups of restrictions (for example, restrictions to Query Controls, SQL Generation, and so on). The Security Bridge applies/updates Row Access and Object Access restrictions for the managed universes:
• It applies Row Access restrictions to dimension tables that are defined in PeopleSoft EPM. These restrictions are user-specific and can be configured to one of the following settings:
• The user has access to all of the data.
• The user has access to none of the data.
• The user has access to data based on their row-level permissions in PeopleSoft, which are exposed through the Security Join Tables (SJT) that are defined in PeopleSoft EPM.
• It applies Object Access restrictions to measure objects based on the fields that are accessed by the measure objects.
If a measure object accesses fields that are defined as metrics in PeopleSoft, then access to the measure object is allowed/disallowed depending on whether or not the user can access the referenced metrics in PeopleSoft. If a user cannot access any of the metrics, then access to the measure object is denied. If the user can access all of the metrics, then access to the measure object is granted.
As an administrator, you can also limit the data that users can access from your PeopleSoft system by limiting the number of universes that are managed by the Security Bridge.
8.6.5.4 PeopleSoft response file
The Security Bridge feature of the BI Platform operates based on the settings that you specify in a response file.
Typically, you generate the response file by using the interface that is provided by the Security Bridge in configuration mode. However, because the file is a Java property file, you can also create or modify it manually.
324 2012-12-12
Authentication
This appendix provides information about the parameters that you need to include in the response file if you choose to generate it manually.
Note:
When you create the file, you must respect the Java property file escaping requirement (for example,
':' is escaped as '\:').
8.6.5.4.1 Response file parameters
The following table describes the parameters that are included in the response file:
Parameter Description
classpath
The class path for loading the necessary .jar files.
Multiple class paths must be separated by a ';' on both Windows and Unix.
The class paths that are needed are for the com.peoplesoft.epm.pf.jar
and the JDBC driver .jar files.
db.driver.name
db.connect.str
db.user.name
db.password
db.password.encrypted
enterprise.cms.name
The JDBC driver name that is used to connect to the PeopleSoft database (for example, com.microsoft.jdbc.sqlserver.SQLServerDriver).
The JDBC connection string that is used to con nect to the PeopleSoft database (for example, jdbc:microsoft:sqlserver://vanrdps ft01:1433;DatabaseName=PRDMO)
The user name for logging on to the PeopleSoft database.
The password for logging on to the PeopleSoft database.
The value for this parameter determines whether the password parameter in the response file is encrypted or not. The value can be set to either
True or False. (If no value is specified, the value becomes False by default.)
The CMS in which the universes are located.
325 2012-12-12
Authentication
Parameter
enterprise.user.name
enterprise.password
enterprise.password.encrypted
enterprise.authMethod
enterprise.role
enterprise.license
peoplesoft.role.n
Description
The user name for logging on to the CMS.
The password for logging on to the CMS.
The value for this parameter determines whether the password parameter in the response file is encrypted or not. The value can be set to either
True or False. (If no value is specified, the value becomes False by default.)
The authentication method for logging on to the
CMS.
The managed BI Platform group. (For more information, see
.)
Controls the license type when importing users from PeopleSoft. "0" sets the named user license,
"1" sets the concurrent user license.
The list of managed PeopleSoft roles. (For more information, see
n
is an integer, and each entry occupies a property with the peoplesoft.role prefix.
Note:
n
is 1 based.
You can use '*' to denote all available PeopleSoft roles, given that n is 1, and it is the only property that has peoplesoft.role as the prefix in the response file.
326 2012-12-12
Authentication
Parameter
mapped.universe.n
log4j.appender.file.File
327 log4j.*
Description
The list of universes that you want the Security
Bridge to update. (For more information, see
n
is an integer, and each entry occupies a property with the mapped.universe prefix.
Note:
n
is 1 based.
You can use '*' to denote all available universes, given that n is 1, and it is the only property that has mapped.universe as the prefix in the response file.
The log file that is written by the Security Bridge.
Default log4j properties that are required for log4j to function properly: log4j.rootLogger=INFO, file, stdout log4j.appender.file=org.apache.log4j.RollingFile
Appender log4j.appender.file.layout=org.apache.log4j.Pat
ternLayout log4j.appender.file.MaxFileSize=5000KB log4j.appender.file.MaxBackupIndex=100 log4j.appender.file.layout.ConversionPattern=%d
[ %-5 ] %c{1} - %m%n log4j.appender.stdout=org.apache.log4j.Con
soleAppender log4j.appender.stdout.layout=org.apache.log4j.Pat
ternLayout log4j.appender.stdout.layout.ConversionPat
tern=%d [ %-5 ] %c{1} - %m%n
2012-12-12
Authentication
Parameter
peoplesoft classpath enterprise.classpath
db.driver.type
sql.db.class.location
sql.db.host
sql.db.port
sql.db.database
oracle.db.class.location
oracle.db.host
oracle.db.port
oracle.db.sid
328
Description
The class path to the PeopleSoft EPM API .jar
files.
This parameter is optional.
The class path to the BI Platform SDK .jar files.
This parameter is optional.
The PeopleSoft database type. This parameter can have one of the following values:
Microsoft SQL Server 2000
Oracle Database 10.1
DB2 UDB 8.2 Fixpack 7
Custom
Custom may be used to specify databases other than the recognized types or versions.
This parameter is optional.
The location of the SQL Server JDB driver .jar
files, the SQL Server host machine, the SQL
Server port, and the SQL Server database name.
These parameter can be used only if the db.driver.type is Microsoft SQL Server 2000.
These parameters are optional.
The location of the Oracle JDBC driver .jar files, the Oracle database host machine, the Oracle database port, and the Oracle database SID.
These parameters can be used only if the db.driver.type is Oracle Database 10.1.
These parameters are optional.
2012-12-12
Authentication
Parameter
db2.db.class.location
db2.db.host
db2.db.port
db2.db.sid
custom.db.class.location
custom.db.drivername
custom.db.connectStr
Description
The location of the DB2 JDBC driver .jar files, the
DB2 database host machine, the DB2 database port, and the DB2 database SID.
These parameters can be used only if the db.driver.type is DB2 UDB 8.2 Fixpack 7
These parameters are optional.
The location, name, and connection string of the custom JDBC driver.
These parameters can be used only if the db.driver.type is Custom.
These parameters are optional.
8.7 JD Edwards authentication
8.7.1 Overview
To use your JD Edwards data with the BI platform, you must provide the system with information about your JD Edwards deployment. This information is what allows the BI platform to authenticate users so that they can use their JD Edwards EnterpriseOne credentials to log on to the BI platform.
8.7.2 Enabling JD Edwards EnterpriseOne authentication
To allow JD Edwards EnterpriseOne information to be used by the BI platform, Enterprise needs information on how to authenticate into your JD Edwards EnterpriseOne system.
329 2012-12-12
Authentication
8.7.2.1 To enable JD Edwards authentication in the BI Platform
1.
Log on as an administrator to the Central Management Console.
2.
From the Manage area, click Authentication.
3.
Double-click JD Edwards EnterpriseOne.
The "JD Edwards EnterpriseOne" page appears. It has four tabs: Options, Servers, Roles, and
User Update.
4.
On the Options tab, click Enable JD Edwards EnterpriseOne Authentication check box.
5.
Make appropriate changes under New Alias, Update Options, and New User Options according to your BI platform deployment. Click Update to save your changes before proceeding to the Systems tab.
6.
Click the Servers tab.
7.
In the "JD Edwards EnterpriseOne System User" area, type a database User name and Password for the BI platform to use to log on to your JD Edwards EnterpriseOne database.
8.
In the "JD Edwards EnterpriseOne Domain" area, enter the name, host, and port used to connect to your JD Edwards EnterpriseOne environment, enter a name for the environment and click Add.
9.
Click Update to save your changes.
8.7.3 Mapping JD Edwards EnterpriseOne roles to BI Platform
The BI platform automatically creates a group for each JD Edwards EnterpriseOne role that you map.
As well, the system creates aliases to represent the members of the mapped JD Edwards EnterpriseOne roles.
You can create a user account for each alias that is created.
However, if you run multiple systems, and your users have accounts in more than one of the systems, then you can assign each user to an alias with the same name before you create the accounts in the
BI platform.
Doing so reduces the number of accounts that are created for the same user in the BI platform.
For example, if you run a JD Edwards EnterpriseOne test environment and production environment, and 30 of your users have access to both systems, then only 30 accounts are created for those users.
If you choose not to assign each user to an alias with the same name, then 60 accounts are created for the 30 users in the BI platform.
However, if you run multiple systems, and user names overlap, then you must create a new member account for each alias that is created.
330 2012-12-12
Authentication
For example, if you run your test environment with a user account for Russell Aquino (user name
"raquino"), and you run the production environment with a user account for Raoul Aquino (user name
"raquino"), then you need to create a separate account for each user's alias. If you do not, the two users are added to the same BI platform account, and they will not be able to log on to the BI platform with their own JD Edwards EnterpriseOne credentials.
8.7.3.1 To map a JD Edwards EnterpriseOne role
1.
Log on as an administrator to the Central Management Console.
2.
From the "Manage" area, click Authentication.
3.
Double-click JD Edwards EnterpriseOne.
4.
In the New Alias Options area, select one of the following options:
•
Assign each added alias to an account with the same name
Select this option if you run multiple JD Edwards EnterpriseOne systems with users who have accounts on more than one system (and no two users have the same user name for different systems).
•
Create a new account for every added alias
Select this option if you run only one JD Edwards EnterpriseOne, if the majority of your users have accounts on only one of your systems, or if the user names overlap for different users on two or more of your systems.
5.
In the Update Options area, select one of the following options:
•
New aliases will be added and new users will be created
Select this option to create a new alias for every user that is mapped to BI platform. New accounts are added for users without BI platform accounts or for all users if you selected the Create a new account for every added alias option.
•
No new aliases will be added and new users will not be created
Select this option if the role that you want to map contains many users, but only a few of them will use BI platform. The system does not automatically create aliases and accounts for the users.
Instead, it creates aliases (and accounts, if required) only for users when they log on to BI platform for the first time. This is the default option.
6.
In the New User Options area specify how new users are created.
Select one of the following options:
•
New users are created as named users.
New user accounts are configured to use named user licenses. Named user licenses are associated with specific users and allow people to access the system based on their user name and password. This provides named users with access to the system regardless of how many
331 2012-12-12
Authentication other people are connected. You must have a named user license available for each user account created using this option.
•
New users are created as concurrent users.
New user accounts are configured to use concurrent user licenses. Concurrent licenses specify the number of people who can connect to BI platform at the same time. This type of licensing is very flexible because a small concurrent license can support a large user base. For example, depending on how often and how long users access BI platform, a 100 user concurrent license could support 250, 500, or 700 users.
The roles that you selected now appear as groups in BI platform.
7.
Click the Roles tab.
8.
Under Select a Server, select the JD Edwards server that contains the roles you want to map.
9.
Under "Imported Roles", select the roles you want to map to BI platform and click <.
10.
Click Update.
The roles will be mapped to BI platform.
8.7.3.2 Remapping consideration
If you add users to a role that has already been mapped to the BI platform, you need to remap the role to add the users to the BI platform. When you remap the role, the option to map users as either named users or concurrent users affects only the new users that you added to the role.
For example, you first map a role to the BI platform with the "New users are created as named users" option selected. Later, you add users to the same role and remap the role with the "New users are created as concurrent users" option selected.
In this situation, only the new users in the role are mapped to the BI platform as concurrent users; the users that were already mapped remain named users. The same condition applies if you first map users as concurrent users, and then you change the settings to remap new users as named users.
8.7.3.3 To unmap a role
1.
Log on as an administrator to the Central Management Console.
2.
From the "Manage " area, click Authentication.
3.
Click the tab for JD Edwards EnterpriseOne.
4.
In the "Roles" area, select the role that you want to remove, and click <.
5.
Click Update.
332 2012-12-12
Authentication
Members of the role will no longer be able to access the BI platform, unless they have other accounts or aliases.
Note:
You can also delete individual accounts or remove users from roles before you map them to the BI platform to prevent specific users from logging on.
8.7.4 Scheduling user updates
To ensure changes to your user data for your ERP system are reflected in your BI platform user data, you can schedule regular user updates. These updates will automatically synchronize your ERP and
BI platform users according to the mapping settings you have configured in the Central Management
Console (CMC).
There are two options for running and scheduling updates for imported roles:
• Update roles only: using this option will update only the links between the currently mapped roles that have been imported in BI platform. Use this option if you expect to run frequent updates, and you are concerned about system resource usage. No new user accounts will be created if you only update roles.
• Update roles and aliases: this option not only updates links between roles but will also create new user accounts in BI platform for new user aliases added to the ERP system.
Note:
If you have not specified to automatically create user aliases for updates when you enabled authentication, no accounts will be created for new aliases.
333
8.7.4.1 To schedule user updates
After you map roles into BI platform, you need to specify how the system updates these roles.
1.
Click the User Update tab.
2.
Click Schedule in either the "Update Roles Only" or "Update Roles and Aliases" sections.
Tip:
If you want to run an update immediately click Update Now.
Tip:
Use the "Update Roles Only" option if you would like frequent updates and are concerned about system resources. It takes the system longer to update both roles and aliases.
The "Recurrence" dialog box appears.
3.
Select an option from the "Run Object" list and provide all the requested scheduling information.
2012-12-12
Authentication
When scheduling an update, you can choose from the recurrence patterns summarized in the following table:
Recurrence pattern
Hourly
Daily
Weekly
Monthly
Nth Day of Month
1st Monday of Month
Description
The update will run every hour. You specify at what time it will start, as well as a start and end date.
The update will run every day or run every number of specified days. You can specify at what time it will run, as well as a start and end date.
The update will run every week. It can be run once a week or several times a week. You can specify on which days and at what time it will run, as well as a start and end date.
The update will run every month or every several months. You can what time it will run, as well as a start and end date.
The update will run on a specific day in the month. You can specify on which day of the month, what time it will run, as well as a start and end date.
The update will run on the first Monday of each month. You can specify what time it will run, as well as a start and end date.
Last Day of Month
X Day of Nth Week of the Month
The update will run on the last day of each month. You can specify what time it will run, as well as a start and end date.
The update will run on a specified day of a specified week of the month. You can specify what time it will run, as well as a start and end date.
Calendar
The update will run on the dates specified in a calendar that has previously been created.
4.
Click Schedule after you have finished providing the scheduling information.
The date of the next scheduled role update is displayed in the User Update tab.
Note:
You can always cancel the next scheduled update by clicking Cancel Scheduled Updates in either the "Update Roles Only" or "Update Roles and Aliases" sections.
8.8 Siebel authentication
334 2012-12-12
Authentication
8.8.1 Enabling Siebel authentication
To allow Siebel information to be used by the BI platform, it needs information on how to authenticate into your Siebel system.
8.8.1.1 To enable Siebel authentication in the BI Platform
1.
Log on as an administrator to the Central Management Console.
2.
From the Manage area, click Authentication.
3.
Double-click Siebel.
The "Siebel" page appears. It has four tabs: Options, Systems, Responsibilities, and User Update.
4.
On the Options tab, select the Enable Siebel Authentication check box.
5.
Make appropriate changes under New Alias, Update Options, and New User Options according to your BI platform deployment. Click Update to save your changes before proceeding to the Systems tab.
6.
Click the Domains tab.
7.
In the Domain Name field enter the domain name for the Siebel system you want to connect to.
8.
Under Connection enter the connection string for that domain.
9.
In the Username area, type a database User name and Password for the BI platform to use to log on to your Siebel database.
10.
In the Password area, enter the password for the user you have selected.
11.
Click Add to add the system information to your "Current Domains" list.
12.
Click Update to save your changes.
8.8.2 Mapping roles to BI platform
The BI platform automatically creates a group for each Siebel role that you map. As well, the program creates aliases to represent the members of the mapped Siebel roles.
You can create a user account for each alias that is created.
However, if you run multiple systems, and your users have accounts in more than one of the systems, then you can assign each user to an alias with the same name before you create the accounts in the
BI platform.
335 2012-12-12
Authentication
Doing so reduces the number of accounts that are created for the same user in the program.
For example, if you run a Siebel eBusiness test environment and production environment, and 30 of your users have access to both systems, then only 30 accounts are created for those users. If you choose not to assign each user to an alias with the same name, then 60 accounts are created for the
30 users in the BI platform.
However, if you run multiple systems, and user names overlap, then you must create a new member account for each alias that is created.
For example, if you run your test environment with a user account for Russell Aquino (user name
"raquino"), and you run the production environment with a user account for Raoul Aquino (user name
"raquino"), then you need to create a separate account for each user's alias. If you do not, the two users are added to the same account, and they will not be able to log on to the BI platform with their own
Siebel eBusiness credentials.
336
8.8.2.1 To map a Siebel eBusiness role to BI Platform
1.
Log on as an administrator to the Central Management Console.
2.
Click Authentication.
3.
Double-click Siebel eBusiness.
4.
In the New Alias Options area, select one of the following options:
•
Assign each added alias to an account with the same name
Select this option if you run multiple Siebel eBusiness systems with users who have accounts on more than one system (and no two users have the same user name for different systems).
•
Create a new account for every added alias
Select this option if you run only one Siebel eBusiness, if the majority of your users have accounts on only one of your systems, or if the user names overlap for different users on two or more of your systems.
5.
In the Update Options area, select one of the following options:
•
New aliases will be added and new users will be created
Select this option to create a new alias for every user that is mapped to the BI platform. New accounts are added for users without BI platform accounts or for all users if you selected the
Create a new account for every added alias option.
•
No new aliases will be added and new users will not be created
Select this option if the role that you want to map contains many users, but only a few of them will use the BI platform. The program does not automatically create aliases and accounts for the users. Instead, it creates aliases (and accounts, if required) only for users when they log on to the BI platform for the first time. This is the default option.
6.
In the New User Options area specify how new users are created.
2012-12-12
Authentication
Select one of the following options:
•
New users are created as named users.
New user accounts are configured to use named user licenses. Named user licenses are associated with specific users and allow people to access the system based on their user name and password. This provides named users with access to the system regardless of how many other people are connected. You must have a named user license available for each user account created using this option.
•
New users are created as concurrent users.
New user accounts are configured to use concurrent user licenses. Concurrent licenses specify the number of people who can connect to the BI platform at the same time. This type of licensing is very flexible because a small concurrent license can support a large user base. For example, depending on how often and how long users access the BI platform, a 100 user concurrent license could support 250, 500, or 700 users.
7.
Click the Roles tab.
8.
Select the domain that corresponds to the Siebel server you want to map roles for.
9.
Under "Available roles", select the roles you want to map and click >.
Note:
You can use the Search Roles Begin With: field to narrow your search if you have a large number of roles. Enter the characters that the role or roles begin with followed by the wildcard (%) character, and click Search.
10.
Click Update.
The roles will be mapped to the BI platform.
8.8.2.2 Remapping consideration
To enforce group and user synchronization between the BI platform and Siebel, set the Force user
synchronization.
Note:
In order to select Force user synchronization you must first select New aliases will be added and
new users will be created.
When you remap the role, the option to map users as either named users or concurrent users affects only the new users that you added to the role.
For example, you first map a role to the BI platform with the "New users are created as named users" option selected. Later, you add users to the same role and remap the role with the "New users are created as concurrent users" option selected.
337 2012-12-12
Authentication
In this situation, only the new users in the role are mapped to the BI platform as concurrent users; the users that were already mapped remain named users. The same condition applies if you first map users as concurrent users, and then you change the settings to remap new users as named users.
8.8.2.3 To unmap a role
1.
Log on as an administrator to the Central Management Console.
2.
From the "Manage" area, click Authentication.
3.
Double-click Siebel.
4.
On the Domains tab select the Siebel domain that corresponds to the role or roles you want to unmap.
5.
In the Roles tab select the role that you want to remove, and click <.
6.
Click Update.
Members of the responsibility will no longer be able to access the BI platform, unless they have other accounts or aliases.
Note:
You can also delete individual accounts or remove users from roles before you map them to the BI platform to prevent specific users from logging on.
8.8.3 Scheduling user updates
To ensure changes to your user data for your ERP system are reflected in your BI platform user data, you can schedule regular user updates. These updates will automatically synchronize your ERP and
BI platform users according to the mapping settings you have configured in the Central Management
Console (CMC).
There are two options for running and scheduling updates for imported roles:
• Update roles only: using this option will update only the links between the currently mapped roles that have been imported in BI platform. Use this option if you expect to run frequent updates, and you are concerned about system resource usage. No new user accounts will be created if you only update roles.
• Update roles and aliases: this option not only updates links between roles but will also create new user accounts in BI platform for new user aliases added to the ERP system.
Note:
If you have not specified to automatically create user aliases for updates when you enabled authentication, no accounts will be created for new aliases.
338 2012-12-12
Authentication
339
8.8.3.1 To schedule user updates
After you map roles into BI platform, you need to specify how the system updates these roles.
1.
Click the User Update tab.
2.
Click Schedule in either the "Update Roles Only" or "Update Roles and Aliases" sections.
Tip:
If you want to run an update immediately click Update Now.
Tip:
Use the "Update Roles Only" option if you would like frequent updates and are concerned about system resources. It takes the system longer to update both roles and aliases.
The "Recurrence" dialog box appears.
3.
Select an option from the "Run Object" list and provide all the requested scheduling information.
When scheduling an update, you can choose from the recurrence patterns summarized in the following table:
Recurrence pattern
Hourly
Daily
Weekly
Monthly
Nth Day of Month
1st Monday of Month
Last Day of Month
Description
The update will run every hour. You specify at what time it will start, as well as a start and end date.
The update will run every day or run every number of specified days. You can specify at what time it will run, as well as a start and end date.
The update will run every week. It can be run once a week or several times a week. You can specify on which days and at what time it will run, as well as a start and end date.
The update will run every month or every several months. You can what time it will run, as well as a start and end date.
The update will run on a specific day in the month. You can specify on which day of the month, what time it will run, as well as a start and end date.
The update will run on the first Monday of each month. You can specify what time it will run, as well as a start and end date.
The update will run on the last day of each month. You can specify what time it will run, as well as a start and end date.
2012-12-12
Authentication
Recurrence pattern
Calendar
Description
X Day of Nth Week of the Month
The update will run on a specified day of a specified week of the month. You can specify what time it will run, as well as a start and end date.
The update will run on the dates specified in a calendar that has previously been created.
4.
Click Schedule after you have finished providing the scheduling information.
The date of the next scheduled role update is displayed in the User Update tab.
Note:
You can always cancel the next scheduled update by clicking Cancel Scheduled Updates in either the "Update Roles Only" or "Update Roles and Aliases" sections.
8.9 Oracle EBS authentication
8.9.1 Enabling Oracle EBS authentication
To allow Oracle EBS information to be used by BI platform the system needs information on how to authenticate into your Oracle EBS system.
340
8.9.1.1 To enable Oracle E-Business Suite authentication
1.
Log on as an administrator to the Central Management Console.
2.
From the Manage area, click Authentication.
3.
Click Oracle EBS.
The "Oracle EBS" page appears. It has four tabs: Options, Systems, Responsibilities, and User
Update.
4.
On the Options tab, select the Oracle EBS Authentication is enabled check box.
5.
Make appropriate changes under New Alias, Update Options, and New User Options according to your BI platform deployment. Click Update to save your changes before proceeding to the Systems tab.
2012-12-12
Authentication
6.
Click the Systems tab.
7.
In the "Oracle EBS System User" area, type a database User name and Password for BI platform to use to log on to your Oracle E-Business Suite database.
8.
In the "Oracle EBS Services" area, enter the service name used by your Oracle EBS environment and click Add.
9.
Click Update to save your changes.
You now need to map Oracle EBS roles into the system.
Related Topics
•
To map Oracle E-Business Suite roles
8.9.2 Mapping Oracle E-Business Suite roles to BI platform
BI platform automatically creates a group for each Oracle E-Business Suite (EBS) role that you map.
The system also creates aliases to represent the members of the mapped Oracle E-Business Suite roles.
You can create a user account for each alias that is created. However, if you run multiple systems and your users have accounts in more than one of the systems, then you can assign each user to an alias with the same name before you create the accounts in BI platform
Doing so reduces the number of accounts that are created for the same user in the system.
For example, if you run a EBS test environment and production environment, and 30 of your users have access to both systems, then only 30 accounts are created for those users. If you choose not to assign each user to an alias with the same name, then 60 accounts are created for the 30 users in BI platform.
However, if you run multiple systems, and user names overlap, then you must create a new member account for each alias that is created.
For example, if you run your test environment with a user account for Russell Aquino (user name
"raquino"), and you run the production environment with a user account for Raoul Aquino (user name
"raquino"), then you need to create a separate account for each user's alias. Otherwise, the two users are added to the same BI platform account; they will be able to log on to the system with their own
Oracle EBS credentials and have access to data from both EBS environments.
8.9.2.1 To map Oracle E-Business Suite roles
1.
Log on as an administrator to the Central Management Console.
2.
From the Manage area, click Authentication.
341 2012-12-12
Authentication
3.
Click Oracle EBS.
The "Oracle EBS" page displays the Options tab.
4.
In the "New Alias Options" area, select one of the following options:
•
Assign each added Oracle EBS alias to an account with the same name
Select this option if you run multiple Oracle E-Business Suite systems with users who have accounts on more than one system (and if no two users have the same user name for different systems).
•
Create a new account for every added Oracle EBS alias
Select this option if you run only one Oracle E-Business Suite, if the majority of your users have accounts on only one of your systems, or if the user names overlap for different users on two or more of your systems.
5.
In the "Update Options" area, select one of the following options:
•
New aliases will be added and new users will be created
Select this option to create a new alias for every user that is mapped to BI platform. New accounts are added for users without BI platform accounts or for all users if you selected the Create a new
account for every added Oracle EBS alias option.
•
No new aliases will be added and new users will not be created
Select this option if the role that you want to map contains many users, but only a few of them will use BI platform. The platform does not automatically create aliases and accounts for the users. Instead, it creates aliases (and accounts, if required) only for users when they log on to
BI platform for the first time. This is the default option.
6.
In "New User Options" specify how new users are created, and then click Update.
Select one of the following options:
•
New users are created as named users.
New user accounts are configured to use named user licenses. Named user licenses are associated with specific users and allow people to access the system based on their user name and password. This provides named users with access to the system regardless of how many other people are connected. You must have a named user license available for each user account created using this option.
•
New users are created as concurrent users.
New user accounts are configured to use concurrent user licenses. Concurrent licenses specify the number of people who can connect to BI platform at the same time. This type of licensing is very flexible because a small concurrent license can support a large user base. For example, depending on how often and how long users access the platform, a 100 user concurrent license could support 250, 500, or 700 users.
The roles that you selected now appear as groups in BI platform.
7.
Click the Responsibilities tab.
342 2012-12-12
Authentication
343
8.
Select Force user synchronization if you want to synchronize Oracle EBS user account information after you click Update in the Responsibilities tab.
9.
Under Current Oracle EBS Services, select the Oracle EBS service that contains the roles you want to map.
10.
You can specify filters for Oracle EBS users under "Mapped Oracle EBS Roles".
a.
Select which applications users can use for the new role from the Application list.
b.
Select what Oracle applications, functions, reports, and concurrent programs the user can run in the Responsibility list.
c.
Select which security group the new role is assigned to in the Security group in the Security
Group
d.
Use the Add and Delete buttons under "Current Role" to modify the security group assignments for the role.
11.
Click Update.
The roles will be mapped to BI platform.
After you map roles into BI platform you need to specify how the system updates these roles.
8.9.2.1.1 Updating Oracle EBS roles and users
After enabling Oracle EBS authentication, it is necessary to schedule and run regular updates on mapped roles that have been imported into BI platform. This will ensure that updated Oracle EBS role information is accurately reflected in the BI platform.
There are two options for running and scheduling updates for Oracle EBS roles:
• Update roles only: using this option will only update the links between the currently mapped roles that have been imported in BI platform. It is recommended that you use this option if you expect to run frequent updates, and you have concerns over system resource usage. No new user accounts will be created if you only update Oracle EBS roles.
• Update roles and aliases: this option not only updates links between roles but will also create new user accounts in BI platform for user aliases added to roles in the Oracle EBS system.
Note:
If you have not specified to automatically create user aliases for updates when you enabled Oracle
EBS authentication, no accounts will be created for new aliases.
8.9.2.1.2 To schedule updates for Oracle EBS roles
After you map roles into BI platform you need to specify how the system updates these roles.
1.
Click the User Update tab.
2.
Click Schedule in either the "Update Roles Only" or "Update Roles and Aliases" sections.
Tip:
If you want to immediately run an update click Update Now.
Tip:
Use the "Update Roles Only" option if you would like frequent updates and have concerns about system resources. It takes the system longer to update both roles and aliases.
2012-12-12
Authentication
The "Recurrence" dialog box appears.
3.
Select an option from the" Run Object" pull-down list and provide all the requested scheduling information in the fields provided.
When scheduling an update, you can choose from the recurrence patterns summarized in the following table:
Recurrence pattern
Hourly
Daily
Weekly
Monthly
Nth Day of Month
1st Monday of Month
Description
The update will run every hour. You specify at what time it will start, as well as a start and end date.
The update will run every day or every number of specified days. You can specify at what time it will run, as well as a start and end date.
The update will run every week. It can run once a week or several times a week. You can specify on which days and at what time it will run, as well as a start and end date.
The update will run every month or every several months. You can what time it will run, as well as a start and end date.
The update will run on a specific day in the month. You can specify on which day of the month, what time it will run, as well as a start and end date.
The update will run on the first Monday of each month. You can specify what time it will run, as well as a start and end date.
Last Day of Month
X Day of Nth Week of the Month
The update will run on the last day of each month. You can specify what time it will run, as well as a start and end date.
The update will run on a specified day of a specified week of the month. You can specify what time it will run, as well as a start and end date.
Calendar
The update will run on the dates specified in a calendar that has previously been created.
4.
Click Schedule after you have finished providing the scheduling information.
The date of the next scheduled role update is displayed in the User Update tab.
Note:
You can always cancel the next scheduled update by clicking Cancel Scheduled Updates in either the "Update Roles Only" or "Update Roles and Aliases" sections.
344 2012-12-12
Authentication
8.9.3 Unmapping roles
To prevent specific user groups from logging on to BI platform, you can unmap the roles to which they belong.
8.9.3.1 To unmap a role
1.
Log on as an administrator to the Central Management Console.
2.
From the Manage area, click Authentication.
3.
Double-click the name of the ERP system you want to unmap roles for.
The ERP system page displays the Options tab.
4.
Click the Responsibilities or Roles tab.
5.
Select the target role from the Imported Roles area and click < or Delete to remove them.
6.
Click Update.
Members of the role will no longer be able to access BI platform, unless they have other accounts or aliases.
Note:
You can also delete individual accounts or remove users from roles before you map them to BI platform to prevent specific users from logging on.
8.9.4 Customizing rights for mapped Oracle EBS groups and users
When you map roles to BI platform, you can set rights or grant permissions for the groups and users that are created.
345
8.9.4.1 To assign administration rights
To allow users to maintain BI platform, you must make them members of the default Administrator's group. Members of this group receive full control over all aspects of the system, which includes accounts, servers, folders, objects, settings, and so on.
2012-12-12
Authentication
1.
Log on as an administrator to the Central Management Console.
2.
From the "Organize" area, click Users.
3.
In the Name column, click Administrators.
4.
Click Group List, and then from the Actions list, click Add.
The Available Users/Groups page appears.
5.
From the User List or Group List area, select the mapped role to which you want to assign administrative rights.
6.
Click > to make the role a subgroup of the Administrators group, and click OK.
Members of the role now have administration rights in BI platform.
Note:
You can also create a role within Oracle EBS, add the appropriate users to the role, map the role to BI platform, and make the mapped role a subgroup of the default Administrator's group to grant members of the role administrative rights.
8.9.4.2 To assign publishing rights
If your system has users who are designated as content creators within your organization, you can grant them permission to publish objects to BI platform.
1.
Log on as an administrator to the Central Management Console.
2.
From the "Organize" area, click Folders.
3.
Go to the folder where you want to allow users to add objects.
4.
Click Manage, Top-Level Security and then All Folders.
5.
Click Add Principals.
The Add Principals page appears.
6.
In the Available users/groups list, select the group that includes the members to whom you want to give publishing rights.
7.
Click > to enable the group to access the folder, and then click Add & Assign Security.
The Assign Security page appears.
8.
In the Available Access Level list, select the access level you want and click > to explicitly assign the access level.
9.
If the Inherit from Parent Folder and Inherit from Parent Group options are selected, deselect them, and click Apply.
10.
Click OK.
Members of the role now have permission to add objects to the folder and all of its subfolders. To remove assigned permissions, click Remove Access.
346 2012-12-12
Authentication
8.9.5 Configuring Single Sign-on (SSO) for SAP Crystal Reports and Oracle EBS
By default, BI platform will be configured to allow SAP Crystal Reports users to access Oracle EBS data using Single Sign-on (SSO).
8.9.5.1 To deactivate SSO for Oracle EBS and SAP Crystal Reports
1.
In the Central Management Console (CMC), click Applications.
2.
Double-click Crystal Reports Configuration.
3.
Click Single Sign-On Options.
4.
Select crdb_oraapps.
5.
Click Remove.
6.
Click Save & Close.
7.
Restart SAP Crystal Reports.
8.9.5.2 To reactivate SSO for Oracle EBS and SAP Crystal Reports
Follow the steps below to reactivate SSO for Oracle EBS and SAP Crystal Reports.
1.
In the Central Management Console (CMC), click Applications.
2.
Double-click Crystal Reports Configuration.
3.
Click Single Sign-On Options.
4.
Under "Use SSO context for database logon" type crdb_oraapps.
5.
Click Add.
6.
Click Save & Close.
7.
Restart SAP Crystal Reports.
347 2012-12-12
Authentication
348 2012-12-12
Server Administration
Server Administration
9.1 Working with the Servers management area in the CMC
The Servers management area of the CMC is your primary tool for server management tasks. It provides a list of all of the servers in your deployment. For most management and configuration tasks, you need to select a server in the list and choose a command from the Manage or Action menu.
About the navigation tree
The navigation tree on the left side of the Servers management area provides a number of ways to view the Servers list. Select items in the navigation tree to change the information displayed in the
"Details" pane.
Navigation tree option Description
Servers List
Displays a complete list of all servers in the deployment.
Server Groups List
Server Groups
Nodes
Displays a flat list of all available server groups in the Details pane. Select this option if you want to configure a server group's settings or security.
Lists the server groups and the servers within each server group. When you select a server group, its servers and server groups are displayed in the Details pane in a hierarchical view.
Displays a list of the nodes in your deployment.
Nodes are configured in the CCM. You can select a node by clicking it to view or manage the servers on the node.
349 2012-12-12
Server Administration
Navigation tree option
350
Service Categories
Server Status
Description
Provides a list of the types of services that may be in your deployment. Service categories are divided into core SAP BusinessObjects Business
Intelligence platform services and services associated with specific SAP Business Objects components. Service categories include:
•
Connectivity Services
•
Core Services
•
Crystal Reports Services
•
Data Federation Services
•
Lifecycle Management Services
•
Analysis Services
•
Web Intelligence Services
•
Dashboards Services
Select a service category in the navigation list to view or manage the servers in the category.
Note:
A server may host services belonging to multiple service categories. Therefore a server can appear in several service categories.
Displays the servers according to their current status. This is a valuable tool for checking to see which of your servers are running or stopped. If you are experiencing slow performance on the system, for example, you can use the" Server
Status" list to quickly determine if any of your servers are in an abnormal state. Possible server states include the following:
•
Stopped
•
Starting
•
Initializing
•
Running
•
Stopping
•
Started with Errors
•
Failed
•
Waiting for resources
2012-12-12
Server Administration
About the Details pane
Depending on which options you have selected in the navigation tree, the "Details" pane on the right side of the Servers management area shows a list of servers, server groups, states, categories, or nodes. The following table describes the information listed for servers in the "Details" pane.
Note:
For nodes, server groups, categories, and states, the "Details" pane usually shows names and descriptions.
Details pane column Description
Server Name or Name
Displays the name of the server.
State
Displays the current status of the server. You can sort by server state using the "Server Status" list in the navigation tree. Possible server states include the following:
•
Stopped
•
Starting
•
Initializing
•
Running
•
Stopping
•
Started with Errors
•
Failed
•
Waiting for resources
Enabled
Stale
Kind
Host Name
Health
Displays whether the server is enabled or disabled.
If the server is marked as Stale, then it requires a restart. For example, if you change certain server settings in the server's "Properties" screen, you may need to restart the server before the changes will take effect.
Displays the type of server.
Displays the Host Name for the server.
Indicates the general health of the server.
351 2012-12-12
Server Administration
Details pane column
PID
Description
Date Modified
Description
Displays the unique Process ID number for the server.
Displays a description of the server. You can change this description in the server's "Properties" page.
Displays the date that the server was last modified, or when the server's state was changed. This column is very useful if you want to check the status of recently changed servers.
Related Topics
•
•
•
•
Starting, stopping, and restarting servers
•
To change a server's properties
9.2 Managing servers by using scripts on Windows
The ccm.exe executable lets you start, stop, restart, enable, and disable the servers in your Windows deployment through the command line.
Related Topics
•
9.3 Managing servers on Unix
The ccm.sh executable lets you start, stop, restart, enable, and disable the servers in your Unix deployment through the command line.
352 2012-12-12
Server Administration
Related Topics
•
9.4 Managing License keys
This section describes how to manage license keys for your BI platform deployment.
Related Topics
•
•
•
To view current account activity
9.4.1 To view license information
The License Keys management area of the CMC identifies the number of concurrent, named, and processor licenses that are associated with each key.
1.
Go to the License Keys management area of the CMC.
2.
Select a license key.
The details associated with the key appear in the License Key Information area. To purchase additional license keys, contact your SAP sales representative.
Related Topics
•
•
•
To view current account activity
9.4.2 To add a license key
If you are upgrading from a trial version of the product, be sure to delete the Evaluation key prior to adding any new license keys or product activation keycodes.
353 2012-12-12
Server Administration
Note:
If you have received new license keys following a change in the way your organization implements BI platform licenses, you must delete all previous license keys from the system to maintain complaince.
1.
Go to the License Keys management area of the CMC.
2.
Type the key in the Add Key field.
3.
Click Add.
The key is added to the list.
Related Topics
•
•
To view current account activity
9.4.3 To view current account activity
1.
Go to the Settings management area of the CMC.
2.
Click View global system metrics.
This section displays current license usage, along with additional job metrics.
Related Topics
•
•
•
9.5 Measuring licenses
The BusinessObjects License Measurement Tool (BOLMT) is a java command-line utility used to collect and store BI platform licensing data. The output XML document contains license deployment measurements and is sent to SAP Global License Auditing Services (GLAS) for consolidation as part of a license audit.
The system administrator installs and runs BOLMT for every BI platform cluster whenever a license audit is requested. BOLMT collects usage measurements on named and concurrent user licenses.
The administrator can specify a particular output directory for the XML document, and configure the output document to not contain any information that may be used to identify system users.
354 2012-12-12
Server Administration
9.5.1 To run a license audit
To perform a license audit, you will need administrator rights and access to the directory containing the
BOLMT.jar
file in the BI platform installation.
1.
Open a command line console.
2.
Change directories to the directory containing the java executables for your BI platform installation
By default the file is installed in the following directory:[INSTALLDIR]\SAP BusinessObjects
Enterprise XI 4.0\java\lib
3.
Execute the BOLMT.jar.
The execution command is entered in the following format: -jar BOLMT.jar [options] <outputFile>
The table below summarizes the available options:
Option
-c --cms
Description
Specifies the name identifier and port number for the Central Management Server
(CMS). Specified as cmsname:port number. By default, the CMS settings for the local host are used if this setting is not specified.
-p --pass word
Specifies the administrator account password used to connect to the CMS.
-a --auth
-s --sani tize
Specifies the authentication method to connect user to the CMS. Default method is
Enterprise specified as secEnterprise.
Specifies that the output audit document should filter out any personal information that may be used to identify users.
Note:
The output file specification is always the last argument in the command line. It is an optional setting.
If no argument is specified, the output goes to the console's standard output. You can also pipe output to script as a command line argument.
Example:
C:\Program Files (x86)\SAP
Business Objects\SAP BusinessObjects Enterprise XI 4. 0\java\lib>"C:\Program Files
(x86)\SAP Business Objects\SAP BusinessObjects Enterprise XI 4.0\win64_x64\sapjvm\bin
\java.exe" -jar BOLMT.jar --cms=mycms:6400 -uAdministrator
-p=7juujg --auth=secEnterprise --sanitize audit.xml
355 2012-12-12
Server Administration
9.6 Viewing and changing a server's status
9.6.1 Viewing the state of servers
The status of a server is its current state of operation: a server can be running, starting, stopping, stopped, failed, initializing, started with errors, or waiting for resources. To respond to SAP
BusinessObjects Business Intelligence platform requests, a server must be running and enabled. A server that is disabled is still running as a process; however, it is not accepting requests from the rest of SAP BusinessObjects Business Intelligence platform. A server that is stopped is no longer running as a process.
This section shows how to modify the state of servers by using the CMC.
Related Topics
•
•
Starting, stopping, and restarting servers
•
Enabling and disabling servers
•
Stopping a Central Management Server
•
To start a server automatically
356
9.6.1.1 To view a server's status
1.
Go to the "Servers" management area of the CMC.
The "Details" pane displays the service categories in your deployment.
2.
To view a list of servers in a given Server Group, Node, or Service Category, in the navigation tree click the server group, node, or category.
The "Details" pane displays the list of servers in your deployment. A State column that provides the status for each server in the list.
3.
If you want to view a list of all of the servers that currently have a particular status, expand the Server
Status option in the navigation tree and select the status you want.
A list of servers with the selected status appears in the Details pane.
2012-12-12
Server Administration
Note:
This can be particularly useful if you need to quickly view a list of servers that are not starting properly or have stopped unexpectedly.
9.6.2 Starting, stopping, and restarting servers
Starting, stopping, and restarting servers are common actions that you perform when you configure servers or take them offline. For example, if you want to change the name of a server, then you must first stop the server. Once you have made your changes, you start the server again to effect your changes. If you make changes to a server's configuration settings, the CMC will prompt you if you need to restart the server.
The remainder of this section tells you when a certain configuration change requires that you first stop or restart the server. However, because these tasks appear frequently, the concepts and differences are explained first, and the general procedures are provided for reference.
Action Description
Stopping a server
Starting a server
You may need to stop SAP BusinessObjects
Business Intelligence platform servers before you can modify certain properties and settings.
If you have stopped a server to configure it, you must restart it before your changes will take effect and before the server will resume processing requests.
Restarting a server
Starting a server automatically
Restarting a server is a shortcut to stopping a server completely and then starting it again. If you need to restart a server after changing a server setting, you will be prompted by the CMC.
You can set servers to start automatically when the Server Intelligence Agent starts.
357 2012-12-12
Server Administration
Action
Force Termination
Description
Stops a server immediately (whereas when you stop a server, it will stop when it has completed its current processing activities). Forcibly terminate a server only when stopping the server has failed and you need to stop the server immediately.
Tip:
When you stop (or restart) a server, you terminate the server's process, thereby stopping the server completely. Before you stop a server, it is recommended that you
• Disable the server so it can finish processing any jobs it has in progress, and
• Ensure that there are no auditing events remaining in the queue. To view the number of auditing events remaining in the queue, navigate to the server's "Metrics" screen and view the "Current
Number of Auditing Events in the Queue" metric.
Related Topics
•
Enabling and disabling servers
9.6.2.1 To start, stop, or restart servers with CMC
1.
Go to the "Servers" management area of the CMC.
The "Details" pane displays the service categories in your deployment.
2.
To view a list of servers in a particular Server Group, Node, or Service Category, select the group, node, or category on the navigation pane.
The "Details" pane displays a list of servers.
3.
If you want to view a list of all of the servers that currently have a particular status, expand the Server
Status option in the navigation tree and select the status you want.
A list of servers with the selected status appears in the "Details" pane.
Note:
This can be particularly useful if you need to quickly view a list of servers that are not starting properly or have stopped unexpectedly.
4.
Right-click the server whose status you want to change, and depending on the action you need to perform select Start Server, Restart Server, Stop Server, or Force Termination.
358 2012-12-12
Server Administration
Related Topics
•
9.6.2.2 To start, stop, or restart a Windows server with the CCM
1.
In the CCM, click the Manage Servers button on the toolbar.
2.
When prompted, log on to your CMS with an administrative account.
3.
In the "Manage Servers" dialog box, select the server that you want to start, stop, or restart.
4.
Click Start, Stop, Restart, or Force Terminate.
5.
Click Close to return to the CCM.
9.6.2.3 To start a server automatically
By default, servers in your deployment are started automatically when the Server Intelligence Agent
(SIA) starts. This procedure shows where to set this option.
1.
In the Servers management area of the CMC, double-click the server that you want to start automatically.
The "Properties" screen appears.
2.
Under "Common Settings", select the Automatically start this server when the Server Intelligence
Agent starts check box, and click Save or Save & Close.
Note:
If the Automatically start this server when the Server Intelligence Agent starts check box is cleared for each CMS in the cluster, you must use the CCM to restart the system. After using the
CCM to stop the SIA, right-click the SIA and choose Properties. On the Startup tab, set Autostart to Yes, and click Save. Restart the SIA. The Autostart option is available only when the
Automatically start this server when the Server Intelligence Agent starts check box is cleared for each CMS in the cluster.
9.6.3 Stopping a Central Management Server
If your SAP BusinessObjects Business Intelligence platform installation has more than one active Central
Management Server (CMS), you can shut down a single CMS without losing data or affecting system functionality. Another CMS on the node will assume the workload of the stopped server. Clustering
359 2012-12-12
Server Administration multiple CMSs enables you to perform maintenance on each of your Central Management Servers in turn without taking Business Intelligence platform out of service.
However, if your Business Intelligence platform deployment has a single CMS, shutting it down will make the platform unavailable to your users and will interrupt the processing of reports and programs.
To avoid this problem, the Server Intelligence Agent for each node ensures that at least one CMS is running at all times. You can still stop a CMS by stopping its SIA, but before stopping the SIA, you should disable the processing servers via the CMC so that they can finish any jobs in progress before
Business Intelligence platform shuts down, because all other servers on the node will also shut down.
Note:
You may encounter situations where the CMS has been stopped and you need to restart the system from the CCM. For example, if you shut down each CMS on a node and the Automatically start this
server when the Server Intelligence Agent starts check box is cleared for each CMS in the cluster when the SIA starts, you must use the CCM to restart the system. In the CCM, right-click the SIA and choose Properties. On the Startup tab, set Autostart to Yes, and click Save. Restart the SIA. The
Autostart option is available only when the Automatically start this server when the Server
Intelligence Agent starts check box is cleared for each CMS in the cluster.
If you want to configure your system so that you can start and stop the Central Management Server in the cluster without starting and stopping other servers, put the CMS on a separate node. Create a new node and clone the CMS to the node. With the CMS on its own node, you can easily shut down the node without affecting other servers.
Related Topics
•
•
•
Clustering Central Management Servers
9.6.4 Enabling and disabling servers
When you disable an SAP BusinessObjects Business Intelligence platform server, you prevent it from receiving and responding to new SAP BusinessObjects Business Intelligence platform requests, but you do not actually stop the server process. This is useful when you want to allow a server to finish processing all of its current requests before you stop it completely.
For example, you may want to stop a Job Server before rebooting the machine it is running on. However, you want to allow the server to fulfill any outstanding report requests that are in its queue. First, you disable the Job Server so it cannot accept any additional requests. Next, go to the Central Management
Console to monitor when the server completes the jobs it has in progress. (From the "Servers" management area, right-click the server and select "Metrics".) Then, once it has finished processing current requests, you can safely stop the server.
Note:
• The CMS must be running in order for you to enable and/or disable other servers.
360 2012-12-12
Server Administration
• A CMS cannot be enabled or disabled.
9.6.4.1 To enable and disable servers with CMC
1.
Go to the "Servers" management area of the CMC.
2.
Right-click the server whose status you want to change, and depending on the action you need to perform click Enable Server or Disable Server.
9.6.4.2 To enable or disable a Windows server with the CCM
1.
In the CCM, click Manage Servers.
2.
When prompted, log on to your CMS with the credentials that provide you with administrative privileges to SAP BusinessObjects Business Intelligence platform.
3.
In the "Manage Servers" dialog box, select the server that you want to enable or disable.
4.
Click Enable or Disable.
5.
Click Close to return to the CCM.
9.7 Adding, cloning, or deleting servers
9.7.1 Adding, cloning, and deleting servers
If you want to add new hardware to SAP BusinessObjects Business Intelligence platform by installing server components on new, additional machines, run the SAP BusinessObjects Business Intelligence platform installation program from your product distribution. The setup program allows you to perform a Custom installation. During the Custom installation, specify the CMS from your existing deployment, and select the components that you want to install on the local machine. For details on custom installation options, see the SAP BusinessObjects Business Intelligence platform Installation Guide.
361 2012-12-12
Server Administration
9.7.1.1 Adding a server
You can run multiple instances of the same SAP BusinessObjects Business Intelligence platform server on the same machine. To add a server:
1.
Go to the "Servers" management area of the CMC.
2.
On the Manage menu, click New > New Server.
The "Create New Server" dialog box appears.
3.
Choose the Service Category.
4.
Choose the type of service that you need from the Select Service list, then click Next.
5.
To add an additional service to the server, select the service in the Available Additional Services list and click >.
Note:
Additional services are not available for all server types.
6.
After adding the additional services you want, click Next.
7.
If your SAP BusinessObjects Business Intelligence platform architecture is composed of multiple nodes, choose the node where you want to add the new server from the Node list.
8.
Type a name for the server in the Server Name box.
Each server on the system must have a unique name. The default naming convention is <NODE
NAME>
.<servertype> (a number is appended if there is more than one server of the same type on the same host machine).
9.
To include a description for the server, type it into the Description box.
10.
If you are adding a new Central Management Server, specify a port number in the Name Server
Port field.
11.
Click Create.
The new server appears in the list of servers in the Servers area of the CMC, but it is neither started nor enabled.
12.
Use the CMC to start and enable the new server when you want it to begin responding to SAP
BusinessObjects Business Intelligence platform requests.
Related Topics
•
•
•
•
362 2012-12-12
Server Administration
363
9.7.1.2 Cloning servers
If you want to add a new server instance to your deployment, you can clone an existing server. The cloned server retains the configuration settings of the original server. This can be particularly useful if you are expanding your deployment and want to create new server instances that use almost all of the same server configuration settings as an existing server.
Cloning also simplifies the process of moving servers between nodes. If you want to move an existing
CMS to another node, you can clone it to the new node. The cloned CMS appears on the new node and retains all of the configuration settings of the original CMS.
There are some considerations to keep in mind when cloning servers. You may not want all settings to be cloned, so it's good practice to check the cloned server to make sure it meets your needs. For example, if you clone a CMS to the same machine, make sure you change the port number settings that were copied from the original CMS to the cloned CMS.
Note:
• Before you clone servers, make sure that all machines in your deployment have the same version of SAP BusinessObjects Business Intelligence platform (and any updates, if applicable).
• You can clone servers from any machine. However, you can only clone servers to machines where the required binaries for the server are installed.
• When you clone a server, it does not necessarily mean that the new server will use the same OS credentials. The user account is controlled by the Server Intelligence Agent that the server is running under.
9.7.1.2.1 Using placeholders for server settings
Placeholders are node-level variables are used by the servers that are running on the node. Placeholders are listed on a dedicated page in the Central Management Console (CMC). When you double-click any server listed under "Servers" in the CMC, a link is provided on the left-hand navigation pane for
“Placeholders”. The "Placeholders" page lists all the available placeholder names and their associated values for the selected server. Placeholders contain read-only values and the placeholder names begin and end with the percentage character %.
Note:
You can always overwrite a placeholder setting with a specific string in the CMC Server "Properties" page.
Example:
Placeholders are useful when cloning servers. For example, multi-drive machine A has SAP
BusinessObjects Enterprise installed on C:\Program Files (x86)\SAP BusinessObjects\SAP
BusinessObjects Enterprise XI 4.0
. So the %DefaultAuditingDir% placeholder will be
2012-12-12
Server Administration
D:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise
XI 4.0\Auditing\
.
On another machine, machine B, there is only one disc drive (no drive D) and SAP BusinessObjects
Enterprise is installed on C:\Program Files (x86)\SAP BusinessObjects\SAP
BusinessObjects Enterprise XI 4.0
. In this case the %DefaultAuditingDir% placeholder will be C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects
Enterprise XI 4.0\Auditing\
To clone the Event Server from machine A to machine B, if placeholders are used for the Auditing
Temporary Directory, the placeholders will resolve themselves and the Event Server will work properly.
If no placeholders are used, the Event Server will fail unless you manually overwrite the Auditing
Temporary Directory setting.
9.7.1.2.2 To clone a server
1.
On the machine that you want to add the cloned server to, go to the "Servers" management area of the CMC.
2.
Right-click the server that you want to clone and select Clone Server.
The "Clone Server" dialog box appears.
3.
Type a name for the server (or use the default name) in the New Server Name field.
4.
If you are cloning a Central Management Server, specify a port number in the Name Server Port field.
5.
On the Clone to Node list, choose the node where you want to add the cloned server, then click
OK.
The new server appears in the "Servers" management area of the CMC.
Note:
Port number settings are also cloned. In many cases, such as cloning a CMS, you will want to change the port number to avoid port conflicts between the original server and its clone.
9.7.1.3 Deleting a server
1.
Go to the "Servers" management area of the CMC.
2.
Stop the server that you want to delete.
3.
Right-click the server and select Delete.
4.
When prompted for confirmation, click OK.
364 2012-12-12
Server Administration
9.8 Clustering Central Management Servers
9.8.1 Clustering Central Management Servers
If you have a large or mission-critical implementation of SAP BusinessObjects Business Intelligence platform, you will probably want to run several CMS machines together in a cluster. A cluster consists of two or more CMS servers working together against a common CMS system database. If a machine that is running one CMS fails, a machine with another CMS will continue to service Business Intelligence platform requests. This "high availability" support helps to ensure that Business Intelligence platform users can still access information when there is an equipment failure.
This section shows how to add a new CMS cluster member to a production system that is already up and running. When you add a new CMS to an existing cluster, you instruct the new CMS to connect to the existing CMS system database and to share the processing workload with any existing CMS machines. For information about your current CMS, go to the Servers management area of the CMC.
Before clustering CMS machines, make sure that each CMS is installed on an operating system that meets the requirements (including version level and patch level) outlined in the Product Availability
Matrix for database servers, database access methods, database drivers, and database clients. In addition, you must meet the following clustering requirements:
• For best performance, the database server that you choose to host the system database must be able to process small queries very quickly. The CMS communicates frequently with the system database and sends it many small queries. If the database server is unable to process these requests in a timely manner, Business Intelligence platform performance will be greatly affected.
• For best performance, run each CMS cluster member on a machine that has the same amount of memory and the same type of CPU.
• Configure each machine similarly:
• Install the same operating system, including the same version of operating system service packs and patches.
• Install the same version of Business Intelligence platform (including patches, if applicable).
• Ensure that each CMS connects to the CMS system database in the same manner, regardless of whether you use native or ODBC drivers. Make sure the drivers are the same on each machine and are a supported version.
• Ensure that each CMS uses the same database client to connect to its system database and that it is a supported version.
365 2012-12-12
Server Administration
• Check that each CMS uses the same database user account and password to connect to the
CMS system database. This account must have create, delete, and update rights on the system database.
• Ensure that the nodes on which each CMS is located are running under the same operating system account. (On Windows, the default is the LocalSystem account.)
• Verify that the current date and time are set correctly on each CMS machine (including settings for daylight savings time).
• Ensure that all machines in a cluster (including the machines that host the CMS) are set to the same system time. For best results, synchronize the machines to a time server (such as time.nist.gov
), or use a central monitoring solution.
• Ensure that the same WAR files are installed on all web application servers in the cluster. For more information on WAR file deployment, see the
SAP BusinessObjects Business Intelligence
Platform Installation Guide.
• Ensure that each CMS in a cluster is on the same Local Area Network.
• Out-of-Band threads (-oobthreads) are used by clustering pings and clustering notifications. Since both operations are quick (notifications are asynchronous), BI platform no longer requires multiple oobthreads and only one -oobthread is created.
If your cluster has more than eight CMS cluster members, ensure that the command line for each
CMS includes the -oobthreads <numCMS> option, where <numCMS> is the number of CMS servers in the cluster. This option ensures that the cluster can handle heavy loads. For information about configuring server command lines, see the server command lines appendix in the SAP
BusinessObjects Business Intelligence Platform Administrator Guide.
• If you want to enable auditing, each CMS must be configured to use the same auditing database and to connect to it in the same manner. The requirements for the auditing database are the same as those for the system database in terms of database servers, clients, access methods, drivers, and user IDs.
Tip:
By default, a cluster name reflects the machine host-name of the first CMS you install.
Related Topics
•
Changing the name of a CMS cluster
366
9.8.1.1 Adding a CMS to a cluster
There are several ways to add a new CMS cluster member. Follow the appropriate procedure:
• You can install a new node with a CMS on a new machine.
• If you already have a node with CMS binary files, then you can add a new CMS server from the
CMC.
2012-12-12
Server Administration
• If you already have a node with CMS binary files, you can also add a new CMS server by cloning an existing CMS server.
Note:
Back up your current CMS system database, server configuration, and the contents of your Input and
Output File Repositories before making any changes. If necessary, contact your database administrator.
Related Topics
•
Adding a new node to a cluster
•
•
•
Backing up and restoring your system
9.8.1.2 Adding a new node to a cluster
When you add a node (a node is a collection of BI platform servers managed by a single Server
Intelligence Agent), you are prompted to either create a new CMS or to cluster the node to an existing
CMS.
If you want to cluster a node to an existing CMS, you can use the installation setup program. Run the
SAP BusinessObjects Business Intelligence platform installation and setup program on the machine where you want to install a new CMS cluster member. The setup program allows you to perform a custom installation, where you specify the existing CMS whose system you want to expand and then select the components that you want to install on the local machine. In this case, specify the name of the CMS that is running on your existing system, choose to install a new CMS on the local machine, and provide the setup program with the information it needs to connect to your existing CMS system database. When the setup program installs the new CMS on the local machine, it automatically adds the server to your existing cluster.
Note:
Before you cluster a new node to an existing CMS, if the new node is a brand new server, ensure that the BI platform installation on that server is at the same patch level as the existing BI platform environment.
Related Topics
•
9.8.1.3 Adding clusters to the web application property files
367 2012-12-12
Server Administration
If you have added additional CMSs to your deployment, and you are using a Java application server, you must modify the PlatformServices.properties file in the \webapps\BOE\WEB-INF\con fig\custom directory of your web application deployment.
9.8.1.3.1 To define cluster properties for the BOE web application
1.
Access the custom folder for the BOE.war file on the computer hosting the web applications:
<INSTALLDIR>\SAP BusinessObjects Business Intelligence platform
4.0\warfiles\webapps\BOE\WEB-INF\config\custom\
.
You will have to later redeploy the modified BOE.war file.
2.
Create a new file.
Use Notepad or any other text editing utility.
3.
Specify CMS cluster properties for each cluster in your deployment.
Precede each cluster name with an @ symbol, and separate each CMS name with a comma (,).
The port number is separated from the CMS name with a colon (:). The port number is assumed to be 6400 unless it is specified.
Use the cms.clusters property to specify each cluster in your deployment. For example, cms.clusters=@samplecluster,@samplecluster2, @samplecluster3
. Use the cms.clusters.[cluster name] property to specify each CMS in the cluster. For example: cms.clusters=@samplecluster,@samplecluster2, @samplecluster3 cms.clusters.samplecluster=cmsone:6400,cmstwo cms.clusters.samplecluster2=cms3,cms4, cms5 cms.clusters.samplecluster3=aps05
4.
Save the file with the PlatformServices.properties name.
5.
Restart the web application server.
The new properties take affect only after the modified BOE web application is redeployed on the computer running the web application server. Use WDeploy to redeploy the WAR file on the web application server. For more information on using WDeploy, see the
SAP BusinessObjects Business Intelligence
Platform Web Application Deployment Guide.
9.8.1.4 Changing the name of a CMS cluster
This procedure allows you to change the name of a cluster that is already installed. After changing the name of the CMS cluster, the Server Intelligences Agent automatically reconfigures each SAP Business
Objects server so that it registers with the CMS cluster, rather than with an individual CMS.
Note:
For experienced administrators of SAP BusinessObjects Business Intelligence platform, note that you can no longer use the -ns option on the server command line to configure which CMS a server should register with. This is now handled automatically by the SIA.
368 2012-12-12
Server Administration
9.8.1.4.1 To change the cluster name on Windows
1.
Use the CCM to stop the Server Intelligence Agent for the node that contains a Central Management
Server that is a member of the cluster whose name you want to change.
2.
Right-click the Server Intelligence Agent and choose Properties.
3.
In the Properties dialog box, click the Configuration tab.
4.
Select the Change Cluster Name to check box.
5.
Type the new name for the cluster.
6.
Click OK and then restart the Server Intelligence Agent.
The CMS cluster name is now changed. All other CMS cluster members are dynamically notified of the new cluster name (although it may take several minutes for your changes to propagate across cluster members).
7.
Go to the Servers management area of the CMC and check that all of your servers remain enabled.
If necessary, enable any servers that have been disabled by your changes.
9.8.1.4.2 To change the cluster name on Unix
Use the cmsdbsetup.sh script. For reference, see the Unix Tools chapter of the SAP BusinessObjects
Business Intelligence platform Administrator Guide.
9.9 Managing server groups
Server groups provide a way of organizing your SAP BusinessObjects Business Intelligence platform servers to make them easier to manage. That is, when you manage a group of servers, you need only view a subset of all the servers on your system. More importantly, server groups are a powerful way of customizing SAP BusinessObjects Business Intelligence platform to optimize your system for users in different locations, or for objects of different types.
If you group your servers by region, you can easily set up default processing settings, recurrent schedules, and schedule destinations that are appropriate to users who work in a particular regional office. You can associate an object with a single server group, so the object is always processed by the same servers. And you can associate scheduled objects with a particular server group to ensure that scheduled objects are sent to the correct printers, file servers, and so on. Thus, server groups prove especially useful when maintaining systems that span multiple locations and multiple time zones.
If you group your servers by type, you can configure objects to be processed by servers that have been optimized for those objects. For example, processing servers need to communicate frequently with the database containing data for published reports. Placing processing servers close to the database server that they need to access improves system performance and minimizes network traffic. Therefore, if you had a number of reports that ran against a DB2 database, you might want to create a group of Processing
Servers that process reports only against the DB2 database server. If you then configured the appropriate reports to always use this Processing Server group for viewing, you would improve system performance for viewing these reports.
369 2012-12-12
Server Administration
After creating server groups, configure objects to use specific server groups for scheduling, or for viewing and modifying reports. Use the navigation tree in the Servers management area of the CMC to view server groups. The Server Groups List option displays a list of server groups in the details pane, and the Server Groups option allows you to view the servers in the group.
9.9.1 Creating a server group
To create a server group, you need to specify the name and description of the group, and then add servers to the group.
9.9.1.1 To create a server group
1.
Go to the "Servers" management area of the CMC.
2.
Choose Manage > New > Create Server Group.
The "Create Server Group" dialog box appears.
3.
In the Name field, type a name for the new group of servers.
4.
If you want to include additional information about the server group, type it in the Description field.
5.
Click OK.
6.
In the "Servers" management area, click Server Groups in the navigation tree and select the new server group.
7.
Choose Add Members from the Actions menu.
8.
Select the servers that you want to add to this group; then click > .
Tip:
Use CTRL + click to select multiple servers.
9.
Click OK.
You are returned to the "Servers" management area, which now lists all the servers that you added to the group. You can now change the status, view server metrics, and change the properties of the servers in the group.
Related Topics
•
370 2012-12-12
Server Administration
9.9.2 Working with server subgroups
Subgroups of servers provide you with a way of further organizing your servers. A subgroup is just a server group that is a member of another server group.
For example, if you group servers by region and by country, then each regional group becomes a subgroup of a country group. To organize servers in this way, first create a group for each region, and add the appropriate servers to each regional group. Then, create a group for each country, and add each regional group to the corresponding country group.
There are two ways to set up subgroups: you can modify the subgroups of a server group, or you can make one server group a member of another. The results are the same, so use whichever method proves most convenient.
9.9.2.1 To add subgroups to a server group
1.
Go to the "Servers" management area of the CMC.
2.
Click Server Groups in the navigation tree and select the server group you want to add subgroups to.
This group is the parent group.
3.
Choose Add Members from the Actions menu.
4.
Click Server Groups in the navigation tree, select the server groups that you want to add to this group, and then click >.
Tip:
Use CTRL + click to select multiple server groups.
5.
Click OK.
You are returned to the "Servers" management area, which now lists the server groups that you added to the parent group.
9.9.2.2 To make one server group a member of another
1.
Go to the "Servers" management area of the CMC.
2.
Click the group that you want to add to another group.
3.
Choose Add to Server Group from the Actions menu.
371 2012-12-12
Server Administration
4.
In the Available server groups list, select the other groups that you want to add the group to, then click >.
Tip:
Use CTRL + click to select multiple server groups.
5.
Click OK.
9.9.3 Modifying the group membership of a server
You can modify a server's group membership to quickly add the server to (or remove it from) any group or subgroup that you have already created on the system.
For example, suppose that you created server groups for a number of regions. You might want to use a single Central Management Server (CMS) for multiple regions. Instead of having to add the CMS individually to each regional server group, you can click the server's Member of link to add it to all three regions at once.
9.9.3.1 To modify a server's group membership
1.
Go to the "Servers" management area of the CMC.
2.
Right-click the server whose membership information you want to change, and select Existing
Server Groups.
In the details panel, the Available server groups list displays the groups you can add the server to. The Member of Server Groups list displays any server groups that the server currently belongs to.
3.
To change the groups that the server is a member of, use the arrows to move server groups between the lists, then click OK.
9.9.4 User access to servers and server groups
You can use rights to grant people access to servers and server groups, allowing them to perform tasks such as starting and stopping servers.
Depending on your system configuration and security concerns, you may want to limit server management to the SAP BusinessObjects Business Intelligence platform administrator. However, you may need to provide access to other people using those servers. Many organizations have a group of IT professionals dedicated to server management. If your server team needs to perform regular server maintenance
372 2012-12-12
Server Administration
373 tasks that require them to shut down and start up servers, you need to grant them rights to the servers.
You may also want to delegate SAP BusinessObjects Business Intelligence platform server administration tasks to other people. Or you may want different groups within your organization to have control over their own server management.
9.9.4.1 To grant access to a server or server group
1.
Go to the "Servers" management area of the CMC.
2.
Right-click the server or server group you want to grant access to and select User Security.
3.
Click Add Principals to add users or groups that you want to give access to the selected server or server group.
The "Add Principals" dialog box appears.
4.
Select the user or group you want to grant access to the specified server or server group, then click
>.
5.
Click Add and Assign Security.
6.
On the "Assign Security" screen, choose the security settings you want for the user or group, and click OK.
For detailed information about assigning rights, refer to the Setting Rights chapter.
9.9.4.2 Object rights for the Report Application Server
To allow users to create or modify reports over the Web through the Report Application Server (RAS), you must have RAS Report Modification licenses available on your system. You must also grant users a minimum set of object rights. When you grant users these rights to a report object, they can select the report as a data source for a new report or modify the report directly:
• View objects (or “View document instances” as appropriate)
• Edit objects
• Refresh the report's data
• Export the report's data
User must also have permission to add objects to at least one folder before they can save new reports back to SAP BusinessObjects Business Intelligence platform.
To ensure that users retain the ability to perform additional reporting tasks (such as copying, scheduling, printing, and so on), it's recommended that you first assign the appropriate access level and update your changes. Then, change the access level to Advanced, and add any of the required rights that are not already granted. For instance, if users already have View On Demand rights to a report object, you
2012-12-12
Server Administration allow them to modify the report by changing the access level to Advanced and explicitly granting the additional Edit objects right.
When users view reports through the Advanced DHTML viewer and the RAS, the View access level is sufficient to display the report, but View On Demand is required to actually use the advanced search features. The extra Edit objects right is not required.
9.10 Assessing your system's performance
9.10.1 Monitoring SAP BusinessObjects Business Intelligence platform servers
The Monitoring application provides the ability to capture the runtime and historical metrics of SAP
BusinessObjects Business Intelligence platform servers, for reporting and notification. The application helps system administrators to identify if servers are functioning normally and if the response times are as expected.
Related Topics
•
9.10.2 Analyzing server metrics
The Central Management Console (CMC) allows you to view the metrics for the servers in your system.
These metrics include general information about each machine, along with details that are specific to the type of server. The CMC also allows you to view system metrics, which include information about your product version, your CMS, and your current system activity.
Note:
You can only view the metrics for servers that are currently running.
9.10.2.1 To view server metrics
1.
Go to the "Servers" management area of the CMC.
374 2012-12-12
Server Administration
2.
Right-click the server whose metrics you want to view, and select Metrics.
The "Metrics" tab displays a list of metrics for the server.
Related Topics
•
To change a server's properties
•
About the Server Metrics Appendix
9.10.3 Viewing system metrics
The "Settings" management area of the CMC displays system metrics that provide general information about your SAP BusinessObjects Business Intelligence platform installation. The "Properties" section includes information about the product version and build. It also lists the data source, database name, and database user name of the CMS database. The "View global system metrics" section lists current account activity, along with statistics about current and processed jobs. The "Cluster" section lists the name of the CMS you are connected to, the name of the CMS cluster, and the names of other cluster members.
9.10.3.1 To view system metrics
• In the "Settings" management area of the CMC, click the arrows to expand and view settings in the
"Properties", "View global system metrics", and "Cluster", and "Hot Backup" areas.
9.10.4 Logging server activity
SAP BusinessObjects Business Intelligence platform allows you to log specific information about SAP
BusinessObjects Business Intelligence platform web activity.
• In addition, each of the SAP BusinessObjects Business Intelligence platform servers is designed to log messages to your operating system's standard system log.
• On Windows, SAP BusinessObjects Business Intelligence platform logs to the Event Log service.
You can view the results with the Event Viewer (in the Application Log).
• On Unix, SAP BusinessObjects Business Intelligence platform logs to the syslog daemon as a
User application. Each server prepends its name and PID to any messages that it logs.
375 2012-12-12
Server Administration
Each server also logs assert messages to the logging directory of your product installation. The programmatic information logged to these files is typically useful only to SAP Business Objects support staff for advanced debugging purposes. The location of these log files depends upon your operating system:
• On Windows, the default logging directory is <INSTALLDIR>\SAP BusinessObjects
Enterprise XI 4.0\Logging
.
• On Unix, the default logging directory <INSTALLDIR>/sap_bobj/logging directory of your installation.
The important point to note is that these log files are cleaned up automatically, so there will never be more than approximately 1 MB of logged data per server.
Note:
To enable logging to function on Unix machines that are hosting SAP BusinessObjects Business
Intelligence platform servers, you must set up and configure system logging so that all messages logged to the “user” facility of “info” level or higher are recorded. You must also configure SYSLOGD to accept remote logging.
Setup procedures vary from system to system. Consult your operating system documentation for specific instructions.
9.11 Configuring server settings
This section includes technical information and procedures that show how you can modify settings for
SAP BusinessObjects Business Intelligence platform servers.
The majority of the settings discussed in this section allow you to integrate SAP BusinessObjects
Business Intelligence platform more effectively with your current hardware, software, and network configurations. Consequently, the settings that you choose will depend largely upon your own requirements.
You can change server settings though the Central Management Console (CMC) in two ways.
• On "Properties" screen for the server.
• On the "Edit Common Services" screen for the server.
It is important to note that not all changes occur immediately. If a setting cannot change immediately, the "Properties" and "Edit Common Services" screens display both the current setting (in red text) and the desired setting. When you return to the Servers management area, the server will be marked as
Stale. When you restart the server, it will use the desired settings and the Stale flag is removed from the server.
Note:
This section does not show how to configure your Web application server to deploy SAP BusinessObjects
Business Intelligence platform applications. This task is typically performed when you install the product.
For details, see the
SAP BusinessObjects Business Intelligence platform Installation Guide.
376 2012-12-12
Server Administration
Related Topics
•
•
To change a server's properties
•
Recreating the CMS system database
•
Selecting a new or existing CMS database
9.11.1 To change a server's properties
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the server whose settings you want to change.
The "Properties" screen appears.
3.
Make the changes you want, then click Save or Save & Close.
Note:
Not all changes occur immediately. If a setting cannot change immediately, the Properties dialog box display both the current setting (in red text) and the desired setting. When you return to the
Servers management area, the server will be marked as Stale. When you restart the server, it will use the desired settings from the Properties dialog box and the Stale flag is removed from the server.
9.11.2 To apply service settings to multiple servers
You can apply the same setting to services that are hosted on multiple servers.
1.
Go to the "Servers" management area of the CMC.
2.
Pressing Ctrl, click each server that hosts services for which you want to change settings, and then right-click and select Edit Common Services.
The "Edit Common Services" dialog box appears, displaying a list of services hosted on the servers you selected that have settings you can change.
3.
If the "Edit Common Services" dialog box lists more than one service, select the service that you want to edit, and click Continue.
4.
Make changes to the service, and click OK.
Note:
You are redirected to the "Servers" management area of the CMC. If a server requires a restart, the server is marked as Stale. When you restart the server, it uses the new settings and the Stale flag is removed.
377 2012-12-12
Server Administration
9.11.3 Working with configuration templates
Configuration templates allow you to easily configure multiple instances of servers. Configuration templates store a list of settings for each service type, which you can use to configure additional server instances. For example, if you have a dozen Web Intelligence Processing Servers that you want to configure identically, you only need to configure settings for one of them. You can then use the configured service to define the configuration template for Web Intelligence Processing Servers, and then apply the template to the other 11 service instances.
Each type of SAP BusinessObjects Business Intelligence platform service has its own configuration template. For example, there is one configuration template for the Web Intelligence Processing service type, one for the Publishing service type, and so on. The configuration template is defined in the server properties in the Central Management Console (CMC).
When you make a server use a configuration template, existing settings for the server are overwritten with the values from the template. If you later decide to stop using the template, the original settings are not restored. Subsequent changes to the configuration template no longer affect the server.
It is good practice to use configuration templates as follows:
1.
Set the configuration template on one server.
2.
Assuming you want the same configuration on all servers of the same type, check Use Configuration
Template for all servers of the same type, including the one where you set the configuration template.
3.
Later, if you want to change the configuration of all services of this type, view the properties of any one of the services, deselect the Use Configuration Template check box. Change the settings you want, then select Set Configuration Template for this server and click Save. All services of that type are updated. By not having a server that is always set as the configuration template, you ensure that you will not accidentally change configuration settings for all servers of that type.
Related Topics
•
To set a configuration template
•
To apply a configuration template to a server
378
9.11.3.1 To set a configuration template
You can set a configuration template for each type of service. You cannot set multiple configuration templates for a service. You can use any server's "Properties" page to configure the settings that will be used by the configuration template for a service type that is hosted on the server.
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the server that hosts services whose configuration template you want to set.
The "Properties" screen appears.
2012-12-12
Server Administration
3.
Configure the service settings that you want to use in the template, select the Set Configuration
Template check box and click Save or Save & Close.
The configuration template for the service type that you selected is defined according to the settings of the current server. Other servers of the same type hosting the same services will be automatically and immediately reconfigured to match the configuration template if they have the Use Configuration
Template option enabled in their properties.
Note:
If you don't explicitly define the settings for the configuration template, the service's default settings are used.
Related Topics
•
To apply a configuration template to a server
9.11.3.2 To apply a configuration template to a server
Before you apply a configuration template, ensure that you have defined the configuration template settings for the type of server you want to apply the template to. If you haven't explicitly defined the configuration template settings, the default settings for the service are used.
Note:
Servers that do not have the Use Configuration Template setting enabled will not be updated when you modify the settings of the configuration template.
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the server that is hosting a service you want to apply the configuration template to.
The "Properties" screen appears.
3.
Select the Use Configuration Template check box and click Save or Save & Close.
Note:
If the server requires you to restart it in order for the new settings to take effect, it will show up as
"stale" in the servers list.
The appropriate configuration template is applied to the current server. Any subsequent changes to the configuration template change the configuration of all servers that use the configuration template.
Unchecking Use Configuration Template does not restore the server configuration to the values as they were when the configuration template was applied. Subsequent changes to the configuration template do not affect the configuration of the servers that are using the configuration template.
Related Topics
•
To set a configuration template
379 2012-12-12
Server Administration
9.11.3.3 To restore system defaults
You may want to restore a service's configuration to the settings it was initially installed with (for example, if you misconfigure the servers, or experience performance issues).
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the server hosting a service that you want to restore system defaults for.
The "Properties" screen appears.
3.
Select the Restore System Defaults check box and click Save or Save & Close.
The default settings for the particular service type are restored.
9.12 Configuring server network settings
The networking settings for SAP BusinessObjects Business Intelligence platform servers are managed through the CMC. These settings are divided into two categories: port settings and host identification.
Default settings
During installation, server host identifiers are set to Auto assign. Each server can however be assigned either a specific IP address or a hostname. The default CMS port number is 6400. The other SAP
BusinessObjects Business Intelligence platform servers dynamically bind to available ports. Port numbers are automatically managed by SAP BusinessObjects Business Intelligence platform, but you can use the CMC to specify port numbers.
9.12.1 Network environment options
SAP BusinessObjects Business Intelligence platform supports both Internet Protocol 6 (IPv6) and
Internet Protocol version 4 (IPv4) network traffic. You can use the server and client components in any of the following environments:
• IPv4 network: all server and client components run with IPv4 protocol only.
• IPv6 network: all server and client components run with IPv6 protocol only.
• Mixed IPv6/IPv4 network: server and client components can run with both IPv6 and IPv4 protocols.
Note:
Network configuration should be performed by the system and network administrator. SAP
BusinessObjects Business Intelligence platform does not provide a mechanism to designate a networking
380 2012-12-12
Server Administration environment. You can use the CMC to bind to a specific IPv6 or IPv4 address for any of your SAP
BusinessObjects Business Intelligence platform servers.
9.12.1.1 Mixed IPv6/IPv4 environment
The IPv6/IPv4 networking environment enables the following:
• SAP BusinessObjects Business Intelligence platform servers can service both IPv6 and IPv4 requests when running in mixed IPv6/IPv4 mode.
• Client components can interoperate with servers as IPv6-only nodes, IPv4-only nodes, or IPv6/IPv4 nodes.
The mixed mode is particularly useful in the following scenarios:
• You are moving from an IPv4-only node to an IPv6-only node environment. All the client and server components will continue to seamlessly interoperate until the transition is complete. You can then deactivate the IPv4 settings for all the servers.
• Third party software that is not IPv6 compatible will continue to function in the IPv6/IPv4 node environment.
Note:
DNS names do not resolve properly if IPv6-only node is used with Windows 2003. It is recommended that your deployment runs as both IPv6/IPv4 if IPv4 stack is disabled on Windows 2003.
9.12.2 Server host identification options
Host identification options can be specified in the CMC for every SAP BusinessObjects Business
Intelligence platform server. The following table summarizes the options available in the Common
Settings area:
381 2012-12-12
Server Administration
382
Option
Auto assign
Hostname
IP Address
Description
This is the default setting for all servers. When Auto-Assign is selected, the server automatically binds the server's Request Port onto the first network interface on the machine.
Note:
It is good practice to select the Auto-Assign check box for the Host Name setting.
However in some cases, such as when the server is running on multi-homed machine, or when the server needs to inter-operate with a certain firewall configuration, you should consider using either a specific hostname or IP address. See the information about configuring a multihomed machine and working with firewalls in the SAP BusinessObjects Business Intelligence platform Administrator Guide.
Specifies the host name of the network interface that the server listens for requests on. For the CMS, this setting specifies the host name of the network interface that the CMS binds the Name Server Port and the Request Port.
Specifies the IP address of the network interface that the server listens for requests on. For the CMS this setting specifies the address of the network interface that the CMS binds the Name Server Port and the Request Port. For every server, separate fields are provided to specify IPv4 and/or IPv6 IP addresses.
Caution:
If you specify Auto assign on a multi-homed machines, the CMS may automatically bind to the wrong network interface. To prevent this from happening, make sure the network interfaces on the host machine are listed in the correct order (using the machine's OS tools). You must also specify the Host Name setting for the CMS in the CMC.
Note:
If you are working with multi-homed machines or in certain NAT firewall configurations, you may need to specify the Host Name using fully qualified domain names instead of host names.
Related Topics
•
To configure the system for firewalls
•
Configuring a multi-homed machine
•
To troubleshoot multiple network interfaces
9.12.2.1 To modify a server's host identification
1.
Go to the "Servers" management area of the CMC.
2.
Select the server, then choose Stop Server from the Actions menu.
3.
Choose Properties from the Manage menu.
2012-12-12
Server Administration
4.
Under Common Settings, select one of the following options:
Option
Auto assign
Hostname
IP Address
Description
The server will bind to one of the available network interfaces.
Enter the host name of the network interface on which server listens for requests.
Enter in the fields provided either an IPv4 or an IPv6 IP address for the network interface on which server listens for requests.
Note:
To enable the server to operate as a dual IPv4/IPv6 node, enter a valid IP address in both fields.
5.
Click Save or Save & Close.
The changes are reflected in the command line displayed on the "Properties" tab.
6.
Start and enable the server.
9.12.3 Configuring a multi-homed machine
A multi-homed machine is one that has multiple network addresses. You may accomplish this with multiple network interfaces, each with one or more IP addresses, or with a single network interface that has been assigned multiple IP addresses.
If you have multiple network interfaces, each with a single IP address, change the binding order so that the network interface at the top of the binding order is the one you want the SAP BusinessObjects
Business Intelligence platform servers to bind to. If your interface has multiple IP addresses, use the
Host Name option in the CMC to specify a network interface card for the Business Intelligence (BI) platform server. It can be specified by host name or IP address. For information about configuring the
Host Name value, see “To troubleshoot multiple network interfaces”.
Tip:
This section shows how to restrict all servers to the same network address, but it is possible to bind individual servers to different addresses. For instance, you might want to bind the File Repository
Servers to a private address that is not routable from users' machines. Advanced configurations such as this require your DNS configuration to route communications effectively between all the BI platform server components. In this example, the DNS must route communications from the other BI platform servers to the private address of the File Repository Servers.
Related Topics
•
To troubleshoot multiple network interfaces
383 2012-12-12
Server Administration
384
9.12.3.1 To configure the CMS to bind to a network address
Note:
On a multi-homed machine, the Host Identifier can be set to the fully qualified domain name or the IP address of the interface that you want the server to bind to.
1.
Go to the Servers management area of the CMC.
2.
Double-click the CMS.
3.
Under "Common Settings", select one of the following options:
•
Hostname
• Enter the host name of the network interface to which the server will bind.
•
IP Address
• Enter in the fields provided either an IPv4 or an IPv6 IP address for the network interface to which the server will bind.
Note:
To enable the server to operate as a dual IPv4/IPv6 node, enter a valid IP address in both fields.
Caution:
Do not select Auto assign.
4.
For Request Port you can do one of the following:
• Select the Auto assign option.
• Enter a valid port number in the Request Port field.
5.
Make sure that a port number is specified in the Name Server Port dialog box.
Note:
The default port number is 6400.
9.12.3.2 Configuring the remaining servers to bind to a network address
The remaining SAP BusinessObjects Business Intelligence platform servers select their ports dynamically by default. For information on disabling the Auto assign setting that dynamically propagates this information, see “To change the port a server uses for accepting requests ”.
Related Topics
•
To change the port a server uses for accepting requests
2012-12-12
Server Administration
385
9.12.3.3 To troubleshoot multiple network interfaces
On a multi-homed machine, the CMS may automatically bind to the wrong network interface. To prevent this from happening, you can ensure the network interfaces on the host machine are listed in the correct order (using the machine's OS tools), or make sure you specify the Host Name setting for the CMS in the CMC. If the primary network interface is not routable, you can use the following procedure to configure SAP BusinessObjects Business Intelligence platform to bind to a non-primary routable network interface. Perform these steps immediately after installing SAP BusinessObjects Business Intelligence platform on the local machine, before you install SAP BusinessObjects Business Intelligence platform on other machines.
1.
Open the CCM and stop the SIA for the node on the machine that has multiple network interfaces.
2.
Right-click the SIA and choose Properties.
3.
In the "Properties" dialog box, click the "Configuration" tab.
4.
To bind the SIA to a specific network interface, type in the Port field one of the following:
• the hostname of the target network interface and port number (use the hostname:port number format)
• the IP address of the target network interface and port number (use the IP address:port number format)
5.
Click OK and select the "Startup" tab.
6.
From the "Local CMS Servers" list select the CMS and click Properties.
7.
To bind the CMS to a specific network interface, type in the Port field one of the following:
• the hostname of the target network interface and port number (use the hostname:port number format)
• the IP address of the target network interface and port number (use the IP address:port number format)
8.
Click OK to apply the new settings.
9.
Start the SIA and wait for the servers to start.
10.
Launch the Central Management Console (CMC), and go to the "Servers" management area. Repeat steps 11-14 for each server.
11.
Select the server, then choose Stop Server from the Actions menu.
12.
Choose Properties from the Manage menu.
13.
Under Common Settings, select one of the following options:
• Hostname: enter the host name of the network interface to which the server will bind.
• IP Address: enter in the fields provided either an IPv4 or an IPv6 IP address for the network interface to which the server will bind.
Note:
To enable the server to operate as a dual IPv4/IPv6 node, enter a valid IP address in both fields.
2012-12-12
Server Administration
Caution:
Do not select Auto assign.
14.
Click Save or Save & Close.
15.
Return to the CCM and restart the SIA.
The SIA restarts all servers on the node. All servers on the machine now bind to the correct network interface.
9.12.4 Configuring port numbers
During installation, the CMS is set up to use default port numbers. The default CMS port number is
6400. This port falls within the range of ports reserved by SAP Business Objects (6400 to 6410).
Communication on these ports should not conflict with third-party applications.
When started and enabled, each of the other SAP BusinessObjects Business Intelligence platform servers dynamically binds to an available port (higher than 1024), registers with this port on the CMS, and then listens for SAP BusinessObjects Business Intelligence platform requests. If necessary, you can instruct each server component to listen on a specific port (rather than dynamically selecting any available port).
Port numbers can be specified on each server's Properties tab in the CMC. This table summarizes the options under the "Common Settings" area as they relate to port usage for specific server types:
Setting
Request Port
Name Server Port
CMS Other Servers
Specifies the port that the CMS uses for accepting all requests from other servers (except for Name Server requests). Uses the same network interface as the Name Server Port.
When Auto assign is selected, the server automatically uses an OSassigned port number.
Specifies the port on which the server listens for all requests. When
Auto assign is selected, the server automatically uses a port number assigned by the OS.
Specifies the SAP BusinessObjects
Business Intelligence platform port on which the CMS listens for name service requests. The default is
6400.
Not applicable.
386 2012-12-12
Server Administration
387
9.12.4.1 To change the default CMS port in the CMC
If there is a CMS already running on the cluster, you can use the CMC to change the default CMS port number. If no CMS is running on the cluster, you must use the CCM on Windows, or the servercon fig.sh
script on Unix, to change the port number.
Note:
The CMS uses the same network interface card for the request port and the name server port.
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the CMS in the server list.
3.
Replace the Name Server Port number with the port that you want the CMS to listen on. (The default port is 6400.)
4.
Click Save & Close.
5.
Restart the CMS.
The CMS begins listening on the port number you specified. The Server Intelligence Agent dynamically propagates the new settings to the other servers on the node, if those servers have the Auto assign option selected for the request port. (It may take several minutes for your changes to appear in the
Properties settings of all node members.)
The settings you choose on the "Properties" page are reflected in the server command line, which also appears on the "Properties" page.
9.12.4.2 To change the default CMS port in the CCM on Windows
If no CMS is accessible on the cluster and you want to modify the default CMS port for one or more
CMSs in your deployment, you must use the CCM to change the CMS port number.
1.
Open the CCM and stop the SIA for the node.
2.
Right-click the SIA and choose Properties.
3.
In the "Properties" dialog box, click the "Startup" tab.
4.
From the "Local CMS Servers" list select the CMS that you want to change the port number for, and click Properties.
5.
To bind the CMS to a specific port, type in the Port field one of the following:
• port number
• the hostname and port number (use the hostname:port number format)
• the IP address and port number (use the IP address:port number format)
6.
Click OK to apply the new settings.
2012-12-12
Server Administration
7.
Start the SIA and wait for the servers to start.
9.12.4.3 To change the default CMS port in the CCM on Unix
If no CMS is accessible on the cluster and you want to modify the default CMS port for one or more
CMSs in your deployment, you must use the serverconfig.sh script to change the CMS port number.
1.
Use the ccm.sh script to stop the Server Intelligence Agent (SIA) that hosts the CMS whose port number you want to change.
2.
Run the serverconfig.sh script. By default this script is in the <InstallDir>/sap_bobj directory by default.
3.
Select 3 - Modify a node, and press Enter.
4.
Select the node that hosts the CMS that you want to modify, and press Enter.
5.
Select 4 - Modify a local CMS and press Enter.
A list of CMSs that are currently hosted on the node appears.
6.
Select the CMS that you want to modify and press Enter.
7.
Type the new port number for the CMS and press Enter.
8.
Specify whether you want the CMS to automatically start when the SIA starts and press Enter.
9.
Type the command-line arguments for the CMS, or accept the current arguments, and press Enter.
10.
Type quit to exit the script.
11.
Start the SIA with the ccm.sh script, and wait for the servers to start.
9.12.4.4 To change the port a server uses for accepting requests
Note:
These steps cannot be used to change the request port for the Central Management Server (CMS).
See “To change the port a CMS uses for accepting requests” instead.
1.
Go to the "Servers" management area of the CMC.
2.
Select the server, then choose Stop Server from the Actions menu.
3.
Double-click the server.
The "Properties" screen appears.
4.
Under "Common Settings", deselect the Auto assign check box for Request Port, then type the port number you want the server to listen on.
5.
Click Save or Save & Close.
6.
Start and enable the server.
388 2012-12-12
Server Administration
The server binds to the new port, registers with the CMS, and begins listening for SAP BusinessObjects
Business Intelligence platform requests on the new port.
9.13 Managing Nodes
9.13.1 Using nodes
A node is a group of SAP BusinessObjects Business Intelligence platform servers that run on the same host and are managed by the same Server Intelligence Agent (SIA). All servers on a node run under the same user account.
One machine can contain many nodes, so you can run processes under different user accounts.
One SIA manages and monitors all of the servers on a node, ensuring they operate properly.
Note:
You must use an Administrator account with Enterprise authentication to perform all node management procedures securely. However, if SSL communication between servers is enabled, you must disable
SSL to perform any node management procedures (by clearing the Enable SSL check box). For more information, see “To configure the SSL protocol in the CCM” in this guide.
Caution:
BI platform supports SQL Anywhere databases as ODBC data sources. Before performing node management operations with SQL Anywhere on a Unix machine, you must create an odbc.ini file and source it.
Related Topics
•
To prepare a Unix machine for SQL Anywhere
•
To configure the SSL protocol in the CCM
9.13.1.1 Variables
389 2012-12-12
Server Administration
Variable
<INSTALLDIR>
<SCRIPTDIR>
Description
The directory where SAP BusinessObjects Business Intelligence platform is installed.
On Windows: C:\Program Files (x86)\SAP BusinessObjects
The directory where node management scripts are located.
• On Windows: <INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\win64_x64\scripts
• On Unix: <INSTALLDIR>/sap_bobj/enterprise_xi40/<PLAT
FORM64>/scripts
<PLATFORM32>
<PLATFORM64>
The name of your Unix operating system. Acceptable values are:
• aix_rs6000
• linux_x86
• solaris_sparc
• win32_x86
The name of your Unix operating system. Acceptable values are:
• aix_rs6000_64
• linux_x64
• solaris_sparcv9
• win64_x64
9.13.1.2 To prepare a Unix machine for SQL Anywhere
You must create an odbc.ini file and source it before you can use SQL Anywhere as an ODBC data source on a Unix machine.
1.
Create odbc.ini in <INSTALLDIR>/sap_bobj/enterprise_xi40/<PLATFORM64>
2.
Enter the database source name (DSN), username, password, the database name and server name for SQL Anywhere, and the IP address and port number of the machine that hosts the SQL Anywhere database server.
3.
Save odbc.ini.
4.
Source odbc.ini and the SQL Anywhere database client environment on the machine that performs node management operations.
390 2012-12-12
Server Administration
Example:
A sample odbc.ini file:
[ODBC Data Sources]
SampleDatabase=SQLAnywhere 12.0
[SampleDatabase]
UID=Administrator
PWD=password
DatabaseName=SampleDatabase
ServerName=SampleDatabase
CommLinks=tcpip(host=192.0.2.0;port=2638)
Driver=/build/bo/sqlanywhere12/lib64/libdbodbc12.so
A sample source command: source /build/bo/sqlanywhere12/bin64/sa_config.sh
ODBCINI=/build/bo/aurora41_pi_bip_37/sap_bobj/enterprise_xi40/linux_x64/odbc.ini;export ODBCINI
Related Topics
•
9.13.2 Adding a new node
The installation program creates nodes when you first install SAP BusinessObjects Business Intelligence platform.
You may need additional nodes if you want to add a new machine to an existing cluster to improve the cluster's performance, or if you want to run servers under different user accounts with an existing deployment.
You can add a new node using the Central Configuration Manager (CCM), or using a node management script. If you use a firewall, ensure that the ports of your Server Intelligence Agent (SIA) and Central
Management Server (CMS) are open.
391
9.13.2.1 Adding a node to a new machine on an existing deployment
You can automatically create the first node on a machine when you use the installation program to add a new machine to an existing deployment.
2012-12-12
Server Administration
Tip:
During the installation, click Expand, and specify your existing Central Management Server.
If you want to create additional nodes, use the Central Configuration Manager or the script.
For more information on installation, see the SAP BusinessObjects Business Intelligence platform
Installation Guide.
9.13.2.2 To add a node on Windows
Caution:
Back up the server configuration for the entire cluster before and after you add a node.
1.
In the Central Configuration Manager (CCM), on the toolbar, click Add Node.
2.
In the "Add Node Wizard", enter the node name and port number for the new Server Intelligence
Agent (SIA).
3.
Choose whether you want to create servers on the new node.
•
Add node with no servers
•
Add node with CMS
•
Add node with default servers
This option creates only the servers installed on this machine. It does not include all possible servers.
4.
Select a CMS.
• If your deployment is running, select Use existing running CMS, and click Next.
If prompted, enter the host name and port number for the existing CMS, the Administrator credentials, the data source name, the credentials for the system database, and the cluster key.
• If your deployment is stopped, select Start a new temporary CMS, and click Next.
If prompted, enter the host name and port number for the temporary CMS, the Administrator credentials, the data source name, the database credentials for the system database, and the cluster key. A temporary CMS will start. (It will stop when this process finishes.)
Caution:
Avoid using the deployment while the temporary CMS runs. Ensure that the existing and temporary
CMS use different ports.
5.
Review the confirmation page, and click Finish.
The CCM creates a node. If any errors occur, review the log file.
You can now use the CCM to start the new node.
392 2012-12-12
Server Administration
393
9.13.2.2.1 Adding a node on Windows using a script
Caution:
Back up the server configuration for the entire cluster before and after you add a node.
You can use AddNode.bat to add a node on a Windows machine. For more information, see “Script parameters for adding, recreating, and deleting nodes”.
Example:
Due to the limitations of the command prompt, you must use the caret (^) to escape spaces, the equals sign (=) and the semicolon (;) in the -connect string.
<SCRIPTDIR>\AddNode.bat -name mynode2
-siaport 6415
-cms mycms:6400
-username Administrator
-password Password1
-cmsport 7400
-dbdriver mysqldatabasesubsystem
-connect "DSN^=BusinessObjects^ CMS^ 140^;UID^=username^;PWD^=Password1^;HOSTNAME^=database^;PORT^=3306"
-dbkey abc1234
-noservers
-createsms
Note:
To avoid using the caret in long strings, you can write the script's name and all of its parameters to a temporary response.bat file, and then run response.bat without any parameters.
Related Topics
•
•
Script parameters for adding, recreating, and deleting nodes
9.13.2.3 To add a node on Unix
Caution:
Back up the server configuration for the entire cluster before and after you add a node.
1.
Run <INSTALLDIR>/sap_bobj/serverconfig.sh
2.
Select 1 - Add node, and press Enter.
3.
Type the name of the new node, and press Enter.
4.
Type the port number of the new SIA, and press Enter.
5.
Choose whether you want to create servers on the new node.
•
no servers
Creates a node that does not contain any servers.
2012-12-12
Server Administration
394
•
cms
Creates a CMS on the node, but does not create other servers.
•
default servers
Creates only the servers installed on this machine. It does not include all possible servers.
6.
Select a CMS.
• If your deployment is running, select existing, and press Enter.
If prompted, enter the host name and port number for the existing CMS, the Administrator credentials, the database connection information and the credentials for the system database, and the cluster key.
• If your deployment is stopped, select temporary, and press Enter.
If prompted, enter the host name and port number for the temporary CMS, the Administrator credentials, the database connection information and the credentials for the system database, and the cluster key. A temporary CMS will start. (It will stop when this process finishes.)
Caution:
Avoid using the deployment while the temporary CMS runs. Ensure that the existing and temporary
CMS use different ports.
7.
Review the confirmation page, and press Enter.
The CCM creates a node. If any errors occur, review the log file.
You can now run <INSTALLDIR>/sap_bobj/ccm.sh -start <nodeName> to start the new node.
9.13.2.3.1 Adding a node on Unix using a script
Caution:
Back up the server configuration for the entire cluster before and after you add a node.
You can use addnode.sh to add a node on a Unix machine. For more information, see the “Script parameters for adding, recreating, and deleting nodes” section.
Example:
<SCRIPTDIR>/addnode.sh -name mynode2
-siaport 6415
-cms mycms:6400
-username Administrator
-password Password1
-cmsport 7400
-dbdriver mysqldatabasesubsystem
-connect "DSN=BusinessObjects CMS 140;UID=Administrator;PWD=Password1;HOSTNAME=myDatabase;PORT=3306"
-dbkey abc1234
-noservers
-createcms
Related Topics
•
•
Script parameters for adding, recreating, and deleting nodes
2012-12-12
Server Administration
9.13.3 Recreating a node
You can recreate a node using the Central Configuration Manager (CCM), or using a node management script, after you restore the server configuration for the entire cluster, or if the machine hosting your deployment fails, becomes damaged, or has a corrupt file system. Use the following guidelines:
• It is not necessary to recreate a node if you reinstall the deployment on a replacement machine with identical installation options and node name. The installation program automatically recreates the node.
• A node should be recreated only on a machine with an existing deployment with identical installation options and patch level.
• You should recreate only nodes that do not exist on any machines in your deployment. Ensure that no other machines host the same node.
• Although the deployment allows nodes to run on different operating systems, you should recreate nodes only on machines that use the same operating system.
• If you use a firewall, ensure that the ports of your Server Intelligence Agent (SIA) and Central
Management Server (CMS) are open.
Remember:
You can recreate a node only on the machine where the node is located.
9.13.3.1 To recreate a node on Windows
1.
In the Central Configuration Manager (CCM), on the toolbar, click Add Node.
2.
In the "Add Node Wizard", enter the node name and port number for the recreated Server Intelligence
Agent (SIA).
Note:
The names of the original and recreated nodes must be identical.
3.
Select Recreate node, and click Next.
• If the node exists in the system database of the Central Management Server (CMS), it is recreated on the local host.
Caution:
Use this option only if the node does not exist on any hosts in the cluster.
• If the node does not exist in the system database of the CMS, a new node with default servers is added. Default servers include all of the servers installed on the host.
4.
Select a CMS.
• If your CMS is running, select Use existing running CMS, and click Next.
395 2012-12-12
Server Administration
If prompted, enter the host name and port number for the existing CMS, the Administrator credentials, the data source name, the credentials for the system database, and the cluster key.
• If your CMS is stopped, select Start a new temporary CMS, and click Next.
If prompted, enter the host name and port number for the temporary CMS, the Administrator credentials, the data source name, the credentials for the system database, and the cluster key.
A temporary CMS will start. (It will stop when this process finishes.)
Caution:
Avoid using the deployment while the temporary CMS runs. Ensure that the existing and temporary
CMS use different ports.
5.
Review the confirmation page, and click Finish.
The CCM recreates the node, and adds information about the node to the local machine. If any errors occur, review the log file.
You can now use the CCM to start the recreated node.
9.13.3.1.1 Recreating a node on Windows using a script
You can use AddNode.bat to recreate a node on a Windows machine. For more information, see the
“Script parameters for adding, recreating, and deleting nodes” section.
Example:
Due to the limitations of the command prompt, you must use the caret (^) to escape spaces, the equals sign (=) and the semicolon (;) in the -connect string.
<SCRIPTDIR>\AddNode.bat -name mynode2
-siaport 6415
-cms mycms:6400
-username Administrator
-password Password1
-cmsport 7400
-dbdriver mysqldatabasesubsystem
-connect "DSN^=BusinessObjects^ CMS^ 140^;UID^=username^;PWD^=Password1^;HOSTNAME^=database^;PORT^=3306"
-dbkey abc1234
-adopt
Note:
To avoid using the caret in long strings, you can write the script's name and all of its parameters to a temporary response.bat file, and then run response.bat without any parameters.
Related Topics
•
•
Script parameters for adding, recreating, and deleting nodes
396 2012-12-12
Server Administration
9.13.3.2 To recreate a node on Unix
1.
Run <INSTALLDIR>/sap_bobj/serverconfig.sh
2.
Select 1 - Add node, and press Enter.
3.
Type the name of the new node, and press Enter.
Note:
The names of the original and recreated nodes must be identical.
4.
Type the port number of the new SIA, and press Enter.
5.
Select recreate node and press Enter.
• If the node exists in the system database of the Central Management Server (CMS), it is recreated on the local host.
Caution:
Use this option only if the node does not exist on any hosts in the cluster.
• If the node does not exist in the system database of the CMS, a new node with default servers is added. Default servers include all of the servers installed on the host.
6.
Select a CMS.
• If your deployment is running, select existing, and press Enter.
If prompted, enter the host name and port number for the existing CMS, the Administrator credentials, the database connection information and the credentials for the system database, and the cluster key.
• If your deployment is stopped, select temporary, and press Enter.
If prompted, enter the host name and port number for the temporary CMS, the Administrator credentials, the database connection information and the credentials for the system database, and the cluster key. A temporary CMS will start. (It will stop when this process finishes.)
Caution:
Avoid using the deployment while the temporary CMS runs. Ensure that the existing and temporary
CMS use different ports.
7.
Review the confirmation page, and press Enter.
The CCM recreates the node, and adds information about the node to the local machine. If any errors occur, review the log file.
You can now run <INSTALLDIR>/sap_bobj/ccm.sh -start <nodeName> to start the recreated node.
397 2012-12-12
Server Administration
9.13.3.2.1 Recreating a node on Unix using a script
You can use addnode.sh to recreate a node on a Unix machine. For more information, see the “Script parameters for adding, recreating, and deleting nodes” section.
Example:
<SCRIPTDIR>/addnode.sh -name mynode2
-siaport 6415
-cms mycms:6400
-username Administrator
-password Password1
-cmsport 7400
-dbdriver mysqldatabasesubsystem
-connect "DSN=BusinessObjects CMS 140;UID=Administrator;PWD=Password1;HOSTNAME=database;PORT=3306"
-dbkey abc1234
-adopt
Related Topics
•
•
Script parameters for adding, recreating, and deleting nodes
9.13.4 Deleting a node
You can delete a stopped node using a running Central Configuration Manager (CCM), or using a node management script. Use the following guidelines:
• Deleting a node also permanently deletes the servers on the node.
• If your cluster has multiple machines, delete the nodes before you remove a machine from the cluster and uninstall the software from it. If you remove a machine from a cluster before deleting a node, or if the file system on a machine malfunctions, you must recreate the node on a different machine with the same servers, in the same cluster, and then delete the node.
Remember:
You can delete a node only on the machine where the node is located.
Related Topics
•
9.13.4.1 To delete a node on Windows
398 2012-12-12
Server Administration
Caution:
Back up the server configuration for the entire cluster before and after you delete a node.
1.
Run the Central Configuration Manager (CCM).
2.
In the CCM, stop the node that you want to delete.
3.
Select the node, and click Delete Node on the toolbar.
4.
If prompted, enter the host name, the port number, and the Administrator credentials for the CMS.
The CCM deletes the node and all the servers on the node.
9.13.4.1.1 Deleting a node on Windows using a script
Caution:
Back up the server configuration for the entire cluster before and after you delete a node.
You can use RemoveNode.bat to delete a node on a Windows machine. For more information, see the “Script parameters for adding, recreating, and deleting nodes” section.
Example:
<SCRIPTDIR>\RemoveNode.bat -name mynode2
-cms mycms:6400
-username Administrator
-password Password1
Related Topics
•
•
Script parameters for adding, recreating, and deleting nodes
9.13.4.2 To delete a node on Unix
Caution:
Back up the server configuration for the entire cluster before and after you delete a node.
1.
Run <INSTALLDIR>/sap_bobj/ccm.sh -stop <nodeName> to stop the node that you want to delete.
2.
Run <INSTALLDIR>/sap_bobj/serverconfig.sh.
3.
Select 2 - Delete node, and press Enter.
4.
Select the node you want to delete, and press Enter.
5.
If prompted, enter the host name, the port number, and the Administrator credentials for the CMS.
The node and all the servers on the node are deleted.
399 2012-12-12
Server Administration
9.13.4.2.1 Deleting a node on Unix using a script
Caution:
Back up the server configuration for the entire cluster before and after you delete a node.
You can use removenode.sh to delete a node on a Unix machine. For more information, see the
“Script parameters for adding, recreating, and deleting nodes” section.
Example:
<SCRIPTDIR>\RemoveNode.sh -name mynode2
-cms mycms:6400
-username Administrator
-password Password1
Related Topics
•
•
Script parameters for adding, recreating, and deleting nodes
9.13.5 Renaming a node
You can rename a node using the Central Configuration Manager (CCM). In order to rename a node, you must create a new node with a new name, clone the servers from the original node to the new node, and then delete the original node. Use the following guidelines:
• If you rename the machine where a node is located, you do not need to rename the node. You can continue to use the existing node name.
• If you use a firewall, ensure that the ports of your Server Intelligence Agent (SIA) and Central
Management Server (CMS) are open.
Remember:
You can rename a node only on the machine where the node is located.
Related Topics
•
•
•
9.13.5.1 To rename a node on Windows
400 2012-12-12
Server Administration
Caution:
Back up the server configuration for the entire cluster before and after you rename a node.
1.
Start the Central Configuration Manager (CCM).
2.
In the Central Configuration Manager (CCM), on the toolbar, click Add Node.
3.
In the "Add Node Wizard", enter the node name and port number for the new Server Intelligence
Agent (SIA), the Administrator credentials, the database connection information, the credentials for the system database, and the cluster key.
4.
Select Add node with no servers.
5.
After the node is created, use the "Server Management" page of the Central Management Console to clone all of the servers from the original node to the new node.
Note:
Ensure that the cloned servers have no port conflicts with servers on the old node.
6.
In the CCM, start the new node.
7.
After the new node has been running for five minutes, use the CCM to delete the original node.
Related Topics
•
•
•
401
9.13.5.2 To rename a node on Unix
Caution:
Back up the server configuration for the entire cluster before and after you rename a node.
1.
Run <INSTALLDIR>/sap_bobj/serverconfig.sh.
2.
Select 1 - Add node, and press Enter.
3.
Type the name of the new node, and press Enter.
4.
Type the port number of the new SIA, and press Enter.
5.
If prompted, enter the Administrator credentials, the database connection information, the credentials for the system database, and the cluster key.
6.
Select no servers and press Enter.
7.
After the node is created, use the "Server Management" page of the Central Management Console to clone all of the servers from the original node to the new node.
Note:
Ensure that the cloned servers have no port conflicts with servers on the old node.
8.
Run <INSTALLDIR>/sap_bobj/ccm.sh -start <nodeName> to start the new node.
2012-12-12
Server Administration
9.
After the new node has been running for five minutes, use serverconfig.sh to delete the original node.
Related Topics
•
•
•
9.13.6 Moving a node
You can move a stopped node from one cluster to another using the Central Configuration Manager
(CCM), or using a node management script. Use the following guidelines:
• Ensure that the destination cluster does not have a node with the same name.
• Ensure that all server types installed on the machine where the source node is located are also installed on the production cluster.
• If you want to add a new machine to a production cluster but do not want the machine to be usable until you finish testing it, install SAP BusinessObjects Business Intelligence platform on a stand-alone machine, test the machine, then move the node to a production cluster.
Remember:
You can move a node only on the machine where the node is located.
9.13.6.1 To move an existing node on Windows
In this example, the node that you want to move is installed on the source system. The source system computer was initially a standalone installation, but now it will be added to the destination cluster.
Caution:
Back up the server configurations for the source and destination clusters before and after you move a node.
1.
Stop the node in the Central Configuration Manager (CCM).
2.
Right-click the node and choose Move.
3.
If prompted, select the data source name, and enter the host name, the port, the database connection information, the Administrator credentials for the destination CMS, and the destination cluster key.
4.
Select a CMS.
• If your source deployment is running, select Use existing running CMS, and click Next.
402 2012-12-12
Server Administration
403
If prompted, enter the host name and port number for the source system's existing CMS and the
Administrator credentials.
• If your source deployment is stopped, select Start a new temporary CMS, and click Next.
If prompted, enter the host name and port number for the source system's temporary CMS and the Administrator credentials.
Caution:
Avoid using the deployment while the temporary CMS runs. Ensure that the existing and temporary
CMS use different ports.
5.
Review the confirmation page, and click Finish.
The CCM creates a new node on the destination cluster with the same name and the same servers as the node on the source cluster. A copy of the node remains on the source cluster. The configuration templates for the servers in the node do not move. If any errors occur, review the log file.
Caution:
Do not use the source cluster after moving the node.
6.
In the CCM, start the moved node.
9.13.6.1.1 Moving a node on Windows using a script
Caution:
Back up the server configuration for the entire cluster before and after you move a node.
You can use MoveNode.bat to move a node on a Windows machine. For more information, see the
“Script parameters for moving nodes” section.
Example:
Due to the limitations of the command prompt, you must use the caret (^) to escape spaces, the equals sign (=) and the semicolon (;) in the -connect string.
<SCRIPTDIR>\MoveNode.bat -cms sourceMachine:6409
-username Administrator
-password Password1
-dbdriver mysqldatabasesubsystem
-connect "DSN^=Source^ BOEXI40^;UID^=username^;PWD^=Password1^;HOSTNAME^=database1^;PORT^=3306"
-dbkey abc1234
-destcms destinationMachine:6401
-destusername Administrator
-destpassword Password2
-destdbdriver sybasedatabasesubsystem
-destconnect "DSN^=Destin^ BOEXI40^;UID^=username^;PWD^=Password2^;"
-destdbkey def5678
Note:
To avoid using the caret in long strings, you can write the script's name and all of its parameters to a temporary response.bat file, and then run response.bat without any parameters.
Related Topics
•
•
Script parameters for moving nodes
2012-12-12
Server Administration
404
9.13.6.2 To move an existing node on Unix
In this example, the node you want to move is installed on the source system. The source system computer was initially part of a standalone cluster, but it will be added to the destination cluster.
Caution:
Back up the server configuration for the entire cluster before and after you move a node.
1.
Run <INSTALLDIR>/sap_bobj/ccm.sh -stop <nodeName> to stop the node.
2.
Run <INSTALLDIR>/sap_bobj/serverconfig.sh
3.
Select 4 - Move node, and press Enter.
4.
Select the node you want to move, and press Enter.
5.
When prompted, select the system database connection information, and enter the host name, the port, the Administrator credentials for the destination CMS, and the destination cluster key.
6.
Select a CMS.
• If your source deployment is running, select existing, and press Enter.
If prompted, enter the host name and port for the source system's existing CMS and the
Administrator credentials.
• If your source deployment is stopped, select temporary, and press Enter.
If prompted, enter the host name and port for the source system's temporary CMS, the
Administrator credentials, the database connection information and the credentials for the source system database, and the source cluster key. A temporary CMS will start. (It will stop when this process finishes.)
Caution:
Avoid using the deployment while the temporary CMS runs. Ensure that the existing and temporary
CMS use different ports.
7.
Review the confirmation page, and press Enter.
The CCM creates a new node on the destination cluster with the same name and the same servers as the node on the source cluster. A copy of the node remains on the source cluster. The configuration templates for the servers in the node do not move. If any errors occur, review the log file.
Caution:
Do not use the source cluster after moving the node.
8.
Run <INSTALLDIR>/sap_bobj/ccm.sh -start <nodeName> to start the moved node.
9.13.6.2.1 Moving a node on Unix using a script
Caution:
Back up the server configuration for the entire cluster before and after you move a node.
2012-12-12
Server Administration
You can use movenode.sh to move a node on a Unix machine. For more information, see the “Script parameters for moving nodes” section.
Example:
<SCRIPTDIR>/movenode.sh -cms sourceMachine:6409
-username Administrator
-password Password1
-dbdriver mysqldatabasesubsystem
-connect "DSN=Source BOEXI40;UID^=username;PWD=Password1;HOSTNAME=database1;PORT=3306"
-dbkey abc1234
-destcms destinationMachine:6401
-destusername Administrator
-destpassword Password2
-destdbdriver sybasedatabasesubsystem
-destconnect "DSN=Destin BOEXI40;UID=username;PWD=Password2;"
-destdbkey def5678
Related Topics
•
•
Script parameters for moving nodes
9.13.7 Script parameters
9.13.7.1 Script parameters for adding, recreating, and deleting nodes
Parameter
-adopt
-cms
Description Example
Recreates the node if it already exists in the CMS.
-adopt
The name and port number of the Central Management Server (CMS).
Caution:
Do not use this parameter if you use
-usetempcms
.
Note:
You must specify a port number if the
CMS is not running on the default 6400 port.
-cms mycms:6409
405 2012-12-12
Server Administration
Parameter
-cmsport
-connect
-dbdriver
-dbkey
-name
-noservers
Description Example
• The port number of the CMS when starting a temporary CMS.
Restriction:
You must also use the -usetem pcms
, -dbdriver, -connect, and
-dbkey parameters.
• The port number of the CMS when creating a new CMS.
Restriction:
You must also use the -dbdriver,
-connect
, and -dbkey parameters.
-cmsport 6401
The connection string of the CMS (or the temporary CMS) system database.
Note:
Omit the HOSTNAME and PORT attributes when connecting to DB2, Oracle, SQL
Anywhere, SQL Server, or Sybase databases.
-connect "DSN=BusinessObjects
CMS 140;UID=username;PWD=pass word;HOST
NAME=database;PORT=3306"
The database driver of the CMS.
Accepted values:
• db2databasesubsystem
• maxdbdatabasesubsystem
• mysqldatabasesubsystem
• oracledatabasesubsystem
• sqlanywheredatabasesubsystem
• sqlserverdatabasesubsystem
• sybasedatabasesubsystem
-dbdriver mysqldatabasesubsystem
The cluster key.
The name of a node.
-dbkey abc1234
-name mynode2
Creates a node without servers.
Note:
The additional -createcms parameter creates a node with a CMS, but no other servers. Omit these parameters to create a node with all of the default servers.
-noservers
406 2012-12-12
Server Administration
Parameter
-password
-siaport
-username
-usetempcms
Description
The password of the Administrator account.
Example
-password Password1
The port number of the Server Intelligence Agent for the node.
The user name of the Administrator account.
-siaport 6409
-username Administrator
Caution:
Do not use this parameter if you use
-cms
Starts and uses the temporary CMS.
Note:
Use a temporary CMS when your deployment is not running.
-usetempcms
Related Topics
•
Adding a node on Windows using a script
•
Adding a node on Unix using a script
•
Recreating a node on Windows using a script
•
Recreating a node on Unix using a script
•
Deleting a node on Windows using a script
•
Deleting a node on Unix using a script
9.13.7.2 Script parameters for moving nodes
407 2012-12-12
Server Administration
Parameter
-cms
-cmsport
-connect
Description
The name of the source Central Management Server (CMS).
Caution:
Do not use this parameter if you use
-usetempcms
Note:
You must specify a port number if the
CMS is not running on the default 6400 port.
Example
-cms sourceMachine:6409
• The port number of the CMS when starting a temporary CMS.
Restriction:
You must also use the -usetem pcms
, -dbdriver, -connect, and
-dbkey parameters.
• The port number of the CMS when creating a new CMS.
Restriction:
You must also use the -dbdriver,
-connect
, and -dbkey parameters.
-cmsport 6401
The connection string of the source
CMS (or the temporary CMS) system database.
Note:
Omit the HOSTNAME and PORT attributes when connecting to DB2, Oracle, SQL Anywhere, SQL Server, or
Sybase databases.
-connect "DSN=Source
BOEXI40;UID=username;PWD=pass word;HOST
NAME=database;PORT=3306"
408 2012-12-12
Server Administration
Parameter
-dbdriver
Description
The database driver of the source
CMS.
Accepted values:
• db2databasesubsystem
• maxdbdatabasesubsystem
• mysqldatabasesubsystem
• newdbdatabasesubsystem
• oracledatabasesubsystem
• sqlanywheredatabasesubsystem
• sqlserverdatabasesubsystem
• sybasedatabasesubsystem
Note:
sqlserverdatabase is not supported on Unix.
Example
-dbdriver mysqldatabasesubsystem
-dbkey
-destcms
The source cluster key.
The name of the destination CMS.
Note:
You must specify a port number if the
CMS is not running on the default 6400 port.
-dbkey abc1234
-destcms destinationMachine:6401
-destconnect
The connection string of the destination
CMS system database.
Note:
Omit the HOSTNAME and PORT attributes when connecting to DB2, Oracle, SQL Anywhere, SQL Server, or
Sybase databases.
-destconnect "DSN=Destin
BOEXI40;UID=username;PWD=pass word;HOST
NAME=database;PORT=3306"
409 2012-12-12
Server Administration
Parameter Description
-destdbdriver
The database driver of the destination
CMS.
Accepted values:
• db2databasesubsystem
• maxdbdatabasesubsystem
• mysqldatabasesubsystem
• newdbdatabasesubsystem
• oracledatabasesubsystem
• sqlanywheredatabasesubsystem
• sqlserverdatabasesubsystem
• sybasedatabasesubsystem
Note:
sqlserverdatabase is not supported on Unix.
Example
-destdbdriver sybasedatabasesubsystem
-destdbkey
The destination cluster key.
-destpassword
The password of the Administrator account on the destination CMS.
-destdbkey def5678
-destpassword Password2
-destusername
The user name of the Administrator account on the destination CMS.
-password
The password of the Administrator account on the source CMS.
-username
The user name of the Administrator account on the source CMS.
-destusername Administrator
-password Password1
-username Administrator
-usetempcms
Caution:
Do not use this parameter if you use
-cms
Starts and uses the temporary CMS.
Note:
Use a temporary CMS when your deployment is not running.
-usetempcms
Related Topics
•
Moving a node on Windows using a script
•
Moving a node on Unix using a script
410 2012-12-12
Server Administration
9.13.8 Adding Windows server dependencies
In a Windows environment, each instance of the Server Intelligence Agent (SIA) depends on the Event
Log and Remote Procedure Call (RPC) services.
If a SIA does not operate correctly, ensure that both services appear on the SIA's "Dependency" tab.
9.13.8.1 To add Windows server dependencies
1.
Use the Central Configuration Manager (CCM) to stop the Server Intelligence Agent (SIA).
2.
Right-click the SIA and select Properties.
3.
Click the Dependency tab.
4.
Click Add.
The "Add Dependency" dialog box appears, displaying a list of all available dependencies.
5.
Select a dependency, and click Add.
6.
Click OK.
7.
Use the CCM to restart the SIA.
9.13.9 Changing the user credentials for a node
You can use the Central Configuration Manager (CCM) to specify or update the user credentials for the Server Intelligence Agent (SIA) if the operating system password changes, or if you want to run all of the servers on a node under a different user account.
All servers managed by the SIA run under the same account. To run a server using a non-system account, ensure that your account is a member of the Local Administrators group on the server machine, and that it has the “Replace a process level token” right.
Restriction:
On a Unix machine, you must run SAP BusinessObjects Business Intelligence platform with the same account that was used to install it. To use a different account, reinstall the deployment using a different account.
411 2012-12-12
Server Administration
9.13.9.1 To change the user credentials for a node on Windows
1.
Use the Central Configuration Manager (CCM) to stop the Server Intelligence Agent (SIA).
2.
Right-click the SIA and select Properties.
3.
Clear the System Account check box.
4.
Enter a username and a password, and click OK.
5.
Use the CCM to restart the SIA.
The SIA and the server processes log onto the local machine with the new user account.
9.14 Renaming a machine in a BI platform deployment
9.14.1 Renaming a machine in a BI platform deployment
9.14.1.1 Changing cluster names
The following are best practices for renaming clusters:
Caution:
Never deploy multiple clusters with the same name.
Condition
The name of the cluster changes.
Action
Inform your users of the new cluster name and ask them to use it (after the first connection to the
CMS using the <hostname>:<port> syntax).
On the web tier, update the cluster name in the properties files of all web application servers.
412 2012-12-12
Server Administration
Condition Action
You install a different version of SBOP on a machine that previously ran a CMS, or you add the machine to a different cluster.
• Ensure that the new CMS runs on a different port.
• Use different passwords for different clusters to prevent users from logging into an incorrect cluster.
9.14.1.2 Changing IP addresses
To avoid configuration changes that result from changes to the machine's IP address, select Server
Properties on the Servers tab of the CMC, and then ensure that all servers bind to hostnames, or use the Auto-Assign option. In addition, follow these best practices:
Condition Action
You use ODBC with the CMS database or the auditing database.
You use another database connection type with the CMS database or the auditing database.
Ensure that the DSN uses the CMS database server hostname.
Use the CCM to update the database to use the database server hostname.
The CMS database or the auditing database is located on the same host at the CMS.
You use the URL for BI platform web applications that users access using web browsers (for example, the CMC).
You use the URL for BI platform clients based on web services (for example, Crystal Reports for
Java or LiveOffice).
Use localhost for the machine name.
Use hostnames instead of IP addresses for the default URL. To update the URL for the default viewer, select Processing Settings on the Appli-
cations tab of the CMC.
You use OpenDocument.
Alternative guidelines
Note:
Follow these guidelines only if you cannot follow the best practices described above.
413 2012-12-12
Server Administration
Table 9-10: For machines hosting servers
Condition
The host contains BI platform servers and the servers must bind to specific IP addresses.
Action
Change the IP addresses on the Servers tab of the CMC, but do not restart the servers at this time.
A database connection must use an IP address.
Change the IP address.
An IP address change is required in a static IP network.
Change the IP address of the BI platform machine.
Tip:
Log on to the CMC to verify that the BI platform is operational.
Remember:
Restart the machine after performing an action.
Table 9-11: For machines hosting the web application server
Condition
The OpenDocument default viewer URL must use an IP address.
Action
Update the IP address in the Default Viewer URL field in the Processing Settings section of the
Applications tab of the CMC.
Your users access BI platform web applications
(for example, the CMC) by providing a URL with an IP address in their browsers.
Inform your users of the new IP address.
BI platform clients based on web services (for example, Crystal Reports for Java, or LiveOffice) must use IP addresses.
Configure all clients to use the new IP address.
Related Topics
•
Selecting a new or existing CMS database
9.14.1.3 Renaming machines
414 2012-12-12
Server Administration
You can rename machines in an SAP BusinessObjects Business Intelligence platform deployment at any time by stopping all BI platform servers on the machine and then renaming the machine. The following are best practices for renaming machines:
Condition
You log on for the first time.
You have a multi-machine deployment.
Action
Use the CMS machine name (rather than the cluster name).
Ensure that all CMS servers on all other machines are running during renaming.
9.14.1.3.1 Server tier
Note:
Before you rename the CMS machine, inspect the configuration of all servers located on the machine that you would like to rename on the “Server Management” tab of the CMC. If the "Hostname" property uses the old CMS hostname, update it to the new CMS hostname.
Remember:
Do not restart the servers until you complete all machine renaming procedures.
Follow these instructions for renaming server tier machines:
Condition Action
The renamed machine hosts a CMS, and users have previously logged in by providing the name of the old machine.
Inform your users of the CMS machine name and ask them to use it.
The renamed machine hosts a CMS, and the BI platform web application default properties files contain the old CMS hostname in the cms.de
fault property.
Update the CMS machine name in the cms.de
fault property in all custom property files on all web tier machines. On Tomcat 6, the property files that you create are located in <IN
STALLDIR>\SAP BusinessObjects
Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom by default.
Note:
If no custom property files exist, create new custom property files. Copy the the default property files to a custom folder, and remove all content except for the cms.default line from the custom property files.
415 2012-12-12
Server Administration
416
Condition
The renamed machine hosts a CMS, and SAP
BusinessObjects Explorer is installed on any machine in the cluster.
Action
Replace the old CMS hostname with the new hostname in the default.cms.name property in the default.settings.properties file on all machines that host web application servers.
By efault, on Tomcat 6, the default.set
tings.properties
file is located in <IN
STALLDIR>\SAP BusinessObjects
Enterprise XI
4.0\warfiles\webapps\explorer\WEB-INF\classes\
Remember:
Restart the Explorer web application or application server after performing the action.
You use SSO with Explorer
Update the cms value in jsp-ssoprovider.jsp
and update thesso.glob
al.cms
and sso.trusted.auth.x509.cms
values in sso.properties to the new CMS hostname.
You use Portal Integration Kits or custom applications.
Configure the Portal Integration Kits or custom applications to use the new CMS hostname.
Your deployment meets all of the following conditions:
• A cluster has multiple nodes.
• All CMS servers run only on the machine that has been renamed.
• At least one node does not host the CMS.
• You rename a machine with at least one node.
• The IP address changes during the renaming process.
Use the CCM to perform the “Recreate Node” workflow on all nodes, except for the node that hosts the CMS, and then start all BI platform nodes in the deployment. For more information, see the “Managing Nodes” chapter.
Remember:
Restart the web application or application server after performing an action.
Related Topics
•
9.14.1.3.2 Web tier
If you rename the machine that hosts the SAP BusinessObjects BI platform web application server, follow these instructions:
2012-12-12
Server Administration
Condition Action
You change the name of the machine that hosts the BI platform web application server, and the
URL of the default OpenDocument viewer uses a web application server hostname.
Log onto the CMC and update the default viewer
URL in Applications > CMC > Processing Set-
tings.
You change the name of the machine that hosts the BI platform web application server, and your users access BI platform web applications using a URL that includes a web application server hostname.
Ask your users to access BI platform web applications using a URL that includes the new web application server hostname.
You change the name of the machine that hosts the BI platform web application server, and web service-based BI platform clients use web application server hostnames in the URL.
Reconfigure all web-service-based BI platform clients to use the newweb application server hostname.
9.14.1.3.3 Databases
If you rename the machine hosting the CMS system database or the auditing database, follow these best practices:
Condition Action
You want to avoid updating the IP address.
The CMS database or auditing database is located on the same host as the CMS.
Use the CMS database or auditing database machine name in the data source name (DSN).
Use localhost in the DSN to avoid updating it if the hostname changes.
CMS system database
Condition Action
You rename a machine that hosts the CMS system database, and you use ODBC.
Update the CMS database DSN to the new database server hostname.
You rename a machine that hosts the CMS system database, and you use another database connection type.
Use the CCM to update the CMS database to the new database server hostname on every node in the cluster.
417 2012-12-12
Server Administration
Auditing database
Condition Action
You rename a machine that hosts the auditing database, and you use ODBC.
You rename a machine that hosts the auditing database, and you use another database connection type.
Update the auditing database DSN to use the new database server hostname.
Update the database server machine name to the new database server hostname on the Auditing tab of the CMC.
9.14.1.3.4 File Repository Servers
If you rename the machine that hosts the FRS file store, you must update the "Input File Repository" and "Output File Repository" servers on the “Server Management” page of the CMC, and ensure that the "File Store Directory" and "Temporary Directory" properties use the new file store path, and then restart the servers.
9.15 Using 32-bit and 64-bit third-party libraries with BI platform
SAP BusinessObjects Business Intelligence platform servers are a combination of 32-bit and 64-bit processes. Some servers additionally launch 32-bit and 64-bit child processes. To use the correct version of third-party libraries (32-bit versus 64-bit) with Business Intelligence (BI) platform processes, you must set separate environment variables for each version on the computer hosting BI platform.
You must then set an additional environment variable that contains a comma-separated list of those environment variables that have 32-bit and 64-bit versions. When a process is launched by BI platform, it will select the appropriate variable depending on whether the process is 32-bit or 64-bit.
•
<FIRST_ENV_VAR>
is the value to be used by 64-bit BI platform processes.
•
<FIRST_ENV_VAR32>
is the value to be used by 32-bit processes.
•
<SECOND_ENV_VAR>
is the value to be used by 64-bit processes.
•
<SECOND_ENV_VAR32>
is the value to be used by 32-bit processes.
• BOE_USE_32BIT_ENV_FOR=<FIRST_ENV_VAR>,<SECOND_ENV_VAR>
For example, if you've installed BI platform on an AIX computer, as well as 32-bit and 64-bit Oracle clients, and need to set the LIBPATH variable, set the following variables:
• ORACLE_HOME=<64-bit version of the Oracle client>
• ORACLE_HOME32=<32-bit version>
• LIBPATH=<64-bit version>
• LIBPATH32=<32-bit version>
• BOE_USE_32BIT_ENV_FOR=ORACLE_HOME,LIBPATH
418 2012-12-12
Server Administration
9.16 Managing server and node placeholders
9.16.1 To view server placeholders
• In the "Servers" management area of the CMC, right-click a server and select Placeholders.
The "Placeholders" dialog box displays a list of placeholders for all of the servers on the same cluster as the server that you selected. If you want to change the value for a placeholder, modify the placeholder for the node.
Related Topics
•
9.16.2 To view and edit the placeholders for a node
Note:
You cannot edit the settings for all placeholders. For example, %INSTALLROOTDIR% is auto-populated and is, therefore, read-only.
1.
In the "Servers" management area of the Central Management Console, right-click the node for which you want to change a placeholder and choose Placeholders.
2.
Edit settings for the placeholder as needed, and click OK.
Related Topics
•
419 2012-12-12
Server Administration
420 2012-12-12
Managing Central Management Server (CMS) databases
Managing Central Management Server (CMS) databases
10.1 Managing CMS system database connections
If the CMS system database is unavailable, for example due to a hardware or software failure or a network problem, the CMS goes into the “Waiting for resources” state. If the SAP BusinessObjects
Business Intelligence platform deployment has multiple CMSs, then subsequent requests from other servers are forwarded to any CMSs in the cluster that have an active connection to the system database.
While a CMS is in the “Waiting for resources” state, any current requests that do not require database access continue to be processed, but requests that require access to the CMS database will fail.
By default, a CMS in the “Waiting for resources” state periodically attempts to reestablish the number of connections that are specified in the “System Database Connections Requested” property. As soon as at least one database connection is established, the CMS synchronizes all necessary data, goes into the “Running” state, and resumes normal operations.
In some cases, you may want to prevent the CMS from automatically reestablishing a connection to the database. For example, you may want to verify the integrity of the database before database connections are reestablished. To do so, on the "Properties" page of the CMS server, uncheck Auto
Reconnect to System Database.
Related Topics
•
To change a server's properties
10.1.1 To select SQL Anywhere as a CMS database
During initial installation, BI platform supports a select number of databases. To use SQL Anywhere as a CMS database, you must perform the following steps.
1.
Start the Central Configuration Manager.
• On Unix, run ./cmsdbsetup.sh.
• On Windows, start the CCM.
2.
Copy your data from the default CMS database, selecting SQL Anywhere as the destination database.
For more information, see “Copying data from one CMS system database to another”.
421 2012-12-12
Managing Central Management Server (CMS) databases
3.
On multi-node deployments, update the CMS data source on every node (except the node on which you copy the database) to the new SQL Anywhere database. For more information, see “Selecting a new or existing CMS database”.
4.
Ensure that the deployment is operational (for example, log into the CMC and view a report).
Related Topics
•
Copying data from one CMS system database to another
•
Selecting a new or existing CMS database
10.1.2 To select SAP HANA as a CMS database
During initial installation, BI platform supports a select number of databases. To use the SAP HANA as a CMS database, you must perform the following steps.
1.
Install BI platform with the default CMS database.
2.
Install the HANA client.
3.
Create a connection to HANA.
• On Unix, check the environment variable ODBCINI. If the variable exists and points to an existing odbc.ini
file, add the following lines to that file:
[ODBC Data Sources]
NewDB=<New_DB_version>
[NewDB]
SERVERNODE=<HANA Server IP address>:<HANA server port #>
<New_DB_version> is the HANA version; for example “NewDB 1.0”, <HANA Server IP address> is the HANA server IP address, and <HANA server port #> is the HANA server port number.
If the ODBCINI environment variable does not exist, create an odbc.ini file in the <IN
STALLDIR>/sap_bobj/enterprise_xi40/ directory, add the above lines to the file, and set the ODBCINI environment variable as follows:
ODBCINI=<INSTALLDIR>/sap_bobj/enterprise_xi40/odbc.ini
• On Windows, create an ODBC connection to HANA.
4.
Ensure that connections can be made to the HANA server.
• On Unix, you can test the connection to the HANA server by running the following command.
The variables in the following example refer to the HANA installation:
<INSTALLDIR>/odbcreg <SERVER>:<HDBINDEXSERVERPORT> <SYSTEMID> <NONADMINUSER> <NONADMINPASSWORD>
• On Windows, you can use the ODBC Data Source Administrator to test the HANA ODBC connection.
5.
On Unix, copy libodbcHDB.so from the HANA installation directory to <IN
STALLDIR>/sap_bobj/enterprise_xi40/<PLATFORM>
422 2012-12-12
Managing Central Management Server (CMS) databases
6.
Start the Central Configuration Manager.
• On Unix, run ./cmsdbsetup.sh.
• On Windows, start the CCM.
7.
Copy your data from the default CMS database, selecting HANA as the destination database. For more information, see “Copying data from one CMS system database to another”.
8.
On multi-node deployments, update the CMS data source on every node (except the node on which you copy the database) to the new HANA database. For more information, see “Selecting a new or existing CMS database”.
9.
Ensure that the deployment is operational (for example, log into the CMC and view a report).
Related Topics
•
Copying data from one CMS system database to another
•
Selecting a new or existing CMS database
10.2 Selecting a new or existing CMS database
You can use the CCM to specify a new or existing CMS system database for a node that contains a
CMS. Generally, there are only a few times when you need to complete these steps:
• If you have changed the password for the current CMS system database, these steps allow you to disconnect from, and then reconnect to, the current database. When prompted, you can provide the
CMS with the new password.
• If you want to select and initialize an empty database for SAP BusinessObjects Business Intelligence platform, these steps allow you to select that new data source.
• If you have restored a CMS system database from backup (using your standard database administration tools and procedures) in a way that renders the original database connection invalid, you will need to reconnect the CMS to the restored database. (This might occur, for instance, if you restored the original CMS database to a newly installed database server.)
Note:
If you use IBM DB2 as your CMS database, and upgrade it from a version older than 9.5 Fix Pack 5 to version 9.5 Fix Pack 5 or newer (for the 9.5 line), or if you upgrade from a version older than 9.7 Fix
Pack 1 to version 9.7 Fix Pack 1 or newer (for the 9.7 line), then during the next restart of the BI platform node or CMS, the CMS database schema will automatically be updated by the CMS to support
HADR-compatible schema.
This may be a lengthy process, during which the BI platform system will not be available for use. Do not interrupt the update process, to avoid corrupting the CMS database. It is highly recommended that you back up your CMS database before performing this operation. Also, do not try to use IBM HADR with an IBM DB2 CMS database of a version older than 9.5 Fix Pack 5 (for the 9.5 line) or 9.7 Fix Pack
1 (for the 9.7 line).
423 2012-12-12
Managing Central Management Server (CMS) databases
10.2.1 To select a new or existing CMS database on Windows
1.
Use the CCM to stop the Server Intelligence Agent (SIA).
2.
Select the SIA, and click Specify CMS Data Source on the toolbar.
3.
Select Update Data Source Settings.
4.
The remaining steps depend on the connection type you selected:
• If you selected ODBC, in the "Select Data Source" dialog box, select the ODBC data source to use as the CMS database, and click OK. When prompted, provide your database credentials and the cluster key, and click OK.
Tip:
If you want to configure a new DSN, click New.
• If you selected a native driver, when you are prompted, enter your database server name, login
ID, password, and the cluster key, and click OK.
5.
Enter the cluster key.
The CCM notifies you when the CMS database setup is complete.
6.
In the "Properties" dialog box, click OK.
7.
Restart the Server Intelligence Agent.
10.2.2 To select a new or existing CMS database on Unix
Use the cmsdbsetup.sh script. For reference, see the chapter about Unix tools.
Note:
If you point to an empty CMS database, you must use the cmsdbsetup.sh script again to reinitialize
(recreate) the database (option 5).
1.
Run the cmsdbsetup.sh script (located by default in <InstallDirectory>/sap_bobj/).
2.
Select the update action (option 6).
3.
Type yes to confirm that the data source contains deployment information for this cluster and that you are not using this functionality for clustering purposes.
4.
When prompted, enter the database type of the new CMS database.
5.
Enter database information (for example, host name, user name, and password) and the cluster key.
A notification message appears when the CMS database has been pointed to the new location.
424 2012-12-12
Managing Central Management Server (CMS) databases
Related Topics
•
Recreating the CMS system database
10.3 Recreating the CMS system database
This procedure shows how to recreate (re-initialize) the current CMS system database. By performing this task, you destroy all data that is already present in the database. This procedure is useful, for instance, if you have installed SAP BusinessObjects Business Intelligence platform in a development environment for designing and testing your own, custom web applications. You can re-initialize the
CMS system database in your development environment every time you need to clear the system of all its data.
Caution:
By implementing the steps outlined in this workflow, you will delete of all data in the CMS database as well as objects such as reports and users. Do not perform these steps on a production deployment.
It is very important that you back up all server configuration settings before re-initializing the CMS system database. When you recreate the database, your server configuration settings will be erased and you must have a backup in order to restore this information.
When you recreate the system database, your existing license keys should be retained in the database.
However, if you need to enter license keys again, log on to the CMC with the default Administrator account. Go to the "License Keys" area.
Note:
If you re-initialize your CMS system database, all data in your current CMS system database will be destroyed. Consider backing up your current database before beginning. If necessary, contact your database administrator.
Related Topics
•
10.3.1 To recreate the CMS system database on Windows
1.
Use the CCM to stop the Server Intelligence Agent (SIA).
Note:
For this procedure, you cannot run the CCM on a remote computer; it must be run on a computer with at least one valid node.
2.
Right-click the SIA and choose Properties.
425 2012-12-12
Managing Central Management Server (CMS) databases
3.
In the "Properties" dialog box, click the Configuration tab, and click Specify.
4.
In the "CMS Database Setup" dialog box, click Recreate the current Data Source.
Note:
All servers and objects from the computer where you ran the CCM in step 1 will also be recreated.
5.
Click OK and, when prompted to confirm, click Yes.
6.
Specify the password for the CMS system database, and click OK.
The CCM notifies you when the CMS system database setup is complete.
7.
Click OK.
You are returned to the CCM.
8.
Restart the Server Intelligence Agent and enable services.
While it is starting, the Server Intelligence Agent starts the CMS. The CMS writes required system data to the newly emptied data source.
9.
If your deployment has more than one computer, you need to re-create the nodes on the other computers.
Related Topics
•
10.3.2 To recreate the CMS system database on Unix
Use the cmsdbsetup.sh script. For reference, see the Unix tools information in the SAP
BusinessObjects Business Intelligence Platform Administrator Guide.
1.
Run cmsdbsetup.sh (located in <INSTALLDIR>/sap_bobj/, by default).
2.
Enter the name of the node.
3.
Select reinitialize (option 5), and confirm your choice.
4.
Enter the CMS system database password.
The cmsdbsetup.sh script begins recreating the CMS system database. When the database creation is complete, the cmsdbsetup.sh script closes automatically.
5.
In the <INSTALLDIR>/sap_bobj/ directory, use the following command to start the node: ccm.sh -start <nodename>
6.
To enable the services, use the following command: ccm.sh -enable all -cms <CMSNAME:PORT> -username administrator -password <password>
Note:
Since you just recreated the CMS database, the administrator password is blank.
426 2012-12-12
Managing Central Management Server (CMS) databases
10.4 Copying data from one CMS system database to another
You can use the Central Configuration Manager (CCM) to copy system data from the one database server into another database server. For example, if you want to replace the database with another database because you are upgrading the database or are moving from one database type to another, you can copy the contents of the existing database into the new database before decommissioning it.
Note:
When DB2 is installed by the BI platform as the default database, enter a blank password.
The destination database is initialized before the new data is copied in, so any existing contents of the destination database are permanently deleted (all SAP BusinessObjects Business Intelligence platform tables are destroyed permanently and then recreated). Once the data has been copied, the destination database is established as the current database for the CMS.
Note:
If you want to import users, groups, folders, and reports from a previous version of SAP BusinessObjects
Business Intelligence platform to the current version, use the SAP BusinessObjects Business Intelligence platform Upgrade management tool. For more information, see the SAP BusinessObjects Business
Intelligence platform Upgrade Guide.
10.4.1 Preparing to copy a CMS system database
Before copying a CMS system database, take the source and the destination environments offline by disabling and subsequently stopping all servers. Back up both CMS databases, and back up the root directories used by all Input and Output File Repository Servers. If necessary, contact your database or network administrator.
Ensure that you have a database user account that has permission to read all data in the source database, and a database user account that has Create, Delete, and Update rights to the destination database. Also ensure also that you can connect to both databases—through your database client software or through ODBC, according to your configuration—from the CMS machine whose database you are replacing.
If you are copying a CMS database from its current location to a different database server, your current
CMS database is the source environment. Its contents are copied to the destination database, which is then established as the active database for the current CMS. Perform this task to move the default
CMS database from the existing default database to a dedicated database server, such as Microsoft
SQL Server, Oracle, DB2, or Sybase. Log on with an administrative account to the machine that is running the CMS whose database you want to move.
427 2012-12-12
Managing Central Management Server (CMS) databases
Note:
• When you copy data from one database to another, the destination database is initialized before the new data is copied in. That is, if your destination database does not contain the SAP
BusinessObjects Business Intelligence platform system tables, these tables are created. If the destination database does contain Business Intelligence platform system tables, the tables will be permanently deleted, new system tables will be created, and data from the source database will be copied into the new tables. Other tables in the database are unaffected.
• If you are copying a CMS system database to a MaxDB destination database on Windows, you must ensure that the path to the MaxDB client has been added to the PATH environment variable. For example, ;C:\Program Files\sdb\MAXDB1\pgm.
• If you use SQL Anywhere as a CMS database, do not click Encrypt Password during DSN configuration.
10.4.2 To copy a CMS system database on Windows
Before you copy the contents of the CMS database, ensure that you can logon to the destination database with an account that has permissions to add or drop tables, and to add, drop, or modify data in those tables.
1.
Open the Central Configuration Manager (CCM), and stop the Server Intelligence Agent (SIA).
2.
Right-click the SIA and choose Properties.
3.
Click the Configuration tab, and click Specify.
4.
Choose Copy data from another Data Source, and click OK.
5.
Select the database type for the source CMS database, and specify its database information when prompted, including the host name, your user name and password, and the source cluster key.
6.
Select the database type for the destination CMS database, and specify its database information when prompted, including the host name, your user name and password, and the destination cluster key.
If the destination database is empty, you can enter a new cluster key. If the destination database contains existing deployment information for a cluster, you must enter the cluster key of that cluster.
7.
Confirm that you want to delete the Business Intelligence platform tables in the destination database.
8.
When the CMS database has finished copying, click OK.
10.4.3 To copy data from a CMS system database on Unix
Before you copy the contents of the CMS database, ensure that you can logon to the destination database with an account that has permissions to add or drop tables, and to add, drop, or modify data in those tables.
428 2012-12-12
Managing Central Management Server (CMS) databases
Note:
On Unix you cannot migrate directly from a source environment that uses an ODBC connection to the
CMS database. If your source CMS database uses ODBC, you must first upgrade that system to a supported native driver.
1.
Stop the CMS by typing the following command:
./ccm.sh -stop <nodename>
2.
From <InstallDirectory>/sap_bobj/ (the default location), run cmsdbsetup.sh.
3.
Enter the name of the node.
4.
Select copy (option 4), and confirm your choice.
5.
Select the database type for the destination CMS database, and specify its host name, your user name and password, and the destination cluster key when prompted.
If the destination database is empty, enter a new cluster key. If the destination database contains existing deployment information for a cluster, you must enter the cluster key of that cluster.
6.
Select the database type for the source CMS database, and specify its host name, your user name and password, and the source cluster key when prompted.
The CMS database is copied to the destination database. A message appears when the copy is complete.
429 2012-12-12
Managing Central Management Server (CMS) databases
430 2012-12-12
Managing Web Application Container Servers (WACS)
Managing Web Application Container Servers (WACS)
11.1 WACS
11.1.1 Web Application Container Server (WACS)
Web Application Container Servers (WACS) provide a platform for hosting SAP BusinessObjects
Business Intelligence platform web applications. For example, a Central Management Console (CMC) can be hosted on a WACS.
WACS simplifies system administration by removing several workflows that were previously required for configuring application servers and deploying web applications, and by providing a simplified, consistent administrative interface.
Web applications are automatically deployed to WACS. WACS does not support manual or WDeploy deployment of SAP BusinessObjects Business Intelligence platform or external web applications.
11.1.1.1 Do I need WACS?
If you do not want to use a Java application server to host your SAP Business Objects web applications, then you can host them on WACS.
If you plan to use a supported Java application server to deploy SAP BusinessObjects Business
Intelligence platform web applications, or if you are installing SAP BusinessObjects Business Intelligence platform on a Unix system, you do not need to install and use WACS.
11.1.1.2 What are the advantages of using WACS?
Using WACS to host the CMC provides you with a number of advantages:
431 2012-12-12
Managing Web Application Container Servers (WACS)
• WACS requires a minimum effort to install, maintain, and configure.
• All hosted applications are predeployed on WACS, so that no additional manual steps are required.
• WACS is supported by SAP.
• WACS removes the need for Java application server administration and maintenance skills.
• WACS provides an administrative interface that is consistent with other SAP BusinessObjects
Business Intelligence platform servers.
11.1.1.3 Common Tasks
Task Description Topic
How can I improve the performance of web applications or web services that are hosted on
WACS.
You can improve the performance of the web applications or web services by installing WACS on multiple machines.
•
Adding a new Web Application Container Server
•
How can I improve the availability of my web-tier?
Create additional WACS in your deployment, so that in the event of a hardware or software failure on one server, another server can continue servicing requests.
How can I create an environment where I can easily recover from a misconfigured CMC?
Create a second, stopped,
WACS, and use this WACS to define a configuration template.
In the event that the primary
WACS becomes misconfigured, either use the second WACS until you configure the first server, or apply the configuration template to the first server.
How can I improve the security of communication between clients and WACS?
Configure HTTPS on WACS.
•
•
How can I improve the security of communication between
WACS and other Business Objects servers in my deployment?
Configure SSL communication between WACS and other SAP
BusinessObjects Business Intelligence platform servers in your deployment.
•
•
432 2012-12-12
Managing Web Application Container Servers (WACS)
Task
Can I use WACS with HTTPS and a reverse proxy?
Description Topic
You can use WACS with HTTPS and a reverse proxy if you create two WACS and configure both servers with HTTPS. Use the first
WACS for communication inside your internal network, and the other WACS for communication with an external network through a reverse proxy.
How does WACS fit in my IT environment?
WACS can be deployed in an IT environment with existing web servers, hardware load balancers, reverse proxies, and firewalls.
•
Using WACS with other web servers
•
Using WACS with a load balancer
•
Using WACS with a reverse proxy
•
Can I use WACS in a deployment with a load balancer?
You can use WACS in a deployment that uses a hardware load balancer. WACS itself cannot be used as a load balancer.
Using WACS with a load balancer
Can I use WACS in a deployment with a reverse proxy?
You can use WACS in a deployment that uses a reverse proxy.
WACS itself cannot be used as a reverse proxy.
Using WACS with a reverse proxy
How can I troubleshoot my
WACS servers?
If you need to determine the reasons for/causes of the poor performance of your WACS, you can view the log files and view the system metrics.
•
•
433 2012-12-12
Managing Web Application Container Servers (WACS)
Task
I don't get any pages served to me on a particular port. What is wrong?
Description Topic
There are a number of reasons why you might not be able to connect to WACS. Check to see if:
• The HTTP, HTTP through proxy, and HTTPS ports that you specified for the WACS have been taken by other applications.
• The WACS has enough memory allocated to it.
• The WACS allows enough concurrent requests.
• If necessary, restore the system defaults for the WACS.
•
•
•
To change the number of concurrent requests
•
How can I configure the properties of web applications that are hosted on WACS?
The procedure for configuring the properties for web applications depends on the specific property and web application. For more information, see the “ Configuring web application properties” section of this chapter.
Configuring web application properties
Where can I find a list of WACS properties?
The “Server Properties Appendix” of this guide contains a list of
WACS properties.
11.1.2 Adding or removing additional WACS to your deployment
Adding additional WACS to your deployment can give you a number of advantages:
• Faster recovery from a misconfigured server.
• Improved server availability.
• Better load balancing.
• Better overall performance.
There are three ways to add additional WACS to your deployment:
• Installing WACS on a machine.
• Creating a new WACS.
434 2012-12-12
Managing Web Application Container Servers (WACS)
• Cloning a WACS.
Note:
It is recommended that you run a single WACS on the same machine at the same time due to high resource utilization. However, you can deploy more than one WACS on the same machine, and only run one of them, to help you recover in the event of a misconfigured WACS.
435
11.1.2.1 Installing WACS
Installing WACS on separate machines can provide your deployment with better performance, better load balancing, and higher server availability. If your deployment contains two or more WACS on separate machines, the availability of web applications and web services won't be affected by hardware or software failures on a specific machine, because the other WACS will continue to provide the services.
You can install a Web Application Container Server by using the SAP BusinessObjects Business
Intelligence platform installation program. There are two ways that you can install WACS:
• In a Full installation, on the "Select Java Web Application" screen choose Install Web Application
Container Server and automatically deploy web applications and services to it.
If you select a Java application server in a New installation, WACS is not installed.
• In a Custom / Expand installation, you can choose to install WACS on the "Select Features" screen by expanding Servers > Platform Services and selecting Web Application Container Server.
If you install WACS, the installation program automatically creates a server called
<NODE>
.WebApplicationContainerServer, where <NODE> is the name of your node. SAP BusinessObjects
Business Intelligence platform web applications and web services are then deployed to that server. No manual steps are required to deploy or configure the CMC. The system is ready to use.
When you install WACS, the installation program prompts you to provide an HTTP port number for
WACS. Ensure that you specify a port number that is not used. The default port number is 6405. If you plan to allow users to connect to the WACS from outside a firewall, you must ensure that the server's
HTTP port is open on the firewall.
WACS is supported only on Windows operating systems.
Note:
The web applications that WACS hosts are automatically deployed when you install WACS or when you apply updates or hot-fixes to WACS or to WACS-hosted web applications. It takes several minutes for the web applications to deploy. The WACS will be in the “Initializing” state until the web application deployment is complete. Users will not be able to access web applications hosted on WACS until the web applications are fully deployed. Do not stop the server until the initial deployment is completed.
You can view the server state of the WACS through the Central Configuration Manager (CCM).
This delay occurs only when starting WACS the first time after installing WACS or applying updates to it. This delay does not occur for subsequent WACS restarts.
2012-12-12
Managing Web Application Container Servers (WACS)
Web applications cannot be manually deployed to a WACS server. You cannot use WDeploy to deploy web applications to WACS.
11.1.2.2 Adding a new Web Application Container Server
Note:
• It is recommended that you run a single WACS on the same machine at the same time due to high resource utilization. However, you can deploy more than one WACS on the same machine, and only run one of them, to help you recover in the event of a misconfigured WACS.
• The TraceLog Service (for server tracing) is created automatically when you create a new WACS.
1.
Go to the "Servers" management area of the CMC.
2.
Select Manage > New > New Server.
The "Create New Server" screen appears.
3.
From the Service Category list, select Core Services.
4.
From the Select Service list, select the services that you want the WACS to host, and click Next.
• If you want the WACS to host web applications such as the CMC, BI launch pad or
OpenDocument, select BOE Web Application Service.
• If you want the WACS to host web services such as Live Office or Query as a Web Service
(QaaWS), select Web Services SDK and QaaWS Service.
• If you want the WACS to host Business Process BI Web Services, select Business Process BI
Service.
5.
On the next "Create New Server" screen, select additional services that you want the WACS to host, and click Next.
6.
On the next "Create New Server" screen, click Next.
7.
On the next "Create Server Screen" screen, select a node to add the server to, type a server name and description for the server, and click Create.
Note:
Only nodes that have WACS installed will appear in the Node list.
8.
On the "Servers" screen, double-click the new WACS.
The "Properties" screen appears.
9.
If you do not want the WACS to automatically start when the system restarts, in the "Common
Settings" pane, ensure that the Automatically start this server when the Server Intelligence
Agent starts check box is unchecked.
10.
Click Save & Close.
A new WACS is created. The default settings and properties are applied to the server.
436 2012-12-12
Managing Web Application Container Servers (WACS)
11.1.2.3 Cloning a Web Application Container Server
As an alternative to adding a new WACS to your deployment, you can also clone a WACS, either to the same machine or to another machine. While adding a new WACS creates a server with the default settings, cloning a WACS applies the settings of the source WACS to the new WACS.
Servers can only be cloned to machines that already have WACS installed.
Note:
It is recommended that you run a single WACS on the same machine at the same time due to high resource utilization. However, you can deploy more than one WACS on the same machine, and only run one of them, to help you recover in the event of a misconfigured WACS.
1.
Go to the "Servers" management area of the CMC.
2.
Select the WACS that you want to clone, right-click and select Clone Server.
The "Clone Server" screen displays a list of nodes in your deployment that you can clone the WACS to. Only those nodes that have WACS installed appear in the Clone to Node list.
3.
On the "Clone Server" screen, type a new server name, select the node that you want to clone the server to, and click OK.
A new WACS is created. The new server contains the same services as the server that it is cloned from. The new server and services that it hosts have the same settings as the server it was cloned from, with the exception of the server name.
Note:
If you cloned a WACS to the same machine, you may have port conflicts with the WACS that was used for cloning. If this occurs, you must change the port numbers on the newly cloned WACS instance.
Related Topics
•
437
11.1.2.4 Deleting WACS from your deployment
You can only delete a WACS if the server isn't currently serving the CMC to you. If you want to delete a WACS from your deployment, you must log on to a CMC from another WACS or a Java application server. You cannot delete a WACS that is currently serving the CMC to you.
1.
Go to the "Servers" management area of the CMC.
2.
Stop the server that you want to delete by right-clicking the server and clicking Stop Server.
3.
Right-click the server and select Delete.
2012-12-12
Managing Web Application Container Servers (WACS)
4.
When prompted for confirmation, click OK.
11.1.3 Adding or removing services to WACS
438
11.1.3.1 To add a web application or web service to a WACS
Adding additional SAP BusinessObjects Business Intelligence platform web applications or web services to a WACS requires that you stop the WACS. Therefore, you must have at least one additional CMC hosted on a WACS in your deployment that provides a BOE Web Application Service while you are stopping and adding a service to the other WACS.
When you add a service to WACS, the service is automatically deployed to WACS when the server is restarted.
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the WACS that you want to add the service to, and view the properties of the server to ensure that the service that you want to add is not already present.
3.
Click Cancel to return to the "Servers" screen.
4.
Stop the server by right-clicking the server and clicking Stop Server.
If you are trying to stop the WACS that is currently serving the CMC to you, a warning message appears. Don't proceed unless you have at least one additional running BOE Web Application Service on another WACS in your deployment. If you do, click OK, log on to another WACS, and start this procedure from the beginning.
5.
Right-click the server and choose Select Services.
The "Select Services" screen appears.
6.
Select the service that you want to add to the server, add the service to the server by clicking >, and click OK.
7.
Start the WACS by right-clicking the server and clicking Start Server.
The service is added to the WACS. The default settings and properties for the service are applied.
11.1.3.2 To remove a web application or web service from a WACS
In order to remove a web application or web service from a WACS, you must log on to a CMC on another
WACS or on a Java application server. You cannot stop the WACS that is currently serving the CMC to you.
2012-12-12
Managing Web Application Container Servers (WACS)
You cannot delete the last service from a WACS. Therefore, if you are removing a web service from a
WACS, you must ensure that the server is hosting at least one other service.
If you want to remove the last service from a WACS, delete the WACS itself.
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the WACS that you want to remove the web service from, and view the properties of the server to ensure that the web service that you want to remove is present.
3.
Click Cancel to return to the "Servers" screen.
4.
Stop the WACS by right-clicking the server and clicking Stop Server.
If you are trying to stop the WACS that is currently serving the CMC to you, a warning message appears. Don't proceed unless you have at least one additional running BOE Web Application Service on another WACS in your deployment. If you do, click OK, log on to another WACS, and start this procedure from the beginning.
5.
Right-click the WACS and choose Select Services.
The "Select Services" screen appears.
6.
Select the service that you want to remove, click <, and then click OK.
7.
Start the WACS by right-clicking the server and clicking Start Server.
The service is removed from the WACS.
11.1.4 Configuring HTTPS/SSL
You can use the Secure Sockets Layer (SSL) protocol and HTTP for network communication between clients and WACS in your SAP BusinessObjects Business Intelligence platform deployment. SSL/HTTPS encrypts network traffic and provides improved security.
There are two types of SSL:
• CorbaSSL, which is used between SAP BusinessObjects Business Intelligence platform servers
(including WACS and other SAP BusinessObjects Business Intelligence platform servers) in your deployment. For information about using SSL between the SAP BusinessObjects Business Intelligence platform servers in your deployment, read about communication between BI platform components in a firewall in this guide.
• HTTP over SSL, which occurs between WACS and clients (for example, browsers) that communicate with WACS
Note:
If you are deploying WACS in a deployment with a proxy or reverse proxy and want to use SSL to secure the network communication in your deployment, create two WACS. See the information about using WACS with a reverse proxy in this guide.
To configure HTTPS/SSL on a WACS, you must complete these steps:
• Generate or obtain a PKCS12 certificate store or JKS keystore which contains your certificates and private keys. You can use Microsoft's Internet Information Service (IIS) and Microsoft Management
439 2012-12-12
Managing Web Application Container Servers (WACS)
Console (MMC) to generate a PCKS12 file, or use openssl or the Java keytool command line tool to generate a keystore file.
• If you want only certain clients to connect to a WACS, then you must generate a certificate trust list file.
• When you have a certificate store and, if necessary, a certificate trust list file, copy the files to the
WACS machine.
• Configure HTTPS on the WACS.
Related Topics
•
To configure the system for firewalls
•
Understanding communication between BI platform components
•
Using WACS with a reverse proxy
440
11.1.4.1 To generate a PKCS12 certificate file store
There are many ways of generating a PKCS12 certificate file stores or Java keystores, and tools that you can use. The method that you use depends on the tools that you have access to and are familiar with.
This example demonstrates how to generate a PKCS12 file using Microsoft's Internet Information
Services (IIS) and the Microsoft Management Console (MMC).
1.
Log on to the machine that hosts WACS as an administrator.
2.
In IIS, request a certificate from Certificate Authority. For information on doing this, see the IIS help documentation.
3.
Start the MMC by clicking Start > Run, typing mmc.exe, and clicking OK.
4.
Add Certificates Snap-in to the MMC: a.
From File menu, click Add/Remove Snap-in.
b.
Click Add.
c.
On the "Add Standalone Snap-in" dialog box, select Certificates, and click Add.
d.
Select Computer account, and click Next.
e.
Select Local Computer, and click Finish.
f.
Click Close, and click OK.
The Certificates Snap-In is added to the MMC.
5.
In the MMC, expand Certificates, and select the certificate that you want to use.
6.
On the Action menu, select All Tasks > Export.
The "Certificate Export Wizard" starts.
7.
Click Next.
8.
Select Yes, export the private key, and click Next.
2012-12-12
Managing Web Application Container Servers (WACS)
9.
Select Personal Information Exchange - PKCS #12 (.PFX), and click Next.
10.
Enter the password you used when you created the certificate and click Next. You must specify this password in the Private Key Access Password field when you configure HTTPS for the WACS.
A PKCS12 certificate file store is created.
11.1.4.2 To generate a Certificate Trust List
1.
Log on to the machine that hosts WACS as an administrator.
2.
Start the Microsoft Management Console (MMC).
3.
Add the Internet Information Services Snap-in: a.
From the File menu, select Add/Remove Snap-in, and click Add.
b.
In the "Add Standalone Snap-in" dialog, select Internet Information Services (IIS) Manager, and click Add.
c.
Click Close, and click OK.
The IIS snap-in is added to the MMC.
4.
In the left pane of the MMC, find the web site for which you want to create the Certificate Trust List.
5.
Right-click the web site, and select Properties.
6.
Click the Directory Security tab, and under "Secure Communications", click Edit.
7.
Click Enable certificate trust list, and click New.
The "Certificate Trust List Wizard" starts.
8.
Click Next.
9.
Click Add from Store or Add from File, select the certificate that you want to add to the Certificate
Trust List, click OK, and click Next.
10.
Type a name and description for the Certificate Trust List, and click Next.
11.
Click Finish, and then click OK.
The Certificate Trust List is displayed in the Current CTL field.
12.
Select the Certificate Trust List and click Edit.
The "Certificate Trust List Wizard" starts.
13.
Click Next.
14.
On the Current CTL certificates list, select the Trust List, and click View Certificates.
15.
Click the Details tab, and click Copy to File.
The "Certificate Export Wizard" starts.
16.
Click Next.
17.
Select Yes, export the private key, and click Next.
18.
Select Personal Information Exchange - PKCS #12 (.PFX), and click Next.
441 2012-12-12
Managing Web Application Container Servers (WACS)
19.
Enter the password you used when you created the certificate and click Next. You must specify this password in the Certificate Trust List Private Key Access Password field when you configure
HTTPS for the WACS.
11.1.4.3 To configure HTTPS/SSL
Before you configure HTTPS/SSL on your WACS, ensure that you've already created a PCKS12 file or JKS keystore, and that you've copied or moved the file to the machine that is hosting the WACS.
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the WACS the server for which you want to enable HTTPS.
The "Properties" screen appears.
3.
In the "HTTPS Configuration" section, check the Enable HTTPS check box.
4.
In the Bind to Hostname or IP Address field, specify the IP address for which the certificates were issued and to which WACS will bind.
HTTPS services will be provided through IP address that you specify.
5.
In the HTTPS Port field, specify a port number for WACS to provide HTTPS service. You must ensure that this port is free. If you plan to allow users to connect to the WACS from outside a firewall, you must also ensure that this port is open on the firewall.
6.
If you are configuring SSL with a reverse proxy, specify the proxy server's hostname and port in the
Proxy Hostname and Proxy Port fields.
7.
On the Protocol list, select a protocol. The available options are:
•
SSL
SSL is the Secure Sockets Layer protocol, which is a protocol for encrypting network traffic.
•
TLS
TLS is the Transport Layer Security protocol, and is a newer, enhanced protocol. The differences between SSL and TLS are minor, but include stronger encryption algorithms in TLS.
8.
Under the Certificate Store Type field, specify the file type for the certificate. The available options are:
•
PKCS12
Select PKCS12 if you are more comfortable working with Microsoft tools.
•
JKS
Select JKS if you are more comfortable working with Java tools.
9.
In the Certificate Store File Location field, specify the path where you copied or moved the certificate file store or Java keystore file.
10.
In the Private Key Access Password field, specify the password.
442 2012-12-12
Managing Web Application Container Servers (WACS)
PKCS12 certificate stores and JKS keystores have private keys that are password protected, to prevent unauthorized access. You must specify the password for accessing the private keys, so that
WACS can access the private keys.
11.
It is recommended that you either use a certificate file store or keystore that either contains a single certificate, or where the certificate that you want to use is listed first. However, if you are using a certificate file store or keystore that contains more than one certificate, and that certificate is not the first one in the filestore, in the Certificate Alias field, you must specify the alias for the certificate.
12.
If you want the WACS to only accept HTTPS requests from certain clients, enable client authentication.
Client authentication doesn't authenticate users. It ensures that WACS only serves HTTPS requests to certain clients.
a.
Check Enable Client Authentication.
b.
In the Certificate Trust List File Location, specify the location of the PCKS12 file or JKS keystore that contains the trust list file.
Note:
The Certificate Trust List type must be the same as the Certificate Store type.
c.
In the Certificate Trust List Private Key Access Password field, type the password that protects the access to the private keys in the Certificate Trust List file.
Note:
If you enable client authentication, and a browser or web service consumer is not authenticated, the
HTTPS connection is rejected.
13.
Click Save & Close.
14.
Go to the "Metrics" screen, and ensure that HTTPS connector appears under List of Running WACS
Connectors. If HTTPS does not appear, then ensure that the HTTPS connector is configured correctly.
11.1.5 Supported authentication methods
WACS supports the following authentication methods:
• Enterprise
• LDAP
• AD Kerberos
WACS does not support the following authentication methods:
• NT
• AD NTLM
• LDAP with Single sign-on
443 2012-12-12
Managing Web Application Container Servers (WACS)
11.1.6 Configuring AD Kerberos for WACS
To configure AD Kerberos authentication for WACS, you must first configure your machine to support
AD. You must perform the following steps.
• Enabling the Windows AD security plug-in.
• Mapping users and groups.
• Setting up a service account.
• Setting up constrained delegation.
• Enabling Kerberos authentication in the Windows AD plug-in for WACS.
• Creating configuration files.
After you've setup the machine that is hosting WACS to use AD Kerberos authentication, you must perform additional configuration steps through the Central Management Console (CMC).
Related Topics
•
•
•
Setting up a service account for AD authentication with Kerberos
•
To configure constrained delegation for Vintela SSO
•
Setting up a service account for AD authentication with Kerberos
•
Enabling Kerberos authentication in the Windows AD plug-in for WACS
•
•
Configuring WACS for AD Kerberos
•
Configuring AD Kerberos single sign-on
444
11.1.6.1 Enabling Kerberos authentication in the Windows AD plug-in for WACS
In order to support Kerberos, you have to configure the Windows AD security plug-in in the CMC to use
Kerberos authentication. This includes:
• Ensuring Windows AD authentication is enabled.
• Entering the AD Administrator account.
Note:
This account requires read access to Active Directory only; it does not require any other rights.
•
• Entering the service principal name (SPN) for the service account.
2012-12-12
Managing Web Application Container Servers (WACS)
11.1.6.1.1 Prerequisites
Before you configure the Windows AD security plug-in for Kerberos, you must have completed the following tasks:
• Set up a service account
• Grant rights to the service account
• Configure servers for Windows AD with Kerberos
• Map AD users and groups and configure the Windows AD security plug-in
Related Topics
•
Setting up a service account for AD authentication with Kerberos
•
Running the SIA under the BI platform service account
•
11.1.6.1.2 To configure the Windows AD security plug-in for Kerberos
1.
Go to the Authentication management area of the CMC.
2.
Double-click Windows AD.
3.
Ensure that the Windows Active Directory Authentication is enabled check box is selected.
4.
Under Authentication Options, select Use Kerberos authentication.
5.
In the Service principal name field, enter the account and domain of the service account or the
SPN mapping to the service account.
Use the following format, where svcacct is the name of the service account or SPN you created earlier, and DNS.COM is your fully qualified domain in uppercase. For example, the Service Account would be [email protected] and the SPN would be BOBJCentralMS/[email protected].
Note:
• If you plan to allow users from other domains than the default domain to log on, you must provide the SPN you mapped earlier.
• The service account is case sensitive. The case of the account you enter here must match with what is set up in your Active Directory Domain.
• This must be the same account that you use to run the SAP BusinessObjects Business Intelligence platform servers or the SPN that maps to this account.
Related Topics
•
Configuring AD Kerberos single sign-on
445 2012-12-12
Managing Web Application Container Servers (WACS)
446
11.1.6.2 Creating configuration files
The general process of configuring Kerberos on your application server involves these steps:
• Creating the Kerberos configuration file.
• Creating the JAAS login configuration file.
Note:
• The default Active Directory domain must be in uppercase DNS format.
• You don't need to download and install MIT Kerberos for Windows. You also no longer require a keytab for your service account.
11.1.6.2.1 To create the Kerberos configuration file
Follow these steps to create the Kerberos configuration file.
1.
Create the file krb5.ini, if it does not exist, and store it under C:\WINNT for Windows.
Note:
You can store this file in a different location. However if you do, you need to specify its location in the Krb5.ini File Location field on the "Properties" page for the WACS server, in the CMC.
2.
Add the following required information in the Kerberos configuration file:
[libdefaults] default_realm = DOMAIN.COM
dns_lookup_kdc = true dns_lookup_realm = true default_tkt_enctypes = rc4-hmac default_tgs_enctypes = rc4-hmac
[domain_realm]
.domain.com = DOMAIN.COM
domain.com = DOMAIN.COM
.domain2.com = DOMAIN2.COM
domain2.com = DOMAIN2.COM
[realms]
DOMAIN.COM = { default_domain = DOMAIN.COM
kdc = HOSTNAME.DOMAIN.COM
}
DOMAIN2.COM = { default_domain = DOMAIN2.COM
kdc = HOSTNAME.DOMAIN2.COM
}
[capaths]
DOMAIN2.COM = {
DOMAIN.COM =
}
Note:
•
DNS.COM
is the DNS name of your domain which must be entered in uppercase in FQDN format.
• kdc is the Host name of the Domain Controller.
• You can add multiple domain entries to the [realms] section if your users log in from multiple domains. To see a sample of this file with multiple domain entries, see
2012-12-12
Managing Web Application Container Servers (WACS)
• In a multiple domain configuration, under [libdefaults] the default_realm value may be any of the desired domains. The best practice is to use the domain with the greatest number of users that will be authenticating with their AD accounts.
11.1.6.2.2 To create the JAAS login configuration file
1.
Create a file called bscLogin.conf if it does not exist, and store it in the default location: C:\WINNT.
Note:
You can store this file in a different location. However if you do, you will need to specify its location in the bscLogin.conf File Location field on the "Properties" page for the WACS server, in the CMC.
2.
Add the following code to your JAAS bscLogin.conf configuration file: com.businessobjects.security.jgss.initiate { com.sun.security.auth.module.Krb5LoginModule required;
};
3.
Save and close the file.
11.1.6.2.3 Sample Krb5.ini files
Sample multiple domain Krb5.ini file
The following is a sample file with multiple domains:
[domain_realm]
.domain03.com = DOMAIN03.COM
domain03.com = DOMAIN03.com
.child1.domain03.com = CHILD1.DOMAIN03.COM
child1.domain03.com = CHILD1.DOMAIN03.com
.child2.domain03.com = CHILD2.DOMAIN03.COM
child2.domain03.com = CHILD2.DOMAIN03.com
.domain04.com = DOMAIN04.COM
domain04.com = DOMAIN04.com
[libdefaults] default_realm = DOMAIN03.COM
dns_lookup_kdc = true dns_lookup_realm = true
[realms]
DOMAIN03.COM = { admin_server = testvmw2k07 kdc = testvmw2k07 default_domain = domain03.com
}
CHILD1.DOMAIN03.COM = { admin_server = testvmw2k08 kdc = testvmw2k08 default_domain = child1.domain03.com
}
CHILD2.DOMAIN03.COM = { admin_server = testvmw2k09 kdc = testvmw2k09 default_domain = child2.domain03.com
}
DOMAIN04.COM = { admin_server = testvmw2k011 kdc = testvmw2k011
} default_domain = domain04.com
447 2012-12-12
Managing Web Application Container Servers (WACS)
Sample single domain Krb5.ini file
Following is a sample krb5.ini file with a single domain.
[libdefaults] default_realm = ABCD.MFROOT.ORG
dns_lookup_kdc = true dns_lookup_realm = true
[realms]
ABCD.MFROOT.ORG = { kdc = ABCDIR20.ABCD.MFROOT.ORG
kdc = ABCDIR21.ABCD.MFROOT.ORG
} kdc = ABCDIR22.ABCD.MFROOT.ORG
kdc = ABCDIR23.ABCD.MFROOT.ORG
default_domain = ABCD.MFROOT.ORG
448
11.1.6.3 Configuring WACS for AD Kerberos
After you've configured the machine that is hosting WACS for AD Kerberos authentication, you must configure the WACS itself, through the Central Management Console (CMC).
11.1.6.3.1 To configure WACS for AD Kerberos
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the WACS that you want to configure AD for.
The "Properties" screen appears.
3.
In the Krb5.ini File Location field, specify the path to the krb5.ini configuration file.
4.
In the bscLogin.conf File Location field, specify the path to the bscLogin.conf configuration file.
5.
Click Save & Close.
6.
Restart the WACS.
11.1.6.4 Troubleshooting Kerberos
These steps may help you if you encounter problems when configuring Kerberos:
• Enabling logging
• Testing your Kerberos configuration
11.1.6.4.1 To enable Kerberos logging
1.
Start the Central Configuration Manager (CCM), and click Manage Servers.
2.
Specify the logon credentials.
3.
On the "Manage Servers" screen, stop the WACS.
2012-12-12
Managing Web Application Container Servers (WACS)
4.
Click web tier Configuration.
Note:
The web tier Configuration icon is only enabled when you select a WACS that is stopped.
The "web tier Configuration" screen appears.
5.
Under Command Line Parameters, copy the following text to the end of the parameters:
“-Dcrystal.enterprise.trace.configuration=verbose
-Djcsi.Kerberos.debug=true”
6.
Click OK.
7.
On the "Manage Servers" screen, start the WACS.
11.1.6.4.2 To test your Kerberos configuration
• Run the following command to test your Kerberos configuration, where servact is the service account and domain under which the CMS is running, and password is the password associated with the service account.
<Install Directory>\Business Objects\javasdk\bin\kinit.exe [email protected] Password
For example:
C:\Program Files\Business Objects\javasdk\bin\kinit.exe [email protected] Password
If you still have a problem, ensure that the case you entered for your domain and service principal name match exactly with what is set in Active Directory.
11.1.6.4.3 Mapped AD user unable to log on to BusinessObjects Business Intelligence platform on WACS
The following two issues may occur, despite the fact that the users have been mapped to SAP
BusinessObjects Business Intelligence platform.
Logon failure due to different AD UPN and SAM names
A user's Active Directory ID has successfully been mapped to SAP BusinessObjects Business Intelligence platform. Despite this fact, they are unable to successfully log on to CMC with AD authentication and
Kerberos in the following format: DOMAIN\ABC123
This problem can happen when the user is set up in Active Directory with a UPN and SAM name that are not the same, either in case or otherwise. Following are two examples which may cause a problem:
• The UPN is [email protected] but the SAM name is DOMAIN\ABC123.
• The UPN is jsmith@company but the SAM name is DOMAIN\johnsmith.
There are two ways to address this problem:
• Have users log in using the UPN name rather than the SAM name.
• Ensure the SAM account name and the UPN name are the same.
449 2012-12-12
Managing Web Application Container Servers (WACS)
Pre-authentication error
A user who has previously been able to log on, can no longer log on successfully. The user will receive this error: Account Information Not Recognized. The WACS logs reveal the following error: "Pre-au thentication information was invalid (24)"
This can occur because the Kerberos user database didn't get a change made to UPN in AD. This may mean that the Kerberos user database and the AD information are out of sync.
To resolve this problem, reset the user's password in AD. This will ensure the changes are propagated correctly.
11.1.7 Configuring AD Kerberos single sign-on
If you are configuring AD Kerberos single sign-on for BI launch pad or Web Services SDK and QaaWS, ensure that you have configured both the WACS and the machine that is hosting WACS for AD Kerberos authentication.
Note:
If you plan to use single sign-on in a reverse proxy environment, read the security section of this guide.
Related Topics
•
Configuring WACS for AD Kerberos single sign-on
•
Configuring your machine for AD Kerberos single sign-on
•
Configuring WACS for AD Kerberos single sign-on
•
11.1.7.1 Configuring your machine for AD Kerberos single sign-on
To configure AD Kerberos single sign-on for Web Services SDK and QaaWS, you must first configure the machine that is hosting WACS :
•
To configure constrained delegation for Vintela SSO
•
To set up the service account for Vintela SSO
•
•
To increase the header size limit of your WACS
The following sections describe how to complete each of these steps.
450 2012-12-12
Managing Web Application Container Servers (WACS)
451
11.1.7.1.1 Setting up multiple SPNs
Using multiple SPNs is not supported.
11.1.7.1.2 To increase the header size limit of your WACS
Active Directory creates a Kerberos token which is used in the authentication process. This token is stored in the HTTP header. Your WACS will have a default HTTP header size which will be sufficient for most user. This header size can be configured.
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the WACS for which you want to change the HTTP header size.
The "Properties" screen appears.
3.
Under the "HTTP Configuration", "Configuration of HTTP through Proxy", or "HTTPS Configuration" section, specify a value in the Maximum HTTP Header Size (in bytes) field.
4.
Click Save & Close.
5.
Restart the server.
11.1.7.2 Configuring WACS for AD Kerberos single sign-on
You can configure a Web Application Container Server to use AD Kerberos single sign-on. AD Kerberos single sign-on is supported. AD NTLM is not supported.
Before you configure WACS, you must configure AD Kerberos single sign-on for the machine that is hosting the WACS.
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the WACS that you want to configure.
The "Properties" screen appears.
3.
Check Enable Kerberos Active Directory Single Sign On.
4.
Specify values for Default AD Domain, Service Principal Name, and Keytab File properties, and click Save & Close.
5.
Restart the WACS.
Active Directory single sign-on is ready for use.
11.1.7.3 Configuring Kerberos and single sign-on to the database
Single sign-on to the database is supported for deployments that meet all these requirements:
2012-12-12
Managing Web Application Container Servers (WACS)
• The deployment of SAP BusinessObjects Business Intelligence platform is on WACS.
• WACS has been configured with AD with Kerberos.
• The database to which single sign-on is required is a supported version of SQL Server or Oracle.
• The groups or users that need access to the database must have been granted permissions within
SQL Server or Oracle.
• The Cache Security context check box (which is required for single sign-on to the database) in the
AD Authentication page of the CMC is checked.
The final step is to modify the krb5.ini file to support single sign-on to the database.
Note:
These instructions explain how to configure single sign-on to the database. If you want to configure end-to-end single sign-on to the database, you must also perform the configuration steps required for
Vintela single sign-on. For details, see
Configuring AD Kerberos single sign-on .
11.1.7.3.1 To enable single sign-on to the database
1.
Open the krb5.ini file that is being used for your deployment of SAP BusinessObjects Business
Intelligence platform.
The default location for this file is the WINNT directory on your web application server.
2.
Go to the [libdefaults] section of the file.
3.
Enter this string prior to the start of the [realms] section of the file: forwardable = true
4.
Save and close the file.
5.
Restart your WACS.
11.1.8 Configuring RESTful web services
The Business Intelligence platform RESTful web services SDK allows you to access the BI platform using the HTTP protocol. This enables users to navigate the BI platform repository and schedule objects using any programming language that supports HTTP requests. RESTful web services are installed as part of WACS.
This section explains how to administer RESTful web services. For more information about RESTful web services, see the Business Intelligence Platform RESTful Web Service Developer Guide.
11.1.8.1 To configure the base URL for RESTful web services
452 2012-12-12
Managing Web Application Container Servers (WACS)
If your BI platform deployment uses a proxy server or contains more than one instance of the Web
Application Container Server (WACS), you may need to configure the base URL for use with RESTful web services. Before you configure the base URL, you must know the server name and port number that listens to RESTful web service requests.
The base URL is used as part of every RESTful web service request. Developers programmatically discover the base URL and use it to direct RESTful web service requests to the correct server and port.
The base URL is also used in RESTful web service responses to define hyperlinks to other RESTful resources.
Note:
In default installations of the BI platform, the base URL is defined as http://<server name>:6405/biprws
. Replace <servername> with the name of the server that hosts RESTful web services.
1.
Log on to the Central Management Console (CMC) as an administrator.
2.
In the CMC, select Applications.
A list of applications is displayed.
3.
Right-click RESTful Web Service > Properties.
The "Properties" dialog box appears.
4.
In the Access URL text box, type the name of the base URL for RESTful web services.
For example, type http://<servername>:<portnumber>/biprws. Replace <servername> and <portnumber> with the name of the server and the port that listens to RESTful web service requests.
5.
Click Save and Close.
453
11.1.8.2 To enable the error message stack
As an administrator, you can configure the error messages returned by RESTful web services to include the error stack. The error stack provides extra debugging information that can be used to discover where errors have occurred.
Note:
You may not want to enable the error stack in production scenarios, because it could provide information about the BI platform that you do not want to reveal to end users. It is recommended to enable the error stack in production scenarios as required for debugging, and to turn it off when it is no longer needed.
1.
Log on to the Central Management Console as administrator user.
2.
Click Servers, and then click Servers List.
3.
Right-click on your Web Application Container Server (WACS), for example, right-click on
MySIA.WebApplicationContainerServer
, and click Properties.
The Properties tab for the WACS server appears.
4.
In the RESTful Web Service area, select Show Error Stack.
2012-12-12
Managing Web Application Container Servers (WACS)
5.
Click Save and Close.
Error stack information is included in RESTful web service error messages.
11.1.8.3 To set the default number of entries displayed on each page
When a RESTful web service response contains a feed with a large number of entries, the response can be divided into pages. You can configure the default number of entries that are displayed on each page. When developers make RESTful web service requests, they can specify the number of entries to display on each page. However, if they do not specify this value then the default page size is used.
1.
Log on to the Central Management Console as an administrator.
2.
Click Servers, and then click Servers List.
3.
Right-click on your Web Application Container Server (WACS), for example, right click on
MySIA.WebApplicationContainerServer
, and click Properties.
The Properties tab for the WACS server appears.
4.
In the RESTful Web Service area, type the default page size in the Default Number of Objects
on One Page text area.
5.
Click Save and Close.
11.1.8.4 To set the timeout value of a logon token
Logon tokens expire after they have not been used for a certain amount of time. You can set the amount of time that an unused logon token remains valid.
Note:
By default, the logon token timeout value is one hour.
1.
Log on to the Central Management Console as an administrator.
2.
Click Servers, and then click Servers List.
3.
Right-click on your Web Application Container Server (WACS), for example, right click on
MySIA.WebApplicationContainerServer
, and click Properties.
The Properties tab for the WACS server appears.
4.
In the RESTful Web Service area, type the number of minutes for a logon token to be valid in the
Enterprise Session Token Timeout (minutes) text area.
5.
Click Save and Close.
454 2012-12-12
Managing Web Application Container Servers (WACS)
455
11.1.8.5 To configure session pool settings
You can improve server performance by using a session pool. The session pool caches active RESTful web service sessions so they can be reused when a user sends another request that uses the same logon token in the HTTP request header. The session pool size defines the number of cached sessions to be stored at one time, and the session timeout value controls the amount of time that a session is cached.
You can set the session pool size and the session timeout value:
1.
Log on to the Central Management Console (CMC) as an administrator.
2.
Click Servers, and then click Servers List.
3.
Right-click on your Web Application Container Server (WACS), for example, right-click on
MySIA.WebApplicationContainerServer
, and click Properties.
The Properties tab for the WACS server appears.
4.
Type the maximum number of sessions to cache in the Session Pool Size text box of the RESTful
Web Service area.
5.
Type the session pool timeout value in the Session Pool Timeout (minutes) text box of the RESTful
Web Service area.
6.
Click Save and Close.
7.
Right-click on the WACS server, for example, MySIA.WebApplicationContainerServer, and click Restart Server.
11.1.8.6 To enable HTTP basic authentication
HTTP basic authentication lets users make RESTful web service requests without providing a logon token. If HTTP basic authentication is enabled, users are prompted to provide their user name and password the first time they make a RESTful web service request.
Note:
User names and passwords are not transmitted securely with HTTP basic authentication, unless it is used in conjunction with HTTPS.
When you enable HTTP basic authentication, you set the default HTTP basic authentication type to
SAP, Enterprise, LDAP, or WinAD. Users can override the default HTTP basic authentication type when they log on.
Logging on to the BI platform using HTTP basic authentication consumes a license. If the session pool caching is used, the request uses the license associated with its cached session. If session pool caching
2012-12-12
Managing Web Application Container Servers (WACS) is not used, a license is consumed while the request is in progress and released once the request is finished.
1.
Log on to the Central Management Console (CMC) as an administrator.
2.
Click Server > Servers List.
3.
Right-click on your Web Application Container Server (WACS), for example, right-click on
MySIA.WebApplicationContainerServer
, and click Properties.
The Properties tab for the WACS server appears.
4.
In the "RESTful Web Service" area, select Enable HTTP Basic Authentication.
5.
(Optional) In the Default Authentication Scheme for HTTP Basic list, select the default type of
HTTP basic authentication.
6.
Click Save and Close.
When an end user logs on using HTTP basic authentication, they can specify the type of authentication to use. In a web browser, the user types <authtype>\<username> in the user name prompt, and
<password> in the password prompt.
To log on using HTTP basic authentication programmatically, users add the Authorization attribute to the HTTP request header, and set the value to be Basic <authtype>\<username>:<password>.
Replace <authtype> with the authentication type, <username> with the user name, and <password> with the password. The authentication type, user name, and password must be base64-encoded as defined by RFC 2617. User names that contain the : character cannot be used with HTTP basic authentication.
Related Topics
•
To configure session pool settings
11.1.9 WACS and your IT environment
This section describes how to configure WACS in a complex environment.
11.1.9.1 Using WACS with other web servers
When a Web Application Container Server (WACS) is installed, it works as an application server and a web server without requiring any extra configuration. You can configure supported web servers like
Internet Information Services (IIS) and Apache to perform URL forwarding to the WACS server.
Note:
Request forwarding from IIS by using an ISAPI filter to WACS is not supported.
456 2012-12-12
Managing Web Application Container Servers (WACS)
WACS does not support a deployment scenario where a web server hosts static content and WACS hosts dynamic content. Static and dynamic content must always reside on WACS.
11.1.9.2 Using WACS with a load balancer
To use WACS in a deployment with a hardware load balancer, you must configure the load balancer so that it uses either IP routing or active cookies. This way, once a user's session is established on one
WACS, all subsequent requests by the same user are sent to the same WACS.
WACS is not supported with hardware load balancers using passive cookies.
If your hardware load balancer forwards SSL-encrypted HTTPS requests to your WACS, then you must configure HTTPS on the WACS, and install SSL certificates on every WACS.
If your hardware load balancer decrypts HTTPS traffic and forwards decrypted HTTP requests to your
WACS, then no additional WACS configuration is required.
Related Topics
•
457
11.1.9.3 Using WACS with a reverse proxy
You can use WACS in a deployment with a forward or reverse proxy server. You cannot use WACS itself as a proxy server.
11.1.9.3.1 To configure WACS to support HTTP with a reverse proxy
To use WACS in a deployment with a reverse proxy, configure your WACS so that the HTTP Port is used for communication inside a firewall (for example on a secure network), and the HTTP through
Proxy port is used for communication from outside the firewall (for example, the internet).
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the WACS that you want to configure.
The "Properties" screen appears.
3.
In the "Configuration of HTTP through Proxy" section: a.
Check Enable HTTP through Proxy.
b.
Specify the HTTP port of the WACS to be used for communication through the proxy.
c.
Specify the Proxy Hostname and Proxy Port of the proxy server.
4.
Click Save & Close.
2012-12-12
Managing Web Application Container Servers (WACS)
11.1.9.3.2 To configure WACS to support HTTPS with a reverse proxy
Some load balancers and reverse proxy servers can be configured to decrypt HTTPS traffic and then forward the decrypted traffic to your application servers. In this case, you can configure WACS to use
HTTP or HTTP through proxy.
If your load balancer or reverse proxy forwards HTTPS traffic, and you want to configure HTTPS with a reverse proxy, create two WACS. Configure one WACS for HTTPS for external traffic through the reverse proxy, and the other WACS to communicate with clients on your internal network through
HTTPS.
11.1.9.4 Using WACS with firewalls
Deploying WACS in an IT environment with firewalls is supported.
By default, WACS bind to all IP addresses on the machine that it is installed on. If you plan to use a firewall between clients and your WACS, you must force WACS to bind to a specific IP address for
HTTP or HTTP through proxy. To do this, uncheck Bind to All IP Addresses, and then specify a
Hostname or IP address to bind to.
If you plan to use a firewall between a WACS server and the other SAP BusinessObjects Business
Intelligence platform servers in your deployment, see the “Understanding communication between SAP
BusinessObjects Business Intelligence platform components ” section of the SAP BusinessObjects
Business Intelligence platform Administrator Guide.
Related Topics
•
Understanding communication between BI platform components
458
11.1.9.5 To configure WACS on a multihomed machine
A multihomed machine is one that has multiple network addresses. By default, a Web Application
Container Server instances binds its HTTP port to all IP addresses. If you want to bind WACS to a specific Network Interface Card (NIC), for example, when you want to bind the HTTP port of the WACS to one NIC and bind the request port to another NIC:
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the WACS that you want to configure.
The "Properties" screen appears.
3.
In the Configuration of HTTP through Proxy section of the Web Application Container Service pane, uncheck Bind to all IP addresses, and type an IP address for the WACS to bind to.
2012-12-12
Managing Web Application Container Servers (WACS)
4.
In the HTTP Configuration section, uncheck Bind to all IP addresses, and type an IP address or host name for the WACS to bind to.
5.
Under Common Settings, deselect Auto assign, and specify the host name or IP address of the
NIC that's used for communication between WACS and the other Business Intelligence platform servers in your deployment.
6.
Click Save & Close.
7.
Restart the WACS.
11.1.10 Configuring web application properties
The properties for web applications that are hosted on a WACS can be configured in the following ways:
• Properties that are often changed are exposed as configurable service properties for the WACS.
To edit these properties, open the "Properties" screen of the WACS in the Central Management
Console (CMC), modify the value for the appropriate property, and click Save.
• To modify the session timeouts for web applications hosted on WACS, first determine whether the web application has any properties that can be configured in the CMC.
If the web application has properties that can be modified in the CMC, then modify the web_xml.ino
file for the web application. The file is <WebAppName>_web_xml.ino, where <WebAppName> is the name of the web application, and can be found in the <EnterpriseDirectory>/ja va/pjs/services/<WebAppName> directory.
If the web application does not have properties that can be modified in the CMC, modify the web.xml
file for the web application. This file can be found in the <EnterpriseDirectory>/warfile/we bapps/<WebAppName>
, where <WebAppName> is the name of the web application.
• To modify properties other than the session time out or the properties that appear on the "Properties" screen for the WACS in the CMC, modify the .properties file for the web application. See the information in this guide about managing applications through BOE.war properties.
Note:
• Do not modify the web.xml, web_xml.ino, or .properties files in the <EnterpriseDirecto
ry>/java/pjs/container/work/<ServerFriendlyName> directory, as your change will be overwritten every time that the WACS starts or restarts.
• After you modify the properties for a WACS, you must always restart it.
Related Topics
•
To change a server's properties
•
459 2012-12-12
Managing Web Application Container Servers (WACS)
11.1.11 Troubleshooting
11.1.11.1 To configure tracing on WACS
To configure tracing for WACS, see
Logging traces from components
11.1.11.2 To view server metrics
You can view the server metrics of a WACS from the Central Management Console (CMC).
1.
Go to the "Servers" management area of the CMC.
2.
Right-click the WACS, and click Metrics.
Related Topics
•
Web Application Container Server Metrics
11.1.11.3 To view the state of a WACS
To view the state of a WACS, go to the "Servers" area of the CMC. The Servers List includes a State column that provides the state for each server in the list.
WACS has a new server state called “Started with Errors”. A WACS that is in this state is running, but has at least one misconfigured HTTP, HTTP through Proxy, or HTTPS connector.
If a WACS status is “Started with Errors”, go to the "Metrics" page and view the "List of Running WACS
Connectors" metric. If an enabled connector does not appear in the list, the connector has not been configured properly.
460 2012-12-12
Managing Web Application Container Servers (WACS)
461
11.1.11.4 Resolving port conflicts
If you cannot get any pages when you try to access the CMC through a particular port, ensure that another application has not taken over the HTTP, HTTP through proxy, or HTTPS ports that you have specified for WACS.
There are two ways to determine if there are port conflicts with your WACS. If you have more than one
WACS in your deployment, log on to the CMC and check the Running WACS Connectors and WACS
Startup Errors metrics. If the HTTP, HTTP through Proxy, or HTTP connectors do not appear in the
Running WACS Connectors list, these connectors are not able to start due to a port conflict.
If your deployment has only one WACS, or If you are not able to access the CMC through any WACS, use a utility such as netstat to determine if another application has taken a WACS port.
11.1.11.4.1 To resolve HTTP port conflicts
1.
Start the Central Configuration Manager (CCM), and click the Manage Servers icon.
2.
Specify the logon credentials.
3.
On the "Manage Servers" screen, stop the WACS.
4.
Click the web tier Configuration icon.
Note:
The web tier Configuration icon is only enabled when you select a WACS that is stopped.
The "web tier Configuration" screen appears.
5.
In the HTTP Port field, specify a free HTTP port to be used by the Web Application Container Server, and click OK.
6.
On the "Manage Servers" screen, start the WACS.
11.1.11.4.2 To resolve HTTP through proxy or HTTPS port conflicts
If you cannot access a WACS through the HTTP through proxy or HTTPS ports, but you can still connect to the Central Management Console (CMC) through the HTTP port, change the port numbers through the CMC.
1.
Go to the "Servers" management area of the CMC.
2.
To stop the WACS that you want to configure, right-click the server and click Stop Server.
3.
Double-click the WACS that you want to configure.
The "Properties" screen appears.
4.
In the "Configuration of HTTP through Proxy" section, specify a new HTTP port.
5.
To change the HTTPS port, in the "HTTPS Configuration" section, type a new value in the HTTPS
Port field.
6.
Click Save & Close.
7.
To start the WACS, right-click the server and click Start Server.
2012-12-12
Managing Web Application Container Servers (WACS)
462
11.1.11.5 To change memory settings
To improve the server performance of a WACS, you can change the amount of memory that is allocated to the server through the Central Configuration Manager (CCM).
1.
Start the CCM, and click the Manage Servers icon.
2.
Specify the logon credentials for the CMC.
3.
On the "Manage Servers" screen, stop the WACS.
4.
Click the web tier Configuration icon.
Note:
The web tier Configuration icon is only enabled when you select a WACS that is stopped.
The "web tier Configuration" screen appears.
5.
Under "Command Line Parameters", specify a new memory value by editing the command line: a.
Find the -Xmx option. This option normally has a value specified.
For example “-Xmx1g”. This setting allocates one gigabyte of memory to the server.
b.
Specify a new value for the parameter.
• To specify a value in megabytes, use “m”. For example, “-Xmx640m” allocates 640 megabytes of memory to the WACS.
• To specify a value in gigabytes, use “g”. For example, “-Xmx2g” allocates two gigabytes of memory to the WACS.
c.
Click OK.
6.
On the "Manage Servers" screen, start the WACS.
11.1.11.6 To change the number of concurrent requests
The default number of concurrent HTTP requests that WACS is configured to handle is 150. This should be acceptable for most deployment scenarios. To improve the performance of WACS, you can increase the maximum number of concurrent HTTP requests. Although increasing the number of concurrent requests can improve performance, setting this value too high can hurt performance. The ideal setting depends on your hardware, software, and IT requirements.
1.
Go to the "Servers" management area of the CMC.
2.
To stop the WACS that you want to configure, right-click the server and click Stop Server.
3.
Double-click the WACS that you want to configure.
The "Properties" screen appears.
2012-12-12
Managing Web Application Container Servers (WACS)
4.
Under "Concurrency Settings (Per Connector)", in the Maximum Concurrent Requests field, type the desired number of concurrent requests, and click Save & Close.
5.
To start the WACS, right-click the server and click Start Server.
11.1.11.7 To restore system defaults
If you have misconfigured a WACS, you can restore the system defaults through the Central Configuration
Manager (CCM).
1.
Start the CCM, and click the Manage Servers icon.
2.
Specify the logon credentials.
3.
On the "Manage Servers" screen, stop the WACS.
4.
Click the web tier Configuration icon.
Note:
The web tier Configuration icon is enabled only when you select a WACS that is stopped.
The "web tier Configuration" screen appears.
5.
Click Restore System Defaults.
6.
If necessary, specify a free HTTP port, and click OK.
7.
On the "Manage Servers" screen, start the WACS.
11.1.11.8 To prevent users from connecting to WACS through HTTP
In certain cases, you may want to allow only users from the local machine to connect to a WACS through
HTTP or HTTPS. For example, although you cannot close the HTTP port, you may want to configure your WACS so that it accepts only HTTP requests from the clients located on the same machine as the WACS. In this way, you can perform maintenance or configuration tasks on the WACS through a browser from the same machine as the WACS, while preventing other users from accessing the server.
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the WACS that you want to modify.
The "Properties" screen appears.
3.
In the Web Application Container Service section, clear the Bind to all IP Addresses check box.
4.
In the Bind to Hostname or IP address field, type 127.0.0.1, and click OK.
5.
To start the WACS, right-click the server and choose Start Server.
A WACS configured this way accepts only connections from the local machine.
463 2012-12-12
Managing Web Application Container Servers (WACS)
11.1.12 WACS properties
For a complete list of the general, HTTP, HTTP through Proxy, and HTTPS configuration properties that can be configured for WACS, see the “Core Server Settings” section of the “Server Properties
Appendix”.
Related Topics
•
464 2012-12-12
Backing Up and Restoring
Backing Up and Restoring
12.1 Backing up and restoring your system
This chapter explains how to back up the Business Intelligence platform system and data files and how to recover your system from hardware failure, software failure, and data loss. To execute a backup and recovery plan, you need an experienced BusinessObjects Professional, System Administrator, and
Database Administrator.
Caution:
To avoid data loss, regularly back up the following components of BI platform:
• All environments
• Your BI platform system
• Your Business Intelligence content, including reports, users, and rights
The backup and recovery process is identical for all environments: development, test, and production.
Tip:
You can back up a Business Intelligence Suite system and then restore it to the same or a different host computer to create a copy of the system.
A backup and recovery plan consists of precautions to take in the event of a system failure due to a natural disaster or a catastrophic event. The plan aims to minimize the effects of the disaster on daily operations so that you can maintain or quickly resume critical functions.
Cold backups and hot backups
If the BI platform system fails, you must restore the system from an available backup.
You perform a cold backup when the system is offline and unavailable to users. You perform a hot backup while the system is in use, and data can change while the backup is being performed.
Restoring the BI platform system and recovering BI content and server settings
If a CMS system database, auditing database, Input File Repository or Output File Repository, or file system becomes lost, damaged, or corrupt, you must restore your BI content and server settings.
Use the Promotion management application to back up BI content and then export the content to
Business Intelligence Archive (LCMBIAR) files. If content is corrupt or missing, you can restore it later, without restoring the entire system. For more information about using the Promotion management application, see the Promotion Management section of this guide.
465 2012-12-12
Backing Up and Restoring
Related Topics
•
Conducting an entire system backup
•
•
To back up server settings in the CCM on Windows
•
To back up server settings on Unix
•
12.1.1 Backups
When backing up your BI platform deployment, you have three options:
• Backing up the entire system, which allows you to restore the entire system. Restoring only a portion of the system is not possible.
• Backing up server settings, which allows you to restore only server settings without restoring other objects, preserving the current state of your system's BI content.
• Backing up BI content, which allows you to selectively restore parts of BI content without the need to restore all objects.
Terms
A backup is a copy of your SAP BusinessObjects data specifically created for the purpose of restoring your system in the event your operational database is compromised. There are several different ways that data can be copied or replicated so it is important to understand what we are talking about when we use the term backup or backup copy.
Data replication creates a copy or copies of your data that are updated in real time, such as mirrored drives. It offers real time data protection from physical data damage, but because the drives are constantly being updated it is not possible to revert your system to an earlier state if data becomes corrupted or accidentally removed.
Versioning creates multiple versions of a specific file or files on your system. In this case, it is possible to revert your system to an earlier state, but with data versioning, all data versions are typically stored on the same host system. If this system is compromised or damaged, you risk losing both the current version and the older versions. Similarly, Undelete functions keep copies of "deleted" files for later recovery, but again these are usually stored on the same host system as the original data. It doesn't offer protection from physical data damage (for example, disc failure).
System and application backups differ in the level of granularity you can use when recovering data. A system backup creates a copy of the entire system. This allows you to revert to an earlier version of the system as a whole. An application backup will back up all the files relating to that application individually. This allows you to selectively restore individual files to earlier versions, without having to revert the entire system.
A cold backup is performed while the system is stopped and unavailable to users. A hot backup is performed while the system is running and available to users.
466 2012-12-12
Backing Up and Restoring
467
12.1.1.1 Conducting an entire system backup
A complete system backup is called a backup set. A backup set is made up of the following backups, created at the same time:
• A backup of the CMS system database
• A backup of the BI platform file system
• A backup of the Input FRS and the Output FRS file stores (if not included in the BI platform file system)
• A backup of the web tier components (if not included as part of the BI platform file system)
• A backup of the Auditing database
As a set, the backup files allow you to restore to the time when the CMS database backup began.
Keeping multiple backup sets from different times gives you more options when restoring the system.
Only the latest backup is required for the auditing database. Any previous backups of the auditing database can be deleted when a new backup is created.
Note:
• We recommend writing the transaction log to a file system other than the main database server system, regularly backing up this transaction log, and keeping it with the other files in the backup set.
• If you back up auditing data, make sure to include the database transaction log for the auditing database with your backup file set. You do not need to include the auditing temporary files with the backup.
The frequency with which you back up your system will depend on your organization's business needs.
You can choose to stop your BI platform system and perform a cold backup, or you can perform a hot backup. With a hot backup, the system stays live and available to users during the backup process. It has the advantage of no downtime for your system.
12.1.1.1.1 To perform a backup
If you are performing a cold backup, stop all nodes in your BI platform deployment.
Note:
While it is important that the procedures are started in the sequence described, it is not necessary to wait for each backup to complete before starting the next. The sequence is only important during a hot backup, cold backups must create the same set of files but can be performed in any order.
1.
Use your database vendor tools to back up the Central Management Server (CMS) system database.
2012-12-12
Backing Up and Restoring
468
Note:
For hot backups, use the database vendor's backup tools in online atomic mode. The bundled database installed with SAP BusinessObjects Business Intelligence platform does not provide tools for database backup.
2.
Use your database vendor tools in online atomic mode to back up the BI platform auditing database.
3.
Back up the entire file system of all host machines where BI platform is installed.
a.
If the Input and Output FRS file stores are not included in the BI platform backup (separate host machines), create a backup copy of both using your file-backup tools.
b.
If the web-tier components are not included in the BI platform backup (separate host machines), create a backup copy of them using your file backup tools.
For hot backups, use atomic file backup tools if possible.
If you performed a cold backup, wait for all backups to complete and then restart your BI platform nodes.
12.1.1.1.2 Hot backups
The hot backup feature allows you to back up your Business Intelligence platform system while continuing to allow users to use the system normally.
Prerequisites
It is easiest to restore your system to a specific backup time. For example, if your system backups are performed daily at 3:00 AM, you can easily restore the system to the state it was in when the CMS system backup started (3:00 AM on the date of your choice). After a CMS database or auditing database failure, if you have enabled transaction logging on the CMS database or the auditing database, you can restore the system to the state it was in immediately before the failure.
For maximum safety, save transaction logging records at a different location than your primary database backup records. This ensures that, in case of database failure, you can perform roll-forward operations.
Note:
• Due to a limitation on transaction log size on older versions of IBM DB2, hot backup and transaction-log-related tasks are supported only if the CMS system database is hosted on DB2 database server version 9.5 Fix Pack 5 or newer (for the 9.5 line), and 9.7 Fix Pack 1 or newer (for the 9.7 line).
• We recommend writing the transaction log to a file system other than the main database server system, regularly backing up this transaction log, and keeping it with other files in the backup set.
Enabling hot backups
If your business must continue operating while your system is backing up, you must enable and configure hot backups. When activating the hot backup feature, keep the following considerations in mind:
• Ensure that the Hot Backup Maximum Duration time is greater than the maximum time you anticipate the backup operation to take—from the time when the CMS backup begins to the time when the FRS backup ends. If the duration is too short, files may be deleted before the backup has a chance to copy them. Balance this concern against system resources because a high value may slightly increase your FRS file store size.
2012-12-12
Backing Up and Restoring
• Crystal Reports 2011 Designer clients, Web Intelligence Rich Clients, and Universe Design Tool clients older than 4.0 FP3, and custom developed thick client applications compiled against SDKs older than 4.0 FP3 might not support file modification during hot backup. If these client applications are modifying BI content during backups, they may compromise the quality of data modified during the backup. You can prevent client applications from modifying documents to ensure the consistency of backed up data. Update client applications to 4.0 FP3 when possible. If it is not possible, you may want to explore workaround options. For example, you can advise users of client applications to delete existing objects and save new versions rather than modify the objects.
To enable hot backups
1.
Open the Central Management Console (CMC).
2.
Navigate to the Settings page.
3.
Click Enable Hot Backup.
4.
Enter the maximum number of minutes you expect the backup to take under Hot Backup Max
Duration.
Be sure to include the time required to backup both the CMS database and the file system of the BI platform host-machine.
Note:
If the actual duration of the backup exceeds the limit entered here it may cause inconsistencies in the backed up data. To avoid this, it is safer to overestimate the time required.
5.
To allow older (before 4.0 FP3) Web Intelligence Rich Client, Crystal Reports Designer, or custom
SDK thick-client applications to modify documents on the system, select the Enable Legacy
Applications Support (Backup Limitations) check box.
Note:
Allowing older client applications to modify documents during backup operations may result in inconsistencies in documents modified during the backup. For information about backup limitations, see the enabling hot backup section.
6.
Click Update.
Hot backup is enabled.
Once hot backup support is enabled, you can perform backups using your database and file system vendor's backup tools.
Related Topics
•
•
12.1.1.2 Backing up server settings
469 2012-12-12
Backing Up and Restoring
470
In order to protect your system from misconfigured server settings, back up your server settings to a
BIAR file on a regular basis. Having available backups of your servers allows you to restore settings without having to restore your Central Management Server (CMS) system database, File Repositories, or Business Intelligence content.
It is essential that you back up your server settings whenever you make any changes to your system's deployment. This includes creating, renaming, moving, and deleting nodes, and creating or deleting servers. It is recommended that you back up your server settings before you change any of the settings, and then again after you're satisfied with the changes that you've made.
Use the Central Configuration Manager (CCM) or a script to back up your BI platform server settings to a BIAR file, and then store the file on a separate machine or storage media. It is recommended that you back up your server settings whenever you modify the settings.
Note:
If you are backing up or restoring server settings in a deployment where SSL is enabled, you must first disable SSL through the CCM, and then re-enable it when the backup or restore is complete.
On Windows, the BackupCluster.bat script is located in the <INSTALLDIR>\SAP
BusinessObjects Enterprise XI 4.0\win64_x64\scripts directory.
On Unix, the backupcluster.sh script is located in the /<INSTALLDIR>/sap_bobj/enter prise_xi40/<platform64>/scripts directory.
Related Topics
•
12.1.1.2.1 To back up server settings in the CCM on Windows
This procedure backs up the server settings for an entire cluster. It is not possible to back up the settings for individual servers.
Note:
If you are using a temporary CMS, you must use the CCM on a machine that has a local CMS binaries installed.
1.
Start the CCM, and on the toolbar, click Back up Server Configuration.
The "Server Configuration Backup Wizard" appears.
2.
Click Next to start the wizard.
3.
Specify whether to use an existing CMS to back up server configuration settings or to create a temporary CMS.
• To back up server settings from a system that is running, select Use existing running CMS, and click Next.
• To back up server settings from a system that is not running, select Start a new temporary
CMS, and click Next.
4.
If you are using a temporary CMS, select a port number for the CMS to run on, and specify the database connection information.
2012-12-12
Backing Up and Restoring
471
To minimize the risk of users accessing your system while you are backing up or restoring your system, specify a port number that is different than the port numbers that your existing CMS uses.
5.
Enter the cluster key, and click Next to continue.
6.
When prompted, log on to the CMS by specifying the system and user name and password of an account with administrative privileges, and click Next to continue.
7.
Specify the location and name of a BAR file that you want to back up the server configuration settings to, and click Next to continue.
The "Confirmation" page displays the information that you have provided.
8.
Verify that the information displayed on the "Confirmation" page is correct, and click Finish to continue.
The CCM backs up the server configuration settings for the entire cluster to the BIAR file that you specify. Details of the backup procedure are written to a log file. The name and path of the log file are displayed in a dialog box.
9.
If the backup operation failed, check the log file to determine the reason.
10.
Click OK to close the wizard.
12.1.1.2.2 To back up server settings on Unix
On Unix, use the serverconfig.sh script to back up your deployment's server settings to a BIAR file.
1.
Select 5 - Back up server configuration and press Enter.
2.
Specify whether to use an existing CMS to back up server configuration settings or to create a temporary CMS.
• To back up server settings from a system that is running, select existing, and press Enter.
• To either back up server settings from a system that isn't running, or to restore server settings, select temporary, and press Enter.
3.
If you are using a temporary CMS to back up your server settings, on the next several screens, select a port number for the temporary CMS to run on, and the connection information to the CMS system database.
To minimize the risk of users accessing your system while you are backing up or restoring your system, specify a port number that is different than the port numbers that your existing CMS uses.
4.
When prompted, log on to the CMS by specifying the system and user name and password of an account with administrative privileges, and press Enter.
5.
When prompted, specify the location and name of a BIAR file that you want to back up the server configuration settings to, and press Enter.
A summary page displays the information that you have provided.
6.
Verify that the information displayed is correct, and press Enter to continue.
The serverconfig.sh script backs up the server configuration settings for the entire cluster to the BIAR file that you specify. Details of the backup procedure are written to a log file. The name and path of the log file are displayed.
7.
If the backup operation failed, check the log file to determine the reason.
2012-12-12
Backing Up and Restoring
12.1.1.2.3 To back up servers settings with a script
You can back up the server settings in your deployment by running the backupcluster.bat script on Windows or the BackupCluster.sh script on Unix.
On Windows, the BackupCluster.bat is located in the <INSTALLDIR>\SAP BusinessObjects
Enterprise XI 4.0\win64_x64\scripts directory.
On Unix, backupcluster.sh is located in the /<INSTALLDIR>/sap_bobj/enter prise_xi40/<platform64>/scripts directory.
Related Topics
•
BackupCluster and RestoreCluster scripts
12.1.1.3 Backing up BI content
You can use the Promotion Management application to regularly back up your Business Intelligence content, such as reports, users and groups, and universes. Having current backups of your content makes it possible to restore your Business Intelligence without having to restore your entire system or your server settings.
For more information about using the Promotion Management application, see the Promotion
Management section of this.
If you are using Subversion, see the information about backing up Subversion files in the Version
Management section of this guide.
12.1.2 Restoring your system
If your system is damaged or corrupted, you can restore the entire system, which restores BI platform.
Depending on the condition of your system, a complete restoration may not be required. If the system is working normally but you have lost or corrupted content, you can choose to restore only Business
Intelligence (BI) content. If BI content is valid but your platform servers have become misconfigured, you can restore only server settings.
The procedure is the same for restoring from a hot or cold backup.
Related Topics
•
•
472 2012-12-12
Backing Up and Restoring
•
473
12.1.2.1 Restoring your entire system
When you restore the entire system, the BI platform cluster is also restored. Depending on what failed in the system, you may still have the option to do only a partial restore.
If any of the following components fails or is lost, you must restore your entire system:
• The CMS database
• The FRS file store
• The file system where the BI platform is installed
If only the auditing database is corrupted or lost, you can restore the auditing database, without restoring the entire system.
If your web-tier content is corrupted or lost, you can restore the web-tier content, without restoring the entire system.
If the rest of BI platform operates normally but the CMS database has crashed, you can restore the
CMS database, without restoring the entire system.
Related Topics
•
•
To restore only the auditing database
•
•
To restore only the CMS database
12.1.2.1.1 To restore your entire system
Before restoring your system, you must use the Central Configuration Manager (CCM) to stop all nodes in your BI platform deployment, and you must choose the point in time when you want to restore the system to.
Note:
If you may want to restore the system to its current state, back up the system before restoring it.
1.
Locate the following backup files:
• CMS database backup
• Input FRS and Output FRS file store backups
• Backups of file systems for every host machine in the BI platform cluster
Note:
Make sure to validate the backups, and ensure that all of the files listed above are from the same backup set. Ensure the CMS database backup start timestamp is earlier than the matching FRS file
2012-12-12
Backing Up and Restoring store, web tier, and host-machine file-system timestamp. All these files will be required, even if only one component failed.
2.
Use your file restore tools to restore the file system of all host machines in the BI platform cluster.
3.
Use your file restore tools to restore the Input and Output FRS file stores.
4.
Use your database tools to restore the CMS database.
5.
If you have changed the CMS database password since the backup was created, use the CCM to update the CMS database password on all nodes and BI platform host machines.
6.
If you use the Auditing feature: a.
Locate the latest backups and transaction logs for the auditing database.
b.
Use the database tools to restore the auditing database.
c.
Perform a roll forward on the auditing database, replaying the transaction log.
7.
Choose one of the following options for restoring your search index:
• If you want to run the search index recovery script, see
To run the search index recovery script
and follow the instructions there. This will provide you with a full index more quickly.
• If you want to rebuild your search index rather than use the recovery script, use the CCM to restart your BI platform nodes. This is a more simple procedure, but while the index is rebuilding you will on have partial search access to the platform data.
Note:
Make a note the time you start the system.
8.
Verify that your system is working as expected, and perform a sanity test.
Once the system has been verified, take the following actions:
• Run the Repository Diagnostic Tool to remove any unused temporary files and check repository consistency. See the SAP BusinessObjects Business Intelligence Platform Repository Diagnostic
Tool Users Guide.
• If you did not use the index recovery script, rebuild your platform search index.
• Any publishing jobs in process at the time the system was backed up will display as failed. Do not rerun these instances, start a new publishing jobs.
• If your auditing database was compromised, then you must run an SQL query to remove any events that fall between the database failure and the restart time (the time you noted in step 7). For example: delete from [DB_NAME].ADS_EVENT where Start_Time > '[time of DB failure]' and Start_Time < '[time of DB restoration]'
Related Topics
•
Indexing Content in the CMS Repository
12.1.2.1.2 To restore only the auditing database
Before restoring your system, use the Central Configuration Manager (CCM) to stop all nodes in your
BI platform deployment. You must also choose which point in time you want to restore the system to.
474 2012-12-12
Backing Up and Restoring
475
Note:
Perform this task only if you are sure the auditing database is the only compromised component of BI platform. If additional components are affected, you must perform a full system restore.
1.
Locate the latest backups and transaction logs for the auditing database.
2.
Use the database tools to restore the auditing database.
3.
Perform a roll forward on the auditing database, replaying the transaction log.
Related Topics
•
12.1.2.1.3 To restore web-tier content
Before you restore your system you must stop all nodes in your BI platform deployment using the Central
Configuration Manager (CCM). You will also need to decide which point in time you want to restore the system to.
If you want to have the option to return to the current state of the system, you must perform a backup the system before restoring.
If the web-tier is corrupted it can be restored individually.
1.
Use file restoration tools to restore the web tier folders on the web-tier host-machine.
2.
Use the CCM to restart all nodes for you BI platform deployment.
12.1.2.1.4 To restore only the CMS database
Note:
Only perform this procedure if only the CMS database has crashed. If the database is corrupted or other components have been compromised you must perform a full system restore.
Repair or replace the CMS database host-machine. If replaced, ensure that it has the same system name as the previous host-machine, as well as the same port settings and database credentials.
Note:
If it is not possible to restore the machine using the same name and credentials, you will need to use the CCM to update this database connection information for each node in the cluster and restart those nodes.
1.
Stop all BI platform nodes using the CCM.
2.
Locate the latest CMS database backup set.
3.
Using your database tools, restore the CMS database.
4.
Locate the most recent CMS database transaction log—that is, the log that contains transactions performed after the last backup.
5.
Replay the entire transaction log for the CMS database.
6.
Use the CCM to start the BI platform nodes.
2012-12-12
Backing Up and Restoring
476
Once you have verified the system is working properly, take the following actions:
• Run the Repository Diagnostic Tool to remove any unused temporary files and check repository consistency. See the
SAP BusinessObjects Business Intelligence Platform Repository Diagnostic
Tool Users Guide.
• Any publishing jobs in process at the time the system was backed up will display as failed. Do not rerun these instances, start a new publishing jobs.
Related Topics
•
Indexing Content in the CMS Repository
12.1.2.1.5 The search index recovery
The platform search feature maintains a series of index and information files across you system to help it search more efficiently. If it is necessary to restore the system, these information files may develop inconsistencies. You can repair these inconsistencies by either using the index recovery script or rebuilding the index.
Rebuilding the index is a straightforward procedure, but the process will consume significant resources and take some time to complete, and searches conducted during the rebuild will only return results for the indexed portions of the database. The recovery script involves a more complicated procedure, but will provide you with a full, working index more quickly.
If you are restoring a deployment with multiple computers, run the script on any computers hosting the search service. For the first computer in a cluster, use the -Both option, then on all subsequent computers in that cluster using the -ContentStore option.
Related Topics
•
Indexing Content in the CMS Repository
To run the search index recovery script
• Confirm that the CMS is running, and stop all Adaptive Processing Servers (APS) with the Search
Service installed.
Note:
You must stop these APS as quickly as you can after the node starts.
• Set JAVA_HOME to the sapjvm/bin location in the BI platform installation directory.
• The Platform Search data directory is accessible from the machine where you are running the script.
1.
On the CMS or APS host-machine, open a command-line window (if using a Windows OS).
2.
Switch to the following directory <installdir>\SAP BuinsessObjects Enterprise XI
4.0\java\lib\
.
Unix machines use the equivalent Unix file path.
3.
Type java -jar platformSearchOnlineHotbackupRestore.jar and press Enter.
4.
When prompted, enter the following information and press Enter:
2012-12-12
Backing Up and Restoring
• Your BI platform installation location (for example, <install dir>/SAP businessObjects
Enterprise XI 4.0
)
• Your CMS logon credentials, including the CMS name, user ID and password, and authentication type. Authentication type has the following options:
• secEnterprise
• secLDAP
• secWinAD
• secSAPR3
5.
When you are prompted for the index restore type, type one of the following options and press Enter.
Value
-Both
-Exit
Description
This should be used for single server deployments, or, in multi-machine deployments, for the first APS host-machine with the search service installed in each cluster.
-ContentStore
This should be used when running the script on APS host-machines with the search service installed, unless it is the first computer in the cluster where the script is run.
Exit the script without performing an index restore.
6.
When the script has finished running, close the command-line window (for Windows machines).
Start all stopped APSs.
12.1.2.2 Restoring server settings
If you need to restore your system's server settings from a BIAR file, you can use either the Central
Configuration Manager (CCM) or the RestoreCluster script to restore the server settings. Restoring server content from a BIAR file doesn't affect Business Intelligence content such as reports, users and groups, or security settings.
Note:
• When restoring server settings, only the restoration of the settings for an entire cluster is supported.
It is not possible to restore the settings for only some of the servers in the cluster.
• If you are backing up or restoring server settings in a deployment where SSL is enabled, you must first disable SSL through the CCM, and then re-enable it when the backup or restore is complete.
Related Topics
•
477 2012-12-12
Backing Up and Restoring
12.1.2.2.1 To restore server settings with the CCM on Windows
You can use the Central Configuration Manager (CCM) to restore server settings. After you restore server settings, you must recreate your system's nodes on every computer in your system's cluster.
1.
Stop all the nodes on all of the computers in the cluster for which you are restoring server configuration settings by stopping the Server Intelligence Agent for each node.
2.
Start the CCM on a computer that has a CMS.
3.
From the toolbar, click Restore Server Configuration.
The "Restore Server Configuration Wizard" appears.
4.
Click Next to start the wizard.
5.
When prompted, provide the port number for the temporary Central Management Server (CMS) to use, and the information to connect to the CMS system database, and click Next to continue.
6.
Enter the cluster key, and click Next to continue.
7.
When prompted, log on to the CMS by entering the CMS name and the user name and password of an account with administrative privileges, and click Next to continue.
8.
Specify the location and name of the BIAR file that contains the server configuration settings you want to restore, and click Next to continue.
A summary page displays the contents of the BIAR file.
9.
Click Next to continue.
A summary page displays the information you entered.
10.
Click Finish to continue.
A warning message indicates that existing server settings will be overwritten by values in the BIAR file, and if you proceed, the current server settings will be lost.
11.
Click Yes to restore the server configuration settings.
The CCM restores the server configuration settings for the entire cluster from the BIAR file. Details of the restoration are written to a log file. The name and path of the log file appear in a dialog box.
12.
If the restore operation failed, check the log file to determine the reason.
13.
Click OK to close the wizard.
The server settings from the BIAR file are restored on your system. Any nodes and servers existing in the BIAR file that did not exist on the system prior to the restore are created.
Note:
Nodes and servers that existed on the system, but not in the BIAR file, are removed from the repository.
The nodes and servers still appear in the CCM, but you can manually delete the dbinfo and bootstrap files for a node.
You must recreate the nodes in your system on each computer in the cluster.
Related Topics
•
478 2012-12-12
Backing Up and Restoring
12.1.2.2.2 To restore server settings with the CCM on Unix
On Unix machines, use the serverconfig.sh script to restore your deployment's server settings from a BIAR file.
1.
Select 6 - Restore server configuration, and press Enter.
2.
Enter a port number for the temporary Central Management Server (CMS) to use, and press Enter.
3.
On the next screens, specify the connection information to the CMS system database.
4.
When prompted, log on to the CMS by specifying the system and user name and password of an account with administrative privileges, and press Enter.
5.
When prompted, specify the location and name of a BIAR file that you want to restore the server configuration settings from, and press Enter.
A summary screen displays the information that you have provided.
6.
Verify that the information displayed on the screen is correct, and press Enter to continue.
The serverconfig.sh script restores the server configuration settings for the entire cluster from the BIAR file that you specify. Details of the restore procedure are written to a log file. The name and path of the log file are displayed on the screen.
7.
If the restore operation failed, check the log file to determine the reason.
12.1.2.2.3 To restore server settings with a script
If you prefer, you can restore the server settings of your deployment by running the RestoreClus ter.bat
script on Windows, or the restorecluster.sh script on Unix.
On Windows, RestoreCluster.bat is located in the <INSTALLDIR>\SAP BusinessObjects
Enterprise XI 4.0\win64_x64\scripts directory.
On Unix, restorecluster.sh is located in the /<INSTALLDIR>/sap_bobj/enter prise_xi40/<PLATFORM64>/scripts directory.
Related Topics
•
BackupCluster and RestoreCluster scripts
12.1.2.3 Restoring BI content
If you've backed up Business Intelligence (BI) content to LCMBIAR files, you can use the Promotion
Management application to restore BI content, without restoring your entire system.
479 2012-12-12
Backing Up and Restoring
12.1.3 BackupCluster and RestoreCluster scripts
The following table describes the command-line parameters used with the BackupCluster script.
Note:
This script only backs up server settings for a cluster. Other data must be backed up separately.
Table 12-1: BackupCluster parameters
Name
-backup
-cms
-username
-password
Description Example
The name and path of the BIAR file that you want to back up your system's server settings to restore.
-backup "C:\Users\Administrator\Desktop\my.biar"
The host name of the machine where your system's Central
Management Server is located.
If your CMS is running on any other port than the default port,
6400, you must also specify the port number.
-cms mycms:6400
The user name of an Administrator account.
-username Administrator
The password of an Administrator account.
-password Password1
The following table describes the command-line parameters used with the RestoreCluster script.
Table 12-2: RestoreCluster parameters
Name
-restore
-username
Description Example
The name and path of the BIAR file that contains the server configuration settings that you want to restore.
-restore "C:\Users\Administrator\Desktop\my.biar"
The user name of an Administrator account.
-username Administrator
480 2012-12-12
Backing Up and Restoring
Name
-password
-displaycontents
Description
Displays a list of nodes and servers that the BIAR file contains.
Example
The password of an Administrator account.
-password Password1
-displaycontents "C:\Users\Administrator\Desktop\my.biar"
Note:
Run the RestoreCluster script with the -displaycontents parameter to display the contents of the BIAR file before you restore the server settings.
The following parameters are required if you are backing up server settings from a system that is not running, or if you are restoring server settings.
Table 12-3: Parameters used when using a temporary CMS
Name
-usetempcms
-cmsport
-dbdriver
Description Example
Creates a temporary CMS for the specified operation. After the operation is complete, the temporary CMS is stopped.
-usetempcms
The port number of the temporary CMS.
-cmsport 6400
The database driver of the CMS system database. Accepted values are:
• db2databasesubsystem
• maxdbdatabasesubsystem
• mysqldatabasesubsystem
• oracledatabasesubsystem
• sqlserverdatabasesubsystem
• sybasedatabasesubsystem
• sqlanywheredatabasesubsys tem
• newdbdatabasesubsystem
Note:
The newdbdatabasesubsys tem parameter is for use with
SAP HANA databases.
-dbdriver sqlserverdatabasesubsystem
481 2012-12-12
Backing Up and Restoring
Name
-connect
-dbkey
Description
The CMS system database connection string.
The cluster key.
Example
-connect "DSN=BusinessOb jects CMS 140;UID=user name;PWD=Password1;HOST
NAME=database;PORT=3306"
-dbkey abc1234
Example:
The following example shows how to back up your server settings to a BIAR file, using an existing
CMS.
-backup "C:\Users\Administrator\Desktop\my.biar"
-cms mycms:6400
-username Administrator
-password Password1
Example:
The following example shows how to display the contents of a BIAR file.
-displaycontents "C:\Users\Administrator\Desktop\mybiar.biar"
Example:
The following example shows how to restore your settings from a BIAR file. You must always use a temporary CMS when restoring server settings.
-restore "C:\Users\Administrator\Desktop\my.biar"
-cms mycms:6400
-username Administrator
-password Password1
-usetempcms
-cmsport 6400
-dbdriver sqlserverdatabasesubsystem
-connect "DSN=BusinessObjects CMS 140;UID=username;PWD=Password1;HOSTNAME=database;PORT=3306"
-dbkey abc1234
482 2012-12-12
Copying your deployment
Copying your deployment
13.1 Overview of system copying
This chapter describes how to create a duplicate of your BI platform deployment for testing, standby or other purposes.
13.2 Terminology
• Source System: The original BI platform deployment.
• Target System: The new deployment you want to create.
• System Copy: To create a duplicate of an existing BI platform deployment.
• Homogenous System Copy: To create a duplicate system where the source and target systems have the same type of operating system and database.
• Heterogeneous System Copy: To create a duplicate system where the source and target systems use different types of operating systems or databases but are based on the same data.
• Database Copy: To create a duplicate of the CMS system or auditing database using database vendor tools.
13.3 Use cases
There are a few different reasons why you may want to create a copy of your system. The following table contains a list of the goals you might want to achieve given the resources you might have, and provides a reference to the most appropriate workflow.
483 2012-12-12
Copying your deployment
Goal
Copying a set of objects (up to
1,000) between deployments
Recover a document or other object that was accidentally deleted
Recover a document or other object that was accidentally deleted
Resources available Solution
A system where LCM versioning is in use
Use Promotion Management to promote objects between systems. See the Promotion Management section of this guide.
A system where LCM versioning is in use
Use Version Management to recover an earlier version of the document. See the Version Management section of this guide.
•
• Source System (running or stopped) OR Backups of source system databases and files.
Use the System Copy Procedure workflow, starting with
Planning to copy your system , and follow
the instructions for the rest of the chapter
AND
Detailed system information described in copying procedure
Note:
You can create your target system on a computer with an existing BI platform deployment of the same release, support package, and patch level, or a "clean" computer with no BI platform installed.
Create a duplicate system for standby or testing with an identical hardware configuration and
IP addresses/machine names
• Identical hardware where you intend to recreate the source system
AND
• Backups of the source system or access to the source system to make a backup from.
Use the system backup and restore workflow detailed in this guide, see the
Conducting an entire system backup
procedure.
Recreate the target system from backups of the source system.
Create a duplicate system for standby, testing, or training that does not have to directly mimic the hardware and IP addresses/machine names of the source system
•
• Source System (running or stopped) OR Backups of source system databases and files.
Use the System Copy Procedure workflow, starting with
Planning to copy your system , and follow
the instructions for the rest of the chapter
AND
Detailed system information described in copying procedure
Note:
You can create your target system on a computer with an existing BI platform deployment of the same release, support package, and patch level, or a "clean" computer with no BI platform installed.
484 2012-12-12
Copying your deployment
13.4 Planning to copy your system
There are two stages to copying your system:
1.
Making the copy of the source system
2.
Recreating the copy on the target environment
These steps do not have to be carried out immediately after each other. You can create your copy and wait some time before proceeding to recreate the copy on the target system. This will mean that the copy will be of the system as it was at the time the copy was created. For example, if you wait one month, the copy will recreate the system as it was one month ago.
After reviewing the use cases in the preceding section and deciding which one best suits your needs, you should develop a system copy plan.
Create a system copy plan
When planning to copy a system, you should decide on the following details in advance:
• If the source system will be stopped or active while the copy is being made (the procedure can be done under either circumstance)
• If the source system is stopped, how much downtime will be required
• Plan time for testing to ensure the integrity of the target system
• Which database tools you want to use for database backup and restoration
• Which machines the target system will be deployed on, and where each node will be hosted
• Which optional components you want to copy
• The database type to use for the target CMS database, and any other optional databases you will be copying
You should also give consideration to the following topics:
• Which BI platform components your source system has installed. You can use the Add/Remove
> Modify function of the installation program to view the list of currently installed components.
• You may need to tune the target system for better performance if it is installed on different hardware than the source system. See the information about improving your system performance in the SAP
BusinessObjects Business Intelligence sizing companion guide.
• If you want the target system to report from reporting databases other than the source system databases, you may want to change the database connection information for the reporting databases.
You can do this by keeping the same DSN name but pointing to DSN on the target system to another database.
Required source system files
• CMS system database
• FRS file store
• Semantic layer configuration files
• Auditing database (optional)
• Monitoring database (optional)
• Lifecycle management subversion database (optional)
485 2012-12-12
Copying your deployment
13.5 Considerations and limitations
You should be aware of the following considerations when making a copy of your BI platform deployment.
Area Consideration
SAP Business Warehouse integrations
If you are using BI platform and SAP ERP or BW in an integrated environment, before copying your system, read the SAP system copy documentation. The system copy guides are available at http://www.sdn.sap.com/irj/sdn/systemcopy (SMP login required).
Choose your SAP NetWeaver version; the relevant copy guides can be found in the installation guides folder.
Program version
Content and configuration settings
Installation path
The source and target systems must be at the same version, support package, and patch level.
Only the entire source system can be copied. You cannot selectively copy content or system configuration settings.
The installation path on the source and target locations must be identical: for example, if you installed the source system to C:\Busines sObjects
, you must install the target to C:\BusinessObjects.
Host operating system
CMS database software type
The source and target operating systems must be the same.
CMS source and target databases must be of the same type. You will have the option of changing to another supported database type after copying the system.
Auditing database software type
If you are copying auditing data, the auditing source and target databases must be of the same type. After the copy has been created, you can establish a new database of a different type.
Note:
If you establish a new database, existing events will not be copied to that database, only new events will be recorded to the new database.
Web tier customization
Topics not covered by these instructions
The copy procedure will not copy web tier components from the source system. If you customized the web tier (modified .properties files in the custom folder, for example) you must manually apply those customizations to the target.
This workflow does not describe how to export or import a database.
Use your database vendor tools for database copying and restoring.
The following data will be copied during the system copy procedure:
• The CMS repository database. (contains reports, analytics, folders, rights, users and user groups, server settings, and other BI content and system content)
486 2012-12-12
Copying your deployment
• The Auditing database. (contains auditing events triggered by BI platform servers or client applications)
• The Monitoring database. (contains trending data from metrics, probes, and watches)
• The Lifecycle Management database. (contains different versions of reports, analytics, other BI resources, and version information)
Note:
For a description of the databases and their contents, see the
section of this guide.
• Semantic layer configuration files
Web tier configuration, search index, and any data not specifically mentioned above are not copied.
Considerations for file recovery copies
If you are copying a system for the specific purpose of recovering a file that was accidentally deleted, you should be aware of the following additional considerations:
Using your backup, perform the steps in the procedure
To perform a system copy import to a target system
on the production system.
• Do not install all nodes, just install the first node which will contain the CMS and its database.
• Do not install auditing, LCM, or monitoring databases.
• Do not recreate connections to the auditing or reporting databases.
Use LCM to promote the object you want to recover from the target system to the source system.
13.6 System copy procedure
The following procedures guide you through the two stages of copying your BI platform deployment.
13.6.1 To perform a system copy export from a source system
You will need to make note of the following information from the source system. If you want to write this information down there is a worksheet you can use at
487 2012-12-12
Copying your deployment
Property
The CMS cluster key (make sure to keep the record secure).
Location
Created by the system administrator when the BI platform was installed.
The name of the nodes.
Go to the Servers tab of the CMC, on the left tree expand Nodes.
The machine name and the BI platform installation folder for each machine in the deployment.
Go to the Servers tab of the CMC, right-click the
CMS and select Placeholders. Look for the value of the %INSTALLROOTDIR% placeholder.
The BI platform administrator password (make sure to keep the record secure).
Created by the system administrator when the BI platform was installed.
All database connections that might be used by the CMS, and the user names and passwords associated with those connections. This can include auditing database if you want to copy this information. Make sure to get this information for all machines in the cluster.
Note:
If you are copying the auditing database, you also need the auditing database connection names and credentials.
Go to the Servers tab of the CMC, right-click the
CMS and select Metrics.
Look for the following metrics:
• "System Database Connection Name"
• "System Database Server Name"
• "System Database User Name"
• "Data Source Name"
• "Auditing Database Connection Name" (optional)
• "Auditing Database User Name" (optional)
For every machine in the cluster, the details (client types, versions) of any other database connections
(used by universes and reports for example). Make sure to include user names and passwords.
For Crystal reports that report directly from databases, look at the connection information using the SAP Crystal Reports 2011 or SAP Crystal Reports for Enterprise designers. For universe connection information, use the Information Design
Tool (.unx) or Universe design tool (.unv).
The version, support package, and patch level of the source system.
On Windows this can be determined by looking at the "Remove or Change" programs tool.
On Unix, you can use the AddOrRemoveProd ucts.sh
utility in the BI platform install directory.
488 2012-12-12
Copying your deployment
Property
The file store locations for every Input FRS and
Output FRS in the deployment.
Location
Go to the Servers tab of the CMC, right-click the
Input or Output FRS and select Properties. Look for the "File Store Directory" property.
Note:
If the value begins with % then this is a placeholder, and you will need to click on Placeholders and make a note of the directory listed under that placeholder.
If you plan to copy Lifecycle management (LCM), the location of the LCM overrides folder and LCM subversion files.
The default folder for Override in Windows installations is <INSTALDIR>\SAP BusinessObjects
Enterprise XI
4.0\Data\LCM\LCMOverride
.
The default location for the LCM subversion files in Windows installations is <INSTALDIR>\SAP
BusinessObjects Enterprise XI
4.0\CheckOut
If you plan on copying the monitoring database, the monitoring database folder.
This is set in the CMC. Go to the Applications management area of the CMC, Select Monitoring
Application > Properties and look for the
"Trending database backup directory".
The default folder in Windows installations is <IN
STALDIR>\SAP BusinessObjects
Enterprise XI 4.0\Data\TrendingDB by default.
The semantic layer folder path.
The default folder path in Windows installations is
<install_dir>\SAP BusinessObjects
Enterprise XI
4.0\dataAccess\connectionsServer\ by default.
After you've recorded the information above:
1.
Use your database vendor backup tools to create a backup copy of the following databases:
• The CMS system database
• The auditing database (optional)
2.
Using file backup tools, back up the following sets of files:
• The FRS input and output file stores
• The monitoring trending database (optional)
489 2012-12-12
Copying your deployment
• Lifecycle management subversion database (optional)
• Configuration files from the semantic layer folder: the cs.cfg file in the connectionServer folder, and any .sbo and .prm files in any of its subfolders.
Note:
For constraints and a detailed description of this workflow, please see the
section.
Keep the information recorded above with the copy of the databases and files. You may want to keep a second copy which you can update as required for future system copy procedures.
13.6.2 To perform a system copy import to a target system
This procedure assumes you have created backup copies of the source deployment databases and system files you want to use in your target system. All backup files must be from the same backup set.
You will also need the details (cluster key and database credentials for example) noted in “To perform a system copy export from a source system”.
If the target system will reside in a network location with access to the source system resources, you should ensure the target system does not attempt to access those resources until it has been reconfigured. This can be accomplished by placing a firewall between the target system and the source system resources, or leaving the source system stopped while you start the target system. After the first time you start the target system, the firewall can be removed or the source system can be started.
If the target system already has BI platform installed, ensure it is at the same version, support package, and patch level as the source system at the time the copy was created. Also ensure it uses the same installation path as the source system.
1.
On the target system, create the connections to the database or databases where you intend to put the CMS repository, auditing database, and reporting database.
Note:
While the connections can point to a different database, they must have the same connection name or DSN and use the same credentials as the source system.
2.
Use your database tools to restore the CMS system database and the auditing database (if required) from the source-system backup to the target database.
If the universes or reports on the target system need to use a different reporting database, modify the database connection to point to that database.
If you require further instructions on this step, see the
topic.
3.
If BI platform is installed on the target host system, skip to Step 4. If BI platform is not installed, install the BI platform on the target host system keeping the following steps in mind: a.
Install the same program version, support package, and patch level as the source system.
b.
Use the same installation path as the source system.
c.
Select the same components that were installed on the source system.
490 2012-12-12
Copying your deployment d.
When the installation program asks you to create the CMS database (and auditing database if applicable), choose the Use an existing database server option and enter the connection name and credentials set up in step 1.
Note:
Do not choose to reinitialize the CMS database.
e.
When prompted for the Node Name, use the same names, port numbers, platform administrator password and cluster key as the source system.
For complete installation instructions, see the
SAP BusinessObjects Business Intelligence Platform
Installation Guide. When the system has finished installing, go to step 6.
Note:
If you are not copying your auditing data from the source system, you can create a new auditing database by configuring auditing during the installation procedure.
f.
Stop all nodes in the CCM.
4.
If the BI platform is already installed on the target system, stop all nodes in the CCM. On the target system CMS host computer, start the CCM.
5.
If the BI platform is already installed, add a new node, using the Recreate Node option.
a.
Use the Node Name and SIA Port Number from the source system.
b.
Choose to Start a new temporary CMS.
c.
Select a new CMS Port Number (can be any free port) and CMS Database Type (matching the restored database type).
d.
Enter details for the connection the CMS database was restored to in Step 1.
e.
Enter the cluster key from the source-system.
f.
Enter the Administrator password from the source system.
6.
Restore the Input and Output FRS file stores to the target system file store.
7.
Restore the monitoring database folder (if you want to copy monitoring information).
8.
Restore the LCM subversion files (if you want to copy LCM information).
9.
Restore the semantic layer/connection configuration server files.
10.
Restart the target system host computers.
11.
If you installed the BI platform on the target system in step 3, apply any support packages or patches required to match the source system.
12.
If the target system will run on multiple host computers, repeat steps 1–11 for each host computer.
Use the Expand install option when installing additional BI platform nodes, and keep in mind that the same node names as the source system should be used for the additional nodes in the target system.
13.
If the target system CMS database will use a different database type from the source system, use the CCM to perform
Copying data from one CMS system database to another
, specifying as destination the database you want to use for the copy.
After the system copy of BI platform is performed:
1.
The installation of the first node on the target creates a temporary CMS, which will be stopped at the end of the installation. Using the CMC, go to the Servers page and delete this CMS.
491 2012-12-12
Copying your deployment
Remember:
If you do not remove the source system (or if you use it concurrently with the target system), renaming the cluster on the target system is recommended.
2.
Run the Repository Diagnostic Tool on the target CMS database.
3.
Perform a sanity check on the target system to ensure its integrity.
4.
Perform a full search re-index.
492 2012-12-12
Version Management
Version Management
14.1 Managing Different Versions of BI resources
The promotion management application enables you to maintain different versions of BI resources that exist in the SAP BusinessObjects Business Intelligence platform repository. To facilitate this feature, the tool includes SubVersion and ClearCase version control systems.
To manage different versions of jobs or infoobjects, complete the following steps:
1.
Log into the CMC application and select Version Management.
2.
From the left panel of the "Version Management" window, select the folder to view the job or infoobjects whose versions you want to manage.
3.
Select the infoobjects and click Add to VM.
Note:
Clicking "Add to VM" results in the creation of a base version of the object in the Version Management
System (VMS) repository. A base version is required for subsequent check-in.
4.
On subsequent changes to the document and to version the incrementally changed document, click
Checkin. This will update the document that exists in the VMS repository.
The "Check-in Comments" dialog box appears.
5.
Enter your comments, and click OK.
The change in the version number of the selected infoobject is displayed in the Version Management
System and Content Management System columns.
6.
To obtain the latest version of the document from the VMS, select the required infoobject, and click
Get latest Version.
The last version from the VMS repository is imported to the CMS.
7.
To create a copy of the latest version, click Create Copy.
A copy of the selected version is created in the VMS repository.
8.
Select History to view all the versions available for the selected infoobject.
The "History" window appears. The following options are displayed:
• Get Version - If there are multiple versions, and if you require a particular version of the BI resource, then you can select the required infoobject and click Get Version.
• Get Copy of Version - This option enables you to obtain a copy of the selected version.
• Export Copy of Version - this option enables you to obtain a copy of the selected version and save it to your local system.
493 2012-12-12
Version Management
• Compare - this option enables you to compare the metadata information of two versions of content.
9.
Select an infoobject and click Lock to lock the infoobject,or Unlock to unlock the infoobject, or
Delete to delete all versioned content from the VMS repository. Content in the CMS is not affected.
Note:
If you lock an infoobject, you cannot perform any action on that infoobject.
10.
When the version in the CMS is newer than the version in the VMS, an indicator appears beside the updated infoobject. When you place the cursor on the indicator, you get a tool tip describing that the infoobject in the CMS is updated.
11.
To view the list of all checked in resources that exist in the VMS but not in the CMS, click View
Deleted resources.
Click any deleted resource to view the history of that resource. You can select a deleted resource, and click Get Version to view that particular version of the resource. You can click Get Copy of
Version to get a copy of the selected resource.
Click Delete to permanently drop the object from the VMS repository as well.
Note:
If you use either Get Version or Get Copy of Version, the resource is moved from the VMS missing file list to the CMS.
12.
Select an infoobject, and click to view the properties of the infoobject.
Alternatively, you can right click on the infoobject and perform Steps 4 to 16.
14.2 Using the Version Management System Settings Option
You can set the version management system settings from the Central Management Console. You can configure the SubVersion and the ClearCase parameters.
To set the SubVersion management system, complete the following steps:
1.
From the CMC home page, select Applications..
2.
Double click VMS. The Version Management Settings screen appears.
3.
Select VMS Settings.
4.
From the Version Management Systems drop-down list, select SubVersion.
The server port number, password, repository name, server name, user name, the name of the workspace directory and the name of the install directory that were provided during the promotion management tool installation process, are displayed in the appropriate fields.
5.
Modify the fields, if required.
Ensure that you enter the install path extending till the .exe file. In Windows, For example:
C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise
494 2012-12-12
Version Management
XI 4.0\subversion and In Unix - /usr/u/qaunix/aurora_730/sap_bobj/enter prise_40/subversion/bin
.
6.
You can use either http or svn protocols to access the subversion repository by clicking the http or svn radio buttons respectively.
7.
You can validate the VMS settings that you entered by clicking Test VMS.
8.
Click Save.
Note:
• If you want SubVersion as your default VMS, then select Use as Default VMS.
• If you have modified the fields as per Step 3, restart the Server Intelligence Agent.
14.2.1 Setting the ClearCase Version Management System in Windows
To set the ClearCase version management system in Windows, complete the following steps:
1.
In the "Administration Options" window, click VMS Settings.
2.
From the Version Management Systems drop-down list, select ClearCase.
3.
Enter the following details:
• ClearCase Map Drive - Enter the drive name. By default, it is the M drive. For example: M:
• VOB Tag Name - Enter the Versioned Object Base (VOB) name. For example: FridayVB
• View Storage Directory - Enter the path to the shared folder. For example: \\HostName\Fold erName
Note:
The host name must not be written as localhost.
4.
Click Save.
14.2.2 Setting the ClearCase Version Management System in Unix
To set the ClearCase version management system in Unix, complete the following steps:
1.
In the Administration Options window, click VMS Settings.
2.
From the Version Management Systems drop-down list, select ClearCase.
3.
Enter the following details:
• ClearCase Map Drive - Enter the name of the folder where the MVFS is located. By default, it is
/view
• VOB Tag Name - Enter the VOB name and the folder where the VOB is located. For example:
VobFolder/VobName
• View Storage Directory: Enter the path of the directory where the views are created.
495 2012-12-12
Version Management
You can select Use as Default VMS if you want to use ClearCase as the default version management system.
14.3 Comparing different versions of the same job
You can view the differences between two versions of the same job by completing the following steps:
1.
Log into the CMC application.
2.
From the CMC home page, select Version Management.
3.
From the Version management screen, select the infoobject whose versions needs to be compared.
4.
Click History.
The History page appears which displays all the versions of the selected infoobject.
5.
Select any two versions for comparison.
6.
Click Compare.
The comparison process starts and the differences are highlighted in orange color, and the missing objects are highlighted in red color.
7.
Click Save to save the difference report.
14.4 Upgrading Subversion content
If you have old subversion content that was created using a previous version of the SAP BusinessObjects
BI platform, you can upgrade your content to the latest version by following these steps:
1.
Log on to the VMS on the SAP BusinessObjects Enterprise 3.x machine.
2.
Check-in any object. For example, check in the administrator and guest objects twice.
3.
In CMC, click Users and verify that 2 is displayed in the in VMS and CMS version number.
4.
Log off from the VMS.
5.
Go to the command prompt, navigate to C:\Program Files\Subversion\bin, and run the export command: svnadmin dump c:/LCM_repository/svn_repository > dumrepo
6.
Copy the dumrepo file to the SAP BusinessObjects BI platform machine
7.
Go to the command prompt on the SAP BusinessObjects BI platform machine, navigate to
C:\Program Files (x86)\SAP
, and execute the following commands: svnadmin.exe load "C:/Program Files (x86)/SAP BusinessObjects/SAPBusines sObjects Enterprise XI 4.0/LCM_repository/svn_repository" < c:/dumrepo svnadmin.exe upgrade "C:/Program Files (x86)/SAP BusinessObjects/SAP
BusinessObjects Enterprise XI 4.0/LCM_repository/svn_repository"
8.
After the commands have been successfully executed, restart the SIA.
9.
Login to CMC and click Version management.
496 2012-12-12
Version Management
10.
Click on Users, and verify that the VMS version is 2.
11.
Select the Administrator object and then click Get Latest Version.
12.
The version number on the VMS and CMS are now the same.
497 2012-12-12
Version Management
498 2012-12-12
Promotion Management
Promotion Management
15.1 Welcome to promotion management
15.1.1 Promotion Management Overview
The promotion management application enables you to move business intelligence (BI) resources from one repository to another, manages dependencies of the resources and also rolls back the promoted resources at the destination system, if required. It also supports the management of different versions of the same BI resource.
The promotion management application is integrated with the Central Management Console. You can promote a BI resource from one system to another only if the same version of the SAP BusinessObjects
Business Intelligence platform application is installed on both the source and destination systems.
15.1.2 Promotion Management Features
The promotion management application supports the following features:
• Promotion - This feature enables you to create or update infoobjects in the destination system. Apart from promoting infoobjects, this feature enables you to perform the following tasks:
• Create a new job
• Copy an existing job
• Edit a job
• Schedule a job promotion
• View the history of a job
• Export as LCMBIAR
• Import both BIAR /LCMBIAR
• Managing Dependencies - This feature enables you to select, filter, and manage the dependents of the infoobjects in the job that you want to promote.
499 2012-12-12
Promotion Management
• Scheduling - This feature enables you to specify a time for job promotion, rather than promote a job as soon as it is created. You can specify the time for job promotion by using any of the following parameters: hourly, daily, weekly, or monthly.
• Security - This feature enables you to promote infoobjects along with the associated security rights and if required promotes infoobjects associated with application rights.
• Test Promotion - This feature enables you to check or test the promotion to ensure that all the preventive measures are taken before the actual promotion of the infoobjects.
• Rollback - This feature enables you to restore the destination system to its previous state, after a job is promoted. You can roll back an entire job or a part of the job.
• Auditing - The events generated by the promotion management tool are stored in the audit database.
This feature enables you to monitor the events that are logged in the audit database.
• Override Settings - This feature enables you to scan and promote the overrides through a job promotion.
15.1.3 Application Access Rights
This section describes the application access rights for the promotion management application.
• You can set access rights to the promotion management application within the CMC.
• You can set granular application rights to various functions within the promotion management application.
To set specific rights in the promotion management application, complete the following steps:
1.
Log on to CMC and select Applications.
2.
Double-click promotion management.
3.
Click User Security, and select a user. You can view or assign security rights for the user.
4.
The following promotion management specific rights are available:
• Allow access to edit overrides
• Allow access to Include Security
• Allow access to LCM administration
• Allow access to Manage Dependencies
• Create Job
• Delete Job
• Edit Job
• Edit LCMBIAR
• Export as LCMBIAR
• Import LCMBIAR
• Promote Job
• Rollback Job
• View and Select BOMM (BusinessObjects Metadata) Objects
• View and Select Business Views
• View and Select Calenders
500 2012-12-12
Promotion Management
• View and Select Connections
• View and Select Profiles
• View and Select QaaWS
• View and Select Report Objects
• View and select Security settings
• View and select Universes
5.
If you wish to assign rights to a selected user, select the appropriate right and click Assign Security.
The promotion management application access rights are set within the CMC.
15.2 Getting Started with the promotion management tool
15.2.1 Accessing the promotion management application
To access the promotion management application, select Promotion Management from the CMC home page.
Any user with view permissions to the Promotion Jobs folder can launch the promotion management application. However, to create, schedule, or promote a job, the user must be granted additional rights by the administrator.
15.2.2 User Interface components
This chapter discusses the GUI components in the promotion management tool.
• promotion management workspace toolbar
• Workspace panel
• Tree panel
• Details panel
• Shopping Cart and Job Viewer page
promotion management workspace toolbar
The following table lists the options included in the promotion management workspace toolbar and discusses the tasks you can perform using these options:
501 2012-12-12
Promotion Management
502
Option
Properties
History
New Job
Import
Edit
Promote
Rollback
Search
Promotion Jobs
Promotion Status
Description
Enables you to create a new folder. The new folder is created as a subfolder in the Promotion Jobs folder.
Enables you to copy and remove the selected job or folder from its current location.
Enables you to copy the job or folder from its current location.
Enables you to paste the copied job or folder in a new location.
Enables you to delete an existing job.
Enables you to refresh the home page, to obtain the updated list of jobs or folders that are available for promotion.
Enables you to modify the properties of the selected job. You can modify the title, description, and keywords of the selected job.
Enables you to view the history of the selected job.
Enables you to create a new job.
Enables you to import a BIAR files or Override files.
Enables you to edit the selected job.
Enables you to promote the selected job.
Enables you to retrieve the promoted job from the destination system.
Enables you to navigate between pages of a job list. You can use this option to navigate a single page, or navigate to a specific page by entering the relevant page number.
Enables you to search for specific jobs. You can search for a job by its name, keywords, description, or all three parameters.
Enables you to view the promoted jobs.
Displays the promoted jobs according to their status, such as
Success, Failure, or Partial Success.
Workspace panel
The Workspace panel in the promotion management home page displays the list of newly created jobs.
You can use this panel to view the name of the job, status of the job, job creation information, promotion
2012-12-12
Promotion Management summary, test promotion summary, dependency management screens, and information about the destination system.
Tree panel
The Tree panel in the promotion management home page displays the tree structure, which includes the Promotion Job folder and the Promotion Status folder. The newly created jobs are displayed in a hierarchical structure under the Promotion Job folder. The Promotion Status folder displays the promoted jobs according to their status.
Details panel
This panel includes the Preferences link that enables the administrator and users to set the tool preferences. The Help and About links enable you to obtain more information about using the promotion management tool.
Shopping Cart and Job Viewer page
A Shopping Cart is a dynamically generated tree list that contains a list of the infoobjects to be promoted.
It also categorizes the infoobjects into user groups, universes, connections, and so on. The Job Viewer page enables you to view the infoobjects added to a job.
15.2.3 Using the Settings Option
The Settings Option enables you to configure settings before promoting infoobjects from one SAP
BusinessObjects Business Intelligence platform deployment to another SAP BusinessObjects Business
Intelligence platform deployment and SAP deployment. This section describes how to use the settings options.
Click Settings drop-down in the "Promotion Jobs" screen. This drop-down displays the following options:
• Manage Systems - This option enables you to add all the systems required for promotion management activities.
• Rollback Settings - This option enables you to select a system for which rollback is enabled.
• Job Settings - This option enables you to select viewing of completed instances in the Dependencies page. Also enables you to manage job instance cleanup activities.
• CTS settings - This option enables you to add the web service and SAP BW system information for the Enhanced Change Transport System integration.
• Override Settings - This option enables you to scan, promote, and edit the database connection information for Crystal Reports and Universe connections. You can also edit the QAAWA URLs here.
15.2.3.1 Using the Manage Systems Option
503 2012-12-12
Promotion Management
This section describes how to use the Manage Systems option. You can add or remove host systems by using this option.
To add a host system, complete the following steps:
1.
In the "Administration Options" window, click the Manage Systems option.
The "Manage Systems" window appears. This window displays a list of host names, port numbers, display names, and description.
2.
Click Add.
The "Add System" dialog box appears.
3.
Add the host name, port number, display name, and the description in the appropriate fields.
Note:
Select the Mark as 'Origin' option to identify the system as a source system, that is, the system where the connection information originated from.
4.
Click OK to add the system.
The host system is added to the list.
Note:
To remove a host system, select the host system you want to remove, and click Remove.
Related Topics
•
Using the Rollback Settings Option
•
15.2.3.2 Using the Rollback Settings Option
By default, the rollback process is enabled at the system level. The Rollback Settings option allows you to disable the rollback process at the system level.
To disable the rollback process at the system level, complete the following steps:
1.
In the "Rollback" window, from the list of host systems, select the host system to disable the rollback process.
2.
Click Save and Close to save the modifications.
Related Topics
•
504 2012-12-12
Promotion Management
15.2.3.3 Using the Job Settings Option
The Job Settings option enables you to specify the number of job instances that can exist in the system.
You can specify one of the following options:
• Delete Job Instances when more than N instances of a Job - This option enables you to specify the maximum number of job instances per job that can exist in the system.
• Delete Job Instances after N days - This option enables you to specify that all job instances created before the specified number of days must be deleted.
• From the Show Jobs Created drop-down list, you can select the time interval to view the jobs created during the specified period.
To set the Job Settings option, complete the following steps:
1.
Select the option, and enter the preferred value.
2.
Click Save to save the updated changes.
You can click Default Settings to set the default values, and you can click Close to close the window.
Note:
The old job instances are deleted only when the job is executed the next time.
Related Topics
•
Using the Version Management System Settings Option
505
15.2.3.4 Using the Override Settings Option
The Override Settings option enables you to promote the overrides through a job promotion or through the BIAR files.
Note:
The term system will be used in the following procedures. There are three types of systems :
• Origin : This is the source system which acts as the originating system for any connection information.
• Central LCM : This is the system to which you are connected by default.
• Destination : This is the end system to which the BI resources have been promoted.
15.2.3.4.1 Promoting Overrides
Add a host system before promoting the overrides. For information about adding host systems, see
Using the Manage Systems Option
.
2012-12-12
Promotion Management
To promote the overrides, complete the following steps:
1.
In the "Administration Options" window, click the Override Settings option.
The "Override Settings" window appears.
2.
If you are logged on to the Central promotion management system, log out from the system.
3.
Click Login to connect to the Origin system.
The "Login to system" window appears.
4.
Select the source system marked as Origin to scan the objects, and login to the system using valid credentials.
5.
From the Start dropdown list next to Scan, select the Start option.
The scanning process starts. The "list of unique connections" is displayed.
Note:
To schedule the scan to suit your preferences, select Recurrence Settings option from the drop-down list.
6.
In the list of overrides, change the status to Active for the objects you want to promote, and click
Save.
7.
Click Promote Overrides.
.The "Promote Overrides" screen appears where the list of destination systems is displayed.
8.
Click Login to log into the destination system using valid credentials.
You can specify multiple destination systems.
9.
Click Promote.
The promotion of overrides is complete.
Note:
If the overrides fail at the destination system during the promotion of infoobjects, the system sets the job status to "Partial Success" and also sets the "Overrides Failed" warning status on the object.
10.
Log off from the Origin system.
11.
From the "Override Settings" screen, click Login .
The Login to System window appears.
12.
Login to one of the destination systems using valid credentials.
A list of all the promoted objects is displayed in "list of overrides". The status of these objects is
Inactive.
13.
Click the Select check box for the objects you want to edit, and click Edit.
14.
Update the required values, and click Done.
15.
Change the state of the objects to Active and click Save.
15.2.3.4.2 Promoting Overrides Through BIAR Files
Add a host system before promoting the overrides. For information about adding host systems, see
Using the Manage Systems Option
.
506 2012-12-12
Promotion Management
507
To promote the overrides through BIAR files, complete the following steps:
1.
In the "Administration Options" window, click the Override Settings option.
The "Override Settings" window appears.
2.
If you are logged on to the Central LCM system, log out from the system.
3.
Click Login to connect to the Origin system.
The "Login to system" window appears.
4.
In the "Override Settings" screen, select the source system marked as Origin to scan the objects and login to the system using valid credentials.
5.
From the Start drop-down list next to Scan, select the Start option.
The scanning process starts.The List of Overrides is displayed.
Note:
To schedule the scan to suit your preferences, select Recurrence Settings option from the drop-down list.
6.
In the list of overrides, change the status of the required objects to Active, and click Save.
7.
Click Promote Overrides.
The "Promote Overrides" screen appears where the list of destination systems is displayed.
8.
To encrypt the BIAR file using a password, click Password Encryption checkbox.
The Password and Confirm Password fields are enabled.
9.
Enter a password in the Password field. Re-enter the same password in the Confirm Password field.
10.
Click Export, and save the overrides BIAR file to a file system.
11.
Log into the destination system through the LCM tool, and click Import > Override File.
The "Import LCMBIAR file" window appears.
12.
Click Browse to browse the BIAR file.
13.
Enter the password of the BIAR file in the Password field.
Note:
The Password field appears only if the BIAR file you selected is encrypted using a password
14.
Click OK. The promotion of overrides is complete.
15.
Log off from the origin system.
16.
From the "Override Settings" screen, click Login.
The "Login to system" window appears.
17.
Login to the destination system using valid credentials.
A list of imported objects is displayed in List of Overrides.The status of these objects is Inactive.
18.
Click the Select check box for the objects you want to edit, and click Edit. The edited objects will be indicated by an icon.
Note:
You can delete the override objects by clicking on the icon.
2012-12-12
Promotion Management
508
19.
Update the required values, and click Done.
20.
Change the status of the objects to "Active" and click Save.
15.2.3.4.3 Promoting Overrides Through CTS+
Add a host system before promoting the overrides. For information about adding host systems, see
Using the Manage Systems Option
.
To promote the overrides through CTS+, complete the following steps:
Note:
Launch the promotion management tool using SAP authentication for this option to be available.
1.
In the "Administration Options" window, click the Override Settings option.
The "Override Settings" window appears.
2.
If you are logged on to the Central LCM system, log out from the system.
3.
Click Login to connect to the Origin system.
The "Login to system" window appears.
4.
Select the source system marked as Origin to scan the objects, and login to the system using valid credentials.
5.
From the Start drop-down list next to Scan, select the Start option.
The scanning process starts. The "List of Overrides" is displayed.
Note:
To schedule the scan to suit your preferences, select Recurrence Settings option from the drop-down list.
6.
In the list of overrides, change the status to Active for the objects you want to promote, and click
Save.
7.
Click Promote Overrides.
The "Promote Overrides" screen appears where the list of destination systems is displayed.
8.
From the Promotion Options drop-down list, select Promote with CTS+.
9.
Click Promote.
10.
Release the overrides to the destination system by completing the following steps: a.
Login to the domain controller of CTS+ and open the "Transport Organizer" Web UI. For more information on using the Transport Organizer Web UI, see http://help.sap.com/saphelp_nw70ehp1/helpdata/en/b5/6d03660d3745938cd46d6f5f9cef2e/frame set.htm
b.
If the status of the request is Modifiable, click Release to release the transport request of the overrides. For more information on Releasing Transport Requests with Non-ABAP Objects, see http://help.sap.com/saphelp_nw70ehp1/helpdata/en/55/07c497db8140ef8176715d4728eec1/frame set.htm
c.
Close the "Transport Organizer" Web UI.
11.
Import the overrides to the destination system by completing the following steps: a.
Login to the Domain Controller of CTS+.
2012-12-12
Promotion Management b.
Call the STMS transaction to enter the transport management system.
c.
Click on the Import Overview icon.
The "Import Overview" screen appears and you can view the import queue items from all the systems.
d.
Click the System ID of the destination LCM system.
You can see the list of transport requests that can be imported to the system.
e.
Click Refresh.
f.
Import the relevant transport requests. For more information, see http://help.sap.com/saphelp_nw70ehp1/helpdata/en/44/b4a39e7acc11d1899e0000e829fbbd/frame set.htm
12.
The promotion of overrides is complete.
13.
Login to one of the destination systems using valid credentials.
A list of all the promoted objects is displayed in "list of overrides". The status of these objects is
Inactive.
14.
Click the Select check box for the objects you want to edit, and click Edit.
15.
Update the required values, and click Done .
16.
Change the state of the objects to Active and click Save.
15.2.3.4.4 Promoting Overrides in a Clustered Environment
When you try to override any infoobject, the override information is stored in the derby database (Central
LCM) by default. In a clustered environment, each BI platform has its own derby database. To promote overrides, you need to share one derby database of a BI platform system and use it as a shared central database for all clustered systems.
For example, consider three clustered systems A, B, and C. First, you need to share the derby database of A system. The derby database of A system becomes the central database. In the Override Settings of B and C systems, you need to provide the location of the central derby database shared by the A system.
1.
Log on to CMC.
2.
Go to Applications.
3.
Choose Promotion Management.
4.
Choose LCM Override Settings.
5.
Enter the location of the central derby database.
For example, for the system hosting central database, provide the actual path
(<BI_PLATFORM_INST_DIR>/SAP BusinessObjects Enterprise XI 4.0/Data/) of the shared derby database. In all the other clustered systems, provide shared derby database location
(\\SYSTEM_A_HOSTNAME\Data\)
6.
Choose Save.
7.
Restart APS.
509 2012-12-12
Promotion Management
15.2.3.5 Using the CTS Settings Option
You can use this option to add web services and manage BW systems in your landscape. Refer to the
Configuring CTS+ Settings in the Promotion Management Tool
section for more information on using the CTS Settings Option and setting up CTS for usage with the promotion management application.
15.3 Using the promotion management tool
When you launch the promotion management application, by default, you are taken to the "Promotion
Jobs" page.
The "Promotion Jobs" home page screen includes various tabs that enable you to perform the following tasks:
• Select New Job to select job-related processes. You can also right-click the home page screen and select the job-related processes from the list.
• Select Import > Import file to import a BIAR file or LCMBIAR directly from the file system, instead of performing the entire procedure of creating a new job.
• Select Import > Override File to import overrides.
• Select Edit to edit the existing jobs.
• Select Promote to promote the job from the source system to the destination system, or export the job to a BIAR file.
• Select Rollback to revert the promoted jobs from the destination system.
• Select History to view the previous promotion instances of the job.
• Select Properties to view the properties of the selected job instance, such as title, ID, file name, description, and so on.
The "Promotion Jobs" application area displays the list of jobs that exist in the system, along with the following information for each job:
• Name: Displays the name of the job that was created.
• Status: Displays the status of the job, such as Created, Success, Partial Success, Running, or
Failure.
• Created: Displays the date and time when the job was created.
• Last Run: Displays the date and time when the job was last promoted.
• Source System: Displays the name of the system from which the job is promoted.
• Destination System: Displays the name of the system to which the job is promoted.
• Created By: Displays the name of the user who created the particular job.
510 2012-12-12
Promotion Management
Note:
The promotion management application uses SAP BusinessObjects Business Intelligence platform
SDK for all its activities.
15.3.1 Creating and Deleting a Folder
This section describes how to create and delete a folder in the promotion jobs home page.
15.3.1.1 Creating a Folder
This section describes how to create a folder.
To create a folder, complete the following steps:
1.
In the promotion management toolbar, click .
2.
In the "Create Folder" dialog box, enter the folder name.
3.
Click OK.
A new folder is created.
Related Topics
•
•
15.3.1.2 Deleting a Folder
This section describes how to delete a folder.
To delete a folder, complete the following steps:
1.
Select a folder or job in the "Promotion Jobs" home page.
2.
Click .
The "Delete" dialog box appears.
3.
Click OK.
The selected folder is deleted.
511 2012-12-12
Promotion Management
Related Topics
•
15.3.2 Creating a Job
This section describes how to create a new job by using the promotion management tool.
The following table discusses the GUI elements and fields that you can use to create a new job:
Field
Name
Description
Keywords
Save Job in
Source System
Destination System
User name
Password
Authentication
Description
Name of the job that you want to create.
Description of the job you want to create.
The keywords for the contents of the job you want to create.
The default selected folder is displayed.
The name of the SAP BusinessObjects Business Intelligence platform system from which you want to promote a job.
The name of the SAP BusinessObjects Business Intelligence platform system to which you want to promote a job.
The login ID that you must use to log into the source or destination system.
The password that you must use to log into the source or destination system.
The authentication type that is used to log into the source or destination system.
The promotion management tool supports the following authentication types:
• Enterprise
• Windows AD
• LDAP
• SAP
512 2012-12-12
Promotion Management
Note:
Prior to job creation, ensure that the overrides, if any, have been edited and updated in the destination system so that the BI platform content is automatically updated. For more information see, Using the
Override Settings Option.
To create a new job by using the promotion management tool, complete the following steps:
1.
Launch the promotion management tool.
2.
In the "Promotion Jobs" home page, click the New Job tab.
3.
Enter the name, description, and keywords for the job in the appropriate fields.
Note:
Providing information in the Description, Keywords, and Destination System fields is optional.
4.
In the Save Job in field, browse and select the folder in which you want to save the job.
Note:
By default, the Save Job in field will be populated by the name of the folder highlighted in the folders pane prior to clicking New Job.
5.
From the Select Dependents drop-down list, select the options to add the dependents to the job.
You must explicitly select the dependents that you want to promote. For example, if you select All
Universes from the Select Dependents drop-down list, then all the universes included in the list of dependents are displayed. You can then select the dependents individually.
6.
Select source system and destination system from the respective drop-down lists.
If the name of the system is not included in the drop-down list, click the Login to a new CMS option.
A new window is launched. Enter the name of the system along with the user name and password.
7.
Click Create.
The newly created job is stored in the CMS repository of the source system.
Note:
If you create a job with a folder as the primary object and the job is a recurring one, the job will include any content added to the folder at the next run-time.
Related Topics
•
Using the Override Settings Option
15.3.2.1 Logging into a New CMS
This section describes how to log into a new CMS.
To log into a new CMS, complete the following steps:
1.
Launch the promotion management application.
2.
Create a new job.
513 2012-12-12
Promotion Management
For more information on creating a new job, see
3.
From the Source System drop-down list, select Login to a New CMS.
The "Login to System" dialog box appears.
4.
Enter the user credentials, select the appropriate authentication type, and click Login.
5.
From the Destination System drop-down list, select Login to a New CMS.
6.
Enter the user credentials, select the appropriate authentication type, and click Login.
Related Topics
•
•
Adding an Infoobject in promotion management
•
Promoting a Job When the Repositories are Connected
•
15.3.3 Creating a New Job by Copying an Existing Job
This section describes how to create a new job by copying an existing job.
To create a new job by copying an existing job, complete the following steps:
1.
Launch into the promotion management application.
2.
In the "Promotion Jobs" home page, click New Job.
3.
Click the Copy an Existing Job option.
The "Copy an Existing Job" window appears displaying the list of jobs in the Promotion Jobs folder.
4.
Select the required job from the list, and click Create.
The name, keywords, and description of the job are displayed. You can modify these fields, if required.
However, you cannot change the name of the source system.
5.
In the Save Job in field, browse and select the folder in which you want to save the job, and click
Create.
A new job is created, and the "Add Objects - Job Name" page appears.
Related Topics
•
Adding an Infoobject in promotion management
•
•
Promoting a Job When the Repositories are Connected
514 2012-12-12
Promotion Management
15.3.4 Searching for a Job
The search feature in the promotion management tool enables you to locate a job that is available in the repository.
To search for a job, complete the following steps:
1.
In the Search field of the home page, enter the text that you want to locate.
2.
Click the list that appears beside the Search field to specify the search parameters. You can specify the following search parameters:
• Search Title - This option enables you to search for a job by its name.
• Search Keyword - This option enables you to search for a job by its keywords.
• Search Description - This option enables you to search for a job by its description.
• Search All Fields - This option enables you to search for a job by its title, keywords, and description.
3.
Click the Search icon.
Related Topics
•
Adding an Infoobject in promotion management
•
15.3.5 Editing a Job
This section describes how to edit a job.
Note:
Editing a job does not amount to creating a new job.
To edit a job, complete the following steps:
1.
Launch into the promotion management application.
2.
In the "Promotion Jobs" home page, select the job that you want to edit.
3.
Click Edit.
The details of the selected job are displayed. Based on your requirements, you can add or remove infoobjects, manage dependencies or promote the job.
While editing a job, you cannot change the name of the source system.
Related Topics
•
Adding an Infoobject in promotion management
515 2012-12-12
Promotion Management
•
Promoting a Job When the Repositories are Connected
•
15.3.6 Adding an Infoobject in promotion management
Each job must include a set of infoobjects and their dependents. Hence, you must add infoobjects to a job before you promote it to the destination system.
Note:
You must log into the destination system while adding an infoobject to a job.
To add an infoobject to a job, complete the following steps:
1.
Launch the promotion management tool.
2.
Create a new job.
For information on creating a new job, see
3.
Click Add Objects.
The "Add Objects" dialog box appears, and the list of objects is displayed.
4.
Navigate to the folder from which you want to select the infoobject.
The list of infoobjects in the selected folder is displayed.
5.
Select the infoobject that you want to add to the job, and click Add.
If you want to add an infoobject and exit the "Add Objects - Name of the source system" dialog box, click Add and Close. The infoobject is appended to the job and "Add Objects - Name of the source system " dialog box closes.
After you add an infoobject to a job, you can right-click the "Job Viewer" page and select the job-related processes to proceed with the promotion task. You can manage the dependents of the infoobject you selected by using the Manage Dependencies option in the "Job Viewer" page.
Note:
• The Shopping Cart, which appears in the left panel of the "Job Viewer" page, displays the job, along with its dependents, in a flat tree structure.
• Click Save option after adding infoobjects, to save the changes. Otherwise, the user is prompted with an option to save the job when the user closes the tab.
Best Practice: SAP Business Objects recommends that you select a small number of infoobjects, which should not exceed 100 at a time, for promotion to obtain optimum performance of the promotion management tool.
Related Topics
•
Managing Dependencies in promotion management
•
Promoting a Job When the Repositories are Connected
516 2012-12-12
Promotion Management
•
15.3.7 Managing Dependencies in promotion management
This section describes how to manage the dependents of an infoobject.
To manage the dependents of an infoobject, complete the following steps:
1.
Launch the promotion management tool.
2.
Create a new job.
For information on creating a new job, see
3.
Add the required infoobjects to the new job.
The "Promotion Jobs" screen appears.
4.
Click Manage Dependencies.
The "Manage Dependencies" window appears. This window displays the list of infoobjects and their dependents. To view only the object dependents that have not been selected, click Show unselected
Dependents check box.
5.
From the Select Dependents drop-down list, select the options to add the dependents to the job.
The dependents are not selected by default; you must explicitly select the dependents you want to promote.
For example, if you select All Universes from the Only show dependents that are not selected drop-down list, then all universes included in the list of dependents are selected. You can also select the dependents individually.
You can click the Type to view the supported filtering options for the infoobjects. A drop-down list appears. This list displays the supported filtering options. Select the filtering option, and click
OK. The filtered infoobjects are displayed.
When you select the dependents from the Dependents column, the dependents are automatically moved to the Objects in Job column.
You can also type the name of the dependent in the Search Dependents field to search for a dependent.
For more information on searching for dependents, see
6.
Click Apply Changes to update the list of dependents and click Apply Changes and Close to save the changes.
Dependent objects are computed automatically by the tool. These dependents are computed based on either the infoobject relationships or infoobject properties. Dependents that do not qualify under either of these are not computed in this version of the tool.
517 2012-12-12
Promotion Management
Note:
If you select a folder for promotion, then the contents in the selected folder are considered as primary resources.
Related Topics
•
Promoting a Job When the Repositories are Connected
15.3.8 Searching for Dependents
The advanced search feature in the promotion management tool enables you to locate the dependents of infoobjects that are available in the repository.
To search for the dependents of an infoobject, complete the following steps:
1.
Launch promotion management.
2.
Create a new job, or edit an existing job.
If you have created a new job, add infoobjects to the job. If you are editing an existing job, you can add objects, if required.
3.
Click Managing Dependencies.
4.
In the Search Dependents field, enter the name of the dependent you want to locate.
5.
Click the Search icon.
Related Topics
•
Managing Dependencies in promotion management
15.3.9 Promoting a Job When the Repositories are Connected
This section describes how to promote a job from the source system to the destination system if the repositories are connected.
The following table lists the infoobject types that can be promoted by using the promotion management tool:
Category
Reports
Object types you can promote
Crystal reports, Web Intelligence, Dashboards, QaaWS,
Explorer
518 2012-12-12
Promotion Management
519
•
•
Category
Third-Party Objects
Users
Server
Business Intelligence Platform
Universe, Workspace
EPM Dashboard
BusinessView
Federation
Replication List
Replication Jobs
BI Services
New Infoobjects
Object types you can promote
Rich text, Text document, Microsoft Excel, Microsoft
Power Point, Microsoft word, Flash, Adobe acrobat
Users and user groups
Server groups
Folder, Program, Events, Profiles, Object package, Hyper-
Link, Categories, Alerts, Inbox document, Personal and
Favorites folder
Universes UNV, Connections
Universes, Connections, Reports, Dashboard, and Analytics
DataFoundation
Replication List promotes the following objects: Flash, .txt,
Discussions, Dashboards, .pdf, Hyperlink, .xls, ObjectPackage, Crystal Reports, Web Intelligence Documents, Universes, Program, Connections, DataFoundation, Business
Views, .rtf, Profile, Event, Users, and userGroups. Replication Connections promotes Replication Jobs, Remote
Connection, Publications, Discussion, Pioneer Connection
Web Intelligence Documents, Universes and Connections
Crystal reports(rpt/rptr),Pioneer, Dashboard Design, DSL
Universe (UNX),WEBI,Explorer, Data Federator, Data
Steward, BI Workspace, etc.
To promote a job, complete the following steps:
1.
Launch promotion management.
2.
In the "Promotion Jobs" home page, select the job you want to promote.
You can also right-click the home page screen, and click Promote.
3.
From the Source and Destination systems drop-down lists, select the source and destination systems.
Note:
Ensure that you have logged into both source and destination systems before you proceed with promotion process.
4.
In the Change Management ID field, enter the appropriate value, and click Save.
Note:
The Change Management ID is used for obtaining information related to logging, auditing, job history, and so on. The promotion management tool enables you to map each instance of job creation to a
2012-12-12
Promotion Management
Change Management ID. The Change Management ID is an attribute that is set by the user in the job definition while creating a new job. The tool automatically generates an ID for each job.
5.
Select Security Settings, if required. The following options are displayed:
• Do not promote security - this is the default option.
• Promote security - use this option to promote jobs along with the associated security rights.
• Promote object security - use this option to promote the security of objects and folders
• Promote user security - enables you to promote the rights of the users who are a part of the job
• Include Application Rights - this option is enabled only when you select Promote Security. If the objects in the job inherit any application rights, the job is promoted along with those rights.
You can also click View Rights to view the security dependencies of infoobjects in the job.
6.
Click Test Promote to ensure that there are no conflicts between CUIDs of infoobjects in the source and destination systems. The promotion details are displayed under the tabs Success, Failure and
Warning. The first column displays the objects to be promoted, and the second column displays promotion status of each infoobject. The promotion management tool classifies the selected objects into users, groups, universes, and so on.
Note:
This option does not commit any infoobjects for promotion.
The result of a test promote can be any one of the following:
• Overwritten - The infoobject in the destination system is overwritten by the infoobject in the source system.
• Copied - The infoobject in the source system is copied to the destination system.
• Dropped - The infoobject is not promoted from the source system to the destination system.
• Warning - The infoobject in the destination system is the newer version and you can remove the infoobject from the Job. However, if you want to promote, the infoobject gets promoted.
7.
Click Schedule Job if you want to schedule the promotion of a job instance.
8.
Click Promote.
The selected job is promoted.
If you do not want to promote the job, you can use the Save option to save the modifications such as
Security, Change Management ID, and Schedule settings.
15.3.10 Promoting a Job by Using a BIAR File
Promoting refers to the activity of transferring a BI resource from one repository to another. If the source system and destination system are connected, the promotion management tool uses WAN or LAN to promote the infoobject. However, the promotion management tool also facilitates the promotion of infoobjects even if the source and destination systems are not connected.
In scenarios where the source and destination systems are not connected, the promotion management tool supports the promotion of jobs to the destination system by enabling you to export the job in the source system to a BIAR file and import the job from the BIAR file to the destination system.
520 2012-12-12
Promotion Management
This section describes how to export a job to a BIAR file and then import the job from the BIAR file to the destination system.
Note:
You cannot use a BIAR file that was created by using the Import Wizard tool.
Related Topics
•
Exporting a Job to a BIAR File
•
Importing a Job from a BIAR File
521
15.3.10.1 Exporting a Job to a BIAR File
This section describes how to export a job to a BIAR file.
To export a job to a BIAR file, complete the following steps:
1.
Launch the promotion management tool, and create a new job.
For more information on creating a new job, see
2.
From the Destination drop-down list, select Output to LCMBIAR file option and click Create.
3.
Click Add Objects to add infoobjects to the job.
You can use the Manage Dependencies option to manage the dependencies of the selected job.
4.
Click Promote.
The "Promote" window appears.
5.
Modify these options per your requirements, and click Export.
The BIAR file is created. You can save a BIAR file to a File System or an FTP location.
6.
From the Destination drop-down list, select Output to LCMBIAR file, and click LCMBIAR File
Destination.
The LCMBiar File Destination pane appears.
7.
Perform one of the following steps:
• Select File System.
• Select FTP, enter appropriate details in the host, port, username, password, directory, and filename fields.
8.
To encrypt the LCMBIAR file using password, click Password Encryption checkbox.
9.
Enter a password in the Password field.
10.
Re-enter the password in the Verify Password field.
11.
Click Export.
The BIAR file is exported to the file system or an FTP location, depending on the option you select in step 7.
2012-12-12
Promotion Management
12.
You can schedule the export of a job to a BIAR file. For more information on this, refer to the
Scheduling a job promotion section.
Related Topics
•
Adding an Infoobject in promotion management
•
Managing Dependencies in promotion management
15.3.10.2 Importing a Job from a BIAR File
You can import a job from classic BIAR files or from LCMBIAR file. The BIAR file is copied from the storage device to the destination system.
To import a BIAR file, complete the following steps:
1.
Launch the promotion management application.
2.
In the "Promotion Jobs" home page, click Import > Import file.
The "Import from file" window appears.
3.
You can import a BIAR file from your local machine or from any other source machine.
• To import a BIAR file from your local machine, perform the following steps :
a.
Select file system.
b.
Click Browse and select a BIAR file from the file system.
Note:
If a job with the same name exists, the Confirm Save popup appears. Click 'Yes' to overwrite the existing job; Click 'No' to create a job with a new CUID and name Jobname_copy.
c.
In the Password field, enter the password of the LCMBIAR file.
Note:
The Password field appears only if the LCMBIAR file is encrypted with a password.
d.
Click Create. The job is created.
• To import BIAR file from any source machine where FTP has been enabled, complete the following steps:
a.
Select FTP.
b.
Enter appropriate details in the host, port, username, password, directory, and filename fields and click OK.
Note:
You can import only LCMBIAR or upgrade BIAR files.
4.
Click Promote.
The "Promote - Job Name" window appears.
522 2012-12-12
Promotion Management
5.
From the Destination drop-down list, select the destination system. If you select Login to a New
CMS, you will be prompted for credentials. Confirm the login credentials of the destination system.
6.
Click Promote to promote the contents to the destination system.
You can also click the Test Promote option to view the objects to be promoted and the promotion status.
Related Topics
•
Managing Dependencies in promotion management
15.3.11 Scheduling a job promotion
This section describes how to schedule the promotion of a job instance. It also describes how to specify the recurrence options and parameters.
To schedule the promotion of a job instance, complete the following steps:
1.
In the "Promote" dialog box, click the Schedule option.
2.
Set the required schedule option and click Schedule.
If you add InfoObjects to an existing folder after the job has been scheduled for promotion, they will also be promoted to the destination at the scheduled time.
Scheduling to a destination is possible while exporting a job to a BIAR file.
Tip:
After the promotion of an InfoObject is complete, you can view all the running instances of the infoobject by right clicking on it and selecting History.
Promotion of a job can also happen based on event triggers.
You can select email notifications based on job promotion status (like success/partial success/failed).
For detailed information on the various scheduling options and configuring your notifications, refer to the Scheduling section.
Related Topics
•
Exporting a Job to a BIAR File
15.3.11.1 Updating the Recurring and Pending Job Promotion Instances
523 2012-12-12
Promotion Management
The promotion management tool enables you to track and update the status of the scheduled promotion of a job instance by using the Recurring and Pending Instances option.
To track and update the scheduled job promotion instances, complete the following steps:
1.
Launch the promotion management tool.
2.
In the "Promotion Jobs" home page, select a job.
3.
Click History.
The "Job History" window appears.
4.
Click Recurring & Pending Instances.
The "Job History for Recurring and Pending Instances" window appears. This window displays the list of recurring and pending job promotion instances.
Based on your requirements, you can use the following options:
•
• Click Promoted Instances to view the list of scheduled job promotion instances.
• Click the Pause option to pause the scheduled promotion.
•
•
• Click the Resume option to resume the paused scheduled job promotion instance.
• Click the Reschedule option to reschedule a job promotion instance.
Click to delete a scheduled job promotion instance.
Click to refresh the status of a scheduled job promotion instance.
You can use the option to navigate a single page, or navigate to a specific page by entering the relevant page number.
Note:
The status column in the "Job History for Recurring and Pending Instances" window displays the status of the job promotion instance, such as recurring, pending, and so on.
Related Topics
•
15.3.12 Viewing the History of a Job
This section describes how to view the history of a job.
Note:
To view the history of a job, you must ensure that the status of the job is one of the following:
• Success
• Failure
• Partial Success
To view the history of a job, complete the following steps:
524 2012-12-12
Promotion Management
1.
Launch the promotion management tool.
The "Promotion Jobs" home page appears.
2.
Perform any of the following operations:
• Right-click the job for which you want to view the history, and select History.
• Select the job for which you want to view the history, and click the History tab.
The job instance, name of the job, names of the source and destination systems, the ID of the user who promoted the job, and the status (Success, Failure, or Partial Success) of the job are displayed.
You can view the status of the job by using the link displayed in the Status column.
15.3.13 Rolling Back a Job
The Rollback option enables you to restore the destination system to its previous state, after a job is promoted.
To roll back a job, complete the following steps:
1.
Launch the promotion management tool.
The "Promotion Jobs" home page appears.
2.
Perform any of the following operations:
• Right-click the job you want to rollback, and select Rollback.
• Select the job you want to rollback, and click the Rollback tab.
The "Rollback" window appears.
3.
Select the job you want to roll back, and click Complete Rollback.
The job is rolled back.
You can roll back only the most recent instance of a job promotion. You cannot roll back two job instances at a time.
15.3.13.1 Using the Partial Rollback Option
The promotion management tool enables you to roll back infoobjects in a job either completely or partially from the destination system.
To roll back infoobjects partially, complete the following steps:
1.
Launch the promotion management tool.
The "Promotion Jobs" home page appears.
2.
Perform any of the following operations:
525 2012-12-12
Promotion Management
• Right-click the job you want to rollback, and select Rollback.
• Select the job you want to rollback, and click the Rollback tab.
The "Rollback" window appears.
3.
Select the job from the list, and click Partial Rollback.
The list of infoobjects in the selected job is displayed in the "Job Viewer" page.
4.
Select the infoobjects that you want to roll back, and click Rollback.
Note:
You must ensure that you have rolled back all the infoobjects in a job before you roll back infoobjects in the next job.
Important: If a job is promoted with security, then, during the partial rollback of infoobjects, the selected dependent infoobjects may not have its security rolled back to its previous state.
Related Topics
•
Managing Different Versions of BI resources
15.3.13.2 Rolling Back a Job After the Password Expires
This section describes how to roll back a job, after the password that was used to promote it expires.
To roll back a job after the password expires, complete the following steps:
1.
Select the job that you want to roll back, and click Rollback.
2.
In the "Rollback" window, select Complete Rollback.
An error message is displayed. This message states that the job cannot be rolled back. You are also prompted to log into the source or destination system.
3.
Enter the new login credentials, and click Login.
A dialog box appears indicating that the rollback process is complete.
Note:
The jobs that were promoted by using the source or destination system credentials are updated automatically.
Related Topics
•
Rolling Back infoobjects After the Password Expires
•
Using the Partial Rollback Option
526 2012-12-12
Promotion Management
15.3.13.2.1 Rolling Back infoobjects After the Password Expires
This section describes how to roll back infoobjects, after the password for the source or destination system expires.
To roll back infoobjects after the password expires, complete the following steps:
1.
Select the job that you want to roll back, and click Rollback.
The "Rollback" window appears.
2.
Select the Partial Rollback option.
An error message is displayed. This message states that the infoobjects cannot be rolled back. You are also prompted to log into the source or destination system.
3.
Enter the new login credentials, and click Login.
The "Job Viewer" page appears. This page displays the list of infoobjects.
4.
Select the required infoobjects, and click Rollback.
Note:
The jobs that were promoted by using the source or destination system credentials are updated automatically.
Related Topics
•
•
Using the Partial Rollback Option
•
Rolling Back a Job After the Password Expires
15.4 Managing Different Versions of an Infoobject
The version management application enables you to manage versions of BI resources that exist in the
SAP BusinessObjects Business Intelligence platform repository. It supports both Subversion and
ClearCase version management systems. This section describes how to use the Version Management feature in the promotion management console tool.
To create and manage different versions of an infoobject, complete the following steps:
1.
Launch the promotion management application.
2.
In the home page, select Version Management from the drop-down list.
The "Login to System" dialog box appears.
3.
Enter the login credentials, and click Login.
The "Version Management" window appears.
527 2012-12-12
Promotion Management
Note:
You can log into the version management system (VMS) only if it is already configured.
4.
If you want to change the host system, click
The "Login to System" dialog box appears.
.
5.
Enter the user credentials, and click Login.
6.
From the left panel of the "Version Management" window, select the folder to view the infoobjects whose versions you want to manage.
7.
Select the infoobjects and click Add to VM.
Note:
Clicking "Add to Version Management" results in the creation of a base version of the object in the
VMS repository. A base version is required for subsequent check-in.
8.
Click Checkin to update the document that exists in the VMS repository.
The "Check-in Comments" dialog box appears.
9.
Enter your comments, and click OK.
The change in the version number of the selected infoobject is displayed in the VMS and Content
Management System columns.
10.
To obtain the latest version of the document from the VMS, select the required infoobject, and click
Get latest Version.
11.
To create a copy of the latest version, click Create Copy.
A copy of the selected version is created.
12.
Select History to view all the versions available for the selected resource.
The "History" window appears. The following options are displayed:
• Get Version - If there are multiple versions, and if you require a particular version of the BI resource, then you can select the required resource and click Get Version.
• Get Copy of Version - This option enables you to obtain a copy of the selected version.
• Export Copy of Version - This option enables you to obtain a copy of the selected version and save it to your local system.
13.
Select an infoobject and click Lock to lock the infoobject and click Unlock to unlock the infoobject.
Note:
If you lock an infoobject, you cannot perform any action on that infoobject.
14.
CMS and VMS Synchronisation - When the CMS version of the infoobject is updated, an indicator appears beside the updated infoobject. When you place the cursor on the indicator, you get a tool tip describing that the infoobject in the CMS is updated.
15.
To view the list of all checked in resources that exist in the VMS, but not in the CMS, click View
Deleted resources.
Click any deleted resource to view the history of that resource. You can select a deleted resource, and click Get Version to view that particular version of the resource. You can click Get Copy of
Version to get a copy of the selected resource.
528 2012-12-12
Promotion Management
Note:
If you use either Get Version or Get Copy of Version option, the resource is moved to CMS from the VMS missing file list.
16.
Select a resource, and click to view the properties of the resource.
Alternatively, you can right click on the infoobject and perform Steps 4 to 16.
15.4.1 Version Management application access rights
This section describes the application access rights for the version management application.
• You can set access rights to the version management application within the CMC.
• You can set granular application rights to various functions within the version management application.
To set specific rights in the version management application application, complete the following steps:
1.
Log into CMC and select Applications.
2.
Double-click Version Management.
3.
Click User Security, and select a user.You can view or assign security rights for the selected user.
4.
The following version management specific rights are now available:
• Allow Checkin
• Allow Create Copy
• Allow Delete Revision
• Allow Get Revision
• Allow Lock and Unlock
• View and Version BOMM objects
• View and Version Business Views
• View and Version Calenders
• View and Version Connections
• View and Version Profiles
• View and Version QaaWS
• View and Version Report Objects
• View and Version Security Objects
• View and Version Universes
• View Deleted Resources
5.
If you wish to assign rights to a selected user, select the appropriate right and click Assign Security.
15.4.2 Backing Up and Restoring Subversion Files
529 2012-12-12
Promotion Management
This section describes suggested procedures to perform backups and recover subversion files.A backup and recovery plan consists of precautions to be taken in the event of a system failure due to a natural disaster or a catastrophic event.
15.4.2.1 Backing Up Subversion Files
Complete the following steps to backup the subversion files:
1.
Go to <InstallDIR>\Program Files (x86)\SAP BusinessObjects\SAP
BusinessObjects Enterprise 4.0\CheckOut
2.
Copy the CheckOut folder and store in any backup device.
3.
Copy the entire LCM_Repository and store in any backup device.
15.4.2.2 Restoring Subversion Files
Complete the following steps to restore subversion files:
1.
Restore the CheckOut folder from the earlier backed up location.
Note:
In LCM > Administration options > VMS Settings > Subversion, ensure that the correct check out path is entered in the Workspace Directory field.
2.
Restore the LCM_Repository from the earlier backed up location.
Note:
In LCM > Administration options > VMS Settings > Subversion, ensure that the correct check out path is entered in the Install Path field.
15.5 Using the Command Line Option
The Command Line option of the promotion management tool enables you to promote objects through command line input from one SAP BusinessObjects Business Intelligence platform system to another
SAP BusinessObjects Business Intelligence platform system.
The promotion management tool supports the following job promotion through command line option:
• Export an existing LCM job template to LCMBIAR with password encryption.
• Export an existing LCM job template to LCMBIAR without password encryption.
• Promote with existing job template
530 2012-12-12
Promotion Management
• Import and promote an existing LCMBIAR
• Export single/multiple platform queries
• Promote multiple platform queries
15.5.1 Running the Command Line Option in Windows
To run the command line tool, complete the following steps:
1.
Launch a command line window or shell.
2.
Navigate to the appropriate directory.
For example, the directory path for windows is -C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\java\lib
3.
Do one of the following:
• Execute the LCMCLI, ensure the java path is set prior to running the program.
Command: java -cp "lcm.jar" com.businessobjects.lcm.cli.LCMCLI <property file>
• Run the BAT file from C:\Program Files (x86)\SAP Business Objects\SAP
BusinessObjects Enterprise XI 4.0\win64_x64\scripts\lcm_cli.bat
Command: lcm_cli.bat -lcmproperty <property file>
Note:
Enter the valid passwords when prompted.
The promotion management command line tool takes a properties file as a parameter. The prop
erties
file contains the required parameters to communicate the promotion management tool about the actions to perform, connection to which SAP BusinessObjects Business Intelligence platform deployment, connection methods, objects to promote, and so on.
The file must be in the form of <File Name>.properties
For Example: Myproperties.properties
15.5.2 Running the Command Line Option in UNIX
To run the command line tool, complete the following steps:
1.
Launch shell.
2.
Navigate to the appropriate directory.
For example, /usr/u/qaunix/Aurora604/sap_bobj/enterprise_40/java/lib
531 2012-12-12
Promotion Management
3.
Do one of the following:
• Execute the LCMCLI, ensure the java path is set prior to running the program.
Command: java -cp "lcm.jar" com.businessobjects.lcm.cli.LCMCLI <property file>
• Run the BAT file from <installdir_path>\sap_bobj\lcm_cli.sh
Command: lcm_cli.sh -lcmproperty <property file>
Note:
Enter the valid passwords when prompted.
15.5.3 Command Line Option Parameters
The following table describes the parameters and the allowed values for the command line option of the promotion management application.
Parameter
action
Allowed Values
Export, Promote
Example: action=ex port
Description
Mandatory vs Optional
This option enables you to specify the operation that the CLI must perform. This operation can perform any of the following operations:
• Promote objects from an LCMBiar file or a promotion management job to an SAP BusinessObjects Business
Intelligence platform system.
• Export objects from an SAP BusinessObjects Business
Intelligence platform system to an
LCMBIAR file.
Mandatory
532 2012-12-12
Promotion Management
Parameter
exportLocation importLocation
LCM_CMS
LCM_userName
LCM_password
Allowed Values Description
Mandatory vs Optional
Free form text. Must have .lcmbiar extension
Example: exportLoca tion=C:/Back up/New.lcmbiar
This parameter enables the user to specify the location to place the LCMBIAR file after the objects have been exported and packaged.
Mandatory if ac tion=ex port
Free form text. Must have .lcmbiar extension
Example: importLoca tion=C:/Back up/New.lcmbiar
This parameter enables the user to specify the location of the
LCMBIAR file that contains the objects to be promoted.
Mandatory if ac tion=pro mote
Free form text.
Example:
LCM_CMS=<CM
Sname:port no.>
This parameter enables the user to specify the CMS for the promotion management application.
Mandatory if ac tion=pro mote or export
Free form text.
Example: LCM_user
Name=<username>
This parameter enables the user to specify the account username that the tool must use to connect to the promotion management application CMS.
Note:
Delegated administrator is supported
Mandatory if ac tion=pro mote or export
Free form text.
Example: LCM_pass word=<password>
This parameter enables the user to specify the password of the user account.
Mandatory if ac tion=pro mote or export
533 2012-12-12
Promotion Management
534
Parameter
LCM_authentication
LCM_systemID
LCM_clientID
Source_CMS
Source_userName
Source_password
Allowed Values Description
Mandatory vs Optional
secEnterprise, secWinAD, secLDAP,secSAPR3
Example: LCM_authen tication=<authenti cation>
This parameter indicates the authentication type to be used.
Optional. If the authentication type is not specified, secEnter prise is used
System ID
Example: LCM_sys temID=<systemID>
This parameter is used for SAP authentication.
Mandatory for SAP authentication.
Client ID
Example: LCM_clien tID=<clientID>
This parameter is used for SAP authentication.
Mandatory for SAP authentication.
Free form text.
Example:
Source_CMS=<CM
Sname: port no.>
This parameter enables the user to specify the CMS to which the tool must connect.
Mandatory if ac tion=ex port
Free form text.
Example:
Source_user name=<username>
This parameter specifies the user account that the tool must use to connect to the SAP
BusinessObjects Business Intelligence platform CMS.
Note:
Delegated administrator is supported.
Mandatory if ac tion=ex port
Free form text.
Example:
Source_pass word=<password>
This parameter specifies the associated password of the user account.
Mandatory if ac tion=ex port
2012-12-12
Promotion Management
Parameter
Source_authentication
Source_systemID
Source_clientID
Destination_userName
Destination_password
Allowed Values Description
Mandatory vs Optional
secEnterprise, secWinAD, secLDAP,secSAPR3
Example: Source_au thentication=<au thentication>
This parameter indicates the authentication type to be used.
Optional. If the authentication type is not specified, secEnter prise is used
SAP System ID
Example:
Source_sys temID=<systemID>
This parameter is used for SAP authentication only.
Mandatory for SAP authentication.
SAP Client ID
Example:
Source_clien tID=<systemID>
This parameter is used for SAP authentication only.
Mandatory for SAP authentication.
Free form text.
Example: Destina tion_user name=<username>
This parameter specifies the user account that the tool must use to connect to the SAP
BusinessObjects Business Intelligence Platform CMS.
Note:
Delegated administrator is supported.
Mandatory if ac tion=pro mote
Free form text.
Example: Destina tion_pass word=<password>
This parameter specifies the associated password of the user account.
Mandatory if ac tion=pro mote
535 2012-12-12
Promotion Management
Parameter Allowed Values
Destination_authentication secEnterprise, secWinAD, secLDAP,secSAPR3
Example: Destina tion_authentica tion=<authentica tion>
Description
Mandatory vs Optional
This parameter indicates the authentication type to be used.
Optional. If the authentication type is not specified, secEnter prise is used
Destination_systemID
System ID
Example: Destina tion_systemID=<sys temID>
This parameter is used for SAP authentication only.
Mandatory for SAP authentication.
Destination_clientID includeSecurity
JOB_CUID
Client ID
Example: Destina tion_clientID=<sys temID>
This parameter is used for SAP authentication only.
Mandatory for SAP authentication.
false, true
Example: includeSe curity=<true or false>
This parameter instructs the tool to export or import the security associated with selected objects and selected users. If access levels are used this will also export/import them.
Optional, if not specified the default is false.
Used if ac tion=pro mote or export
The CUID of the saved
LCM job.
This parameter instructs the tool to export all the objects in the job to the LCM-
BIAR file.
Optional, used if ac tion=ex port or promote
536 2012-12-12
Promotion Management
Parameter
exportQuery exportQueriesTotal stacktrace
Allowed Values Description
Mandatory vs Optional
Free form text. Use the
CMS query language format.
Example: export
Query1=select*from ci_Infoobjects where si_name='Xtreme
Employees' and si_kind='Webi'
Note:
You can have any number of queries in one properties file, but they must be named as exportQuery1, export-
Query2, and so on.
These are the queries the tool should execute to gather the desired objects for exportation.
Optional, used if ac tion=ex port
Positive whole numbersexport
QueriesTo tal=<whole number>
This parameter enables the user to specify the number of export queries to execute. If you have x export queries and want to execute them all, you must set this parameter value to x.
Optional, used if ac tion=ex port
If not specified, default equals 1 true or false
Example: stack trace=<true or false>
This parameter enables the user to trace all calls.
Optional, if not specified, default equals false
537 2012-12-12
Promotion Management
Parameter
lcmbiarpassword lcmproperty consolelog
Allowed Values Description
Mandatory vs Optional
Free form text
Example: java -jar upgradeManagement
Tool.jar -mode livetobiar biarfile
"C:\TEMP\abc.biar"
-lcmbiarpassword
"testpassword"
.
This parameter enables the encryption and decryption of BIAR files using a password
Optional,if not specified or if the string is empty, implies there is no encryption
The full path of the location where property file has been saved lcm_cli.bat -lcm property <file path of the proper ty file>
This parameter refers to the values required for the execution of a command, which are saved in a file
Mandatory true or false
This parameter is used to display the complete log of the command executed by the user in the command log.
Optional
Note:
• Similar to creation of a job before exporting, the Command Line option creates a temporary job on the fly. This job name could be a combination of Query_<USER>_<Timestamp>. This is specific only to exportQuery.
• The exported LCMBIAR file naming convention can be a combination of <JobName>_<Times tamp>.lcmbiar
for uniqueness when lcmbiar name is not specified in the exportLocation file.
• You can rollback the job only through the promotion management application. There is no command line support to rollback the jobs.
15.5.4 Sample Properties File
The following is a sample properties file:
538 2012-12-12
Promotion Management
Example:
importLocation=C:/Backup/CR.lcmbiar
action=promote
LCM_CMS=<CMS name:port number>
LCM_userName=<username>
LCM_password=<password>
LCM_authentication=<authentication>
LCM_systemID=<ID>
LCM_clientID=<client ID>
Destination_CMS=<CMS name:port number>
Destination_userName=<username>
Destination_password=<password>
Destination_authentication=<authentication>
Destination_systemID=<ID>
Destination_clientID=<client ID> lcmbiarpassword=<password>
Note:
If the properties file does not have any personal information, the LCM CLI will prompt for the same in the console.
15.6 Using the Enhanced Change and Transport System
The Change and Transport System (CTS) organizes and customizes development projects in the ABAP
Workbench, and then transports these changes between SAP Systems in your system landscape. The
Enhanced Change and Transport System(CTS+) is an add-on to the CTS that promotes non ABAP content across CTS+ enabled non-ABAP repositories.
SAP BusinessObjects Business Intelligence platform (BI platform) infoobjects can use SAP Business
Warehouse content as a data source. The integration of CTS+ with the promotion management tool enables the handling of the SAP BusinessObjects Business Intelligence platform repository, in a similar way to the SAP Business Warehouse(BW) repository, by using CTS transport requests to promote jobs. CTS+ provides an option to transport non-SAP objects within a system landscape. For example,
539 2012-12-12
Promotion Management objects created in the development system can be attached to a transport request and forwarded to other systems within the landscape.
For more information about the Change and Transport System, see http://help.sap.com/saphelp_nw70ehp1/helpdata/en/3b/dfba3692dc635ce10000009b38f839/frameset.htm
For more information about CTS+ and non ABAP transports, see http://help.sap.com/saphelp_nw70ehp1/helpdata/en/bb/6fab6036a146baa58e42fac032ab7b/frameset.htm
15.6.1 Pre-requisites
The following are the prerequisites for transporting business intelligence content from system to another through CTS+:
1.
SAP BusinessObjects Business Intelligence platform 4.0 (BI platform) is installed.
2.
SAP Solution Manage 7.1 or SAP Solution Manager 7.0 EHP1 (minimum SP25) is installed and is used as the domain controller for CTS+, at least for the configuration of SAP BusinessObjects systems.
For more information about configuring the transport domain, see http://help.sap.com/saphelp_nw70ehp1/helpdata/en/44/b4a0a77acc11d1899e0000e829fbbd/frame set.htm
3.
CTS plug-in is installed on the SAP Solution Manager (CTS plug-in is taken from SL Toolset 1.0
SP02. We recommend you to use the latest available CTS plug-in).
For more information on installing required CTS plug-in, see the SAP Note: https://ser vice.sap.com/sap/support/notes/1533059
4.
SAP Business Warehouse 7.0 (SPS 24 or higher) systems are installed. For more information, see
SAP note https://service.sap.com/sap/support/notes/1369301
5.
SAP Business Warehouse (SAP BW) transport landscape is configured in the Change and Transport
System (CTS).
15.6.2 Configuring the Business Intelligence Platform and CTS+ Integration
540 2012-12-12
Promotion Management
541
The Transport Management System (TMS) which is part of the Change and Transport System is used to transport changes between the SAP systems within a landscape. It manages the connected systems, their routes, and the imports into its systems. For more information about the Transport Management
System, see http://help.sap.com/saphelp_nw70ehp1/helpda ta/en/44/b4a0137acc11d1899e0000e829fbbd/frameset.htm
CTS+ enables collection of files from outside and their distribution within a transport landscape. The
Transport Organizer Web UI, which is part of CTS+, manages the transport requests and the objects contained by it. For more information, see http://help.sap.com/saphelp_nw70ehp1/helpda ta/en/44/b4a0137acc11d1899e0000e829fbbd/frameset.htm
You can integrate SAP BusinessObjects Business Intelligence platform promotion management with
CTS+ and SAP BW using CTS transport requests.
Note:
To enable the integration of Business Intelligence Platform with SAP Solution Manager, you need to define "BOLM" application type in the SAP Solution Manager landscape.
Perform the following steps to integrate BI platform and CTS+:
1.
Activate the CTS export web service.
2.
Configure CTS settings in the promotion management tool.
3.
Configure the BI platform import system in SAP Solution Manager.
Related Topics
•
Activating CTS Export Web Service
•
Configuring CTS+ Settings in the Promotion Management Tool
•
Configuring the Business Intelligence Platform and CTS+ Integration
15.6.2.1 Activating CTS Export Web Service
2012-12-12
Promotion Management
To configure the BI platform system, you need activate CTS export web service in the SOA Management web tool.
1.
To start the application, enter the transaction code SOAMANAGER in your SAP Solution Manager.
For more information on SOA Management and the configuration of a service endpoint, refer to SAP
Help Portal at: http://help.sap.com/saphelp_nw70ehp1/helpda ta/en/33/06820d9d174c2884576bd78ac5629d/frameset.htm
After the required authentication is done, the SOA Management Console opens in a Web browser.
2.
On the Service Administration tab, choose Single Service Configuration.
The CTS Export Web Service is named as EXPORT_CTS_WS
3.
In the Configuration tab, create or edit the service endpoint.
4.
In the Security tab, configure the transport protocol and authentication method.
5.
In the Transport Settings tab, define alternative access URL for the convenient access of the service endpoint.
542
15.6.2.2 Configuring CTS+ Settings in the Promotion Management Tool
The following section describes the configuration steps to be performed in the CMC application to set up CTS+ for usage with the promotion management tool.
1.
In the "Promotion Jobs" page, click CTS Settings and then click BW Systems.
2.
In the "BW Systems" page, click Add to add a BW system to the landscape.
3.
In the "Add System" page, enter the following details:
• Host BW SID : specify the system ID (SID) of the host SAP BW/ABAP machine.
• Host name: specify the IP address of the host machine.
• System number: enter the system number of the host system.
• Client: refers to the system details of the client machine.
• User and Password: specify the user name and password on the client machine in these fields.
• Language: specify your choice of language in this field.
4.
Click Save to add the system to your landscape.
Note:
Once you've added a BW system to your landscape, you can use the Edit or Delete in the "BW
Systems" page to modify the systems in your landscape.
5.
In the "Promotion Jobs" page, click CTS Settings and then click Web Service Settings.
6.
In the "Web Service Settings" page, enter the Web Service URL and user details.
Note:
If you're not familiar with these details, obtain the same from the Solution Manager administrator.
7.
Click Save and Close to complete adding the web service settings.
8.
Create a mapping file on the BI source system.
2012-12-12
Promotion Management
543
Complete the following steps in the BI platform development system to create a text file with connectivity details to enable the mapping: a.
In the BI platform promotion management CMS, go to the root directory and create a folder with name LCM in the path <SAP BusinessObjects Business Intelligence platform install path>/SAP BusinessObjects Business Intelligence platform 4.0/ b.
Create a text file with name LCM_SOURCE_CMS_SID_MAPPING.properties, and enter either one of the following in the file:
•
<Complete name of the SAP BusinessObjects Business Intelligence platform source
system with domain>@<CMS port number> = <logical name for source system as used
in CTS configuration >
•
<IP number of the SAP BusinessObjects Business Intelligence platform source
system>@<CMS port number> = <logical name for source system as used in CTS
configuration >
For example:
DEWDFTH04171S@6400=WJ3
10.208.112.177@6400=WJ3
DEWDFTH04171S.pgdev.sap.corp@6400=WJ3
Note:
In case of clustered environment, copy LCM_SOURCE_CMS_SID_MAPPING.properties and
LCM_SID_RFC_MAPPING.properties files to the system where Adaptive Processing Server is running.
For more information about performing configuration steps for non-ABAP systems, see http://help.sap.com/saphelp_nw70/helpdata/en/d4/3bab83106941f08ad1f2e1ec14375e/frameset.htm
15.6.2.3 Configuring the Business Intelligence Platform Import System in SAP
Solution Manager
1.
Log on to the SAP Solution Manager system.
2.
Enter transaction stms and press Enter.
3.
Configure BOLM as the application type.
a.
Go to Overview > Systems.
b.
Go to Extras > Application Type > Configure.
c.
Choose New Entries.
d.
In the Application Type field, enter BOLM.
e.
Enter description.
f.
In the Support Details field, enter http://service.sap.com (ACH: BOJ-BIP-DEP) g.
Choose Table View > Save.
2012-12-12
Promotion Management
544 h.
Confirm the prompt by choosing Yes.
4.
To work with different languages, you can maintain translated text as follows: a.
Choose Goto > Translation.
b.
Select the languages into which you want to translate the text.
c.
Enter the translated values in the Description and Support Details fields.
d.
Confirm the dialog box.
e.
Choose Continue.
f.
Choose Table View > Save.
g.
Confirm the prompt.
The TMS domain is now ready to support usage of business intelligence content in CTS.
5.
In CTS+, define the SAP BusinessObjects Business Intelligence platform source system as an export system.
Note:
For more information on creating a non-ABAP system as a source system, see http://help.sap.com/saphelp_nw70ehp1/helpdata/en/bf/e4626214504be18b2f1abeeaf4f8e4/frame set.htm (http://help.sap.com/saphelp_nw70ehp1/helpda ta/en/bf/e4626214504be18b2f1abeeaf4f8e4/frameset.htm)
6.
In CTS+, configure the SAP BusinessObjects Business Intelligence platform import system by completing the following steps:
Note:
You can define a SID as a reference to the SAP BusinessObjects Business Intelligence platform import system.
a.
Create a non-ABAP system as an import system.
For more information, see http://help.sap.com/saphelp_nw70ehp1/helpda ta/en/bf/e4626214504be18b2f1abeeaf4f8e4/frameset.htm
(http://help.sap.com/saphelp_nw70ehp1/helpdata/en/bf/e4626214504be18b2f1abeeaf4f8e4/frame set.htm) b.
Specify the deployment method as Others and deselect all other options.
c.
Choose Save.
d.
Confirm the distribution dialog box.
The table view to configure the import system settings appears.
e.
Choose Edit > New Entries.
f.
In the "Change View CTS: System details for handling of application types" screen, perform the following steps:
1.
In the Deploy Method field, select application specific Deployer (EJB).
2.
In the Deploy URI field, enter the following URI: http://<BOE (http://%3cboe/) web server name>:<Webserver port>/BOE/LCM/CTSServlet?&cmsName=<BOE destination name>:<CMSport>&authType=<BOE authentication type> where,
• "BOE web server name" is the name or IP address of the machine where Business
Intelligence platform web server is running.
• "Web server port" is the port number of Business Intelligence Platform application server.
2012-12-12
Promotion Management
• "BOE destination name" is the name of the machine on which Business Intelligence platform
Central Management Server (CMS) is running.
• "CMS port" is the port number of the CMS.
• "BOE authentication type" is the type of the user authentication for importing business intelligence content. The supported authentication type are secEnterprise, secLDAP, secWinAD, and secSAPR3.
3.
In the User field, enter the Business Intelligence platform user name.
4.
In the Password field, enter the Business Intelligence Platform password.
5.
Choose Save to save the settings.
If you require more than one import system, repeat the steps above to create all destination systems required. To configure transport routes between the source and target system after the creation of the destination systems, see http://help.sap.com/saphelp_nw70ehp1/helpda ta/en/44/b4a1df7acc11d1899e0000e829fbbd/frameset.htm
15.6.3 Promoting a Job Using CTS
This section describes the workflow that the promotion management application supports for promoting
SAP BusinessObjects Business Intelligence platform Central Management Server(CMS) objects from the source system to destination system using the Change Transport System. To use CTS to promote a job, complete the following steps:
1.
Launch the promotion management application using SAP authentication, and create a job.
For more information on creating a new job, see the "Creating a Job" section in the related links below .
Note:
Ensure that you select "SAP" as the authentication type in the source system login screen.
2.
From the Destination drop-down list, select promote via CTS
545 option.
3.
Click Create.
The "Add Objects from the System" screen appears. Here the folders and subfolders are displayed in a tree structure.
4.
Navigate to the folder from which you want to select the infoobject.
2012-12-12
Promotion Management
546
5.
Select the infoobject that you want to add to the job, and click Add.If you want to add an infoobject and exit the "Add Objects" screen, click Add and Close.
The infoobject is appended to the job and the "Promotion Jobs" screen appears.
Note:
On the Promotion Jobs screen you can do the following:
• Use the Add Objects option to add more info objects to the job. For more information, see Adding an Infoobject to a job.
• Use the Manage Dependencies option to manage the dependencies of the info object you have selected. The SAP BW dependencies of the object are displayed on the UI and available for the user to select.
For more information, see Managing Job Dependencies.
6.
Click Promote.
The "Promote" screen appears which displays the ID, owner and a short description of the currently set default transport request.
7.
You can use the Transport Requests hyperlink to do the following:
• View details of the transport request.
• Change settings of the default transport request.
• Choose a different transport request.
• Create a transport request.
a.
Click the Transport Requests hyperlink to open the "Transport Organizer" Web User Interface.
b.
If prompted for logon credentials, log on using valid user credentials for the CTS domain controller system.
c.
Refresh the "Promote" Screen to view your updates.
For more information about using the "Transport Organizer "Web UI, see http://help.sap.com/saphelp_nw70ehp1/helpdata/en/b5/6d03660d3745938cd46d6f5f9cef2e/frame set.htm
8.
To view the details of the dependencies of the SAP BW objects, click the Second level dependencies hyperlink.
Note:
Only the objects that are locked in a request are displayed when you click the Second level
dependencies hyperlink. If the request has been released you can not view any dependencies. In addition, this hyperlink is grayed out if there are no active second level dependencies.
9.
Click Promote.
10.
Close the job.
The promotion management main screen is displayed. The status of the job that you created is now
Exported to CTS.
11.
Release the SAP BusinessObjects Business Intelligence platform object to the destination system by completing the following steps: a.
Click the link displayed in the status column of the job that you want to promote.
The "Promotion Status" window appears.
2012-12-12
Promotion Management
547 b.
Click State of Request.
The "Transport Organizer" Web UI appears.
c.
If the status of the request is Modifiable, click Release to release the transport request of the
SAP BusinessObjects Business Intelligence Platform object . For more information about releasing transport requests containing non-ABAP objects, see http://help.sap.com/saphelp_nw70ehp1/helpdata/en/55/07c497db8140ef8176715d4728eec1/frame set.htm
d.
Close the "Transport Organizer" Web UI.
12.
To view the dependencies for the SAP BW objects, click List of BW dependencies hyperlink.
Note:
We recommend talking to the SAP BW team to get updates on the SAP BW dependencies and their release as these objects are worked on by the team.
13.
Close the "Promotion Status" window.
14.
Import the SAP BusinessObjects Business Intelligence platform object to the destination system by completing the following steps: a.
Log on to the CTS+ domain controller.
b.
Call the STMS transaction to enter the transport management system.
c.
Click on the Import Overview icon.
The "Import Overview" screen appears and you can view the import queue items from all the systems.
d.
Choose the system ID of the destination LCM system.
You can see the list of transport requests that can be imported to the system.
e.
Click Refresh.
f.
Import the relevant transport requests. For more information, see http://help.sap.com/saphelp_nw70ehp1/helpdata/en/44/b4a39e7acc11d1899e0000e829fbbd/frame set.htm
For general information about importing transport requests with BOLM content, see http://help.sap.com/saphelp_nw70ehp1/helpdata/en/09/ca0f3a878f46e9a5a32e666131d2ba/frame set.htm
15.
If the object that you selected has SAP BW dependencies, perform the following steps: a.
Release the SAP BW dependencies to the destination system by completing the following steps:
1.
Log on to the SAP BW source system.
2.
Call SE09 transaction. The "Transport Organizer" screen appears.
3.
Click Display .The SAP BW request is displayed.
4.
Click the SAP BW request and expand it to view the tasks created for the dependencies.
5.
Right click the request associated with the primary SAP BW object and select Release Directly.
Repeat this step to release all the tasks associated to each dependent separately.
6.
Right click on the request associated to the primary BW object and select Release Directly.
7.
Refresh the screen until all the requests are released.
Note:
You can view the logs for a request by double clicking it.
2012-12-12
Promotion Management b.
Import the SAP BW dependencies to the destination system by completing the following steps:
1.
Log on to the SAP BW destination system.
2.
Call the SIMS transaction to enter the transport management system.
3.
Click the Import Overview icon. The "Import Overview" screen appears.
4.
Double-click the system ID for the SAP BW destination. You can see the list of transport requests that can be imported to the system.
5.
Import the relevant transport requests. For more information, see http://help.sap.com/saphelp_nw70ehp1/helpda ta/en/44/b4a39e7acc11d1899e0000e829fbbd/frameset.htm
For more information about Transports with Import Queues, see http://help.sap.com/saphelp_nw70ehp1/helpda ta/en/65/8a99386185c064e10000009b38f8cf/frameset.htm
16.
Log on to the destination system to view the status of the job you promoted.
For information on online documentation for Generic CTS, see http://help.sap.com/saphelp_ct splug100/helpdata/en/52/700dbe608e4752a8e2e96a1876f865/frameset.htm
Related Topics
•
•
Managing Dependencies in promotion management
548 2012-12-12
Visual Difference
Visual Difference
16.1 Visual Difference in the promotion management tool
Visual Difference enables you to view the differences between two versions of a supported file type
(LCM BIAR) or a supported object type (LCM Job) or both. You can use this feature to determine the difference between files or objects to develop and maintain different report types. This feature gives a comparison status between the source and the destination versions. For example, if a previous version of the user report is accurate and the current version is inaccurate, you can compare and analyze the file to evaluate the exact issue.
Following are the three types of visual difference from which you can detect the file or an object:
• Removed - In a report, if an element is missing in one of the file versions, the type of difference is shown as Removed. For example, the element could be a row, section instance, or even a block.
• Modified - In a report, if there is a different value between the source version and the destination version, the type of difference is shown as Modified. For example, the value could be the cell content or the result of a local variable.
• Inserted - In a report, if there is an element in the destination version but is not present in the source version, the type of difference is shown as Inserted.
Following are the object types that support visual difference:
• LCMBIAR
• LCM Job
You can compare the following combinations:
• LCM job with another LCM job
• LCM job with an LCMBIAR file
• LCMBIAR file with another LCMBIAR file
• LCMBIAR file with an LCM job
Preferences
In the visual difference home page, you can set preferences such as product locale, preferred viewing locale, maximum number of objects per page, time zone, and prompt for unsaved data.
Home Page
The visual difference home page consists of the following tabs and panes:
• New Comparison - this tab enables you to create new comparison between objects
• Search Comparisons - this field enables you to search for the already compared objects
549 2012-12-12
Visual Difference
• Comparisons pane - this pane lists the filters and differences tabs
• Comparisons: Differences pane - this pane lists the compared objects with the comparison name,
Date/Time and the status of the differences
16.1.1 Comparing objects or files by using visual difference
The visual difference option enables you to compare the BIAR files and objects.
To compare files using visual difference, complete the following steps:
1.
Log into the CMC application.
2.
In the CMC homepage, under the "Manage" tab, click the Visual Difference link.
The Visual Difference page appears. The compared files are stored in the "Differences" folder, or in any of the user created sub-folder.
Note:
To create a new sub-folder, click the Folder icon.
3.
Click New Comparison.
The "Visual Difference - Comparisons" screen appears.
4.
Select the reference system from the Select System under Reference.
You can connect to any of the following reference systems:
• CMS
• VMS
• Local File System
5.
Click Browse to select the object, or a file from your local system that you want to compare.
6.
Select the target system from the Select System under Target.
You can connect to any of the following reference systems:
• CMS
• VMS
• Local File System
Note:
If you log into the CMS or the VMS, the selected object in the reference system can also be automatically matched with an object having the same name in the reference system.
7.
Click Browse to select the object or a job from your local system that you want to compare.
8.
Click Add.
The objects selected for comparison are added to the shopping cart.
If more than one of pair of objects is added to the shopping cart, the objects can be scheduled for comparison at a later time. However, if the shopping cart contains just one pair of objects, you can compare these objects.
550 2012-12-12
Visual Difference
To compare the files, continue with the next step. To schedule the comparison, see
9.
Click Compare to compare the objects or folders.
Note:
The comparison of LCMBIAR/LCM Job file includes:
• LCMBIAR Metadata: comparison of the job details like name, created by, time and so on.
• Primary Objects: comparison of each of the explicitly selected objects in the LCMBIAR against a similar object in the target LCMBIAR by CUID.
• Dependent Objects: comparison of the selected dependent object in the file against a similar object in the target by CUID.
If the objects other than LCMBIAR or LCM job are selected, the following error message is displayed:
Plugin not found.
The comparison process starts immediately and the differences if any are displayed in the "Visual
Difference viewer". The differences are highlighted in orange color, and the missing objects are highlighted in red color.
You can also use the filter option to view the compared objects by type, and with differences or with common attributes.
10.
Click Save to save the difference report.
11.
Specify the location where you want to save the report, and click OK.
16.1.2 Comparing objects or files in version management system
You can compare the objects or files in a version management system by using the visual difference option.
To compare the objects in a version management system, complete the following steps:
1.
Log on to the CMC application.
2.
In the CMC homepage, under the "Manage" tab, click the Visual Difference link.
The Visual Difference page appears. The compared files are stored in the "Differences" folder, or in any of the user created sub-folder.
Note:
To create a new sub-folder, click the Folder icon.
3.
Click New Comparison.
The "Visual Difference - Comparisons" screen appears.
4.
Select Logon to VMS from Select System under Reference.
5.
Enter the login credentials to the VMS, and click Log On.
The "Visual Difference - Auto Select Target System" dialog box appears
551 2012-12-12
Visual Difference
6.
Click No if you want to set a different target system, or click Yes if you want to set the target system same as the reference system.
7.
Click Browse to select the objects or jobs that you want to compare from both the reference and target systems.
8.
Click Add.
The objects selected for comparison are listed in the New Comparison pane.
You can compare the files immediately, or schedule the comparison for a later point of time. To compare the files, continue with the next step. To schedule the comparison, see
9.
Click Compare to compare the objects or folders.
The comparison process starts immediately and the differences if any are displayed in the "Visual
Difference viewer". The differences are highlighted in orange color, and the missing objects are highlighted in red color.
You can also use the filter option to view the compared objects by type, and with differences or with common attributes.
10.
Click Save to save the difference report.
11.
Specify the location where you want to save the report, and click OK.
16.1.3 Scheduling the comparison
To schedule the comparison of files or objects, complete the following steps:
1.
Click Schedule.
The "Visual Difference -Schedule" window appears.
2.
Select the frequency to schedule the comparison from the Run Comparison list.
3.
Specify the number of retries allowed, and the retry interval in the respective fields.
Note:
You can specify the retry interval only if you specify the number of retries.
4.
Specify the report name, and click Browse to browse for the location in which you want to save the report.
The "Save Job in" window appears.
5.
Select the required folder where you want to save the report, and click OK.
Note:
Depending on the option you select from the Run Comparison list, you must specify the date and time respectively for comparison.
6.
Click Schedule.
552 2012-12-12
Visual Difference
The user can view the comparison object or the difference report in the Visual Difference Viewer at a later point of time. The "Compared Differences" page appears with the list of folders and files or comparison reports.
The Compared Difference page also contains the following options:
• History: The History option enables you to view the history of comparison.
• Rerun: The Rerun option runs the comparison again.
• Schedule: The Schedule option enables you to schedule the comparison.
553 2012-12-12
Visual Difference
554 2012-12-12
Managing Applications
Managing Applications
17.1 Managing applications through the CMC
17.1.1 Overview
The "Applications" management area of the CMC allows you to change the appearance and functionality of web applications such as the CMC and BI launch pad, without doing any programming. You can also modify access to applications for users, groups, and administrators by changing the rights associated with each one.
In this section, you'll find contextual information, procedures, and instructions on how to manage various settings. The following applications have settings that can be modified through the CMC:
• Analysis edition for OLAP
• Alerting Application
• BI launch pad
• BI workspaces
• Central Management Console
• Crystal Reports Configuration
• Dashboards
• Discussions
• Information Designer
• Web Intelligence
• Promotion Management
• Monitoring Application
• Open Document
• Platform Search Application
• Report Conversion Tool
• SAP BusinessObjects Mobile
• SAP StreamWork
• Translation management tool
• Universe design tool
• Upgrade management tool
555 2012-12-12
Managing Applications
• Visual Difference
• Web Service
• Widgets
17.1.2 Common settings for applications
556
17.1.2.1 Setting user rights on applications
You can use rights to control user access to certain features of applications. The "Applications" area in the CMC lets you assign principals to the access control list for an application, view the rights that a principal has, and modify the rights that the principal has to an application. For more information about rights administration, see the SAP BusinessObjects Business Intelligence Platform Administrator Guide.
17.1.2.2 To set the web application trace log level in the CMC
By default the trace log level for web applications in the CMC is set to "Unspecified". Trace log settings are available for the following applications in the CMC:
• Central Management Console
• BI launch pad
• Open Document
• Web Service
• Promotion Management
• Version Management
• Visual Difference
To trace all other web applications, use the manual method to configure the corresponding BO_trace file.
1.
Go to the "Applications" management area of the CMC.
The "Applications" dialog box appears.
2.
Right-click the application and select Trace Log Settings.
The "Trace Log Settings" dialog box appears.
3.
Select the desired setting from the Log Level list.
4.
Click Save & Close to submit the trace log level.
2012-12-12
Managing Applications
The new trace log level will be in effect after the next logon to the web application.
Related Topics
•
17.1.2.2.1 Trace log levels
The following table describes the available trace log levels for BI platform components:
Level
Unspecified
None
Low
Medium
High
Description
The trace log level is specified through another mechanism, usually an .ini file.
When the trace log level is set to "None", the filter to optionally suppress traces below a specified importance level is deactivated.
Note:
A "None" trace log level does not mean that the tracing feature is turned off.
System resources continue to be monitored and traces will be logged for rare critical events such as failed assertions.
The trace log filter is set to allow for logging error messages while ignoring warning and most status messages. However, very important status messages will be logged for component startup, shutdown, as well as the start and end request messages.
Note:
This level is not recommended for debugging purposes.
The trace log filter is set to include error, warning, and most status messages in the log output. Status messages that are least important or highly verbose will be filtered out. This level is not verbose enough for debugging purposes.
No messages will be excluded by the filter. This level is recommended for debugging purposes.
Note:
A "High" trace log level could affect system resources. It could potentially increase
CPU usage as well as storage space in the file system.
17.1.3 Application-specific settings
557 2012-12-12
Managing Applications
558
17.1.3.1 Managing CMC application settings
17.1.3.1.1 Authentication and program objects
Be aware of the potential security risks associated with adding program objects to the repository. The level of file permissions for the account under which a program object runs will determine what modifications, if any, the program can make to files.
You can control the types of program objects users can run, and you can configure the credentials required to run program objects.
Enabling or disabling a type of program object
As a first level of security, you can configure the types of program objects available for use.
Authentication on all platforms
In the "Folders" management area of CMC, you must specify credentials for the account under which the program runs. This feature allows you to set up a specific user account for the program, and assign it appropriate rights, to have the program object run under that account.
Alternatively, users who add program objects to BI platform can assign their own credentials to a program object and give the program access to the system. Thus, the program will run under that user account, and the rights of the program will be limited to those of the user. If you choose not to specify a user account for a program object, it runs under the default system account, which generally has rights locally but not across the network.
Note:
By default, when you schedule a program object, the job fails if credentials are not specified. To provide default credentials, select Central Management Console in the "Applications" management area. On the Actions menu, click Program Object Rights. Click Schedule with the following operating system
credentials and enter a default user name and password.
Authentication for Java programs
BI platform allows you to set security for all program objects. For Java programs, BI platform forces the use of a Java Policy File, which has a default setting that is consistent with the Java default for unsecured code. Use the Java Policy Tool (available with the Java Development Kit) to modify the Java Policy
File, to suit your specific needs.
The Java Policy Tool has two code base entries. The first entry points to the BI platform Java SDK and allows program objects full rights to all BI platform .jar files. The second code base entry applies to all local files. It uses the same security settings for unsecured code as the Java default for unsecured code.
Note:
• The settings for the Java Policy are universal for all Adaptive Job Servers running on the same computer.
2012-12-12
Managing Applications
559
• By default, the Java Policy File is installed to the Java SDK directory in the BI platform install root directory. For example, a typical location on Windows is C:\Program Files\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\conf\crystal-program.policy
.
To enable or disable a type of program object
1.
In the "Applications" area, select Central Management Console.
2.
Click Actions > Program Object Rights.
The "Program Object Rights" dialog box appears.
3.
In the "Allow users to" area, select the types of program objects that you want users to be able to run.
You can select Run scripts/binaries or Run java programs.
If you selected Run java programs, you can select or clear the Use impersonation check box.
This option provides the Java program a token with which to log on to the Business Intelligence
Platform.
4.
Click Save & Close.
17.1.3.1.2 Registering processing extensions with the system
Note:
This feature does not apply to Web Intelligence documents.
Before you can apply your processing extensions to particular objects, you must make your library of code available to each machine that will process the relevant schedule or view requests. Installing BI platform creates a default directory for your processing extensions on each Job Server, Processing
Server, and Report Application Server (RAS). It is recommended that you copy your processing extensions to the default directory on each server. On Windows, the default directory is C:\Program
Files\SAP Business Objects\SAP BusinessObjects Enterprise XI
4.0\win32_x86\ProcessExt
. On UNIX, it is the sap_bobj/ProcessExt directory.
Tip:
It is possible to share a processing extension file.
Depending upon the functionality that you have written into the extension, copy the library onto the following machines:
• If your processing extension intercepts schedule requests only, copy your library onto each machine that is running as an Adaptive Job Server.
• If your processing extension intercepts view requests only, copy your library onto each machine that is running as a Crystal Reports Processing Server or RAS.
• If your processing extension intercepts schedule and view requests, copy your library onto each machine that is running as an Adaptive Job Server, Crystal Reports Processing Server, or RAS.
Note:
If the processing extension is required only for schedule/view requests made to a particular server group, you need only copy the library onto each processing server in the group.
2012-12-12
Managing Applications
560
To register a processing extension
1.
Go to the "Applications" management area of CMC.
2.
Select Central Management Console.
3.
Click Actions > Processing Extensions.
The "Processing Extensions: CMC" dialog box appears.
4.
In the Name field, enter a display name for your processing extension.
5.
In the Location field, type the file name of your processing extension along with any additional path information.
• If you copied your processing extension into the default directory on each of the appropriate machines, type only the file name (not the file extension).
• If you copied your processing extension to a subfolder below the default directory, type the location as subfolder/file_name.
6.
Use the Description field to add information about your processing extension.
7.
Click Add.
Tip:
To delete a processing extension, select it from the Existing Extensions list and click Delete. (Make sure that no recurring jobs are based on this processing extension because any future jobs based on this processing extension will fail.)
8.
Click Save & Close.
The processing extension is registered with CMC.
You can select this processing extension to apply its logic to objects.
Sharing processing extensions between multiple servers
Note:
This feature does not apply to Web Intelligence documents or reports created in SAP Crystal Reports for Enterprise.
If you want to put all processing extensions in a single location, you can override the default processing extensions directory for each Adaptive Job Server, Crystal Reports Processing Server, and RAS. First, copy your processing extensions to a shared directory on a network drive that is accessible to all of the servers. Map (or mount) the network drive from each server's machine.
Note:
Mapped drives on Windows are valid only until you reboot the machine.
If you are running servers on both Windows and on UNIX, you must copy a .dll and an .so version of every processing extension into the shared directory. In addition, the shared network drive must be visible to Windows and to UNIX machines (through Samba or some other file-sharing system).
Finally, change each server's command line to modify the default processing extensions directory. Do this by adding -report_ProcessExtPath absolute path to the command line. Replace absolute
path
with the path to the new folder, using whichever path convention is appropriate for the operating
2012-12-12
Managing Applications
561 system that the server is running on (for example, M:\code\extensions,
/home/shared/code/extensions
, and so on).
To modify the default processing extensions directory, use the CMC to stop the server. Then open the server's Properties to modify the command line. Start the server again when you have finished.
17.1.3.1.3 Managing CMC tab access
Delegated administration and CMC tab access
Typically, a Business Intelligence platform system administrator manages a large number of documents, folders, users, servers, and other objects. However, large corporate environments may exceed the resources of a single administrator. A system administrator who wants to focus only on high-priority tasks can create delegated administrators and assign subsets of management tasks to them (for example, the administration of a department or tenant content). Unlike system administrators, delegated administrators perform a limited set of tasks and have fewer rights on objects in the system.
The default configuration of the Central Management Console allows users to access all available CMC tabs. The system administrator can manage CMC tab access to control which tabs are visible to principals
(users or user groups). To improve the user experience and workflow of the delegated administrator, a system administrator may also hide any of the CMC tabs that a delegated administrator is not expected to use.
Caution:
Management of CMC tab access affects only the visual appearance of the CMC user interface. Hiding
CMC tabs is not a security measure, because it does not set or modify security rights on objects within tabs. To ensure that users cannot perform unauthorized operations on unauthorized objects (for example, manage servers through the Central Configuration Manager or third-party software based on the BI platform SDK), you must set appropriate security rights on objects (such as server objects).
Related Topics
•
To manage CMC tab access for other users
•
To manage permission to configure CMC tab access for other users or user groups
Working with CMC tab access
To manage CMC tab access for other users
A system administrator always has access to all CMC tabs. Use the following guidelines to administer the CMC tabs that principals can access:
• For a simplified management process and a reduced need for maintenance and troubleshooting, it is recommended that administrators manage CMC tab access on a user group level (instead of on a user level).
• For CMC tabs that have top-level folders, an administrator must grant access to a tab and grant the
View right on the top-level folder of the tab. The following CMC tabs support top-level folders: Access
Levels, Calendars, Categories, (Universe) Connections, Cryptographic Keys, Events,
Federations, Folders, Inboxes, OLAP Connection, Personal Categories, Personal Folders,
2012-12-12
Managing Applications
562
Profiles, Replication Lists, Servers, Temporary Storage, Universes, Users and Groups, and
Web Service Query.
• For improved system security, only users who have both membership in the Administrators group and have CMC tab access granted should be able to access the following CMC tabs: Auditing,
Authentications, Cryptographic Keys, License Keys, Monitoring, Sessions, Settings, and User
Attribute Management.
Caution:
Management of CMC tab access affects only the visual appearance of the CMC user interface. Hiding
CMC tabs is not a security measure, because it does not set or modify security rights on objects within tabs. To ensure that users cannot perform unauthorized operations on unauthorized objects (for example, manage servers through the Central Configuration Manager or third-party software based on the BI platform SDK), you must set appropriate security rights on objects (such as server objects).
1.
Log on to the CMC.
2.
On the "Users and Groups" tab, right-click a principal and select CMC Tab Configuration.
Note:
If CMC tab access is unrestricted, the following message will be displayed:
WARNING: CMC tab access is unrestricted. Settings below do not take effect until CMC tab access will be restricted. To restrict CMC access navigate to Applications tab, select CMC and set CMC tab access to restricted.
You can still configure CMC tab access. However, the configuration will not take effect until you restrict CMC tab access.
In the "Configure CMC Tab Access" dialog box, a table is displayed:
• ✔ or ✘ indicates which CMC tabs the principal can access.
• "Inherited" indicates that the tab access was inherited from its parent user group(s).
• "Explicit" indicates that the tab access was explicitly specified on the principal level.
3.
Review the CMC tab access rights. To modify the rights, you can use the buttons on the toolbar:
• Click Grant to explicitly grant access to a tab.
• Click Deny to explicitly deny access to a tab.
• Click Inherit to use an inherited access right.
Note:
Clicking the buttons applies changes to the principal immediately.
4.
When you are finished, click Close.
The new effective tab access is displayed in the "Permission" column of the table.
Related Topics
•
Inheritance of CMC tab access
CMC tab access rights and the permission to configure CMC tab access for other users or user groups are both applied and inherited in the same way as other BI platform security rights. If principals have
2012-12-12
Managing Applications no tab access explicitly specified, they will inherit the tab access of the user groups they are members of.
If a user is a member of two user groups, tab access is calculated in the same manner as all other
Business Intelligence platform rights are calculated. For example, if access to a CMC tab is granted in one of the groups and denied in the other, the principal will not be able to access the CMC tab.
Note:
• Modifying the CMC tab access right of a user group changes the same tab access for all users or user groups that inherit rights from the user group, if their CMC tab access is set to Inherited.
• Tab access set on the user level always supersedes tab access inherited from user groups.
Delegated administrator user groups
You can create a set of delegated administrator user groups to simplify CMC tab management. To avoid configuring individual CMC tab access, you can make an existing user or user group a member of a delegated administrator user group. The following configuration is recommended, but it can be modified for specific business needs.
Note:
Membership in multiple groups will result in the addition of rights, if the rights are set to Inherited.
Delegated Administrator
User Group Recommended Rights
System Administrators
User Administrators
Grant access to all tabs.
Grant access to Access Levels, Folders, Inboxes, Personal Folders,
Personal Categories, Query Results, Sessions, and User and Groups.
Set all other tabs to Inherited.
Content Administrators
Server Administrators
Grant access to Calendars, Categories, Events, Folders, Instance Man-
ager, Personal Categories, Personal Folders, Profiles, Query Results, and Universes. Set all other tabs to Inherited.
Grant access to Servers and Applications. Set all other tabs to Inherited.
To restrict CMC tab access
It is recommended that you first configure CMC tab access for principals, and then restrict CMC tab access. If you restrict tab access before configuring it, your users will not be able to access any CMC tabs until an administrator grants them access.
To ensure consistency with previous versions of the Business Intelligence platform, CMC tab access is initially unrestricted after the BI platform is installed, and any user who can access the CMC is able to access all available tabs. To prevent users from accessing tabs to which they have no access rights, a system administrator can restrict CMC tab access.
563 2012-12-12
Managing Applications
564
You can remove CMC tab access restriction in an urgent case, or to troubleshoot CMC tab access configuration (for example, if a delegated administrator cannot access an essential CMC tab).
1.
Log onto the CMC.
2.
On the "Applications" tab, right-click Central Management Console and select CMC Tab Access
Configuration.
The "CMC Tab Access" dialog box is displayed.
3.
Configure the CMC tab access rule.
• To limit your users to access to tabs for which they have rights, select Restricted.
• To allow your users to access all tabs, select Unrestricted.
4.
When you are finished, click Save and Close.
The CMC tab access rule is applied to the system.
Related Topics
•
To troubleshoot CMC tab access
To manage permission to configure CMC tab access for other users or user groups
In a large corporate environment, a system administrator may need to delegate CMC tab access management to a delegated administrator. Alternatively, in a multitenant system each tenant may have a delegated administrator responsible for managing CMC tab access for other users and user groups.
1.
Log onto the CMC.
2.
On the "Users and Groups" tab, right-click a principal and select CMC Tab Configuration.
In the "Configure CMC Tab Access" dialog box, the Permission to configure CMC tab access for
other users or user groups is displayed for the principal.
Note:
If this permission is granted, the principal will be able to manage CMC tab access (only for tabs that the principal has access to) for users on which the principal has the "Securely Modify Rights" right.
In addition, the principal will be able to further delegate CMC tab access management to other users by granting the Permission to configure CMC tab access for other users or user groups to users on which the principal has the "Securely Modify Rights" right.
• ✔ or ✘ indicates whether the principal has permission to configure CMC tabs for other users or user groups.
• "Inherited" indicates that the permission was inherited from its parent user group(s).
• "Explicit" indicates that the permission was explicitly specified on the principal level.
3.
Review the permissions to configure CMC tab access for other users or user groups. To modify the permissions, you can select one of the following settings from the list:
• Click Grant to explicitly grant permission to manage CMC tab access for other users or user groups.
• Click Deny to explicitly deny permission to manage CMC tab access for other users or user groups.
• Click Inherit to inherit permission to managed CMC tab access for other users or groups.
2012-12-12
Managing Applications
Note:
Selecting a setting from the list changes the permission of the principal immediately.
4.
When you are finished, click Close.
The new effective permission is displayed.
Related Topics
•
Delegated administration and CMC tab access
•
To troubleshoot CMC tab access
To prevent unauthorized access, or to troubleshoot a user's limited access to CMC tabs, you can troubleshoot a user's CMC tab access rights.
1.
Log onto the CMC as a system administrator.
Note:
Ensure you have access to the tab that you want to troubleshoot, and that you have the "Securely
Modify Rights" right on the user.
2.
On the "Users and Groups" tab, right-click a principal and select CMC Tab Configuration.
The "Configure CMC Tab Access" window is displayed.
3.
Review the effective CMC tab access. You can explicitly grant or deny access to available tabs.
If the CMC tab access is inherited, but the effective tab access does not match the user's needs: a.
Compile a list of all user groups that the selected principal is a member of.
b.
Repeat steps 1-3 for every group that the user inherits tab access from.
c.
Correct CMC tab access on the principal level or under the group level as needed.
Note:
Performing this task on the group level affects CMC tab access for all users who are members of this user group, and all users who are members of user groups inherited from this user group, as long as the users have CMC tab access set to Inherited.
4.
When you are finished, click Close.
Related Topics
•
To manage CMC tab access for other users
•
17.1.3.2 Managing discussion settings
565 2012-12-12
Managing Applications
In the "Applications" area of the CMC in BI platform, you can specify system-level settings for discussion threads.
For the "Discussions" application you can manage and interact with discussion threads in several ways, including:
• Searching for discussion threads according to specified search criteria.
• Sorting discussion thread search results.
• Deleting discussion threads.
Note:
User rights settings are not available for the Discussions application. However, you can set rights on individual reports.
17.1.3.2.1 To search for a discussion thread
By default, the "Discussions" page displays the titles of all discussion threads. Only the root level threads are displayed.
To page through the list of discussion threads, use the Previous and Next buttons. You can also search for a specific thread or group of threads.
1.
Go to the "Applications" area of the CMC and select Discussions.
2.
Click Manage > Manage Threads.
The "Notes Administration" dialog box appears.
3.
In the Field name list, select an option.
Option
Thread title
Creation date
Last modified date
Author
Description
Searches by thread title
Searches by creation date
Searches by the last date modified
Searches by author
4.
On the second list, refine your search.
Note:
Searches are not case-sensitive.
• If you chose Thread title or Author, choose from the following options in the second field.
566 2012-12-12
Managing Applications
Option is is not contains
Description
Searches for discussion threads where the thread title, or the author name, exactly match the text you type into the third field
Searches for discussion threads where the thread title, or the author name, do not exactly match the text that you type into the third field
Searches for discussion threads that contain the search text string within any part of the thread title or the author's name
does not contain
Searches for discussion threads that do not contain the text string within any part of the thread title
• If you chose Creation date or Last modified date, choose one of the following options, and then specify a search date.
Option before after between
Description
Searches for discussion threads that were created or modified before the search date
Searches for discussion threads that were created or modified after the search date
Searches for discussion threads that were created or modified between the two search dates
5.
To further refine your search, use the third text field.
• If you selected a text-based search in the first two fields, type in the text string.
• If you chose a date-based search, enter the date or dates in the appropriate fields.
6.
Click Search.
17.1.3.2.2 To sort your discussion thread search results
When you search discussion threads, you can select how you want your search results to display. For example, you can sort them in ascending alphabetical order, and choose the number of results to display per page.
1.
Go to the "Applications" area of the CMC and select Discussions.
2.
Click Manage > Properties.
The "Notes Administration" dialog box appears.
3.
In the Sort by list, select a sort option.
567 2012-12-12
Managing Applications
568
Option
Thread title
Description
Sort by the title of a discussion thread.
Creation date
Sort by the date the discussion thread was created.
Last modified date
Sort based on the date a discussion thread was last modified.
Author
Sort by the author of a specific discussion thread.
4.
In the second list, select if you want the records to be displayed in ascending or descending order.
5.
In the third text field, enter how many discussion thread results you want displayed on each page.
The default is 10 results per page.
6.
Click Search.
17.1.3.2.3 To delete a discussion thread
You can delete any discussion thread in the "Applications" area of the CMC in BI platform.
1.
Go to the "Applications" area of the CMC and select Discussions.
2.
Click Manage > Manage Threads.
The "Notes Administration" dialog box appears.
3.
In the results list, search for the discussion thread you want to delete and select it.
4.
Click Delete.
17.1.3.3 Managing BI launch pad settings
In the "Applications" area of the CMC in BI platform, you can change the display options of BI launch pad by going to Manage > Properties.
For BI launch pad, you can grant users or groups the following abilities:
• Change preferences
• Organize folders
• Search
• Filter object listings by object type
• View the Favorites folder
For example, if you created your user folders using a standard naming convention, you may want to deny your users the ability to organize their own folders.
2012-12-12
Managing Applications
Note:
By default, all users have access to these features.
17.1.3.3.1 To change display settings for BI launch pad
1.
Go to the "Applications" area of the CMC and select BI launch pad.
2.
Click Manage > Properties.
The "BI launch pad Properties" dialog box appears.
3.
To enable Discussions for BI launch pad users, select Enable Discussions.
4.
To enable the filters functionality for scheduling, select Show "Filters" tab on the Schedule page.
This setting controls whether users can enter record or group selection formulas when they schedule a Crystal report.
5.
Click Save & Close.
569
17.1.3.4 Managing Web Intelligence settings
You can control which features your users have access to for Web Intelligence documents by setting properties for the Web Intelligence application.
17.1.3.4.1 To modify display settings for Web Intelligence
1.
Go to the "Applications" area of the CMC and select Web Intelligence.
2.
Click Manage > Properties.
The "Properties" dialog box appears.
3.
Define any of the following display options.
Option
"Dimensions and details"
Description
Use the options in this area to define how added data appears in reports; change the font style, text color, and background color. A cell preview automatically shows your changes. Click OK when you are finished.
"Fluctuating values (numerical measures)"
Use the options in this area to modify and format the page heading; change the font style, text color, and background color. A cell preview automatically shows your changes. Click OK when you are finished.
"Embedded image properties" Enter the maximum embedded image size.
"Quick display mode properties"
In the appropriate fields, enter the maximum vertical records, maximum horizontal records, minimum width of page, minimum height of page, right padding value, and bottom padding value.
4.
Click Save & Close.
2012-12-12
Managing Applications
Note:
To revert your selection to the default display variables, click Reset.
17.1.3.5 Managing Alerting settings
In the "Applications" area of the CMC in BI platform, you can specify system-level settings for alerts.
For the "Alerting" application you can control and define how system users access alerts by:
• Enabling the My Alerts folder for alert subscribers
• Enabling and formatting alert messages sent through email
• Setting a limit for the number of alerts in the system
• Setting an expiry period for alert messages
Related Topics
•
Setting user rights on applications
•
17.1.3.5.1 To modify Alerting destination properties
1.
Go to the "Applications" area of the CMC and select Alerting Application.
2.
Click Manage > Properties.
The "Alerting" dialog box appears.
3.
Set the appropriate options.
Option Description
"Enable My Alerts" Select this option to allow alert subscribers to receive notifications in the "My
Alerts" section of BI launch pad.
"Enable Email" Select this option to allow alert subscribers to receive notifications through email. When you select this option, the global Email settings for alerts are displayed.
Note:
You must specify one or both of the above destination options.
If you have selected "Enable Email", you can modify the following global settings:
570 2012-12-12
Managing Applications
Option
"From"
"To"
Description
Specifies the email address that the alert notifications are sent from. Subscribers will receive alert emails from the specified sender. It is recommended that you use a valid email address recognized by your system.
Specifies the email address of the alert subscriber.
Tip:
It is recommended that you keep the %SI_EMAIL_ADDRESS% placeholder for this setting. If you specify a specific email address or recipient, by default all system alerts will be sent to the specified email address.
"cc"
"Subject"
"Message"
Specifies which recipient(s) should receive carbon copies of alerts sent through email.
Specifies the default subject heading used in emails containing system alerts.
Specifies the default message to include in emails containing system alerts.
"Add Attachment" Select this option to enable attachments to be included by default in emails containing system alerts. This option is typically used to include by default
Crystal Reports associated with triggered alerts.
"File Name" If you have selected the Add Attachment option, specify how attachments are named in emails by selecting either Automatically Generated or Specific
Name.
4.
Click Save & Close.
Related Topics
•
Setting user rights on applications
•
17.1.3.5.2 To modify Alerting default properties
1.
Go to the "Applications" area of the CMC, and select Alerting Application.
2.
Click Manage > Properties.
The "Properties" page appears.
3.
Click Default Settings.
4.
Set values for the following properties:
571 2012-12-12
Managing Applications
Option
Expiry Period
Description
Specifies how long alert messages will be maintained in the system before they are deleted
Maximum Number of
Alert Messages
Specifies the maximum number of alert messages supported by the system.
When the threshold is reached, the system will remove 20% of the alert messages, starting with the oldest messages.
5.
Click Save & Close.
Related Topics
•
Managing security settings for objects in the CMC
•
17.1.3.6 Managing widgets settings
Widgets for SAP BusinessObjects is a desktop application that allows users to add mini-applications to their desktop for easy access to business intelligence content on BI platform and Web Dynpro applications on SAP NetWeaver Application Servers.
From the "Applications" area of the CMC, you can control user access to create and use widgets on their desktops, as well as their ability to search the BI platform repository from within the widgets application on their desktop.
You can grant users or groups the ability to:
• Use widgets
• Edit objects created by widgets
• Modify user rights to access objects
Note:
By default, all general users have access to these features.
Related Topics
•
Managing security settings for objects in the CMC
572 2012-12-12
Managing Applications
573
17.1.3.7 Managing SAP BusinessObjects Explorer settings
You can define which features your users have access to for SAP BusinessObjects Explorer by settings its security rights from the Applications area of the CMC.
Related Topics
•
Managing security settings for objects in the CMC
17.1.3.7.1 To modify SAP BusinessObjects Explorer application properties
1.
Go to the "Applications" area of the CMC.
2.
Click Manage > Properties.
The "Properties" dialog box appears.
3.
Define any of the following SAP BusinessObjects Explorer settings:
• Default index folder location
• Number of threads
• Bookmark validity
4.
Click Save & Close.
17.1.3.8 Managing Platform Search settings
In the "Applications" area of the CMC in BI platform, you can specify system-level settings for the
Platform Search application.
Related Topics
•
Configuring Application Properties in CMC
17.1.3.8.1 Configuring Application Properties in CMC
To configure the Platform Search application properties, complete the following steps:
1.
Go to the "Applications" area of the CMC.
2.
Select Platform Search Application.
3.
Click Manage > Properties. The "Platform Search Application Properties" dialog box appears.
4.
Configure the Platform Search settings that you want.
The configurable properties are described in the following table:
2012-12-12
Managing Applications
Option
Search Statistics
Description
Platform Search offers the following search statistics:
• Indexing Status: displays the status of the indexing process.
• Number of indexed documents: displays the number of documents that are indexed.
• Last indexed time stamp: displays the time stamp at which the document was last indexed.
Stop / Start Indexing
Start or Stop Indexing options enable you to start or stop the indexing process when you want to switch from continuous crawling to schedule crawling, or for maintenance purpose.
To stop indexing, click Stop Indexing and then click OK in the confirmation dialog box.
Default Index Locale
Platform Search uses the locale specified in CMC page for indexing all the default BI documents. Once the document is localized the corresponding language analyzer is used for indexing.
Search is based on the Client 's product Locale and the weightage is given to client product locale.
You can configure the weightage in CMC configuration properties.
574 2012-12-12
Managing Applications
Option
Crawling Frequency
Description
You can index the entire SAP BusinessObjects BI platform repository by using the following options:
• Continuous crawling: With this option, indexing is continuous where the repository is indexed whenever an object is added, modified, or deleted. It allows you to view or work with the most up-to-date BI platform content. Set by default, the continuous crawling updates the
SAP BusinessObjects BI platform repository continuously with the actions that you perform. Continuous crawling works without a user's intervention and reduces the time taken for indexing a document.
• Scheduled crawling: With this option, indexing is based on the schedule set by the Schedule options.
For more information about scheduling an object, refer to Scheduling an Object section of Platform Search in the SAP BusinessObjects
Business Intelligence platform CMC Online Help.
Note:
• If you select Schedule Crawling and set the Recurrence to an option other than Now Platform Search displays the date and time stamp when the document is scheduled to be indexed next.
• If you select Schedule Crawling, then the Start Indexing button is enabled and Stop Indexing button is disabled.
• Once the scheduling is complete, the Stop Indexing button is disabled.
575 2012-12-12
Managing Applications
Option
Index Location
Description
When the documents are indexed, they are stored in shared folders in the following locations:
• Master index location (indexes and speller): The master and speller indexes stored in this location. During a search workflow, the initial hits are retrieved using the Master Index and the speller indexes are used to retrieve suggestions. In a clustered BI platform deployment, this location should be on a shared file system that is accessible from all nodes in the cluster.
• Persistent data location (Content stores): The content store is placed in this location. It is created from the master index location and re mains in sync with it. The content store is used to generate facets and process the initial hits generated from the Master Index location.
In a clustered SAP BusinessObjects BI platform deployment, content stores are generated at every node.
The persistent data location is the only index location that is affected by the clustered environment as it contains the content store folders.
If a machine has a single search service, then there will be only one content store location. For example, {bobj.enterprise.home}\data\Plat formSearchData\workspace\Server\ContentStores.
However, in a clustered environment, if there are multiple search services, then each search service will have one content store loca tion. For example, if you have two instances of a server running, then the content store locations would be as follows:
a.
{bobj.enterprise.home}\data\PlatformSearchData\workspace\Serv er\ContentStores.
b.
{bobj.enterprise.home}\data\PlatformSearchData\workspace\Serv er1\ContentStores.
• Non-persistent data location (Temporary files, Delta Indexes): In this location, the delta indexes are created and stored temporarily before being merged with the Master index. The indexed documents from this location are deleted once they are merged with the Master Index.
In addition, surrogate files (output of the extractors) are created in this location and stored temporarily until they are converted into delta indexes.
Note:
• All the index locations must be shared locations.
• You need to click Stop Indexing to modify the index location.
• If you modify an index location, you need to copy the content to a new location, else the existing index information will be lost.
576 2012-12-12
Managing Applications
577
Option
Level of indexing
Content Types
Rebuild index
Description
You can tune the search content by setting the level of indexing in the following ways:
• Platform Metadata: An index is created only for the platform metadata information such as titles, keywords, and descriptions of the documents.
• Platform and Document Metadata: This index includes the platform metadata as well as the document metadata. The document metadata includes the creation date, modification date, and name of the author.
• Full Content: This index includes the platform metadata, document metadata, and other content such as:
• The actual content in the document
• The content of prompts and LOVs
• Charts, graphs, and labels
Note:
When you modify the level of indexing, the indexing is initialized for the entire SAP BusinessObjects BI platform repository refresh.
You can select the following content types for indexing:
• Microsoft Word
• Microsoft Excel
• Microsoft PowerPoint
• Text
• Adobe Acrobat
• Rich Text
• Crystal Reports
• Universe
• Web Intelligence
This option deletes all the existing indexed content and re-indexes the entire document from the start.
You can select the Rebuild index option irrespective of the indexing status. However, the Rebuild index option would not function if indexing is stopped, and you select the Rebuild index, save and close the Platform Search application.
When indexing is stopped, and you select the Rebuild index, save and close the Platform Search application, then re-open the configuration page and click Start Indexing, the stored rebuild index would re-index the entire document automatically.
If you do not want Platform Search to re-index the documents, you need to deselect the Rebuild index before clicking Start Indexing.
2012-12-12
Managing Applications
Option Description
Documents Excluded from Indexing
The Documents Excluded from Indexing option excludes documents from indexing. For example, you may not want extremely large Crystal reports to be made searchable to ensure the report application server resources are not overloaded. Similarly, you may not want publications with hundreds of personalized reports to be indexed.
By excluding particular documents, you can prevent them from being accessed by Platform Search. It is important to note that if a document is already indexed before it is put into this group, the document may still be searchable. To ensure that documents in the Documents Excluded
from Indexing group are not searchable, you must rebuild the index.
By default only the Administrator account has full control of the Docu-
ments Excluded from Indexing. Other users with the following rights can only add documents to the Documents Excluded from Indexing group:
• View and edit rights on the category
• Edit the document directly
5.
Click Save & Close.
Note:
If a user does not select the Rebuild Index option and changes the level of indexing or selects or deselects extractors, then the index is incrementally updated from the start without deleting the existing index.
17.1.3.9 Managing SAP StreamWork integration
In the "Applications" area of the CMC in BI platform, you can enable and configure integration details for the SAP StreamWork application. Additional configuration is required in the SAP StreamWork enterprise agent. For more information, see Integrating SAP StreamWork with SAP BusinessObjects
Business Intelligence Platform.
Once the application is properly configured, SAP StreamWork feeds will be available in BI launch pad.
17.1.3.9.1 SAP StreamWork Integration Configuration settings
The table below summarizes the settings available in the CMC for configuring the SAP StreamWork
Integration application.
578 2012-12-12
Managing Applications
Setting
"Enable
StreamWork
Integration"
Description
Check this box to enable the SAP StreamWork Integration application.
"Unique
Identity
Provider ID"
Enter a value to use for your BI platform deployment. This value will be associated with the certificate used to configure integration on the SAP StreamWork administration console.
Note:
The application asserting an identity for single sign-on must be configured as an administrative OAuth application.
"Identity
Provider
Base64 Certificate"
When you click Generate, a certificate is created in the Identity Provider Base64
Certificate field. Use this certificate in the SAP StreamWork administration console to generate an OAuth Consumer Key. This certificate establishes the trust relationship between SAP StreamWork and BI platform. The external identity provider itself is identified with an X509 certificate, which is used to sign all identity assertions. The certificate must be Base64 encoded.
"OAuth Consumer Key"
Use this field to enter a valid OAuth Consumer Key generated from the SAP
StreamWork administration console.
Note:
For information about creating a consumer key, see
Integrating SAP StreamWork with SAP BusinessObjects Business Intelligence Platform.
579 2012-12-12
Managing Applications
Setting Description
Check this box to enable connection through a proxy. You must provide specific information about your proxy host in the HTTP Proxy Host and Port fields.
Tip:
To allow inbound connections from the SAP StreamWork servers to your corporate network, you need to have a reverse proxy in the DMZ.
Note:
To add a trusted certificate from an SSL certificate provider to your reverse proxy, you need to have a domain or sub-domain name for your reverse proxy.
"Connecting using proxy"
"HTTP Proxy
Host"
In your reverse proxy configuration, you need to include an external address that is accessible by SAP StreamWork. For example, you could use the following address: https://ReverseProxy/
Where ReverseProxy is the domain or sub-domain name of your reverse proxy.
SAP StreamWork uses this address to send information to BI platform.
The reverse proxy uses this address to redirect information received from SAP StreamWork to the machine containing the SAP Stream-
Work enterprise agent.
"Port"
The SAP StreamWork enterprise agent is configured to listen from port 8443.
580
17.1.3.10 Configuring BEx Web Integration
BEx Web applications are Web-based applications from the Business Explorer (BEx) of SAP NetWeaver
Business Warehouse (BW) for data analysis, reporting, and analytical applications on the Web.
The Business Explorer is the SAP NetWeaver Business Intelligence suite, which provides flexible reporting and analysis tools for strategic analyses and decision-making support. These tools include query, reporting, and analysis functions. As an employee with access access rights, you can evaluate historical or current data at various levels of detail and from different perspectives, both on the Web and in Microsoft Excel.
Users access the data from the SAP NetWeaver Portal or from the BI launch pad of SAP BusinessObjects
Business Intelligence platform. Authors of BEx Web applications can execute the Web applications directly in the BI launch pad from BEx Web Application Designer.
2012-12-12
Managing Applications
581
To integrate BEx Web applications in SAP BusinessObjects Business Intelligence platform, perform the following configuration steps:
1.
Set up a server for the BEx Web applications in the Central Management Console (CMC).
You can use either a general or standalone server for the BEx Web applications.
Tip:
We recommend setting up a standalone server for the BEx Web applications, as the general server is normally used by many other services.
2.
Configure the server settings.
3.
Check the connection to the BW system.
4.
To ensure that authors can run BEx Web applications directly in the BI launch pad from BEx Web
Application Designer, make the relevant settings in the Connected Portals table
(RSPOR_T_PORTAL) in the BW system.
After the configuration of the SAP BusinessObjects Business Intelligence platform server, users can open BEx Web applications in the BI launch pad. They can navigate in the data here and save the BEx
Web applications as bookmarks in the web browser favorites.
Restriction:
Integration is supported as of the following SAP NetWeaver releases:
• SAP NetWeaver 7.0 Enhancement Package 1 Support Package Stack 8
• SAP NetWeaver 7.3 Support Package Stack 1
Because the SAP NetWeaver Java stack is not required for this integration, the following restrictions apply:
• Information Broadcasting is not supported.
• Because the portal and Knowledge Management of SAP NetWeaver are not needed, document integration and the use of portal motives are not supported in the BEx Web applications.
• The Report Web item is not supported. We recommend that you use SAP Crystal Reports for formatted reporting.
• To create print versions of BEx Web applications, the Export Library for SAP Business Explorer is used. Adobe Document Services (ADS) are not available.
• The BEx Web applications that are integrated in SAP BusinessObjects Business Intelligence platform can contain only data sources that are stored in the BW master system. In system administration, you define which system is configured as the BW master system in BusinessObjects Business
Intelligence platform.
• Single sign-on between SAP BusinessObjects Business Intelligence platform and the SAP NetWeaver
BW system is not enabled. For each BusinessObjects Business Intelligence platform session, BEx
Web applications users are requested to log on to the corresponding BW master system.
• Report-report interface from and to BEx Web applications is not supported. Corresponding commands won't be executed.
• Dashboards based on BEx queries or query views and created with SAP BusinessObjects Dashboards are not supported.
For more information about the features of BEx Web applications, see SAP Help Portal at http://help.sap.com
: SAP NetWeaver 7.3 > SAP NetWeaver Library: Function-Oriented View >
2012-12-12
Managing Applications
582
Business Warehouse > SAP Business Explorer > BEx Web > Analysis & Reporting: BEx Web
Applications.
For more information about accessing and saving BEx Web applications in the BI launch pad, see the
BI Launch Pad User Guide at http://help.sap.com
.
Related Topics
•
Starting a server for BEx web applications
•
Starting a Standalone Server for BEx Web Applications
•
•
Checking Connection to BW System
•
Configuring a Connection Between BEx Web Application Designer and BusinessObjects Business
17.1.3.10.1 Starting a server for BEx web applications
Before you can perform this task, the Adaptive Processing Server must be in a Stopped state.
1.
Log on to the Central Management Console (CMC).
2.
Choose Servers.
3.
Expand the Service Categories node, and choose Analysis Services.
4.
Select Adaptive Processing Server, and choose Select Services in the context menu.
5.
Move BExWebApplicationsService from the Available Services list to the
AdaptiveProcessingServerServices list.
6.
Activate and start the BEx Web applications service using the context menu.
17.1.3.10.2 Starting a Standalone Server for BEx Web Applications
1.
Log on to the Central Management Console (CMC).
2.
Choose Server.
3.
Expand the Service Categories node and choose Analysis Services.
4.
Select the Adaptive Processing Server and choose Clone Server in the context menu.
5.
Enter a name for the server (AdaptiveProcessingServer for example) and select the required server in the Clone to Node box.
6.
Select the cloned server and choose Select Services in the context menu.
7.
Select BExWebApplicationsService in the Available Services list and move it to the
AdaptiveProcessingServerServices list.
8.
Activate and start the BEx Web applications service using the context menu.
17.1.3.10.3 Configuring Server Settings
1.
Log on to the Central Management Console (CMC).
2.
Choose Server.
3.
Expand the Service Categories node and choose Analysis Services.
4.
Select the BEx Web Applications service and choose Properties in the context menu.
2012-12-12
Managing Applications
5.
Under The BEx Web Applications service configuration in the "BEx Web Applications Service" area, make the following settings: a.
Check (and change if necessary) the maximum number of client sessions.
b.
Under SAP BW Master System, enter the name of the OLAP connection to the BW system that you created in SAP BusinessObjects Business Intelligence platform. The default name is SAP_BW.
c.
Enter the name of the JCo Server RFC Destination that you entered in the BW system under
Configuration of RFC Connections (transaction code sm59).
d.
Enter the name of the JCo Server Gateway Host that you defined in the BW system under
Configuration of RFC Connections (transaction code sm59).
e.
Enter the name of the JCo Server Gateway Service that you defined in the BW system under
Configuration of RFC Connections (transaction code sm59).
f.
Check (and change if necessary) the JCo Server Connection Count.
6.
Choose Save & Close.
7.
Select the BEx Web Applications service and choose Restart Server in the context menu.
To apply the selected settings, you have to restart the server.
Note:
Before you restart the server, the RFC destination in the ABAP system must have been created.
Related Topics
•
Creating an RFC destination in the ABAP System
17.1.3.10.4 Checking Connection to BW System
1.
Log on to the Central Management Console (CMC).
2.
Choose OLAP Connections.
3.
Check whether a connection has been established to the BW system. If not, set one up. The default name of the connection is SAP_BW. You can also enter a different name.
4.
Make sure that you have selected Pre-defined under Authentication and have made the required entries for user and password.
Note:
This user account is required for the JCo server RFC destination, which allows the integration of
BEx Web Application Designer, BW system, and BusinessObjects Business Intelligence platform.
Tip:
To make the connection secure, make sure that only administrators have access rights to it.
a.
To do this, right-click the connection to the BW system (default name SAP_BW) and choose
User Security.
b.
Make the required security settings and give access rights only to administrators if possible.
583 2012-12-12
Managing Applications
584
17.1.3.10.5 Configuring a Connection Between BEx Web Application Designer and
BusinessObjects Business Intelligence platform
To ensure that authors can run BEx Web applications directly in the BI launch pad from BEx Web
Application Designer, you need to make the relevant settings in the Connected Portals table
(RSPOR_T_PORTAL) in the BW system.
1.
In the BW system, call transaction SM30 (Table View Maintenance).
2.
Under Table/View, enter RSPOR_T_PORTAL.
3.
Choose Maintain.
4.
To create a new entry, choose New Entries.
5.
Make the following settings: a.
To ensure integration between the BW system and BusinessObjects Business Intelligence platform, you have to create an RFC destination in transaction SM59. Enter this RFC destination under Destination.
b.
Select Standard Portal. This ensures that Web applications in Web Application Designer are always called in BusinessObjects Business Intelligence platform.
c.
Under URL Prefix, enter the URL to the BusinessObjects Business Intelligence platform Web
Application Container Server (WACS), including the protocol, host name and port, http://<wacs><domain>:<port> for example.
d.
Under Platform, select BOE.
e.
Select Use SAP Export Lib (PDF) if you want the Export Library for SAP Business Explorer to be activated, thus allowing PDF, PostScript and PCL files to be exported from BEx Web applications.
6.
Save your entries.
Related Topics
•
Creating an RFC destination in the ABAP System
Creating an RFC destination in the ABAP System
To integrate the BW system and BusinessObjects Business Intelligence platform, you need an RFC destination. This RFC destination allows the BW system and BusinessObjects Business Intelligence platform to communicate with one another.
1.
Call Configuration of RFC Connections (transaction codeSM59).
2.
Choose Create.
3.
Maintain the RFC destination: a.
Enter a name for the RFC destination.
b.
Select T for TCP/IP connection as the connection type.
c.
Enter a description.
You can maintain the description of the RFC destination language dependently.
d.
Under Technical Settings, select Registered Server Program as the activation type.
e.
Under Technical Settings, enter the program ID.
2012-12-12
Managing Applications
The program ID must be identical to the program ID (JCo Server RFC Destination) that you specified when creating the destination for this BW system in the BusinessObjects Business
Intelligence platform server.
f.
Under Technical Settings under Gateway Options, enter the gateway host and the gateway service that the BusinessObjects Business Intelligence platform serve uses to communicate with the BW system.
4.
On the Logon & Security tab page, activate the Send SAP Logon Ticket option.
5.
Save your entries.
Related Topics
•
17.2 Managing applications through BOE.war properties
17.2.1 The BOE war file
You can modify settings for BI platform web applications by overwriting default properties for the BOE.war
file. This file is deployed on the machine hosting the web application server. For detailed information on how the file is deployed see the SAP BusinessObjects Business Intelligence Platform Web Application
Deployment Guide.
The properties contained in the BOE.war file control specifications for default login behavior, default authentication methods, settings for single sign-on. There two types of properties you can specify:
• Global properties - these properties affect all the web applications contained in the BOE.war file.
• Application-specific properties - property settings that affect only a specific web application.
To modify any of the default properties, use the custom configuration directory to save new settings for either global or application-specific properties. By default, the directory is located at: C:\Program
Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom
.
Do not modify the properties in the config\default directory.
Note:
On some web application servers such as the Tomcat version bundled with BI platform you can access the BOE.war directly. In this scenario, you can set custom settings directly without undeploying the
WAR file. When you cannot directly access the deployed web applications, you must undeploy, customize, and then redeploy the file. For more information, see the SAP BusinessObjects Business Intelligence
Platform Web Application Deployment Guide.
585 2012-12-12
Managing Applications
586
17.2.1.1 Global BOE.war properties
The following table lists the settings included in the default global.properties file for BOE.war. To overwrite any of the settings, create a new file in C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom
.
Setting Default values Description
persistentcook ies.enabled
persistentcookies.enabled=true
Enables or disables persistent cookies on the web application logon page.
siteminder.au
thentication siteminder.en
abled siteminder.authentication=se cLDAP siteminder.enabled=false
Specifies what authentication method to use with SiteMinder. Only options are secLDAP and secwinAD.
Enables and disables authentication with
SiteMinder.
sso.enabled
sso.sap.prima
ry tree.pagesize
trust ed.auth.shared.se
cret trust ed.auth.us
er.param
sso.enabled=false sso.sap.primary=false tree.pagesize=100
Enables and disables single sign-on
(SSO) to BI platform.
Set to true if you want to use SAP SSO as the application's primary single signon mechanism. Only applies to cases where both SAP and SiteMinder SSO are used.
Specifies the maximum number of entries that can be displayed in the web application navigation pane.
Specifies the session variable name used to retrieve the secret for Trusted
Authentication. Only applies if using the web session to pass the shared secret.
Specifies the variable used to retrieve the username for Trusted Authentication.
Can be set to one of the following:
•
Header
•
URL Parameter
•
Cookie
•
Session
2012-12-12
Managing Applications
Setting
trust ed.auth.us
er.retrieval
trust ed.auth.us
er.names
pace.enabled
Default values Description
Specifies the method used to retrieve the username for Trusted Authentication.
Can be set to one of the following:
•
"REMOTE_USER"
•
"HTTP_HEADER"
•
"COOKIE"
•
"QUERY_STRING"
•
"WEB_SESSION"
•
"USER_PRINCIPAL"
Set to empty to disable Trusted Authentication.
Enables and disables dynamic binding of aliases to existing user accounts. If property is set to true, Trusted authentication uses alias binding to authenticate users to BI platform. With alias binding, your application server can work as a SAML service provider therefore enabling Trusted Authentication to provide SAML SSO to the system. If set to false
, Trusted Authentication uses name matching to authenticate users.
Used to enable or disable Vintela settings for Windows AD authentication.
vintela.en
abled vintela.enabled=false idm.realm=YOUR_REALM idm.princ=YOUR_PRINCIPAL idm.allowUnsecured=true idm.allowNTLM=false idm.logger.name=simple idm.logger.props=error-log.properties
pinger.showWarn
ingDialog.cmc
pinger.showWarn
ingDialog.bi
launchpad pinger.showWarningDia
log.cmc=true pinger.showWarningDialog.bi
launchpad=true
Specifies whether or not to display the warning dialog box with the message indicating that the current session will expire soon in the CMC.
Specifies whether or not to display the warning dialog box with the message indicating that the current session will expire soon in BI launch pad.
pinger.warning
Period.pingIn
crementsInSec onds pinger.warningPeriod.pingIncre
mentsInSeconds=15
Specifies how often a web server request should be sent while the session expiry warning message is displayed.
This is important for synchronizing the warning dialog across applications.
587 2012-12-12
Managing Applications
Setting Default values Description
pinger.warning
Period.length
InMinutes pinger.warningPeriod.lengthIn
Minutes=5
Specifies how long prior to session expiry the warning should be displayed.
logoff.on.web
session.expiry
logoff.on.websession.ex
piry=true
Specifies if all application sessions log off when the web session expires.
pinger.enabled
pinger.enabled=true sys tem.com.sap.bip.jco
manager.desti
nations.max
size system.com.sap.bip.jcomanag
er.destinations.maxsize=1000
Enables or disables the session expiry warning messaging mechanism.
Specifies the maximum number of cached Java connections.
httpproxy.user
name httpproxy.username=myusername
Specifices the username to log on to the
HTTP proxy server.
httpproxy.pass
word httpproxy.password=mypassword
Specifices the password to log on to the
HTTP proxy server.
17.2.1.2 BI launch pad properties
The following table lists the settings included in the default bilaunchpad.properties file for the
BOE war file. To overwrite any of the settings, create a new file in C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom
.
588 2012-12-12
Managing Applications
Setting
app.name
app.name.short
app.url.name
Description
Specifies the display name of the application. The name appears on the web application title page and logon screen
Specifies the display name of the application. The name appears on the web application title page and logon screen. Default: app.name.short=BI launch pad
Specifies the URL name of the application, preceded by the / (forward slash) character. Default: app.url.name=/BI authentication.de
fault
Specifies the default authentication method used to authenticate users in the application. You can use any of the following for this setting:
Authentication
Enterprise
LDAP
Windows AD
SAP
PeopleSoft
JD Edwards
Siebel
Oracles EBS
Setting value
secEnterprise secLDAP secWinAD secSAPR3 secpsenterprise secPSE1 secSiebel7 secOraApps
Default: authentication.default=secEnterprise authentication.vis
ible
Specifies if users logging into BI launch pad have the option to view and change the authentication method. Default: authentication.visi
ble=false cms.default
Specifies the default CMS name. Default: cms.default=[name of host machine] cms.visible
Specifies if users logging into BI launch pad have the option to view and change the CMS name. Default: cms.visible=true dialogue.prompt.en
abled
Specifies if users should be prompted when navigating away from an input page in a dialog box. Default: dialogue.prompt.enabled=false logontoken.enabled
Specifies whether or not to enable token creation for the session after a user logs into BI launch pad. Token will be stored in a cookie. Default: logonto ken.enabled=false
589 2012-12-12
Managing Applications
Setting
SMTPFrom
Description
Enables or disables the "From" field when scheduling an object to a destination. Default: SMTPFrom=true
When the value is set to false the "From" field will not be displayed and the system attempts to retrieve the "From" email value in the following order:
1.
First, from the report default for a report object.
2.
Second, from the email address on the user profile of the logged on user.
3.
Lastly, from the Job server default.
url.exit
disable.lo
cale.preference
Specifies which URL to redirect users after terminating their BI launch pad session. This setting applies only to users who have logged into the application through an external verification process.
Enables or disables the user from viewing and thus modifying the viewing local preferences for BI launch pad. Default: disable.locale.prefer
ence=false extlogon.allow.lo
goff
Enables or disables automatically logging off user sessions once they have closed their BI launch pad session. Set to false if you want user sessions not to automatically terminate when users log off BI launch pad. Default: extlo gon.allow.logoff=true enforceTopLevel
Frame.enabled
Specifies whether or not to enable frame breaking on the BI launch pad logon page to prevent a cross-site framing security vulnerability. Set to true to enable. Default: enforceTopLevelFrame.enabled=true
17.2.1.3 OpenDocument properties
The following table lists the settings included in the default opendocument.properties file for the
BOE war file. To overwrite any of the settings, create a new file in C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom
.
590 2012-12-12
Managing Applications
Setting
app.name
app.name.short
Description
Specifies the display name of the application. The name appears on the web application title page and logon screen. Default: app.name=BusinessOb jects OpenDocument
Specifies the display name of the application. The name appears on the web application title page and logon screen. Default: app.name.short=Open
Document authentication.de
fault
Specifies the default authentication method used to authenticate users into the application. You can use any of the following for this setting:
Authentication
Enterprise
LDAP
Windows AD
SAP
PeopleSoft
JD Edwards
Siebel
Oracles EBS
Setting value
secEnterprise secLDAP secWinAD secSAPR3 secpsenterprise secPSE1 secSiebel7 secOraApps authentica tion.visible
cms.default
cms.visible
Default: authentication.default=secEnterprise
Specifies if users logging into OpenDocument have the option to view and change the authentication method. Default: authentication.visi
ble=false
Specifies the default CMS name. Default: cms.default=[name of host machine]
Specifies if users logging into OpenDocument have the option to view and change the CMS name. Default: cms.visible=false
591 2012-12-12
Managing Applications
Setting
logontoken.en
abled
Description
Specifies whether or not to enable token creation for the session after a user logs into OpenDocument. The token will be stored in a cookie. Default: lo gontoken.enabled=true extlogon.allow.lo
goff
Enables or disables automatically logging off user sessions once they have closed their OpenDocument session. Set to false if you want user sessions to not automatically terminate when users log off OpenDocument. Default: extlogon.allow.logoff=true
SAPLogonToken.en
abled
Specifies whether or not to allow RESTful Web Service SAP logon tokens to authenticate to the BI platform. The SAP logon token is specified by the X-
SAP-LogonToken value in the request header after a successful logon with the RESTful Web Service URL. Default: SAPLogonToken.enabled=true
17.2.1.4 CMC properties
The following table lists the settings included in the default CmcApp.properties file for BOE.war. To overwrite any of the settings, create a new file in C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\config\custom
.
592 2012-12-12
Managing Applications
Setting
app.url.name
Description
Specifies the URL name of the application, preceded by the / (forward slash) character. Default: app.url.name=/CMC authentication.de
fault
Specifies the default authentication method used to authenticate users into the application. You can use any of the following for this setting:
Authentication
Enterprise
LDAP
Windows AD
SAP
PeopleSoft
JD Edwards
Siebel
Oracles EBS
Setting value
secEnterprise secLDAP secWinAD secSAPR3 secpsenterprise secPSE1 secSiebel7 secOraApps authentica tion.visible
cms.default
cms.visible
Default: authentication.default=secEnterprise
Specifies if users logging into the CMC have the option to view and change the authentication method. Default: authentication.visible=true
Specifies the default CMS name. Default: cms.default=[name of host machine]
Specifies if users logging into the CMC have the option to view and change the CMS name. Default: cms.visible=true
593 2012-12-12
Managing Applications
Setting
dia logue.prompt.en
abled logontoken.en
abled
SMTPFrom
Description
Specifies if users should be prompted when navigating away from an input page in a dialog box. Default: dialogue.prompt.enabled=false
Specifies whether or not to enable token creation for the session after a user logs into the CMC. The token will be stored in a cookie. Default: logonto ken.enabled=false
Enables or disables the "From" field when scheduling an object to a destination. Default: SMTPFrom=true
When the value is set to false the "From" field will not be displayed and the system attempts to retrieve the "From" email value in the following order:
1.
First, from the report default for a report object.
2.
Second, from the email address on the user profile of the logged on user.
3.
Lastly, from the job server default.
17.3 Customizing BI launch pad and OpenDocument logon entry points
You can customize the logon page for BI launch pad and OpenDocument web applications. For example, you can customize the logon page to use a company logo or corporate style sheet, or you can create a customized logon page that enables trusted authentication.
To customize the logon page, modify the custom.jsp file stored in the BI launch pad and
OpenDocument application areas of the BOE.war web application, and then redeploy the BOE.war
web application to your BI platform system. Users access the custom logon entry point by navigating to a unique URL.
To work with these examples, you need to be familiar with deploying BI platform web applications. For more information, see the SAP BusinessObjects Business Intelligence Platform Web Application
Deployment Guide.
17.3.1 BI launch pad and OpenDocument file locations
The BI launch pad and OpenDocument web applications are packaged within in the BOE.war web archive file. The location of the BOE.war archive is defined in the BOE.properties file.
The BOE.properties file is found here on Windows systems:
594 2012-12-12
Managing Applications
•
<BOE_INSTALL_DIR>\SAP BusinessObjects Enterprise XI
4.0\wdeploy\conf\apps\BOE.properties
The BOE.properties file is found here on Unix systems:
•
<BOE_INSTALL_DIR>/sap_bobj/enterprise_xi40/wdeploy/conf/apps/BOE.properties
The following tables define the location of common files within the BOE.war web archive file for both the BI launch pad and OpenDocument applications.
Table 17-3: BI launch pad file locations
Note:
The BI launch pad web application was formerly known as InfoView.
File type Location
Custom logon script
WEB-INF\eclipse\plugins\webpath.InfoView\web\custom.jsp
Directory for additional files
WEB-INF\eclipse\plugins\webpath.InfoView\web\noCacheCustom
Resources
Custom logon URL http://<servername>:<port>/BOE/BI/custom.jsp
Table 17-4: OpenDocument file locations
File type Location
Custom logon script
WEB-INF\eclipse\plugins\webpath.OpenDocument\web\open doc\custom.jsp
Directory for additional files
WEB-INF\eclipse\plugins\webpath.OpenDocument\web\noCacheCus tomResources
Custom logon URL http://<servername>:<port>/BOE/OpenDocument/opendoc/cus tom.jsp
17.3.2 To define a custom logon page
595 2012-12-12
Managing Applications
You can customize the entry point to the BI platform logon page. For example, you can create a custom logon page that displays a company logo and uses a corporate style sheet.
Edit the custom.jsp file to customize the logon experience for your users, and place supporting files in the noCacheCustomResources folder.
This example shows how to create a custom logon page that redirects the user to the standard logon page.
1.
Create a file that contains your custom logon code, and save it as custom.js in the noCacheCus tomResources folder.
This example defines a function that redirects the user to the standard logon page, logon.jsp.
function load() {window.location = "logon.jsp";}
2.
Edit the custom.jsp file to customize the logon page.
This example displays a welcome message and a hyperlink that calls the load method defined in the custom.js file.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<%@ page language= "java" contentType= "text/html;charset=utf-8"%>
<html>
<head> <title>Welcome</title>
</head>
<body>
<script type= "text/javascript" src= "noCacheCustomResources/custom.js"></script>
<p>Welcome to ABC corporation.</p>
<a href= "javascript:load()">Enter</a>
</body>
</html>
3.
Redeploy the BOE.war web application, and restart the web server.
17.3.3 To add trusted authentication at logon
To enable trusted authentication, set the trusted user as a session attribute in the custom.jsp file, and modify authentication settings in a copy of the global.properties file. The values of the custom copy of the global.properties file override the default values.
1.
Edit the custom.jsp file to set a session attribute that defines the trusted user.
request.getSession().setAttribute("TrustedUserAttribute", "TrustedUser");
2.
Create a custom copy of the global.properties file by copying WEB-INF\config\de fault\global.properties
to WEB-INF\config\custom\global.properties.
3.
Modify WEB-INF\config\custom\global.properties to enable Single Sign-on (SSO).
sso.enabled=true
4.
Modify WEB-INF\config\custom\global.properties to set trusted authentication parameters, including the trusted user session variable, and the shared secret.
596 2012-12-12
Managing Applications
Replace "..." with the shared secret for your system.
trusted.auth.user.param=TrustedUserAttribute trusted.auth.user.retrieval=WEB_SESSION trusted.auth.shared.secret="..."
5.
Redeploy your web application, and restart the web server.
Related Topics
•
Enabling Trusted Authentication
597 2012-12-12
Managing Applications
598 2012-12-12
Managing Connections and Universes
Managing Connections and Universes
18.1 Managing connections
A connection is a named set of parameters that defines how one or more applications can access relational or OLAP databases. Connection details such as server name, database, username, and password, can be stored securely in the BI platform repository in the Connections folder.
Designers define universes based on connections. Users of query, analysis, and reporting applications access the database via the universe without needing to know about the underlying data structures in the database.
You can create connections using the following applications:
• The universe design tool. Connections are stored in the repository.
• The information design tool. Connections can be created locally and then published to the repository, or created and edited directly in the repository.
Note:
For information on how to manage OLAP data source connections, see the SAP BusinessObjects
Analysis, edition for OLAP Administrator Guide.
You grant rights to allow users to create, edit, and delete connections.
You grant user access to universe connections and allow users to create and view documents that use universes and connections.
Related Topics
•
Managing security settings for objects in the CMC
•
18.1.1 To delete a universe connection
Tip:
It is also possible to delete connections in the universe design tool and the information design tool.
1.
In the "Connections" area, select a universe connection from the list.
2.
Click Manage > Delete.
599 2012-12-12
Managing Connections and Universes
18.2 Managing universes
A universe is an organized collection of metadata objects that enables business users to analyze and report on corporate data in non-technical language. These objects include dimensions, measures, hierarchies, attributes, pre-defined calculations, functions, and queries. The metadata object layer is built on a relational database schema or an OLAP cube, so the objects map directly to the database structures. A universe includes connections to the data sources so that users of query and analysis tools can connect to a universe and run queries and create reports using the objects in a universe without needing to know about the underlying data structures in the database.
You can create universes with the following tools:
• The universe design tool. Universes created with this tool can be distinguished by the .unv extension and are therefore called .unv universes. The .unv universes are defined on a secured connection and stored in the repository Universes folder.
• The information design tool. Universes created with this tool are based on the new semantic layer.
They are distinguished by the .unx extension and are therefore called .unx universes. The .unx
universes are authored locally and published to the repository Universes folder. Designers can define object-level security using the information design tool security editor.
You grant users application rights and universe rights to allow them to create, edit, and delete universes, as well as design security on universes.
You grant users universe rights to allow them to create and view documents that use universes.
Related Topics
•
Managing security settings for objects in the CMC
•
•
•
Information design tool rights
•
18.2.1 To delete universes
Tip:
It is also possible to delete universes in the information design tool.
1.
In the "Universes" area of the CMC, select a universe in the list.
2.
Click Manage > Delete.
3.
When prompted for confirmation, click OK.
600 2012-12-12
Monitoring
Monitoring
19.1 About Monitoring
Monitoring allows you to capture the runtime and historical metrics of SAP BusinessObjects Business
Intelligence platform servers, for reporting and notification. The monitoring application helps system administrators to identify if an application is functioning normally and if the response times are as expected. By providing key business metrics, the monitoring application provides better insight to
Business Intelligence (BI) platform.
Monitoring allows you to:
• Check the performance of each server: This is possible with the help of watches, which show the state of each server as traffic lights. The system administrator can set thresholds for these watches and receive alerts when these thresholds are breached. This helps in taking proactive action if there is an impending failure or outage.
• View critical system Key Performance Indicators (KPIs): This helps in activity and resource monitoring.
These KPIs are displayed on the dashboard page of the monitoring application.
• View the entire BI platform deployment based on Server Groups, Service Categories and Enterprise nodes in graphical and tabular format.
• View the recent failures on the dashboard screen.
• Check system availability and response time: Using probes, you can simulate workflows to check if the servers and services in the BI platform deployment are functioning as expected. By analyzing the round-trip time of these probes at periodic intervals, the system administrator can assess the system usage pattern.
• Analyze peak load and peak period for the CMS: This helps the system administrator determine if more licenses or system resources are required.
• Integrate with other enterprise applications: The Business Intelligence platform monitoring application can be integrated with other enterprise applications like SAP Solution Manager and IBM Tivoli
Monitoring.
19.2 Monitoring terms
The following list provides terms that relate to the monitoring application:
601 2012-12-12
Monitoring
602
Dashboard
The Dashboard page provides a centralized view for the system administrator to monitor the performance of all servers. It provides real-time information on the system KPIs, recent alerts, watches, and corresponding graphs based on the watch state.
Watch
Watches provide real-time status and historical trends of servers and workflows within the SAP
BusinessObjects BI platform environment. Users can associate thresholds and alerts to a watch. You can create a watch using data from probes, servers, SAPOSCOL or Derived Metrics.
Derived Metrics
Derived metric gives you the flexibility to create metrics based on the user's requirements, and then create a watch using this metric. You can create a derived metric by combining two or more existing metrics in a mathematical equation.
Topological metrics
Topological metrics provides you the net state for each service category in Business Intelligence
Platform. For example, the Crystal Report service gives you the combined health state of all the watches related to Crystal servers.
Health State terminology
The list below highlights the values and corresponding health state:
• "0" - Indicates that the health of the metric is bad.
• "1" - Indicates that the health of the metric is deteriorating and needs immediate attention.
• "2" - Indicates that the health of the metric is good.
KPI
KPIs (key performance indicators) are standard metrics in the SAP BusinessObjects Enterprise deployment. They provide information about the schedules and log on sessions. For example, a higher number of RunningJobs indicates good performance of the servers. Alternatively, a higher number of
PendingJobs indicates poor performance and high system load.
Probes
Probes monitor different services and simulates the different functionalities of SAP BusinessObjects
Enterprise components. By scheduling probes to run at specified intervals, the system administrator can track the availability and performance of key services provided by SAP BusinessObjects BI platform
4.0. This data can also be used for capacity planning.
Traffic lights
Traffic lights represent the watch state at any given time. The colors Green, Amber, and Red are used to indicate the state of a watch. Users can choose to set two or three states to a watch.
Trending graph
A trending graph is a graphical representation of historical metric data generated by probes and servers.
It helps the system administrator monitor the system at different time intervals, and assess the system usage pattern.
2012-12-12
Monitoring
Alert
An alert is a notification generated by the monitoring application, when a user-defined threshold value set for different metrics applied to a watch is breached. You can choose to receive alerts either through email or view on the "Dashboard" page.
19.2.1 Architecture
This section provides a high-level overview of the monitoring architecture and briefly explains the roles the components play. The monitoring architecture is represented graphically below:
603
The high-level components in the architecture are listed below:
• The Platform Java Server (PJS)
• The Java Management Extensions (JMX) agent/server
• MBeans
• JMX Clients
2012-12-12
Monitoring
• The Management consoles
• Trending Database
The monitoring service is hosted on the Platform Java Server. The application is based on JMX technology.
The Monitoring Platform Java Service provides the core services available in the monitoring application.
The Monitoring Platform Java Service provides the following services:
• Provides the JMX agent service.
• Creates MBeans dynamically for the SAP BusinessObjects servers.
• Provides lifecycle management for the MBeans.
• Provides a mechanism for registering new probes.
• Allows users to create complex threshold conditions using the metrics of the servers.
• Provides a threshold notification mechanism and sends alerts.
• Provides a trending function by storing historical data.
The Probe Scheduling Service that is hosted on the Adaptive Job Server manages the running and scheduling of probes. Hence, the Adaptive Job Server should be running for the probes to run.
The monitoring application also exposes a JMX or Remote Method Invocation (RMI) URL end point.
Other enterprise applications such as SAP Solution Manager and IBM Tivoli Monitoring can connect to the monitoring application and access the SAP BusinessObjects metrics by using a JMX Remote
API. The monitoring application uses a dedicated Derby database for storing historical data for the purpose of trending. For information on the trending database schema, see
.
19.2.1.1 Trending DB schema
The following Trending Database diagram and table explanations show you the tables where the metric, probe, and watch data will be recorded and how these tables are related.
604 2012-12-12
Monitoring
605
Table 19-1: TREND_DETAILS
This table records information about managed entities, probes, and watches. For example, CUID and metric names.
Description Column name
DetailsId
Primary key
Autogenerated
CUID (64)
MetricName
Type (32)
Name
CUID of the InfoObject (or) the unique id of non-InfoObject
Name of the Metric
Subscription or Metric types
Name of the watch
NOT NULL
NOT NULL
NOT NULL
NOT NULL
Table 19-2: TREND_DATA
This table records the trending data from metrics, watches, and probes. For example, metric value and time.
Column name Description Primary key
DataId
DetailsId
Time
Value
Auto generated
Foreign key
Time at which data was collected
NOT NULL
Value of the metric / subscription
No
Table 19-3: MANAGED_ENTITY_STATUS_DETAILS
This table records the information about subscription breaches and alert delivery information. For example, breach time and alert delivery time.
Column name
StatusDetailsId
DetailsId
Time
AlertType
Description Primary key
Auto generated
Foreign key
Time at which data was collected
NOT NULL
Subscription notification delivery type (for example, email)
No
2012-12-12
Monitoring
Column name
DataId
DetailsId
CUID
Name
Description Primary key
Yes (INTEGER NOT NULL )
Foreign key
NOT NULL
NOT NULL
Table 19-4: MANAGED_ENTITY_STATUS_METRICS
This table records information about watches and the metrics belonging to the watch equations. Every metric belonging to the watch will have one entry in this table.
Column name Description Primary key
DataId
DetailsId
CUID
Name
Data ID of the watch
Details ID of the metric belonging to the watch
Yes, auto-incrementing
Foreign key
CUID of the watch
Name of the watch
NOT NULL
NOT NULL
19.3 Cluster support for monitoring server
The monitoring application provides cluster support. The cluster support is easy to implement and provides failover support.
With cluster support, only one service will be active at any given time, and all other services will be passive. Let us assume there are two monitoring services s1 and s2 in a clustered environment. Only one of them must be available. Both s1 and s2 attempt to become active. Only one of them will be successful and the other service becomes inactive or passive.
The passive services keep checking on a periodic basis (every one minute) on the availability of the active service. If the active service is unavailable, the passive service immediately attempts to become active.
Note:
It is recommended that the monitoring service is hosted on a separate Adaptive Processing Server
(APS) instance to avoid crash or restart or poor performance of the APS.
606 2012-12-12
Monitoring
19.4 Metrics
There are many metrics that can be used for creating watches. Metrics can be:
• Probe metrics
• Server metrics
• Host metrics
• Derived metrics
• Topology Metrics
When a default probe is run, the metrics execution time and passed are generated. These metrics are called virtual metrics.
The SAP BusinessObjects Business Intelligence platform server metrics are listed in the following table:
607 2012-12-12
Monitoring
Server
Adaptive Processing Server
Metrics
608 2012-12-12
Monitoring
Server
609
Metrics
• Number of Auditing Events Received Since Server Startup
• Current Number of Auditing Events in the Queue
• Available Processors
• Busy Server Threads
• CPU Usage Percentage last 15 minutes
• CPU Usage Percentage last 5 minutes
• Cube Count
• Number of Active Connections to Loaded Connectors
• Number of Active Threads
• Number
• Free Memory
• Number of Connections
• Number of Failed Queries
• Number of Failed GCs
• JVM Deadlocked Threads Counter
• JVM Lock Contention Count
• Maximum Memory
• Number of Full GCs
• DataFederator.Number of Loaded Connectors
• DataFederator.Number of Queries Consuming Memory
• DataFederator.Number of Queries Using Disk
• DataFederator.Number of Queries Waiting for Resources
• DataFederator.Number of Queries in Query Analyze Step
• DataFederator.Number of Queries in Query Execution Step
• DataFederator.Number of Queries in Query Optimization Step
• DataFederator.Number of Running Queries
• Number of Page Faults during GC last 15 minutes
• Number of Page Faults during GC last 5 minutes
• Percentage of stopped system during GC last 15 minutes
• Percentage of stopped system during GC last 5 minutes
• Query Count
• Server Enabled State
• Server Running State
• Session Count
• Threads in Transport Layer
• Total Memory
• Transport Layer Thread Pool Size
• Health State
• DataFederator.Total Bytes Produced by Query Execution
• DataFederator.Total Bytes Transferred from Data Sources
• DataFederator. Total Bytes of Disk Used by Query a Execution
• DataFederator.Total Bytes of Memory Used by Metadata
2012-12-12
Monitoring
Server
Adaptive Job Server
Central Management Server
Metrics
Cache
• DataFederator.Total Bytes of Memory Used by Query Execution
• Busy Server Threads
• CPUs
• Concurrent Jobs
• Current Number of Auditing Events in the Queue
• Disk Size
• Peak Jobs
• Received Job Requests
• Failed Job Creations
• RAM MB
• Server Enabled State
• Server Running State
• Used Disk Space
610 2012-12-12
Monitoring
Server
611
Connection Server
Metrics
• Auditing Thread Utilization
• Average Commit Response Time Since Startup (msec)
• Average Query Response Time Since Startup (msec)
• Busy Server Threads
• CPUs
• Completed Jobs
• Currently Used System Database Connections
• Disk Size (GB)
• Established System Database Connections
• Existing Concurrent User Accounts
• Existing Named User Accounts
• Failed Jobs
• Longest Commit Response Time Since Startup (msec)
• Longest Query Response Time Since Startup (msec)
• Number of Commits Since Startup
• Number of Objects in CMS System Cache
• Number of Objects in CMS System DB
• Number of Queries Since Startup
• Number of Sessions Established by All Users
• Number of Sessions Established by Concurrent Users
• Number of Sessions Established by Named Users
• Number of Sessions Established by Servers
• Number of User Logons Since Startup
• Peak Number of User Sessions Since Startup
• Pending Jobs
• Pending System Database Request
• RAM (MB)
• Running Jobs
• Server Enabled State
• Server Pending State
• Used Disk Space (GB)
• Waiting Jobs
• Auditing Database Last Updated On
• Auditing Thread Last Polling Cycle Duration (sec)
• CMS Auditor
• Concurrent User Licenses
• Connection to Auditing Database is Established
• Current Number of Auditing Events in Queue
• Named User Licenses
• Health State
2012-12-12
Monitoring
Server Metrics
• Busy Server Threads
• CPUs
• Disk Size
• PID
• RAM
• Server Enabled State
• Server Running State
• Used Disk Space
• Health State
Crystal Reports 2011 Processing
Server
• Busy Server Threads
• CPUs
• Disk Size (GB)
• PID
• RAM (MB)
• Server Enabled State
• Server Running State
• Used Disk Space
• Health State
• Data Transfer
• Max Child Processes
• Maximum Processing Time (msec)
• Minimum Processing Time (msec)
• Number of Open Connections
• Number of Open Jobs
• Number of Queued Requests
• Number of Requests Failed
• Number of Requests Served
• Requests Failure Rate Percentage
612 2012-12-12
Monitoring
Server Metrics
Crystal Reports 2011 Report Application Server
• Busy Server Threads
• CPUs
• CrystalReports service through Report Application Servers
• Disk Size (GB)
• PID
• RAM (MB)
• Server Enabled State
• Server Running State
• Used Disk Space
• Current Number of Auditing Events in the Queue
• Current Agent Thread Count
• Current Doc Count
• Total Agent Thread Count
• Total Doc Count
• Health State
Crystal Reports Cache Server
• Busy Server Threads
• CPUs
• Disk Size (GB)
• PID
• RAM (MB)
• Server Enabled State
• Server Running State
• Used Disk Space
• Health State
• Current Number of Auditing Events in the Queue
613 2012-12-12
Monitoring
Server Metrics
Crystal Reports Processing Server
• Average Processing Time (msec)
• Busy Server Threads
• CPUs
• Crystal Reports service through Page and Cache Server execution time
• Disk Size (GB)
• PID
• RAM (MB)
• Server Enabled State
• Server Running State
• Used Disk Space (GB)
• Health State
• Data Transfer
• Max Child Processes
• Maximum Processing Time (msec)
• Minimum Processing Time (msec)
• Number of Open Connections
• Number of Open Jobs
• Number of Queued Requests
• Number of Requests Failed
• Number of Requests Served
• Requests Failure Rate Percentage
Event Server
• Busy Server Threads
• CPUs
• Disk Size (GB)
• Monitored Files
• PID
• RAM (MB)
• Server Enabled State
• Server Running State
• Used Disk Space (GB)
• Current Number of Auditing Events in the Queue
• Health State
614 2012-12-12
Monitoring
Server
Input File Repository
Output File Repository
Metrics
• Active Connections
• Active Files
• Available Disk Space in Root Directory (%)
• Available Disk Space in Root Directory (GB)
• Busy Server Threads
• CPUs
• Data Sent (MB)
• Data Written (MB)
• Disk Size (GB)
• Free Disk Space in Root Directory (GB)
• PID
• RAM (MB)
• Server Enabled State
• Server Running State
• Total Disk Space in Root Directory (GB)
• Used Disk Space (GB)
• Health State
• Active Connections
• Active Files
• Available Disk Space in Root Directory (%)
• Available Disk Space in Root Directory (GB)
• Busy Server Threads
• CPUs
• Data Sent (MB)
• Data Written (MB)
• Disk Size (GB)
• Free Disk Space in Root Directory (GB)
• PID
• RAM (MB)
• Server Enabled State
• Server Running State
• Total Disk Space in Root Directory (GB)
• Used Disk Space (GB)
• Health State
615 2012-12-12
Monitoring
Server
Web Application Container Server
Metrics
• Server Enabled State
• Server Running State
• Health State
• Available Processors
• Busy Server Threads
• CPU Usage Percentage last 15 minutes
• CPU Usage Percentage last 5 minutes
• Current Number of Auditing Events in Queue
• Free Memory
• Maximum Memory
• Number of Full GCs last 15 minutes
• Number of Full GCs last 5 minutes
• PID
• Percentage of stopped system during GC last 15 minutes
• Percentage of stopped system during GC last 5 minutes
• Threads in Transport Layer
• Total Memory
• Transport Layer thread pool size
• JVM Deadlocked Threads Counter
• JVM Locked Contention Count
616 2012-12-12
Monitoring
Server Metrics
Web Intelligence Processing Server
• Busy Server Threads
• CPU Usage (%)
• CPUs
• Cache high mark count
• Cache Size (KB)
• Current number of active sessions
• Current number of client calls
• Current number of sessions
• Current number of tasks
• Disk Size (GB)
• Memory high threshold count
• Memory max threshold count
• Number of active threads
• Number of document swap
• Number of document timeout
• Number of documents
• Number of swapped documents
• Number of out of date documents in cache
• Number of remote extension errors
• Number of sessions timeout
• Number of users
• PID
• RAM (MB)
• Server Enabled State
• Server Running State
• Total CPU time (seconds)
• Total number of client calls
• Total number of sessions
• Total number of tasks
• Total number of threads
• Used Disk Space (GB)
• Virtual memory size (MB)
• Current Number of Auditing Events in the Queue
• Health State
Dashboards Cache Server
617 2012-12-12
Monitoring
Server
Dashboards Processing Server
Metrics
• Busy Server Threads
• CPUs
• Disk Size
• PID
• RAM
• Server Enabled State
• Server Running State
• Used Disk Space
• Health State
• Maximum Processing Time (msec)
• Minimum Processing Time (msec)
• Number of Open Connections
• Number of Queued Requests
• Number of Requests Served
• Average Processing Time (msec)
• Data Transferred
• Busy Server Threads
• CPUs
• Disk Size
• PID
• RAM
• Server Enabled State
• Server Running State
• Used Disk Space
• Health State
• Max Child Processes
• Maximum Processing Time (msec)
• Minimum Processing Time (msec)
• Number of Open Connections
• Number of Open Jobs
• Number of Queued Requests
• Number of Requests Failed
• Number of Requests Served
• Request Failure Rate Percentage
Note:
When you add a new server or start an existing server whose metrics are not displayed in the Metric page, wait for 10 minutes approximately for the metrics to be displayed on the Metrics page.
618 2012-12-12
Monitoring
19.4.1 CMS Query metrics
Metric
Number of scheduled Crystal Reports
Number of defined Crystal Reports
Number of Infospaces
Number of executed Program instances
Number of Programs
Number of Publications
Number of Universes
Number of scheduled Web Intelligence Reports
Number of defined Web Intelligence Reports
Number of defined Xcelsius models
Number of generated Xcelsius Shockwave files
Description
The number of scheduled Crystal Report instances.
The number of defined Crystal reports.
The number of InfoSpaces.
The number of executed program instances.
The number of programs.
The number of publications.
The number of defined universes.
The number of scheduled Web Intelligence report instances.
The number of defined Web Intelligence reports.
The number of defined Xcelsius models.
The number of generated Xcelsius Shockwave files.
19.5 Configuration properties
This section describes the monitoring application properties and how you can edit them.
To see the configuration properties of the monitoring application:
1.
Go to the Applications area of the CMC.
2.
Right-click Monitoring and select Properties. The "Monitoring Application Properties" window appears. The configurable properties are described in the following table:
619 2012-12-12
Monitoring
Section
RMI
Host metrics
Field
Enable Monitoring Application
Description
Select this option to enable monitoring.
If you deselect this option, all monitoring functions except probes will be disabled.
Probe trending is also disabled.
Default JMX agent end point
URL (IIOP)
This contains the default JMX agent end point URL that uses IIOP protocol. This
URL is generated automatically if you enable monitoring and then restart the server. This is the default protocol for monitoring service. This is a read-only field.
Enable RMI protocol for JMX
By default, this option is disabled. If you enable this option, you must provide the
RMI port number. This port will be used for both RMI registry entry and RMI connector port. This port should be available for the service; otherwise the service will fail to start. After you provide the RMI port number, restart the server.
Once the server is restarted, the RMI
JMX agent end point URL is generated.
This is a read-only property containing the JMX agent's end point URL using
RMI protocol. Use this URL to connect to monitoring from other clients.
Enable host metrics
By default, this option is disabled. If you enable this option, you must provide the path to your installation of SAPOSCOL binary.
To enable host metrics, you need to install SAPOSCOL.
620 2012-12-12
Monitoring
Section Field
Trending database settings
Use Audit Database
Use Embedded Database
Description
Select this option to store the trend history of metrics in the CMS AuditDB.
Note:
CMS Auditing has to be configured for this to work.
Select this option to store the metric/watch trend history in the Embedded
DB which comes along with the Monitoring application.
621 2012-12-12
Monitoring
622
Section
Other settings
Field
Metric Refresh Interval (seconds)
Description
The minimum interval that you can specify is 15 seconds. This interval governs the following:
• Subscription computation of the watches: The caution and danger rules are computed continuously with an interval of time mentioned here.
• Calculating the watch state: Watch state is computed continuously with an interval of time mentioned in the metric refresh period if the Event setting of the watch is selected with the following option: Change the
watch state every time caution or
danger evaluates to true.
• Trending period: History mode for the graphs is always trended continuously with an interval of time mentioned here.
Delete older data when the database size grows more than
( MB)
Data from trending database will be cleaned up when the database size exceeds the amount specified. A 30% buffer is created for the database. For example, if you set this to 100 MB, and if the database has grown more than
100 MB when the system checks, the database will be cleared until 70 MB.
Monitoring UI auto refresh interval (seconds)
This interval will be used in the monitoring user interface (including the dashboard, watch list, and probes) for auto refresh. The minimum interval is 15 seconds. Auto-refresh does not affect the time duration in Live mode in graphs, which is set to 15 seconds by default.
Run database cleanup task everyday at
The database cleanup task starts at the time specified. The database will be cleaned when the database size exceeds the specified maximum amount.
Backup trending database
2012-12-12
Monitoring
623
Section Field Description
Trending database backup directory
By default, the location is not specified.
You can specify a location; however, provide an absolute path and not a relative path. In case of a shared location, permission should be given to access the shared location.
Run database backup tasks
By default, this option is disabled. If you enable this option, the trending database backup task starts at the time specified.
The database backup task starts when you click this option. Specify the database backup directory location before choosing this option.
Trending database location
By default, the trending database location is BOE_Install_Dir\SAP
Business Objects\SAP
BusinessObjects Enterprise XI
4.0/Data/TrendingDB
. You can also specify a different location; however, provide an absolute path and not a relative path. For a clustered environment, the location can be shared and permission should be given to access the shared location.
3.
Click Save.
Note:
When you change any property except enabling and disabling the monitoring application, you must restart the monitoring service that is hosted on the Adaptive Processing Server.
Installing SAPOSCOL
Perform the following steps to install SAPOSCOL:
1.
Download SAPHOSTAGENT710_XX.SAR from SAP Marketplace ( http://service.sap.com
).
2.
Extract SAPHOSTAGENT710_XX.SAR by executing the SAPCAR.EXE -xvf
SAPHOSTAGENT710_XX.SAR
command.
3.
Install saphostexec by executing the saphostexec.exe -install command. Once saphostexec is installed as a service, SAPOSCOL starts.
2012-12-12
Monitoring
4.
Check the status of SAPOSCOL by executing the saposcol -s command.
19.5.1 JMX end point URL
The monitoring application exposes a JMX end point URL through which other clients can connect using JMX Remote API. By default, the JMX connectivity is provided over the IIOP (Internet Inter-Orb
Protocol) or CORBA (Common Object Request Broker Architecture) transport. This connection URL is displayed in the properties page of the monitoring application. Being able to connect over IIOP absolves the need to worry about firewalls and having to expose ports. The CORBA ports are available by default.
The jar files listed in the following table are needed at the JMX client end to be able to connect:
Jar Files
activation-1.1.jar
axiom-api-1.2.5.jar
axiom-impl-1.2.5.jar
axis2-adb-1.3.jar
axis2-kernel-1.3.jar
cecore.jar
celib.jar
cesession.jar
commons-logging-1.1.jar
corbaidl.jar
ebus405.jar
log4j.jar
logging.jar
monitoring-plugins.jar
monitoring-sdk.jar
stax-api-1.0.1.jar
wsdl4j-1.6.2.jar
wstx-asl-3.2.1.jar
XmlSchema-1.3.2.jar
624 2012-12-12
Monitoring
Jar Files
TraceLog.jar
ceaspect.jar
aspectjrt.jar
Another option is to connect through the default RMI port. For more information on how to connect through the RMI port, see
19.6 Integrating with other applications
Enterprise solutions, such as SAP Solution Manager and IBM Tivoli Monitoring, integrate with the monitoring application as JMX clients connecting via the JMX end point URL. After integration, the SAP
BusinessObjects metrics can be viewed from the Client's user interface.
19.6.1 Integrating the monitoring application with IBM Tivoli
To integrate monitoring application with IBM Tivoli, you need to create, install, and configure an IBM
Tivoli Monitoring Agent. Perform the following steps to create an IBM Tivoli Monitoring Agent:
1.
Install the IBM Tivoli Monitoring Agent builder version 6.2.1 software.
2.
Create a new agent. For information on how to create a new agent, see the IBM Tivoli Monitoring
Agent user's guide.
3.
In the Defining data monitoring types step, select Data from a server in the Monitoring Data
Categories area and select JMX in the Data Sources area.
4.
Click Next.
5.
In the "JMX Information" window, click Browse to see all the JMX MBeans on the MBean server.
Note:
If you are running the browser for the first time, you need to add a new connection.
6.
In the "Java Management Extensions (JMX) Browser" window, click + next to the Connection Name to add a new connection.
7.
In the "MBean Server Connection Wizard" window, select Standard JMX Connections (JSR-160).
8.
In the "Connection Properties" window, provide the following information:
625 2012-12-12
Monitoring
626
Field
Connection Name
User ID
Password
Service URL
Description
JSR-160-Compliant Server
The username that is used to log into SAP BusinessObjects Enterprise
The password that is used to log into SAP BusinessObjects Enterprise
Provide the JMX endpoint URL
9.
Click Finish.
10.
In the MBean Key Properties area, select Domain and Type.
All the MBeans appear in the text field below.
11.
Select all the MBeans with domain as Servers, one MBean at a time such that the attributes are listed. Choose a key attribute if there is a possibility of having multiple MBeans of same type. For example, if there are two instances of a server running, then the PID of each instance can be a key attribute.
12.
Select a server and select options for the JMX attribute group in the "JMX Agent-Wide Options" window.
13.
In the "Data Source Definition" window, select the agent you added and click Add to Selected. This will take you to the beginning of the agent creation cycle and you need to repeat the above steps to add another server to be monitored.
14.
After creating the agent, you need to install the agent. for more information on how to install an agent, see the IBM Tivoli Monitoring Agent user's guide Figure no. 154 onwards. This section gives information about installing the agent locally and also about creating an installable solution of the agent.
Note:
If you are creating an agent for SAP BusinessObjects Enterprise using the Agent Builder, then you need to have SAP BusinessObjects BI plaform 4.0 installed on the same system. However, if you are installing an already created agent using its installer file, then you do not need to have BOE monitoring installed because at configuration time you can give the details of any system with a JMX end point.
Perform the following steps to configure an installed agent:
1.
Open "Manage Tivoli Enterprise Monitoring Services" in TEMS Mode. You will see the agent installed.
2.
Right-click the agent template and select Configure using defaults.
3.
Select an instance name.
The agent can be configured by using two different protocols: RMI and BOEIIOP.
To use RMI protocol:
• Click Next. Do not make any changes to the Java parameters.
• Provide values for JMX credentials, such as User ID, Password, and Service URL. For more information, see
Configuration Properties in the Related Topics.
• Click OK.
To use BOEIIOP protocol:
2012-12-12
Monitoring
• Copy bcm.jar and cryptojFIPS.jar files from %InstallDir%\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\java\lib to a folder in your system.
• Copy the jar files listed in the following table to another folder.
• In the Java parameters, set JVM arguments to -Djmx.remote.protocol.provider.pkgs
= com.businessobjects.sdk.monitoring
and -Djmx.boeiiop.bcm.dir=< folder location where you have copied bcm.jar and cryptojFIPS.jar files.
• Select Next.
• Provide values for JMX credentials, such as User ID, Password, and Service URL. For more information, see
Configuration Properties in the Related Topics.
• Set <Jar Directories> value as the location of the folder where you copied the list of jar files provided in the table.
• Click OK.
Jar files
activation-1.1.jar
axiom-api-1.2.5.jar
axiom-impl-1.2.5.jar
axis2-adb-1.3.jar
axis2-kernel-1.3.jar
cecore.jar
celib.jar
cesession.jar
commons-logging-1.1.jar
corbaidl.jar
ebus405.jar
log4j.jar
logging.jar
monitoring-plugins.jar
monitoring-sdk.jar
stax-api-1.0.1.jar
wsdl4j-1.6.2.jar
wstx-asl-3.2.1.jar
XmlSchema-1.3.2.jar
627 2012-12-12
Monitoring
Jar files
TraceLog.jar
ceaspect.jar
aspectjrt.jar
4.
Right-click the agent and select Start in the "Manage Tivoli Enterprise Monitoring Services" window.
5.
Open IBM Tivoli Enterprise Portal Desktop/Browser Client. A button appears on the "Navigator" window.
6.
Click the Navigator button.
The agent is added to the Navigator.
Related Topics
•
19.6.2 Integrating the monitoring application with SAP Solution Manager
To integrate the monitoring application with SAP Solution Manager, you need to have Wily Introscope installed and running in your system. The SAP Solution Manager must be configured for Introscope workstation. Perform the following steps during SAP BusinessObjects BI platform installation:
1.
In the Configure Connectivity to Introscope Enterprise Manager step, provide the host name and port details. An Introscope Agent will be installed at C:\Program Files (x86)\SAP Business
Objects\SAP BusinessObjects Enterprise XI 4.0\java\Wiley when SAP
BusinessObjects BI platform is installed.
2.
Launch Introscope workstation and click New Investigator. You can view the SAP BusinessObjects server metrics and probe virtual metrics in the JMX section of the agent configured.
Note:
You can configure the Introscope (IS) agent by choosing CMC > Servers > Server node > Placeholders.
The IS Enterprise Manager host and port are also configured here for the IS agent to communicate with the monitoring application. For more information, see Managing Servers in the SAP BOE CMC
Help guide.
For the JMX metrics to be available in IS, ensure that both the IS agent services and monitoring service are available on the AdaptiveProcessingServer Instance.
If you enable IS instrumentation, the code instrumentation is enabled automatically.
628 2012-12-12
Monitoring
19.7 Creating Universe for Derby Database
You create a universe for Derby database in order to run queries in the Derby database to create reports and perform data analysis. For more information on creating universes, refer to the SAP BOE Universe
Designer guide.
Note:
You create a universe for Derby database only after you run backup tasks for the database. For more information on database backup tasks, see Configuration Properties in the Related Topics.
1.
Create a universe for Derby database by running the Universe Design Tool wizard.
For more information on creating universe using the wizard, see Using the Quick Design Wizard in the SAP BOE Universe Designer guide.
You can create the universe using two database connections, Apache and Generic.
2.
If you select Apache connection, proceed as follows: a.
Click JDBC Drivers.
b.
Select the derby.sbo file from the location INSTALL_DIR\SAP BusinessObjects
Enterprise XI 4.0\dataAccess\connectionServer\jdbc c.
Add the classpath <ClassPath> <Path>\...\...\derby.jar</Path></ClassPath>
Download the latest derby.jar file (version 10.5.x) from the Apache website before adding the classpath.
d.
To create a new Apache database connection, enter the Derby database folder location in the
Server field.
If the database is located in C:\Derby, enter C:\Derby;create=false
3.
If you select Generic connection, proceed as follows: a.
Select Generic JDBC Datasource.
b.
Select the jdbc.sbo file from the location INSTALL_DIR\SAP BusinessObjects
Enterprise XI 4.0\dataAccess\connectionServer\jdbc c.
Add the classpath <ClassPath> <Path>\...\...\derby.jar</Path></ClassPath> and JDBC class details <Parameter Name="JDBC Class">org.apache.derby.jdbc.Em
beddedDriver</Parameter> d.
If you are creating a new Generic database connection, enter jdbc:derby:C:\Derby;cre ate=false in the URL field.
Monitoring Trend Data Universe is available at Universes > Monitoring TrendData Universes
Related Topics
•
629 2012-12-12
Monitoring
19.8 Audit DB Support for Monitoring
In SAP BusinessObjects Business Intelligence platform 4.0, the Monitoring application was packaged with an embedded database (Derby DB), and all the Monitoring information was available in this database. In SAP BusinessObjects Business Intelligence platform 4.0 FP3, users can now also utilize the Audit DB, which is the database where CMS stores the auditing data, for storing monitoring information.
Note:
At present, Monitoring does not support the 'SAP HANA Database'. Monitoring supports all other databases supported by CMS Auditing.
The next section contains the following topics and explains how to configure an existing Audit database to store the monitoring information:
• Pre-requisites
• Configuring SBO files
• Adding Alias names in the SBO
Note:
Before using the Audit database for storing your monitoring information, you should migrate data in the
Derby database to the Audit database. To do this, refer to
Monitoring Database Migration .
19.8.1 Pre-Requisites
1.
The Use Audit Database option should be selected in the "Monitoring Application Properties" page.
2.
The database information should already be configured in the "Auditing" page in CMC and the
Auditing application should be functioning properly. For more information on Auditing, refer to the
Auditing section of this guide.
19.8.2 Configuring SBO files
Internally, the Monitoring application uses Connection Server libraries and the SBO configuration is required for the Connection Server to establish connectivity to the database driver. You need to specify the database driver and its location in the SBO file to establish this connectivity.
630 2012-12-12
Monitoring
631
Example:
• If the Connection name field configured in CMC Auditing page is an ODBC DSN, the driver should be configured in: <Install_Dir>\dataAccess\connectionServer\odbc\<dbType>.sbo.
• If the database used for Auditing is MS SQL Server, the file where the driver needs to be configured is: <Install_Dir>\dataAccess\connectionServer\odbc\sqlsrv.sbo.
• If the database used for Auditing is DB2, the file where the driver needs to be configured is: <In stall_Dir>\dataAccess\connectionServer\odbc\db2iseries.sbo
.
• If the Connection name field configured in CMC Auditing page is <hostName><Portnum><dbName>, the driver JAR should be configured in: dataAccess\connectionServer\jdbc\<dbType>.sbo.
Configuring SBO files
Typically, the ODBC libraries are already configured in the SBO files and you just need to add the alias names. If this is not the case, follow these examples to perform the configuration in the SBO file:
Example:
• If the database version used for Auditing is MS SQL Server 2008, the configuration in SBO should be:
<DataBase Active="Yes" Name="MS SQL Server 2008">
<Libraries>
<Library>dbd_wmssql</Library>
<Library>dbd_mssql</Library>
</Libraries>
<Parameter Name="Extensions">sqlsrv2008,sqlsrv,odbc</Parameter>
<Parameter Name="CharSet Table" Platform="Unix">datadirect</Parameter>
<Parameter Name="Driver Name">SQL (Server|Native Client)</Parameter>
<Parameter Name="SSO Available" Platform="MSWindows">True</Parameter>
</DataBase>
• If the database version used for Auditing is DB2, the configuration in SBO should be:
<DataBase Active="Yes" Name="DB2 UDB for iSeries v5">
<!-- You can add an alias here if you are using some connections that are defined with an older database engine -->
<Alias>DB2/400 V5</Alias>
<Alias>DB2/400 V4</Alias>
<Alias>DB2 for iSeries v4</Alias>
<Alias>DB2</Alias>
</Aliases>"
• If the database version used for Auditing is MySQL 5, the SBO should have this entry:
<DataBase Active="Yes" Name="MySQL 5">
<JDBCDriver>
<ClassPath>
<Path>C:\mysqljdbcdriver.jar</Path>
</ClassPath>
<Parameter Name="JDBC Class">com.mysql.jdbc.Driver</Parameter>
<Parameter Name="URL Format">jdbc:mysql://$DATASOURCE$/$DATABASE$</Parameter>
</JDBCDriver>
<Parameter Name="Driver Capabilities">Query,Procedures</Parameter>
<Parameter Name="Force Execute">Always</Parameter>
</DataBase>
<Parameter Name="Extensions">mysql5,mysql,jdbc</Parameter>
For more information on configuring the driver in SBO files, refer to the Data Access Guide.
2012-12-12
Monitoring
19.8.3 Adding alias names in the SBO file
As well as configuring the driver, users also need to add an alias in the SBO, under the database version that is being used for auditing. The following table lists the alias names that should be used for specified databases.
DB Name
Microsoft SQL Server
My SQL
SAP Max DB
IBM DB2
Sybase SQL Anywhere
Sybase Adaptive Server Enterprise
Oracle
Alias Name to be used in SBO
MS SQL Server
MySQL
MaxDB
DB2
Sybase SQL Anywhere
Sybase Adaptive Server Enterprise
Oracle
You need to use the specified names, as the Monitoring application searches the SBO for these names.
Example:
If the DB used for Auditing is MS SQL Server 2008, the alias needs to be added to the SBO as shown:
<DataBase Active="Yes" Name="MS SQL Server 2008">
<Aliases>
<Alias>MS SQL Server</Alias>
</Aliases>
<Libraries>
<Library>dbd_wmssql</Library>
<Library>dbd_mssql</Library>
</Libraries>
<Parameter Name="Extensions">sqlsrv2008,sqlsrv,odbc</Parameter>
<Parameter Name="CharSet Table" Platform="Unix">datadirect</Parameter>
<Parameter Name="Driver Name">SQL (Server|Native Client)</Parameter>
<Parameter Name="SSO Available" Platform="MSWindows">True</Parameter>
</DataBase>
After these steps have been performed, select the Use Audit Database option in "Monitoring Application
Properties" page, save the configuration, and restart the APS. Monitoring trending data will now be stored in the Audit database.
19.9 Monitoring Database Migration
632 2012-12-12
Monitoring
This feature explains migration of the Monitoring application database from Embedded Apache Derby
DB to a standard CMS Auditing database. This process involves various steps which are explained in the following topics:
• Pre-requisites
• DDL File for target DBs
• Creating CSV (Comma separated values) dumps
• Importing data to the target DB
• Validating the migration
19.9.1 Pre-requisites
The following pre-requisites must be in place before you start migrating your data:
1.
The database configured for CMS Auditing is working and that auditing is running properly.
2.
You have sufficient authorizations and database client applications on the target database to create new tables, import CSV dumps, and so on.
3.
All databases support the import of comma-separated values (CSV) files. Most database client software support the import of CSV files into the data base. Not many databases provide command line support for importing CSV dumps into the target database.
19.9.2 Preparing the Target Database
Follow these steps while preparing the target database:
1.
After installing version 4.0 FP3 of SAP BusinessObjects Business Intelligence platform, DDLs related to all the supported CMS auditing DBs are available in the <Install Dir>\ SAP
BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\Data\TrendingDB location. You will find seven different (.sql extension) files with the respective database name. For example: Oracle.sql for Oracle, Sybase ASE.sql for Sybase ASE Database, and so on.
2.
Go to the target database (in this case, the target DB is the database where CMS auditing has been configured) and run the .sql file. The following four Monitoring tables are created: MOT_TREND_DE
TAILS
, MOT_TREND_DATA, MOT_MES_DETAILS, and MOT_MES_METRICS. The required indexes are also created, along with the tables.
If all the tables are created with correct data types as mentioned in the .sql file, the database schema required for the Monitoring application is created.
19.9.3 Creating CSV dumps
633 2012-12-12
Monitoring
This section explains how to generate the CSV dump file required for migration. The CSV file contains comma-separated values of the embedded derby DB data content. The Monitoring application allows users to export content to CSV format. Follow these steps to export content to CSV format:
1.
In CMC, select Applications.
2.
Select Monitoring Application.
3.
On the "Monitoring Application Properties" page, click Export in the "Trending Database Settings" section.
The following four CSV files are generated in the default Trending Database location, which is <
BOE_Install_Dir>\SAP BusinessObjects\SAP BusinessObjects Enterprise XI
4.0/Data/TrendingDB
:
• MOT_MES_Details.csv
• MOT_Trend_Data.csv
• MOT_Trend_Details.csv
• MOT_MES_Metrics.csv
19.9.4 Restoring contents on the target database
The following steps need to be performed in order to restore the content to the target database:
1.
Enable Identity Insert
The Monitoring tables contain a number of IDENTITY columns. These are columns that auto-generate their values. Certain databases (for example MS SQL Server and SYBASE ASE) do not allow explicit insertion of values to these columns. During data migration, even these identity column values need to be migrated however. Users therefore have to enable the explicit insertion of these values using the following SQL command: SET IDENTITY_INSERT <TABLE NAME> ON
2.
Import the CSV dump file to target table
All software provided by database clients enables users to import the data from CSV to the table using either a menu option or a command. The user needs to use this option to import the data from the CSV file to the corresponding table.
Note:
It is recommended to import the contents of MOT_TREND_DETAILS first.
3.
Disable Identity Insert
Once the data has been imported, the user needs to disable the identity insert on the table using the following SQL command:SET IDENTITY_INSERT <TABLE NAME> OFF
Users have to disable the identity insert on a table after the data import in order to enable the identity insert on the next table. This is because the identity insert operation can be enabled on only one table at a time.
Enabling or disabling Identity Insert applies only to MS SQL Server and Sybase ASE. For other databases such as Oracle, MaxDb, Db2, MySQL, SQL Anywhere, this is not required. You can import the data to the tables directly.
634 2012-12-12
Monitoring
19.9.5 Validating the Migration
You can check if the import was successful by checking the data in the tables. Once you have done this, you can switch the database so that Monitoring trending information will be stored in the Audit database.
Note:
In a clustered scenario, users are expected to use the same instance of the Derby database for all the
Monitoring instances. If the user has more than one Derby DB instance in a clustered scenario, he/she should only import the data from one Derby instance of his/her choice. Importing data from multiple
Derby instances will result in data inconsistency and is therefore not recommended.
1.
On the "Monitoring Application Properties" page, select the Audit DB.
2.
Click Save and then Close.
3.
Restart the APS.
Monitoring information will now be stored in the Audit DB. Users will see the migrated data as well in the metric/watch/probe history graphs too.
19.10 Troubleshooting
This section provides step -by-step solutions to a wide range of problems that may occur in your work with the monitoring application.
19.10.1 Dashboard
Monitoring link is not displayed on the CMC page
• Check if the user has adequate access rights.
• Ensure that the user is added to the Monitoring User or Administrator group or to any other group that is a part of these groups.
Key Performance Indicators (KPIs) are not visible on the Monitoring Dashboard
• Check if the required metrics are visible by choosing CMS Server properties > Metrics.
• Ensure that the Central Management Server is responding as expected.
635 2012-12-12
Monitoring
Unable to launch the monitoring application
Download and install the latest Flash player (10.5.x).
19.10.2 Alerts
Unable to receive alerts on the Alerts page
• Check if the Enable Alert Notification in the Notification settings is selected.
• Ensure that you have adequate access rights to receive alerts.
• Check if the recent alerts are visible on the monitoring dashboard.
Note:
You can send a CR document to the e-mail ID you set to test if the SMTP is working as expected.
Unable to receive email notifications
• Check if the SMTP server is functioning.
• Check if the e-mail ID set to receive e-mail alerts is appropriate.
• Ensure that AdaptiveJobServer instance is enabled.
• Check the SMTP settings in the AdaptiveJobServer instance destination.
19.10.3 Watchlist
Unable to receive historical data for Watch
• Check for polling interval on the monitoring application Properties page.
• Check the trace file in the logging folder.
• Check if the Trending database location is specified on the CMC Applications page. For a clustered environment, ensure that the user has permissions to access the shared location. For more information, see Configuration Properties in the Related Topics.
• Check if the system time of the server and client is the same in a specific time zone.
An error occurred while retrieving synchronized live data
Check if the AdaptiveProcessingServer instance is running.
Watchlist tab is disabled
• Check if the Monitoring service is running.
• Check the monitoring service logs for error messages.
• Check if the servers and their metrics are visible in jConsole.
636 2012-12-12
Monitoring
Related Topics
•
19.10.4 Probes
Unable to schedule Probes
• Check if the AdaptiveJobServer instance is running.
• Ensure that the report CUID, that is used for Crystal reports and Web Intelligence documents, is appropriate.
• Ensure that the user has administrative rights or is a member of the Administrator group.
• Check if the user has adequate rights to open, refresh, export Crystal Reports or Web Intelligence documents that are used in the corresponding probes.
Probe schedule status is "pending"
• Check if the ProbeSchedulingService instance is installed.
• Check if the AdaptiveJobServer instance is running.
An error occurred while retrieving the trend data from the database
Check if the AdaptiveProcessingServer instance is running.
probeRun.bat fails to run successfully
• Check if java_home is set.
• Check if the correct parameters are entered in the command prompt.
Note:
Enter probeRun.bat –help in the command prompt to check if all the parameters are appropriate.
19.10.5 Metrics
Host metrics are not listed
• Ensure that SAPOSCOL is running.
• Ensure that the Enable Host Metrics option is selected on the monitoring application Properties page.
• Restart the AdaptiveProcessingServer instance for the changes to be effective.
• Ensure that Path to your installation of SAPOSCOL binary is appropriate.
637 2012-12-12
Monitoring
Error occurred while retrieving JMX Client
Check if the AdaptiveProcessingServer instance is running.
SAPOSCOL metric value is zero on the Metric page
• Ensure that SAPOSCOL is running.
• Execute the following on the host where SAPOSCOL is installed:
1.
saposcol –s to check the status
2.
saposcol –m to get a snapshot of the data collected by SAPOSCOL
19.10.6 Graph
Graphs show different times for the live and history modes
Ensure that the system time of the server and client is the same in a specific time zone.
Graph data is not displayed in history mode for a cluster scenario
Ensure that all the AdaptiveProcessingServer instances point to the same Derby database location.
638 2012-12-12
Auditing
Auditing
20.1 Overview
Auditing allows you to keep a record of significant events on servers and applications, which helps give you a picture of what information is being accessed, how it's being accessed and changed, and who is performing these operations. This information is recorded in a database called the Auditing Data
Store (ADS). Once the data is in the ADS, you can design custom reports to suit your needs. You can look for sample universes and reports on the SAP Developer Network .
For the purposes of this chapter, an auditor is a system responsible for recording or storing information on an event, and an auditee is any system responsible for performing an auditable event. There are some circumstances where a single system can perform both functions.
How Auditing works
The Central Management Server (CMS) acts as the system auditor, while each server or application that triggers an auditable event acts as an auditee. When an audited event is triggered, the auditee will generate a record and store it in a local temporary file. At regular intervals, the CMS communicates with the auditees to request these records and writes the data to the ADS.
The CMS also controls the synchronization of auditing events that occur on different machines. Each auditee provides a timestamp for the auditing events that it records. To ensure that the timestamps of events on different servers are consistent, the CMS periodically broadcasts its system time to the auditees. The auditees then compare this time to their internal clocks. If differences exist, they correct the time recorded for subsequent auditing events.
Depending on the type of auditee, the system uses one of the following workflows to record the events.
Server auditing
In cases of server generated events, the CMS can act as both Auditee and Auditor.
639 2012-12-12
Auditing
1.
An auditable event is performed by the server.
2.
The server auditee writes events in a temporary file.
3.
The auditor polls the auditee and requests a batch of auditing events.
4.
The server auditee retrieves the events from the temporary files.
5.
The server auditee transmits the events to the auditor.
6.
The auditor writes events to the ADS and signals the server auditee to delete the events from the temporary files.
Client logon auditing for clients connecting through CORBA
This includes applications such as SAP BusinessObjects Web Intelligence.
640
1.
The client connects to the CMS, which will act as the auditee. The client provides its IP address and machine name, which the auditee then verifies.
Note:
A port should be opened in the firewall between the client and CMS. More details on firewalls can be found in the security chapter of the
SAP BusinessObjects Business Intelligence Platform
Administrator Guide.
2.
The auditee writes events in a temporary file.
3.
The auditor polls the auditee and requests a batch of auditing events.
4.
The auditee retrieves the events from the temporary files.
5.
The auditee transmits the events to the auditor.
2012-12-12
Auditing
6.
The auditor writes events to the ADS and signals the auditee to delete the events from the temporary files.
Client logon auditing for clients connecting through HTTP
This includes online applications such as BI launch pad, Central Management Console, SAP
BusinessObjects Web Intelligence, and so on.
641
1.
The browser connects to the web application server, and logon data is submitted to the web application server.
2.
The BI platform SDK submits the logon request to the auditee (CMS), along with the IP address and name of the browser machine.
3.
The auditee writes events in a temporary file.
4.
The auditor polls the auditee and requests a batch of auditing events.
5.
The auditee retrieves the events from the temporary files.
6.
The auditee sends events to the auditor.
7.
The auditor writes events to the ADS and signals the auditee to delete the events from the temporary files.
Non-logon auditing for clients connecting through CORBA
This workflow applies to auditing SAP BusinessObjects Web Intelligence events when connecting through CORBA.
2012-12-12
Auditing
642
1.
The user performs an operation that may be audited.
2.
The client contacts the CMS to check if the operation is configured to be audited.
3.
If the action is set to be audited, the CMS communicates this information to the client.
4.
The client sends the event information to the Client Auditing Proxy Service (CAPS), hosted in an
Adaptive Processing Server.
Note:
A port in the firewall should be opened between each client and any Adaptive Processing Servers that hosts a CAPS, and also between each client and the CMS. More details on firewalls can be found in the security chapter of the
SAP BusinessObjects Business Intelligence Platform Administrator
Guide.
5.
The CAPS writes events in a temporary file.
6.
The Auditor polls the CAPS and requests a batch of auditing events.
7.
The CAPS retrieves the events from the temporary files.
8.
The CAPS sends the event information to the auditor.
9.
The auditor writes events to the ADS and signals the CAPS to delete the events from the temporary files.
Non-login auditing for clients connecting through HTTP
This workflow applies to auditing SAP BusinessObjects Web Intelligence events (except for logon events) when connecting through HTTP.
2012-12-12
Auditing
643
1.
The user initiates a potentially auditable event. The client application contacts the web application server.
2.
The web application checks to see if the event is configured to be audited.
Note:
The diagram shows the Auditor CMS being contacted, but any CMS in the cluster can be contacted for this information.
3.
The CMS returns the audit configuration information to the web application server, which passes this information back to the client application.
4.
If the event is configured to be audited, the client sends the event information to the web application server, which passes it to the Client Auditing Proxy Service (CAPS), hosted in an Adaptive Processing
Server (APS).
5.
The CAPS writes events in a temporary file.
6.
The auditor polls the CAPS and requests a batch of auditing events.
7.
The CAPS retrieves the events from the temporary files.
8.
The CAPS sends the event information to the auditor.
9.
The auditor writes events to the ADS and signals the CAPS to delete the events from the temporary files.
Clients that support auditing
The following client applications support auditing:
• Central Management Console (CMC)
• BI launch pad
• Open Document
• Analysis
• Live Office Web Services Provider
2012-12-12
Auditing
644
• Web Intelligence desktop
• Mobile
• Dashboard & Presentation Design
• Dashboard Manager
Note:
At least one instance of CAPS must be running in order to collect auditing events from the clients listed above.
Clients not listed above do not directly generate events, but some actions performed by the servers as a result of client application operations can be audited.
Auditing consistency
In most cases, where auditing is properly installed, configured, secured, and correct versions of all client applications are used, auditing will properly and consistently record all indicated system events.
It is important to keep in mind, however, that certain system and environment conditions can adversely affect auditing.
There is always a delay between the time an event occurs and its final transfer to the Auditor database.
Conditions such as the unavailability of the CMS or auditing database or loss of network connectivity can increase these delays.
As a system administrator, you should work to avoid any of the following conditions, which could result in incomplete auditing records:
• A drive where auditing data is stored reaches maximum capacity. You should ensure plenty of disk space is available for your auditing database and auditee temporary files.
• An auditee server is improperly removed from the network before it can transmit all audit events.
You should ensure that when removing a server from the network, sufficient time is allowed for audit events to post to the auditing database.
• The deletion or modification of auditee temporary files.
• A hardware or disk failure.
• Physical destruction of an auditee or auditor host machine.
There are also some conditions where audit events may be prevented from reaching the CMS-Auditor.
These can include:
• Users with older client versions.
• Transmission of auditing information may be blocked by improperly configured firewalls.
Note:
• Events generated by client applications contain information submitted from the client side, in other words outside the trusted area of the system. Therefore under some conditions this information may not be as reliable as information recorded by the system servers.
• If you want to remove a server from your deployment, you should first disable that server but keep it running and connected to your network until all the events in the temporary files have had a chance to transfer to the auditing database. The server's "Current Number of Auditing Events in the Queue" metric will show how many auditing events are waiting to be transferred, when this reaches zero you can stop the server. The location of the Temporary files is defined in the Placeholders for that node. See the Server Administration chapter for more details on placeholders.
2012-12-12
Auditing
• If you are going to use Client Auditing it is recommend that you create a dedicated Adaptive
Processing Server for the Client Auditing Proxy Service. This will ensure your best system performance. To increase your system's fault tolerance you may also want to consider running the
CAPS on more than one APS.
Related links
20.2 CMC Auditing page
The "Auditing" page in the CMC has the following areas:
• "Auditing Status Summary"
• "Set Events"
• "Set Event Details"
• "Configuration"
20.2.1 Auditing Status Summary
The "Auditing Status" Summary shows a set of metrics that help you optimize your auditing configuration and alert you to any issues that might affect the integrity of your auditing data. The status summary is at the top of the "Auditing" page in the Central Management Console.
The summary will also display warnings under the following circumstances:
• The connection to the Auditing Data Store (ADS) database is unavailable.
• There is no running or enabled Client Auditing Proxy Service, which prevents client events from being collected.
• An auditee has events that could not be retrieved (the server or servers affected will be identified).
This usually indicates a server was not properly stopped or shut down and still has events in the temporary files.
645 2012-12-12
Auditing
Auditing Status metrics
Metric Details
ADS Last Updated on The date and time the auditor CMS last started polling the auditees for their auditing events.
Auditing Thread Utilization The percentage of the polling cycle the auditor CMS spends collecting data from auditees, the remainder is time spent resting between polls.
If this reaches 100% the figure will be displayed in yellow, and means the auditor is still collecting data from the auditees when the next poll is due to begin. This may cause delays in the events reaching the ADS.
If this is happening frequently or persistently, it is recommend you either update your deployment to allow the ADS database to receive data at a higher rate (faster network connections or more powerful database hardware for example), or decrease the number of auditing events your system tracks.
Last Polling Cycle Duration
Duration of the last polling cycle in seconds. This indicates the maximum delay for event data to reach the ADS during the previous polling cycle.
• If under 20 minutes (1200 seconds), the figure will appear on a green background.
• If between 20 minutes and 2 hours (7200 seconds), it will appear on a yellow background.
• If over 2 hours, it will appear on a red background.
If this state persists and you consider the delay too long, it is recommend you either update your deployment to allow the ADS database to receive data at a higher rate (faster network connections or more powerful database hardware for example), or decrease the number of auditing events your system tracks.
CMS Auditor
ADS Database User
Name
The name of the CMS currently acting as auditor.
ADS Database Connection Name
The name of the database connection currently used by the auditor CMS to connect to the Auditing Data Store (ADS). For SQL Anywhere and HANA servers, it is the name of the ODBC connection. For other database types, it is the server name, connection port, and database name.
The user name the auditor CMS is using to log in to the ADS database.
646 2012-12-12
Auditing
20.2.2 Configuring Auditing events
The CMC Auditing page can be used to activate auditing and select which events will be audited across your entire system.
If you are not interested in certain events or event details, you can leave them unselected to gain additional system performance.
Note:
If you chose not to configure your ADS connection when you installed the BI platform, you will need to set up a connection to the database before you configure your auditing events. See Auditing Data Store configuration settings.
20.2.2.1 To configure auditing events
1.
In the Central Management Console, select the Auditing tab.
The Auditing page appears.
2.
Set the Set Events slider to the desired level.
The following table shows the four different settings for the slider and the events captured at each level.
647 2012-12-12
Auditing
648
Auditing Level
Off
Minimal
Default
Complete
Events captured
None
• Logon
• Logout
• Rights Modification
• Custom Access Level Modified
• Auditing Modification
Minimal events, plus:
• View
• Refresh
• Prompt
• Create
• Delete
• Modify
• Save
• Search
• Edit
• Run
• Deliver
Minimal and Default events plus:
• Retrieve
• Trigger
• Drill Out of Scope
• Page Retrieved
• LCM Configuration
• Rollback
• VMS Add
• VMS Retrieve
• VMS Check-in
• VMS Check-out
• VMS Export
• VMS Lock
• VMS Unlock
• VMS Delete
• Cube Connection
• MDAS Session
You select a custom set of events.
Custom
3.
If you selected Custom, click the events you want to capture on the list below the Set Events slider.
2012-12-12
Auditing
4.
Under "Set Event Details," click the optional details you want to record with the events. Recording fewer details will increase system performance.
Detail
Query
Folder Path Details
Rights Details
Description
If set, "Query" event detail (Detail ID 25) will be recorded for any event that queries a database.
If set, the following details will be captured:
• "Object Folder Path (Detail ID 71)"
• "Top Folder Name (Detail ID 72 "
• " Container folder path (Detail ID 64)"
If set, the following details will be captured:
• "Right Added (Detail ID 55)"
• "Right Removed (Detail ID 56)"
• "Right Modified (Detail ID 57)"
User Group Details
If set, the following details will be captured:
• " User Group Name (Detail ID 16)"
• "User Group ID (Detail ID 15)"
Property Value Details
If set, the "Property Value" event detail (Detail ID 29) will be captured when the properties of an object are updated. This is generated only for CMC,
BI launch pad, or SharePoint events.
5.
Click Save.
Note:
For client auditing, it may take up to two minutes after the changes have been made before the system will start recording data for any new events. Make sure you allow for this delay when implementing changes to the system.
20.2.3 Auditing Data Store configuration settings
If you chose not to set up an auditing database when you installed the BI platform, or you want to change the database location or settings, you can use the following steps to configure the connection to the
ADS.
This is also where you can configure how long auditing events will be retained in the database.
If you have performed an upgrade from a previous version of SAP BusinessObjects Enterprise XI 3.x
and have installed version 3.x of Business Objects Metadata Manager (BOMM), it is recommended to configure the ADS to use the same database or tablespace as BOMM.
649 2012-12-12
Auditing
Note:
If you are using an existing DB2 9.7 Workgroup as the auditing database then ensure that the database account is configured to have a page size over 8 kB.
20.2.3.1 To configure your Auditing Data Store database settings
1.
On the Central Management Console, select the Auditing tab.
The Auditing page appears.
2.
Under the "Configuration" heading, click ADS Database Type.
A list of supported database types appears.
3.
Select the database type you have set up for your auditing data.
4.
Under Connection Name, enter the name of the connection you have configured for the auditing database. For SQL databases this will be the ODBC name; all other databases will take the form
<serverhostname>,<port>,<databasename>
.
a.
If you are using an Microsoft SQL database with Windows authentication, enable the Windows
Authentication option.
5.
In the User Name and Password fields, enter the user name and password you want the auditor
CMS to use when logging onto the database.
6.
In the Delete events older than (days) field, enter the number of days you want information to remain in the database. (Minimum value 1, maximum value 109,500.)
Caution:
Data older than the number of days set here will be permanently deleted from the ADS; it cannot be recovered. You may want to consider periodically moving records to an archive database if you want to maintain long-term records.
7.
In the event the database connection is lost, if you want to manually reconnect the auditor-CMS to the database, de-select the ADS Auto Reconnect option.
Note:
If this is unchecked, you will need to manually re-establish a connection to the ADS if the connection is lost. This can be done by restarting the CMS, or enabling ADS Auto Reconnect. Events will be recorded and remain stored in the temporary files until the ADS is reconnected.
8.
Click Save.
9.
Restart the CMS.
20.3 Audit events
650 2012-12-12
Auditing
The following table shows all the auditing events in the system, and gives a brief description for each.
A list of the service types that create the events follows.
Event
Auditing Modification
Create
Cube Connection
Custom Access Level
Modified
Delete
Deliver
Drill out of scope
Description, and servers and clients that generate the event type
The system's auditing settings are modified.
• Central Management service
A new object is added to the system.
• Web Intelligence processing service
• Crystal Reports viewing and modification service
• Central Management service
• Web Intelligence
• Lifecycle Management
An OLAP Cube Connection operation is performed.
• Multi-Dimensional analysis service
Information for privileges are modified.
• Central Management service
An object is removed from the system.
• Central Management service
• Lifecycle Management service
An object is sent/delivered to a destination.
• Destination Delivery Scheduling service
• Crystal Reports Scheduling service
• Crystal Reports for Enterprise scheduling service
• Web Intelligence publishing and scheduling service
• Central Management service
• Program scheduling service
• Security Query Scheduling Service
• Platform Search Scheduling Service
• Probe Scheduling Service
A user of a Web Intelligence document has drilled down to a detail level outside the report's pre-loaded data.
• Web Intelligence
• Web Intelligence processing service
• Web Intelligence Common Services
• Web Intelligence Core Services
• Web Intelligence Engine Services
651 2012-12-12
Auditing
652
Event
Edit
LCM Configuration
Logon
Logout
Modify
MDAS Session
Page Retrieved
Prompt
Description, and servers and clients that generate the event type
The content of an object is changed.
• Web Intelligence processing service
• Dashboard service
• Web Intelligence
• Web Intelligence Common Services
• Web Intelligence Core Services
• Web Intelligence Engine Services
The configuration details of Lifecycle Management Console (LCM) are changed.
• Lifecycle Management
A user logs onto the system.
• Central Management service
A user logs out of the system.
• Central Management service
The file properties of an object are changed.
• Web Intelligence
• Lifecycle Management
• Central Management service
A multi dimensional analysis services operation is performed
• Multi-Dimensional analysis service
An SAP BusinessObjects Web Intelligence client retrieves additional information from the repository.
• Web Intelligence processing service
• Web Intelligence Common Services
• Web Intelligence Core Services
• Web Intelligence Engine Services
Information is entered for a object prompt.
• Dashboards cache service
• Live Office
• Crystal Reports scheduling service
• Crystal Reports for Enterprise
• Crystal Reports cache service
• Web Intelligence processing service
• Web Intelligence
• Web Intelligence Common Services
• Web Intelligence Core Services
• Web Intelligence Engine Services
2012-12-12
Auditing
Event
Refresh
Retrieve
Rights Modification
Rollback
Run
Description, and servers and clients that generate the event type
The data in an object is updated from the database at a user's request.
• Dashboards cache service
• Live Office
• Crystal Reports for Enterprise scheduling service
• Crystal Reports cache service
• Crystal Reports scheduling service
• Web Intelligence processing service
• Web Intelligence
• Web Intelligence Common Services
• Web Intelligence Core Services
• Web Intelligence Engine Services
An object is retrieved from the repository.
• Central Management service
The security information is changed for a user, group, or object.
• Central Management service
LifeCycle Manager is used to revert an object to a previous version.
• Lifecycle Management
A job is run.
• Lifecycle Management scheduling service
• Destination Delivery scheduling service
• Replication service
• Crystal Reports scheduling service
• Crystal Reports for Enterprise scheduling service
• Web Intelligence scheduling and publishing service
• Publication scheduling service
• Program scheduling service
• Lifecycle management
• Security Query Scheduling Service
• Visual Difference Scheduling Service
• Platform Search Scheduling Service
• Probe Scheduling Service
• Explorer
653 2012-12-12
Auditing
Event
Save
654
Search
Trigger
View
VMS Add
Description, and servers and clients that generate the event type
An object is saved after being updated or changed.
• Crystal Reports Enterprise Scheduling Service
• Crystal Reports Cache Service
• Multi-Dimensional Analysis Service
• Lifecycle Management Service
• Web Intelligence Processing Service
• Crystal Reports Viewing and Modification Service
• Crystal Reports Scheduling Service
• SAP BusinessObjects Mobile
• Analysis Edition for OLAP events
• Web Intelligence Common Services
• Web Intelligence Core Services
• Web Intelligence Engine Services
A search is performed.
• Search service
• Explorer
A file event is triggered.
• Event service
• Central Management service
An object is Viewed.
• Web Intelligence
• Web Intelligence processing service
• Central Management Console
• BI launch pad
• Dashboards cache service
• Crystal Reports cache service
• Crystal Reports viewing and modification service
• Dashboard service
• Open document
• Explorer
• SAP BusinessObjects Mobile
• Analysis Edition for OLAP
• Information Engine Service
• Web Intelligence Common Services
• Web Intelligence Core Services
• Web Intelligence Engine Services
An object is added to the LCM Version Management System.
• Lifecycle Management
2012-12-12
Auditing
Event
VMS Check in
VMS Check out
VMS Export
VMS Lock
VMS Unlock
VMS Retrieve
VMS Delete
Description, and servers and clients that generate the event type
An object is checked into the LCM Version Management System.
• Lifecycle Management
An object is checked out of the LCM Version Management System.
• Lifecycle Management
A resource is exported from the VMS.
• Lifecycle Management
A resource in the VMS is locked.
• Lifecycle Management
A resource in the VMS is unlocked.
• Lifecycle Management
An object is retrieved from the LCM Version Management System.
• Lifecycle Management
An object is deleted from the LCM Version Management System.
• Lifecycle Management
Events by Service-type
Service type
Authentication Update
Scheduling Service
Event types generated
• Deliver
• Run
BI Launch Pad
Central Management Service
View
• Auditing Modification
• Create
• Custom Access Level Modified
• Delete
• Deliver
• Logon
• Logout
• Modify
• Retrieve
• Rights Modification
• Trigger
Central Management Console View
655 2012-12-12
Auditing
Service type
Crystal Reports 2011
Scheduling Service
Event types generated
• Deliver
• Prompt
• Refresh
• Run
• Save
Crystal Reports Cache Service
• Prompt
• Refresh
• Save
• View
Crystal Reports for Enterprise
Scheduling Service
• Deliver
• Prompt
• Refresh
• Run
• Save
Crystal Reports Scheduling
Service
• Deliver
• Prompt
• Refresh
• Run
• Save
Crystal Reports Viewing and
Modification Service
•
• Create
Save
• View
Dashboards Cache Service
• Prompt
• Refresh
• View
Dashboard Applications
• Edit
• View
Destination Delivery Scheduling Service
• Deliver
• Run
Event Service Trigger
656 2012-12-12
Auditing
Service type
Information Engine Service
LCM Scheduling Service
LCM service
Event types generated
• Create
• Drill out of scope
• Edit
• Page retrieved
• Prompt
• Refresh
• Save
• View
Run
• Create
• Delete
• LCM console configuration
• Modify
• Rollback
• Run
• Save
• VMS Add
• VMS Checkin
• VMS Checkout
• VMS Delete
• VMS Export
• VMS Lock
• VMS Retrieve
• VMS Unlock
Live Office
Multi-Dimensional Analysis
Service
OpenDocument
Platform Search Scheduling
Service
Platform Search Service
Probe Scheduling Service
• Prompt
• Refresh
• MDAS Cube Connection
• MDAS Session
• Save
View
• Deliver
• Run
Search
• Deliver
• Run
657 2012-12-12
Auditing
Service type
Program Scheduling Service
Event types generated
• Deliver
• Run
Publication Scheduling Service Run
Replication Service
Security Query Scheduling
Service
•
•
Run
Run
Deliver
Users and Groups Import
Scheduling Service
•
• Run
Deliver
Visual Difference Scheduling
Service
Web Intelligence Application
Run
• Create
• Drill out of scope
• Edit
• Modify
• Page retrieved
• Prompt
• Refresh
• Save
• View
Web Intelligence Common
Service
• Create
• Drill out of scope
• Edit
• Page retrieved
• Prompt
• Refresh
• Save
• View
658 2012-12-12
Auditing
Service type Event types generated
Web Intelligence Core Service
• Create
• Drill out of scope
• Edit
• Page retrieved
• Prompt
• Refresh
• Save
• View
Web Intelligence Processing
Service
• Create
• Drill out of Scope
• Edit
• Page Retrieved
• Prompt
• Refresh
• Save
• View
Web Intelligence Scheduling and Publishing Service
•
• Deliver
Run
Event properties and details
Each event that is recorded by the BI platform includes a set of event properties and details.
Event properties will always be generated with an event, although some may not have values if the information is not applicable to a specific event. In the ADS, event properties are included in the table that stores the event, so they can be used to sort or group events when you create reports.
Event details record additional information about the event that is not included in the event's properties.
If an event detail is not relevant to a specific event, that event detail will not be generated. There is a set of common event details that can be generated for all event types when they are relevant. There are also sets of additional event details which are generated for specific event types. For example,
Prompt events record the values entered for the prompt in an event detail, but no other event type generates a prompt value event detail. In the ADS, details are stored on a separate table which is linked to the parent event.
Any multilingual data (such as object or folder names) will be recorded in the default language for the locale of the auditor CMS.
20.3.1 Audit events and details
659 2012-12-12
Auditing
660
The following sections list all of the event types, followed by a description of any properties and event details that are unique to those events. At the beginning of the section is a list of the properties and details that are common to all event types.
Note:
Some client programs do not have their own unique events, and rely on the common and platform events to capture relevant information about their operations.
Universal event properties and details
The following tables show what properties and event details are recorded for all events.
Event Property
Event_ID
Client_Type_ID
Service_Type_ID
Start_Time
Duration
Session_ID
Event_Type_ID
Status_ID
Object_ID
Description
A unique identifier for the event.
Identifier for the type of application that performed the event
Shows the ID of the type of service or application that triggered the event.
The start date and time when the event started (in GMT).
Duration of the event in milliseconds.
ID of the session during which the event was triggered.
Type of event (for example, 1002 for view).
Records if the action succeeds or fails ("0" = succeeded, "1" = failed). Some events will have additional status types, these are detailed with the descriptions of those events.
CUID of the object affected (if applicable). CUID of the alerting event for Trigger events.
Note:
All objects not saved in the CMS repository will have an ID of 0. These objects could be documents that have not yet been saved to the CMS database, or are stored locally on a client machine for example. You will need to use the Object_Name property to differentiate these objects.
User_ID
User_Name
Object_Name
Object_Type_ID
Object_Folder_Path
Folder_ID
CUID of the User that performed the event.
The user-name of the user the performed the event.
Name of the affected object (if applicable). Name of the alerting event for Trigger events.
CUID of object type (for example document, folder, and so on).
Full folder path to where the affected object is located in the CMS repository. For example, Sales/North America/East Coast
The CUID of the folder where the object is stored.
2012-12-12
Auditing
661
Event Detail
Error
Element ID
ID
1
2
Element Name 3
Element Type
ID
Parent Document ID
5
12
Universe ID 13
Universe Name 14
User Group
Name
15
User Group ID 16
Event Property Description
Top_Folder_Name Name of the top level folder the affected object is stored in. For example, if object is located in Sales/North America/East Coast then the value would be
Sales
.
Top_Folder_ID The CUID of the top level folder where the affected object is located. For example, if object is located in Sales/North America/East Coast then the value would be the CUID of the folder Sales.
Cluster ID
Action_ID
The CUID of the CMS cluster that recorded the event.
A unique identifier that can be used to tie together a sequence of events initiated by a single user action.
Description
Only recorded if the action fails; the text of any error messages that result from the attempt.
Name of an object that resides in a container object (Live Office document or Dashboard for example).
ID generated for an object that resides in a container object (Live
Office document or Dashboard for example).
The type of object in a container object that is being viewed or modified. Only generated if applicable.
• For a document instance: the CUID of the parent document.
• For parent documents: its own CUID.
CUID of the Universe used by the document or object. An event detail will be generated for each Universe, if more than one is used.
The name of the Universe used by the document/object. An event detail will be generated for each Universe, if more than one is used.
The user group name that the user performing the action belongs to. If the user belongs to multiple groups, an event detail will be generated for each group.
The user group ID that the user performing the action belongs to.
If the user belongs to multiple groups, an event detail will be generated for each group.
Common events
The following event types are common to all BI platform servers and clients.
View
User viewed a document / object.
2012-12-12
Auditing
• Event Type ID: 1002
Event Detail
Size
Container ID
ID
17
32
Container Type 33
Description
Size of the object (in bytes) that is the subject of the event.
The CUID of the container object (a dashboard, for example) that the object resides in (if applicable).
The application type of the container for the object (if applicable).
Note:
If you are using a search service then during document indexing you may notice a large number of
View events generated by the "System Account" user. This is caused by the search indexing service opening documents in order to build the search index.
Refresh
An object was refreshed from the database.
• Event Type ID: 1003
Event Detail
Size
ID
17
Description
Size of the object (in bytes) that is the subject of the event.
Note:
For View on Demand Crystal Reports this will be set to 0.
Number of Rows 63
Query
Universe Object
Name
25
31
The number of records the database server returned.
Note:
For View on Demand Crystal Reports this will be set to 0.
Records the SQL query used to refresh the data (optional, set in
CMC).
The name of the universe the document or object uses. An event detail will be generated for each universe accessed by the document or object.
662 2012-12-12
Auditing
Event Detail
Document
Scope
ID
36
Publication Instance ID
Live Office Object Type
37
10701
Prompt
A value was entered for a prompt.
• Event Type ID: 1004
Event Detail
Prompt name
ID
26
Prompt value
Document Scope
Publication Instance
ID
Name at Design
Time
Live Office Object
Type
27
36
37
90
10701
Description
The name assigned to the prompt ("Date" for example). A separate detail will be generated for each prompt in a document or object, and they will be grouped.
The value entered for a prompt. A separate detail will be generated for each value entered. These can be grouped together and related back to the prompt name.
Information on the intended scope of the document (for example:
Country=USA, Role=Manager).
ID of this instance of the publication. Only applies to publishing workflows.
The name of the Dashboards document at the time it was designed. This is only generated for Dashboards refreshes, or a
Dashboards or Live Office document that includes a prompt.
Identifies the type of object that is being refreshed in a Live Office document (a Crystal report for example). This will only be generated for Live Office documents where the embedded object includes a prompt.
Create
User created an object.
• Event Type ID: 1005
Description
Records information on the intended scope of the document from its publishing settings (for example: Country=USA, Role=Manager).
Only applicable to publishing workflows.
ID of this instance of the publication. Only applicable to publishing workflows.
Identifies the type of object that is being refreshed in a Live Office document (a Crystal report for example). This will only be generated for Live Office documents.
663 2012-12-12
Auditing
Event Detail
Size
Overwrite
Refresh on
Open
Description
ID
17
21
23
24
Description
Size of the object (in bytes) that is the subject of the event.
Records if the document or object is new or overwrites an existing object (0=New document or object, 1=overwrite of existing document or object).
Records if the document or object is set to be automatically refreshed on open (0=No refresh, 1=Refresh on open). Only generated if applicable.
Records any information in the document or object's description field.
Delete
User deleted an object.
• Event Type ID: 1006
Modify
User modified a file property or the file properties of an object.
• Event Type ID: 1007
Event Detail ID
Property Name 28
Property Value 29
Description
The name of the property that was modified. An event detail will be generated for each modified property.
The new value for any modified property of the document or object.
An event detail will be generated for each modified property.
Save
Saving or exporting a document or object locally, remotely, or to the CMS repository, in either its existing format or a different format.
• Event Type ID: 1008
• Statuses:
• "0" indicates the object was successfully saved locally
• "1" indicates the attempt failed
• "2" indicates the object was successfully saved or exported to a repository
• "3" indicates the object was successfully saved or exported to a new format
664 2012-12-12
Auditing
Event Detail
Size
File Name
Overwrite
Format
Refresh on
Open
ID
17
18
21
22
23
Search
A search was conducted.
• Event Type ID: 1009
Event Detail
Keyword
Category
Number of Rows
ID
19
20
63
Edit
User edited the content of an object.
• Event Type ID: 1010
Description
Size of the object (in bytes) that was saved or exported.
The full name the document or object was saved under. If the file is saved locally by a client application, the name will also include the file path.
Records if the document or object is new or overwrites an existing file. "0"=New document or object, "1"=overwrite of existing document or object.
Specifies the format of the document saved/exported, displayed as the common three-letter file extension ("doc" for a Microsoft Word file, or "pdf" for an Adobe PDF file, for example).
Records if the document or object is set to be automatically refreshed on open ("0"=No refresh, "1"=Refresh on open). Only recorded if applicable.
Description
The keywords of the conducted search.
Category used in the search (if applicable).
The number of rows returned by the search.
665 2012-12-12
Auditing
Event Detail
Size
Query
ID
17
25
Universe Object
Name
31
Container ID 32
Container Type 34
Container Folder Path
64
Description
Size of the object (in bytes) that is the subject of the event.
If the edit modifies an SQL query, records the new query. (This setting is optional and can be selected in the CMC Auditing page.)
The name of the universe the document or object uses. A separate detail will be generated for each universe accessed by the document or object.
The CUID of the container (a dashboard for example) that uses the object (if applicable).
The application type of the container for the object (if applicable).
Folder path for the container of the object (if applicable).
Run
A job was run.
• Event Type ID: 1011
• Statuses:
• "0" indicates the job was successful
• "1" indicates the job failed
• "2" indicates the job failed but will be reattempted
• "3" indicates the job was cancelled
Event Detail
Size
Document
Scope
ID
17
36
Description
Size of the document (in bytes) that was run.
Information on the intended scope of the document (for example:
Country=USA, Role=Manager).
Deliver
An object was delivered.
• Event Type ID: 1012
666 2012-12-12
Auditing
Event Detail
Size
ID
17
Destination Type 35
Document Scope 36
Publication Instance ID
Domain
37
38
Host Name
Port
From address
To address
39
40
41
42
File Name 18
Account Name 45
Printer Name 46
Number of copies 47
Recipient Name 48
Description
Size of the object (in bytes) that was delivered.
The destination of the document or object instance. For example, email, FTP, unmanaged disk, inbox, or printer.
Information on the intended scope of the document (for example:
Country=USA, Role=Manager)
ID of this instance of the document or object.
Records the SMTP server domain name for documents/objects distributed by email (if applicable).
Records the name of the SMTP or FTP host for documents/objects distributed by email or FTP (if applicable).
Records the SMTP or FTP server domain port for documents/objects distributed by email or FTP (if applicable).
Records the sender's address for documents/objects distributed by email (if applicable).
Records the recipient's address for documents/objects distributed by email (if applicable). Will also specify if the address is included in the To, CC, or BCC fields. An event detail will be generated for each intended recipient.
Records the file name of documents/objects distributed by email or FTP, or written directly to a disk that is not part of the Business
Objects deployment.
This records one of the following:
• For Inbox delivered objects, a list of BusinessObjects user account names.
• For FTP delivered objects, the FTP account name.
• For Unmanaged Disk delivered objects, the login account used.
• For SMTP delivered objects, the login account used for the
SMTP server.
The name of the printer the document or object was delivered to
(if applicable).
The number of copies of the document or object printed (if applicable).
User name or names of the recipient or recipients of the document or object. An event detail will be generated for each intended recipient.
667 2012-12-12
Auditing
668
Event Detail
Alerting Event ID
Alerting Event
Name
Delivery Type
ID
92
93
35
Description
The CUID of the Alerting event. This is generated only if the event was prompted by an alert.
The name of the alerting event. This is generated only if the event was prompted by an alert.
Indicates how the delivery was initiated:
• "0" indicates scheduled
• "1" indicates sent to a destination
• "2" indicates published
• "3" indicates an alert was triggered
Retrieve
An object is retrieved from the CMS.
• Event Type ID: 1013
Logon
A user logs on.
• Event Type ID: 1014
• Statuses:
• "0" indicates a concurrent-user license logon was successful
• "1" indicates a failed logon attempt
• "2" indicates a named-user license logon was successful
• "3" indicates a non-user (system) login was successful
Event Detail
Concurrent User
Count
ID
50
Hostname reported by client
51
Hostname resolved by server
52
IP address reported by client
53
IP address resolved by server
54
Description
The number of users on the system at the time the event was triggered.
Hostname of client as reported by client.
Hostname of client as resolved by server. If the client hostname cannot be resolved, no value will be recorded.
IP address of client as reported by the client.
IP address of client as resolved by the server. If the client IP cannot be resolved, no value will be recorded.
Logout
A user logs off.
2012-12-12
Auditing
• Event Type ID: 1015
Event Detail ID
Concurrent User
Count
50
Trigger
A file event is triggered.
• Event Type ID: 10016
Event Detail
File Name
ID
17
Description
The number of concurrent users on the system at the time the event was triggered.
Description
The name of the file that was being monitored and triggered the event.
20.3.1.1 Platform events
The following events are specific to the BI platform.
Rights modification
Right or rights for an object were modified.
• Event Type ID: 10003
669 2012-12-12
Auditing
Event Detail
Rights Added
Rights Removed
Rights Modified
Principal
ID
55
56
57
118
Description
The type of right added, the scope of the new right (which objects) and the object type it was applied to. The information will be structured according to the following example: added right=Export; new value=Granted; scope=Current object; applicable object type=all object types
.
The type of right removed, the scope of the new right (which objects) and the object type it was applied to. The information will be structured according to the following example: removed right=Export; previous value=Denied; scope=Current object; applicable object type=all object types
.
The type of right modified, the scope of the new right (which objects) and the object type it was applied to. The information will be structured according to the following example: modified right=Export; previous value=Granted; scope=Current object; applicable object type=all object types
.
The ID of a user or user group (principal) for whom security rights were modified.
Custom Access Level modified
A Custom Access Level was modified.
• Event Type ID: 10004
670 2012-12-12
Auditing
Event Detail
Rights Added
Rights Removed
Rights Modified
Principal
ID
55
56
57
118
Description
The type of right added, the scope of the new right (which objects) and the object type it was applied to. The information will be structured according to the following example: added right=Export; new value=Granted; scope=Current object; applicable object type=all object types
The type of right removed, the scope of the new right (which objects) and the object type it was applied to. The information will be structured according to the following example: removed right=Export; previous value=Denied; scope=Current object; applicable object type=all object types
.
The type of right modified, the scope of the new right (which objects) and the object type it was applied to. The information will be structured according to the following example: modified right=Export; previous value=Granted; scope=Current object; applicable object type=all object types
.
The ID of a user or user group (principal) for whom security rights were modified.
Auditing modification
A change was made to the system's auditing settings.
• Event Type ID: 10006
Event Detail
Event Type ID
Action
New Auditing Level
Old Auditing Level
ID
58
59
60
61
Description
Records the ID of the auditing event type that was enabled or disabled. If multiple event types are enabled or disabled in one action, an event detail will be generated for each event type.
Records which auditing events were enabled or disabled.
If the auditing level of detail is changed, records the new level setting (off, minimal, or default for example).
If the auditing level of detail is changed, records the previous level setting (off, minimal, or default for example).
671 2012-12-12
Auditing
Event Detail
Auditing option
ADS Connection
ID
62
70
Auto Delete Interval
105
Description
If an optional detail is enabled or disabled, the detail modified is recorded and whether it was enabled or disabled. If multiple details are enabled or disabled in a single action, a detail record will be generated for each modified detail.
If the connection to the Auditing Data Store is changed, this records the new connection settings using the following format:
DBType=Oracle,DBName=MyADS,Username=USR1,Pass word="*****",SSO=off,DBReconnect=on
. Only the details changed will be recorded. For example, if only the user name is updated, only Username="new" will be recorded.
Note:
The password information will always be obscured with * in the database.
This detail will record any changes to the Delete Events Older
Than field in the Auditing CMC page. This governs how many days auditing information will be maintained in the ADS.
20.3.1.2 SAP BusinessObjects Web Intelligence events
The following events are specific to the SAP BusinessObjects Web Intelligence component.
Drill Out Of Scope
User drilled out of the report's scope.
• Event Type ID: 10201
672 2012-12-12
Auditing
Event Detail ID
Object Instance 11
Number of
Rows
Query
63
25
Universe Object
Name
31
Universe Object
ID
32
Description
Records if the event is the result of a scheduled update or a user viewing the object ("0" = resulted from a user viewing the object,
"1" = resulted from a scheduled refresh of the object).
The number of rows the database server returned.
Records the query used to refresh the data (optional, set in CMC).
The name of the universe the document uses. An instance will be recorded for each universe accessed by the document.
The CUID of the universe the document uses. An instance will be recorded for each universe accessed by the document.
Page Retrieved
Web Intelligence document page was retrieved.
• Event Type ID: 10202
20.3.1.3 SAP BusinessObjects Analysis, edition for OLAP events
MDAS Session
An MDAS session operation is performed
• Event Type ID: 10300
• Statuses:
• "0" = A new session opened successfully.
• "1" = A new session failed.
• "2" = An existing session is closed.
MDAS Cube Connection
A Cube Connection operation is performed.
• Event Type ID: 10301
• Statuses:
• "0" = A new connection opened successfully.
• "1" = A new connection failed.
• "2" = An existing connection is closed.
673 2012-12-12
Auditing
Event Detail
Connection ID
Connection Name
Provider type
Cube Name
ID
94
95
96
97
Description
Unique identifier for the connection.
The name of the connection.
The type of provider for the cube.
The full name of the cube used.
20.3.1.4 Lifecycle management events
The following events are unique to the Lifecycle management for SAP BusinessObjects component.
Common details
All Lifecycle management events will have the following additional event details.
Event Detail ID
Element Cluster 6
Description
The CUID of affected clusters when Lifecycle management console performs an operation on objects located in different clusters. An event detail will be generated for each affected cluster.
Additional information on the object.
Element Comment
Primary Element
7
8
Element Status 9
Operation 10
If the element is a primary element, this detail will be set to "1"; if it is a dependent element, it will be set to "0".
If the operation element fails this detail will be set to "1"; otherwise it will be "0".
Describes the type of operation performed (for example Add, Delete, or Modify).
Configuration
Configuration of Lifecycle management is changed.
• Event Type ID: 10900
674 2012-12-12
Auditing
675
Event Detail
Configuration
Configuration
Before
Configuration
After
VMS Type
ID
100
101
102
10900
Description
A user views the Lifecycle management console configuration. The configuration displays as comma-separated value pairs, for example: rollback settings=enabled, port=900.
If the Lifecycle management console settings for an object are modified, records the previous configuration settings. Uses the same format as Configuration.
If the Lifecycle management console settings for an object are modified, records the new configuration settings. Uses the same format as Configuration.
The type of version management system.
Rollback
An object was rolled back to a previous Version Management System (VMS) version.
• Event Type ID: 10901
VMS Add
A resource is added to the VMS.
• Event Type ID: 10902
Event Detail
Version
ID
104
Description
Records the version number of the document in the Version
Management System.
VMS Retrieve
A resource is retrieved from the VMS.
• Event Type ID: 10903
Event Detail ID
Restore Deleted
Object
103
Version 104
Description
Indicates if a retrieved object had been deleted from the system.
"0" indicates the object was not deleted; "1" indicates the object was deleted.
Records the version number of the document in the VMS.
VMS Checkin
A resource is checked into the VMS.
• Event Type ID: 10904
2012-12-12
Auditing
676
Event Detail
Version
ID
104
Description
Records the version number of the document in the VMS.
VMS Checkout
A resource is checked out from the VMS.
• Event Type ID: 10905
Event Detail
Version
ID
104
Description
Records the version number of the document in the VMS.
VMS Export
A resource is exported from the VMS.
• Event Type ID: 10906
Event Detail
Version
ID
104
Description
Records the version number of the document in the VMS.
VMS Lock
A resource in the VMS is locked, to prevent users editing it.
• Event Type ID: 10907
Event Detail
Version
Locked By
ID
104
10901
Description
Records the version number of the document in the VMS.
The user name of the user who performed the action.
VMS Unlock
A resource in the VMS is unlocked, allowing users to edit it.
• Event Type ID: 10908
Event Detail
Version
Unlocked By
ID
104
10901
Description
Records the version number of the document in the VMS.
The user name of the user who performed the action.
VMS Delete
A resource is deleted from the VMS.
2012-12-12
Auditing
• Event Type ID: 10909
Event Detail
Version
ID
104
Description
Records the version number of the document in the Version
Management System.
677 2012-12-12
Auditing
678 2012-12-12
Platform Search
Platform Search
21.1 Understanding Platform Search
Platform Search enables you to search content within the SAP BusinessObjects Business Intelligence repository. It refines the search results by grouping them into categories and ranking them in order of their relevance.
In this version of SAP BusinessObjects Business Intelligence, Platform Search is enhanced with the following features to:
• Search for both BOE and Explorer content.
• Suggest a query for creating a document if it cannot find an existing document.
• Support both continuous and schedule-based indexing.
• Support indexing in a clustered environment.
• Set and modify the level of indexing.
• Provide advanced search configuration options.
• Support multilingual search and indexing.
• Provide an advanced search syntax.
• Support metadata, content, and dynamic facets.
• Support self healing based on the system load.
Note:
If you migrate from the previous version to a new version, the index is not migrated.
21.1.1 Platform Search SDK
Platform Search supports a public SDK that functions as an interface between the client application and Platform Search. It is publicly exposed to help you customize the search service and integrate it with your application.
When a search request parameter is sent through the client application to the SDK layer, the SDK layer converts the request parameter into XML-encoded format and passes it to the Platform Search Service.
For more information about the Platform Search API, see
SAP BusinessObjects Enterprise Java API
Reference.
679 2012-12-12
Platform Search
21.1.2 Clustered Environment
Platform Search can share the load across multiple nodes in a clustered environment. The deployment in a clustered environment optimizes system resources and enhances server performance.
Platform Search supports both horizontal and vertical clustering for both search and indexing features.
With clustered environments, it optimizes the performance of both search and index processes.
Load balancing
Platform Search supports load balancing for both indexing and searching. In a clustered environment, indexing and search requests can be executed on multiple nodes to share the load. Each node functions independently to index the content and create delta indexes. However, only one node in the cluster will act as a master index and merge the delta indexes into the master index. All nodes can access the master index. This enables simultaneous search requests.
Failover
The failover mechanism ensures that users can continue to search and the index operation without any disruption. When a node in the cluster becomes unavailable due to a technical failure or due to maintenance-related activities, another node automatically takes over the process of indexing and searching requests.
21.2 Setting Up Platform Search
21.2.1 Deploying OpenSearch
Platform Search supports the OpenSearch standard, enabling client applications to use the OpenSearch standard or format to communicate with Platform Search. OpenSearch is not installed by default with
SAP BusinessObjects Business Intelligence suite, so users need to deploy it manually as a separate
WAR file (opensearch.war) to an application server such as Tomcat used for SAP BusinessObjects
Business Intelligence or using the WDeploy tool. This file is copied into
{BOE_INSTALL_DIR}\warfiles\OpenSearch directory by the installer.
Note:
• Client programs need to follow the OpenSearch standards to communicate with Platform Search.
• When you install SAP BusinessObjects Business Intelligence, the Tomcat application server is installed by default.
680 2012-12-12
Platform Search
21.2.1.1 Deploying Manually
To deploy OpenSearch in an SAP BusinessObjects Business Intelligence environment, perform the following steps:
1.
Go to the following location: {installdir}/SAP BusinessObjects Enterprise 4.0\warfiles\
2.
Copy the OpenSearch folder into {INSTALLDIR}\Tomcat6\webapps.
3.
Change the configuration parameters in the OpenSearch\WEB-INF\config.properties file as mentioned below:
• CMS: the CMS name with port number such as, <CMS Name>:<Port Number>
• OpenDocURL: the URL of the OpenDocument application such as http://<tomcathost>:<connector port>/BOE/OpenDocument/opendoc/openDocument.jsp
• Proxy.rpurl: the reverse proxy server name is required if you want to use reverse proxy
• Proxy.opendoc.rpurl: the opendoc reverse proxy server name is required if you want to use the reverse proxy.
4.
Restart the Tomcat application server to deploy OpenSearch.
681
21.2.1.2 Deploying Using WDeploy
To deploy OpenSearch using the WDeploy, perform the following steps:
Note:
For Windows and Unix commands are mentioned respectively as wdeploy.bat <parameters> and wdeploy.sh <parameters>
.
1.
Update the config.<app server server> file located under <BOE_Install_Dir>\<Enter prise_DIR>\wdeploy\conf with the required Web application server parameters, such as the installation directory, instance name, admin port, admin user name and admin password.
2.
Change the configuration parameters in the OpenSearch\WEB-INF\config.properties file as mentioned below:
• CMS: the CMS name with port number such as, <CMS Name>:<Port Number>
• OpenDocURL: the URL of the OpenDocument application such as http://<Web Application
Server Host>:<connectorport>/BOE/OpenDocument/opendoc/openDocument.jsp
• Proxy.rpurl: the reverse proxy server name is required if you want to use reverse proxy
• Proxy.opendoc.rpurl: the opendoc reverse proxy server name is required if you want to use reverse proxy.
3.
Execute the wdeploy.bat <WEB_APPLICATION_SERVER>
-Dapp_source_dir=<LOCATION_OF_OpenSearch Webapp> -DAPP=OpenSearch deploy command from <BOE_Install_Dir>\<Enterprise_DIR>\wdeploy location
2012-12-12
Platform Search
For example, the following command deploys OpenSearch to a WebSphere 7 Web application server: wdeploy.bat websphere7 -Dapp_source_tree=<BOE_Install_Dir>\<Enterprise_DIR>\warfiles" -DAPP=OpenSearch deploy
4.
Restart the application server.
21.2.2 Configuring reverse proxy
To deploy Business Intelligence Web Applications on a Web application server located behind the reverse proxy server, configure reverse proxy server to map incoming URL requests to the correct WAR file.
To illustrate the configuration steps, we use Apache 2.2 Reverse Proxy server as an example. To configure Apache 2.2 Reverse Proxy server for OpenSearch:
1.
Set up the reverse proxy and make the changes in the WEB-INF\config.properties file of
OpenSearch.
2.
Enable the following context parameters and change the values accordingly.
• proxy.rpurl
: This is the reverse proxy URL for OpenSearch (such as http://machineIPAd dress/RP/OpenSearch/
).
• proxy.opendoc.rpurl
: This is the reverse proxy URL for Open Doc (such as http://ma chineIPAddress/RP/BOE/
).
3.
Update the httpd.conf file, located under the Apache Reverse Proxy installation folder, with the following settings:
•
ProxyPass /RP/BOE/OpenDocument/ http://<Tomcat host>:<Connector
Port>/BOE/OpenDocument/
•
ProxyPass /RP/OpenSearchRP/ http://<Tomcat host>:<Connector
Port>/OpenSearch/
•
ProxyPassReverseCookiePath /BOE /RP/BOE
•
ProxyPassReverseCookiePath /OpenSearchRP /RP/OpenSearchRP
4.
Restart the Apache 2.2 Reverse Proxy server.
21.2.3 Configuring Application Properties in CMC
To configure the Platform Search application properties, complete the following steps:
1.
Go to the "Applications" area of the CMC.
2.
Select Platform Search Application.
3.
ChooseManage > Properties. The "Platform Search Application Properties" dialog box appears.
682 2012-12-12
Platform Search
4.
Configure the platform settings that you want.
The configurable properties are described in the following table:
683 2012-12-12
Platform Search
Option
Search Statistics
Stop / Start Indexing
Deafult Index Locale
Description
Platform Search offers the following search statistics:
• Indexing Status: displays the status of the indexing process.
• Number of indexed documents: displays the number of documents that are indexed.
• Last indexed time stamp: displays the time stamp at which the document was last indexed.
Start or Stop Indexing options enable you to start or stop the indexing process when you want to switch from continuous crawling to schedule crawling, or for maintenance purpose.
To stop indexing, click Stop Indexing and then click OK in the confirmation dialog box.
Platform Search uses the locale specified in CMC page for indexing all the default BI documents.Once the document is localized the corresponding language analyzer is used for indexing.
Search is based on the Client 's product Locale and the weightage is given to client product locale.
You can configure the weightage in CMC configuration properties.
Crawling Frequency
684 2012-12-12
Platform Search
Option Description
You can index the entire SAP BusinessObjects BI platform repository by using the following options:
• Continous Crawling: With this opinion, indexing is continuous where the repository is indexed whenever an object is added, modified, ordeleted. It allows you to view or work with the most up-to-date BI platform content. Set by default, the continuous crawling updates the SAP BusinessObjects BI platform repository continuously with the actions that you perform. Continuous crawling works without a user's intervention and reduces the time taken for indexing a document.
• Scheduled Crawling: With this option, indexing is based on the schedule set by the Schedule options.
For more information about scheduling an object, refer to Scheduling an Object section of Platform Search in the SAP BusinessObjects
Business Intelligence platform CMC Online Help.
Note:
• If you select Schedule Crawling and set the Recurrence to an option other than Now Platform Search displays the date and time stamp when the document is scheduled to be indexed next.
• If you select Schedule Crawling, then the Start Indexing button is enabled and the Stop Indexing button is disabled.
• Once the scheduling is complete, the Stop Indexing button is disabled.
685 2012-12-12
Platform Search
Option
Index Location
Description
When the documents are indexed, they are stored in shared folders in the following locations:
• Master index location (indexes and speller): The master and speller indexes stored in this location. During a search workflow, the initial hits are retrieved using the Master Index and the speller indexes are used to retrieve suggestions. In a clustered BI platform deployment, this location should be on a shared file system that is accessible from all nodes in the cluster.
• Persistent data location (Content stores): The content store is placed in this location. It is created from the master index location and remains in sync with it. The content store is used to generate facets and process the initial hits generated from the Master Index location.
In a clustured SAP BusinessObjects BI platform deployment, content stores are generated at every node.
The persistent data location is the only index location that is affected by the clustered environment as it contains the content store folders.If
a machine has a single search service, then there will be only one content store location. For example, {bobj.enterprise.home}\data\PlatformSearchData\workspace\Server\ContentStores.
However, in a clustered environment, if there are multiple search services, then each search service will have one content store location.
For example, if you have two instances of a server running, then the content store locations would be as follows: a. {bobj.enterprise.home}\data\PlatformSearchData\workspace\Server\ContentStores.
b. {bobj.enterprise.home}\data\PlatformSearchData\workspace\Server1\ContentStores.
• Non-persistent data location ( Temporary files, Delta Indexes): In this location, the delta indexes are created and stored temporarily before being merged with the Master index. The indexed documents from this location are deleted once they are merged with the Master
Index.In addition, surrogate files (output of the extractors) are created in this location and stored temporarily until they are converted into delta indexes.
Note:
• All the index locations must be shared locations.
• You need to click Stop Indexing to modify the index location.
• If you modify an index location, you need to copy the content to a new location, else the existing index information will be lost.
686 2012-12-12
Platform Search
Option
Level of indexing
Description
You can tune the search content by setting the level of indexing in the following ways:
• Platform Metadata:An index is created only for the platform metadata information such as titles, keywords, and descriptions of the documents.
• Platform and Document Metadata: This index includes the platform metadata as well as the document metadata. The document metadata includes the creation date,modification date, and name of the author.
• Full Content: This index includes the platform metadata, document metadata, and other content such as:
• The actual content in the document.
• The content of prompts and LOVs.
• Charts, graphs, and labels.
Note:
When you modify the level of indexing, the indexing is initialized for the entire SAP BusinessObjects BI platform repository refresh.
687 2012-12-12
Platform Search
688
Option
Content Types
Description
You can select the following content types for indexing:
• Microsoft Word
• Microsft Excel
• Microsoft PowerPoint
• Text
• Adobe Acrobat
• Rich Text
• Crystal Reports
• Universe
• Web Intelligence
Rebuild Index
This option deletes all the existing indexed content and re-indexes the entire document from the start.
You can select the Rebuild index option irrespective of the indexing status. However, the Rebuild index option would not function if indexing is stopped, and you select the Rebuild index, save and close the Platform Search application.
When indexing is stopped, and you select the Rebuild index, save and close the Platform Search application, then re-open the configuration page and click Start Indexing, the stored rebuild index would re-index the entire document automatically.
If you do not want Platform Search to re-index the documents, you need to deselect the Rebuild index before clicking Start Indexing.
Documents Excluded from indexing
The Documents Excluded from Indexing option excludes documents from indexing. For example, you may not want extremely large Crystal reports to be made searchable to ensure the report application server resources are not overloaded. Similarly, you may not want publicationswith hundreds of personalized reports to be indexed.
By excluding particular documents, you can prevent them from being accessed by Platform Search. It is important to note that if a documentis already indexed before it is put into this group, the document may stillbe searchable. To ensure that documents in the Documents Excluded from
Indexing group are not searchable, you must rebuild the index.
By default only the Administrator account has full control of the Documents Excluded from Indexing. Other users with the following rights can only add documents to the Documents Excluded from Indexing group:
• View and edit rights on the category.
• Edit the document directly.
2012-12-12
Platform Search
5.
ChooseSave and Close.
Note:
If a user does not select the Rebuild Index option and changes the level of indexing or selects or deselects extractors, then the index is incrementally updated from the start without deleting the existing index.
21.3 Working with Platform Search
21.3.1 Indexing Content in the CMS Repository
Indexing is a continuous process that involves the following sequential tasks:
1.
Crawling: Crawling is a mechanism that polls the CMS repository and identifies objects that are published, modified, or deleted. It can be done in two ways: continuous and scheduled crawling.
For more information on continuous and scheduled crawling, refer to the Configuring Application
Properties topic in Related Topics.
2.
Extracting: Extracting is a mechanism to call the extractors based upon the document type. There is a dedicated extractor for every document type that is available in the repository. New document types can be made searchable by defining new extractor plug-ins. Each of these extractors is scalable enough to extract content from large documents that contain many records.
The following extractors are supported:
• Metadata extractor
• Crystal report extractor
• Web Intelligence extractor
• Universe extractor
• Agnostic extractors (MS Office 2003 and 2007 and PDF documents)
For more information on searchable documents types, refer to the Searchable content types topic in Related Topics.
3.
Indexing: Indexing is a mechanism that indexes all the extracted content through a third-party library, called Apache Lucene Engine. The time required for indexing varies, depending on the number of objects in the system, and the size and type of documents.
The search index is stored in a designated location on the file and contains all searchable content of the documents that are indexed.
For indexing to run successfully, the following servers must be running and enabled:
• InputFileRepositoryServer (IFRS)
689 2012-12-12
Platform Search
• OutputFileRepositoryServer (OFRS)
• CentralManagementServer (CMS)
• AdaptiveProcessingServer (APS)
If the object type is selected as Web Intelligence or Crystal report, the corresponding
WebIntelligenceProcessingServer or CrystalReportApplicationServer must be running and enabled for the respective object types selected.
4.
Content Store: The content store contains information such as id, cuid, name, kind, and instance extracted from the main index in a format that can be read easily. This helps to quicken the search process.
Related Topics
•
Configuring Application Properties in CMC
•
21.3.2 Indexing Failure Listing
The indexing failure listing provides a list of documents that fail to get indexed. platform Search offers three attempts for a document to get indexed. If a document fails to get indexed, it is listed in the indexing failure listing.
To view the indexing failure listing, complete the follwoing steps:
1.
Go to the "Applications" area of the CMC.
2.
Select Platform Search Application.
3.
ChooseActions > Indexing failure listing.
The "Platform Search Application" dialog box appears, displaying a list of documents with the following details:
• Title: displays the title of the document that failed to get indexed.
• Type: displays the name of the document type, such as Crystal Report and Web Intelligence, and the location of the document.
• Failure Type: displays the error code and the reason for index failure of the document. Click the
More info hyperlink to learn more about the stack trace of the cause of the error.
• Last attempted time: displays the time stamp of the last attempt to index a document.
21.3.3 Searching Results
690 2012-12-12
Platform Search
691
21.3.3.1 Pre- Search
21.3.3.1.1 Suggested Queries
When using Platform Search, a user may be trying to find answers to a specific question rather than looking for a specific object. These questions may or may not be answered in reports available in the
SAP BusinessObjects Business Intelligence repository.
Platform Search analyzes the structure of universes and existing reports in your SAP BusinessObjects
Business Intelligence repository and compares this information to the search request that the user has provided to suggest new SAP BusinessObjects Web Intelligence queries that may help users find the answers to their questions.
To create potential reports, Platform Search matches the words in all universes for dimension, measure, condition and filter value.
Platform Search looks for matches in the following information about universes or existing SAP
BusinessObjects Web Intelligence documents:
• Measures in universes that match words in the search input.
When a measure matches one of the search terms, that measure will be used in the resulting SAP
BusinessObjects Web Intelligence document.
• Dimension names in universes that match words in the search input.
When a dimension name matches one of the search terms, the resulting Web Intelligence document breaks down the information on this dimension.
• Query filters may be used to focus the data shown in the document. These query filters are generated by analyzing the search input.
• If the name of a universe condition matches one of the search terms, the condition is used as the filter.
• If there are field values in existing SAP BusinessObjects Web Intelligence documents whose names match search terms, a filter will be created from the dimension from the historical report with the matched value, using "equal to" as the condition operator.
If Platform Search has made enough matches that the resulting document will contain two result fields and one filter, the query is considered to be ready to run. In this case, the user can click to view the completed report.
If there are insufficient number of matches between universes and the document, you can edit the query before running it.
Platform Search suggests multiple queries if several universes matches the search input, or if the same word appears in two different matches, such as in the name of a dimension and as a filter value.
2012-12-12
Platform Search
21.3.3.1.2 Searchable Content Types
The content published to the BI platform is searchable with Platform Search. The object types are listed below with their corresponding indexed content:
Object Type Indexed Content
Crystal Reports (2008 and 2011)
Title, description, selection formula, saved data, text fields in any section, parameter values, and sub-reports.
Web Intelligence documents
Microsoft Excel documents (2003 and 2007)
Title, description, name of the universe filters used in the report, saved data, constants in the filter condition locally defined in the report, name of the universe measures used in the report, name of the universe objects used in the report, data in record set, and static text in cells.
Data in all non-empty cells, fields on the Summary page of the document properties (title, subject, author, company, category, keywords and comments), and text in document headers and footers.
For cells that use calculation or formula, the value after the evaluation is searchable. For number or date/time values, the raw data is searchable.
Microsoft Word documents (2003 and 2007)
Text in all paragraphs and tables, fields on the
Summary page of the document properties (title, subject, author, company, category, keywords and comments), text in document headers and footers, and numerical text.
RTF, PDF, PPT and TXT Files
All text in these files is searchable.
LCMJob, AFDashboard Page, Dashboards, ObjectPackage, Web service query (QaaWS), Profile, Discussions, InformationDesigner, widgets for SAP BusinessObjects BI platform, MDAnalysis, Publications, Flash, Analytic and Hyperlink
Metadata content is searchable.
692 2012-12-12
Platform Search
Object Type
693
Events
BI Workspace
Indexed Content
All events such as Custom events, System events, Crystal Reports events and Monitoring events are searchable. If an event is associated with a source, Platform Search surfaces the source along with the event.
Note:
Platform Search supports events for Crystal Reports for Enterprise.
• The title, description, and contents of the following BIW modules is indexed:
• Text module
• Web Page module
• Navigation List module
• Viewer module
• The title and description of a Compound
Module is indexed.
• Only the title of a Workspace Template Module is indexed.
• In the case of a Group module, the title and metadata of the modules within it, is indexed.
• The title, description, and CUID of InfoObject modules in BIW are indexed.
Note:
Since only the title and description of an embedded InfoObject module is indexed, attempts to search for the InfoObject content, will not return references to the embedded module. For example, if a CR is inserted in
BIW, its title and description is indexed. Any attempts to search for the contents of the CR will not return references to the embedded module.
• If a BIW contains multiple tabs and sub-tabs, the title and contents of each tab and sub-tab, is also indexed.
2012-12-12
Platform Search
694
Object Type
CR Next Gen
Universe
Indexed Content
Title, description, selection formula, saved data, text fields in any section, parameter values, and sub-reports.
The following objects in a CR Next Gen report are not supported:
• Cross Tab report
• Chart data extraction
• Images and associated metadata extraction
• Embedded OLE (for example, a Word document embedded in CR)
• Flash object extraction
Also, read data page by page of a CR Next gen report is not possible.
Data content is searchable.
Note:
By default, Universe Indexing option is enabled.
If you notice queries used by Platform Search to index universe content is long running that may impact DB server performance, then we recommend disabling universe indexing option in Central
Management Console (CMC). Example of query which Platform Search uses while indexing Universe content is Select distinct SampleColumn-
Name from SampleTableName LIMIT 1000.
Steps to be followed to disable Universe Indexing are mentioned below:
• Logon to Central Management Console
(CMC).
• Choose Applications.
• Navigate to Platform Search Applications and choose Properties.
• Navigate to content types and uncheck Uni-
verse.
• Choose Save & Close.
Note:
The maximum size supported for Agnostic documents (MS Office 2003 and 2007 and PDF documents) is 15 MB.
2012-12-12
Platform Search
695
21.3.3.2 Search
When a user searches for a keyword from BI launch pad or any other application that uses the Platform
Search SDK, the master index is checked for their search terms. Based on the user's view rights, the search engine displays only those documents for which a user has the access rights.
21.3.3.3 Post- Search
21.3.3.3.1 Facets
Platform Search refines the search results by grouping them into categories or facets of similar object types, and ranking them in order of the number of occurrences of the category among the returned results for the search term. Facets enable you to navigate to the exact result.
Platform Search generates facets from InfoObject metadata, document metadata, and document content.
It displays only those facets that have more than two documents matching a specified query. Facets are surfaced dynamically based on the documents that match the search query and are sorted by document count.
The SAP BusinessObjects Business Intelligence documents are grouped into the following generic facets or categories:
• Personal or public (such as HR, Corporate, and Finance): this is based on the BI platform document categories.
• Document type: this is based on the document type such as Web Intelligence, Crystal Reports,
Microsoft Word (2003 and 2007), Microsoft Excel (2003 and 2007), and Dashboards.
• Universe and Connections: this is based on the content source.
• Date: this includes the last refreshed date: (year, quarter and month).
• Time: this includes the last refreshed time, such as, 24 hours and last week.
• Author: this is the name of the user who created the document.
21.3.3.3.2 Normalizing the Search Results Ranking
Platform search considers the place of occurence of the searched term for ranking a document. It groups the content into following categories based on the occurrence of the content in the document:
1.
Platform Metadata
2.
Document Metadata
3.
Content Metadata
4.
Content
2012-12-12
Platform Search
696
You can configure the weightage for the above mentioned categories in the CMC Page.
Customizing Weight for Ranking Search Results
Platform Search allows you to set weights for the content grouped in categories based on the occurrence of the content in the document, so that you can set a higher value for the desired category to retrieve related search results faster.
To set the weight, perform the following steps:
1.
Go to the "Applications" area of the CMC.
2.
Select Platform Search Application.
3.
ChooseRanking. The" Ranking: Platform Search Application "dialog box appears displaying the weights of different content categories such as Platform Metadata, Document Metadata, Content
Metadata and Content. You can modify weights as per the requirement.
The User Locale is locale set in the Preference Locale in BI launch pad application.
4.
ChooseSave.
In an upgrade scenario, if ranking needs to be applied for documents that are already indexed, you need to rebuild the index. For more information, refer information on rebuild index in the
section.
21.3.3.3.3 Multilingual Support
Platform Search offers multilingual support to index content, retrieve search results and get suggestions in your desired language. to index all the SAP BusinessObjects Business Intelligence documents it uses the locale set in the Default Index Locale in the CMC application.
Once the InfoObject is localized, Platform Search uses the corresponding language analyzer to index the document.
Search is based on the locale set as the Client's Product Locale. Platform Search gives more weightage to the Client Product locale while retrieving search results. You can configure the weights in CMC configuration page.
21.3.3.3.4 Suggestions
Platform Search offer suggestions for incorrectly-spelt search queries. If the original search query does not yield any results, then Platform Search suggests the most probable terms based on the indexed content.
Suggestions appear as keywords with a hyperlink. Click a hyperlink to view a list of documents containing the keyword that may match your original query. These suggestions are determined algorithmically based on various objective factors.
If there are multiple terms that may match the original request, Platform Search suggests the top three suggestions in the language set as the Index locale in the CMC application.
Note:
Platform Search does not generate suggestions:
2012-12-12
Platform Search
• If the search queries contain fewer than three letters
• For attributed searches, such as Type: Crystal Report
• For universe metadata and content
• For multi-byte languages such as Chinese, Japanese, and Korean
21.3.3.3.5 Federating Search Results from SAP BusinessObjects Explorer
Platform Search federates the search request from SAP BusinessObjects Explorer and surface
InfoSpaces along with the SAP BusinessObjects Business Intelligence content.
The search results from SAP BusinessObjects Explorer are grouped by metadata categories. The supported facets for InfoSpaces include type, location, and refresh time.
SAP BusinessObjects Explorer sends the term frequency to Platform Search for each search term in the search query. Platform Search calculates the relevancy using a sum of the square root of the term frequencies. The resultant value is assigned as a score to each InfoSpace. The results are then sorted by score and sent to the client.
21.4 Integrating Platform Search with SAP NetWeaver Enterprise Search
SAP NetWeaver Enterprise Search 7.20 and above can use search service based on OpenSearch
(RSS and ATOM). It can delegate search requests to remote search service provider systems. In this case, OpenSearch is the service provider, NetWeaver Enterprise Search is the search results consumer, and SAP BusinessObjects Platform Search is the search service provider.
If a user submits a search request, SAP NetWeaver Enterprise Search forwards the search request directly to the OpenSearch provider. The provider replies to the search request and sends the reply back to SAP NetWeaver Enterprise Search. It is then merged with the results received from other search object connectors to a search result and displayed on the user interface.
To integrate SAP NetWeaver Enterprise Search and Platform Search, you need to perform the following steps:
1.
Create a connector in SAP NetWeaver Enterprise Search.
2.
Import a user's role in SAP BusinessObjects BI platform Authentication section.
21.4.1 Creating a Connector in SAP NetWeaver Enterprise Search
You can use a search object connector of type OpenSearch to integrate external search providers that offer a search function available through OpenSearch.
To create a connector in SAP NetWeaver Enterprise Search, you need the following pre-requisites:
697 2012-12-12
Platform Search
1.
The OpenSearch description service URL.
2.
The OpenSearch description service must be available in the RSS or ATOM format only.
Perform the following steps to create a connector in SAP NetWeaver Enterprise Search:
1.
Launch the administration cockpit and choose Create.
2.
Select OpenSearch as the search object connector type.
3.
Choose Next.
4.
Enter the OpenSearch description service URL of the OpenSearch provider.
5.
Select any one of the following authentication settings to launch the description service URL:
• No Authentication: No authentication takes place.
• SAP Authentication Assertion Ticket: This user is used for authentication via SSO.
• User/Password: A predefined user is used for authentication.
6.
Select Launch Search URL from the OpenSearch URL settings.
The OpenSearch description service is then validated for a suitable search service. The system automatically enters a value for the search URL template and the associated description.
7.
Select any one of the following authentication settings to set up a connector:
• No Authentication: No authentication takes place.
• SAP Authentication Assertion Ticket: This user is used for authentication via SSO.
• User/Password: A predefined user is used for authentication.
8.
Choose Next.
A summary dialog box appears displaying the values entered for this search object connector.
9.
Choose Previous to modify the settings, or Cancel to discard all the entered data.
10.
Choose Finish to save the settings.
21.4.2 Importing a User's Role in SAP BusinessObjects Business Intelligence
Authentication
Perform the following steps to import a user's role in SAP BusinessObjects Business Intelligence
Authentication:
Note:
Administrator must have the user details, system information, and application host information and user credentials.
1.
Go to the "Authentication" area of the CMC.
2.
Choose SAP.
3.
Specify the following on the "Entitlement Systems" tab:
• System
• Client
• Application Server
• System Number
698 2012-12-12
Platform Search
• Username
• Password
• Language
4.
Choose Update.
5.
Choose"Role Import" tab and import user roles.
6.
Choose Update.
7.
Choose Manage > User Security in the CMC to assign the appropriate user's rights.
21.5 Searching from NetWeaver Enterprise Search
To search results from SAP NetWeaver Enterprise Search, perform the following steps:
1.
Log on to the SAP NetWeaver Enterprise Search application.
2.
Choose Advanced Search.
3.
Select the connector that was created for Platform Search.
4.
Search for a keyword.
Consolidated results for the keyword contain the result from Platform Search if there is a match on the keyword.
21.6 Auditing
All the events of search requests sent from a client application that uses the Platform Search Service and the search response are audited. For Platform Search, the auditing is implemented at the service level.
There is one event ID 1009 for Platform Search and there are four Platform Search specific event details such as:
• Keyword searched (ID: 19)
• Number of Search Results (ID: 63)
• Facet Search (ID: 20)
• Search Exception (ID: 1)
Apart from the above event details, there are a few standard event details like sessionCuid and userCuid which are supported for any auditing in any BOE module.
How auditing works in Platform Search is explained below with an example.
If you search a keyword such as "Sales", the total number of search results could be 5. In this case, the following events are audited:
• Event ID 1009
699 2012-12-12
Platform Search
• Event Detail ID 19 with the value sales
• Event Detail ID 63 with the value 5
• Session CUID
• User CUID
• Status with value 0 which is success state
• Start time
• Duration
• Object
• ID with value 0 since this is service side auditing
When Facets are generated and you select one or more facets, the following events are audited:
• Event ID 1009
• Event Detail ID 19 with the value sales
• Event Detail ID 63 with the value 5
• Event Detail ID 20 with comma separated string of facets
• Session Cuid
• User Cuid
• Status with value 0 which is success state
• Start time
• Duration
• Object ID with value 0 since this is service side auditing
If there is a search exception due to an invalid entry (for example *"a"), the following event details are audited:
• Event ID 1009
• Event Detail ID 19 with the value sales
• Event Detail ID 63 with the value 0
• Event Detail ID 1 with the exception message
• Session Cuid
• User Cuid
• Status with value 1 which is failure state
• Start time
• Duration
• Object ID with value 0 since this is service side auditing
21.7 Troubleshooting
700 2012-12-12
Platform Search
21.7.1 Self Healing
Platform Search has its own self-healing mechanism. It continuously monitors the search service memory usage and stops indexing automatically when memory usage exceeds the threshold value. It automatically starts after the memory usage reduces to a reasonable limit. However, users can continue to search during this process but cannot index for a specific period of time. By default, Platform Search configures the number of documents that can be indexed at any instant, based on the document type. The indexing is initiated based on the system resources like CPU and memory.
21.7.2 Problem Scenarios
This section provides step-by-step solutions to a wide range of problems that may occur while retrieving search results with Platform Search.
Unable to retrieve search results from the newly added document containing the keyword
• Check if Platform Search supports the document type of the submitted document. If the document type is not supported, then the document is not indexed.
For more information about supported document types, refer to the topic Searchable Content Types in the Related Topics listed below.
• Check the option selected for Crawling Frequency. If the Crawling Frequency is set to Continuous
crawling, documents are picked immediately for indexing. If the Crawling Frequency is set to
Scheduled crawling, indexing is executed only during the scheduled time period.
For more information about Crawling Frequency, refer to the topic Configuring Application Properties in the Related Topics listed below.
• Check the Indexing failure listing to verify if the document is indexed successfully. If the document is displayed in this list, then you need to modify and re-submit it so that Platform Search uses the document for indexing.
Note:
You can modify the document by adding or deleting a field and then saving it again. This updates the document's timestamp in the SAP BusinessObjects Business Intelligence platform repository and initiates the re-indexing of the document.
For more information about the document that failed to get indexed, refer to the topic
Indexing failure listing in the Related Topics listed below.
• Check the Adaptive Processing Server trace logs containing information about the indexing failure.
1.
In the file system, go to {BOE Install Dir}\logging\ containing the APS trace log with .gif extension.
2.
Open the trace log file and search for the document SI_ID, that needs to be indexed.
701 2012-12-12
Platform Search
Note:
You can find the document SI_ID from document properties.
Unable to retrieve Crystal Report documents
Platform Search indexes Crystal Report content only for versions 2008 and 2011. It does not index content for Crystal Reports for Enterprise.
However, for Crystal Reports for Enterprise you can search for document's metadata such as title, description and keyword, which is a part of document properties.
If the document contains indexable content, then you need to follow the same process as listed in the above mentioned section Unable to retrieve search results from the newly added document containing the keyword.
Unable to retrieve search results in the language set as the product locale in BI launch pad
Platform Search searches and indexes content from the BI platform repository based on the index locale set in CMC. If the product locale set in BI launch pad is different from the locale set in CMC, then
Platform Search does not retrieve any results.
For more information about configuring the index locale, see Configuring Application Properties in the
Related Topics listed below.
Unable to retrieve SAP BusinessObjects Explorer InfoSpaces
Check if SAP BusinessObjects Explorer servers are stopped or disabled. Enable the servers for Platform
Search to retrieve the search results from SAP BusinessObjects Explorer.
SAP NetWeaver Enterprise Search is unable to retrieve results from the SAP BusinessObjects
Business Intelligence Repository
• Check if Platform Search retrieves the search results using BI launch pad to find out if the problem is due to the Platform Search and SAP NetWeaver Enterprise Search integration.
• Check if OpenSearch is deployed correctly in the Web application server. The specific steps for validating the OpenSearch deployment depend on the type of Web application server in use.
• Check if the connector is created or configured correctly in the SAP NetWeaver Enterprise Search configuration. You need to use the correct connector for SAP NetWeaver Enterprise Search to federate results from Platform Search.
• Check if the communication is correct between the machines running SAP NetWeaver Enterprise
Search and BI platform respectively. In case of any network issues in a distributed environment,
SAP NetWeaver Enterprise Search may fail to federate the results.
• Check if SAP NetWeaver Enterprise Search user(s) are added tothe BI platform with appropriate rights. To validate the user's rights, go to the Authentication area of the CMC and select SAP.
Related Topics
•
Configuring Application Properties in CMC
•
702 2012-12-12
Federation
Federation
22.1 Federation
Federation is a cross-site replication tool for working with multiple Business Intelligence platform deployments in a global environment.
Content can be created and managed from one BI platform deployment and replicated to other BI platform deployments across geographical sites on a recurring schedule. You can complete both one-way replication and two-way replication jobs.
The benefits of Federation include the ability to:
• Reduce network traffic
• Create and manage content from a single site
• Increase performance for end users
When you replicate content using Federation, you can:
• Simplify administration needs for multiple deployments
• Provide a consistent rights policy across multiple offices for global organizations
• Obtain information faster and process reports at remote sites where data resides
• Save time by retrieving local and dispersed data faster
• Synchronize content from multiple deployments without writing custom code
Federation allows you to have separate security models, life cycles, testing, and deployment times, as well as different business owners and administrators. For example, you can delegate administration features that restrict the sales application administrator from changing a human resources application.
You can replicate a variety of objects with Federation, as described in the following table.
703 2012-12-12
Federation
Category
Business Views
Reports
Third-Party Objects
Users
Business Intelligence Platform
Universe
Object types you can replicate
Business View Manager, DataConnection,
LOVs, Data Foundation, and so on
Crystal reports, Web Intelligence, and Dashboard Design
Excel, PDF, PowerPoint, Flash, Word, text, rich text, and Shockwave Flash files users, groups, Inboxes, Favorites, and Personal Category
Folders, Events, Categories, Calendars, Access Levels, Hyperlinks, Shortcuts, Programs,
Profiles, Object Packages, Agnostic
Universe, Connections, and Universe Overload
Additional notes
All objects are supported, although not at the individual level.
Full client add-in and templates are supported.
The following scenarios highlight two examples of how your organization can use Federation.
Scenario 1: Retail (centralized design)
ACME store wants to send a monthly sales report to the different store locations using the one-way replication method. The administrator at the origin site creates a report that administrators at each destination site replicate and run against that store's database.
Tip:
Localized instances can be sent back to the origin site that maintain each object's replicated info. For example, it will apply the appropriate logo, database connection information, and so on.
Scenario 2: Remote Schedule (distributed access)
The data is at the origin site. Pending replication jobs are sent to the origin site to run. Completed replication jobs are then sent back to the destination sites for viewing. For example, the data for a report may not be available on the destination site, but the user can configure the reports to run on the origin site before the completed report is sent back to the destination site.
22.2 Federation terms
The following list of terms introduces words and phrases that relate to Federation and may assist with its navigation and use.
BI application
The logical grouping of related Business Intelligence (BI) content with a specific purpose and audience. A BI application is not an object. One BI platform deployment can host multiple BI applications, each of which can have a separate security model, life cycle, testing and deployment timeline, as well as separate business owners and administrators.
Destination site
704 2012-12-12
Federation
705
A BI platform system that pulls replicated BI platform content from an origin site.
Local
The local system where a user or administrator is connected. For example, the administrator of a destination site is considered “local” to the destination site.
Locally run completed instances
Instances that are processed on the destination site and then sent back to the origin site.
Multiple origin sites
More than one site can serve as an origin site. For example, multiple development centers generally have multiple origin sites. However, there can be only one origin site per replication.
One-way replication
Objects are replicated only in one direction: from the origin site to the destination site. Any updates made at a destination site remain at that destination site.
Origin site
The BI platform system where the content originates.
Remote
A system that is not local to a user. For example, the origin site is considered “remote” to users and administrators of the destination site.
Remote connection
An object that contains information used to connect to a BI platform deployment, including username and password, CMS name, WebService URI and clean-up options.
Remote scheduling
Schedule requests that are sent from the destination site to the origin site. Reports on destination sites can be scheduled remotely, which sends the report instance back to the origin site for processing. Then the completed instance is returned to the destination site.
Replication
The process of copying content from one BI platform system to another.
Replication job
An object that contains information about replication scheduling, which content to replicate, and any special conditions that should be performed when replicating content.
Replication list
A list of the objects to be replicated. A replication list refers to other content such as users, groups, reports, and so on, in the BI platform deployment to be replicated together.
Replication object
An object that is replicated from an origin site to a destination site. All replicated objects on a destination site will be flagged with a replication icon. If there is a conflict, objects will be flagged with a conflict icon.
Replication package
Created during the transfer, the replication package contains objects from a replication job. It can contain all the objects defined in the replication list, as in the case of a rapidly changing environment or initial replication. Or it can contain a subset of the replication list
2012-12-12
Federation if the objects change infrequently compared to the schedule of the replication job. The replication package is implemented as a BI Application Resource (BIAR) file.
Replication refresh
All objects in a replication list are refreshed regardless of the last modified version.
Two-way replication
Acts the same as one-way replication, but two-way replication also sends changes in both directions. Updates to the origin site are replicated to each destination site. Updates and new objects on a destination site are sent to the origin site.
22.3 Managing security rights
Federation replicates content between separate deployments and requires collaboration with other administrators, therefore it is necessary to understand security before you begin using Federation.
Administrators in separate deployments must coordinate with each other before enabling Federation.
After content is replicated, administrators can change content.
Specific rights on the origin and destination deployments are required to accomplish certain tasks:
• Rights required on the origin site
• Rights required on the destination site
• Rights required on Federation-specific objects
• Federation scenarios
Tip:
It is recommended that you read this chapter prior to enabling Federation.
22.3.1 Rights required on the origin site
This section describes the actions on the origin site and the required rights of the user account connecting to the origin site. This is the account you enter in the remote connection object on the destination site.
706 2012-12-12
Federation
Action
One-way replication
Description Rights required
Performs replication only from the origin site to the destination site.
Note:
“View” and “Replicate” rights are required on all objects being replicated, including objects that are automatically replicated by dependency calculations.
• “View” and “Replicate” rights on all objects you want to replicate
• “View” right on the replication list
Two-way replication
Performs replication from the origin site to the destination site, and from the destination site to the origin site.
• “View” and “Replicate” rights on all objects you want to replicate
• “View” right on the replication list
• “Modify Rights” right on user objects to replicate any password changes
Scheduling
Allows remote scheduling to occur on the origin site from the destination site.
• “Schedule” right for all objects that you want to remotely schedule
Related Topics
•
Rights required on the destination site
22.3.2 Rights required on the destination site
This section describes actions applied to the destination site and the required rights of the user account that is running the replication job. This is the account of the user who created the replication job.
Note:
Like other schedulable objects, you can schedule the replication job on behalf of someone else.
707 2012-12-12
Federation
Action
All objects
Description Rights required
Replicates objects regardless of one-way or two-way replication.
• “View”, “Add”, “Edit”, and “Modify Rights” rights on all objects
• “Modify User Password” right, for all user objects
First replication
The first time the replication job is run, no objects exist on the destination site yet.
Therefore, the user account that the replication job is running under must have rights for all top-level folders and objects that will have content added to them.
• “View”, “Add”, “Edit”, and “Modify Rights” rights on all top-level folders and default objects
Related Topics
•
Rights required on the origin site
22.3.3 Federation-specific rights
This section details scenarios that are specific to Federation.
708 2012-12-12
Federation
Action
Object cleanup
Description Rights required
Object cleanup deletes objects on the destination site.
• The account that the replication job is running under requires “Delete” rights on all objects that may be potentially deleted.
Disable cleanup for certain objects
When certain objects are replicated from the origin site, you may not want to delete them from the destination site if they are deleted on the origin site. You can safeguard this through rights. For instance, choose this option when users on the destination site start are using an object independently of users on the origin site.
• Deny “Delete” rights of the user account the replication job is running under on the objects you want to keep.
For example, in a replicated universe where users on the destination site create their own local reports using this universe, you may not want to lose the universe on the destination site if it is deleted from the origin site.
Two-way replication with no modifications on the origin site
In certain circumstances you may choose two-way replication but do not want some objects on the origin site modified, even if they are changed on the destination site. Reasons for this include: if the object is special and should only be changed by users on the origin site; or if you want to enable remote scheduling but do not want changes propagated back.
• Deny “Edit” rights of the user account used to connect in the remote connection object.
Note:
For remote scheduling, you can create a job that only handles objects for remote scheduling. However, in this case ancestor objects are still replicated, including the report, the folder containing the report, and the parent folder of that folder. Any changes made on the destination site are replicated to the origin site, and changes made on the origin site are replicated to the destination site.
709 2012-12-12
Federation
22.3.4 Replicating security on an object
To keep security rights for an object, you must replicate both the object and its user or group at the same time. If not, they must already exist on the site you are replicating to and have identical unique identifiers (CUIDs) on each site.
If an object is replicated and the user or group is not replicated, or does not already exist on the site you are replicating to, their rights will be dropped.
Example:
Group A and Group B have rights assigned on Object A. Group A has “View” rights and Group B has
“Deny View” rights. If the replication job replicates only Group A and Object A, then on the destination site, Object A will have only the “View” rights for Group A associated with it.
When you replicate an object, there is a potential security risk if you do not replicate all groups with explicit rights on the object. The previous example highlights a potential risk. If User A belongs to both
Group A and Group B, the user will not have permission to view Object A on the origin site. However,
User A will be replicated to the destination site because he belongs to both groups. Once there, because
Group B was not replicated, User A will have the right to view Object A on the destination site, but cannot view Object A on the origin site.
Objects that reference other objects that are not included in a replication job, or those not already on the destination site, are displayed in a log file. The log file shows that the object referenced the unreplicated object and dropped its reference.
Security on an object for a particular user or group is replicated only from the origin site to the destination site. You can set security on replicated objects on the destination site, but those settings will not be replicated to the origin site.
22.3.5 Replicating security using access levels
To persist, rights must be defined by access levels. The object, user or group, and access level must be replicated at the same time, or they must already exist on the site you are replicating to.
Objects that assign explicit rights to a user or group that are not included in the replication job, or not already on the destination site, are displayed in its log file, which shows the object had rights assigned that were not replicated and those rights were dropped.
In addition, you can choose to automatically replicate “Access Levels” that are used on an imported object. This option is available on the replication list.
Note:
Default access levels are not replicated, but references are maintained.
710 2012-12-12
Federation
22.4 Replication types and mode options
Depending on your selection of replication type and replication mode, you may create one of four different replication job options:
• One-way replication
• Two-way replication
• Refresh from origin
• Refresh from destination
22.4.1 One-way replication
With one-way replication, you can replicate content in only one direction, from the origin site to a destination site. Any changes you make to objects on the origin site in the replication list are sent to the destination site. However, changes you make to objects on a destination site are not sent back to the origin site.
One-way replication is ideal for deployments with one central BI platform deployment where objects are created, modified, and administered. Other deployments use the content of the central deployment.
To create one-way replication, select the following options:
• Replication type = One-way replication
• Replication mode = Normal replication
22.4.2 Two-way replication
With two-way replication, you can replicate content in both directions between the origin and destination sites. Any changes made to objects on the origin site are replicated to destination sites, and changes made on a destination site are replicated to the origin site.
Note:
To perform remote scheduling and to replicate locally run instances back to the origin site, you must select two-way replication mode.
If you have multiple BI platform deployments where content is created, modified, administered, and used at both locations, two-way replication is the most efficient option. It also helps synchronize the deployments.
To create two-way replication, select the following options:
711 2012-12-12
Federation
• Replication Type = Two-way replication
• Replication Mode = Normal replication
Related Topics
•
Remote scheduling and locally run instances
22.4.3 Refresh from origin or refresh from destination
When you replicate content in one-way or two-way replication modes, the objects on the replication list are replicated to a destination site. However, not all of the objects may replicate each time the replication job runs.
Federation has an optimization engine designed to help finish your replication jobs faster. It uses a combination of the object's version and time stamp to determine if the object was modified since the last replication. This check is done on objects specifically selected in the replication list and any objects replicated during dependency checking.
However, in some cases the optimization engine may miss objects, which won't be replicated. In these cases, you can use “Refresh from Origin” and “Refresh from Destination” to force the replication job to replicate content, and their dependencies, regardless of the timestamps.
"Refresh from Origin" only sends content from the origin to the destination sites. "Refresh from
Destination" only sends content from the destination sites to the origin site.
Example:
The following three examples describe scenarios using “Refresh from Origin” and “Refresh from
Destination” where certain objects will be missed due to the optimization.
Scenario 1: The addition of objects that contain other objects into an area that is being replicated.
Folder A is replicated from the origin site to the destination site. It now exists on both sites. A user moves or copies Folder B with Report B, into Folder A on the origin site. During the next replication,
Federation will see that Folder B's timestamp has changed and will replicate it to the destination site.
However, Report B's timestamp does not change. Therefore, it will be missed by a regular one-way or two-way replication job.
To ensure Folder B's content is properly replicated, a replication job with “Refresh from Origin” should be used once. After this, the regular one-way or two-way replication job will replicate it properly. If this example is reversed and Folder B is moved or copied on the destination site, then use “Refresh from
Destination”.
Scenario 2: The addition of new objects using LifeCycle Manager or the BIAR command line.
When you add objects to an area that is being replicated using LifeCycle Manager or BIAR command line, the object may not be picked up by a regular one-way or two-way replication job. This occurs
712 2012-12-12
Federation because the internal clocks on the source and destination systems may be out of sync when using the LifeCycle Manager or BIAR command line.
Note:
After importing new objects into an area that is being replicated on the origin site, it is recommended that you run a “Refresh from Origin” replication job. After importing new objects into an area that is being replicated on the destination site, it is recommended that you run a “Refresh from Destination” replication job.
Scenario 3: In between scheduled replication times.
If you add objects to an area that is being replicated and can't wait until the next scheduled replication time, you can use “Refresh from Origin” and “Refresh from Destination” replication jobs. By selecting the area where objects have been added, you can replicate content quickly.
Note:
• This scenario can be costly for large replication lists, so it is recommended that you do not use this option often. For example, it is not necessary to create replication jobs to refresh from the origin to destination mode on an hourly schedule. These modes should be used in “run now” or infrequent schedules.
• In some cases, you cannot use conflict resolution, including: “Refresh from Origin”: destination site option wins is blocked, or “Refresh from Destination”: origin wins option is blocked.
22.5 Replicating third-party users and groups
In Federation you can replicate third-party users and groups, specifically Active Directory (AD) and
LDAP users and groups.
Tip:
Read this section if you plan to replicate these types of users and groups or their personal content, such as favorite folders or Inboxes.
Mapping users and groups
1.
Map the users and groups on the origin site for Federation to replicate them properly.
2.
Replicate the mapped users and groups to the destination site.
Note:
Do not map groups and users separately on the destination site. If you do, they will have different unique identifiers (CUIDs) on the destination and origin sites, and Federation will not be able to match the user or groups.
713 2012-12-12
Federation
Example:
The administrator maps Group A with User A on the origin and destination sites. Both Group A and
User A have different unique identifiers on the origin and destination sites. During replication, Federation cannot match them and Group A or User A are not replicated due to an alias conflict.
Note:
• Before replicating third-party users and groups, the destination site must be set up to use AD or
LDAP authentication. However, you must also configure the destination site to use AD or LDAP so it can communicate to the directory server or domain controller.
• After replicating an AD or LDAP group for the first time, users in this group are unable to log on until the AD/LDAP Group Graph has been refreshed. This occurs automatically approximately every 15 minutes. To refresh AD/LDAP Group Graph manually, go to the "Authentication" page of the CMC, double-click Windows AD or LDAP, and then click Update.
• Be careful when replicating third-party groups. When you add new users to the group in the directory server, they will be able to log on to both sites. This security issue of AD or LDAP authentication is independent of Federation.
If you log on to the destination and origin sites separately, or the group membership is updated on both sites using the update button on the CMC authentication page, a user account is created on both sites. The accounts will have different unique identifiers and Federation won't be able to replicate them properly.
Note:
It is important to create the account on one site and then replicate it to the other.
22.6 Replicating universes and universe connections
When using Federation to replicate Universes between BI platform deployments, it is important to plan in advance. A Universe object cannot function without an underlying Universe Connection.
Universe Connection objects contain information required to connect to a reporting database. To function correctly, Universe Connection objects must contain valid information and allow a database connection to be established.
Note:
If you are using two-way replication and replicate a Universe from the origin site to the destination site without its Universe Connection, in subsequent replications the origin site's Universe may have its relationship to the Universe Connection on the origin site overwritten or removed. To avoid this, always replicate the Universe Connections with the Universes.
To ensure that dependent Universe Connections are replicated with the Universes, always select the following options when you create or modify the replication list that contains the Universes:
•
Include connections used by selected universes
•
Include universes required by selected universes
714 2012-12-12
Federation
Note:
If a Universe's relationship with its Universe Connection has been overwritten or removed, open the
Universe in Universe Designer, and under File > Parameters, modify the connection information.
The following two examples demonstrate the process of replicating Universes and their related Universe
Connections.
Example:
When replicating Universes and Universe Connections, you must ensure that the connectivity environment on the origin site matches the connectivity environment on the destination site.
For example, if the Universe Connection uses an ODBC connection called “TestODBC”, then there needs to be a correctly configured ODBC connection called “TestODBC” on the destination environment.
The ODBC connection can resolve to the same database or to a different database. To ensure that
Universes using this connection do not encounter connectivity issues, the schemas of the databases must be the same.
Example:
If you want the replicated Universe on the destination site to use a different database than the Universe on the origin site uses, replicate the Universe Connection, but have the connectivity information on the destination site point to the desired database.
For example, if the Universe Connection on the origin site is using an ODBC connection called “Test” pointing to “DatabaseA”, make sure you have an ODBC connection on the destination site that is also called “Test” but pointing to “DatabaseB”.
22.7 Managing replication lists
Replication lists include content, such as users, groups, and reports in the BI platform deployment, that can be replicated together. Replication lists are accessed from the CMC.
Content types that can be replicated are explained in the following table.
715 2012-12-12
Federation
Category
Repository objects
Reports
Third-party objects
Users
Business Intelligence
Platform
Universes
Supported objects
Objects that include Business Views, DataConnection, LOVs, Data Foundation, and more.
Note:
All objects are supported, although not at the individual level.
Crystal reports, Web Intelligence documents, and Dashboards objects.
Note:
Full Client Add-in and templates are supported.
Excel, PDF, PowerPoint, Flash, Word, text files, rich text files, Shockwave
Flash files.
Users, groups, Inboxes, Favorites, personal Category.
Folders, events, categories, calendars, custom roles, hyperlinks, shortcuts, programs, profiles, object packages, agnostic.
Universes, connections, universe overload.
Note:
The following objects must be created on the origin site and then replicated to the destination site. If you create these objects on the destination site and then replicate them to the origin site, they will not function on the origin site.
• Business Views
• Business Elements
• Data Foundations
• Data Connections
• Lists of Values
• Universe Overloads
22.7.1 Creating replication lists
Replication lists are located in the Replication Lists area of the CMC. You can organize replication lists in folders and subfolders that you create.
22.7.1.1 To create a replication list folder
1.
Go to the "Replication Lists" area of the CMC.
2.
Click Replication Lists.
716 2012-12-12
Federation
3.
Click Manage > New > Folder.
The "Create Folder" dialog box appears.
4.
Type a folder name and click OK.
You can now create replication lists in this folder.
22.7.1.2 To create a replication list
1.
Go to the "Replication Lists" area of the CMC.
2.
Select the folder where you want to save your new replication list.
3.
Click Manage > New > New Replication List.
The "New Replication List" dialog box appears.
4.
Type the title and description of the replication list.
5.
For advanced options, click the Replication List Properties link.
This allows you to specify which dependencies to automatically replicate from the origin site to the destination site.
6.
Select the required options as described in the table.
Dependency object options
Include personal folders for selected users
Definition
Replicates a selected user's personal folders and their content.
Include personal categories for selected users
Replicates a selected user's personal categories.
Include universes for selected reports Replicates any universe that selected report objects depend on.
Include members of selected user groups
Replicates users within a selected group.
Include universes required by selected universes
Replicates any universes that depend on other universes.
Include inboxes for selected users Replicates a selected user's Inbox and its content.
Include user groups for selected universes
Replicates the user groups associated with a universe's overloads.
Include access levels set on selected objects
Include documents for selected categories
Replicates any access levels used on any of the selected objects.
Replicates any documents, including Word, Excel, and
PDF, that are included in selected categories.
717 2012-12-12
Federation
Dependency object options Definition
Include supported dependencies for selected Flash objects
Replicates any Crystal reports, hyperlinks, Web Intelligence documents or universes that the Flash object depends on.
Include profiles for selected users and user groups
Include connections used by selected universes
Replicates any profiles associated with selected users or groups.
Replicates any universe connection objects used by selected objects.
Note:
Some objects in the BI platform are dependent on other objects. For example, a Web Intelligence document is dependent on the underlying universe for its structure and content. If you replicate a
Web Intelligence document but do not select the universe it uses, replication will not work on the destination site unless the universe was already replicated there. However, if you enable "Include universes for selected reports", Federation automatically replicates the universes that the report depends on.
7.
Click Next.
8.
Select one or more objects to add to your replication list.
• Use the arrow buttons to add or remove objects in the "Available Objects" folder.
• Or, click Repository objects under "Replicate all" to replicate all Business View, Business
Elements, Data Foundation, Data Connection, List of Values, and repository objects, including report images and functions.
Note:
It is not possible to replicate top level folders located in the "Available Objects" folder.
9.
Click Save & Close.
22.7.2 Modifying Replication Lists
After you create a replication list, you can modify its properties or objects.
22.7.2.1 To modify properties in a replication list
1.
Go to the "Replication Lists" area of the CMC.
2.
Select the Replication List you want to modify.
3.
Click Manage > Properties.
The General Properties dialog box appears.
718 2012-12-12
Federation
4.
Modify the title and description. You can also modify the other areas of the replication list while the
General Properties dialog box is open.
5.
If you want to modify dependency options, click Replication List Properties on the navigation list.
6.
Click Save & Close.
Related Topics
•
22.7.2.2 To modify objects in a replication list
1.
Go to the "Replication Lists" area of the CMC.
2.
Select a Replication List.
3.
Click Actions > Manage Replication List.
The "Manage Replication List" dialog box appears with a list of objects included in the replication list.
4.
Add or remove objects as desired.
5.
Click Save & Close.
Related Topics
•
22.8 Managing remote connections
Remote connection objects contain the information needed to connect to a remote BI platform deployment.
Note:
The remote connection object is created on a destination site BI platform deployment. The remote connection is the origin site.
You can view remote connections in the "Federation" area of the CMC.
22.8.1 Creating remote connections
719 2012-12-12
Federation
A remote connection in Federation connects to a remote BI platform deployment. To establish a connection to the origin site where the content to be replicated is located, you must first create a remote connection on the destination site.
You can create folders and subfolders to organize your remote connections.
22.8.1.1 To create a remote connection folder
1.
Go to the "Federation" area of the CMC.
2.
Click Remote Connections.
3.
Click Manage > New > Folder.
A Create Folder dialog box appears.
4.
Type a folder name and click OK.
You can now create remote connections in this folder.
22.8.1.2 To create a remote connection
To connect to a remote BI platform deployment, you must create a remote connection in Federation.
1.
Go to the "Federation" area of the CMC.
2.
Click Remote Connections.
3.
Click Manage > New > New Remote Connection.
The "New Remote System Connection" dialog box appears.
4.
Enter a title, description, and related fields as required:
Note:
All fields are mandatory, except “Description” and “Limit the number of cleanup objects”.
Field
Title
Description
Description
Name of the remote connection object.
Description of the remote connection object. (Optional)
720 2012-12-12
Federation
Field Description
Remote System Web Service URI URL to Federation Web Services, which is automatically deployed on your Java application server. You can use any
Federation Web Services in theBI platform whether they are the origin or destination site, or another deployment. Use this format: http://application_yourserver_ma
chine_name
:port/dswsbobje Example: http://myma
chine.mydomain.com
:8080/dswsbobje
Remote System CMS The name of the CMS you want to connect to that is accessible through Federation Web Services. This will be treated as the CMS for the origin site. This is the format:
CMS_Name:port Example: mymachine:6400
Note:
If you are using the default port 6400, specifying the port is optional.
User Name The user name that is used to connect to the origin site.
Note:
Ensure that the user name you are using has view rights on the replication list at the origin site deployment.
Password
Authentication
Cleanup Frequency (in hours)
Limit the number of cleanup objects to
The password of the user account to connect to the origin site.
The type of account authentication to connect to the origin site. Options are: Enterprise, AD, or LDAP.
How often replication jobs that use this remote connection object perform an object cleanup. Enter only positive whole numbers. The unit is hours. Default = 24.
The number of objects a replication job cleans up. (Optional)
5.
Click OK.
Related Topics
•
22.8.2 Modifying remote connections
721 2012-12-12
Federation
After you create a remote connection, you can modify its properties and security options.
To modify a remote connection:
1.
Go to the "Federation" area of the CMC.
2.
Click Remote Connections.
3.
Double-click the remote connection you want to modify.
The "Remote Connection Properties" dialog box appears. You can modify the following properties:
•
Title
•
Description
•
Remote System Web Service URI
•
Remote System CMS
•
User Name
•
Password
•
Authentication
•
Cleanup Frequency (in hours)
•
Limit the number of cleanup objects to
4.
Specify your changes.
5.
Click Save & Close.
22.9 Managing replication jobs
A replication job is a type of object that runs on a schedule and is used to replicate content between two BI platform deployments in federation.
Note:
Replicated objects on a destination site will be flagged with a replication icon as shown here: there is a conflict, an object will be flagged with a conflict icon as shown here:
If
You can view a list of replication jobs in the Remote Connection folder in the "Federation" area of the
CMC.
22.9.1 Creating replication jobs
A replication job is required to replicate content between two BI platform deployments in federation.
Each replication job must have only one remote connection and one replication list associated with it.
722 2012-12-12
Federation
22.9.1.1 To create a replication job
1.
Go to the "Federation" area of the CMC.
2.
Click Remote Connections.
3.
Select a Remote Connection to contain the new replication job.
Caution:
The CMC must be able to connect to Web Services in the remote connection URI to continue using the wizard.
4.
Click Manage > New > New Replication Job.
A "New Replication Job" dialog box appears.
5.
Type a title and description of the replication job.
6.
Click Next.
A list of available replication lists on the origin site appears.
7.
Select the Replication List you want to use with your replication job.
8.
Click Next.
9.
Select configuration options as described in the table below.
723 2012-12-12
Federation
Option
Enable object cleanup on destination
One-way replication
Two-way replication
Origin site takes precedence
No automatic conflict resolution
Destination site takes precedence (Only available with two-way replication)
Normal replication
Refresh from origin
Refresh from destination (Only available with two-way replication)
Description
Forces the replication job to delete any replicated objects on the destination site, where the originating object on the origin site was removed.
Note:
Object Cleanup will not delete objects replicated using dependencies or objects selected on the replication list.
Specifies that an object only replicates from the origin site to the destination site. Any changes made after replication to the object on the origin site are replicated to the destination site, but changes made on the destination site are not replicated back to the origin site.
Specifies that objects are replicated in both directions; from the origin site to the destination site, and from the destination site to the origin site. Changes made to these objects after replication at one site are then automatically replicated to the other site.
Specifies that when a conflict is detected between an object on the origin site and its replicated version on the destination site, the version on the origin site takes priority.
Specifies that no action is taken to resolve any detected conflicts.
Specifies that when a conflict is detected between an object on the origin site and its replicated version on the destination site, that the version on the destination site takes priority.
Specifies that the replication job acts normally.
Replicates all content from the origin site to the destination site whether it has changed or not. You can replicate the entire replication list or only a portion of it.
Replicates all content from the destination site to the origin site whether it has changed or not. You can replicate the entire replication list or only a portion of it.
724 2012-12-12
Federation
Option
Replicate all objects (Only visible with twoway replication)
Description
Replicates the entire replication list.
Note:
This is the most complete option but takes the longest to perform.
Replicate remote schedules (Only visible with two-way replication)
Replicates pending remote instances from the destination site to the origin site, and forces completed instances from the origin site to the destination site.
Replicate document templates
Replicates all objects that aren't instances (locally run or reports that are checked for remote scheduling). This includes users, groups, folders, reports, and so on.
Replicate locally run completed instances
Replicates completed instances only from the destination site to the origin site.
10.
Click OK.
Related Topics
•
•
Managing conflict detection and resolution
•
Remote scheduling and locally run instances
22.9.2 Scheduling replication jobs
After you create a replication job, you can schedule it to run once or on a recurring basis. You can also schedule multiple replication jobs on one destination site from one origin site.
Note:
If you schedule multiple replication jobs on one destination site, only one replication job can connect to the origin site at a time. All other replication jobs that try to connect will be moved to a pending state and remain pending until they are able to automatically connect to the origin site.
22.9.2.1 To schedule a replication job
1.
Go to the "Federation" area of the CMC.
2.
Select the Replication Job you want to schedule.
725 2012-12-12
Federation
3.
Click Actions > Schedules.
4.
Select the desired scheduling options.
22.9.3 Modifying replication jobs
After you create a replication job in Federation, you can modify its properties.
22.9.3.1 To modify a replication job
1.
Go to the "Federation" area of the CMC.
2.
Click Remote Connections folder.
3.
Select the Remote Connection object that contains the Replication Job you want to modify.
4.
Select the Replication Job you want to modify.
5.
Click Manage > Manage object properties.
6.
View and edit the Properties, Schedule, History, Replication List, and User Security, as necessary.
Sections
Properties
Schedule
History
Replication List
User Security
Description
Modify the name, description and other general properties and options of the replication job.
Set the replication job to run on a recurring schedule.
View and administer all instances of the replication job.
Change the selected replication list.
Set rights on the replication job.
22.9.4 Viewing a log after a replication job
Every time you run a replication job, Federation automatically produces a log file, which is created on the destination site. The log files use XML 1.1 standards and require a web browser that supports XML
1.1.
To view a replication log:
726 2012-12-12
Federation
1.
Go to the "Federation" area of the CMC.
2.
Click All Replication Jobs.
3.
Select a Replication Job from the list.
4.
Click Properties.
The replication job "Properties" page opens.
5.
Click History.
6.
Click the Instance time of the log file to view successful replication jobs, or click Failed status to view a log file of failed replication jobs.
7.
Select desired instance to view the log file.
The log file is generated in XML format and uses an XSL form to format the information into an
HTML page.
You can access the XML log from the computer that is running the Server Intelligence Agent that contains the Adaptive Job Server. You can find the log file at:
• Windows:<InstallDir>\SAP BusinessObjects XI 4.0\logging
• Unix:<InstallDir>/sap_bobj/logging
22.10 Managing object cleanup
In Federation, you should perform object cleanup throughout the lifecycle of your replication process, to make sure all objects that you delete from the origin site are also deleted from each destination site.
Object cleanup involves two elements: a remote connection and a replication job. A remote connection object defines general cleanup options, and a replication job performs the clean up when the appropriate interval passes.
22.10.1 How to use object cleanup
Separate replication jobs that use the same remote connection work together during object cleanup.
This means that your replication job will clean up objects within its replication list, as well as objects within other replication lists that use the same remote connection. A remote connection is only considered the same if the parent of the replication job is the same remote connection object.
Example:
Replication Jobs A and B replicate Object A and Object B. They both replicate from the same origin site and use the same remote connection. If the origin site deletes Object B , Replication Job A will see that Object B was deleted. Even though Replication Job B is the one replicating it, Object B will
727 2012-12-12
Federation also be removed from the destination site. When Replication Job B executes it won't need to run an object cleanup.
Note:
Only objects on the destination site are deleted during object cleanup. If you remove an object from the origin site that is part of a replication, the object will be removed from the destination site. However, if an object is removed from the destination site, it will not be removed from the origin site during object cleanup, even if the replication job is in two-way replication mode.
Objects that are deleted or removed from the replication list are not deleted from destination site. To properly remove an object that is specified in a replication list, you should delete it on both the destination site and the origin site. Objects that are replicated via dependency calculations are not deleted.
22.10.2 Object cleanup limits
In the remote connection object, you can define the number of objects a replication job will clean up at one time. Federation automatically tracks where the clean up job ends. This way, the next time you run a replication job, it starts the next clean up job at that point.
Tip:
To complete a replication job faster, limit the number of objects for cleanup.
Example:
Replication Jobs A and B are replicating Object A and Object B. Both objects are replicated from the same origin site and use the same remote connection.
If the origin site deletes Object B and the object limit is set to 1, the next time Replication Job A runs, it will only check if Object A has been deleted. This way, the Object B is not checked and will not be deleted.
Next, Replication Job B runs and starts the object cleanup at the point where Replication Job A ended.
It will check if Object B has been deleted and remove it from the destination site. You can find this option on the remote connection object's property “Limit the number of clean up objects to:”
Note:
If you do not select this option, all replication jobs that use this remote connection will check all objects for potential clean up.
22.10.3 Object cleanup frequency
728 2012-12-12
Federation
You can set the how often a replication job performs object cleanup in the remote connection “Cleanup
Frequency” field.
Note:
You must enter a positive whole number, which represents the number of hours to wait between object cleanup processing.
Example:
Replication Jobs A and B replicate Object A and Object B. Both objects are replicated from the same origin site and use the same remote connection.
If Object B is deleted from the origin site and all of the following conditions are true, the replication job will check if Object A has been deleted.
• The Object Limit is 1
• The cleanup frequency is 150 hours
• Replication Job A runs next
Because the object limit is 1, Object B will not be checked or deleted on the destination site.
The next cleanup occurs 150 hours after Replication Job A did the initial check. Although Replication
Jobs A and B may execute many times before the 150 hour limit, neither will attempt to run an object cleanup. After 150 hours, the next replication job will execute and attempt cleanup. Then it will determine that Object B was deleted on the origin site, and then delete it on the destination site.
Enabling and disabling options
Each replication job can participate in object cleanup. Use “Enable Object Cleanup on destination” option on a replication job to instruct it whether to run an object cleanup. In some cases, you may have high priority replication jobs you do not want to participate in object cleanup, so you can execute them as quickly as possible. To do this, disable object cleanup.
Related Topics
•
22.11 Managing conflict detection and resolution
In Federation, a conflict can occur when the properties of an object are changed on both the origin site and destination site. Both top level and nested properties of an object are checked for conflicts. For example, a conflict can occur if a report or the name of a report is modified on both the origin and destination sites.
Some instances do not create a conflict. For example, if the name of a report is modified on the origin site, and the description of the replicated version is modified on the destination site, the changes merge together and no conflict occurs.
729 2012-12-12
Federation
22.11.1 One-way replication conflict resolution
In one-way replication, you have two choices for conflict resolution.
Origin site takes precedence
If a conflict occurs during one-way replication, the origin site object takes precedence. Any changes to objects on a destination site are overwritten by the origin site's information. For example, if a report is modified on both the origin site and the destination site, the destination site modification will be overwritten by the origin site version after the next replication job.
Note:
Because the conflict is automatically resolved, it is not generated in the log file and does not appear in the conflicting object list.
No automatic conflict resolution
If a conflict occurs and you select “No automatic conflict resolution”, the conflict is not resolved, a log file is not generated, and it does not appear in the conflicting object list.
Administrators can access a list of all replicated objects that are in conflict in the Federation area of the
CMC. Objects in conflict are grouped together by the remote connection they used to connect to the origin site with. To access these lists, go to the Replication Errors folder in the Federation area of the
CMC, and select the desired remote connection. All replicated objects on a destination site will be flagged with a replication icon. If there is a conflict, objects will be flagged with a conflict icon. A warning message also appears in the "Properties" page.
Note:
• The list is updated when a replication job that uses a remote connection is completed. It contains all objects in conflict for all of the replication jobs that use its specific remote connection.
• Any user with access to the CMC and the replication job instances can access the XML log saved in the logfile directory. A destination site object's icon is flagged to indicate a conflict. During processing, a conflict log is created.
Abdul modifies Report A on the origin site. Maria modifies the replicated version on the destination site.
The next time the replication job runs, the report will be in conflict as it has changed on both sites and it will not be resolved.
The destination report is maintained and changes to the origin's report are not replicated. Subsequent replication jobs will behave the same way until the conflict is resolved. Any changes on the origin site are not replicated until the conflict is manually resolved.
Note:
In this case, the entire object is not replicated. Other changes that may not be in conflict are not brought over.
To manually resolve a conflict, you have three options:
730 2012-12-12
Federation
1.
Create a replication job that replicates only the objects in conflict. It must use the same remote connection object and replication list.
To keep the origin site changes, create a replication job. Then set replication mode to “Refresh from
Origin”, and set Automatic Conflict Resolution to “Origin site takes precedence”.
To keep the destination site changes, create a replication job with Replication Type = “Two-way replication”, Replication Mode = “Refresh from Destination”, and Automatic Conflict Resolution =
“Destination site takes precedence”
Note:
In replication mode, set “Refresh from Origin ” or “Refresh from Destination”, to select only the objects in conflict on the replication list. This way, other objects are not replicated. Next, schedule the replication job to run and it will replicate the selected objects and resolve the conflict as specified.
2.
Create a replication job that replicates only the objects in conflict. It will need to use the same remote connection object. However unlike option 1, you may create a new replication list on the origin site.
Use only the objects in conflict and create a new replication job which will use this focused replication list.
To keep the origin site changes, set the Automatic Conflict Resolution to “Origin site takes precedence”.
To keep the destination site changes, set Automatic Conflict Resolution to “Destination site takes precedence” and the Replication Type to “Two-way replication”.
3.
For one-way replication jobs, you may only delete the object on the destination site. The next time the replication job executes, it replicates the object from the origin site to the destination site.
Note:
Be careful when deleting an object because other objects that depend on it may be removed, stop working, or lose security. Options 1 and 2 are recommended.
22.11.2 Two-way replication conflict resolution
In two-way replication conflict, you have three choices for conflict detection:
• Origin site takes precedence
• Destination site takes precedence
• No automatic conflict resolution
Origin site takes precedence
If a conflict occurs, the origin site will take precedence and overwrite any changes to the destination site.
731 2012-12-12
Federation
Example:
Lily modifies the name of a report to Report A. Malik modifies the name of the replicated version on the destination site to Report B. After the next replication job runs, the replicated version on the destination site will revert to Report A.
This will not generate a conflict in the log file, and it will not appear in the conflicting object list because the conflict was resolved according to the user's instructions on the origin site.
Destination site takes precedence
If a conflict occurs, the destination site keeps its changes and overwrites them to the origin site.
Example:
Kamal modifies the name of a report to Report A. Peter modifies the name of the replicated version on the destination site to Report B. When the replication job runs, a conflict is detected. The name of the destination report remains as Report B.
In two-way replication, changes are also sent back to the origin site. In this scenario, the origin site is updated and its report name is changed to Report B. This does not generate a conflict in the log file and it will not appear in the conflicting object list because the conflict was resolved according to the user's instructions.
No automatic conflict resolution
When “No automatic conflict resolution” is selected, a conflict will not be resolved. The conflict will be noted in a log file for the administrator, who can manually resolve it.
Note:
• An object's icon is flagged to indicate that a conflict exists.
• Although changes are replicated to both origin and destination sites in two-way replication, only the destination site's versions will be flagged with a conflict icon.
Note:
Any user with access to the CMC and the replication job instances can access the XML log outputted in the logfile directory. A destination site object's icon is flagged to indicate a conflict. During processing, a conflict log is created.
The administrator can access a list of all replicated objects that are in conflict in the Federation area of the CMC. Objects in conflict are grouped together by the remote connection they used to connect to the origin site with. To access these lists, go to CMC > Federation > Replication Errors > Remote
Connection.
Note:
The list is updated when a replication job that uses a remote connection is completed. It contains all objects in conflict for all of the replication jobs that use its specific remote connection. All replicated objects on a destination site will be flagged with a replication icon. If there is a conflict, objects will be flagged with a conflict icon.
732 2012-12-12
Federation
733
Example:
Michael modifies Report A on the origin site. Damien modifies the replicated version on the destination site. When the next replication job runs, the report is in conflict as it has changed on both sites and will not be resolved.
The destination report is kept and changes to the origin's report are not replicated. Subsequent replication jobs behave the same way until the conflict is resolved. Any changes on the origin site will not get replicated until the conflict is manually resolved by the administrator or delegated administrator.
Note:
• In this case, the entire object is not replicated. Other changes that are not in conflict are not replicated.
• Any user with access to the CMC and the replication job instances can access the XML log outputted in the logfile directory. A destination site object's icon is flagged to indicate a conflict. During processing, a conflict log is created.
The administrator can access a list of all replicated objects that are in conflict in the Federation area of the CMC. Objects in conflict are grouped together by the remote connection they used to connect to the origin site with. To access these lists, go to CMC > Federation > Replication Errors > Remote
Connection.
Note:
The list is updated when a replication job that uses a remote connection is completed. It contains all objects in conflict for all of the replication jobs that use its specific remote connection. All replicated objects on a destination site will be flagged with a replication icon. If there is a conflict, objects will be flagged with a conflict icon.
To manually resolve a conflict, you have three options:
1.
Create a replication job that replicates only the objects in conflict. It must use the same remote connection object and replication list.
To keep the origin site changes, create a replication job. Then set the Replication Mode to “Refresh from Origin” and set Automatic Conflict Resolution to “Origin site takes precedence”.
To keep the destination site changes, create a replication job and set Replication Type to “Two-way replication”, set Replication Mode to “Refresh from Destination”, and set Automatic Conflict Resolution to “Destination site takes precedence”.
Note:
In Replication Mode, set “Refresh from Origin” or “Refresh from Destination”, to select only the objects in conflict on the replication list. This way, other objects are not replicated. Next, schedule the replication job to run and it will replicate the selected objects and resolve the conflict as specified.
2.
Create a replication job that replicates only the objects in conflict. It will need to use the same remote connection object. However unlike option 1, you may create a new replication list on the origin site.
Use only the objects in conflict and create a new replication job which will use this focused replication list.
To keep the origin site changes, set the Automatic Conflict Resolution to: “Origin site takes precedence”.
2012-12-12
Federation
To keep the destination site changes, set Automatic Conflict Resolution to: “Destination site takes precedence” and the Replication Type to: “Two-way replication”.
3.
Delete the object on the site you don't want it to be located.
Note:
Be careful when deleting an object because other objects that depend on it may be removed, stop working, or lose security. Options 1 and 2 are recommended.
To keep the destination site changes, you can delete the object on the origin site. The next time the replication job executes, it replicates the object from the destination site to the origin site.
Note:
Be careful when deleting a origin site's copy as other destination sites that replicate that object may execute their replication job before the copy has been replicated back. This will cause the other destination sites to delete their copy, which will be unavailable until the copy is returned.
To maintain the origin site changes, you can delete the object on the destination site.
22.12 Using Web Services in Federation
Federation uses Web Services to send objects and their changes between the origin and destination sites. Federation-specific web services are automatically installed and deployed in your BI platform installation. However, you may want to modify properties or customize deployments in Web Services to improve functionality, as described in this section.
Tip:
To improve file management and functionality, enable file caching in Federation.
22.12.1 Session variables
If you are transferring a large number of content files in one replication job, you may want to increase the session timeout period of the Federation Web Services.
The property is located in the dsws.properties file:
<App Server Installation Directory>\dswsbobje\Web-INF\classes
For example:
C:\Program Files\SAP BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\dswsbobje\WEB-INF\classes
To activate a session variable, enter: session.timeout = x
734 2012-12-12
Federation
Where “x ”is the desired time, “x” is measured in seconds. If not specified, the default value is 1200 seconds or 20 minutes.
The new properties take effect only after the modified web application is redeployed on the computer running the web application server. Use WDeploy to redeploy the WAR file on the web application server. For information on using WDeploy, see the SAP BusinessObjects Business Intelligence Platform
Web Application Deployment Guide.
22.12.2 File caching
File caching allows Web Services to handle very large attachments without buffering them in memory.
If it is not enabled during large transfer sizes, all of the Java's Virtual Machine memory can be utilized and replication may fail.
Note:
File caching decreases performance as the Web Services process to files instead of memory. You may use a combination of both options and send large transfers to a file and smaller ones into memory.
To enable file caching, modify the Axis2.xml file located at:
<App Server Installation Directory>\dswsbobje\Web-Inf\conf
For example:
C:\Program Files\SAP BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\dswsbobje\WEB-INF\conf
Enter the following:
<parameter name="cacheAttachments" locked="false">true</parameter>
<parameter name="attachmentDIR" locked="false">temp directory</parameter>
<parameter name="sizeThreshold" locked="false">4000</parameter>
Note:
Threshold size is measured in bytes.
The new properties take effect only after the modified web application is redeployed on the computer running the web application server. Use WDeploy to redeploy the WAR file on the web application server. For information on using WDeploy, see the SAP BusinessObjects Business Intelligence Platform
Web Application Deployment Guide.
22.12.3 Custom deployment
735 2012-12-12
Federation
Federation Web Services may deploy automatically and require the “federation”, “biplatform”, and
“session” services to activate. To disable Federation or any other Web Services, modify the corresponding
Web Services service.xml file.
BI platform Web Services are located in:
<App Server Installation Directory>\dswsbobje\WEB-INF\services
Example:
C:\Program Files\SAP BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\dswsbobje\WEB-INF\services
To deactivate Web Services:
• add “activate” property in the service name tag of the service.xml file and set it to false
• restart your Java application server
For example, to disable Federation:
The services.xml file is located in:
C:\Program Files\SAP BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\dswsbobje\WEB-INF\services\federator\META-INF
Change the service name from:
<service name="Federator">
To:
<service name="Federator" activate="false">
The new properties take effect only after the modified web application is redeployed on the computer running the web application server. Use WDeploy to redeploy the WAR file on the web application server. For information on using WDeploy, see the SAP BusinessObjects Business Intelligence Platform
Web Application Deployment Guide.
22.13 Remote scheduling and locally run instances
This section describes remote scheduling, locally run instances, and instance sharing. These features allow reports to run where the data resides and send completed instances to the appropriate locations.
22.13.1 Remote scheduling
736 2012-12-12
Federation
737
Using Federation, you can schedule a report on the destination site and then process it on the origin site. The completed instance will be returned to the destination site.
To enable remote scheduling, schedule a report as normal and enable the option “Run at origin site”.
To enable this option, click Schedule > Scheduling Server Group > Run at origin site. After the scheduled instances are created, they are placed in the pending stage.
During remote scheduling, information submitted on the destination site is disregarded and the report instance remains in the pending stage.
When the next replication job that manages the report is enabled for remote scheduling, it copies the instance to the origin site for processing. The instance remains in a pending state until the scheduler processes it. Meanwhile, the replication job that sent it will return any previously completed instances and object changes.
Once the instance has processed on the origin site, it reverts to a completed state. When the next replication job that manages the report is enabled for remote scheduling, it uses the completed instance to update the copy on the destination site. Once updated, the instance on the destination site is complete.
Note:
A replication job has to run twice to bring back one completed instance.
Example:
1.
Tom schedules Report A for remote scheduling.
2.
Report A is created on the destination site and is in the pending state.
3.
Replication Job A runs. First, it replicates changes from the origin site to destination site (including previously completed instances). Second, it copies the instance in the pending state to the origin site, as well as changes to be replicated from the destination site to the origin site.
4.
At the origin site, the scheduler picks up the instance in the pending state and sends it to the appropriate job server for processing. The instance is then processed and placed in the completed state on the origin site.
5.
Replication Job A runs again. When it replicates content from the origin site to the destination site, the completed instance Report A is picked up and changes are applied to the destination's version.
6.
Once this task is done, the destination's version is complete.
Remote scheduling only works with a two-way replication job. You must enable “Replicate remote schedules”. This option is located on the "Replication Job Properties" page in the “Replication Filters” area. In some scenarios, you may want to replicate remotely scheduled jobs more frequently than other objects on your replication list. To do this, create two replication jobs. Enable one job with “Replicate remote schedules” for a replication job that is only focusing on remote scheduling. Enable the other job with “Replicate document templates” or “Replicate all objects (no filter)”.
Note:
When you enable remote scheduling, completed and failed instances appear on both the origin and destination site.
If a user on the destination site schedules a report for remote scheduling and the user does not exist on the origin site, the instance will fail on the origin site. The owner of the failed instance will be the user account of the remote connection object used to connect to the origin.
2012-12-12
Federation
A replication job may only be configured for remote scheduling, but it always replicates the ancestor objects of the report instance. This means that if there are any changes between replications, it replicates the actual report, reports folder, and so on. If you do not want these changes on the destination site to be replicated to the origin site, you can use security rights to control which changes are replicated.
Related Topics
•
22.13.2 Locally run instances
Locally run Instances are instances of a report that are processed from reports on the destination site.
With Federation, you can replicate the completed instances from the destination site to the origin site.
To enable a replication job to replicate completed and failed instances from the destination site to the origin site, click Replication Job Properties > Replication Filters > Replicate locally run completed
instances.
In some cases, you may want a replication job to only replicate locally run instances. To do this, enable
“Replicate locally run completed instances”.
Note:
When you enable locally run Instances on a replication job, both completed and failed instances are replicated to the origin site. This means that there will be copies on both the origin and destination sites.
Pending instances are never replicated.
If the owner of a locally run instance does not exist on the origin site, then the owner will be the user account used to connect in the remote connection object.
22.13.3 Instance share
When you enable Remote Scheduling and Locally Run Instances in a replication job, instance share may occur if one origin site with multiple destination sites are replicating the same report.
Example:
Report A originates on the origin site, while destination sites A and B are replicating it. Instance share occurs at both destination sites:
• Enabled replication jobs with “Replicate remote schedules” and/or “Replicate locally run completed instances” Replicate Report A with the same replication job as above
• Schedule Report A on the destination site to “run at origin” and/or to run locally
738 2012-12-12
Federation
If both destination sites A and B replicate Report A and their corresponding replication jobs are replicating remote schedules and/or replicating locally run instances, then any instances that were processed at destination site A and/or at the origin site on behalf of destination site A will be shared with destination site B.
Similarly, any instances processed at destination site B and/or processed at the origin site will also be shared with destination site A. Finally, the origin site and destination sites A and B will have an identical set of instances.
Instance share is ideal in many cases. For example, when users from other sites need to access information from their sister deployments. In this case, to prevent instances from being viewed by users at the local site, ensure the proper security rights are set. For example, in a report object, apply the rights so users can see only the instances they own.
Note:
All objects follow the BI platform security rules. To ensure that users and groups can only view applicable instances, it is recommended that you set rights so that the users can only view instances that they own. For example, in a report object, apply the rights so users can see only the instances they own.
Related Topics
•
22.14 Importing and promoting replicated content
In some cases, you may choose to import or promote replicated content from one BI platform system to another. This section discusses these features in Federation.
Note:
Object migrations are best performed by members of the Administrators group, in particular the
Administrator user account. To migrate an object, many related objects may also need to be migrated.
Obtaining the required security rights for all the objects may not be possible for a delegated administrator account.
22.14.1 Importing replicated content
If you use the LifeCycle Manager to import content from one BI platform deployment to another, the
LifeCycle Manager does not import any of the replication-specific information associated with replicated objects that are being imported. This means that after the import, the object acts as if it was never replicated. This is specific to replicated objects on a destination site and is described in the following scenario.
739 2012-12-12
Federation
Example:
BI platform A is a destination site in a Federation process. Report A, a replicated report on System A, is imported from System A to BI platform B using the LifeCycle Manager.
Outcome: When Report A is copied to BI platform B, it doesn't contain any replicated information.
Report A will no longer be flagged with a replication icon. If the object was in conflict on BI platform
A, it will not be in conflict on System B. Essentially it is treated as an object that originated from System
B.
Note:
The CUID may or may not be the same, depending on the import choices you select in the LifeCycle
Manager.
22.14.2 Importing replicated content and continuing replication
After you've imported replicated content, you may want to include the imported objects in a Federation process. There are two scenarios: treat the system that the imported objects reside on as an origin site, or treat the system as a destination site. To treat this system as an origin site, proceed with Federation as normal.
To treat the system as a destination site and replicate the imported objects from the origin site, you must:
• Ensure the CUID of the objects are preserved when you use the LifeCycle Manager.
• Ensure the first replication job either has conflict resolution set to “Origin wins” or “Destination wins”.
Tip:
Instead of importing the object using LifeCycle Manager from one destination site to another, it is more efficient and highly recommended to only use Federation to replicate the object.
Example:
Report A was created on BI platform System A. System X used Federation to replicate Report A from
System A to System X. The LifeCycle Manager then imported Report A from System X to System Y.
Plan: System Y wants to set up Federation to System A, and keep Report A as part of Replication.
System Y is the destination and System A is the origin.
Action: When importing Report A from System X to System Y, the CUID of Report A must be preserved.
In addition, when the first Replication Job executes, it will try to replicate Report A. Because the object already exists on System Y, replication will produce a conflict. To specify which version to use, you must set the Conflict Resolution mode to either “Origin wins” or “Destination wins”.
Note:
In this example, it is recommended that instead of importing the object using LifeCycle Manager from one destination site to another, only use Federation to replicate the object. Report A will replicate from
740 2012-12-12
Federation
System A to System Y and it is unnecessary to use LifeCycle Manager to import from System X to
System Y.
22.14.3 Promoting content from a test environment
In any organization, testing is often done before placing anything into a production environment. It is normal to test Federation between BI platform systems in a development or testing environment prior to setting Federation up on your production machines. Once you create your origin site and destination sites and content in a testing environment, you can promote this set up to your production machines using the following steps:
1.
Use the LifeCycle Manager to promote your content from your origin site in the testing environment to the machine in production that will act as your origin site.
Note:
The replication list object is not selectable when using the LifeCycle Manager.
2.
Create the replication list on the origin site in the production environment and include the desired content.
3.
Choose from these two following options:
• A) Create a remote connection object and the appropriate replication jobs on the production machine(s) in production that will act as your destination site(s).
• B) Use the LifeCycle Manager to import the remote connection and replication jobs from the destination site in Dev/QA to the production machines that will act as destination site(s). Then edit the imported remote connections to point to the machine in production that will act as the origin site.
22.14.4 Re-pointing a destination site
Currently, after an object is replicated from an origin site, it must always be replicated from that origin site and cannot be replicated from another BI platform if the remote connection object is edited to point to a new system, any attempt to replicate an object that was replicated from a different BI platform system than the remote connection object will fail to replicate. To replicate an object from a different origin site, delete it from the destination site first.
Note:
After you copy a replicated object, the CUID of the copy is changed and the copy will not contain any replication information.
741 2012-12-12
Federation
22.15 Best practices
You can use Federation to optimize the performance of a replication job.
If there a large number of objects in a single replication job, you can take additional steps to ensure that it runs successfully. Typically, you should be able to replicate up to 32,000 objects in each replication job. However, some deployments may require configurations with smaller or larger replication sizes.
1) Obtain a dedicated Web Services provider
In Federation, replicated content is sent using Web Services. In a default installation of BI platform, all
Web Services use the same web service provider. Larger replication jobs may tie up the web service provider longer and slow down its response to other web service requests as well as any applications it serves.
If you plan to replicate a large number of objects at once, or run several replication jobs in sequence, you may consider deploying Federation Web Services on its own Java Application server using your own web services provider.
To do this, use the BI platform installer to install web services. You must have a Java Application Server already running. If you do not, install the entire Web Tier Components option, which will install web services and Tomcat.
Note:
• You must provide information for an existing CMS (for example, host name, port, and administrator password).
• You will need to use this new Web Services provider's URI in your remote connection's URI field.
2) Increase the Java Application Server's available memory
Increase the available memory of your Java Application Server if your single replication job replicates many objects, or if you are sharing the Application Server with other applications.
If you deployed BI platform and Tomcat, the default available memory is 1 GB. To increase the available memory for Tomcat:
In Windows:
1.
Click Start > Programs > Tomcat > Tomcat Configuration.
2.
Select Java.
3.
In the Java Options box, locate -Xmx1024M
4.
Increase the -Xmx1024M to the desired size.
Example:
To increase the memory to 2 GB, enter: -Xmx2048M
In Unix:
742 2012-12-12
Federation
1.
In the <BOE_Install_Dir>/setup/, open env.sh with your preferred text editor. Increase the
-Xmx1024m parameter to the desired size.
2.
Locate the following lines
# if [ -d "$BOBJEDIR"/tomcat ]; then
# set the JAVA_OPTS for Tomcat
JAVA_OPTS="-Dbobj.enterprise.home=${BOBJEDIR}enterprise120
-Djava.awt.headless=true" if [ "$SOFTWARE" = "AIX" -o "$SOFTWARE" =
"SunOS" -o "$SOFTWARE" = "Linux" ]; then
JAVA_OPTS="$JAVA_OPTS -Xmx1024m -XX:MaxPermSize=256m" fi export JAVA_OPTS
# fi
3.
Increase the -Xmx1024m parameter to the desired size.
Example:
To increase the memory to 2 GB, enter: -Xmx2048m
Tip:
For other Java application servers, refer to your Java application server's documentation to increase the available memory.
3) Reduce the size of the BIAR files being created.
Federation uses Web Services to replicate content between the origin site and destination site. Objects are grouped together and compressed into BIAR files for more efficient transportation.
When replicating a large number of objects, configure your Java Application Server to create smaller
BIAR files. Federation will package and compress objects across multiple smaller BIAR files so the number of objects you want to replicate will not be limited.
To reduce the size of the BIAR files created, add the following Java parameters to your java application server:
Dbobj.biar.suggestSplit
and
Dbobj.biar.forceSplit
bobj.biar.suggestSplit
suggests an appropriate size of the BIAR file, which it will try to meet.
Suggested new value is 90MB.
bobj.biar.forceSplit
will force a BIAR file to stop at a given size. Suggested new value is 100
MB.
Note:
You do not need to change the default BIAR file size settings unless your application server is running out of memory and its maximum heap size cannot be increased any further.
For Tomcat Windows:
1.
To open the Tomcat Configuration tool, click Start > Programs > Tomcat > Tomcat Configuration.
2.
Select Java.
743 2012-12-12
Federation
3.
In the Java Options box, add the following lines at the end:
-Dbobj.biar.suggestSplit=90
-Dbobj.biar.forceSplit=100
For Tomcat Unix/Linux:
1.
Open the env.sh with your preferred text editor. It is located in <BOE_Install_Dir>/setup/
2.
Locate the following lines:
# if [ -d "$BOBJEDIR"/tomcat ]; then
# set the JAVA_OPTS for tomcat
JAVA_OPTS="-Dbobj.enterprise.home=${BOBJEDIR}enterprise120 -Djava.awt.headless=true" if [ "$SOFTWARE" = "AIX" -o "$SOFTWARE" = "SunOS" -o "$SOFTWARE" = "Linux" ]; then
JAVA_OPTS="$JAVA_OPTS -Xmx1024m -XX:MaxPermSize=256m" fi export JAVA_OPTS
# fi
Add the desired BIAR file size parameters.
Example: JAVA_OPTS="$JAVA_OPTS -Xmx1024m -XX:MaxPermSize=256m
-Dbobj.biar.suggestSplit=90 -Dbobj.biar.forceSplit=100"
For other Java Application servers, consult your documentation to add Java system properties.
4) Increase the Socket Timeout.
The Adaptive Job Server is responsible for running the replication job. During the execution of the replication job, the Adaptive Job Server establishes a connection to the origin site. When receiving large amounts of information from the origin site, it is important that the Socket which the Adaptive Job
Server is using to receive information does not timeout.
The default value is 90 minutes. You can increase the Socket Timeout if you need to.
To increase the Socket Timeout on the Adaptive Job Server:
1.
Open the Central Management Console (CMC)
2.
Navigate to the Server section and select Adaptive Job Server.
3.
Click Properties.
4.
Add “Command Line Parameters” to the end of the following:
• Windows:-javaArgs Xmx1000m,Xincgc,server,Dbobj.federation.WSTimeout=<time out in minutes>
• Unix: -javaArgs Xmx512m,Dbobj.federation.WSTimeout=<timeout in minutes>
Related Topics
•
Troubleshooting error messages
•
Using Web Services in Federation
•
744 2012-12-12
Federation
22.15.1 Current release limitations
Federation is a flexible tool, however certain limitations may affect its performance during production.
This section highlights areas that you can modify to optimize your Federation operations.
• Maximum number of objects
Each replication job replicates objects between BI platform deployments. It is recommended that the maximum number of objects you replicate in a single replication job is 100,000. While a replication job may function with more than 100,000 objects, Federation only supports replicating up to 100,000 objects.
• Rights
In Federation, rights are only replicated from the origin site to the destination site. It is recommended that user rights common to both deployments are set on the origin site and replicated to the destination sites using two-way replication. User rights on a specific site will be administered as usual in a BI platform deployment on the site where the user resides.
• Business Views and associated objects
The BI platform may store Business Views, Business Elements, Data Foundations, Data Connections, and List of Values (LOVs). These objects are used to enhance the functionality of Crystal Reports.
If these objects are first created on the destination site and then replicated to the origin site using two-way replication, they may not work properly and their data may not appear in Crystal Reports.
It is recommended that you create the Business Views, Business Elements, Data Foundations, Data
Connections, and LOVs on the origin site and then replicate them to the destination site. Make updates to the objects on the destination site or the origin site (rights permitting) and the changes will replicate back and forth properly.
• Universe overloads
The BI platform may store universe overloads. If universe overloads are created on the destination site and then replicated to the origin site using two-way replication, they may not work properly.
To resolve this, first create the universe overloads on the origin site and replicate them to the destination site. Second, set any security on the universe overloads on the origin site and replicate them to the destination site.
• Object cleanup
Object cleanup deletes objects that have been deleted on the other site. Object cleanup is currently only done from the origin site to the destination site.
• Federation log files
Federation log files are written to XML files that use XML 1.1 standards. To view the log files with a browser, the browser must support XML 1.1.
745 2012-12-12
Federation
Related Topics
•
22.15.2 Troubleshooting error messages
This section contains error messages you may encounter in rare circumstances while using Federation.
These messages will appear in the replication jobs logs or in the functionality area of a report.
1) Invalid GUID
Error example: ERROR 2008-01-10T00:31:08.234Z The GUID ASXOOFyvy0FJnRcD0dZNTZg
(found in property SI_PARENT_CUID on object number 1285) is not a valid GUID
.
This error means that you are replicating an object whose parent is not being replicated with it, and which does not already exist on the destination site. For example, an object is being replicated but not the folder that contains it. The parent object may not be replicated because the account replicating the objects does not have sufficient rights on the parent object.
2) Crystal Reports showing no data on the origin site
This error may occur if the Crystal report is using a Business View, Business Element, Data Foundation,
Data Connection or List Of Values (LOVs) that was originally created on the destination site and then replicated to the origin site.
3) Universe overloads are not applied correctly
This error may occur if the report is using a universe which contains a universe overload that was created on the destination site and replicated to the origin site.
4) Java out of memory
Error example: java.lang.OutOfMemoryError.
This may occur if your Java Application Server has run out of memory while processing a replication job. Your replication job may be too big or your Java Application Server may not have enough memory.
Either increase the available memory of your Java Application Server by moving Federation Web
Services to a dedicated machine, or reduce the amount of objects being replicated in one replication job.
5) Socket timeout
Error example: Error communicating with origin site. Read timed out.
The information being sent from the origin site to the Adaptive Job Server on the destination site is longer than the allotted timeout. Increase the socket timeout on the Adaptive Job Server, or reduce the number of objects you are replicating in your replication job.
746 2012-12-12
Federation
747
6) Query Limit
Error example: SDK error occurred at the destination site. Not a valid query.
(FWB 00025) …...Query string is larger than query length limit.
This error may appear if you are replicating too many objects at one time and Federation submits a query that is too large for the CMS to handle. Objects from the origin site will be committed to the destination site. However, any changes that need to be committed to the origin site will not be committed.
Conflicts are resolved as specified, however manual resolution conflict flags on the object will not be set. Objects committed on the destination site will continue to work properly.
To resolve this issue, reduce the number of objects you are replicating in one replication job.
7) Replication Job Times Out
Error example: Object could not be scheduled within the specified time interval.
You may receive this message if your replication job times out while it waits for another replication job to finish. This may occur if you have multiple replication jobs connecting to the same origin site at the same time. The failed replication job will try to run again at its next scheduled time.
To resolve this issue, schedule the failed replication job at a time that doesn't conflict with other replication jobs that connect to the same origin site.
8) Replication Limit
Error example: SDK error occurred at the destination site. Database access error.
…. Internal Query Processor Error: The query processor ran out of stack space during query optimization. Error executing query in ExecWithDeadlockHandling.
You may receive this message if you exceed the number of supported objects that can be replicated at one time. To resolve this issue, reduce the number of objects you are replicating in your replication job and run the job again.
9) Object dropped
Error example: Error encountered while checking security rights, or Error encountered while packing object
.
This message may display if an object is dropped from the replication package. This can occur when
Federation queries an object that needs replication, but before it checks for rights and the packs the object.
10) Adaptive Processing Server
Error example: An error occurred in Job Processing Server.
This error can occur when too many classes are loaded by Federation and there is not enough memory to process the replication job.
To resolve this issue, you need to perform both of the following steps:
1.
In the command-line arguments of the Adaptive Processing Server, add the following line: -javaArgs
"XX:MaxPermSize=256m"
.
2.
Add the following parameters to the Java Application server that you are connecting to for Federation, to reduce the size of the BIAR files that you are using:
2012-12-12
Federation
•
-Dbobj.biar.suggestSplit=100m
•
-Dbobj.biar.forceSplit=100m
11) Object Manager Space
Error example: Could not build push package. Input/Output exception occurred:
"No space left on device."
This occurs when the temporary directory that Federation uses doesn't have enough disk space. To resolve this issue, either create extra space in the temporary directory, or use a different location for the temporary directory.
To specify a different location for the temporary directory on the origin site, add the following line to the
Java Application Server's configuration files: -Dbobj.tmp.dir=<TempDir>.
To specify a different location for the temporary directory on the destination site, add the following line to the Adaptive Processing Server's command-line arguments: -javaArgs
“-Dbobj.tmp.dir=<TempDir>”
.
In the above examples, <TempDir> is the location of the temporary directory that you want to use.
12) Universe Error
Error example: An internal error occurred while calling processDPCommands API.
This occurs when a Universe that has been replicated has an invalid or missing Universe-to-Universe
Connection relationship. To resolve this issue, run the replication job with the Refresh from Origin option selected, and verify that they Universe Connection is replicated.
Alternatively, you can open the Universe in Universe Designer, edit the Universe's connection, and re-commit the Universe.
Related Topics
•
•
748 2012-12-12
Supplementary Configurations for ERP Environments
Supplementary Configurations for ERP Environments
23.1 Configurations for SAP NetWeaver integration
23.1.1 Integrating with SAP NetWeaver Business Warehouse (BW)
749
23.1.1.1 Overview
This section shows how to configure BW to enable and administer report publishing from SAP NetWeaver
Business Warehouse to BI platform.
Before beginning this section, make sure you have completed the configuration of the SAP Authentication plugin in the CMC.
Related Topics
•
Configuring SAP authentication
23.1.1.1.1 Setting up folders and security in BI platform
When you define an entitlement system in BI platform, the system creates a logical folder structure to match your SAP system. When you import roles and publish content to BI platform, corresponding folders are created. As an administrator, you do not have to create these folders. They are created as a consequence of defining an entitlement system when configuring the SAP authentication plugin, importing roles into the CMC, and publishing content to BI platform.
Note:
The BI platform administrator is responsible for assigning the correct rights to these folders:
• SAP top-level folder
Ensure the Everyone group has limited access to the SAP top-level folder.
2012-12-12
Supplementary Configurations for ERP Environments
750
• System ID folders
Assign the principal Publisher the following rights in the CMC:
• Add objects to folder
• View objects
• Edit objects
• Modify the rights users have to objects
• Delete objects
Tip:
To make rights administration easier, you can create a customized Publisher access level that includes these rights, and then grant the principal Publisher this access level on relevant System ID folders.
Related Topics
•
•
How rights work in BI platform
23.1.1.1.2 Understanding the default folder security patterns
When you publish content to BI platform from SAP, the platform automatically creates the remaining hierarchy of roles, folders, and reports. The system organizes your reports in folders that are named according to the System ID and Client Number, and according to the name of the role:
• The system creates the top-level folders - that is, the SAP, 2.0, and system (SID) folders - when you define an entitlement system.
• The system creates Role folders (imported as groups into BI platform ) as necessary, when a role is published from BW.
• The system creates a Content folder for each role that content is published to.
• Security is set on each report object, so users can view only the reports that belong to their roles.
The administrator is responsible for assigning rights to members of different roles. The Content
Administration Workbench is used to administer report publishing functionality from within SAP BW.
You can identify roles from the SAP BW system with particular BI platform systems, publish reports, and synchronize reports between SAP BW and a BI platform deployment.
Content folders
BI platform imports a group for each role that is added to the entitlement system as defined in the CMC.
To ensure that suitable default rights are granted to all members of a content-bearing role, grant the appropriate rights in the Content Administration Workbench for each entitlement system that is defined in BI platform:
1.
In the Content Administration Workbench, expand Enterprise system and then expand Available
systems.
2.
Double-click the system you want.
3.
Click the Layout tab.
4.
Set Default security policy for reports to View.
2012-12-12
Supplementary Configurations for ERP Environments
5.
Set Default security policy for role folders to View On Demand.
6.
Click OK.
These settings are reflected in BI platform for all content roles. That is, roles that have content published to them. Members of these roles will now be able to view scheduled instances of reports published to other roles and will be able to refresh reports published to roles that they are a member of.
Note:
It is strongly recommended that you keep the activities of roles distinct. For example, while it is possible to publish from an administrator role, it is better practice to publish only from publisher roles. Additionally, the function of publishing roles is only to define which users can publish content. Thus, publishing roles should not contain any content; publishers should publish to content bearing roles that are accessible to regular role members.
23.1.1.2 Configuring the BW Publisher
The BW Publisher allows you to publish Crystal reports (.rpt files) individually or in batches from BW to BI platform.
On Windows, you can configure the BW Publisher in one of two ways:
• Start the BW Publisher using a service on a machine hosting BI platform. The BW Publisher service will start instances of the BW Publisher as required.
• Start the BW Publisher using a local SAP Gateway to create BW Publisher instances.
You must select the configuration method based on the requirements of your site, after considering the advantages and disadvantages of each configuration. Once you have configured the BW Publisher in
BI platform, you must configure publishing in the Content Administration Workbench.
23.1.1.3 Configuring the BW Publisher as a service
This section explains how to enable publishing of reports from BW to BI platform using the BW Publisher as a service, perform the following procedure.
23.1.1.3.1 Distributing the BW Publisher installation
This section explains the distribution of BW Publisher service and how to separate the BW Publisher from other BI platform components.
You can load-balance publishing from BW by installing BW Publisher services on two separate machines in the same BI platform system.
751 2012-12-12
Supplementary Configurations for ERP Environments
752
When you install the BW Publisher on the machines hosting BI platform, configure each one to use the same Program ID and SAP Gateway Host and Gateway Service. After you create an RFC destination that uses this Program ID, BW load-balances publishing between the machines hosting BI platform.
Moreover, if one BW Publisher becomes unavailable, BW continues to use the remaining BW Publisher.
You can add an additional level of system redundancy to any configuration that includes multiple BW application servers. Configure each BW application server to run an SAP Gateway. For each one, install a separate BW Publisher service on a machine hosting BI platform. Configure each BW Publisher service to use the Gateway Host and Gateway service of a separate BW application server. In this configuration, publishing from BW can continue if either a BW Publisher or an application server fails.
If you want to separate the BW Publisher from other BI platform components, install the BW using a stand-alone SAP Gateway.
In this case you must install a local SAP Gateway on the same machine as the BW Publisher. In addition, the BW Publisher requires access to the BI platform SDK and the SAP Crystal Reports Print Engine.
Thus, if you install the BW Publisher and the local SAP Gateway on a dedicated machine, you must also install the SIA Server.
23.1.1.3.2 Starting the BW Publisher: UNIX
Run the BW Publisher script to create a publisher instance or instances to handle publishing requests.
It is recommended that you start one publisher instance.
Once the BW Publisher starts, it establishes a connection with the SAP Gateway Service that you specified when you ran the BI platform installation program.
23.1.1.3.3 Starting the BW Publisher: Windows
On Windows, use the Central Configuration Manager (CCM) to start the BW Publisher service. When you start the BW Publisher service it creates a publisher instance to service publishing requests from your BW system. If the volume of publishing requests increases, the BW Publisher automatically spawns additional publishers to meet the demand.
23.1.1.3.4 Configuring a destination for the BW Publisher service
To enable the BW Publisher, you must configure an RFC destination on your BW server to communicate with the BW Publisher service. If you have a BW cluster, configure the RFC destination on each server, using the central instance of BW as your Gateway Host in every case.
If you want to publish to multiple BI platform systems from BW, create a separate RFC destination for the BW Publisher service in each BI platform deployment. You must use unique Program IDs for each destination, but the same Gateway host and Gateway service.
23.1.1.3.5 Configuring the BW Publisher with a local SAP Gateway
Note:
Do not use this configuration if BI platform is installed on UNIX. Using this method on UNIX could result in unpredictable system behavior.
2012-12-12
Supplementary Configurations for ERP Environments
753
To enable publishing of reports from BW to BI platform, using a local SAP Gateway, perform the following procedure:
•
Installing a local SAP Gateway
.
•
Configuring a destination for the BW Publisher .
23.1.1.3.6 Installing a local SAP Gateway
A local SAP Gateway must be installed on the machine where you installed the BW Publisher. It is recommended that an SAP BASIS administrator perform the installation of one of these SAP Gateways.
For up-to-date instructions on installing a local SAP Gateway, see the SAP installation instructions included on your SAP Presentation CD.
For a detailed list of tested environments for BusinessObjects XI Integration for SAP, consult the platforms_EN.txt
file included with your product distribution. This file includes specific version and
Service Pack requirements for application servers, operating systems, SAP components, and so on.
After you have installed the SAP Gateway, use regedit to verify the TMP and TEMP registry entries under the HKEY_CURRENT_USER\Environment subkey. Both registry entries should hold the same string value, which must be a valid absolute directory path. If either entry's value contains the %USER
PROFILE% variable, replace it with an absolute directory path. Typically, both registry entries are set to C:\WINDOWS\TEMP
23.1.1.4 Configuring a destination for the BW Publisher
To enable the BW Publisher, you must configure an RFC destination to provide BW with the location of the machine where you have installed the local SAP Gateway and the BW Publisher.
23.1.1.5 Configuring publishing in the Content Administration Workbench
The Content Administration Workbench is used to administer report publishing functionality from within
SAP BW. You can identify roles from the SAP BW system with particular BI platform systems, publish reports, and synchronize reports between SAP BW and a BI platform deployment. Once you have set up SAP authentication, and have configured the BW Publisher, perform the functions outlined in this section to enable publishing. These instructions will allow you to:
• Set appropriate authorizations for different users of the Content Administration Workbench.
• Set up connections to the BI platform where content is published.
• Define which roles can publish to each BI platform.
2012-12-12
Supplementary Configurations for ERP Environments
• Publish content from BW to BI platform.
23.1.1.6 Users who can access the Content Administration Workbench
There are three types of users who may access the Content Administration Workbench:
• Content consumers, who belong to content-bearing roles and who can view reports. They do not have authorization to do anything other than view reports.
• BI platform content publishers, who can view, publish, modify, and (optionally) delete reports from
BW.
• BI platform administrators, who are able to perform all tasks within Content Administration Workbench.
These tasks include defining BI platform systems, publishing reports, and performing report maintenance.
23.1.1.7 Creating roles in BW for designated content publishers
When you are configuring BW for integration with BI platform, assess whether or not your current role structure allows you to quickly designate particular BW users as content publishers or system administrators for the BI platform systems.
It is suggested that you label any new roles you create in a descriptive manner. Examples of descriptive role names would include BOE_CONTENT_PUBLISHERS and SBOP_SYSTEM_ADMINISTRATORS.
Tip:
You can assign an administrative user either full system administration rights or a subset of those rights.
To modify the rights that these new roles (or any of your existing roles) are granted in BI platform, you must first set up SAP Authentication and import the roles. You can then modify the rights of each imported role using the Central Management Console.
For details on creating roles, see your SAP documentation. For more information on the use of roles in administering content, see the following sections:
•
.
•
Setting up folders and security in BI platform
.
•
Understanding the default folder security patterns
.
754 2012-12-12
Supplementary Configurations for ERP Environments
755
23.1.1.8 Configuring access to the Content Administration Workbench
For each type of user that can access the Content Administration Workbench, you must apply the appropriate set of authorizations within BW. The authorizations are listed in the following tables.
Table 23-1: Authorizations for administrative users
Authorization object Field Values
RFC_TYPE
S_RFC
S_TCODE
RFC_NAME
ACTVT
FUGR
/CRYSTAL/CE_SYNCH, SH3A,
SUNI
Execute (16)
S_TABU_CLI
S_TABU_DIS
TCD
CLIIDMAINT
ACTVT
DICBERCLS
JOBACTION
JOBGROUP
ACTVT
RSADMWBOBJ
/CRYSTAL/RPTADMIN,
RSCR_MAINT_PUBLISH
X
Change, Display (02, 03)
&NC&
DELE, RELE
' '
Execute (16)
S_RS_ADMWB
ACTVT
WORKBENCH
Create new, Change, Display,
Delete (01, 02, 03, 06)
2012-12-12
Supplementary Configurations for ERP Environments
Authorization object
ZCNTADMJOB
ZCNTADMRPT
Field
ACTVT
ACTVT
Table 23-2: Authorizations for content publishers
Authorization object Field
RFC_TYPE
RFC_NAME
S_RFC
S_BTCH_JOB
ZCNTADMCES
ZCNTADMJOB
ACTVT
TCD
JOBACTION
JOBGROUP
ACTVT
RSADMWBOBJ
ACTVT
ACTVT
Values
Create new, Delete (01, 06)
Display, Delete, Activate, Maintain, Check (03, 06, 07, 23, 39)
Values
FUGR
/CRYSTAL/CE_SYNCH, SH3A,
SUNI
Execute (16)
/CRYSTAL/RPTADMIN
DELE, RELE
' '
Execute (16)
WORKBENCH
Display (03)
(New, Delete) 01, 06
756 2012-12-12
Supplementary Configurations for ERP Environments
Authorization object
ZCNTADMRPT
Field
ACTVT
Values
Display, Activate, Maintain,
Check (03, 07, 23, 39)
Delete (optional) (06)
Edit (optional) (02)
Granting content publishers the right to delete reports in the BW Content Administration Workbench is optional. However, be aware that deleting a report in BW also deletes the report in BI platform. If publishers do not have sufficient rights to delete reports in the platform, an error results.
Authorizations for content consumers
Authorization object Field Values
RFC_TYPE
RFC_NAME
FUGR
SH3A, SUNI
S_RFC
ACTVT
TCD
Execute (16)
/CRYSTAL/RPTADMIN
S_RS_ADMWB
ACTVT
RSADMWBOBJ
ACTVT
Execute (16)
WORKBENCH
Display (03)
757
23.1.1.9 Defining a BI platform system
You must create a system definition in Content Administration Workbench for each BI platform system to which you want to publish reports.
2012-12-12
Supplementary Configurations for ERP Environments
758
23.1.1.9.1 To add a BI platform system
1.
Execute the transaction /crystal/rptadmin to access Content Administration Workbench.
2.
From the Operations pane, select Enterprise System.
3.
Double-click Add new system.
4.
On the System tab: a.
In the Alias box, type a descriptive name, with no spaces or special characters.
Spaces and special characters require special treatment when an alias name is used to configure
Enterprise portals.
b.
Type the name of the machine that is running your BusinessObjects Enterprise CMS.
Note:
If you configured your CMS to listen on a port other than the default, type CMSNAME:PORT c.
Select Default system if you want to publish reports to this system from any role that is not explicitly assigned to a BI platform system.
Only one BI platform system can be the default.
The default system is indicated by a green check mark in the list of available systems.
5.
Click Save.
6.
On the RFC Destinations tab, add each RFC destination that is associated with this system. To add a destination, click the Insert Row button. In the list that appears, double-click the name of the
RFC destination.
Note:
A BI platform system can have multiple destinations to add system redundancy. See “Distributing the BW Publisher installation” for more information.
7.
Test the destination by selecting the destination you added and then clicking the gray box to the left of the destination name.
8.
Click Verify CE definition.
This test verifies that BW can contact the specified BW publisher and can log on to this system using the Crystal entitlement user account.
9.
On the HTTP tab: a.
In the Protocol box, type http.
If the web server connected to BI platform is configured to use https, type https instead.
b.
In the Web server host and port box, type the fully qualified domain name or IP address of the web server that hosts BI launch pad.
For an installation that uses a Java application server, include the port number (such as boserver01.businessobjects.com:8080).
c.
In the Path box, type SAP, with no forward slash at the beginning or the end.
This path is essentially the virtual path that your web server uses when referring to the sap subfolder of your BI platform web content. Provide an alternate value only if you have customized your web environment and the location of the platform web content files.
2012-12-12
Supplementary Configurations for ERP Environments d.
In the Viewer application box, type the name of your viewer application. Type openDocument.jsp
to use the default viewer for BI platform that use the Java version of BI launch pad.
If BI platform was installed on Windows using the default ASP.NET configuration, type report/re port_view.aspx to use the default browser.
10.
On the Languages tab, select the languages of reports that will be published to this system.
11.
Use the Roles tab to add the content-bearing roles that you want to associate with this BI platform system.
See “Importing SAP roles” for more information.
12.
Click the Insert Row button.
A list of roles available to add to this system appears.
Note:
Each role can publish to only one BI platform system. If the roles that you want to add to this BI platform system are not displayed in the list, click Cancel to return to the Roles tab, and click
Reassign Roles.
13.
Select the roles that you want to publish to this system, and click OK.
14.
Set the default security settings for content published to this BI platform system by clicking the
Layout tab and selecting the security settings used by default for reports and roles folders.
Note:
• A folder is created automatically in BI platform for each role published to that system. This folder contains shortcuts to the reports published under that role.
• Once you have configured a BI platform system, changing default security levels does not affect the security levels of published role folders or reports. To change the default security levels for all roles and content published to BI platform, delete the role folders and shortcuts in the system, change the security settings, and republish the roles and reports. Deleting role folders and shortcuts does not delete any reports.
15.
Click OK to create the BI platform system in Content Administration Workbench.
You can publish reports to BI platform from BW.
Related Topics
•
Distributing the BW Publisher installation
•
759
23.1.1.10 Publishing reports using the Content Administration Workbench
After a report has been saved to BW, you can publish it using the Content Administration Workbench.
You can use the Content Administration Workbench to publish individual reports, or you can publish all reports saved to a particular role. Only a user who has the authorizations granted to a Crystal content
2012-12-12
Supplementary Configurations for ERP Environments publisher (see
Creating and applying authorizations ) can use the Content Administration Workbench
to publish and maintain reports.
23.1.1.11 Publishing roles or reports
1.
Execute the transaction /crystal/rptadmin to access the Content Administration Workbench.
2.
From the Operations pane, select Publish reports.
3.
To find content saved to your BW system, double-click Select reports and roles to publish.
A dialog box designed to help you filter the available roles and reports appears.
4.
From the list, select the system or systems containing content that you want to display.
Note:
The list contains all available systems defined on the BW system.
5.
Next, filter your results to limit the number of reports and roles that will be displayed. Use these options:
•
Object version
Selecting "A: active" displays all reports that can be published. Selecting the blank option displays all reports. (The remaining options are SAP reserved terms.)
•
Object status
Select "ACT Active, executable" to display only reports that have been published. Select "INA
Inactive, not executable" to display only reports which have not been published. Leave the field blank to display all reports. (The remaining options are SAP reserved terms.)
•
Role filter
If you type text in this box, only the roles that match what you type here are displayed. Use * as a wildcard character. For example, to display all roles beginning with the letter d, type "d*".
•
Report description
If you type text in this box, only the reports whose descriptions match what you type here are displayed. Use * as a wildcard character to match any number of characters. Use + as a wildcard to match 0 or 1 characters. For example, to display all reports whose description contains the word revenue, type *revenue*.
6.
Click OK.
The list of reports that meet your criteria appears in the right-hand panel.
The reports are arranged in a hierarchy: BI platform system > Roles on that system > Reports saved to the role.
760 2012-12-12
Supplementary Configurations for ERP Environments
•
•
•
Each item in the hierarchy is labeled with a red, yellow, or green dot. Items higher in the hierarchy reflect the status of the items that they contain, with the least favorable condition percolated to the top of the hierarchy. For example, if one report in a role is yellow (active), but all of the rest are green
(published), then the role shows as yellow (active).
Green: The item is fully published. If the item is a BI platform system or a role, all reports in that item are published.
Yellow: The item is active, but not published. If the item is a report, the item is available for publishing. If the item is a role or a BI platform system, then all content is active and at least one item that the role or system contains has not been published.
Red: The item is SAP content, and is not available for publishing using the Content
Administration Workbench. Content is not available for publishing until it has been activated using the BW Administration Workbench.
7.
Select the reports that you want to publish.
To publish all of the reports in a role, select the role. To publish all roles on a BI platform, select the system.
Note:
When you select a role (or a system), all reports contained in that role (or system) are selected. To clear this selection, clear the role (or system) check box, and then click Refresh.
8.
Click Publish.
Note:
Reports published in the background are processed as system resources become available. To use this option, click In background instead of Publish.
9.
Click Refresh to update the display of the status of BI platform systems, roles, and reports in the
Content Administration Workbench.
Tip:
To view a report, right-click the report and select View. To see which queries are used by the report, right-click the report and select Used Queries.
Note:
After you have published a report to BI platform, if you want to overwrite the report you published, click Overwrite.
Related Topics
•
Scheduling background publishing
23.1.1.12 Scheduling background publishing
761 2012-12-12
Supplementary Configurations for ERP Environments
Publishing reports in the background, either immediately or as a scheduled job, conserves system resources. It is recommended that you publish reports in the background to improve system responsiveness.
Publishing reports periodically, as scheduled jobs, synchronizes the report information between BW and your BI platform deployment. It is recommended that you schedule all reports (or roles containing these reports). You can also manually synchronize roles and reports using the Update status option of the Report Maintenance operation. See
Updating the status of reports
for details.
23.1.1.13 Updating system information for published reports
The BW Publisher uses the SAP system information entered here to update the data source of published reports. You can choose to use the local BW application server, or the central BW instance if you prefer a load balancing configuration.
23.1.1.14 Maintaining reports
Report maintenance tasks include synchronizing information about reports between BI platform and
BW (Update status), deleting unwanted reports (Delete reports), and updating reports migrated from previous versions of the platform(Post-migration).
23.1.1.14.1 Updating the status of reports
If you make a change to a published report on a BI platform system (such as changing which role a report is published to), the change is not reflected in BW until you synchronize BI platform and BW.
You can schedule a publishing job to periodically synchronize BI platform and BW (see
Maintenance tool.
23.1.1.14.2 Deleting reports
Deleting a published report from BW using the Content Administration Workbench also deletes the report from BI platform. Only users who have been granted the authorizations necessary to delete reports on both BW and the BI platform system can remove reports.
Note:
If a user has rights to delete a report on BW, but not on the BI platform system where that report is published, you may encounter an error.
762 2012-12-12
Supplementary Configurations for ERP Environments
763
23.1.1.15 Configuring the SAP http request handler
To enable viewing of reports in BW, you must configure BW to use the http request handler that is included as part of the Content Administration Workbench. Then, when a BW user opens a Crystal report from within the SAPGUI, BW can route the viewing request over the Web appropriately.
Use the transaction SICF to access the list of virtual hosts and services active on your BW system.
Create a new node named ce_url under BW in the default_host hierarchy and add /CRYS
TAL/CL_BW_HTTP_HANDLER to the handler list. You may have to manually activate this service after creating it.
23.1.1.16 Configurations for processing SAP data
23.1.1.16.1 Processing scheduled reports in SAP's batch mode
For Windows installations, you can run scheduled reports in BI platform using SAP's batch mode. The
InfoSet and Open SQL drivers can run reports using SAP's batch or background mode when specific environment variables are set to 1. The relevant environment variables are:
•
CRYSTAL_INFOSET_FORCE_BATCH_MODE
(for the InfoSet driver)
•
CRYSTAL_OPENSQL_FORCE_BATCH_MODE
(for the Open SQL driver)
However, it is recommended that you use this feature only when you have a distributed installation of
BI platform. When these environment variables are set to 1, the drivers run reports using SAP's batch mode, regardless of the reporting component that is actually running the report. Therefore, if you create these environment variables as system environment variables on a machine that is running a combination of BI platform servers, the drivers run all reports in batch mode (including on-demand report requests from the Adaptive Processing Server and the Report Application Server).
To ensure that the drivers run only your scheduled reports in batch mode (that is, reports run by the
Adaptive Job Server), avoid setting system environment variables on machines running combinations of BI platform servers. Instead, follow these steps to customize the environment variables for each
Adaptive Job Server.
Note:
SAP users who schedule reports in BI platform may require additional authorizations in SAP.
Related Topics
•
Scheduling a report in batch mode using an Open SQL query
2012-12-12
Supplementary Configurations for ERP Environments
23.1.1.16.2 To process scheduled reports in SAP's batch mode
1.
Create a batch script (.bat file) in a text editor such as Notepad, with the following contents:
@echo off set CRYSTAL_INFOSET_FORCE_BATCH_MODE=1 set CRYSTAL_OPENSQL_FORCE_BATCH_MODE=1
%*
This script sets the environment variables to 1 and then executes any parameters passed to the script from the command line.
2.
Save the file as jobserver_batchmode.bat to a folder on each Adaptive Job Server machine.
3.
Log on to the Central Management Console (CMC).
4.
Choose Servers.
5.
Expand the Service Categories node, and choose Analysis Services.
6.
Select Adaptive Processing Server, and choose Properties in the context menu.
The "Properties" page opens.
7.
On the "Properties" page, locate the Command line Parameters field.
This is the startup command for the Adaptive Job Server. For example:
"\\SERVER01\C$\Program Files\SAO Business Objects\SAP BusinessObjects Enterprise\win32_x86\JobServer.exe"
-service -name SERVER01.report
-ns SERVER01 -objectType BusinessObjects Enterprise.Report -lib procReport
-restart
8.
Precede the default command with the full path to the jobserver_batchmode.bat file that you saved on the Adaptive Job Server machine.
In this example, the batch file is saved on a machine named SERVER01 as:
C:\Crystal Scripts\jobserver_batchmode.bat
The new startup command for the Adaptive Job Server is:
"\\SERVER01\C$\Crystal Scripts\jobserver_batchmode.bat" "\\SERVER01\C$\Program Files\SAP Business Ob jects\SAP
BusinessObjects Enterprise 12.0\win32_x86\JobServer.exe" -service -name SERVER01.report
-ns SERVER01
-objectType BusinessObjects Enterprise.Report -lib procReport -restart
This new startup command launches the batch file first. The batch file in turn sets the required environment variables before executing the original startup command for the Adaptive Job Server.
This ensures that the environment variables available to the Adaptive Job Server differ from the environment variables available to servers responsible for on-demand reporting (the Crystal Reports
Processing Server and Report Application Server).
9.
Click Save & Close.
10.
Right-click the Adaptive Job Server and select Start in the context menu.
Note:
If the Adaptive Job Server fails to start, verify your new startup command.
764 2012-12-12
Supplementary Configurations for ERP Environments
23.1.1.17 Configurations for SAP transports
23.1.1.17.1 Overview
SAP BusinessObjects Enterprise includes eight transports: the Open SQL Connectivity transport, the
InfoSet Connectivity transport, the Row-level Security Definition transport, the Cluster Definition transport, the Content Administration Workbench, the BW Query parameter personalization transport, the MDX transport, and the ODS transport.
There are two different sets of the transports: Unicode compatible transports and ANSI transports. If you are running a BASIS system of 6.20 or later, use the Unicode compatible transports. If you are running a BASIS system earlier than 6.20, use the ANSI transports. All the installed transports are located in the following directory on your product distribution media: \Collaterals\Add-
Ons\SAP\Transports\
.
Note:
When checking for possible installation conflicts, ensure that none of the object names already exists in your SAP system. Objects use a /crystal/ namespace by default, so it is not necessary to create this namespace yourself. If you do create the /crystal/ namespace manually, you will be prompted for license repair keys that you cannot access.
23.1.1.17.2 Configuring transports
To set up the Data Access or BW Publisher components of BI platform , you must import the appropriate transports into your SAP system. These components use the contents of these transport files when communicating with the SAP system.
The installation and configuration procedures required on the SAP system must be performed by a
BASIS expert who is familiar with the Change and Transport system and who has administrative rights to the SAP system. The exact procedure for importing transport files varies, depending upon the version of BASIS that you are running. For specific procedural details, refer to your SAP documentation.
When you first deploy the Data Access component, all users can access all of your SAP tables by default. To secure the SAP data that users can access, use the Security Definition Editor.
After you have imported transports, you must configure the appropriate levels of user access. Create the required authorizations and apply them through profiles or roles to SAP users who will be designing, running, or scheduling Crystal reports.
Related Topics
•
Creating and applying authorizations
765 2012-12-12
Supplementary Configurations for ERP Environments
766
Types of transports
There are two different sets of the transports: Unicode compatible transports and ANSI transports. If you are running a BASIS system of 6.20 or later, use the Unicode compatible transports. If you are running a BASIS system earlier than 6.20, use the ANSI transports. All the installed transports are located in the following directory on your product distribution: Collaterals\Add-Ons\SAP\Trans ports
. The transports.txt file lists the Unicode compatible and ANSI transport files.
Each transport type is described below:
• Open SQL Connectivity transport
The Open SQL Connectivity transport enables the Open SQL driver to connect to and report off the
SAP system.
• Row-level Security Definition transport
This transport provides the Security Definition Editor, which is a tool that serves as a graphical interface to the /crystal/auth tables in the Open SQL Connectivity transport.
• Cluster Definition transport
This transport provides the Cluster Definition tool. This tool enables you to build up a metadata repository for ABAP data cluster definitions. These definitions provide the Open SQL driver with the information it requires in order to report off these data clusters.
Note:
ABAP data clusters are not the same as cluster tables. Cluster tables are already defined in the
DDIC.
• InfoSet Connectivity transport
The InfoSet Connectivity transport enables the InfoSet driver to access InfoSets and SAP Queries.
• Content Administration Workbench transport
This transport provides content administration functionality for BW systems. It is available only as a UNICODE compatible transport.
• BW Query parameter personalization transport
This transport provides support for personalized and default parameter values in reports based on
BW queries.
Checking for conflicts
The contents of the transport files are registered automatically under the SAP Business Objects namespace when you import the files. The SAP Business Objects namespace is reserved for this purpose within recent versions of R/3 and MYSAP ERP. However, object names for some objects such as authorization objects, authorization classes, and legacy objects may not contain the appropriate prefixes. It is recommended that you check these object types for conflicts prior to importing the transport files.
2012-12-12
Supplementary Configurations for ERP Environments
767
If the function group, any of the function modules, or any of the other objects already exists on the SAP system, then you must resolve the namespace before importing the SAP Business Objects transport files. Refer to your SAP NetWeaver documentation for the procedures appropriate to your version of
SAP.
Importing the transport files
Read the transports_EN.txt file located in the following directory on your product distribution media:
\Collaterals\Add-Ons\SAP\Transports\
. This text file lists the exact names of the files that make up each transport. (The cofiles and data directories below the transports directory correspond to the .../trans/cofiles and .../trans/data directories on your SAP server.)
You must import the Open SQL Connectivity transport before importing the Row-level Security Definition or the Cluster Definition transports. You may import the other transports in any order.
Note:
• After copying files from CD to server, ensure that all files are writable before you import the transports.
Imports fail if the import files are read-only.
• Because the transports are binary files, on UNIX installations you must add the files by FTP in Binary mode (to avoid file corruption). In addition, you must have write permissions for the UNIX server.
Transports
Open SQL Connectivity transport
The Open SQL Connectivity transport enables the drivers to connect to and report off the SAP system.
Object Type Description
Development class
Open SQL functions
/CRYSTAL/BC
/CRYSTAL/OPENSQL
Package
Function group
/CRYSTAL/OS
QL_AUTH_FORMS
Program
/CRYSTAL/OSQL_EXECUTE Program
/CRYSTAL/OSQL_TYPEPOOL
PROG
Program
/CRYSTAL/OSQL_TYPE
POOLS
Program
Helper program
Helper program
Helper program
Helper program
2012-12-12
Supplementary Configurations for ERP Environments
768
Object
/CRYSTAL/OSQL_UTILS
ZSSI
ZSEGREPORT
/CRYSTAL/OSQL_CLU_AC
TKEY_ENTRY
/CRYSTAL/OS
QL_FCN_PARAM
/CRYSTAL/OS
QL_FCN_PARAM_FIELD
Table
/CRYSTAL/OSQL_FIELD_EN
TRY
Table
/CRYSTAL/OSQL_OBJECT_EN
TRY
Table
/CRYSTAL/OS
QL_RLS_CHK_ENTRY
/CRYSTAL/OS
QL_RLS_FCN_ENTRY
Table
Table
Table
Table
/CRYSTAL/OS
QL_RLS_VAL_ENTRY
ZCLUSTDATA
ZCLUSTID
ZCLUSTKEY
Type
Program
Authorization object class
Authorization object
Table
Table
Table
Table
Description
Helper program
Reporting authorization objects
Reporting authorization object
Cluster metadata
Function metadata
Function metadata
Table metadata
Table metadata
RLS metadata
RLS metadata
RLS metadata
Cluster metadata
Cluster metadata
Cluster metadata
2012-12-12
Supplementary Configurations for ERP Environments
769
Object
ZCLUSTKEY2
/CRYSTAL/AUTHCHK
/CRYSTAL/AUTHFCN
/CRYSTAL/AUTHKEY
/CRYSTAL/AUTHOBJ
/CRYSTAL/AUTHREF
ZSSAUTHCHK
ZSSAUTHOBJ
ZSSAUTHKEY
ZSSAUTHREF
ZSSAUTH FCN
Table
Table
Table
Table
Type
Table
Table
Table
Table
Table
Table
Table
Description
Cluster metadata
RLS metadata
RLS metadata
RLS metadata
RLS metadata
RLS metadata
Old RLS metadata
Old RLS metadata
Old RLS metadata
Old RLS metadata
Old RLS metadata
InfoSet Connectivity transport
The InfoSet Connectivity transport enables the InfoSet driver to access InfoSets. This transport is compatible with R/3 4.6c and later. Do not import this transport if you are running SAP R/3 4.6a or earlier.
Object Type Description
/CRYSTAL/BC Package Development class
/CRYSTAL/FLAT Function group InfoSet wrapper functions
2012-12-12
Supplementary Configurations for ERP Environments
770
Object
/CRYSTAL/QUERY_BATCH
Type
Program
/CRYS
TAL/QUERY_BATCH_STREAM
Program
Description
Batch mode execution
Streaming batch mode execution.
Row-level Security Definition transport
This transport provides the Security Definition Editor, which is a tool that serves as a graphical interface to the /CRYSTAL/AUTH tables in the Open SQL Connectivity transport.
Object Type Description
/CRYSTAL/BC Package Development class
/CRYSTAL/TABMNT
/CRYSTAL/RLSDEF
/CRYSTAL/RLS_INCLUDE1
/CRYSTAL/RLS_INCLUDE2
Function group
Program
Program
Program
TDDAT [/CRYSTAL/AUTHFCN] Table contents
TVDIR [/CRYSTAL/AUTHFCN] Table contents
/CRYSTAL/AUTHFCNS
/CRYSTAL/RLS
Definition of transport and maintenance object
Transaction
Function group for table maintenance view for function restrictions
Main program
Include program containing the module definitions
Include program containing the subroutine definitions
Table maintenance definition
Table maintenance definition
Table maintenance definition
Main program transaction
2012-12-12
Supplementary Configurations for ERP Environments
771
Object
/CRYSTAL/RLSFCN
Type
Transaction
Description
Helper transaction called internally by main program.
Cluster Definition transport
This transport provides the Cluster Definition tool. This tool enables you to build up a metadata repository for ABAP data cluster definitions. These definitions provide the Open SQL driver with the information it requires in order to report off these data clusters.
Note:
ABAP data clusters are not the same as cluster tables. Cluster tables are already defined in the DDIC.
Object Type Description
ZCIMPRBG
ZCRBGTOP
ZCDD
Program
Program
Transaction
Main program
Include program
Main program transaction
Content Administration Workbench
This transport provides content administration functionality for BW systems. It is available only as a
Unicode compatible transport.
Object Type Description
/CRYSTAL/BC Package Development class
/CRYSTAL/CL_BW_HTTP_HAN
DLER
Class
/CRYSTAL/OBJECT_STA
TUS_DOM
Domain
Multi CE-aware HTTP request handler
Report activity
2012-12-12
Supplementary Configurations for ERP Environments
Object Type
/CRYSTAL/OBJ_POLICY_DOM Domain
/CRYSTAL/OBJECT_STATUS Data element
/CRYSTAL/OBJ_POLICY
/CRYSTAL/CE_SYNCH
Data element
Function group
Message class /CRYSTAL/CA_MSG
/CRYS
TAL/CE_SYNCH_FORMS
Program
/CRYSTAL/CONTENT_ADMIN Program
/CRYSTAL/CONTENT_AD
MIN_CLASS_D
/CRYSTAL/CONTENT_AD
MIN_CLASS_I
Program
Program
/CRYSTAL/CONTENT_AD
MIN_CTREE
/CRYSTAL/CONTENT_AD
MIN_FORMS
/CRYSTAL/CONTENT_AD
MIN_MODULES
/CRYSTAL/CONTENT_AD
MIN_PAIS
/CRYSTAL/CONTENT_AD
MIN_PBOS
Program
Program
Program
Program
Program
772
Description
CE object security
Report activity
CE object security
Publisher stubs
Status messages
Program component
Program component
Program component
Program component
Program component
Program component
Program component
Program component
Program component
2012-12-12
Supplementary Configurations for ERP Environments
Object
/CRYSTAL/CONTENT_AD
MIN_TAB_FRM
Type
Program
/CRYSTAL/CONTENT_AD
MIN_TOP
Program
/CRYSTAL/PUBLISH_WORKER Program
/CRYSTAL/PUBLISH_WORK
ER_DISP
Program
/CRYSTAL/PUBLISH_WORK
ER_DISP_I
Program
/CRYSTAL/PUBLISH_WORK
ER_FORMS
Program
/CRYSTAL/PUBLISH_WORK
ER_PROC
Program
/CRYSTAL/PUBLISH_WORK
ER_PROC_I
Program
/CRYSTAL/PUBLISH_WORK
ER_SCREEN
Program
/CRYSTAL/CA_DEST
/CRYSTAL/CA_JOB
/CRYSTAL/CA_JOB2
/CRYSTAL/CA_LANG
/CRYSTAL/CA_PARM
Table
Table
Table
Table
Table
773
Description
Program component
Program component
Program component
Program component
Program component
Program component
Program component
Program component
Program component
Application state
Application state
Application state
Application state
Application state
2012-12-12
Supplementary Configurations for ERP Environments
774
Object
/CRYSTAL/CA_ROLE
/CRYSTAL/CA_SYST
/CRYS
TAL/MENU_TREE_ITEMS
/CRYSTAL/REPORT_ID
/CRYSTAL/RPTADMIN
/CRYSTAL/EDIT_REPORT
/CRYSTAL/EDIT_REPORT
ZSSI
ZCNTADMCES
ZCNTADMRPT
ZCNTADMJOB
Type
Table
Table
Structure
Table
Transaction
Program
Function Group
Authorization object class
Authorization object
Authorization object
Authorization object
Description
Application state
Application state
Application state
Application state
Main program transaction
Wrapper for report edit
Functions for report edit
Crystal Authorizations
CE operations
Report operations
Background job operations
ODS connectivity transport
This transport enables the ODS Query driver to access ODS data. This transport is compatible with
BW 3.0B patch 27 or higher and BW 3.1C patch 21 or higher.
Object Type Description
/CRYSTAL/BC Package Development class
/CRYSTAL/ODS_REPORT Function group ODS functions
2012-12-12
Supplementary Configurations for ERP Environments
BW Query parameter personalization transport
This transport provides support for personalized and default parameter values in reports based on BW queries.
Object Type Description
/CRYSTAL/BC Package Development class
/CRYSTAL/PERS_VAR
/CRYSTAL/PERS_VALUE
/CRYSTAL/PERS
Structure
Structure
Function Group
Variable definition
Value definition
Personalization functions
BW MDX connectivity transport
This transport enables the MDX Query driver to access BW cubes and queries. This transport is compatible with BW 3.0B patch 27 or higher and BW 3.1C patch 21 or higher.
Object Type Description
/CRYSTAL/BC
/CRYSTAL/MDX
Package
Function group
/CRYSTAL/MDX_STREAM_LAY
OUT
Table definition
/CRYSTAL/CX_BAPI_ERROR Class
/CRYSTAL/CX_METADATA_ER
ROR
Class
/CRYSTAL/CX_MISS
ING_STREAMINFO
Class
Development class
MDX functions
Dataset structure
Exception
Exception
Exception
775 2012-12-12
Supplementary Configurations for ERP Environments
Object
/CRYS
TAL/CX_NO_MORE_CELLS
Type
Class
/CRYS
TAL/CX_NO_MORE_MEM
BERS
Class
/CRYS
TAL/CX_NO_MORE_PROPER
TIES
Class
/CRYSTAL/CX_SAVE_SES
SION_STATE
/CRYSTAL/MDX_READ
ER_BASE
Class
/CRYSTAL/MDX_APPEND_DA
TA
Class
Class
/CRYSTAL/MDX_READ_DIMEN
SIONS
Class
/CRYSTAL/MDX_READ_MEA
SURES
Class
/CRYSTAL/MDX_READ_PROP
ERTIES
Class
/CRYSTAL/MDX_AXIS_LEVELS Table type
/CRYSTAL/MDX_PROPER
TY_KEYS
/CRYSTAL/MDX_PROPER
TY_VALUES
Table type
Table type
776
Description
Exception
Exception
Exception
Exception
Dataset processor
Dataset processor
Dataset processor
Dataset processor
Dataset processor
Metadata structure
Metadata structure
Metadata structure
2012-12-12
Supplementary Configurations for ERP Environments
Object Type
/CRYSTAL/MDX_STREAM_LAY
OUT_TAB
Table type
Description
Metadata structure
777
23.1.1.18 Authorizations overview
This section provides a list of SAP authorizations that, in our experience and in our test environment, are required when carrying out common BI platform tasks in an integrated SAP environment. Additional authorization objects or fields may be required, depending upon your individual implementation.
From each authorization object, you must create an authorization and define the appropriate field values.
You then apply the appropriate authorizations to the profiles (or roles) of your SAP users. The following sections describe the required authorizations and provide you with the necessary field values. For procedural details for your version of SAP, consult your SAP documentation.
Note:
• The information in this appendix is provided as a guideline only.
• The ZSEGREPORT authorization object belongs to the ZSSI object class, which is installed when you import the BusinessObjects XI Integration for SAP transport files needed to support Open SQL queries.
23.1.1.18.1 Creating and applying authorizations
You must create and apply the authorizations needed by each user to access information using the
Desktop Intelligence Integration for SAP. The exact procedures for creating, configuring, and applying authorizations depend upon the version of SAP that you have installed. This section provides a list of
SAP authorizations that, in our experience and in our test environments, are required when carrying out common tasks when using BI platform integrated within an SAP NetWeaver ABAP environment.
Additional authorization objects or fields may be required, depending upon your individual implementation.
Related Topics
•
Configuring publishing in the Content Administration Workbench
23.1.1.19 Actions in BW
2012-12-12
Supplementary Configurations for ERP Environments
This section guides you through a list of various actions in BW.
23.1.1.19.1 Actions within Crystal Reports
Creating a new report from a query in a BW role
Authorization object Field
S_USER_AGR
S_RFC
S_CTS_ADMI
ACT_GROUP
ACTVT
RFC_TYPE
RFC_NAME
ACTVT
CTS_ADMFCT
RSINFOAREA
S_RS_COMP
S_RS_COMP1
RSINFOCUBE
RSZCOMPTP
RSZCOMPID
RSZCOMPID
RSZCOMPTP
RSZOWNER
ACTVT
Values
USER_ROLE
*
01, 02, 06
FUGR
RS_PERS_BOD
16
TABL
INFO_AREA
**
INFO_CUBE
**
REP
COMP_ID
**
COMP_ID
**
REP
QUERY_OWNER
*
16
778 2012-12-12
Supplementary Configurations for ERP Environments
* USER_ROLE denotes the name of any role that the user belongs to. You can enter multiple values in this field.
* QUERY_OWNER denotes the name of the owner of the query. If you specify a name, you can report off only those queries with that owner. Enter * to report off of queries with any owner.
**For INFO_AREA,INFO_CUBE, or COMP_ID enter * to denote any value. If you specify a specific value, you can only report off of queries that contain these info areas, cubes, and component IDs.
Opening an existing report from a BW role
Authorization object Field Values
RFC_TYPE
S_RFC RFC_NAME
ACTVT
RSINFOAREA
FUGR
SUSO, SUNI. RSCR, SH3A,
RFC1, RZX0, RZX2,
RS_PERS_BOD, /CRYS-
TAL/PERS, RSOB
16
INFO_AREA
**
INFO_CUBE
**
S_RS_COMP
RSINFOCUBE
RSZCOMPTP
RSZCOMPID
REP
COMP_ID
**
S_RS_COMP1
RSZCOMPID
RSZCOMPTP
RSZOWNER
ACTVT
COMP_ID
**
REP
QUERY_OWNER
*
16
779 2012-12-12
Supplementary Configurations for ERP Environments
* QUERY_OWNER denotes the name of the owner of the query from which you are creating the report.
If you enter the name of the query owner, you can only report off of queries with this owner. Enter * to denote any query owner.
** For INFO_AREA, INFO_CUBE, or COMP_ID enter * to denote any value. If you specify a specific value, you can only report off of queries that contain these info areas, cubes, and component IDs.
Previewing or refreshing a report
Authorization object Field Values
RSINFOAREA
INFO_AREA
**
S_RS_COMP
S_RS_COMP1
RSINFOCUBE
RSZCOMPTP
RSZCOMPID
RSZCOMPID
RSZCOMPTP
RSZOWNER
ACTVT
INFO_CUBE
**
REP
COMP_ID
**
COMP_ID
**
REP
QUERY_OWNER
*
16
* QUERY_OWNER denotes the name of the owner of the query from which you are creating the report.
If you enter the name of the query owner, you can only report off of queries with this owner. Enter * to denote any query owner.
** For INFO_AREA, INFO_CUBE, or COMP_ID enter * to denote any value. If you specify a specific value, you can only report off of queries that contain these info areas, cubes, and component IDs.
780 2012-12-12
Supplementary Configurations for ERP Environments
Verifying the database (refreshing table definitions in a report)
Authorization object Field Values
RSINFOAREA
INFO_AREA
**
S_RS_COMP
S_RS_COMP1
RSINFOCUBE
RSZCOMPTP
RSZCOMPID
RSZCOMPID
RSZCOMPTP
RSZOWNER
ACTVT
INFO_CUBE
**
REP
COMP_ID
**
COMP_ID
**
REP
QUERY_OWNER
*
16
* QUERY_OWNER denotes the name of the owner of the query from which you are creating the report.
If you enter the name of the query owner, you can only report off of queries with this owner. Enter * to denote any query owner.
** For INFO_AREA, INFO_CUBE, or COMP_ID enter * to denote any value. If you specify a specific value, you can only report off of queries that contain these info areas, cubes, and component IDs.
781 2012-12-12
Supplementary Configurations for ERP Environments
782
Setting the location of the data source
Authorization object Field
S_RS_COMP
S_RS_COMP1
RSINFOAREA
RSINFOCUBE
RSZCOMPTP
RSZCOMPID
RSZCOMPID
RSZCOMPTP
RSZOWNER
ACTVT
Values
INFO_AREA
**
INFO_CUBE
**
REP
COMP_ID
**
COMP_ID
**
REP
QUERY_OWNER
*
16
* QUERY_OWNER denotes the name of the owner of the query from which you are creating the report.
If you enter the name of the query owner, you can only report off of queries with this owner. Enter * to denote any query owner.
** For INFO_AREA, INFO_CUBE, or COMP_ID enter * to denote any value. If you specify a specific value, you can only report off of queries that contain these info areas, cubes, and component IDs.
Saving a report to a BW role
Authorization object Field Values
ACT_GROUP
USER_ROLE
*
S_USER_AGR
ACTVT 01, 02, 06
S_CTS_ADMI CTS_ADMFCT TABL
2012-12-12
Supplementary Configurations for ERP Environments
* USER_ROLE denotes the name of any role that the user belongs to. You can enter multiple values in this field.
Preparing a report for translation while saving to BW
Authorization object Field Values
ACT_GROUP
USER_ROLE
*
S_USER_AGR
ACTVT 01
S_CTS_ADMI CTS_ADMFCT TABL
* USER_ROLE denotes the name of any role that the user belongs to. You can enter multiple values in this field.
Saving a report and simultaneously publishing it to BusinessObjects Enterprise
Authorization object Field Values
S_USER_AGR
S_CTS_ADMI
ACT_GROUP
ACTVT
CTS_ADMFCT
USER_ROLE
*
01
TABL
INFO_AREA
***
RSINFOAREA
RSINFOCUBE
INFO_CUBE
***
S_RS_COMP
RSZCOMPTP
RSZCOMPID
REP
COMP_ID
***
783 2012-12-12
Supplementary Configurations for ERP Environments
Authorization object
S_RS_COMP1
Field
RSZCOMPID
RSZCOMPTP
RSZOWNER
ACTVT
Values
COMP_ID
***
REP
QUERY_OWNER
**
16
* USER_ROLE denotes the name of any role that the user belongs to. You can enter multiple values in this field.
** QUERY_OWNER denotes the name of the owner of the query from which you are creating the report.
If you enter the name of the query owner, you can only report off of queries with this owner. Enter * to denote any query owner.
*** For INFO_AREA, INFO_CUBE, or COMP_ID enter * to denote any value. If you specify a specific value, you can only report off of queries that contain these info areas, cubes, and component IDs.
Starting the BEx Query Designer
Authorization object Field Values
RSINFOAREA
INFO_AREA
**
RSINFOCUBE
INFO_CUBE
**
S_RS_COMP
RSZCOMPTP
RSZCOMPID
REP
COMP_ID
**
784 2012-12-12
Supplementary Configurations for ERP Environments
Authorization object
S_RS_COMP1
S_CTS_ADMI
Field
RSZCOMPID
RSZCOMPTP
RSZOWNER
ACTVT
CST_ADMFCT
Values
COMP_ID
**
REP
QUERY_OWNER
*
16
TABL
* QUERY_OWNER denotes the name of the owner of the query from which you are creating the report.
If you enter the name of the query owner, you can only report off of queries with this owner. Enter * to denote any query owner.
** For INFO_AREA, INFO_CUBE, or COMP_ID enter * to denote any value. If you specify a specific value, you can only report off of queries that contain these info areas, cubes, and component IDs.
23.1.1.19.2 Actions within BI launch pad
Logging on to BusinessObjects Enterprise with SAP credentials
Authorization object Field Values
S_ADMI_FCD S_ADMI_FCD ST0R, ST0M
785 2012-12-12
Supplementary Configurations for ERP Environments
Viewing an SAP BW report on demand
Authorization object Field
RFC_TYPE
S_RFC RFC_NAME
ACTVT
RSINFOAREA
S_RS_COMP
S_RS_COMP1
S_RS_ODSO
RSINFOCUBE
RSZCOMPTP
RSZCOMPID
RSZCOMPID
RSZCOMPTP
RSZOWNER
ACTVT
RSINFOAREA
RSODSOBJ
RSODSPART
ACTVT
COMP_ID
**
REP
QUERY_OWNER
*
16
INFO_AREA
**
0CRM_OLVM
DATA
03
Values
FUGR
SYST, RSOB, SUNI
16
INFO_AREA
**
INFO_CUBE
**
REP
COMP_ID
**
786 2012-12-12
Supplementary Configurations for ERP Environments
787
* QUERY_OWNER denotes the name of the owner of the query from which you are creating the report.
If you enter the name of the query owner, you can only report off of queries with this owner. Enter * to denote any query owner.
** For INFO_AREA, INFO_CUBE, or COMP_ID enter * to denote any value. If you specify a specific value, you can only report off of queries that contain these info areas, cubes, and component IDs.
Refreshing a report from the viewer
Authorization object Field Values
RSINFOAREA
INFO_AREA
**
S_RS_COMP
S_RS_COMP1
S_RS_ODSO
RSINFOCUBE
RSZCOMPTP
RSZCOMPID
RSZCOMPID
RSZCOMPTP
RSZOWNER
ACTVT
RSINFOAREA
RSODSOBJ
RSODSPART
ACTVT
INFO_CUBE
**
REP
COMP_ID
**
COMP_ID
**
REP
QUERY_OWNER
*
16
INFO_AREA
**
0CRM_OLVM
DATA
03
* QUERY_OWNER denotes the name of the owner of the query from which you are creating the report.
If you enter the name of the query owner, you can only report off of queries with this owner. Enter * to denote any query owner.
2012-12-12
Supplementary Configurations for ERP Environments
** For INFO_AREA, INFO_CUBE, or COMP_ID enter * to denote any value. If you specify a specific value, you can only report off of queries that contain these info areas, cubes, and component IDs.
Scheduling a report
Authorization object Field Values
RFC_TYPE FUGR
S_RFC RFC_NAME
ACTVT
SYST, RSOB, SUNI
16
INFO_AREA
**
RSINFOAREA
RSINFOCUBE
INFO_CUBE
**
S_RS_COMP
RSZCOMPTP
RSZCOMPID
REP
COMP_ID
**
COMP_ID
**
S_RS_COMP1
RSZCOMPID
RSZCOMPTP
RSZOWNER
REP
QUERY_OWNER
*
S_RS_ODSO
ACTVT
RSINFOAREA
RSODSOBJ
RSODSPART
ACTVT
16
INFO_AREA
**
0CRM_OLVM
DATA
03
788 2012-12-12
Supplementary Configurations for ERP Environments
* QUERY_OWNER denotes the name of the owner of the query from which you are creating the report.
If you enter the name of the query owner, you can only report off of queries with this owner. Enter * to denote any query owner.
** For INFO_AREA, INFO_CUBE, or COMP_ID enter * to denote any value. If you specify a specific value, you can only report off of queries that contain these info areas, cubes, and component IDs.
Reading dynamic picklists in report parameters
Authorization object Field Values
RFC_TYPE FUGR
S_RFC RFC_NAME
ACTVT
SYST, RSOB
16
23.1.1.19.3 Actions within SAP NetWeaver (ABAP)
From within Crystal Reports using the Open SQL driver
This section guides you through a list of various actions in SAP NetWeaver (ABAP) from within Crystal
Reports using the Open SWL driver.
Logging onto an SAP server
Authorization object Field Values
S_RFC
RFC_TYPE
RFC_NAME
ACTVT
FUGR
SYST, /CRYSTAL/OPENSQL
16
789 2012-12-12
Supplementary Configurations for ERP Environments
Creating a new report
Authorization object
S_RFC
ZSEGREPORT
Field
RFC_TYPE
RFC_NAME
ACTVT
ACTVT
Values
FUGR
SYST, /CRYSTAL/OPENSQL
16
01
Opening or previewing an existing report
Authorization object Field
S_RFC
ZSEGREPORT
RFC_TYPE
RFC_NAME
ACTVT
ACTVT
Values
FUGR
SYST, /CRYSTAL/OPENSQL
16
02
Verifying the database (refreshing table definitions in a report)
Authorization object Field Values
S_ADMI_FCD S_ADMI_FCD ST0R, ST0M
ZSEGREPORT ACTVT 02
790 2012-12-12
Supplementary Configurations for ERP Environments
Authorization object
S_RFC
Setting the location of the data source
Authorization object Field
ZSEGREPORT
S_RFC
Field
RFC_TYPE
RFC_NAME
ACTVT
ACTVT
RFC_TYPE
RFC_NAME
ACTVT
Values
FUGR
/CRYSTAL/OPENSQL
16
Values
02
FUGR
/CRYSTAL/OPENSQL
16
23.1.1.19.4 Actions within Crystal Reports using InfoSet driver and reporting off InfoSet
Logging onto an SAP server
Authorization object Field Values
S_RFC
RFC_TYPE
RFC_NAME
ACTVT
FUGR
SYST
16
791 2012-12-12
Supplementary Configurations for ERP Environments
Creating a new report from an InfoSet on SAP NetWeaver (ABAP)
Authorization object Field Values
RFC_TYPE FUGR
S_RFC
S_CTS_ADMI
RFC_NAME
ACTVT
CTS_ADMFCT
/CRYSTAL/FLAT, SKBW,
AQRC
16
TABL
Note:
Also add enough authorizations to view data rows. For example, P_ORIG or P_APAP.
Related Topics
•
Setting the location of the data source
Verifying the database (refreshing table definitions in a report)
Authorization object Field Values
S_ADMI_FCD S_ADMI_FCD ST0R, ST0M
Setting the location of the data source
Authorization object Field
REPID
P_ABAP
COARS
Values
AQTGSYSTGENERATESY,
SAPDBPNP
2
792 2012-12-12
Supplementary Configurations for ERP Environments
23.1.1.19.5 Actions within Crystal Reports using InfoSet driver and reporting off an ABAP query
Logging onto an SAP server
Authorization object Field Values
RFC_TYPE FUGR
S_RFC RFC_NAME
ACTVT
SYST
16
Creating a new report from an ABAP query on SAP NetWeaver
Authorization object Field
P_ABAP
S_ADMI_FCD
S_TABU_DIS
REPID
COARS
S_ADMI_FCD
ACTVT
GROUP
Values
AQTG02==========P6,
SAPDBPNP
2
ST0R, ST0M
03
Name of table group
Verifying the database
Authorization object
S_ADMI_FCD
Field
S_ADMI_FCD
Values
ST0R, ST0M
793 2012-12-12
Supplementary Configurations for ERP Environments
Authorization object
S_RFC
Field
RFC_TYPE
RFC_NAME
ACTVT
Setting the location of the data source
Authorization object Field
REPID
P_ABAP
S_ADMI_FCD
S_RFC
S_TABU_DIS
COARS
S_ADMI_FCD
RFC_TYPE
RFC_NAME
ACTVT
ACTVT
GROUP
Values
FUGR
SKBW
16
Values
AQTG02==========P6,
SAPDBPNP
2
ST0R, ST0M
16
03
FUGR
SKBW
Name of table group
794 2012-12-12
Supplementary Configurations for ERP Environments
795
23.1.1.19.6 Actions within BI platform
Scheduling a report in dialog mode (with an Open SQL query)
Authorization object Field Values
CLASS
S_USER_GRP
ACTVT 03
RFC_TYPE
S_RFC
ZSEGREPORT
RFC_NAME
ACTVT
ACTVT
16
02
FUGR
SYST, RFC1, /CRYSTAL/OPEN-
SQL
Note:
The value for CLASS is BLANK.
Scheduling a report in batch mode using an Open SQL query
Authorization object Field Values
CLASS
S_USER_GRP
ACTVT 03
RFC_TYPE
S_RFC RFC_NAME
ACTVT
FUGR
SYST, RFC1, /CRYSTAL/OPEN-
SQL, SH3A
16
2012-12-12
Supplementary Configurations for ERP Environments
Authorization object
S_BTCH_JOB
ZSEGREPORT
S_BTCH_ADM
Field
JOBGROUP
JOBACTION
ACTVT
BTCADMIN
Values
' '
RELE
02
Y
Note:
The value for CLASS is BLANK.
Crystal entitlement system
Authorization object Field
Activity (ACTVT)
Value
Read, Write (33, 34)
Authorization for file access
(S_DATASET)
Physical file name (FILENAME) * (denotes All)
ABAP program name (PRO-
GRAM)
Activity (ACTVT)
*
16
Authorization Check for RFC
Access (S_RFC)
Name of RFC to be protected
(RFC_NAME)
BDCH, STPA, SUSO, SUUS,
SU_USER, SYST, SUNI,
PRGN_J2EE, /CRYSTAL/SECU-
RITY
Type of RFC object to be protected (RFC_TYPE)
Function group (FUGR)
796 2012-12-12
Supplementary Configurations for ERP Environments
Authorization object Field
Activity (ACTVT)
User Master Maintenance: User
Groups (S_USER_GRP)
User group in user master maintenance (CLASS)
Value
Create or Generate, and Display
(03)
*
Note:
For greater security, you may prefer to explicitly list the user groups whose members require access to SAP BusinessObjects
Enterprise.
Running and designing BW BeX queries
When creating a report from a universe based on a BW BeX query, if a date dimension is included, the system administrator needs to grant S_RS_IOBJ authorization to both the user designing the Universe and the user running the report.
Authorization object Field Values
ACTVT
03
S_RS_IOBJ
RSIOBJ
RSIOBJ_CAT
RSIOBJ_PART
23.2 Configuring for JD Edwards integration
797 2012-12-12
Supplementary Configurations for ERP Environments
23.2.1 Configuring Single Sign-on (SSO) for SAP Crystal Reports
By default, BI platform will be configured to allow SAP Crystal Reports users to access JD Edwards
EnterpriseOne data using Single Sign-on (SSO).
23.2.1.1 To deactivate SSO for JD Edwards and SAP Crystal Reports
1.
In the Central Management Console (CMC), click Applications.
2.
Double-click Crystal Reports Configuration.
3.
Click Single Sign-On Options.
4.
Select crdb_pseone.
5.
Click Remove.
6.
Click Save & Close.
7.
Restart SAP Crystal Reports.
23.2.1.2 To activate SSO for JD Edwards and SAP Crystal Reports
If you have deactivated SSO for JD Edwards and SAP Crystal Reports and wish to reactivate it.
1.
In the Central Management Console (CMC), click Applications.
2.
Double-click Crystal Reports Configuration.
3.
Click Single Sign-On Options.
4.
"Under Use SSO context for database logon..." type crdb_pseone.
5.
Click Add.
6.
Click Save & Close.
7.
Restart your Crystal Reports servers.
23.2.2 Configuring Secure Socket Layer for JD Edwards Integrations
You can use the Secure Sockets Layer (SSL) protocol for all network communication between clients and servers in your BI paltform and JD Edwards EnterpriseOne deployment.
798 2012-12-12
Supplementary Configurations for ERP Environments
Using JD Edwards EnterpriseOne data with BI platform requires some changes to your SSL configuration.
Similar to the SSL configuration for other BI platform servers and clients, store the following key and certificate files in a secure location (under the same directory) that can be accessed by the computers in your BI platform deployment.
• The trusted certificate file (cacert.der).
• The generated server certificate file (servercert.der).
• The server key file (server.key).
• The passphrase file (passphrase.txt).
23.2.2.1 To enable JD Edwards EnterpriseOne data connectivity with SSL
Note:
All values described in this task are case sensitive.
• Configure the two registry values under the following registry key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Business
Objects\Suite 12.0\Integration Kit for
PeopleSoft EnterpriseOne\QRY\Instances\noname]
"CommunicationProtocol"="ssl"
"SSL Configuration File"="C:\Program
Files\Business Objects\BusinessObjects XI 13.0\sslconf.properties"
You must restart BI platform reporting services (such as the Adaptive Job Server) for the changes to take effect.
23.2.2.2 SSL configuration property file
The property file sslconf.properties contains all the information for required certificates and keys used by BI platform. For example:
[default] businessobjects.orb.oci.protocol=ssl certDir=d:/ssl trustedCert=cacert.der
sslCert=servercert.der
sslKey=server.key
passphrase=passphrase.txt
The sslconf.properties file should be put in the folder where BI platform is installed, C:\Program
Files\Business Objects\BusinessObjects 13.0
by default.
799 2012-12-12
Supplementary Configurations for ERP Environments
23.3 Configuring for PeopleSoft Enterprise integration
23.3.1 Configuring Single Sign-on (SSO) for SAP Crystal Reports and PeopleSoft
Enterprise
By default, BI platform will be configured to allow SAP Crystal Reports users to access PeopleSoft
Enterprise data using Single Sign-on (SSO).
23.3.1.1 To deactivate SSO for PeopleSoft Enterprise and SAP Crystal Reports
1.
In the Central Management Console (CMC), click Applications.
2.
Double-click Crystal Reports Configuration.
3.
Click Single Sign-On Options.
4.
Select crdb_psenterprise.
5.
Click Remove.
6.
Click Save & Close.
7.
Restart SAP Crystal Reports.
23.3.1.2 To activate SSO for PeopleSoft Enterprise and SAP Crystal Reports
If you have deactivated SSO for PeopleSoft Enterprise and SAP Crystal Reports and wish to reactivate it.
1.
In the Central Management Console (CMC), click Applications.
2.
Double-click Crystal Reports Configuration.
3.
Click Single Sign-On Options.
4.
"Under Use SSO context for database logon..." type crdb_psenterprise.
5.
Click Add.
6.
Click Save & Close.
7.
Restart SAP Crystal Reports.
800 2012-12-12
Supplementary Configurations for ERP Environments
23.3.2 Configuring Secure Socket Layer communication
You can use the Secure Sockets Layer (SSL) protocol for all network communication between clients and servers in your BI platform deployment.
Similar to the SSL configuration for other BI platform servers and clients, store the following key and certificate files in a secure location (under the same directory) that can be accessed by the machines in your BI platform deployment.
• The trusted certificate file (cacert.der).
• The generated server certificate file (servercert.der).
• The server key file (server.key).
• The passphrase file (passphrase.txt).
23.3.2.1 SSL configuration property file
The property file sslconf.properties contains all the information for required certificates and keys used by SAP BI platform components. For example:
[default] businessobjects.orb.oci.protocol=ssl certDir=d:/ssl trustedCert=cacert.der
sslCert=servercert.der
sslKey=server.key
passphrase=passphrase.txt
The sslconf.properties file should be put in the folder where BI platform product is installed:
C:\Program Files\Business Objects\BusinessObjects 12.0 Integration Kit for
PeopleSoft\ by default.
23.3.2.2 To enable PeopleSoft Query Server with SSL
Note:
All values described in this task are case sensitive.
• Configure the two registry values under the registry key for every query server.
For example:
[HKEY_LOCAL_MACHINE\SOFTWARE\Business
Objects\Suite 12.0\Integration Kit for
PeopleSoft\QRY\Instances\noname]
801 2012-12-12
Supplementary Configurations for ERP Environments
"CommunicationProtocol"="ssl"
"SSL Configuration File"="C:\Program
Files\Business Objects\BusinessObjects 12.0 Integration Kit for
PeopleSoft\sslconf.properties"
You must restart BusinessObjects reporting servers (for example, the Adaptive Job Server) for the changes to take effect.
23.3.2.3 To enable Security Bridge with SSL
Note:
All values described in the following procedure are case-sensitive.
• Run crpsepmsecuritybridge.bat with following arguments by adding them to the .bat file.
-Dbusinessobjects.orb.oci.protocol=ssl
-DcertDir="d:\ssl"
-DtrustedCert=cacert.der
-DsslCert=servercert.der
-DsslKey=server.key
-Dpassphrase=passphrase.txt
Please be sure that the arguments are added in the correct location in the .bat file, right after the java.exe and before giving -jar arguments. For example:
@ECHO OFF
SETLOCAL
SET PATH=%PATH%;C:\Program Files\Business
Objects\BusinessObjects Enterprise 12.0\win32_x86\;C:\Program
Files\Business Objects\BusinessObjects 12.0 Integration Kit for
PeopleSoft\\epm;
"C:\Program Files\Business Objects\javasdk\bin\java.exe" -Dbusinessobjects.orb.oci.protocol=ssl
-DcertDir="C:\!test" -DtrustedCert=cacert.der
-DsslCert=servercert.der -DsslKey=server.key
-Dpassphrase=passphrase.txt -jar "C:\Program Files\Business
Objects\BusinessObjects 12.0 Integration Kit for
PeopleSoft\\epm\crpsepmsecuritybridge.jar" %1 "language"
"C:\Program Files\Business
Objects\\LanguagePacks.xml\LanguagePacks.xml"
The following table shows the descriptions that correspond to these examples:
DcertDir=d:\ssl The directory to store all the certificates and keys.
DtrustedCert=cacert.der
Trusted certificate file. If specifying more than one, separate with semicolons.
DsslCert=clientcert.der
DsslKey=client.key
Certificate used by the SDK.
Private key of the SDK certificate.
802 2012-12-12
Supplementary Configurations for ERP Environments
Dpassphrase=passphrase.txt
The file that stores the passphrase for the private key.
23.3.3 Performance Tuning for PeopleSoft systems
To ensure optimal performance when you report off PeopleSoft queries, it is important to understand how queries are executed by Crystal Reports and BI platform.
Whenever you refresh or run a report that is based on a PeopleSoft query, a connection is made to a
PeopleSoft server:
• In PeopleSoft Enterprise (PeopleTools 8.46 or newer) environments, a connection is made to the
PeopleSoft Analytic Server.
• In PeopleSoft Enterprise (PeopleTools 8.21-8.45) environments, a connection is made to the
PeopleSoft Application Server.
23.3.3.1 Recommendations
In an optimal deployment, one or more PeopleSoft Analytic or Application Servers are set up to handle only report requests. In each of these servers, the settings for Min and Max Instances control the number of report requests that can be processed at any one time. This setup provides the following advantages:
• There is no contention between report requests and other transactional requests in the PeopleSoft server.
• It is possible to perform maintenance on the server that handles report requests without disabling the server that handles transactional requests.
In an environment where both report and transactional requests are handled by the same PeopleSoft
Analytic or Application Server, you must configure BI platform not to run more than one report at the same time. Otherwise, users will not be able to make any transactional requests if all of the
PSANALYTICSRV or PSAPPSRV processes are used to run reports.
Note:
• For information on how to limit the number of scheduled report jobs and view-report-on-demand jobs, see "Managing and Configuring Servers" in the BusinessObjects Business Intelligence platform
Administrator's Guide.
• It is not possible to configure the system to limit the number of Crystal Reports users who may try to access the server at the same time.
803 2012-12-12
Supplementary Configurations for ERP Environments
If performance issues arise, use the Psadmin configuration tool to determine if requests are being queued. As well, monitor the system resources on the PeopleSoft Analytic or Application Server machine.
If virtual memory is being used because of a lack of physical memory, then processing may also slow down.
23.3.3.2 PeopleSoft servers
In a PeopleSoft Analytic Server, the process that refreshes or runs the reports is the PSANALYTICSRV process. In a PeopleSoft Application Server, the process that refreshes or runs the reports is the
PSAPPSRV process. The number of available PSANALYTICSRV or PSAPPSRV processes determines the number of reports that you can run simultaneously.
A typical PeopleSoft Analytic or Application Server configuration file contains the following information:
Min Instances=3
Max Instances=5
In this example, a minimum of three PSANALYTICSRV or PSAPPSRV processes are available at any time with the ability to increase to up to five processes. The settings do not necessarily mean that five reports can always be run at the same time; the processes may also be used to handle other tasks in the system. If no PSANALYTICSRV or PSAPPSRV processes are available to handle a request, then the request is queued until a process becomes available.
Note:
The configuration file for PeopleSoft Application Servers also typically includes the Service Timeout parameter, which specifies how long queued requests wait for an available process. If no process becomes available within the time that is specified for the parameter, then the request times out.
23.4 Configuring for Siebel integration
23.4.1 Configuring Siebel to integrate with SAP BusinessObjects Business Intelligence platform
The BI platform integration provides a link to Crystal Reports that allows you to embed BusinessObjects
Business Intelligence suite content into a Siebel application. Once installed and configured, the new menu item allows users to launch BI launch pad from within the Siebel application.
804 2012-12-12
Supplementary Configurations for ERP Environments
By default, the files required are installed in the following folder: C:\Program Files (x86)\SAP
BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\Samples\siebel\Siebel
Files\
.
Note:
The subfolders Siebel 7.7 and Siebel 8.0 contain different files for use with Siebel versions 7.7, and
8.0.
23.4.1.1 To import the BI platform Siebel integration project
1.
Start Siebel Tools.
2.
Click Tools > Import from Archive.
3.
When prompted for an archive file, browse to the Siebel Files folder of your Integration product installation.
By default this is: <install directory>\SAP BusinessObjects Enterprise XI
4.0\Samples\siebel\Siebel Files\
.
4.
Go to the appropriate subfolder (either Siebel 7.7 or Siebel 8.0) and select the BusinessObject sEnterprise.sif
file.
The Import Wizard appears.
5.
Click Merge the object definition form the archive file with the definition in the repository.
6.
Proceed through the wizard's screens to finish importing the integration project.
The integration project is added to your repository.
7.
Lock the SAP Businessobjects Integration project.
23.4.2 Creating the Crystal Reports menu item
1.
In Siebel Tools, lock the Menu project.
2.
In the Object Explorer, select the Menu Item object.
Note:
If the Menu object does not appear in the Object Explorer, click View > Options in Siebel Tools, click the Object Explorer tab, and select the Menu object.
3.
In the Menus list, select the Generic Web menu.
4.
Click the Menu Items list heading.
5.
Click Edit > New Record.
6.
Define the new menu item appropriately. These are the recommended values:
• Name: View - Crystal Reports
805 2012-12-12
Supplementary Configurations for ERP Environments
• Caption: Crystal Reports
• Command: Crystal Reports
• Comments: SAP BusinessObjects Integrated Report Menu
• Inactive: False
7.
Use a position number to select a location for the menu item in your View menu.
To help you choose a position number, sort the menu items by Position.
8.
You can now add Locale records to localize the caption as appropriate.
Now recompile your Siebel application. See
Recompiling the Siebel application
.
806
23.4.2.1 Recompiling the Siebel application
When you have installed BI platform and made its command available to users through a Siebel menu item, you must recompile your Siebel application following your usual procedures. For details, see the
Siebel Bookshelf.
When you have recompiled your Siebel application, regenerate its JavaScript files. In Siebel 7.7 and later it is possible to automatically regenerate the JavaScript files as part of the recompile process.
Because the steps required to compile the Siebel repository are performed on your Siebel Tools workstation, you need to deploy the resulting JavaScripts from the Siebel Tools workstation to your
Siebel Server. Typically, and depending on where Siebel is installed, you can find the generated
JavaScript files in the following location:
C:\sea77\tools\PUBLIC\ENU\srf1096416329_444
The example folder name srf1096416329_444 is generated by Siebel Tools, and uniquely corresponds to the resulting repository file.
The JavaScript files should be deployed on the Siebel Server, typically in the following location, depending on where Siebel is installed:
C:\sea77\SWEApp\PUBLIC\ENU\srf1096416329_444
Be sure to maintain the folder name as generated by Siebel Tools.
In addition, you must update your Siebel configuration file on the Siebel Server machine to permit the service. Find the appropriate configuration file on your Siebel Server machine. For example, if you are running an English version of the Siebel Call Center, use uagent.cfg. By default, this file is found at
C:\sea77\siebsrvr\bin\ENU\uagent.cfg
for Siebel 7.7.
Then add the following line to the end of the SWE section of the configuration file:
ClientBusinessServiceNUMBER = BusinessObjects Integration Service
The ClientBusinessService numbers are sequential. If there are no other ClientBusinessServices in the SWE section, set NUMBER to 0. Otherwise, set NUMBER to be the next highest value.
2012-12-12
Supplementary Configurations for ERP Environments
For Siebel 8.x or higher:
1.
Log into Siebel Tools and locate the Siebel Universal Agent application object in the Object Explorer.
2.
Expand the Application objects to reveal the Application User Prop object.
3.
Create a new record for each business service to be declared, setting the Name and Value properties for each as shown:
• Name = ClientBusinessServiceX
• Value = BusinessObjects Integration
You will now create the Crystal Reports menu item that invokes the imported Siebel command.
23.4.3 Contextual awareness
Contextual awareness is a feature that presents the user with reports that are likely to be relevant to their current task. In this case, users accessing Crystal Reports directly from a Siebel Client application would automatically be show reports that have been designed to incorporate Siebel data.
23.4.3.1 To configure contextual awareness
Before configuring for context sensitivity, make sure you have completed the following.
• installed the Siebel Integration product
• Configured Siebel to integrate with the BI platform
1.
Open the Central Management Console (CMC) for BI platform.
2.
Click Authentication.
3.
Double-click Siebel.
The Siebel mapping interface will appear.
4.
Click Domains.
The domain mapping interface appears.
5.
Make note of the Domain name that corresponds to the Siebel server you want to use.
6.
Close the Siebel mapping interface.
7.
Open BI launch pad.
8.
Create a new folder under PublicFolders\Siebel with the same name as the Siebel domain in the CMC.
9.
Place any reports that are designed to incorporate Siebel information in this folder.
807 2012-12-12
Supplementary Configurations for ERP Environments
808
23.4.3.2 To specify the URL for contextual awareness
1.
Once you have regenerated the application's JavaScript files, go to the Siebel Files folder of your
BI platform installation, which is by default C:\Program Files\Business Objects\SAP
BusinessObjects Enterprise XI\Siebel Files\
.
2.
Copy the BusinessObjectsEnterpriseServer.html file. Then find the public folder where the genbscript program generated the new JavaScript files, and place a copy of
BusinessObjectsEnterpriseServer.html in the appropriate language subfolder.
For example, if you generated an application's JavaScript files into the c:\sea752\SWEApp\PUB
LIC\ENU folder on the Siebel server, copy the BusinessObjectsEnterpriseServer.html file to the c:\sea752\SWEApp\PUBLIC\ENU folder.
3.
Open the BusinessObjectsEnterpriseServer.html file from the public folder in a text editor such as
Notepad, and locate this line:
Var userDomain = "SIEB78" var destAddr = "http://<SAP BusinessObjects
server>:8080/BOE/BI/logon/siebelStart.do"
Note:
• If you modify the userDomain or destAddr variable, you must clear your browser's cached web pages to ensure that the browser will point to the correct destination address.
• The userDomain is case-sensitive.
23.4.3.3 To verify contextual awareness
1.
Log on to a Siebel application that uses the modified Generic Web menu.
2.
Navigate to any screen and click the View menu.
Your new Crystal Reports menu item should appear on the menu.
3.
Click the Crystal Reports menu item.
BI platform opens the BI launch pad window that requests the username and password to connect to, and this is only needed when first time logon before session timeout. The domain name configured in html and the Siebel authentication should already be filled in.
Note:
This step is only to verify your installation up until this point. You cannot log on to BI platform using
Siebel Authentication until you have mapped Siebel responsibilities to BI platform.
2012-12-12
Supplementary Configurations for ERP Environments
23.4.3.4 Adding the folders to the BI platform
BI platform integration for Siebel requires some folders to be added to BI launch pad to fully enable the contextual awareness feature.
In order to function, the contextual folder should have the following structure: Root
Dir\Siebel\Domain Name
. Only reports stored in the Domain Name subfolder and configured in the Siebel system to associate with the specific Business Objects business component will display as part of the contextual awareness feature. The Domain Name used here must be the same domain name configured for Siebel in the Authentication configuration, and the same as the value configured in the Siebel side BusinessObjectsEnterpriseServer.html file.
Note:
Siebel Tools is required to complete the steps in this section.
23.4.4 Configuring Single Sign-on (SSO) for SAP Crystal Reports and Siebel
By default, the BI platform will be configured to allow SAP Crystal Reports users to access Siebel data using Single Sign-on (SSO).
23.4.4.1 To deactivate SSO for Siebel and Crystal Reports
1.
In the Central Management Console (CMC), click Applications.
2.
Double-click Crystal Reports Configuration.
3.
Click Single Sign-On Options.
4.
Select crdb_siebel.
5.
Click Remove.
6.
Click Save & Close.
7.
Restart SAP Crystal Reports.
23.4.4.2 To activate SSO for Siebel and SAP Crystal Reports
809 2012-12-12
Supplementary Configurations for ERP Environments
If you have deactivated SSO for Siebel and SAP Crystal Reports and wish to reactivate it.
1.
In the Central Management Console (CMC), click Applications.
2.
Double-click Crystal Reports Configuration.
3.
Click Single Sign-On Options.
4.
"Under Use SSO context for database logon..." type crdb_siebel.
5.
Click Add.
6.
Click Save & Close.
7.
Restart SAP Crystal Reports servers.
23.4.5 Configuring for Secure Sockets Layer Communication
You can use the Secure Sockets Layer (SSL) protocol for all network communication between clients and servers in your Siebel and BI platform deployments.
Similar to the SSL configuration for other BI platform servers and clients, store the following key and certificate files in a secure directory that can be accessed by the machines in your Siebel deployment.
• The trusted certificate file (cacert.der).
• The generated server certificate file (servercert.der).
• The server key file (server.key).
• The passphrase file (passphrase.txt).
SSL configuration property file
The property file sslconf.properties contains all the information for required certificates and keys used by BusinessObjects XI Integration for Siebel components. For example: businessobjects.orb.oci.protocol=ssl certDir=d:/ssl trustedCert=cacert.der
sslCert=servercert.der
sslKey=server.key
passphrase=passphrase.txt
The sslconf.properties file should be put in the folder where the BI platform product is installed,
C:\Program Files\Business Objects\SAP BusinessObjects Enterprise XI\ by default.
810 2012-12-12
Managing and Configuring Logs
Managing and Configuring Logs
24.1 Logging traces from components
Tracing allows system administrators and support personnel to report on the performance of BI platform components (servers and web applications) and the activity that occurs within the monitored components.
System-level messages generated by BI platform servers are traced and written to log files. These log files are used by system administrators to monitor performance or for debugging purposes. Traces are recordings of events that occur during the operation of a monitored component. The traced events range from severe exception errors on one end to simple status messages at another.
Trace Log
Trace messages are collected in log files saved under the generic log file (.glf) extension. In setting the trace log level for a component, you determine the type and verbosity of information sent to the log file. The trace log level is in effect a filter that suppresses traces that are below a specified importance level. Suppressed traces are not written to the output log file. By monitoring the trace log for a component, you can determine whether the current instance of a component or its configuration must be changed to handle the increased workload, or whether the increased load has no significant effect on the performance.
24.2 Trace log levels
The following table describes the available trace log levels for BI platform components:
811 2012-12-12
Managing and Configuring Logs
Level
Unspecified
None
Low
Medium
High
Description
The trace log level is specified through another mechanism, usually an .ini file.
When the trace log level is set to "None", the filter to optionally suppress traces below a specified importance level is deactivated.
Note:
A "None" trace log level does not mean that the tracing feature is turned off.
System resources continue to be monitored and traces will be logged for rare critical events such as failed assertions.
The trace log filter is set to allow for logging error messages while ignoring warning and most status messages. However, very important status messages will be logged for component startup, shutdown, as well as the start and end request messages.
Note:
This level is not recommended for debugging purposes.
The trace log filter is set to include error, warning, and most status messages in the log output. Status messages that are least important or highly verbose will be filtered out. This level is not verbose enough for debugging purposes.
No messages will be excluded by the filter. This level is recommended for debugging purposes.
Note:
A "High" trace log level could affect system resources. It could potentially increase
CPU usage as well as storage space in the file system.
24.3 Configuring tracing for servers
Traces for a monitored BI platform server are written to a specific log file (.glf) and stored in the
Logging folder or directory. On Windows platforms the Logging directory is by default located in:
Program Files <INSTALLDIR>\SAP BusinessObjects Enterprise XI 4.0\logging
. On
Unix, the directory is located in: <INSTALLDIR>/sap_bobj/logging.
Note:
The .glf file name is formatted as a combination of shorthand identifier, the server name, and number reference - for example aps_mysia.AdaptiveProcessingServer_trace.000012.glf. A new trace log file is created for the monitored server once the log file size approaches the one megabyte threshold.
Administrators are able to calibrate the severity and importance of the traces collected in the log file by setting the trace log level for a specific server or a collection of servers. You can modify the trace log level through the following recommended methods:
812 2012-12-12
Managing and Configuring Logs
• Using the "TraceLog Service" for a specific server or a group of servers in the Central Management
Console (CMC)
• Manually change the trace log level and other settings in the BO_trace.ini file.
If you want to only modify the trace log level for specific servers it is recommended that you use the
"TraceLog Service" in the CMC. To modify other tracing parameters you must reconfigure the
BO_trace.ini
file.
24.3.1 To set the server trace log level in the CMC
The trace log level for a server can be adjusted without affecting other tracing settings. Follow the instructions below to adjust the trace log level.
1.
Go to the "Servers" management area of the CMC.
2.
Access the servers whose trace log level you want to modify.
a.
Click the server category to access a server or servers from a specific server “category”, b.
Click Servers List in the navigation pane to access the complete list of servers.
3.
Right-click the server and select Properties.
The "Properties" dialog box appears.
4.
In the "Trace Log Service" area, select the desired setting from the "Log level" list.
5.
Click Save & Close to submit the modified trace log level.
The new trace log level will take effect within a minute.
To specify a different directory for the log files, use the -loggingPath parameter together with a path to the target directory in the "Command Line Parameters" area. This modification will not take effect until the server is restarted.
Related Topics
•
24.3.2 To set the trace log level for multiple servers managed in the CMC
1.
Go to the "Servers" management area of the CMC.
The available Service Categories are displayed in the "Servers" page.
2.
Access the servers whose trace log level you want to reset.
a.
Click the server category to access a server or servers from a specific server category,.
b.
Click Server List in the navigation pane to access the complete list of servers.
813 2012-12-12
Managing and Configuring Logs
3.
Select the servers.
To select multiple servers, hold down the Ctrl key while selecting.
4.
Right-click and select Edit Common Services.
The "Edit Common Services" screen is displayed.
5.
In the "Trace Log Service" area, select the desired setting from the "Log level" list.
6.
Click OK to submit the modified trace log level.
The new trace log level will take effect within a minute.
To specify a different directory for the log files, use the -loggingPath parameter together with a path to the target directory in the "Command Line Parameters" area. This modification will not take effect until the servers are restarted.
Related Topics
•
24.3.3 To configure server tracing through the BO_trace.ini file
The BO_trace.ini file is read every minute and by default it is configured to disable tracing. To activate and configure tracing using the BO_trace.ini file, follow these steps:
1.
Open the BO_trace.ini file.
• The default location on Windows is: <INSTALLDIR>\SAP BusinessObjects Enterprise
XI 4.0\conf\
.
• The default location on Unix is: <INSTALLDIR>/sap_bobj/enterprise_xi40/conf/.
2.
Uncomment the required lines under the "Trace Syntax and Setting" section.
3.
Modify the server tracing parameters as required.
The table below lists the general parameters used for configuring server tracing.
814 2012-12-12
Managing and Configuring Logs
Parameter
active importance alert severity size keep_num
Possible values
false, true
Description
If set to true, trace messages that meet the threshold set in the importance parameter will be traced. If set to false, trace messages will not be traced based on their "importance" level. Default value is false.
'<<', '<=', '==', '>=', '>>', xs, s, m, l, xl
Note:
importance = xs or impor tance = << are the most verbose options available while importance = xl or impor tance = >> are the least.
Specifies the threshold for tracing messages. All messages beyond the threshold will be traced. Default value is m
(medium).
false, true
'S', 'W', 'E', 'A', 'F'.
If set to true, trace messages that meet the threshold set in the severity parameter will be traced. If set to false, the trace messages will not be traced based on their "severity" level.
Default value is true.
Specifies the threshold severity over which massages can be traced. Everything under the severity listed will be recorded
(so a setting of 'E' means that
Errors, Asserts and Fatal traces will be logged. 'S' consumes the most disk space. Default value is 'E'.
• S = success
• W = warning
• E = error
• A = assert
• F = fatal
Possible values are integers >=
1000
Specifies the number of messages in a trace log file before a new one is created. Default value is 100000.
Possible values are integers >=
1000
Specifies the number of logs to keep.
815 2012-12-12
Managing and Configuring Logs
Parameter
administrator log_dir always_close
Possible values
Strings or integers on, off
Description
Specifies an annotation to use in the output log file. For example, if administrator = "hello" this string is inserted into the log file.
Specifies the output log file directory. By default log files are stored in the Logging folder.
Specifies if the log file should be closed after a trace is written to the log file. Default value is off.
4.
Save and close the BO_trace.ini file.
The modified settings will not take effect until all the servers are restarted.
Example:
active=false; severity='E'; importance='=='; size=1000000; keep_num=437;
816
24.3.3.1 To configure tracing per server
The BO_trace.ini file is used to specify tracing parameters for BI platform servers. The settings affect all managed servers. Administrators can use the BO_trace.ini file to set particular tracing parameters for a specific server.
1.
Open the BO_trace.ini file.
• The default location on Windows is: <INSTALLDIR>\SAP BusinessObjects Enterprise
XI 4.0\conf/
.
• The default location on Unix is: <INSTALLDIR>/sap_bobj/enterprise_xi40/conf/.
2.
Uncomment the required lines under the "Trace Syntax and Setting" section.
3.
To specify tracing settings for a specific server use an IF statement as shown in the example below: if (process == "aps_MySIA.ProcessingServer")
{ active = true; importance = '<<' ; alert = true; severity = ' '; keep_num = 487;
2012-12-12
Managing and Configuring Logs size = 100 * 1000;
}
4.
Save and close the BO_trace.ini file.
The modified settings will be implemented with a minute. The new settings will override any trace log level specified in the CMC for a specific server.
24.4 Configuring tracing for web applications
Traces for a monitored BI platform web application are written to a log file (.glf) and stored in a folder on the machine hosting the web applications folder. The trace log files will be located by default in the following directory: $userHome/SBOPWebapp_$application_$IPaddress_$port/.
Note:
On Windows, by default, Tomcat is installed and configured to run under the Local System account and therefore UserHome is the root of the Windows drive (that is, C:\).
Administrators are able to calibrate the severity and importance of the traces collected in the log file by setting the trace log level for a specific or a collection of web applications. You can modify the trace log level through the following recommended methods:
• Using the "Trace Log" application settings in the Central Management Console (CMC).
• Manually reconfigure the trace log level and all other tracing settings in the BO_trace.ini. This file is deployed together with the BOE and dswsbobje WAR files on your web application server.
To modify only the trace log level for a BOE web application, it is strongly recommended that you use the CMC option. To modify all tracing parameters, you must reconfigure the BO_trace.ini file.
Note:
Before reconfiguring the BO_trace.ini file, you must use the WDeploy tool to undeploy the existing web applications from your web application server. After reconfiguring BO_trace.ini, it must be redeployed together with the web applications on your web application server. For more information on using WDeploy to prepare, deploy, and undeploy web applications, see the SAP BusinessObjects
Business Intelligence Platform Web Application Deployment Guide.
24.4.1 To set the web application trace log level in the CMC
By default the trace log level for web applications in the CMC is set to "Unspecified". Trace log settings are available for the following applications in the CMC:
• Central Management Console
• BI launch pad
817 2012-12-12
Managing and Configuring Logs
• Open Document
• Web Service
• Promotion Management
• Version Management
• Visual Difference
To trace all other web applications, use the manual method to configure the corresponding BO_trace file.
1.
Go to the "Applications" management area of the CMC.
The "Applications" dialog box appears.
2.
Right-click the application and select Trace Log Settings.
The "Trace Log Settings" dialog box appears.
3.
Select the desired setting from the Log Level list.
4.
Click Save & Close to submit the trace log level.
The new trace log level will be in effect after the next logon to the web application.
Related Topics
•
24.4.2 To manually modify tracing settings through the BO_trace.ini file
The BO_trace.ini file is deployed together with BOE and dswsbobje WAR files on the web application server. This file is not always accessible on the web application server. You must undertake the following preliminary step. The affected web application must be undeployed from the web application server.
1.
Use WDeploy to undeploy the web application from your web application server. For more information on using WDeploy to undeploy web applications please see the SAP BusinessObjects Business
Intelligence Platform Web Application Deployment Guide.
Note:
If you are using the Tomcat web application server provided with the BI platform installation, the
BO_trace.ini
file is accessible in the following directory. You do not need to undeploy the web applications and modify the file directly.
• The tracing configuration file for the BOE.war file is available at: <INSTALLDIR>\Tomcat6\we bapps\BOE\WEB-INF\TraceLog
.
• The tracing configuration file for the dswsbobje.war file is available at:<INSTALLDIR>\Tom cat6\webapps\dswsbobje\WEB-INF\conf
.
If you are using the bundled Tomcat web application server skip to step 3.
2.
Access a predeployed version of the BO_trace.ini file for the BOE or dswsbobje WAR files.
818 2012-12-12
Managing and Configuring Logs
• A predeployed version of the configuration file for the BOE.war file is available by default in the following directory: <INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\TraceLog
.
• A predeployed version of the configuration file for the dswsbobje.war file is available by default in the following directory: <INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\dswsbobje\WEB-INF\conf
.
3.
Open the BO_trace.ini file.
• The default location on Windows is: <INSTALLDIR>\SAP BusinessObjects Enterprise
XI 4.0\conf
.
• The default location on Unix is: <INSTALLDIR>/sap_bobj/enterprise_xi40/conf/.
4.
Uncomment the required lines under the "Trace Syntax and Setting" section.
5.
Modify the server tracing parameters as required.
The table below lists all the available parameters for configuring server tracing.
Parameter
active importance
Possible values
false, true
Description
Enables tracing for the current process or server if set to true.
Default value is false.
'<<', '<=', '==', '>=', '>>', xs, s, m, l, xl
Note:
importance = xs is the most verbose option available while importance = xl is the least.
Specifies the threshold for tracing messages. All messages beyond the threshold will be traced. Default value is m
(medium).
alert severity size keep false, true
'S', 'W', 'E', 'A', 'F', success, warning, error, assert, fatal
Specifies to automatically enable trace for severe system events. Default value is true.
Specifies the threshold severity over which massages can be traced. 'S' consumes the most disk space. Default value is 'E'.
Possible values are integers >=
1000
Specifies the number of messages in a trace log file before a new one is created. Default value is 100000.
false, true Specifies whether or not to keep the old log file after a new file is created. Default value is false.
819 2012-12-12
Managing and Configuring Logs
Parameter
administrator log_dir always_close
Possible values
Strings or integers on, off
Description
Specifies an annotation to use in the output log file. For example, if administrator = "hello" this string will be inserted into the log file.
Specifies the output log file directory. By default log files are stored in the Logging folder.
Specifies if the log file should be closed after a trace is written to the log file. Default value is off.
active=false; severity='E'; importance='=='; size=1000000; keep=false;
6.
Save and close the BO_trace.ini file.
7.
Use WDeploy to deploy the WAR file on the machine hosting the web application server.
The modified tracing settings take effect after the first log on to the web application.
24.4.2.1 To configure tracing for a specific web application
The BO_trace.ini file is used to specify tracing parameters for BI platform web applications. The settings affect all the applications associated with the deployed WAR file. Administrators can also use the BO_trace.ini file to set particular tracing parameters for a specific web application.
In the current release of BI platform, the table below lists the web applications and their associated
WAR file.
820 2012-12-12
Managing and Configuring Logs
821
Web application
Central Management Console
BI launch pad
Open Document
Web Service
WAR file
BOE.war
BOE.war
BOE.war
dswsbob je.war
Predeployed location
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\TraceLog
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\TraceLog
<INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\TraceLog
<INSTALLDIR>\ SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\dswsbobje\WEB-INF\conf
1.
Use WDeploy to undeploy the web application from your web application server. For more information on using WDeploy to undeploy web applications, see the SAP BusinessObjects Business Intelligence
Platform Web Application Deployment Guide.
Note:
If you are using the Tomcat web application server provided with the BI platform installation, the
BO_trace.ini
file is accessible in the following directory. You do not need to undeploy the web applications. You can modify the file directly.
• The tracing configuration file for the BOE.war file is available at: <INSTALLDIR>\Tomcat6\we bapps\BOE\WEB-INF\TraceLog
.
• The tracing configuration file for the dswsbobje.war file is available at:<INSTALLDIR>\Tom cat6\webapps\dswsbobje\WEB-INF\conf
.
If you are using the bundled Tomcat web application server skip to step 3.
2.
Access a predeployed version of the BO_trace.ini file for the BOE or dswsbobje WAR files.
• A predeployed version of the configuration file for the BOE.war file is available by default in the following directory: <INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\BOE\WEB-INF\TraceLog
.
• A predeployed version of the configuration file for the dswsbobje.war file is available by default in the following directory: <INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\warfiles\webapps\dswsbobje\WEB-INF\conf
.
3.
Open the BO_trace.ini file.
4.
Uncomment the required lines under the "Trace Syntax and Setting" section.
5.
To specify tracing settings for a specific web application use an IF statement as shown in the example below: if (device_name == "Webapp_opendocument_trace")
{ active = true; importance = '<<' ; alert = true; severity = ' '; keep_num = 332; log_dir = 'C:\SAP\SAP BusinessObjects Enterprise XI 4.0\logging' size = 100 * 1000;
}
The table below lists all the available parameters for configuring web application tracing.
2012-12-12
Managing and Configuring Logs
Parameter
active importance alert severity size keep administrator log_dir always_close
Possible values
false, true
Description
Enables tracing for the current process or server if set to true.
Default value is false.
'<<', '<=', '==', '>=', '>>', xs, s, m, l, xl
Note:
importance = xs is the most verbose option available while importance = xl is the least.
Specifies the threshold for tracing messages. All messages beyond the threshold will be traced. Default value is m
(medium).
false, true
'S', 'W', 'E', 'A', 'F', success, warning, error, assert, fatal
Specifies to automatically enable trace for severe system events. Default value is true.
Specifies the threshold severity over which massages can be traced. 'S' consumes the most disk space. Default value is 'E'.
Possible values are integers >=
1000
Specifies the number of messages in a trace log file before a new one is created. Default value is 100000.
false, true Specifies whether or not to keep the old log file after a new file is created. Default value is false.
Strings or integers Specifies an annotation to use in the output log file. For example, if administrator = "hello" this string will be inserted into the log file.
on, off
Specifies the output log file directory. By default log files are stored in the Logging folder.
Specifies if the log file should be closed after a trace is written to the log file. Default value is off.
6.
Save and close the BO_trace.ini file.
7.
Use WDeploy to deploy the WAR file on the machine hosting the web application server.
822 2012-12-12
Managing and Configuring Logs
24.5 Configuring tracing for BI platform client applications
Tracing can be activated on the following clients:
• Universe design tool
• Information design tool
• Web Intelligence Rich Client
You can configure tracing for these components by editing .ini files for each of the client types. These
.ini files operate identically to the BO_trace.ini file described elsewhere in this chapter. See
To configure server tracing through the BO_trace.ini file
for details on modifying the .ini file.
The files need to be located in the working directories configured for these application
(<INSTALLDIR>\SAP BusinessObjects by default), if they do not already exist you may need to create them. The files have the following names:
• Universe design tool: designer_trace.ini.
• Information design tool: BO_Trace.ini
• Web Intelligence Rich Client: WebIRichClient_trace.ini
24.6 Configuring tracing for upgrade management tool
Tracing for the upgrade management tool is done via the BO_trace.ini configuration file.
The default location on Windows is: <INSTALLDIR>\SAP BusinessObjects Enterprise XI
4.0\conf\
.
The default location on Unix is: <INSTALLDIR>/sap_bobj/enterprise_xi40/conf/.
Note:
Unlike other BI platform components, tracing configuration for the upgrade management tool cannot be performed via the CMC.
24.6.1 To configure tracing for upgrade management tool
1.
Open the BO_trace.ini file.
• The default location on Windows is: <INSTALLDIR>\SAP BusinessObjects Enterprise
XI 4.0\conf\
.
823 2012-12-12
Managing and Configuring Logs
• The default location on Unix is: <INSTALLDIR>/sap_bobj/enterprise_xi40/conf/.
2.
Uncomment the required lines under the "Trace Syntax and Setting" section.
3.
To specify tracing settings for a specific server use an IF statement as shown in the example below: if (process == "upgrademanagementtool")
{ active = true; importance = '<<' ; alert = true; severity = ' '; keep = false; size = 100 * 1000;
}
Tip:
The process must be specified as upgrademanagementtool for the tracing setting to apply to the
Upgrade management tool.
4.
Save and close the BO_trace.ini file.
The modified settings will be implemented with a minute.
824 2012-12-12
Integration to SAP Solution Manager
Integration to SAP Solution Manager
25.1 Integration overview
Supportability features have been added to BI platform to enable integration into SAP Solution Manager.
The following SAP Solution Manager components can be used to provide support for your BI platform deployment:
• Solution Landscape Directory
• Solution Manager Diagnostics
• Introscope by CA Wily
• SAP Passport
Note:
To access the SAP Support Portal for SAP BusinessObjects go to: https://websmp205.sap-ag.de/bosapsupport
25.2 SAP Solution Manager integration checklist
The following table summarizes what components are required to enable SAP Solution Manager to provide support for BI platform.
825 2012-12-12
Integration to SAP Solution Manager
SAP Solution Manager Support
SLD registration
SMD integration
Performance instrumentation
SAP Passport
Required for BI platform
• SAPHOSTAGENT must be installed to enable registration of BI platform servers.
Note:
BI platform installer will automatically register servers if SAPHOSTAGENT is already installed.
• Must create a connect.key file for the data supplier reporting on the back-end servers.
• (Optional) For SLD registration with Web-
Sphere 6.1 or 7, the SLDREG registration tool must be installed on each WebSphere web application server. For more information, refer to SAP Note 1482727.
• (Optional) For SLD registration with SAP
NetWeaver 7.2, install SLDREG on every
NetWeaver host. Refer to SAP Note 1018839 for more information.
• (Optional) For SLD registration with Apache
Tomcat 6.0, SLDREG must be installed on each Tomcat server. For more information, refer to SAP Note 1508421.
• Must download and install SMD Agent (DIAG-
NOSTICS.AGENT) on all hosts of BI platform servers.
• SMAdmin user account must be enabled in BI platform.
• Introscope Agent must be configured to connect to Enterprise Manager. Use the BI platform installer or CMC node placeholders to configure the connections.
• SMD Agent must be installed.
• BI platform must be configured to connect to the SMD Agent. Use the BI platform installer or CMC node placeholders to configure the connections.
• You need to download and install SAP Passport client tool.
826 2012-12-12
Integration to SAP Solution Manager
25.3 Managing system landscape directory registration
25.3.1 Registration of BI platform in the System Landscape
The System Landscape Directory (SLD) is a central repository of system landscape information that is relevant for the management of the software lifecycle. The SLD contain a description of the system landscape - the systems and software components that are currently installed. SLD data suppliers register the systems on the SLD server and keep the information up-to-date. Management and business applications access the information stored in the SLD to perform tasks in a collaborative computing environment.
The System Landscape Directory-Data Supplier (SLD-DS) is the application responsible for registering the BI platform servers into the SLD server. A specific data supplier is provided for every installation of the platform to report on the following components:
• BI platform servers
• Web applications and services hosted on the WebSphere web application server.
Note:
SAP NetWeaver has a built-in SLD-DS supplier that registers the NetWeaver application server as well as hosted web applications and services. This SLD-DS is relevant for BI platform deployments that are integrated within an SAP NetWeaver environment.
The SLD-DS that reports on BI platform servers requires that the SLDREG program be installed and configured. The SLDREG program is installed when you install the SAPHOSTAGENT tool. For more information on how to access and install the SAPHOSTAGENT see the Preparation section in the SAP
BusinessObjects Business Intelligence Platform Installation Guide. Once SLDREG has been installed, you need to create a connect.key file to enable it to connect to the SLD server.
For information on how to configure the specific data supplier for WebSphere, see the Web Application
Deployment Guide.
During the installation of BI platform, information required for registering BI platform is stored in a configuration file. This file contains information used by the SLD DS to connect to the BI platform database.
25.3.1.1 To create a connect.key file for the SLD data supplier
BI platform
827 2012-12-12
Integration to SAP Solution Manager
Before creating a connect.key file for the SLD data supplier, you need to download and install the
SAPHOSTAGENT see the Preparation section in the
SAP BusinessObjects Business Intelligence
Platform Installation Guide for more details.
Note:
The connect.key file is required for SLD registration with the data supplier that reports on BI platform servers.
1.
Open a command line console.
2.
Navigate to the default SAPHOSTAGENT install path.
• On Windows: Program Files\SAP\hostctrl\exe
• On Unix: /usr/sap/hostctrl/exe
3.
Run the following command: sldreg -configure connect.key
4.
Enter the following configuration details
• User name
• Password,
• Host
• Port number
• Specify to use HTTP
The sldreg tool will create a connect.key file that will automatically be used by the data supplier to push information to the SLD server.
25.3.2 When is SLD registration triggered?
The SLD registration process is invoked by the data supplier reporting on the BI platform back-end servers in the following scenarios:
• A server node on your BI platform deployment is restarted.
• A new server or a node is added to the deployment.
• A server or a node is deleted
Note:
If a server or a node is deleted, the SLD registration process does not modify the contents on the SLD server.
The data supplier for WebSphere SLD registration can be invoked manually or set to run on a specified interval - for example, every 24 hours. For more information on configuring this data supplier refer to
SAP Note 482727.
828 2012-12-12
Integration to SAP Solution Manager
25.3.3 Logging SLD connectivity
Data supplier configuration file
A configuration file used for SLD registration is created for BI platform deployments. The file, sldparser config.properties
, is located in the following directory: <INSTALLDIR>/SAP BusinessObjects
Enterprise XI 4.0/java/lib/bobj-sld-ds/
.
Logging SLD connectivity
Connectivity between the SLD server and the data supplier on the BI platform deployment is controlled through the sldreg tool and the connect.key file.
Note:
The log file name is specified as a property in the sldparserconfig.properties file.
The log file for the SLD data supplier reporting on the BI platform back-end servers is by default located in the following location: <INSTALLDIR>/SAP BusinessObjects Enterprise XI
4.0/java/lib/bobj-sld-ds/bobjsldds.log
. The file is overwritten each time the data supplier is executed.
The log files for sldreg are by default located in the following location: <INSTALLDIR>/SAP
BusinessObjects Enterprise XI 4.0/java/lib/bobj-sld-ds/log
. The sldreg log files names cannot be modified and use the following format: sldrg_<Timestamp>.log.
A new log file is created each time the data supplier calls sldreg.
25.4 Managing Solution Management Diagnostics agents
25.4.1 Solution Manager Diagnostics (SMD) overview
The Solution Manager Diagnostics (SMD) component of SAP Solution Manager provides all functionality to centrally analyze and monitor a complete system landscape. BI platform can be monitored by the
SMD server if an SMD Agent is installed. The SMD Agent (DIAGNOSTICS.AGENT) gathers information for the SMD which can then be used for root cause analysis. Information collected and sent to the SMD server includes back-end server configurations and the location of server log files.
829 2012-12-12
Integration to SAP Solution Manager
25.4.2 Working with SMD agents
BI platform does not install the SMD Agent. The agent, DIAGNOSTICS.AGENT, is available to download from the following location: http://service.sap.com/swdc .
Information on installing and configuring the agent is available at: http://service.sap.com/diagnostics
Guidelines for working with the SMD Agent
The following are provided as guidelines for using SMD agents to monitor BI platform:
• Installation order of monitored system and agent is not important. You can choose to install the SMD
Agent before or after installing and deploying BI platform.
• When installing an SMD Agent, make a note of the host name and listening port. These are critical for configuring BI platform as a monitored system. If you have installed the agent before the monitored system, you can provide the configuration information during the BI platform installation setup. This information can also be provided later through placeholders for the nodes in the Central Management
Console in your deployment.
• If the back-end servers are deployed on a distributed system, you should install an SMD Agent on every machine hosting a back-end server.
• For performance instrumentation of non-java servers, the SMD Agent is required.
• You must activate the SMAdmin user account to enable the SMD Server access the CMS.
25.4.3 SMAdmin user account
Every BI platform deployment has a user account created to facilitate SMD integration. This read-only account is used by the SMD server to log into the CMS and to gather server configuration and other information about the deployment.
The SMAdmin account is deactivated by default.
25.4.3.1 To activate the SMAdmin account
1.
In the "Users and Groups" management area of the CMC, select User List.
The list of users is displayed.
2.
Locate the "SMAdmin " user account.
3.
Click Manage > Properties.
The "Properties" dialog box appears.
830 2012-12-12
Integration to SAP Solution Manager
4.
Clear the Account is disabled box.
5.
Click Save & Close.
25.5 Managing performance instrumentation
25.5.1 Performance instrumentation for BI platform
You can use CA Wily Introscope as part of SAP Solution Manager for measuring BI platform performance instrumentation. When installing the platform, the following resources are provided for your deployment
• Introscope agent: Introscope agents collect performance metrics from BI platform Java back-end severs. Agents also collect information from the surrounding computing environment. The agents then report these metrics to the Enterprise Manager.
• The files provided to facilitate the instrumentation process. One set of files are provided for instrumentation of non-Java servers, and another set of files for instrumentation of Java servers.
On the SAP Solution Manager end, the Enterprise Manager (EM) component is required. EM acts as the central repository for all Introscope performance data and metrics collected in an application environment. The EM processes performance data and makes it available to users for production monitoring and diagnosis.
25.5.2 Setting up performance instrumentation for BI platform
There are two ways to set up performance instrumentation for workflows running on BI platform back-end servers.
1.
During the installation setup for BI platform. You will need to know the hostname and the listening port for the SMD Agent. For more information see the SAP BusinessObjects Business Intelligence
Platform Installation Guide. If you choose this option, instrumentation will by default run once you have finished deploying the monitored system.
2.
After installing BI platform, you can provide the configuration information for the SMD agent through placeholders in the node properties in the Central Management Console (CMC).
Note:
For instrumentation of workflows on non-Java servers, you must have the SMD Agent (DIAGNOS
TICS.AGENT
) installed.
831 2012-12-12
Integration to SAP Solution Manager
Related Topics
•
25.5.2.1 To configure nodes for instrumentation
Use the following instructions if you did not provide configuration information for the SMD Agent and
Enterprise Manager during installation setup for BI platform.
1.
Go to the "Servers" area in the CMC.
2.
In the navigation pane, click Nodes.
All available nodes are displayed.
3.
Right-click the node on which you want to perform instrumentation and select Placeholders.
The Placeholders dialog box appears.
4.
Modify the value for the following placeholders.
Placeholder Description
%IntroscopeAgentEnableInstrumentation%
Enables or disables instrumentation on Java servers. Will be set to enabled if you have provided configuration details for Enterprise
Manager during installation setup. Set to true to enable instrumentation.
%IntroscopeAgentEnterprise-
ManagerHost%
Host name for machine on which Enterprise Manager is installed.
%IntroscopeAgentEnterprise-
ManagerPort%
Listening port used by Enterprise Manager.
%IntroscopeAgentEnterprise-
ManagerTransport%
Communication protocol used by Enterprise Manager. Supported protocols include TCP, SSL, HTTP Tunnel, and HTTPS.
%NCSInstrumentLevelThreshold%
%SMDAgentHost%
Used to set the level of instrumentation for non-Java servers. Set to
“0” if you want to turn off instrumentation. Set to any value above “0” to activate instrumentation.
The hostname of the machine on which the SMD Agent (DIAGNOS
TICS.AGENT
) is installed .
%SMDAgentPort% The listening port used by the SMD agent.
5.
Click Save&Close.
6.
Restart the node.
After the node is restarted, the new values provided will propagate to all the managed servers.
832 2012-12-12
Integration to SAP Solution Manager
25.5.3 Performance instrumentation for the web tier
Instrumentation data for web tier components is not included with BI platform.
25.5.4 Instrumentation log files
Once your BI platform deployment is configured to run instrumentation, messages are logged in specific locations. Checking the log files is a way to verify instrumentation status.
For instrumentation on Java back-end servers, a log file is located in the following directory:
<INSTALLDIR>/SAP BusinessObjects Enterprise XI 4.0/java/wily/logs folder. A separate .log file is created for each java process. The folder will also contain AutoProbe.log files that specify which methods have been loaded for instrumentation.
For instrumentation on non-Java back-end servers, log files are located in the following directory:
<INSTALLDIR>/SAP BusinessObjects Enterprise XI 4.0/logging/
. On Unix, the files are located in the <sap_bobj>\logging\ directory. Instrumentation related log files for non-Java servers are saved as .trc files.
For instrumentation on web application servers, a log file is located in the following directory:
<INSTALLDIR>/SAP BusinessObjects Enterprise XI 4.0/java/wily/webapp/logs
. Two types of log files appear in this folder: Introscope.log and Autoprobe.log.
25.6 Tracing with SAP Passport
In addition to tracing BI platform components such as servers and web applications, the tracing mechanism can support the tracing of a specific action. An end-to-end trace analysis analyzes the performance of a single transaction. The consolidation of all the tracing information for a specific action enables SAP support personnel to see all the tracing data without being distracted by tracing information related to other actions.
SAP Passport
The mechanism supporting the end-to-end tracing for BI platform is a tool called SAP Passport. The
SAP Passport client tool injects a unique identifier into all HTTP requests for a particular workflow and this identifier is forwarded to all servers used in the workflow. SAP support personnel can put together an end-to-end trace for the workflow by using this unique identifier.
833 2012-12-12
Integration to SAP Solution Manager
Note:
Trace log levels specified in the CMC and the BO_trace.ini configuration file are used if they are higher than the levels specified in the SAP Passport client tool - SAPIEPlugin.exe.
You can find the Passport in the logs for the back-end servers, web applications, and web services logs.
The SAP Passport client tool is not installed as part of BI platform. To access and download the tool, go to http://service.sap.com/swdc .
834 2012-12-12
Command Line Administration
Command Line Administration
26.1 Unix scripts
This section details each of the administrative tools and scripts that are included with the Unix distribution of SAP BusinessObjects Business Intelligence platform. This section is provided primarily for reference purposes. Concepts and configuration procedures are discussed in more detail throughout this guide.
The Unix distribution of SAP BusinessObjects Business Intelligence platform includes a number of scripts that, together, provide you with all the configuration options that are available in the Windows version of the Central Configuration Manager (CCM). There are a number of other scripts that provide you with Unix-specific options or serve as templates for your own scripts. Also, there are several secondary scripts that are used by SAP BusinessObjects Business Intelligence platform. Each script is described here and the command-line options are provided where applicable.
26.1.1 Script utilities
This section describes the administrative scripts that assist you in working with SAP BusinessObjects
Business Intelligence platform on Unix. The remainder of this help discusses the concepts behind each of the tasks that you can perform with these scripts. This reference section provides you the main command-line options and their arguments.
26.1.1.1 ccm.sh
The ccm.sh script is installed to the <INSTALLDIR>/sap_bobj> directory of your installation. This script provides you with a command-line version of the CCM. This section lists the command-line options and provides some examples.
Note:
• Arguments in square brackets [ ] are optional.
• If you are unsure of a Server Intelligence Agent's name, look at the Command properties in the ccm.config
file, and use the value that appears after the -name option.
835 2012-12-12
Command Line Administration
836
• The ccm.sh script can only be launched by the user that performed the installation of Business
Intelligence platform.
• Arguments denoted by [other authentication information] are provided in the second table.
CCM Option Valid Arguments Description
-help n/a
-start
-stop all all or sianame or sianame
Display command-line help.
Start each Server Intelligence
Agent as a process. The all option starts all of the nodes on the machine, including any nodes belonging to different clusters.
Stop each Server Intelligence
Agent by terminating its Process ID. The all option starts all of the nodes on the machine, including any nodes belonging to different clusters.
-restart
-managedstart
-managedstop
-managedrestart all or sianame
Stop each Server Intelligence
Agent by terminating its Process ID; then each SIA is started. The all option starts all of the nodes on the machine, including any nodes belonging to different clusters.
<fully qualified server name>[other authentication information]
Start a server.
<fully qualified server name>[other authentication information]
Stop a server.
<fully qualified server name>[other authentication information]
Stop a server; then start the server.
2012-12-12
Command Line Administration
CCM Option
-enable
Valid Arguments Description
-managedforceterminate
<fully qualified server name>[other authentication information]
Stops the server immediately without completing current processing requests.
<fully qualified server name>[other authentication information]
Enable a started server so that it registers with the system and starts listening on the appropriate port. Use the fully qualified form of the server name.
-disable
-display
<fully qualified server name>[other authentication information]
Disable a server so that it stops responding to BusinessObjects
Business Intelligence platform requests but remains started as a process. Use the fully qualified form of the server name.
[other authentication information]
Reports the current status of all of the servers in the cluster, including the server names, the host names, Process IDs, descriptions, whether they are running, and whether they are enabled or disabled.
The following table describes the options that make up the argument denoted by [other
authentication information]
.
Note:
For improved security, you must always provide the credentials of an account with Enterprise authentication. Other types of authentication are not supported.
837 2012-12-12
Command Line Administration
Authentication Option
-cms
-username
-password
Valid arguments
cmsname:port# username password
Description
Specify the CMS that you want to log on to. If not specified, the
CCM defaults to the local machine and the default port
(6400).
Specify an account that provides administrative rights to BusinessObjects Business Intelligence platform. If not specified, the default Administrator account is attempted.
Specify the corresponding password. If not specified, a blank password is attempted.
Note:
To specify the -password argument, you must also specify the
-username argument.
The CCM reads the launch strings and other configuration values from the ccm.config file.
Related Topics
•
26.1.1.1.1 Examples
These two commands start and enable all Business Intelligence platform servers. The Central
Management Server (CMS) is started on the local computer and the default port (6400): ccm.sh -start all ccm.sh -enable all
These two commands start and enable all Business Intelligence (BI) platform servers. The CMS is started on port 6701, rather than on the default port: ccm.sh -start all ccm.sh -enable all -cms MACHINE01:6701
838 2012-12-12
Command Line Administration
These two commands start and enable all BI platform servers with a specified administrative account named SysAdmin: ccm.sh -start all ccm.sh -enable all -cms MACHINE01:6701 -username SysAdmin -password 35%bC5@5
This single command logs on with a specified administrative account to disable an Adaptive Job Server that is running on “NodeA”: ccm.sh -disable NodeA.AdaptiveJobServer -cms MACHINE01:6701 -username SysAdmin -password 35%bC5@5
26.1.1.1.2 ccm.config
This configuration file defines the launch strings and other values that are used by the CCM when you run its commands. This file is maintained by the CCM itself, and by the other SAP BusinessObjects
Business Intelligence platform script utilities. You typically edit this file only when you need to modify a Server Intelligence Agent's command line.
Related Topics
•
839
26.1.1.2 cmsdbsetup.sh
The cmsdbsetup.sh script is installed to the sap_bobj directory of your installation. The script provides a text-based program that enables you to perform the following tasks.
• Update CMS system database settings
• Reinitialize a CMS system database
• Copy data from another data source
• Change the cluster key
• Change the name of the cluster
Note:
Before running this script, back up your current CMS system database and the contents of your Input
File Repository and Output File Repository. For more information about backing up and restoring your system, clustering Central Management Servers, and configuring and managing CMS databases, see the
SAP BusinessObjects Business Intelligence Platform Administrator Guide.
The script will prompt you for the name of your Server Intelligence Agent (SIA). To check the name of your SIA, view the Command properties of the SIA. The SIA's current name appears after the -name option.
Related Topics
•
Clustering Central Management Servers
•
Backing up and restoring your system
2012-12-12
Command Line Administration
840
26.1.1.3 configpatch.sh
The configpatch.sh script is installed to the sap_bobj/enterprise/generic directory of your installation. Use the configpatch.sh script when installing patches that require updates to system configuration values. After installing the patch, run configpatch.sh with the appropriate .cf file name as an argument. The readme.txt file that accompanies BusinessObjects Business Intelligence platform patches tells you when to run configpatch.sh, and the name of the .cf file to use.
26.1.1.4 serverconfig.sh
The serverconfig.sh script is installed to the sap_bobj directory of your installation. This script provides a text-based program that allows you to perform the following operations.
• Add a node
• Delete a node
• Modify a node
• Move a node
• Back up server configuration
• Restore server configuration
• List nodes
• Modify web tier configuration
26.1.1.4.1 To add/delete/modify/list nodes on Unix
1.
Go to the sap_bobj directory in your installation.
2.
Issue the following command:
./serverconfig.sh
The script prompts you with a list of options:
•
1 - Add a node
•
2 - Delete a node
•
3 - Modify a node
•
7 - List all nodes in the config file
3.
Type the number that corresponds to the action you want to perform.
4.
If you are adding, deleting, or modifying a node, provide the script with any additional information that it requests.
2012-12-12
Command Line Administration
26.1.2 Script templates
These scripts are provided primarily as templates upon which you can base your own automation scripts.
26.1.2.1 startservers
The startservers script is installed to the sap_bobj directory of your installation. This script can be used as a template for your own scripts: it is provided as an example to show how you could set up your own script that starts the Business Intelligence platform servers by running a series of CCM commands. For details on writing CCM commands for your servers, see
26.1.2.2 stopservers
The stopservers script is installed to the sap_bobj directory in your installation. This script can be used as a template for your own scripts: it is provided as an example to show how you could set up your own script that stops the Business Intelligence platform servers by running a series of CCM commands. For details on writing CCM commands for your servers, see
26.1.3 Scripts used by SAP BusinessObjects Business Intelligence platform
These secondary scripts are often run in the background when you run the main SAP BusinessObjects
Business Intelligence platform script utilities. You need not run these scripts yourself.
bobjrestart.sh
This script is run internally by the CCM when it starts the SAP BusinessObjects Business Intelligence platform server components. If a server process ends abruptly without returning its normal exit code, this script automatically restarts a new server process in its place. Do not run this script yourself.
env.sh
The env.sh script is installed to the sap_bobj/setup directory of your installation. This script sets up the SAP BusinessObjects Business Intelligence platform environment variables that are required by some of the other scripts. SAP BusinessObjects Business Intelligence platform scripts run env.sh
as required. When you install SAP BusinessObjects Business Intelligence platform on UNIX, you must
841 2012-12-12
Command Line Administration configure your Java application server to source this script on startup. See the SAP BusinessObjects
Business Intelligence platform Installation Guide for more details.
env-locale.sh
The env-locale.sh script is used for converting the script language strings between different types of encoding (for example, UTF8 or EUC or Shift-JIS). This script is run by env.sh as needed.
initlaunch.sh
The initlaunch.sh script runs env.sh to set up the SAP BusinessObjects Business Intelligence platform environment variables, and then runs any command that you have added as a command-line argument for the script. This script is intended primarily for use as a debugging tool by SAP Business
Objects.
postinstall.sh
he postinstall.sh script is installed to the <SCRIPTDIR> directory of your installation. This script runs automatically at the end of the installation script and launches the setup.sh script. You need not run this script yourself.
setup.sh
The setup.sh script is installed to the root directory of your installation. This script provides a text-based program that allows you to set up your SAP BusinessObjects Business Intelligence platform installation.
This script is run automatically when you install SAP BusinessObjects Business Intelligence platform.
It prompts you for the information that is required in order to set up SAP BusinessObjects Business
Intelligence platform for the first time.
For complete details on responding to the setup script when you install SAP BusinessObjects Business
Intelligence platform, see the SAP BusinessObjects Business Intelligence platform Installation Guide.
setupinit.sh
The setupinit.sh script is installed to the /sap_bobj/init directory of your installation when you perform a system installation. This script copies the run control scripts to your rc# directories for automated startup. When you run a system installation you are directed to run this script after the setup.sh
script completes.
Note:
You must have root privileges to run this script.
26.2 Windows scripts
This section details each of the administrative tools and scripts that are included with the Windows distribution of SAP BusinessObjects Business Intelligence platform. This section is provided primarily for reference purposes. Concepts and configuration procedures are discussed in more detail throughout this guide.
842 2012-12-12
Command Line Administration
The Windows distribution of Business Intelligence platform includes the Windows version of the Central
Configuration Manager (CCM). In addition to interacting with the GUI, you can choose to run the CCM executable from the command-line with options to manage your servers.
26.2.1 ccm.exe
The ccm.exe executable is installed to the <INSTALLDIR>\SAP BusinessObjects Enterprise
XI 4.0\win64_x64
directory of your installation. You can run the executable directly from the command-line to perform certain operations. This section lists the command-line options and provides some examples.
Note:
• A Server Intelligence Agent (SIA) and Central Management Server (CMS) must be running before using the command-line options of ccm.exe to interact with an individual server.
• Arguments in square brackets [ ] are optional.
• Arguments denoted by other authentication information are provided in the second table.
CCM Option Valid Arguments Description
-help n/a Display command-line help.
-managedstart
-managedstop all or <fully qualified
server name>[other authentication information]
Start a server.
all or <fully qualified
server name>[other authentication information]
Stop a server.
-managedrestart all or<fully qualified
server name>[other authentication information]
Stop a server and then start the server.
-managedforceterminate all or<fully qualified
server name>[other authentication information]
Stops the server immediately without completing current processing requests.
843 2012-12-12
Command Line Administration
CCM Option
-enable
-disable
-display
Valid Arguments Description
all or <fully qualified
server name>[other authentication information]
Enable a started server so that it registers with the system and starts listening on the appropriate port.
all or <fully qualified
server name>[other authentication information]
Disable a server so that it stops responding to BusinessObjects
Business Intelligence platform requests but remains started as a process.
[other authentication information]
Reports the current status of all of the servers in the cluster, including the server names, the host names, Process IDs, descriptions, whether they are running, and whether they are enabled or disabled.
The following table describes the options that make up the argument denoted by [other
authentication information]
.
Note:
You must always provide the credentials of an account with Enterprise authentication.
Authentication Option Valid Arguments
-cms
-username
cmsname:port# username
Description
Specify the CMS that you want to log on to. If not specified, the
CCM defaults to the local machine and the default port
(6400).
Specify an account that provides administrative rights to Business
Intelligence platform. If not specified, the default Administrator account is attempted.
844 2012-12-12
Command Line Administration
Authentication Option
-password
-authentication
Valid Arguments
password authentication type
Description
Specify the corresponding password. If not specified, a blank password is attempted.
Note:
To specify the -password argument, you must also specify the
-username argument.
Specify the authentication type.
Only secEnterprise is supported.
The CCM reads the launch strings and other configuration values from the ccm.config file.
Related Topics
•
26.2.1.1 Examples
The following examples assume that a Server Intelligence Agent (SIA) and Central Management Server
(CMS) are started and running. Before using the command-line options of ccm.exe to interact with an individual server, you can use the following Windows command to start the SIA service: net start "Server Intelligence Agent (NODE01)"
The SIA can also be stopped using net stop "Server Intelligence Agent (NODE01)".
This command starts all Business Intelligence platform servers: ccm.exe -managedstart all
This command starts an Adaptive Job Server. The CMS is started on port 6701, rather than on the default port: ccm.exe -managedstart NODE01.AdaptiveJobServer -cms MACHINE01:6701
This command enables an Adaptive Job Server with a specified administrative account named
SysAdmin
: ccm.exe -enable NODE01.AdaptiveJobServer -cms MACHINE01:6701 -username SysAdmin -password 35%bC5@5
845 2012-12-12
Command Line Administration
This command logs on with a specified administrative account and disables an Adaptive Job Server that is running on a node that may be running on a remote machine: ccm.exe -disable NODE02.AdaptiveJobServer -cms MACHINE01:6701 -username SysAdmin -password 35%bC5@5
26.3 Server Command Lines
26.3.1 Command lines overview
This section lists the command-line options that control the behavior of each Business Intelligence platform server.
When you start a server through the Central Management Console (CMC) the server is started (or restarted) with a default command line that includes a typical set of options and values. In the majority of cases, you do not need to modify the default command lines. For reference, this section provides a full listing of the command-line options supported by each server. You can modify each server's command line in the CMC if you need to further customize the behavior of Business Intelligence platform.
Throughout this section, values provided in square brackets [ ] are optional.
Note:
The following tables list the supported command-line options. Business Intelligence platform servers use a number of internal options that are not listed in these tables. These internal options must not be modified.
26.3.1.1 To view or modify a server's command line
1.
Use the Central Management Console (CMC) to stop the server.
2.
Right-click the server and select Properties.
3.
On the "Properties" screen, modify the command line for the server, and click Save & Close.
4.
Start the server.
26.3.2 Standard options for all servers
846 2012-12-12
Command Line Administration
These command-line options apply to all of the Business Intelligence platform servers, unless otherwise indicated. See the remainder of this section for options specific to each type of server.
Option Valid Arguments Behavior
-requestPort
port
Specify the port that the server listens on. The server registers this port with the CMS. If unspecified, the server chooses any free port greater than 1024.
Note:
• When you change this port setting, it is the same as changing the Request Port field under "Common Settings" on a server's "Properties" page in the CMC.
• This port is used for different purposes by different servers. Before changing, see the section on changing the default server port numbers in the SAP BusinessObjects Business Intelligence
Platform Administrator
Guide.
-loggingPath
absolute path
Specify the path where log files are created.
26.3.2.1 Unix signal handling
On Unix, the SAP BusinessObjects Business Intelligence platform daemons handle the following signals:
•
SIGTERM results in a graceful server shutdown (exit code = 0).
•
SIGSEGV
, SIGBUS, SIGSYS, SIGFPE, and SIGILL result in a rapid shutdown (exit code = 1).
847 2012-12-12
Command Line Administration
26.3.3 Central Management Server
This section provides the command-line options that are specific to the CMS. The default path to the server on Windows is <INSTALLDIR>\BusinessObjects Enterprise XI
4.0\win64_x64\CMS.exe
.
The default path to the server on Unix is <INSTALLDIR>/sap_bobj/enterprise_xi40/<PLAT
FORM64>/boe_cmsd
.
Option Valid Arguments Behavior
-threads
number
Specifies the number of working threads that the CMS initializes and uses. The value can be between 12 and 150, and is set to
50 by default.
-reinitializedb
-receiverPool
number
Cause the CMS to delete the system database and recreate it with only the default system objects. All existing data in the database is lost when it is recreated.
Specify the number of threads the CMS creates to receive client requests. A client may be another Business Objects server, the Report Publishing Wizard, Crystal Reports, or a custom client application that you have created. The default value is 5. Normally you will not need to increase this value, unless you create a custom application with many clients.
848 2012-12-12
Command Line Administration
Option Valid Arguments
-maxobjectsincache
number
Behavior
Specify the maximum number of objects that the CMS stores in its memory cache. Increasing the number of objects reduces the number of database calls required and greatly improves
CMS performance. However, placing too many objects in memory may result in the CMS having too little memory remaining to process queries. The upper limit is 100000.
Related Topics
•
Standard options for all servers
26.3.4 Crystal Reports Processing Server and Crystal Reports Cache Server
The Crystal Reports Processing Server and the Crystal Reports Cache Server are controlled in much the same way from the command line. The command-line options determine whether the server starts as a processing server, a cache server, or both. Options that apply only to one server type are noted below.
The default paths to the servers on Windows are:
•
<INSTALLDIR>\SAP BusinessObjects Enterprise XI 4.0\win64_x64\crcache.exe
•
<INSTALLDIR>\SAP BusinessObjects Enterprise XI 4.0\win64_x64\crproc.exe
The default paths to the servers on Unix are:
•
<INSTALLDIR>/sap_bobj/enterprise_xi40/<PLATFORM64>/boe_crcached.bin
•
<INSTALLDIR>/sap_bobj/enterprise_xi40/<PLATFORM64>/boe_crprocd.bin
Option Valid Arguments
-cache
Behavior
Enable Cache Server functionality.
849 2012-12-12
Command Line Administration
Option
-deleteCache
Valid Arguments
-report_ProcessExtPath
absolutepath
Related Topics
•
Standard options for all servers
Behavior
Delete the cache directory every time the server starts and stops.
Specify the default directory for processing extensions. For details, see the SAP BusinessObjects Business Intelligence platform Administrator Guide.
26.3.5 Dashboards Processing Server and Dashboards Cache Server
The Dashboards Processing Server and the Dashboards Cache Server are controlled in much the same way from the command line. The command-line options determine whether the server starts as a Processing Server, a Cache Server, or both. Options that apply only to one server type are noted below.
The default paths to the servers on Windows are:
•
<INSTALLDIR>\SAP BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\win64_x64\xccache.exe
•
<INSTALLDIR>\SAP BusinessObjects\SAP BusinessObjects Enterprise XI
4.0\win64_x64\xcproc.exe
The default paths to the servers on Unix are:
•
<INSTALLDIR>/sap_bobj/enterprise_xi40/<PLATFORM64>/boe_xccached
•
<INSTALLDIR>/sap_bobj/enterprise_xi40/<PLATFORM64>/boe_xcprocd
Option Valid Arguments
-cache
Behavior
Enable Cache Server functionality.
850 2012-12-12
Command Line Administration
Option
-dir
-deleteCache
-psdir
-refresh
Valid Arguments
absolutepath absolutepath minutes
-auditMaxEventsPerFile
number
Behavior
Specify the cache directory for a Cache Server and the temp directory for the Processing
Server. The directories created are absolutepath/cache and absolutepath/temp
Delete the cache directory every time the server starts and stops.
Specify the temp directory for the Processing Server. This option overrides -dir.
Share cached pages for the specified number of minutes.
On the Cache Server, specifies the maximum number of audit actions recorded in the audit log file. The default value is 500. If this maximum number of records is exceeded, the server will open a new log file.
Related Topics
•
Standard options for all servers
26.3.6 Job servers
This section provides the command-line options that are specific to Adaptive Job Servers.
The default path to the server on Windows is <INSTALLDIR>\SAP BusinessObjects Enterprise
XI 4.0\win64_x64\JobServer.exe
.
The default path to the server on Unix is <INSTALLDIR>/sap_bobj/enterprise_xi40/<PLAT
FORM64>/boe_jobsd
.
851 2012-12-12
Command Line Administration
Note:
Do not use command-line parameters to set Adaptive Job Server properties. Instead, set the parameters in the CMC as server properties.
Option Valid Arguments Behavior
-dir
-maxJobs
absolutepath number
Specify the data directory for the
Job Server.
Set the maximum number of concurrent jobs that the server will handle. The default is five.
-requestJSChildPorts
lowerbound-upperbound
Specify the range of ports that child processes should use in a firewall environment. For example, 6800-6805 limits child processes to six ports.
Note:
For this option to take effect, you must also specify the -request
Port setting.
-report_ProcessExtPath
absolutepath
Specify the default directory for processing extensions. For details, see the
SAP BusinessObjects Business Intelligence platform Administrator Guide.
Related Topics
•
Standard options for all servers
26.3.7 Adaptive Processing Server
The Adaptive Processing Server uses parameters defined for the SAP Java Virtual Machine (SAP JVM).
Refer to SAP JVM documentation for more information.
852 2012-12-12
Command Line Administration
26.3.8 Report Application Server
This section provides the command-line options that are specific to the Report Application Server.
The default path to the server on Windows is <INSTALLDIR>\SAP BusinessObjects Enterprise
XI 4.0\win32_x86\crystalras.exe
.
The default path to the server on Unix is <INSTALLDIR>/sap_bobj/enterprise_xi40/<PLAT
FORM32>/ras/boe_crystalras
.
Option Valid Arguments Behavior
-ipport
port
Specify the port number for receiving TCP/IP requests when running in stand-alone mode
(outside of Business Intelligence platform).
-report_ProcessExtPath
absolutepath
Specify the default directory for processing extensions. For details, see the SAP BusinessObjects Business Intelligence Platform Administrator Guide.
853 2012-12-12
Command Line Administration
Option
-ProcessAffinityMask
Valid Arguments
mask
Behavior
Use a mask to specify exactly which CPUs that RAS will use when it runs on a multi-processor computer.
The mask is in the format
0xffffffff
, where each f represents a processor, and the list of processors reads from right to left (that is, the last f represents the first processor).
For each f, substitute either 0
(use of CPU not permitted) or 1
(use of CPU is permitted).
For example, if you run the RAS on a four-processor computer and want it to use the third and fourth processor, use the mask
0x1100
. To use the second and third processor, use 0x0110.
Note:
• RAS uses the first permitted processors in the string, up to the maximum specified by your license. If you have a two processor license,
0x1110 has the same effect as 0x0110.
• The default value of the mask is -1, which has the same meaning as 0x1111.
Related Topics
•
Standard options for all servers
26.3.9 Web Intelligence Processing Server
854 2012-12-12
Command Line Administration
This section provides the command-line options that are specific to the Web Intelligence Processing
Server.
The default path to the server on Windows is <INSTALLDIR>\SAP BusinessObjects Business
Enterprise XI 4.0\win64_x64\WIReportServer.exe
.
The default path to the server on Unix is <INSTALLDIR>/sap_bobj/enterprise_xi40/<PLAT
FORM64>/WIReportServer
.
Option Valid Arguments Behavior
-ConnectionTimeout
Minutes
minutes
Specify the number of minutes before the server will timeout.
-MaxConnections
-DocExpressEnable
number
Specify the maximum number of simultaneous connections that the server allows at one time.
Enables caching of Web Intelligence documents when the document is being viewed.
-DocExpressRealTime
CachingEnable
Enables real time caching of
Web Intelligence documents.
-DocExpressCache
DurationMinutes
minutes
Specify the amount of time (in minutes) that content is stored in cache.
-DocExpressMaxCache
SizeKB
kilobytes
Specify the size of the document cache.
-EnableListOfValues
Cache
Enables the caching per user sessions of lists of values
-ListOfValuesBatchSize
number
Specify the maximum number of values that can be returned per list of values batch.
855 2012-12-12
Command Line Administration
Option Valid Arguments
-UniverseMaxCacheSize
number
-WIDMaxCacheSize
number
Related Topics
•
Standard options for all servers
Behavior
Specify the number of universes to be cached.
Specify the maximum number of Web Intelligence documents that can be stored in cache.
26.3.10 Input and Output File Repository Servers
This section provides the command-line options that are specific to the Input and Output File Repository
Servers.
The default path to the servers on Windows is <INSTALLDIR>\SAP BusinessObjects Enterprise
XI 4.0\win64_x64\fileserver.exe
.
The default path to the program that provides both servers on Unix is <INSTALLDIR>/sap_bobj/en terprise_xi40/<PLATFORM64>/boe_filesd
.
Note:
Do not use command-line parameters to set Input and Output File Repository Server properties. Instead, set the parameters in the CMC as server properties.
Related Topics
•
Standard options for all servers
26.3.11 Event Server
This section provides the command-line options that are specific to the Event Server.
The default path to the server on Windows is <INSTALLDIR>\SAP BusinessObjects Enterprise
XI 4.0\win64_x64\EventServer.exe
.
856 2012-12-12
Command Line Administration
The default path to the server on Unix is <INSTALLDIR>/sap_bobj/enterprise_<PLAT
FORM64>/boe_eventsd
.
Note:
Do not use command-line parameters to set Event Server properties. Instead, set the parameters in the CMC as server properties.
Option Valid Arguments
-cleanup
minutes
Behavior
Specify the frequency (in minutes) with which the server cleans up listener proxies. The value represents the amount of time it takes to perform two cleanups. For example, if you specify a value of 10, the proxies will be cleaned up every five minutes.
Related Topics
•
Standard options for all servers
26.3.12 Dashboard and Dashboard Analytics Servers
The Dashboard and Dashboard Analytics Servers do not have command-line specific parameters for command-line administration.
857 2012-12-12
Command Line Administration
858 2012-12-12
Rights Appendix
Rights Appendix
27.1 About the rights appendix
This rights appendix lists and describes most rights that can be set on different objects in the BI platform system. In cases where you require more than one right to perform a task on an object, it also provides information about the additional rights that you require and which objects you must have those rights on. For more information about setting rights see the Setting Rights chapter in the SAP BusinessObjects
Business Intelligence Platform Administrator Guide.
27.2 General rights
The rights in this section apply to multiple object types.
Note:
• Many of these rights also have equivalent owner rights. Owner rights are rights that apply only to the owner of the object on which the rights are being checked.
• The following rights apply only to objects that can be scheduled:
• The "Schedule the document to run" right.
• The "Schedule on behalf of other users" right.
• The "Schedule to destinations" right.
• The "View document instances" right.
• The "Delete instances" right.
• The "Pause and resume document instances" right.
• The "Reschedule instances" right.
859 2012-12-12
Rights Appendix
Right
"View objects"
Description
Lets you view objects and their properties. If you do not have this right on an object, the object is hidden in the BI platform system.
This right is a basic right that is required for all tasks.
"Add objects to the folder"
Lets you add objects to a folder. This right also applies to objects that behave like folders such as inboxes, Favorites folders, or object packages.
"Edit objects"
Lets you edit object content and the properties for objects and folders.
"Modify the rights users have to objects"
Lets you modify security settings for an object.
"Securely modify the rights users have to objects"
Lets you grant rights or access levels that you already have on an object to other users. To do this, you require this right on the user and the object itself. For more information about this right, see the
“Setting Rights” chapter of the SAP BusinessObjects Business Intelligence Platform Administrator Guide.
"Define server groups to process jobs"
Lets you specify which server group to use when objects are processed. This right only applies to objects for which you can specify processing servers.
To specify a server group, you also require the "Edit objects" right on the object.
"Delete objects"
Lets you delete objects and their instances.
"Copy objects to another folder"
Lets you create copies of objects in other folders in the CMS. To do this, you also require the "Add objects to the folder" right on the destination folder.
Note:
When an object is copied, the explicit security on the object is not copied; the new object inherits security settings from the destination folder, but you must reset explicit security.
"Replicate content"
Lets you replicate objects to another system in a federated deployment.
"Schedule the document to run"
Lets you schedule objects.
860 2012-12-12
Rights Appendix
Right
"Schedule on behalf of other users"
Description
Lets you schedule objects for other users or groups. The user or group that you schedule the object for becomes the owner of the object instance.
To schedule an object for other users or groups, you also require the following rights:
• This right on the user or group.
• The "Schedule the document to run" right on the object.
"Schedule to destinations"
Lets you do the following:
• Schedule objects to destinations other than the default Enterprise location.
• Modify the default destinations specified for scheduling.
To schedule the object to destinations, you also require the following rights:
• The "Schedule the document to run" right on the object that you want to schedule.
• The "Add objects to the folder" right on the recipient inbox (if you want to schedule to an inbox destination).
• The "Copy objects to another folder" right on the object that you want to schedule (if you want to send a copy to an inbox destination instead of a shortcut).
"View document instances"
Lets you view object instances. This right is a basic right that is required for all tasks that you perform on object instances.
"Delete instances"
Lets you delete object instances only. If you have the "Delete objects" right, you do not require this right to delete instances.
"Pause and resume document instances"
Lets you pause or resume object instances that are running.
"Reschedule instances"
Lets you reschedule object instances.
Related Topics
•
•
Choosing between Modify the rights users have to objects options
861 2012-12-12
Rights Appendix
27.3 Rights for specific object types
27.3.1 Folder rights
To make rights administration easier, it is recommended that you set rights on folders so that their contents inherit security settings. Folder rights include the following:
• General rights that apply to the folder object.
• Type-specific rights that are intended for the folder's contents (such as the Print the report's data right on Crystal reports).
Related Topics
•
27.3.2 Categories
The rights in this section are general rights that have a specific meaning in the context of public and personal categories.
Note:
Objects in categories do not inherit rights that are set on the categories.
862 2012-12-12
Rights Appendix
Right
"Add objects to the folder"
Description
Lets you create new categories within categories. This right is not needed to add objects to a category.
"Edit objects"
Lets you do the following:
• Modify category properties.
• Move the category into another category as a sub-category.
• Add objects to the category.
• Remove objects from the category.
To move a category into another category as a sub-category, you also require the following rights:
• The "Delete objects" right on the original category.
• The "Add objects to the folder" right on the destination category.
"Delete objects"
Lets you delete the category.
27.3.3 Notes
Notes allow users to comment on other objects using the Discussions application. Notes are linked together in discussion threads; these discussion threads are considered child objects of the objects that they discuss. You can set rights at the object level or folder level to control the use of discussion threads.
The rights in this section apply to notes only.
Right
Allow discussion threads
Description
This right lets you do the following:
• Start and reply to discussion threads.
• View notes on a discussion thread.
• Modify or delete notes that you posted.
27.3.4 Crystal reports
863 2012-12-12
Rights Appendix
The rights in this section apply to Crystal reports only.
Note:
These rights only apply when Crystal reports are in the BI platform environment. When you download
Crystal reports to your local disk, these rights are ineffective. To prevent this, you can deny the "Download files associated with the object" right on the Crystal report.
Right
"Print the report's data"
Description
Lets you print the report.
"Refresh the report's data"
Lets you refresh report data.
"Export the report's data"
Lets you export report data to any format when you view the report online in the Crystal Reports viewer.
To export report data in RPT format, you also require the "Download files associated with the object" right.
"Download the files associated with the object"
This right lets you do the following:
• Export the report in RPT format.
• Open the report in Crystal Reports Designer.
• Schedule the report in RPT format to external destinations.
27.3.5 Web Intelligence documents
The rights in this section apply to Web Intelligence documents only.
Right
"Use Lists of Values"
Description
Lets you use lists of values.
"Export the report's data"
Lets you export document data to Excel, PDF, and CSV formats. If you do not have this right, you require the "Save as CSV", "Save as
Excel", or "Save as PDF" right; these rights let you export documents in the specified format only.
"Query script - enable viewing
(SQL , MDX…)"
"Refresh the report's data"
Lets you view query scripts (SQL and MDX).
Lets you refresh document data.
864 2012-12-12
Rights Appendix
Right
"Edit Query"
"Refresh List of Values"
"Save as CSV"
"Save as Excel"
"Save as PDF"
"Send to"
Description
Lets you edit queries in the document.
Lets you refresh lists of values for prompts when you create the prompt or when you view the document. To do this, you also require the "Use
Lists of Values" right on the document.
Lets you export documents as CSV files only. If you have the "Export the report's data" right on a document already, you do not require this right.
Lets you export documents as Excel files only. If you have the "Export the report's data" right on a document already, you do not require this right.
Lets you export documents as PDF files only. If you have the "Export the report's data" right on a document already, you do not require this right.
Lets you send documents to the Scheduler, to a BI platform Inbox, or to send as hyperlinks in email. This right also lets Web Intelligence desktop users send documents as email attachments.
27.3.6 Users and groups
You can set rights on users and groups as you would on other objects in the BI platform environment.
The rights in this section are type-specific rights that apply to user and group objects only or general rights that have a specific meaning in the context of users and groups.
Note:
• Users and subgroups can inherit rights from group membership.
• The creator of a user account is considered the owner of the account. However, after the user account is created, the user that the account is intended for is also considered an owner.
865 2012-12-12
Rights Appendix
Right
"Edit objects"
Description
Lets you do the following:
• Edit properties for the user or group.
• Manage group membership.
To add a user or group to another group, you require this right on the user or group and on the destination group.
"Change user password"
Lets you do the following:
• Change the password for your user account. To do this, you also require the "Edit objects" right on your user account.
• Change the password for another user's account. To do this, you also require the "Edit objects" right and the "Modify the rights users have to objects" right on the user account.
Note:
• This right does not affect the following user password settings:
• "Password never expires"
• "User must change password at next logon"
• "User cannot change password"
• This right does not apply to data source credentials for Business Objects
Universes.
"Subscribe to publications"
Lets you add the user to publications as a recipient.
"Schedule on behalf of other users"
Lets you schedule objects on behalf of the user so that the user becomes the owner of the object instance. To do this, you also require the "Schedule on behalf of other users" right on the object.
27.3.7 Access levels
The rights in this section apply to access levels only.
866 2012-12-12
Rights Appendix
Right Description
"Use access level for security assignment"
Lets you assign the access level when you add principals to access control lists for objects. To do this, you also require the "Modify the rights users have to objects" right or the "Securely modify the rights users have to objects" right on the principal and the object. In cases where the "Securely modify the rights users have to objects" right is granted, you must also have the same access level granted to yourself on the object.
Related Topics
•
Choosing between Modify the rights users have to objects options
27.3.8 Universe (.unv) rights
The rights in this section apply to universes created with the universe design tool, or .unv universes.
The rights listed are type-specific rights that apply to universes only, or general rights that have a specific meaning in the context of universes.
Note:
Universe rights apply only when you import universes from the CMS in the universe design tool application. These rights do not apply when the universe is saved to local disk.
Right
"Add objects to the folder"
Description
Lets you add restriction sets or objects to the universe. To do this, you also require the "Edit Access Restrictions" right.
"View objects"
Lets you access and view the universe.
"Edit objects"
This right lets you do the following:
• Edit the universe in the CMC or in the universe design tool.
• Lock or unlock the universe.
To unlock a universe, you also require the "Unlock Universe" right.
"Delete objects"
Lets you delete the universe.
867 2012-12-12
Rights Appendix
Right
"Translate objects"
Description
Lets you to save translated universe object names using the translation management tool.
Note:
You can also save translations if you have the "Edit objects" right explicitly granted as long as the "Translate objects" right is not explicitly denied.
"New List of Values"
This right lets you do the following:
• Associate new lists of values with objects.
• Edit existing lists of values.
Note:
This right does not prevent you from creating cascading lists of values.
"Print Universe"
Lets you print the universe.
"Show Table or Object Values"
Lets you see the values associated with tables or objects in the universe.
"Edit Access Restrictions"
Lets you edit access restrictions (overloads) for the universe.
"Unlock Universe"
Lets you do the following:
• Unlock the universe if it is locked by another user.
• Export the universe from the CMS.
To unlock a universe, you also require the "Edit objects" right.
"Data Access"
Lets you retrieve data from the universe and refresh documents based on the universe. To do this, you also require this right on the universe design tool application, the document, and the universe connection.
"Create and Edit Query based on the universe"
Lets you create documents and edit queries that are based on the universe.
27.3.9 Universe (.unx) rights
868 2012-12-12
Rights Appendix
The rights in this section apply to universes created with the information design tool, or .unx universes.
The rights listed are type-specific rights that apply to universes only, or general rights that have a specific meaning in the context of universes.
Note:
Universe rights apply only to universes published to a repository. These rights do not apply when the universe is saved to a local folder.
Right
"View objects"
Description
Lets you access and view the universe.
"Edit objects"
Lets you to republish the universe.
"Delete objects"
Lets you delete the universe.
"Retrieve universe"
Lets you to retrieve a published universe and edit the underlying resources (business layer and data foundation) in the information design tool.
Note:
You must also have the information design tool application right
"Retrieve universes" granted.
"Edit security profiles"
Lets you to insert, edit, and delete security profiles for the universe in the information design tool security editor.
Note:
This right is not required to view security profiles or to change security profile aggregation options.
"Assign security profiles"
Lets you to assign and unassign security profiles to users and groups in the information design tool security editor.
869 2012-12-12
Rights Appendix
Right
"Data Access"
Description
Lets you retrieve data from the universe and refresh documents based on the universe.
In the information design tool, this right lets you to preview the result set in the query panel.
"Create and edit queries based on this universe"
Lets you create and edit queries that are based on the universe.
In the information design tool, this right lets you open the query panel and run a query on the universe.
"Save for all users"
Lets you save the universe for all users.
Note:
You must also have the information design tool application right
"Save for all users" granted.
27.3.10 Universe object-access levels
When designers create a universe using the universe design tool, or a business layer using the information design tool, they assign an object-access level to every object in the universe. The object-access levels are:
• Public (default)
• Controlled
• Restricted
• Confidential
• Private
Once the universe is published in the repository, you can grant access to universe objects based on the object-access levels assigned in the application. For example, you can grant Public access to the
Everyone group. This allows users in the Everyone group to see the objects in the universe designated as Public.
Each object-access level grants more access to objects than the previous one. Public is the lowest level. Principals granted Public access can only see objects designated as Public. Principals granted
Controlled access can see objects designated as Public and Controlled. Private is the highest level setting and grants principals access to all object-access levels, in other words, all objects in the universe.
Note:
• Object-access level security settings override any security settings that the universe inherits.
870 2012-12-12
Rights Appendix
• For .unx universes, object-access level security settings are taken into consideration with the object security defined by the security profile. For more information on security profiles, see the Information
Design Tool User Guide.
Related Topics
•
Assigning universe object-access levels
27.3.10.1 Assigning universe object-access levels
To set universe object-access level security, you require the Modify the rights users have to objects right on the universe.
1.
In the "Universes" area of the CMS, select the universe.
2.
Click Action > Universe Security.
3.
In the "Universe Security" dialog box, for the user or group, select the object-access level in the
Object Level Security list.
27.3.11 Connection rights
The rights in this section are type-specific rights that apply to universe connections or general rights that have a specific meaning in the context of universe connections. These rights apply to connections published in the repository.
871 2012-12-12
Rights Appendix
Relational connection rights
Right Description
"View objects"
Lets you view the connection.
"Edit objects"
Lets you edit the connection parameters.
"Download connection locally"
Lets you use universes created on the connection in Web Intelligence
Rich Client in offline mode.
Lets you use the local middleware driver in the information design tool.
To do so, select the local middleware option in the information design tool preferences, otherwise queries to the database will use the server middleware.
This right is also needed to edit a secured connection in the information design tool.
"Delete objects"
Lets you delete the connection.
872 2012-12-12
Rights Appendix
Right
"Copy objects to another folder"
"Data Access"
Description
Lets you copy the connection from one folder to another.
Lets you retrieve content from the database specified in the connection.
In the information design tool, this right lets you browse table data from the connection and data foundation editors. It also lets you preview the result set in the query panel.
"Use connection for Stored
Procedures"
Lets you use the stored procedures in the database specified for the universe connection.
Note:
This right applies to .unv universes only.
OLAP connection rights
Right
"View objects"
Description
Lets you view the connection.
"Edit objects"
Lets you edit the connection parameters in the information design tool connection editor.
"Delete objects"
Lets you delete the connection.
"Copy objects to another folder"
Lets you copy the connection from one folder to another.
27.3.12 Applications
27.3.12.1 CMC
The rights in this section apply to the CMC only.
873 2012-12-12
Rights Appendix
Right
"Log on to the CMC and view this object in the
CMC"
"Allow access to Instance Manager"
"Allow access to Relationship Query"
"Allow access to Security Query"
Description
Lets you log on to the CMC.
Lets you access the Instance Manager.
Lets you run relationship queries in the CMC.
Lets you run security queries in the CMC.
27.3.12.2 BI launch pad
The rights in this section apply to BI launch pad only.
Right
"Organize"
Description
Lets you do the following:
• Move and copy objects.
• Add objects to your Favorites folder.
• Create shortcuts to objects.
"Send to Business Objects inbox"
"Send to email destination"
"Send to file location"
"Send to FTP location"
Lets you send objects to BI Inbox recipients.
Lets you send objects to BI Inbox recipients.
Lets you save objects to a file location.
Lets you save objects to an FTP location.
27.3.12.3 BI Workspaces
The rights in this section apply to BI workspaces only.
874 2012-12-12
Rights Appendix
Right
"Create and edit BI workspaces "
Description
Allows the user to create new BI workspaces and edit existing BI workspaces.
"Create and edit modules"
"Edit BI workspaces "
Allows the user to create new modules and edit existing modules.
Allows the user to edit existing BI workspaces. Users cannot create new BI workspaces.
875
27.3.12.4 Web Intelligence
The rights in this section apply to SAP BusinessObjects Web Intelligence (including the desktop interface) only and can affect viewers and query panels in these applications.
Right
"Data - enable data tracking"
Description
Allows tracking of changed data.
"Data - enable formatting of changed data"
Allows choice of formats for changed data.
"Desktop interface - enable Web Intelligence Desktop"
"Desktop interface - enable local data providers"
Allows use of the desktop interface.
Allows use of personal data providers in the desktop interface.
"Desktop interface - export documents"
Allows export of documents to the CMS in the desktop interface.
"Desktop interface - import documents"
Allows import of documents from the CMS in the desktop interface.
"Desktop interface - install from BI launch pad"
Allows download of the desktop interface from BI launch pad.
"Desktop interface - print documents"
Allows printing of documents from the desktop interface.
"Desktop interface - remove document security"
Allows removal of document security from the desktop interface.
2012-12-12
Rights Appendix
Right Description
"Desktop interface - save document for all users"
Allows documents to be saved for all users from the desktop interface.
"Desktop interface - save documents locally"
Allows saving of documents to local disk in the desktop interface.
"Desktop interface - send by mail"
Allows documents to be sent by email in the desktop interface.
"Desktop interface - enable local data providers"
Allows use of personal data providers in the desktop interface.
"Documents - disable automatic refresh on open"
Stops documents from being automatically refreshed when opened.
"Documents - enable autosave"
Allows autosaving of documents (if autosaving is activated in the CMC by the administrator).
"Documents - enable creation"
Allows creation of new documents.
"Documents - enable publishing and content management"
Allows documents to be published in the CMS.
"Interactive: Reporting - Create and edit alerters"
Allows creating and editing alerters in the interactive viewer.
"Interfaces - enable Rich Internet Application"
Allows use of the Rich Internet Application viewing and editing interface (Java Report Panel in previous releases).
"Interfaces - enable web viewing interface"
Allows use of the Web viewing interface (DHTML viewer in previous releases).
"Interfaces - enable web query panel"
Allows use of the web query panel (Query - HTML in previous releases).
"General - edit 'My Preferences'"
Allows preferences to be edited in the BI launch pad.
"General - enable right-click menus"
Allows use of right-click menus.
"Left pane - enable document summary"
Allows display of the document summary in the Left Pane.
876 2012-12-12
Rights Appendix
Right
"Left pane - enable document structure and filters"
Description
Allows display of the document structure and filters in the
Left Pane.
"Query script - enable editing (SQL,
MDX...)"
"Query script - enable viewing (SQL,
MDX...)"
"Reporting - create and edit breaks"
Allows editing of query scripts (SQL and MDX).
Allows viewing of query scripts (SQL and MDX).
Allows creation and editing of breaks.
"Reporting - create and edit conditional formatting rules"
"Reporting - create and edit predefined calculations"
Allows creation and editing of conditional formatting rules.
Allows creation and editing of predefined calculations.
"Reporting - create and edit input controls"
Allows creation and editing of input controls.
"Reporting - create and edit report filters and consume input controls"
Allows creation and editing of report filters and input controls. (Input Controls pane in the Left Pane are not displayed when disabled).
"Reporting - create and edit sorts"
Allows creation and editing of sorts.
"Reporting - create formulas and variables"
Allows creation of formulas and variables.
"Reporting - enable formatting"
Allows editing of report formatting. If this right is denied, then Design and Data mode should be not available to the user (de-activated).
"Reporting - enable merged dimensions"
Allows data synchronization using merged dimensions in reports and in the data manager.
"Reporting - insert and remove reports, tables, charts and cells"
Allows insertion and removal of reports, tables, charts and cells. Also rules the duplicates workflow (copy/paste).
27.3.12.5 Strategy Builder
877 2012-12-12
Rights Appendix
Strategy Builder is a tool related to Performance Management. The rights in this section apply to Strategy
Builder only and can affect goals management in Performance Manager or specific features in Strategy
Builder.
Right
"Create, Modify, or Delete
Goals"
Description
Lets you add, edit, or remove goals in Performance Manager.
"View Goals"
"Access to Goal Management"
Lets you see goals in analytics that contain goals.
Lets you view goals on the "Goals Management" page in Performance
Manager.
"Publish Goals" Lets you publish goals in Performance Manager.
"Access to Strategy Builder" Lets you access the Strategy Builder tool in Performance Manager.
"Create, Modify, or Delete
Roles"
"Create, Modify, or Delete
Strategies"
Lets you administer the roles that are used to publish goals or metrics to specific audiences in Strategy Builder.
Lets you create strategies that link roles and publish goals and metrics in Strategy Builder.
27.3.12.6 Universe design tool rights
The rights in this section apply to the universe design tool application.
878 2012-12-12
Rights Appendix
Right
"Check Universe Integrity"
Description
Lets you check universe integrity.
"Refresh Structure Window"
Lets you refresh the structure window.
"Use Table Browser"
Lets you view database data using the table browser.
"Apply Universe Constraints"
Lets you apply predefined universe constraints to users of an imported universe.
"Link Universe"
Lets you link two universes and share components.
"Create, Modify or Delete
Connections"
Lets you create, modify, and delete universe connections that are stored in the repository or stored as personal or shared connections.
27.3.12.7 Information design tool rights
The rights in this section apply the to the information design tool application.
Right Description
"Administer security profiles"
Lets you open the security editor.
Note:
To work with security profiles, you need rights granted on the universe.
"Share projects "
"Create, modify, or delete connections "
"Publish universes "
Lets you share a local project and open the Synchronize Project view to synchronize a shared project with the local project.
Lets you do the following:
• create and delete secured connections from the Published Resources view
• edit connections in the connection editor
• publish connections to a repository
Lets you publish universes to a repository.
879 2012-12-12
Rights Appendix
Right
"Retrieve universes"
"Save for all users"
"Compute statistics "
Description
Lets you retrieve published universes into a local project to be edited.
Lets you use the save for all users option when retrieving universes.
Lets you select tables and columns on which to calculate and publish statistics.
27.3.12.8 Widgets for SAP BusinessObjects Business Intelligence platform
The rights in this section apply to the widgets for SAP BusinessObjects Business Intelligence platform application only.
Right
"Use Explorer"
Description
Allows users to browse the content on all connected BI platform servers using the Document List Explorer.
"Use Alert Inbox"
(Deprecated) Lets you use the Alerts Inbox.
"Use Search" Allows users to search across all connected BI platform repositories at once using the Content Search.
27.3.12.9 Alerting
The rights in this section apply to the Alerting application only.
880 2012-12-12
Rights Appendix
Right
""Trigger Alerts""
Description
Lets you trigger alert events.
To trigger an alert for a document, you need the following rights:
• View and Schedule rights on the document
• View and Trigger rights on the corresponding event
""Subscribe to Objects"
Lets you subscribe to an alert event
To subscribe to an event, you need the following rights:
• View right on the corresponding event
• Subscribe right on the user's own account
To subscribe to an alert in a document, you need the following rights:
• View right on the document
• View Instance right on the document
• View right on the corresponding event
• Subscribe right on the user's own account
27.3.12.10 Explorer
The rights in this section apply to Explorer only.
881 2012-12-12
Rights Appendix
Right
"Log on to Explorer and view this object in the CMC"
Description
Lets you log on to Explorer. This right is required for you to perform other tasks with Explorer.
"Explore Information Spaces"
Lets you explore an Information Space.
To perform this task, you must also have the "Log on to Explorer and view this object in the CMC" right.
"Explore Information Spaces: Export to Bookmark/Email"
Lets you bookmark and email bookmarks.
To perform this task, you must also have the following rights:
• "Log on to Explorer and view this object in the CMC"
• "Explore Information Spaces"
"Explore Information Spaces: Export to CSV"
Lets you export the results of an exploration to a CSV or Excel file.
To perform this task, you must also have the following rights:
• "Log on to Explorer and view this object in the CMC"
• "Explore Information Spaces"
"Explore Information Spaces: Export to Image"
Lets you export the results of an exploration as an image.
To perform this task, you must also have the following rights:
• "Log on to Explorer and view this object in the CMC"
• "Explore Information Spaces"
"Explore Information Spaces: Export to Web Intelligence"
Lets you export the results of an exploration as a query.
To perform this task, you must also have the following rights:
• "Log on to Explorer and view this object in the CMC"
• "Explore Information Spaces"
"Manage Information Spaces "
Lets you access the Manage Spaces menu and perform the associated tasks.
To perform this task, you must also have the "Log on to Explorer and view this object in the CMC" right.
882 2012-12-12
Rights Appendix
Right Description
"Manage Information Spaces: Create a new Space"
Lets you create a new Information Space.
To perform this task, you must also have the following rights:
• "Log on to Explorer and view this object in the CMC"
• "Manage Information Spaces "
"Manage Information Spaces: Modify a Space"
Lets you modify or delete an Information Space.
To perform this task, you must also have the following rights:
• "Log on to Explorer and view this object in the CMC"
• "Manage Information Spaces "
"Manage Information Spaces:
Schedule indexing"
Lets you schedule indexing for Information Space data.
To perform this task, you must also have the following rights:
• "Log on to Explorer and view this object in the CMC"
• "Manage Information Spaces "
"Manage Information Spaces:
Launch indexing"
Lets you run indexing for Information Space data.
To perform this task, you must also have the following rights:
• "Log on to Explorer and view this object in the CMC"
• "Manage Information Spaces "
27.3.12.11 SAP BusinessObjects Mobile
The rights in this section apply to SAP BusinessObjects Mobile application only.
883 2012-12-12
Rights Appendix
Right Description
"Log on to SAP BusinessObjects
Mobile application"
Grants access to log into BI platform through Mobile application and view documents.
"Subscribe to document alerts"
Grants access for subscribing to document/recurrence alerts.
Note:
• If you are granted "Subscribe to document alerts" right earlier and currently you are denied, you still continue to receive subscribed alerts. You must explicitly unsubscribe to alerts if you do not want to receive them.
• To subscribe to document alerts (or recurring instances) for schedules, user must have "Full Control" security access for the "System Events" folder under "Events" in Central Management Console (CMC).
"Save documents to device's localstore"
Grants access for saving documents on the Mobile device.
Note:
If you have saved documents on the device when you are granted
"Save documents locally on the device" right, then documents still exists on the device even if you are deprived of save right. However, these documents are not synced during synchronization process.
"Send documents from device as an email"
Grants access for sending reports by email.
For more information, refer to the
SAP BusinessObjects Mobile Installation and Deployment Guide.
884 2012-12-12
Server Properties Appendix
Server Properties Appendix
28.1 About the server properties appendix
This server properties appendix lists and describes properties that can be set for each Business
Intelligence platform server.
28.1.1 Common server properties
The server properties described in this section apply to all server types.
Table 28-1: Request port properties
Property
Server Name
Description
The name of the server.
Default Value
Name of the node that the server is on, plus the name of the server
ID, CUID
Node
The short ID and cluster unique ID of the server. Readonly.
Values are auto-generated.
The name of the node where the server is located and, in brackets, the host name and the account name used to run the node
Specified during installation
Description
Command Line Parameters
The server's description
The command-line parameters for the server.
Name of the server
Depends on the type of server
885 2012-12-12
Server Properties Appendix
Property
Request Port
Auto assign
Description Default Value
Specifies the port from which the server receives requests. In an environment with firewalls, you may want to force the server to only listen to requests on ports that are open on the firewall. If you are specifying a port for the server, ensure that the port is not already taking by another process.
Note:
If Auto assign is selected, the server binds to a dynamically allocated port. This means that a random port number is allocated to the server each time the server is restarted.
Blank
Specifies whether the server binds to a dynamically allocated port whenever the server is restarted. To bind the server to a specific port, set Auto Assign to
FALSE and specify a valid Request Port.
TRUE
Table 28-2: Auto-start properties
Property Description Default Value
Automatically start this server when the Server Intelligence Agent starts
Specifies whether the server is automatically started when the Server Intelligence Agent (SIA) starts or restarts.
If this value is set to FALSE and the SIA starts or restarts, the server remains stopped.
TRUE
Table 28-3: Host identifier properties
Property
Auto assign
Description Default Value
Specifies whether the server binds to a network interface that is automatically assigned. If set to FALSE, the server binds to a specific network interface. If set to TRUE, the server accepts requests on the first available IP Address. On multihomed machines, you can specify a particular network interface to bind to by setting this value to FALSE and providing a valid hostname or IP Address.
TRUE
886 2012-12-12
Server Properties Appendix
Property
Hostname
IP Address
Description
The IP Address of the network interface that the server binds to. Both IPv4 and IPv6 protocols are supported. If an IP Address is specified, the server accepts requests on the IP Address only.
Default Value
The hostname of the network interface that the server binds to. If a host name is specified, the server accepts requests on all IP Addresses associated with the host name.
Blank
Blank
Table 28-4: Configuration template properties
Property
Use Configuration
Template
Description
Specifies whether to use a configuration template.
Restore System
Defaults
Specifies whether to restore the original default settings for this server.
Default Value
FALSE
FALSE
Set Configuration
Template
Specifies whether to use the current service's settings as a configuration template for all services of the same type. If set to TRUE, all services of the same type that you have specified to Use Configuration Template are immediately reconfigured to use the settings of the current service.
FALSE
Table 28-5: TraceLog Service properties
Property Description
Log Level
Default Value
Specifies the minimum severity of messages that you want to be recorded, and determines how much information is recorded in the server log file.
Possible log threshold levels are:
•
Unspecified
•
None
•
Low
•
Medium
•
High
Unspecified
887 2012-12-12
Server Properties Appendix
Related Topics
•
Working with configuration templates
•
28.1.2 Core Services properties
The Core Services category includes the following servers:
• Adaptive Job Server
• Adaptive Processing Server
• Central Management Server
• Event Server
• Input File Repository Server
• Output File Repository Server
• Web Application Container Server
Adaptive Job Server properties
Table 28-6: General properties
Property Description Default Value
Temporary Directory
Specifies the directory where temporary files are created on when necessary. You may encounter performance issues if this directory does not have adequate disk space. For better performance, ensure that this directory is located on a local disk.
Note:
You must restart the server for changes to take effect.
%Default
DataDir%
The Adaptive Job Server can host a number of different services. Each service has the following properties
888 2012-12-12
Server Properties Appendix
Table 28-7: Service properties
Property Description Default Value
Maximum Concurrent Jobs
Specifies the number of concurrent independent processes (child processes) that the server allows. You can adjust the maximum number of jobs to suit your reporting environment.
The default setting is acceptable for most reporting scenarios. The ideal setting for your reporting environment depends on your hardware configuration, database software, and reporting requirements.
5
Maximum Child Requests
Specifies the number of jobs the child will process before restarting.
100
Adaptive Processing Server properties
Table 28-8: General properties
Property Description Default Value
Service Startup
Timeout (seconds)
Specifies the amount of time, in seconds, that the server will wait for services to start.
If a service fails to start within the time specified, there are two possible reasons:
• The service failed, for example, because a required resource such as a database could not be found, or the service encountered a port conflict.
• The service could not start within the specified time, for example, because the system is too slow.
1200
To find the reason, check the server log file. If the service could not start within the time specified, consider increasing this Value.
z
889 2012-12-12
Server Properties Appendix
Table 28-9: Insight to Action Service properties
Metric Description
Maximum Number of Active Connections Per User Session
The maximum number of connections with the SAP server available for a user for a given time. When a user opens a report or dashboard that is RRI capable, a connection with the SAP server will be established to determine the available RRI targets.
20
Maximum Number of Idle Connections
Per User Session
Maximum Connection Wait Time (in seconds)
The number of idle connections to keep open and reuse for subsequent RRI requests. Increasing this setting will allocate additional system resources.
20
The amount of time the Insight to Action framework should wait for a response from the SAP Server before timing out (in seconds).
30
Table 28-10: Client Auditing Proxy Service properties
Description Property
No configuration properties
Table 28-11: Publishing Service properties
Description Property
No configuration properties
Table 28-12: Translation Service properties
Description Property
No configuration properties
Table 28-13: Security Token Service properties
Description Property
No configuration properties
Default Value
Default Value
Default Value
Default Value
890 2012-12-12
Server Properties Appendix
Table 28-14: Monitoring Service properties
Description Property
No configuration properties
Default Value
Table 28-15: Platform Search Service properties
Description Property
No configuration properties
Table 28-16: Publishing Post Processing Service properties
Description Property
No configuration properties
Default Value
Default Value
Central Management Server properties
Note:
When you modify any of these server properties, you must restart the server for the changes to take effect.
Table 28-17: Central Management Service properties
Property
Name Server Port
System Database
Connections Requested
Description
Specifies the port on which the CMS listens to initial name service requests.
Default Value
6400
Specifies the number of CMS system database connections that the CMS attempts to establish. If the server cannot establish all of the requested database connection, the CMS continues to function but at a reduced performance, since fewer concurrent requests can be served simultaneously. The CMS will attempt to establish additional connections, until the requested number of connection is established.
The CMS's Established System Database Connec-
tions metric shows the current number of established connections.
14
891 2012-12-12
Server Properties Appendix
892
Property
Auto Reconnect to
System Database
Description Default Value
Specifies whether the CMS automatically attempts to reestablish a connection to the CMS database in the event of a service disruption. If this Value is set to
FALSE, you are able to check the integrity of the CMS database before resuming operations; you must restart the CMS to reestablish the database connection.
TRUE
Table 28-18: Single Sign-on Service properties
Property Description Default Value
Single Sign-On Expiry (seconds)
Specifies the time, in seconds, that an SSO connection to a datasource is valid before expiring. This applies to Windows AD users running reports that are configured for Windows AD SSO to the datasource.
86400
Event Server properties
Table 28-19: Event Service properties
Property
Cleanup Interval
(minutes)
Description
Specifies how often cleanup utility runs, in minutes.
Default Value
20
Event Poll Interval
(seconds)
Specifies how often the server polls for a file that triggers an event, in seconds.
10
The range of allowed
Values is 1 to 1200 seconds.
Input File Repository Server properties
Table 28-20: Input Filestore Service properties
Property
Maximum Retries for File Access
Description
Specifies the number of times the server tries to access a file.
Default Value
1
Maximum Idle Time
(minutes)
Specifies the length of time that the server waits before it closes inactive connections. Setting a Value that is too low can cause a user's request to be closed prematurely. Setting a Value that is too high can cause excessive consumption of system resources such as processing time and disk space.
10
2012-12-12
Server Properties Appendix
893
Property Description Default Value
Temporary Directory
Specifies the directory where temporary files are created when necessary.
Note:
You may encounter performance issues if this directory does not have adequate disk space. To ensure better performance, it is recommended that the Tem-
porary Directory is located on the same file system as the File Store Directory.
%DefaultInput
FRSDir/temp%
File Store Directory
Specifies the directory where file repository objects are stored.
Note:
You may encounter performance issues if this directory does not have adequate disk space.
%DefaultInput
FRSDir/%
Output File Repository Server properties
Table 28-21: Output Filestore Service properties
Property
Maximum Retries for File Access
Description
Specifies the number of times the server tries to access a file.
Default Value
1
Maximum Idle Time
(minutes)
Specifies the length of time that the server waits before it closes inactive connections. Setting a Value that is too low can cause a user's request to be closed prematurely. Setting a Value that is too high can cause excessive consumption of system resources such as processing time and disk space.
10
Temporary Directory
Specifies the directory where temporary files are created when necessary.
Note:
You may encounter performance issues if this directory does not have adequate disk space. For better performance, put the Temporary Directory on the same file system as the File Store Directory.
%DefaultOutput
FRSDir
/temp%
File Store Directory
Specifies the directory where file repository objects are stored.
Note:
You may encounter performance issues if this directory does not have adequate disk space.
%DefaultOutput
FRSDir/%
2012-12-12
Server Properties Appendix
Web Application Container Server properties
Table 28-22: General properties
Property Description Default Value
Service Startup Timeout (seconds)
How long the WACS will wait for its hosted services to start before it times out. If the timeout passes, the WACS will not provide services that haven't started yet. On a slower machine, you can consider specifying a larger Value.
1200
If you specify a Value that is too small, and the WACS doesn't start before timing out, restore the default settings of the WACS through the Central Configuration Manager (CCM).
Table 28-23: TraceLog Service properties
Property Description
Log level
Default Value
Enables logging and sets the level of severity and detail to
None (only critical events logged) Low (startup, shutdown, start and end request messages), Medium (error, warning and most status messages) or
High (Nothing excluded. Use for debugging only. CPU usage may increase, impacting performance).
This setting is unspecified.
The available menu choices are:
•
Unspecified
•
None
•
Low
•
Medium
•
High
894 2012-12-12
Server Properties Appendix
Table 28-24: RESTful Web Service system configuration properties
Property Description Default Value
Show Error Stack
When enabled, the error log includes RESTful web service error messages for debugging purposes. It should not be used otherwise, or when there is a security concern where details of the BI platform are revealed.
Not selected
Default Number of Objects on
One Page
The number of entries that will be listed per page. Developers can override this setting with the
&pageSize=<m> parameter in the RESTful Web Services SDK.
50
Enterprise Session Token
Timeout (minutes)
Session Pool Size
The expiry time a logon token will remain valid. Beyond this time, a new login token must be generated.
60
This is the number of cached sessions to be stored at one time that is used to improve server performance. The session pool caches active RESTful web service sessions so they can be reused when a user sends another request that uses the same logon token in the
HTTP request header.
1000
Session Pool Timeout (minutes)
The time in minutes that cached sessions will expire.
2
895 2012-12-12
Server Properties Appendix
Property Description Default Value
Enable HTTP Basic Authentication
If this setting is not enabled,
RESTful web service requests must use a logon token. When this setting is enabled, users must provide their name and password the first time they make a RESTful web service request. When enabled, the
Default Authentication
Scheme for HTTP Basic drop down menu appears.
Not selected
Default Authentication
Scheme for HTTP Basic
When Enable HTTP Basic Au-
thentication is selected, one of four authentication types may be selected. Note that names and passwords are transmitted in clear text unless HTTPS options are used.
Blank. However, if Enable HTTP
Basic Authentication is selected, secEnterprise is the default setting.
Accepted Values are:
•
secEnterprise
•
secDAP
•
SAPR3
•
secWinAD
Table 28-25: BOE Web Application Service properties
Property Type
Authentication Type
Description Default Value
The authentication type that is used to authenticate users logging on to SAP BusinessObjects
Business Intelligence platform
BI launch pad.
Accepted Values are:
•
AD Kerberos
•
AD Kerberos SSO
•
Enterprise
•
LDAP
Enterprise
896 2012-12-12
Server Properties Appendix
Property Type
Default AD Domain
Service Principal Name
Keytab File
Description Default Value
The default Active Directory domain is used so that users do not have to supply a domain when they log in. For example, if the default domain is set to
“mydomain” and a user logs on with the username “user”, the
Active Directory logon authority tries to authenticate “[email protected]”.
Blank
A service principal name (SPN) is used by clients to uniquely identify an instance of a service.
The Kerberos authentication service uses an SPN to authenticate a service.
Blank
The full path to a keytab file. A keytab file allows Kerberos Filters to be configured without exposing the password of the user account on the web application machine.
Blank
Table 28-26: Web Services SDK and QaaWS Service properties
Property Description Default Value
Enable Kerberos Active Directory Single Sign On
Whether to enable Kerberos AD
Single Sign-on for Web Services
SDK and QaaWS.
FALSE
Default AD Domain
The default Active Directory domain is used so that users do not have to supply a domain when they log in.
Blank
Service Principal Name
A service principal name (SPN) is used by clients to uniquely identify an instance of a service.
The Kerberos authentication service uses an SPN to authenticate a service.
Blank
897 2012-12-12
Server Properties Appendix
Property
Keytab File
Description
The full path to a keytab file. A keytab file allows Kerberos Filters to be configured without exposing the password of the user account on the web application machine.
Default Value
Blank
Table 28-27: HTTP configuration properties
Property
Bind to All IP Addresses
Bind to Hostname or IP Address
HTTP Port
Description Default Value
Whether to bind to all network interfaces or not. If your server has more than one NIC and you want to bind to a specific network interface, do not select this property.
TRUE
Specifies the network interface
(IP address or host name) on which HTTP service is provided.
You can specify a Value only if you do not select Bind to All IP
Addresses.
localhost
The port on which HTTP service is provided.
6405
The range of allowed Values is
1 to 65535.
Maximum HTTP Header Size
The maximum allowed size, in bytes, of the request and response HTTP header.
32768
Table 28-28: HTTP through proxy configuration properties
Property
Enable HTTP through Proxy
Description Default Value
Whether to enable the HTTP through Proxy connector on the
WACS. This is typically selected in deployments with a reverse proxy.
FALSE
898 2012-12-12
Server Properties Appendix
Property
Bind to All IP Addresses
Bind to Hostname or IP Address
HTTP Port
Proxy Hostname
Proxy Port
Maximum HTTP Header Size
Description Default Value
Whether to bind the HTTP through proxy port to all network interfaces or not.
TRUE
Specifies the network interface
(IP address or host name) on which HTTP through Proxy service is provided. You can specify a Value only if you do not select Bind to All IP Addresses.
localhost
The port on which HTTP service in a reverse proxy deployment is provided. You can specify a
Value only if you select Enable
HTTP through Proxy.
6406
The range of allowed Values is
1 to 65535.
The IPv4 address, IPv6 address, hostname, or fully-qualified domain name of your proxy server. You can specify a Value only if you select Enable HTTP
through Proxy.
Blank
.
The port of your forward or reverse proxy server. You can specify a Value only if you select
Enable HTTP through Proxy.
0
The range of allowed Values is
1 to 65535.
The maximum allowed size, in bytes, of the request and response HTTP header. You can specify a Value only if you select
Enable HTTP through Proxy.
32768
Table 28-29: HTTPS configuration properties
Property
Enable HTTPS
Description Default Value
Whether to enable HTTPS/SSL communication.
FALSE
899 2012-12-12
Server Properties Appendix
Property
Bind to Hostname or IP Address
HTTPS Port
Proxy Hostname
Proxy Port
Protocol
Description Default Value
Specifies the network interface
(IP address or host name) on which HTTPS service is provided. You can specify a Value only if you select Enable
HTTPS.
localhost
The port on which HTTPS service is provided. You can specify a Value only if you select En-
able HTTPS.
443
The range of allowed Values is
1 to 65535.
The IPv4 address, IPv6 address, hostname, or fully-qualified domain name of your proxy server. You can specify a Value only if you select Enable
HTTPS.
Blank
The port of your forward or reverse proxy server. You can specify a Value only if you select
Enable HTTPS.
0
The allowed range of Values is
1 to 65535.
The encryption protocol to use.
You can specify a Value only if you select Enable HTTPS.
TLS
The allowed Values are TLS or
SSL.
Certificate Store Type
The type of certificate store that contains your certificates and private keys. In most cases, this will be PCKS12. You can specify a Value only if you select En-
able HTTPS.
PKCS12
The allowed Values are
PKCS12 or JKS.
Certificate Store File Location
The full path to the certificate file. You can specify a Value only if you select Enable
HTTPS.
Blank
900 2012-12-12
Server Properties Appendix
Property
Certificate Alias
Enable Client Authentication
Description Default Value
Private Key Access Password
PKCS12 certificate stores and
JKS keystores have private keys that are password protected, to prevent unauthorized access or theft. Enter the password that you specified when you generated the certificate store here, so that WACS can access private keys from the certificate store.
You can specify a Value only if you select Enable HTTPS.
Blank
The alias of the certificate inside the certificate store. If this is not specified, and a certificate store that contains more than one certificate is used, the first certificate in the store is used. In most cases, you do not need to specify a Value. You can specify a Value only if you select En-
able HTTPS.
Blank
If client authentication is enabled, only clients that have keys stored in the Certificate
Trust List file are can get WACS services. Other clients are rejected. You can only enable client authentication if you select En-
able HTTPS.
FALSE
Certificate Trust List File Location
The full path to the certificate trust list file. You can specify a
Value only if you select Enable
HTTPS and Enable Client Au-
thentication.
Blank
Certificate Trust List Private
Key Access Password
The password that protects access to the private keys in the
Certificate Trust List file. You can specify a Value only if you select Enable HTTPS and En-
able Client Authentication.
Blank
901 2012-12-12
Server Properties Appendix
Property
Maximum HTTP Header Size
Description Default Value
The maximum allowed size, in bytes, of the request and response HTTP header. You can specify a Value only if you select
Enable HTTPS.
32768
Table 28-30: Concurrency settings (per connector)
Property
Maximum Concurrent Requests
Description Default Value
The number of concurrent HTTP or HTTPS requests that each connector (HTTP, HTTP through
Proxy, or HTTPS) can process simultaneously.
150
The range of allowed Values is
1 to 9999.
Table 28-31: Active directory configuration settings
Property
Krb5.ini File Location bscLogin.conf File Location
Description
The full path to a bscLo gin.conf
file.
Default Value
The full path to a krb5.ini file that stores Kerberos configuration properties.
Blank
Blank
28.1.3 Connectivity Services properties
The Connectivity Service category includes the following services:
• Native Connectivity Service (hosted on a standalone server)
• Native Connectivity Service (32-bit hosted on a standalone server)
• Adaptive Connectivity Service (hosted in APS)
All services share the same configuration settings.
902 2012-12-12
Server Properties Appendix
Table 28-32: Excel Data Access Service properties
Property Description
Excel Data Access Cleanup
Timeout (in seconds)
Default Value
Specifies the amount of time, in seconds, that the service waits for an inactive client before performing a cleanup of the client's session
1200
Excel Data Access Swap
Timeout (in seconds)
Specifies the amount of time, in seconds, that the service waits for an inactive client before swapping the client's session onto the hard disk. It is recommended that you specify a value that is lower than the value for the Excel Data Access
Cleanup Timeout (in seconds)
property.
600
Table 28-33: Service Operation properties
Property Description Default Value
Remember:
You do not need to restart the server after changing the following Service Operation properties.
Connection Pooling
Either enables or disables the connection pool. Possible values are:
•
Enabled - With Timeout
•
Enabled
•
Disabled
Note:
The connection pool is a caching functionality that maintains connections in a reusable state for improving server performance.
Enabled - With
Timeout
903 2012-12-12
Server Properties Appendix
Property Description Default Value
Connection Pool
Timeout (minutes)
Specifies the maximum idle time for connections in the pool in minutes.
Note:
This property is equivalent to the Max Pool Time parameter of the cs.cfg file. Disabling the pool is equivalent to Max Pool Time set to 0. Enabling the pool without timeout is equivalent to Max Pool Time set to -1. Refer to Data Access Guide for more information.
60
Transient Object Inactivity Timeout
(minutes)
Specifies how many minutes to keep an unused temporary object in the server. The object is removed afterwards and its resources are reclaimed.
60
Transient Object
Timer Interval (minutes)
Specifies the time between activity checks in minutes.
At regular intervals, the server searches for candidate objects for removal.
5
Enable HTTP
Chunking
Either enables or disables the HTTP chunking.
Note:
HTTP chunking is relevant only to three-tier deployments. It impacts the open/refresh document performance, because bigger responses mean fewer round trips when fetching large documents. Disabling HTTP chunking is equivalent to setting HTTP Chunk Size to 0.
Enabled
HTTP Chunk Size
(kilobytes)
Specifies the size of the HTTP responses emitted by the server in kilobytes.
64
Table 28-34: Low Level Tracing properties
Property Description Default Value
Remember:
You do not need to restart the server after changing the following Low Level Tracing properties.
904 2012-12-12
Server Properties Appendix
Property Description
Enable Job Tracing
Enables the tracing of Connection Server jobs.
Note:
It requires Log Level property to be set to High.
Default Value
Disabled
Enable Middleware
Tracing
Enables the tracing of all middleware. To trace specific middleware, you must configure the cs.cfg file and restart the server.
Note:
It requires Log Level property to be set to High.
Disabled
Table 28-35: Active Data Sources properties
Property Description Default Value
Caution:
You must restart the server after changing the following Active Data Sources properties.
Activate Data
Source
Allows you to select the data sources for which you want connections. This property works as a filter for drivers. You specify the active data sources to load the drivers you want to use.
Caution:
The default server behavior is to load all available drivers. Use this setting to specialize servers. It is particularly useful when you deploy multiple CORBA servers on your network.
Remember:
Only drivers for selected data sources are loaded. All the others are ignored. If you do not select any data sources, the server loads all available drivers.
Note:
Verify in the server metrics that the selected data sources have been activated. The network layers and databases are displayed under "Connectivity Service
Metrics".
Not selected
905 2012-12-12
Server Properties Appendix
Property
Network Layer
Database
Description Default Value
Specifies the network layer used by the connection.
Note:
Only the non-localized name is considered. You can find the list of available network layers in the driv er.cfg
file, which is located in the connectionserv
er-install-dir\connectionServer directory.
• ODBC for native
CORBA servers
• JDBC for Adaptive CORBA server
Specifies the database used by the connection.
Note:
Only the non-localized name is considered. Database names can be regular expressions if they are pure
ASCII strings. Patterns use GNU regexp syntax. Use the .* pattern to match any character. For example, the MS SQL Server.*$ expression means all MS
SQL Server databases are used. For more information about regular expressions, go to the PERL web site at http://www.perl.com/doc/manu al/html/pod/perlre.html#Regular_Expressions .
Blank, until you enter a database name
Table 28-36: Custom Data Access Service properties
Property Description Default Value
Custom Data Access Cleanup
Timeout (in seconds)
Specifies the amount of time, in seconds, that the service waits for an inactive client before performing a cleanup of the client's session.
1200
Custom Data Access Swap
Timeout (in seconds)
Specifies the amount of time, in seconds, that the service waits for an inactive client before swapping the client's session onto the hard disk. It is recommended that you specify a value that is lower than the value for the Custom Data Access
Cleanup Timeout (in seconds)
property.
600
906 2012-12-12
Server Properties Appendix
Related Topics
•
28.1.4 Crystal Reports Services properties
The Crystal Reports service category includes the following servers:
• Adaptive Job Server
• Crystal Reports Cache Server
• Crystal Reports Processing Server
• Crystal Reports 2011 Report Application Server
• Crystal Reports 2011 Processing Server
Crystal Reports Cache Server properties
Any properties that apply to both Crystal Reports Cache Servers and Crystal Reports Processing
Servers should be set to the same value. For example, if you set the Viewer Refresh Always Yields
Current Data setting to TRUE on the Cache Server, you should set the same property to TRUE on the
Processing Server.
When you modify a server property, you must restart the server for the changes to take effect.
Table 28-37: Adaptive Job Server Service properties
Property Description Default Value
Maximum Concurrent Jobs
Specifies the number of concurrent independent processes (child processes) that the server allows. You can adjust the maximum number of jobs to suit your reporting environment.
The default setting is acceptable for most reporting scenarios. The ideal setting for your reporting environment depends on your hardware configuration, database software, and reporting requirements.
5
Maximum Child Requests
Specifies the number of jobs the child will process before restarting.
100
907 2012-12-12
Server Properties Appendix
Table 28-38: Crystal Reports Cache Service properties
Property
Viewer Refresh Always Yields Current Data
Description Default Value
Specifies whether, when users explicitly refresh a report, all cached pages are ignored and new data is retrieved directly from the database.
Note:
This property can be set on a report object itself, and can vary from report to report; values specified on the report object override the server settings. To specify a value on the report object, select the report in the
CMC, and click Default Settings > Viewing Server
Group.
FALSE
Share Report Data
Between Clients
Specifies whether report data is shared between different clients.
Note:
This property can be set on a report object itself, and can vary from report to report; values specified on the report object override the server settings.
TRUE
Idle Connection
Timeout (minutes)
Security Cache
Timeout (minutes)
Specifies the amount of time, in minutes, that the
Crystal Reports Cache Server waits for a request from an idle connection. There is generally no need to modify the default value.
20
Specifies the amount of time, in minutes, that the server uses cached logon credentials, report parameters, and database connection information to serve requests before querying the CMS.
20
908 2012-12-12
Server Properties Appendix
Property Description Default Value
Oldest On-Demand
Data Given to
Clients (seconds)
Specifies the amount of time, in seconds, that the server uses cached data to meet requests from ondemand reports. If the server receives a request that can be met using data that was generated to meet a previous request, and the time elapsed since that data was generated is less than the value set here, then the server will reuse this data to meet the subsequent request. Reusing data in this way significantly improves system performance when multiple users need the same information. When setting this value consider how important it is that your users receive up-to-date data. If it is very important that all users receive fresh data (perhaps because important data changes very frequently) you may need to disallow this kind of data reuse by setting the value to 0.
Note:
This property can be set on a report object itself, and can vary from report to report; values specified on the report object override the server settings.
0
Maximum Cache
Size (KB)
Cache Files Directory
Specifies the amount of hard disk space (in KB) that is used to cache reports. A large cache size may be necessary if the server needs to handle large numbers of reports, or reports that are especially complex.
256000
Specifies the location of the cache file directory.
%Default
DataDir%/Crys talRe portsCachingServ er/temp
Java VM Arguments
Specifies the command-line arguments that can be supplied to the JVM.
blank.
Crystal Reports Processing Server properties
Any properties that apply to both Crystal Reports Cache Servers and Crystal Reports Processing
Servers should be set to the same value. For example, if you set the Viewer Refresh Always Yields
Current Data setting to TRUE on the Cache Server, you should set the same property to TRUE on the
Processing Server.
Note:
When you modify any of these server properties, you must restart the server for the changes to take effect.
909 2012-12-12
Server Properties Appendix
Table 28-39: Crystal Reports Processing Service properties
Property
Idle Job Timeout
(minutes)
Maximum Lifetime
Jobs Per Child
Viewer Refresh Always Yields Current Data
Description Default Value
Specifies the length of time, in minutes, that the
Crystal Reports Processing Server waits between requests for a given job.
20
Specifies the maximum number of jobs that each child process can manage per lifetime.
1000
Specifies whether, when users explicitly refresh a report, all cached pages are ignored and new data is retrieved directly from the database. Specifies whether report data is shared between different clients.
Note:
This property can be set on a report object itself, and can vary from report to report; values specified on the report object override the server settings. To specify a value on the report object, select the report in the
CMC, and click Default Settings > Viewing Server
Group.
FALSE
Share Report Data
Between Clients
Specifies whether report data is shared between different clients. Specifies whether report data is shared between different clients.
Note:
This property can be set on a report object itself, and can vary from report to report; values specified on the report object override the server settings.
TRUE
Idle Connection
Timeout (minutes)
Specifies the amount of time, in minutes, that the
Crystal Reports Processing Server waits for a request from an idle connection. There is generally no need to modify the default value.
20
Maximum Concurrent Jobs (0 for automatic)
Specifies the maximum number of independent jobs allowed to run concurrently on the Crystal Reports
Processing Server. If the value of this property is set to “0”, the server applies a suitable value, based on the CPU and memory of the machine that the server is running on.
0
910 2012-12-12
Server Properties Appendix
Property Description Default Value
Oldest On-Demand
Data Given to
Clients (seconds)
Specifies the amount of time, in seconds, that the server uses cached data to meet requests from ondemand reports. If the server receives a request that can be met using data that was generated to meet a previous request, and the time elapsed since that data was generated is less than the value set here, then the server will reuse this data to meet the subsequent request. Reusing data in this way significantly improves system performance when multiple users need the same information. When setting this value consider how important it is that your users receive up-to-date data. If it is very important that all users receive fresh data (perhaps because important data changes very frequently) you may need to disallow this kind of data reuse by setting the value to 0.
Note:
This property can be set on a report object itself, and can vary from report to report; values specified on the report object override the server settings.
0
Maximum Number of Prestarted Children
Specifies the maximum number of prestarted child processes that are allowed by the server. If this value is too low, the server creates child processes as soon as requests are made, and a user may experience latency. If this value is too high, system resources may be unnecessary wasted by idle child processes.
1
Temporary Directory
Specifies the directory where temporary files are created when necessary.
Note:
You may encounter performance issues if this directory does not have adequate disk space.
%Default
DataDir%/Crys talReportsPro cessingServ er/temp
Java Class Path
The name and path of the Java classes that are required by the server.
%CommonJavaLib
Dir%/procCR.jar
911 2012-12-12
Server Properties Appendix
Property Description Default Value
Java Child VM Arguments
Specifies the command-line arguments that are supplied to child processes that are created by the server.
Dbusinessob jects.connectiv
ity.directo
ry=%CONNECTION
SERV
ER_DIR%,Dcom.busi
nessob jects.mds.cs.Im
plementation
ID=csEX
Table 28-40: Single Sign-On Service Properties
Property Description Default Value
Single Sign-On Expiry (seconds)
Specifies the time, in seconds, that an SSO connection is valid before expiring.
86400
Crystal Reports 2011 Report Application Server properties
Note:
When you modify any of these properties, you must restart the server for the changes to take effect.
Table 28-41: Crystal Reports 2011 Viewing and Modification Service properties
Property Description Default Value
Allow Report Jobs to Stay Connected to the Database until the Report Job is
Closed
Specifies whether the report job will remain connected to the database until the process has been executed.
FALSE
Browse Data Size
(records)
Specifies the number of distinct records returned from the database when browsing through a particular field's values. The data is retrieved first from the client's cache - if it is available - and then from the server's cache. If the data is not in either cache, it is retrieved from the database.
100
912 2012-12-12
Server Properties Appendix
Property
Idle Connection
Timeout (minutes)
Batch Size
(records)
Description Default Value
Specifies the amount of time, in minutes, that the Report Application Server (RAS) waits for requests from an idle client before timing out. Setting a value too low can cause a user's request to be closed prematurely, and setting a value that is too high can affect the server's scalability (for instance, if the ReportClient
Document object is not closed explicitly, the server will be waiting unnecessarily for an idle job to close).
30
Specifies how many rows from the result set are returned by the database during each data transfer. For example, if 500 records are requested, and the Batch
Size property is set to 100 records, the data will be returned in 5 separate batches of 100 rows. To improve the performance of your RAS, you must understand your network environment, database, and the type of requests in order to set the appropriate batch size.
100
Number of database records to read when previewing or refreshing a report (-1 for unlimited)
Specifies the number of database records that will be read when viewing or refreshing a report. This settings limits the number of records that the server retrieves from the database when a user runs a query or report.
This setting is useful when you want to prevent users from running on-demand reports that return excessively large record sets.
You may prefer to schedule such reports, both to make the reports available more quickly to users and to reduce the load on your database from these large queries.
20000
Maximum Concurrent Report Jobs (0 for unlimited)
Specifies the maximum number of independent jobs allowed to run concurrently on the RAS.
Oldest on-demand data given to a client (minutes)
Specifies the amount of time, in minutes, an on-demand report will serve cached report data.
75
20
Temporary Directory
Specifies the directory where temporary files are created when necessary.
Note:
You may encounter performance issues if this directory does not have adequate disk space.
%Default
DataDir%/Crys talReport sRasServer/temp
913 2012-12-12
Server Properties Appendix
914
Table 28-42: Single Sign-On Service properties
Property
Single Sign-On Expiry (seconds)
Description Default Value
Specifies the time, in seconds, that an SSO connection is valid before expiring.
86400
Crystal Reports 2011 Processing Server properties
Note:
When you modify any of these properties, you must restart the server for the changes to take effect.
Table 28-43: Crystal Reports 2011 Processing Service properties
Property
Idle Job Timeout
(minutes)
Maximum Lifetime
Jobs Per Child
Viewer Refresh Always Yields Current Data
Description Default Value
Specifies the length of time, in minutes, that the
Crystal Reports Processing Server waits between requests for a given job
20
Specifies the maximum number of jobs that each child process can manage per lifetime
1000
Specifies whether, when users explicitly refresh a report, all cached pages are ignored and new data is retrieved directly from the database. Specifies whether report data is shared between different clients.
Note:
This property can be set on a report object itself, and can vary from report to report; values specified on the report object override the server settings. To specify a value on the report object, select the report in the
CMC, and click Default Settings > Viewing Server
Group.
FALSE
Share Report Data
Between Clients
Specifies whether report data is shared between different clients
Note:
This property can be set on a report object itself, and can vary from report to report; values specified on the report object override the server settings.
TRUE
Idle Connection
Timeout (minutes)
Specifies the amount of time, in minutes, that the
Crystal Reports Processing Server waits for a request from an idle connection. There is generally no need to modify the default value
20
2012-12-12
Server Properties Appendix
915
Property Description
Maximum Concurrent Jobs (0 for automatic)
Specifies the maximum number of independent jobs allowed to run concurrently on the Crystal Reports
Processing Server. If the value of this property is set to “0”, the server applies a suitable value, based on the CPU and memory of the machine that the server is running on.
Default Value
0
Oldest On-Demand
Data Given to
Clients (seconds)
Specifies the amount of time, in seconds, that the server uses cached data to meet requests from ondemand reports. If the server receives a request that can be met using data that was generated to meet a previous request, and the time elapsed since that data was generated is less than the value set here, then the server will reuse this data to meet the subsequent request. Reusing data in this way significantly improves system performance when multiple users need the same information. When setting this value consider how important it is that your users receive up-to-date data. If it is very important that all users receive fresh data (perhaps because important data changes very frequently) you may need to disallow this kind of data reuse by setting the value to 0.
Note:
This property can be set on a report object itself, and can vary from report to report; values specified on the report object override the server settings.
0
Maximum Number of Prestarted Children
Specifies the maximum number of prestarted child processes that are allowed by the server. If this value is too low, the server creates child processes as soon as requests are made, and a user may experience latency. If this value is too high, system resources may be unnecessary wasted by idle child processes.
1
Temporary Directory
Specifies the directory where temporary files are created when necessary
Note:
You may encounter performance issues if this directory does not have adequate disk space.
%Default
DataDir%/Crys talRe ports2011Pro cessingServ er/temp
Allow Report Jobs to Stay Connected to the Database until the Report Job is
Closed
Specifies whether the report job will remain connected to the database until the job is closed
FALSE
2012-12-12
Server Properties Appendix
Property Description Default Value
Database Records
Read When Previewing or Refreshing (0 for unlimited)
Specifies the number of database records that will be read when viewing or refreshing a report. This settings limits the number of records that the server retrieves from the database when a user runs a query or report.
This setting is useful when you want to prevent users from running on-demand reports that return excessively large record sets.
You may prefer to schedule such reports, both to make the reports available more quickly to users and to reduce the load on your database from these large queries.
20000
Table 28-44: Single Sign-On Service properties
Property
Single Sign-On Expiry (seconds)
Description Default Value
Specifies the time, in seconds, that an SSO connection is valid before expiring
86400
28.1.5 Analysis Services properties
The Analysis Services category includes the Adaptive Processing Server.
916 2012-12-12
Server Properties Appendix
Table 28-45: Multi-Dimensional Analysis Service properties
Property
Maximum number of members returned when filtering
Description
Maximum Client
Sessions
Specifies the maximum number of MDAS sessions that can simultaneously be open on the server. When the number of open sessions reaches this number, any additional attempts to start MDAS sessions result in a server unavailable error message. You can change this value to optimize MDAS performance, depending on your needs and available hardware, but increasing the value may result in performance issues for both the MDAS and the database. The default value of 15 sessions is a conservative estimate. For installations where user queries are small, you can increase this value significantly, whereas installations where user queries are large would require a lower value.
15
The valid range is 1 to 100.
Maximum number of cells returned by a query
Specifies the number of cells that are returned to a user in a single query. The user is prevented from executing a query that returns an extremely large number of cells, consuming a large amount of memory. If the user's query exceeds this cell limit, the user receives an error message.
100000
Specifies the number of members retrieved when filtering by member. A very large number of retrieved members can consume a large amount of memory.
Default Value
100000
Table 28-46: Promotion Management Service properties
Property Description Default Value
Adaptive Job Server
Specifies the number of concurrent independent processes (child processes) that the server allows. You can adjust the maximum number of jobs to suit your reporting environment. The default setting is acceptable for most reporting scenarios. The ideal setting for your reporting environment depends on your hardware configuration, database software, and reporting requirements.
The default value is
5.
917 2012-12-12
Server Properties Appendix
Property Description Default Value
Adaptive Processing Server
Specifies the number of jobs the child will process before restarting.
The Adaptive Processing Server has a Promotion
Management Service and a Promotion Management
ClearCase Service. These services have no configurable properties in the CMC.
The default value is
100.
Table 28-47: BEx Web Applications Service properties
Property
Maximum Client Sessions
SAP BW Master System
JCo Server RFC Destination
Description Default Value
The maximum number of client sessions allowed on the service.
15
The name of the OLAP connection to the BW system that you created in SAP BusinessObjects
Business Intelligence platform.
SAP_BW
The name of the JCo Server
RFS Destination that you entered in the BW system.
Blank
JCo Server Gateway Host
JCo Server Gateway Service
The name of the JCo Server
Gateway Host that you defined in the BW system.
The name of the JCo Server
Gateway Service that you defined in the BW system.
Blank
Blank
JCo Server Connection Count
Specifies the number of automatically created programs that can be used to handle calls from
ABAP to Java for the service.
3
28.1.6 Data Federation Services properties
The Data Federation Services category includes the Adaptive Processing Server.
918 2012-12-12
Server Properties Appendix
Table 28-48: Data Federation Service properties
Property
Max Connections
Description
Specifies the maximum number of connections allowed on the server.
Execution Thread
Pool Size
Connection Inactivity Timeout (seconds)
Specifies the maximum number of queries that can be executed in parallel at a given moment.
Specifies the amount of time in seconds after which an inactive connection is closed.
Statement Inactivity
Timeout (seconds)
Specifies the amount of time in seconds after which an inactive query statement is closed.
Default Value
32767
10
10800
600
28.1.7 Web Intelligence Services properties
The Web Intelligence Services category includes the following servers:
• Adaptive Job Server
• Adaptive Processing Server
• Web Intelligence Processing Server
Adaptive Job Server properties
Table 28-49: Web Intelligence Scheduling Service properties
Property Description Default Value
Maximum Concurrent Jobs
Specifies the number of concurrent independent processes (child processes) that the server allows. You can adjust the maximum number of jobs to suit your reporting environment.
The default setting is acceptable for most reporting scenarios. The ideal setting for your reporting environment depends on your hardware configuration, database software, and reporting requirements.
5
Maximum Child Requests
Specifies the number of jobs the child will process before restarting.
100
919 2012-12-12
Server Properties Appendix
Adaptive Processing Server properties
Table 28-50: Command Line Parameters
Property Description
Expand to
Level
Default Value
Specifies the level to which data is retrieved from
BEx queries.
By default, hierarchies are not expanded to a given level. Level00 is always the default level. You can change this behavior by adding this parameter to the command line, but if the value is set too high,
Web Intelligence retrieves all of the hierarchy data, which can affect the performance and stability of the system.
-Dsap.sl.bics.expandToLevel=n n can be any integer between 0 and 99. If n=0, or if this parameter is not specified, hierarchies will not use the Expand to Level parameter.
Table 28-51: Web Intelligence APS Monitoring Service properties
Property Description Default Value
Enable Monitoring
Monitoring Thread Loop Delay
(seconds)
Specifies whether monitoring is enabled for the service.
TRUE
Specifies the amount of time, in seconds, between attempts that the service makes to ping clients.
300
Default Monitored Resource
Cleanup Timeout (in seconds)
Specifies the amount of time, in seconds, that the service waits for an inactive client before performing a cleanup of the client's session.
1200
Default Monitored Resource
Swap Timeout (in seconds)
Specifies the amount of time, in seconds, that the service waits for an inactive client before swapping the client's session onto the hard disk. It is recommended that you specify a value that is lower than the value for the Default Monitored Re-
source Cleanup Timeout (in
seconds) property.
600
920 2012-12-12
Server Properties Appendix
Table 28-52: Visualization Service properties
Property Description
Visualization Engine Cleanup Timeout (in seconds)
Specifies the amount of time, in seconds, that the service waits for an inactive client before performing a cleanup of the client's session.
Default Value
1200
Visualization Engine Swap Timeout
(in seconds)
Specifies the amount of time, in seconds, that the service waits for an inactive client before swapping the client's session onto the hard disk. It is recommended that you specify a value that is lower than the value for the Visualization Engine Cleanup Timeout (in
seconds) property.
600
Table 28-53: Rebean Service properties
Description Property
No configuration properties
Table 28-54: Document Recovery Service properties
Description Property
No configuration properties
Default value
Default value
Table 28-55: DSL Bridge Service properties
Description Property
DSLBridge Engine Cleanup
Timeout (in seconds)
Table 28-56: Excel Data Access Service properties
Description Property
No configuration properties
Default value
Default value
921 2012-12-12
Server Properties Appendix
Table 28-57: Custom Data Access Service properties
Description Property
No configuration properties
Default value
Web Intelligence Processing Server properties
The Web Intelligence Processing Server properties are grouped into the following services:
• Information Engine
• Web Intelligence Core
• Web Intelligence Processing
• Web Intelligence Common
Threshold settings are described in separate tables.
Table 28-58: Information Engine Service properties
Property
Maximum Custom Sort Size
(entries)
Universe Cache Maximum
Size (Universes)
Description
Enable List of Values Cache
List of Values Batch Size (entries)
Specifies whether caching is enabled for List of Values on the
Web Intelligence Processing
Server.
TRUE
Specifies the maximum number of entries (or values) for each
List of Values batch.
1000
Specifies the maximum number of entries in the custom sort.
Default Value
100
Specifies the number of universes to be cached on the Web Intelligence Processing Server.
20
Maximum List of Values Size
(entries)
Specifies the maximum number of entries (or values) for each
List of Values.
50000
922 2012-12-12
Server Properties Appendix
Table 28-59: Web Intelligence Core Service properties
Property
Timeout Before Recycling
(seconds)
Description Default Value
Specifies the time, in seconds, the server is idle before the
Server Intelligence Agent (SIA) stops and restarts the server when the total number of documents processed is above the value specified with the Maxi-
mum Documents Before Recy-
cling property.
1200
Idle Document Timeout (seconds)
Server Polling Interval (seconds)
Specifies the amount of time, in seconds, before the Web Intelligence Processing Server session will be swapped. Therefore, when the client is not generating requests during this period of time, the session will be swapped onto the hard disk, freeing up resources for an active session.
300
The valid range is 100 to 10000 seconds.
Specifies the interval, in seconds, that must pass before the server polls for new thread requests. When the server is in the polling phase, it performs cleanup actions like swapping unused documents to keep the server memory under the upper memory threshold.
120
Maximum Documents per User
Specifies the maximum number of active sessions (Web Intelligence documents) that can be associated with a user at any given time. Therefore, if the default value is 5, then the user can use up to 5 active sessions at once.
5
The valid range is 1 to 20.
923 2012-12-12
Server Properties Appendix
Property Description Default Value
Maximum Documents Before
Recycling
Specifies the number of Web
Intelligence documents that can be processed before the server will be considered for recycling.
If the number of processed documents has been reached, and the server is idle, then the server is closed and the Server
Intelligence Agent (SIA) starts a new instance of the server.
However, there will be a time delay before a new instance of the server is started. The time delay is defined by the Timeout
Before Recycling property.
50
Allow Document Map Maximum Size Errors
Idle Connection Timeout
(minutes)
Specifies whether the Maximum
Connections
property is restricted. If this property is enabled, then the value set for the
Maximum Connections
property is recognized by the server; otherwise the property is disregarded.
TRUE
Specifies the amount of time, in minutes, that the server waits for a request from an idle connection. Setting a value that is too low can cause a request to close prematurely. Setting a value that is too high can caused requests to be queued while the server waits for idle requests to be closed.
20
924 2012-12-12
Server Properties Appendix
Property
Maximum Connections
Description Default Value
Specifies the maximum number of simultaneous sessions that can be opened at one time. This is an approximate number; this setting does not count the inactive sessions that are swapped, or the session that is created to analyze the number of sessions.
If this limit is reached and no other server is available to handle the request, the user will receive an error message.
Note:
The Allow Document Map
Maximum Size Errors
property must be enabled for this property to be recognized by the server.
50
The valid range is 5 to 65535.
Enable Memory Analysis
Specifies whether memory analysis is enabled. If this property is enabled then the following properties will be active and recognized by the server:
•
Memory Maximum
Threshold
•
Memory Upper
Threshold
•
Memory Lower
Threshold
When the server's process memory is above the Memory
Upper Threshold
, the only operation that is allowed is saving documents. When the process memory is above the
Memory Maximum
Threshold
, all operations stop and fail.
TRUE
Memory Maximum Threshold
(MB)
Specifies the maximum threshold for memory consumption.
6000
925 2012-12-12
Server Properties Appendix
Property
Memory Upper Threshold
(MB)
Description
Specifies the upper threshold for memory consumption.
Default Value
4500
Memory Lower Threshold
(MB)
Enable APS Service Monitoring
Retry Count on APS Service ping failure
APS Service Monitoring
Thread Period
Specifies the lower threshold for memory consumption.
3500
Enables monitoring of the server by the APS service, hosted on the Adaptive processing server.
TRUE
Specifies the number of times the server will try to reach the
APS Service before deciding that it is unable to reach it.
Specifies the period of delay between attempts to reach the
APS Service.
3
300
Enable Current Activity Logs
Specifies whether complete traces are generated in the server's log files.
Note:
This property should be enabled only for debugging purposes when troubleshooting issues.
Set to FALSE during normal operations.
FALSE
Table 28-60: Web Intelligence Processing Service properties
Property Description Default Value
Enable use of HTTP
URL
Specifies whether the server is able to access files that are stored remotely.
Proxy value
TRUE
Specifies the address of your network's proxy server.
It is only necessary to specify a value if your network has a proxy server and you attempting to access files that are stored remotely.
Blank
926 2012-12-12
Server Properties Appendix
Table 28-61: Web Intelligence Common Service properties
Property
Cache Timeout (minutes)
Document Cache Clean-up
Interval (minutes)
Disable Cache Sharing
Enable Document Cache
Enable Real-Time Cache
Description
Specifies the time interval, in minutes, that the document cache is scanned and is checked against the Maximum
Document Cache Size
,
Maximum Document Cache
Reduction Space
, and
Maximum Document in
Cache
settings.
Default Value
Specifies the amount of time, in minutes, before the contents of the document cache will be cleared. The timeout depends on the most recent access date per document.
4370
120
Specifies whether cache sharing is disabled. By default cache sharing is enabled; which means that all Web Intelligence
Processing Server instances will share the same cache. However, if you prefer to have one cache per instance of Web Intelligence Processing Server then you should enable this property.
FALSE
Specifies whether the document cache is enabled. If the property is enabled, then the cache can be pre-loaded with scheduled
Web Intelligence documents.
TRUE
Specifies whether the real-time cache is enabled. If the property is enabled, then the cache can be loaded dynamically. Therefore, the Web Intelligence Processing Server caches Web Intelligence documents when they are viewed. The server also caches the documents when they run as a scheduled job, if the pre-cache was enabled in the document.
TRUE
927 2012-12-12
Server Properties Appendix
Property
Maximum Document Cache
Size (KB)
Maximum Document Cache
Reduction Space (percent)
Maximum Character Stream
Size (MB)
Description Default Value
Specifies the maximum size of the document cache. Once this limit is reached the document cache will be cleared based on the Maximum Document
Cache Reduction Space
property.
1000000
Specifies the percentage of cache that is emptied to allow newer actions and results to be stored in the cache. Documents with the oldest “last access time” are purged.
70
Specifies the maximum character stream size sent to the Web
Intelligence client.
Note:
If the Maximum Character
Stream Size property is exceeded, then the Web Intelligence document will not be created and the client will receive an error message.
5
The valid range is 1 to 65535.
Binary Stream Maximum Size
(MB)
Specifies the maximum size, in
MB, of a binary stream sent to the Web Intelligence client.
Note:
If the Binary Stream Maximum
Size value is exceeded, the
Web Intelligence document will not be created and an error message appears on the client computer.
50
The valid range is 1 to 65535.
928 2012-12-12
Server Properties Appendix
Property
Maximum Documents in
Cache
Images Directory
Output Cache Directory
Description Default Value
The maximum number of Web
Intelligence documents that can be stored in the cache. There is never more than this many documents in the cache; the total size of the cache is never greater than the value specified with the Maximum Document
Cache Reduction Space (MB)
setting.
Note:
To improve system performance, set this value to 0 when
Enable Real-Time Cache is selected, but you should enter a value when Enable Real-
Time Cache is cleared.
0
The valid range is 0 to 65535.
Specifies the location of the images directory.
Blank
Specifies the location of the cache.
Blank
Table 28-62: General properties
Property
Single Sign-On Expiry (seconds)
Description Default Value
Specifies the time, in seconds, that an SSO connection is valid before expiring.
86400
Related Topics
•
Web Intelligence Server Memory Threshold Settings
28.1.7.1 Web Intelligence Server Memory Threshold Settings
The following sections describe what happens on a Web Intelligence server when the Memory Maximum
Threshold, Memory Upper Threshold, or Memory Lower Thresholds are reached.
929 2012-12-12
Server Properties Appendix
Memory Maximum Threshold
If the Memory Maximum Threshold limit is reached, all current operations abort.
Memory Upper Threshold
If this Memory Upper Threshold is reached, the following server actions will take place in order to free resources and protect the server:
• The server will prevent new connections and any other memory-consuming threads from starting.
Only the option to Save Web Intelligence documents will be allowed. Users that request an action requiring memory allocation will receive a Server Busy message, and they will be notified that they should save any pending changes.
• The server will turn on system cleanup to free enough resources so that the amount of allocated memory is below the limit set by the Memory Upper Threshold property.
• The server tries to delete read-only documents.
• If not enough memory was freed during system cleanup then the server will begin to close documents that are in "View" mode. The server will begin to close documents based on the LIFO protocol; the most recent active document will be purged from memory first. The server will continue to close documents until a safe level is reached; this level is based on the following calculation: Memory
Upper Threshold
- (20%*(Memory Upper Threshold)). For example, if the Memory Upper
Threshold property is set to 4500MB then the safe level would be:
4500MB - .20*4500MB = 3600MB
• If not enough memory was released while closing documents in "View" mode, then the server will begin to close all remaining open documents including those that are in "Edit" mode. The server will begin to close documents based on the LIFO protocol; the most recent active document will be purged from memory first. The server will continue to close documents until a safe level is reached; this level is based on the following calculation: Memory Upper Threshold - (20%*(Memory
Upper Threshold
)). For example, if the Memory Upper Threshold property is set to 4500MB then the safe level would be:
4500MB - .20*4500MB = 3600MB
Memory Lower Threshold
If the Memory Lower Threshold is reached, the server will swap out inactive documents onto the hard disk, allocating additional memory for documents which are active.
28.1.8 Dashboards Services properties
930 2012-12-12
Server Properties Appendix
Dashboards Cache Server properties
Table 28-63: Dashboards Cache Service properties
Property
Maximum Cache Size (KB)
Idle Connection Timeout
(minutes)
Share Data Between Clients
Description Default Value
Specifies the amount of hard disk space (in KB) that is used to cache queries. A large cache size may be necessary if the server needs to handle large numbers of queries, or highly complex queries.
256000
Specifies the amount of time, in minutes, that the Dashboards
Cache Server waits for a request from an idle connection.
There is generally no need to modify the default value.
15
Specifies whether report data is shared between different clients.
TRUE
931 2012-12-12
Server Properties Appendix
Property
Oldest On-Demand Data Given to Clients (seconds)
Description Default Value
Specifies the amount of time, in seconds, that the server uses cached data to meet request from on-demand queries. If the server receive a request that can be met using data that was generated to meet a previous request, and the time elapsed since that data was generated is less than the value set here, then the server will reuse this data to meet the subsequent request. Reusing data in this way significantly improves system performance when multiple users need the same information. When setting this value, consider how important it is that your users receive up-to-date data. If it is very important that all users receive fresh data (important changes happen frequently) you may need to disallow this kind of data reuse by setting the value to 0.
Note:
This property can be set in a report object itself; values specified on the report object override the server settings.
0
Security Cache Timeout (minutes)
Java VM Arguments
Specifies the amount of time, in minutes, that the server uses cached logon credentials, query properties, and database connection information to serve requests before querying the CMS
20
Specifies the command-line arguments that can be supplied to the JVM.
Xmx858M
932 2012-12-12
Server Properties Appendix
Dashboards Processing Server Properties
Table 28-64: Dashboards Processing Service Properties
Property Description Default Value
Maximum Concurrent Jobs (0 for automatic)
Maximum Lifetime Jobs Per
Child
Specifies the maximum number of independent jobs allowed to run concurrently on the server.
If the value of this property is set to “0”, the server applies a suitable value, based on the CPU and memory of the machine that the server is running on.
0
Specifies the maximum number of jobs that each child process can manage per lifetime.
10000
Maximum number of
Prestarted Children
Idle Connection Timeout
(minutes)
Idle Job Timeout (minutes)
Java Child VM Arguments
Specifies the maximum number of prestarted child processes that are allowed by the server.
If this value is too low, the server creates child processes as soon as requests are made, and a user may experience latency.
If this value is too high, system resources may be unnecessarily wasted by idle child processes.
1
Specifies the amount of time, in minutes, that the server waits for a request from an idle connection. There is generally no need to modify the default value.
15
Specifies the length of time (in minutes) that the server waits between requests for a given job.
15
Specifies the command-line arguments that are supplied to child processes that are created by the server.
Xmx858M,Dswfinjection.lang.di
rectory=%CommonJavaLib
Dir%,Dbusinessobjects.connec
tivity.directory=%CONNECTION
SERVER_DIR%
933 2012-12-12
Server Properties Appendix
Property
Enable BEx query Cache
Description Default Value
Enabling this option turns on the metadata cache for BEx queries. This improves the performance of models that use
BEx queries as a data source.
This property is enabled by default.
Table 28-65: Single Sign-On Service properties
Property Description Default Value
Single Sign-On Expiry (seconds)
Specifies the time, in seconds, that an SSO connection is valid before expiring.
86400
934 2012-12-12
Server Metrics Appendix
Server Metrics Appendix
29.1 About the Server Metrics Appendix
In this appendix unless otherwise stated, the term server refers to an SAP BusinessObjects server, and not to the machine that SAP BusinessObjects Business Intelligence platform is installed or running on.
Server metrics are not available on servers that are not running.
Related Topics
•
29.1.1 Common Server Metrics
The following metrics describe the machine that the specified server is running on.
Table 29-1: Machine-specific metrics
Metric
Machine Name
Operating System
CPU Type
Description
The host name of the machine that the server is running on.
The operating system of the machine that the server is running on.
The type of Central Processing Units of the machine that the server is running on. This metric is not available on Adaptive Processing Servers or Web Application Container Servers (WACS).
935 2012-12-12
Server Metrics Appendix
Metric
CPUs
RAM (MB)
Local Time
Disk Size (GB)
Used Disk Space (GB)
Description
The number of CPUs that are available to the server.
On multi-core hardware, this metric may report the number of logical CPUs, and not the number of physical processors. This metric is not available on Adaptive Processing Servers or Web Application Container
Servers (WACS).
The amount of memory in megabytes that is available on the machine that the server is running on. This metric is not available on Adaptive Processing Servers or Web Application Container Servers (WACS).
The local time.
The size of the disk that SAP BusinessObjects Business Intelligence platform is installed on, in gigabytes.
This metric is not available on Adaptive Processing
Servers or Web Application Container Servers
(WACS).
The amount of used space on the disk, in gigabytes, that SAP BusinessObjects Business Intelligence platform is installed on. This includes disk space that is used by other programs on the machine, and not just space used by SAP BusinessObjects Business Intelligence platform. This metric is not available on Adaptive Processing Servers or Web Application Container
Servers (WACS).
The following metrics describe the specified SAP BusinessObjects server.
Table 29-2: Server-specific metrics
Metric
Name Server
Registered Name
Version
Start Time
Description
The name and port number of the CMS server that this server publishes its address to.
The internal name of the server. This is not the name that appears on the "Servers" screen of the CMC.
The version of the server.
The time that the server was most recently started.
936 2012-12-12
Server Metrics Appendix
Metric
PID
Host Name
Host IP Address
Request Port
Busy Server Threads
Description
The unique Process ID number for the server. The operating system of the machine that the server is running on generates the PID. The PID can be used to identify the specific server.
A comma-separated list of host names that are currently being used by the server.
A comma-separated list of IP Addresses that the server listens for requests on.
The port from which the server receives requests from other servers. If the server is listening to requests on more than one IP Address, the request port for the server will always be the same. If any other process uses this request port, the server will not start. Ensure that other processes do not use this port.
The number of server threads that are currently servicing a request. If this number is the same as the maximum thread pool size of the server, it indicates that the system can't process additional requests in parallel and that new requests may have to wait for busy threads to become available.
Table 29-3: Auditing Metrics
Metric
Current Number of Auditing Events in the Queue
Description
The number of auditing events that an Auditee has recorded, but which have not yet been retrieved by the CMS Auditor. If this number increases without bound, it could indicate that Auditing is not configured correctly or that the system is heavily loaded and generating audit events faster than the Auditor can retrieve them.
Note:
When stopping a server, first disable it and wait for this metric to reach “0”. Otherwise you may have auditing events that remain in the queue and do not reach the Auditing Data Store until the server is restarted and the CMS polls for them.
937 2012-12-12
Server Metrics Appendix
Table 29-4: Logging Service Metrics
Metric
Logging Directory
Description
Log files for the server are available in this location.
29.1.2 Central Management Server Metrics
The following table describes the server metrics that appear on the "Metrics" screen for Central
Management Servers (CMS).
Table 29-5: Central Management Server Metrics
Metric
Connection to Auditing Database is Established
CMS Auditor
Auditing Database Connection Name
Auditing Database User Name
Auditing Database Last Updated On
Description
Indicates whether the CMS has a healthy connection to the auditing database. A value of “1” indicates that there is a connection. A value of “0” indicates that there is no connection to the auditing database. If the
CMS is an auditor, this value should be “1”. If it is “0”, investigate why a connection to the Auditing database cannot be established.
Indicates if the Central Manager Server (CMS) as acting as an auditor. A value of “1” indicates that the
CMS is acting as an auditor. A value of “0” indicates that the CMS is not acting as an auditor.
The name of the auditing database connection. This is not necessarily the name of the auditing database itself. If this metric is empty, it indicates that a connection to the auditing database cannot be established.
The name of the user account used to connect to the auditing database.
The most recent date and time that the CMS successfully started to retrieve events from an auditee. If the
CMS is an auditor, this metric must show a time that is close to the time that the “Metrics” screen is loaded
If this value is more than two hours prior to the time that the screen is loaded, it may indicate that auditing is not working properly.
938 2012-12-12
Server Metrics Appendix
Metric Description
Auditing Thread Last Polling Cycle Duration (seconds)
The duration of the last polling cycle in seconds. This indicates the maximum delay for event data to reach the auditing database during the previous polling cycle.
• A value of less than 20 minutes indicates a healthy system.
• A value between 20 minutes and 2 hours indicates a busy system.
• A value of greater than 2 hours indicates a very busy system. If this state persists and you consider the delay too long, it is recommended that you either update your deployment to all the auditing database to receive data at a higher rate or decrease the number of auditing events that your system tracks.
Auditing Thread Utilization
The percentage of the polling cycle the auditor CMS spends collecting data from auditees. The remainder is time spent resting between polls.
If this value this reaches 100%, the auditor is still collecting data from the auditees when the next poll is due to begin. This may cause delays in the events reaching the auditing database. If the Thread Utilization frequently reaches 100%, and remains at this rate for several days, it is recommend you either update your deployment to allow the auditing database to receive data at a higher rate, or decrease the number of auditing events that your system tracks.
Clustered CMS Servers
A semicolon-separated list of the host names and port numbers of the running Central Management Servers in the cluster.
Number of Sessions Established by Concurrent
Users
Number of Sessions Established by Named Users
The total number of sessions for users with concurrent licensing.
The total number of sessions for users with named licensing.
Peak Number of User Sessions Since Startup
Number of Sessions Established by Servers
The peak number of concurrent user sessions that the
CMS has handled since it was started.
The number of concurrent sessions that SAP BusinessObjects Business Intelligence platform servers have created with the CMS. If this number is greater than
250, create an additional CMS.
939 2012-12-12
Server Metrics Appendix
Metric
Number of Sessions Established by All Users
Failed Jobs
Pending Jobs
Running Jobs
Completed Jobs
Waiting Jobs
Concurrent User Licenses
Named User Licenses
Build Date
System Database Connection Name
System Database Server Name
System Database User Name
Data Source Name
Build Number
Product Version
Resource Version
Description
The number of concurrent user sessions that are being handled by the CMS when the "Metrics" screen loads.
The larger this number is, the larger the number of users that are using the system is. If this number is greater than 250, create an additional CMS.
The number of failed jobs in the system.
The number of jobs that are scheduled, but not ready, to run because the scheduled time or event has not arrived.
The number of currently running jobs.
The number of completed jobs in the system.
The number of jobs in the system that are scheduled and waiting for free resources.
The number of Concurrent User licenses as indicated by the key code.
The number of Named User licenses as indicated by the key code
The build date of the CMS.
The name of the CMS system database connection.
This is not necessarily the name of the CMS system database itself.
The name of the server where the CMS system database is running. This is not necessarily the name of the CMS system database itself.
The name of the user account used to connect to the
CMS system database.
The name of the CMS system database connection.
The build number of the CMS. This number can be used to identify the version of SAP BusinessObjects
Business Intelligence platform that you have installed.
The product version of the CMS.
The resource version of the CMS.
940 2012-12-12
Server Metrics Appendix
Metric
Average Commit Response Time Since Startup
(msec)
Average Query Response Time Since Startup
(msec)
Longest Commit Response Time Since Startup
(msec)
Longest Query Response Time Since Startup
(msec)
Number of Commits Since Startup
Number of Queries Since Startup
Number of User Logons Since Startup
Established System Database Connections
Description
The average length of time in milliseconds that it took the CMS to perform commit operations since the server was started. A response time greater than 1000 milliseconds may indicate a need to tune the CMS or the CMS system database.
The average length of time in milliseconds that it took the CMS to perform query operations since the server was started. A response time greater than 1000 milliseconds may indicate a need to tune the CMS or the
CMS system database.
The longest length of time in milliseconds that the it took the CMS to perform commit operations since the server was started. A response time greater than
10000 milliseconds may indicate a need to tune the
CMS or the CMS system database.
The longest length of time in milliseconds that the it took the CMS to perform query operations since the server was started. A response time greater than
10000 milliseconds may indicate a need to tune the
CMS or the CMS system database.
The number of commits to the CMS system database since the server was started.
The total number of database queries since the server was started. A large number may indicate a more active or heavily loaded system.
The number of user logons since the server was started. A large number may indicate a more active or heavily loaded system.
The number of connections to the CMS system database that the CMS was able to establish. If a database connection is lost, the CMS attempts to restore the connection. If the number of established database connections is consistently lower than the number of system database connections specified by the System Database Connections Requested property ("Central Management Service" area of the
"Properties" screen), it may indicate the CMS can't acquire additional connections and that the system is not functioning optimally. A potential solution is to configure the database server to allow more database connections for the CMS.
941 2012-12-12
Server Metrics Appendix
Metric
Currently Used System Database Connections
Pending System Database Requests
Number of Objects in CMS System Cache
Number of Objects in CMS System DB
Existing Concurrent User Accounts
Existing Named User Accounts
Description
The number of connections to the CMS system database that the CMS is currently using. The number of connections that are being currently used may be smaller than or equal to the number of established system database connections. If the number of established connections and the number of used connections are identical for some time, this may indicate a bottleneck. Increasing the value for the System
Database Connections Requested property on the
"Properties" screen may improve the performance of the CMS. Tuning the CMS system database may also improve performance.
The number of requests for the CMS system database that are waiting for an available connection. If this number is high, consider increasing the value for the
System Database Connections Requested property.
Tuning the CMS system database may also improve performance.
The total number of objects that are currently in the
CMS system cache.
The total number of objects that are currently in the
CMS system database.
The total number of existing users with concurrent licensing in the cluster.
The total number of existing users with named licensing in the cluster.
29.1.3 Connection Server metrics
942 2012-12-12
Server Metrics Appendix
Table 29-6: Connectivity Service metrics
Metric
Data Sources
Description
Lists in a table the data sources activated via the
"Properties" page. Displays the following information for each network layer and database pair:
• "Status" ("Loaded" or "Failed!"): current status of the driver
• "Available Connections: number of pool connections that can be used"
• "Jobs (CORBA): number of jobs that are being processed (2-tier deployment)"
• "Jobs (HTTP): number of jobs that are being processed processing (web tier deployment)"
Note:
For more information about connection pools, refer to the Data Access Guide.
29.1.4 Event Server Metrics
The following table describes the server metrics that appear on the "Metrics" screen for Event Servers.
Table 29-7: Event Service Metrics
Metric
List of Monitored Files
Monitored Files
Description
A table that lists the files that are being monitored by the Event Server. The “Filename” column displays the name and path of the file. The “Last Notified Time” column displays the latest timestamp of when the server did a poll and found that the file exists.
The total number of files that are being monitored by the Event Server.
943 2012-12-12
Server Metrics Appendix
29.1.5 File Repository Server Metrics
The following table describes the server metrics that appear on the "Metrics" screen for Input and Output
File Repository Servers.
Table 29-8: Filestore Service Metrics
Metric
Active Files
Data Written (MB)
Data Sent (MB)
List of Active Files
Active Connections
Available Disk Space in Root Directory (GB)
Free Disk Space in Root Directory (GB)
Total Disk Space in Root Directory (GB)
Available Disk Space in Root Directory (%)
Description
The number of files in the File Repository Server that are currently being accessed.
The total number of megabytes written to files on the server.
The total number of megabytes read from files on the server.
A table that displays the files in the File Repository
Server that are currently being accessed.
The total number of active connections from clients and to other servers.
The total amount of available space on the disk containing the server's executable file, in gigabytes.
The total amount of free space on the disk containing the server's executable file, in gigabytes.
The total disk space on the disk containing the server's executable file, in gigabytes.
The amount of available disk space, in percentage, on the disk containing the server's executable file.
29.1.6 Adaptive Processing Server metrics
The following table describes the server metrics that appear on the "Metrics" screen for Adaptive
Processing Servers.
944 2012-12-12
Server Metrics Appendix
Table 29-9: Adaptive Processing Server metrics
Metric
Threads in Transport Layer
Transport Layer Thread Pool Size
Available Processors
Maximum Memory (MB)
Free Memory (MB)
Total Memory (MB)
CPU Usage Percentage (last 5 minutes)
CPU Usage Percentage (last 15 minutes)
Percentage of stopped system during GC (last 5 minutes)
Description
The total number of threads in all thread pools of the transport layer.
The total number of shared transport layer threads.
These threads can be used by any of the hosted services on the Adaptive Processing Server.
The number of processors that are available to the
Java Virtual Machine (JVM) on which the server is running.
The maximum amount of memory, in megabytes, that the Java virtual machine will attempt to use.
The amount of memory, in megabytes, that is available to the JVM for allocating new objects.
The total amount of memory, in megabytes, in the
Java virtual machine. This value may vary over time, depending on the host environment.
The percentage of total CPU time used by the server during the previous five minutes. For example, if a single thread fully utilizes one CPU of a four-CPU system, the utilization is 25%. All processors allocated to the JVM are considered. A value of greater than
80% may indicate a CPU bottleneck.
The percentage of total CPU time used by the server during the previous 15 minutes. For example, if a single thread fully utilizes one CPU of a four-CPU system, the utilization is 25%. All processors allocated to the
JVM are considered. A value of greater than 70% may indicate a bottleneck.
Percentages of stopped system while Garbage Collections (GC) were running during the last five minutes.
In this state all APS services are prevented from executing while the virtual machine performs a critical stage of garbage collection that requires exclusive access.
Generally, a low single-digit value should be the normal behavior, even under load. A double-digit value over time might indicate an issue of low throughput and needs to be investigated.
945 2012-12-12
Server Metrics Appendix
Metric Description
Percentage of stopped system during GC (last 15 minutes)
Percentages of stopped system while Garbage Collections (GC) were running during the last 15 minutes.
In this state all application code running on top of the
Java virtual machine is prevented from executing while the virtual machine performs a critical stage of garbage collection that requires exclusive access.
Generally, a low single-digit value should be the normal behavior, even under load. A double-digit value over time might indicate an issue of low throughput and needs to be investigated.
Number of page faults during GC (last 5 minutes)
The number of page faults that have occurred while
Garbage Collections were running during the previous five minutes. Any value greater than 0 indicates a system under heavy load and low memory conditions.
Number of page faults during GC (last 15 minutes)
The number of page faults that have occurred while
Garbage Collections were running during the last 15 minutes. Any value greater than 0 indicates a system under heavy load and low memory conditions.
Number of Full GCs
The number of full Garbage Collections since the server has started. A rapid increase in this value may indicate a system under low memory conditions.
JVM Lock Contention Count
JVM Debug Info
JVM Version Info
JVM Deadlocked Threads Counter
JVM Trace Flags
Services
The number of synchronized objects that have threads that are waiting for access. Any value consistently greater than 0 may indicate threads that will not run again. Initiate a Thread Dump to obtain more information about the cause of the problem.
Debugging information about the SAP Java Virtual
Machine, including the state, port, and attached client, if available.
Version information about the SAP Java Virtual Machine.
The number of threads that are deadlocked. Any value greater than 0 indicates threads that will not run again.
Initiate a Thread Dump to obtain more information about the cause of the problem.
The trace flags that are currently turned on for the
JVM. This indicates the level of tracing of the JVM.
A comma-separated list of the services that the server hosts.
946 2012-12-12
Server Metrics Appendix
Table 29-10: DSL Bridge Service metrics
Metric
DSLServiceMetrics.queryCount
Description
The number of data requests that are open between clients and the service
DSLServiceMetrics.activeConnectionCount
DSLServiceMetrics.activeSessionCount
The number of connections that are currently open between clients and the service.
The number of sessions that are currently open between clients and the service.
DSLServiceMetrics.activeOLAPConnectionCount
The number of connections that are current open between OLAP clients and the service.
Table 29-11: Client Auditing Proxy Service metrics
Metric
Number of Audit Events Received Since Server
Startup
Description
The number of client auditing events that the service has received since it was started. This metric can be used to verify that client auditing has been configured correctly. Values greater than 0 indicate that auditing events from clients are being successfully routed through this Client Auditing Service.
Table 29-12: Platform Search Service metrics
Metric
Number of Successful Extraction Attempts since the Service Start
Description
The number of successful attempts for extracting documents since the Platform Search Service was started.
Last Index Update Timestamp
Last Content Store Generation Timestamp
Number of failed extraction attempts since the service start
Service Available
Indexing Running
The date and time when the last index update happened.
The date and time when the last content store was generated.
The number of failed attempts for extracting documents since the Platform Search Service was started.
TRUE if the service is available. Otherwise FALSE.
TRUE if the indexing is running. Otherwise FALSE.
947 2012-12-12
Server Metrics Appendix
Metric
Number of Documents Indexed
Description
The displays the number of documents that were indexed since the service was started.
Table 29-13: Multi-Dimensional Analysis Service metrics
Metric
Session Count
Cube Count
Query Count
Description
The current number of connections from MDAS clients to the server.
The number of data sources that are being used to supply data to the connections that have not timed out.
The number of data requests that are open between
MDS clients and the server.
Table 29-14: Data Federation Service metrics
Metric
Number of Running Queries
Number of Connections
Total Bytes Transferred from Data Sources
Total Records Transferred from Data Sources
Total Bytes Produced by Query Execution
Total Records Produced by Query Execution
Number of Queries Consuming Memory
Total Bytes of Memory Used by Query Execution
Total Bytes of Disk Used by Query Execution
Description
The total number of running queries (consuming memory or not).
The total number of user connections to data federation query engine.
The amount of data read from the data sources (in bytes).
The total number of rows read from the data sources.
The amount of data produced as output of queries (in bytes).
The total number of rows produced as output of queries.
The total number of running queries consuming memory.
The amount of memory currently used by the running queries (in bytes).
The amount of disk currently used by the running queries (in bytes).
948 2012-12-12
Server Metrics Appendix
Metric
Number of Queries Using Disk
Number of Queries Waiting for Resources
Number of Active Threads
Total Bytes of Memory Used by Metadata Cache
Description
The total number of running queries using disk.
The total number of running queries currently waiting for execution.
The total number of active threads used for used for execution of requests.
The amount of memory used for caching metadata, statistics and connectors configuration (in bytes).
The total number of failed queries (exception raised).
Number of Failed Queries
Number of Queries in Query Analyze Step
Number of Queries in Query Optimization Step
Number of Queries in Query Execution Step
The total number of running queries currently in analyze step.
The total number of running queries currently in optimization step.
The total number of running queries currently in execution step.
The total number of connectors loaded in the service.
Number of Loaded Connectors
Number of Active Connections to Loaded Connectors
The total number of active connections to connectors loaded in the service.
Data Federation Service is available
TRUE if the service is available. Otherwise, FALSE.
Table 29-15: Connectivity Service metrics
Metric
Data Sources
Description
Lists in a table the data sources activated on the
"Properties" page. Displays the following information for each network layer and database pair:
• Status (“Loaded” or “Failed”): The current status of the driver
• Available connections: The number of pool connections that can be used
• Jobs (CORBA): The number of jobs that are being processed (in a 2-tier deployment)
• Jobs (HTTP: The number of jobs that are being processed (in a web-tier deployment)
For more information about connection pools, see the
Data Access Guide.
949 2012-12-12
Server Metrics Appendix
29.1.7 Web Application Container Server Metrics
The following table describes the server metrics that appear on the "Metrics" screen for Web Application
Container Servers.
Note:
Web Application Container Servers also have all of the metrics that are described under the Adaptive
Processing Server Metrics section.
Table 29-16: Web Application Container Server Metrics
Metric
List of Running WACS Connectors
WACS Connector(s) Failed at Startup
Description
A list of all running connectors on the server. If you do not see all of the connectors (HTTP, HTTPS and
HTTP through proxy), it indicates either that the connector is not enabled of that it failed during startup
Whether there are any failed connectors. If true, at least one connector failed to start. If false, all connectors are running. Do not run a server when one or more connectors has failed to start; you must troubleshoot the server to ensure that all connectors start properly.
Related Topics
•
Adaptive Processing Server metrics
29.1.8 Adaptive Job Server metrics
Table 29-17: Job Server metrics
Metric
Received Job Requests
Description
The number of jobs that were supposed to have run on the server.
950 2012-12-12
Server Metrics Appendix
Metric
Concurrent Jobs
Peak Jobs
Failed Job Creations
Temporary Directory
File System Destination Default Settings Valid
FTP Destination Default Settings Valid
Inbox Destination Default Settings Valid
Email Destination Default Settings Valid
Scheduling Services
Children
JSDPC?m_name=CrystalEnterprise.StreamWork
JSDPC?m_name=CrystalEnterprise.StreamWorkEx
Description
The number of jobs that are currently running on the server. If this number is high, the server is busy.
The maximum number of concurrent jobs that have run at the same time on the server. This number never goes down until the server is restarted.
The number of jobs that failed on the server.
The directory where temporary files are created. This can be specified on the "Properties" screen for the server.
You may encounter issues if this directory does not have adequate disk space.
TRUE if the server is able to send documents to the
File System Destination that is specified on the "Destination" screen for the server. Otherwise, FALSE .
TRUE if the server is able to send documents to the
FTP Server Destination that is specified on the "Destination" screen for the server. Otherwise, FALSE .
TRUE if the server is able to send objects to the Inbox
Destination that is specified on the "Destination" screen for the server. Otherwise, FALSE .
TRUE if the server is able to send objects to the Email
Destination that is specified on the "Destination" screen for the server. Otherwise, FALSE.
A table that displays the scheduling services that are running on the server.
A table that displays the child processes that are running on the server.
The following table describes the metrics for each Scheduling Service that is running on the server.
951 2012-12-12
Server Metrics Appendix
Table 29-18: Scheduling Service metrics
Metric
Scheduling Service
Received Job Requests
Concurrent Jobs
Peak Jobs
Maximum Concurrent Jobs Allowed
Failed Job Creations
Description
The name of the service.
The number of jobs that were supposed to have run on the service.
The number of concurrent jobs that are currently running on the service. If this number is high, the service is busy.
The maximum number of concurrent jobs that have run at the same time on the service.
The number of concurrent independent processes
(child processes) that the service allows.
This can be specified on the "Properties" screen for the server.
The number of jobs that failed on the service.
The following table describes the metrics for each child process that is running on the server.
Table 29-19: Child metrics
Metric
Scheduling Service
PID
Received Job Requests
Concurrent Jobs
Peak Jobs
Maximum Jobs Allowed
Description
The name of the child process.
The child process's identifier.
The number of jobs that were supposed to have run on the child process.
The number of concurrent jobs that are currently running on the child process. Normally this number must be 1.
The maximum number of concurrent jobs that have run at the same time on the child process.
The number of concurrent jobs that the child process allows.
952 2012-12-12
Server Metrics Appendix
Metric
Comm. Failures
Initializing
Shutting Down
Description
The number of communication failures with the parent Adaptive Job Server that have occurred.
If this number is large, the child process will restart.
1 if the child process is in the process of initializing. Otherwise, 0.
1 if the child process is in the process of shutting down. Otherwise, 0.
29.1.9 Crystal Report Server metrics
The following table describes the server metrics that appear on the "Metrics" page for Crystal Reports
Processing and Crystal Reports 2011 Processing Servers.
Table 29-20: Crystal Reports Processing Server metrics
Metric
Open Jobs
Number of Requests Served
Number of Open Jobs
ObjectType
Average Processing Time (msec)
Description
A table listing of the jobs that are currently being run on the server. The table includes the ID and Name of the document, the name of the user running the job, the date that the document was last accessed, and the amount of time that the job has been running.
The total number of requests that the server has served since it started.
The number of currently jobs that the server and its child processes are currently processing.
The type of InfoObject that the server primarily deals with. The value for this metric does not change.
The average time, in milliseconds, the server has spent processing the last 500 requests that the server has received. If this number is consistently high and growing, consider creating additional servers on other computers.
953 2012-12-12
Server Metrics Appendix
Metric
Maximum Processing Time (msec)
Minimum Processing Time (msec)
Number of Queued Requests
ObjectDllName
Number of Open Connections
Request Failure Rate (%)
Data Transferred (KB)
Number of Requests Failed
MaxChildProcesses
Description
The maximum time, in milliseconds, that the server has spent processing one of the last 500 requests. If this number is consistently high and growing, consider creating additional servers on other computers.
The minimum time, in milliseconds, that the server has spent processing one of the last 500 requests. If this number is consistently high and growing, consider creating additional servers on other computers.
The number of requests that are either waiting to be processed or are being processed. If this number is consistently high and growing, consider creating additional servers on other computers.
The name of the processing plug-in for the server. The value of this metric does not change.
The number of connections that are currently open between the server and clients.
The number of requests that the server failed to process as a percentage of the last 500 requests that the server has received.
The total amount of data, in kilobytes, that have been transferred to clients since the server was started.
The number of requests that the server was unable to complete since the server started.
The maximum number of concurrent child processes that are allowed on the server.
The following table describes the server metrics that appear on the "Metrics" page for Crystal Reports
Cache Servers.
Table 29-21: Crystal Reports Cache Server metrics
Metric
Cache Hit Rate (%)
Connected Processing Servers
Description
The percentage of requests, over the last 500 requests, that have been served with cached data.
A table listing of the Crystal Reports Processing servers in your deployment.. The table lists the name of the server and the number of connections that are currently open with the server.
954 2012-12-12
Server Metrics Appendix
Metric
Number of Requests Served
ObjectType
Average Processing Time (msec)
Maximum Processing Time (msec)
Minimum Processing Time (msec)
Number of Queued Requests
ObjectDllName
Cache Size (KB)
Number of Open Connections
Data Transferred (KB)
Description
The total number of requests that the server has served since it started.
The type of InfoObject that the server primarily deals with. The value for this metric does not change.
The average time, in milliseconds, the server has spent processing the last 500 requests that the server has received. If this number is consistently high and growing, consider creating additional servers on other computers.
The maximum time, in milliseconds, that the server has spent processing one of the last 500 requests. If this number is consistently high and growing, consider creating additional servers on other computers.
The minimum time, in milliseconds, that the server has spent processing one of the last 500 requests. If this number is consistently high and growing, consider creating additional servers on other computers.
The number of requests that are either waiting to be processed or are being processed. If this number is consistently high and growing, consider creating additional servers on other computers.
The name of the processing plug-in for the server. The value of this metric does not change.
The amount of data, in kilobytes, that is currently being cached by the server on the disk.
The number of connections that are currently open between the server and clients.
The total amount of data, in kilobytes, that have been transferred to clients since the server was started.
The following table describes the server metrics that appear on the "Metrics" page for Crystal Reports
2011 Report Application Servers.
Table 29-22: Crystal Reports 2011 Report Application Server metrics
Metric metric_currentdoccount
Description
The number of documents that are currently being processed by the server.
955 2012-12-12
Server Metrics Appendix
Metric metric_totaldoccount metric_currentagentthreadcount metric_totalagentthreadcount
Description
The number of documents that have been processed by the server since it started.
The number of threads that are currently being processed by the server.
The number of threads that have been processed by the server since it started.
29.1.10 Web Intelligence Server metrics
Table 29-23: Web Intelligence Processing Service Metrics
Metric
Cache size (Kb)
Number of out-of-date documents in cache
Cache high mark count
CPU usage (%)
Total CPU time (seconds)
Memory high threshold count
Memory max threshold count
Virtual memory size (Mb)
Description
The current amount, in kilobytes, of data that is stored in the cache.
The number of documents deleted from the cache because there were too old, since the server was started.
The number of times that the cache has reached the maximum size allowed on the server since it was started.
The percentage of total CPU time spent by the server since the server was started.
The total CPU time, in seconds, spent by the server since it was started.
The number of times that the high memory threshold has been reached on the server since it was started.
The number of times that the maximum memory threshold has been reached on the server since it was started.
The total amount of memory, in megabytes, that are assigned to the server.
956 2012-12-12
Server Metrics Appendix
957
Metric
Current number of client calls
Number of remote extension errors
Current number of tasks
Total number of client calls
Total number of tasks
Idle time (seconds)
Current number of active sessions
Number of documents
Number of documents opened from cache
Current number of sessions
Number of document swap
Number of swapped documents
Number of sessions timeout
Total number of sessions
Number of users
Number of active threads
Description
The current number of CORBA calls that the server is processing.
The number of times the server has failed to connect to a remote extension service hosted by an Adaptive Processing Server.
The current number of tasks that are being executed on the server.
The total number of CORBA calls that the server has received since it was started.
The total number of tasks that have been executed on the server since it was started.
The amount of time, in seconds, that have elapsed since the last request that the server has received from a client.
The current number of sessions that are able to accept requests from clients.
The number of documents that are currently open on the server.
The number of documents for which the last request result has been directly read from the cache.
The current number of sessions that have been created on the server.
The number of documents for which a cleanup thread has scheduled swap requests.
The number of documents that have been swapped by swap requests.
The number of sessions that have timed out since the server was started.
The number of sessions that have been created on the server since the server was started.
The total number of users that are connected to the server.
The number of threads serving requests received by the server (asynchronism threadpool).
2012-12-12
Server Metrics Appendix
Metric
Total number of threads
Description
The total number of threads that have been created since the server was started (asynchronism threadpool).
29.1.11 Dashboards Server metrics
Table 29-24: Dashboard Processing Server metrics
Metric
Open Jobs
Number of Requests Served
Number of Open Jobs
ObjectType
Average Processing Time (msec)
Maximum Processing Time (msec)
Minimum Processing Time (msec)
Description
A table listing of the jobs that are currently being run on the server. The table includes the ID and Name of the document, the name of the user running the job, the date that the document was last accessed, and the amount of time that the job has been running.
The total number of requests that the server has served since it started.
The number of currently jobs that the server and its child processes are currently processing.
The type of InfoObject that the server primarily deals with. The value for this metric does not change.
The average time, in milliseconds, the server has spent processing the last 500 requests that the server has received. If this number is consistently high and growing, consider creating additional servers on other machines.
The maximum time, in milliseconds, that the server has spent processing one of the last 500 requests. If this number is consistently high and growing, consider creating additional servers on other machines.
The minimum time, in milliseconds, that the server has spent processing one of the last 500 requests. If this number is consistently high and growing, consider creating additional servers on other machines.
958 2012-12-12
Server Metrics Appendix
Metric
Number of Queued Requests
ObjectDllName
Number of Open Connections
Request Failure Rate (%)
Data Transferred (KB)
Number of Requests Failed
MaxChildProcesses
Table 29-25: Dashboard Cache Server metrics
Metric
Cache Hit Rate (%)
Connected Processing Servers
Number of Requests Served
ObjectType
Average Processing Time (msec)
Description
The number of requests that are either waiting to be processed or are being processed. If this number is consistently high and growing, consider creating additional servers on other machines.
The name of the processing plug-in for the server. The value of this metric does not change.
The number of connections that are currently open between the server and clients.
The number of requests that the server failed to process as a percentage of the last 500 requests that the server has received.
The total amount of data, in kilobytes, that have been transferred to clients since the server was started.
The number of requests that the server was unable to complete since the server started.
The maximum number of concurrent child processes that are allowed on the server.
Description
The percentage of requests, over the last 500 requests, that have been served with cached data.
A table listing of the Dashboards Processing servers in your deployment.. The table lists the name of the server and the number of connections that are currently open with the server.
The total number of requests that the server has served since it started.
The type of InfoObject that the server primarily deals with. The value for this metric does not change.
The average time, in milliseconds, the server has spent processing the last 500 requests that the server has received. If this number is consistently high and growing, consider creating additional servers on other machines.
959 2012-12-12
Server Metrics Appendix
Metric
Maximum Processing Time (msec)
Minimum Processing Time (msec)
Number of Queued Requests
ObjectDllName
Cache Size (KB)
Number of Open Connections
Data Transferred (KB)
Description
The maximum time, in milliseconds, that the server has spent processing one of the last 500 requests. If this number is consistently high and growing, consider creating additional servers on other machines.
The minimum time, in milliseconds, that the server has spent processing one of the last 500 requests. If this number is consistently high and growing, consider creating additional servers on other machines.
The number of requests that are either waiting to be processed or are being processed. If this number is consistently high and growing, consider creating additional servers on other machines.
The name of the processing plug-in for the server. The value of this metric does not change.
The amount of data, in kilobytes, that is currently being cached by the server on the disk.
The number of connections to clients that are currently open.
The total amount of data, in kilobytes, that have been transferred to clients since the server was started.
960 2012-12-12
Server and Node Placeholder Appendix
Server and Node Placeholder Appendix
30.1 Server and node placeholders
With the exception of %SERVER_FRIENDLY_NAME% and %SERVER_NAME%, the following placeholders apply to all servers on the same node.
Placeholder
%AuditingDatabaseConnec tion%
Description
The Auditing Database connection used by the CMS.
Default values
This value is specified during installation.
%AuditingDatabaseDriver%
The type of database driver that is used to connect to the Auditing database.
Depends on the database used—for example:
• For SQL Server: sqlserverauditdb ss
• For MySQLL: mysqlauditdbss
%BINDIR%
%BINDIR32%
%CACHESERVER_EXE%
The folder where Information platform services 64-bit binaries are located.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/win64_x64
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/<PLATFORM64>/
The folder where Business Intelligence platform 32-bit binaries are located.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/win32_x86
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/<PLATFORM32>
The name of the executable for the Crystal Reports Cache Server.
• On Windows: crcache.exe
• On Unix: boe_crcached.bin
961 2012-12-12
Server and Node Placeholder Appendix
Placeholder
%CMS_EXE%
%CONNECTIONSERV
ER32_EXE%
Description
The name of the executable for the Central Management Server.
Default values
• On Windows: cms.exe
• On Unix: boe_cmsd
The name of the executable for the 32-bit Connection Server.
• On Windows: ConnectionServ er32.exe
• On Unix: ConnectionServer32
%CONNECTIONSERVER_DIR%
The root folder of the Connection
Server.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/dataAccess/connectionServer
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/dataAccess/con nectionServer
%CONNECTIONSERVER_EXE%
%CR2011_BINDIR%
The name of the executable for the 64-bit Connection Server.
• On Windows: ConnectionServ er.exe
• On Unix: ConnectionServer
The directory where Crystal Reports 2011 server binaries are located.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/win32_x86
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/<PLATFORM32>/
%CR2011_DefaultWorkingDir%
The default working directory for
Crystal Reports 2011 servers.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/win32_x86
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/<PLATFORM32>/
%CRYSTALRAS_EXE%
The Name of the executable for the Report Application Server.
• On Windows: crystalras.exe
• On Unix: boe_crystalrasd
962 2012-12-12
Server and Node Placeholder Appendix
Placeholder
%CR_ODBCINI%
%CommonJavaBundlesDir%
%CommonJavaLibDir%
%DLLEXT%
%DLLPATH%
%DLLPATH32%
Description
The name and path of the
.odbc.ini
file is located.
The folder where shared OSGI bundles are located.
Default values
• On Windows: This placeholder is blank.
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/odbc.ini
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/java/lib/bundles
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/java/lib/bun dles
The folder where the common Java libraries are located.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/java/lib
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/java/lib
The default extension of a .dll
or .so file.
•
• On Windows: .dll
On Unix: .so
The name of the environment variable on the computer on which
Business Intelligence platform is installed that specifies the directories where the interpreter will search for executable files.
On Solaris 32-bit systems, The name of the environment variable on the computer on which Business Intelligence platform is installed that specifies the directories where the interpreter will search for executable files.
• On Windows: Path
• On Unix: LD_LIBRARY_PATH
• On Solaris: LD_LI
BRARY_PATH_32
• Other operating systems: This placeholder is blank.
963 2012-12-12
Server and Node Placeholder Appendix
Placeholder
%DLLPATH64%
%DLLPREFIX%
%DLLPRELOAD%
%DLLPRELOAD32%
%DLLPRELOAD64%
%DP%
%DefaultAuditingDir%
%DefaultDataDir%
Description
On Solaris 64-bit systems, the name of the environment variable on the computer on which Business Intelligence platform is installed that specifies the directories there the interpreter will search for executable files.
Default values
• On Solaris: LD_LI
BRARY_PATH_64
• Other operating systems: This placeholder is blank.
The default prefix of a .dll or
.so
file.
• On Windows: This placeholder is blank.
• On Unix: lib
The name of the LD_PRELOAD environment variable for the platform.
• On Windows: This placeholder is blank.
• On AIX: LDR_PRELOAD64
• On other Unix: LD_PRELOAD
The name of the LD_PRELOAD environment variable on 32-bit AIX systems.
• On Windows and Linus: This placeholder is blank.
• On AIX: LDR_PRELOAD
• On Solaris: LD_PRELOAD_32
The name of the LD_PRELOAD environment variable on 64-bit AIX systems.
• On AIX: LDR_PRELOAD64
• On Solaris: LD_PRELOAD_64
• Other operating systems: This placeholder is blank.
The path delimiter.
• On Windows: Semicolon (;)
• On Unix: Colon (:)
The directory where Auditing temporary files are written. For optimum performance, this location should be on the server's local drive.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/Auditing
• On Unix: <IN
STALLDIR>/sap_bobj/da ta/Auditing/
The temporary directory used by the Job Server.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI 4.0/Data
• On Unix: <IN
STALLDIR>/sap_bobj/data/
964 2012-12-12
Server and Node Placeholder Appendix
Placeholder
%DefaultInputFRSDir%
%DefaultLoggingDir%
%DefaultOutputFRSDir%
%DefaultWorkingDir%
%DefaultWorkingDir32%
Description
The root folder of the Input File
Repository Server.
Default values
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/FileStore/Input
• On Unix: <IN
STALLDIR>/sap_bobj/da ta/frsinput
The location where the log files are stored.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI 4.0/logging
• On Unix: <IN
STALLDIR>/sap_bobj/log ging
The root folder of the Output File
Repository Server.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/FileStore/Output
• On Unix: <IN
STALLDIR>/sap_bobj/da ta/frsoutput
The working directory for 64-bit servers
The working directory for 32-bit servers.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/win64_x64
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/<PLATFORM64>
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/win32_x86
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/<PLATFORM32>
965 2012-12-12
Server and Node Placeholder Appendix
Placeholder
%EVENTSERVER_EXE%
%EXEEXT%
%EXEPATH%
%EnterpriseDir%
%EnterpriseDir32%
%ExternalJavaLibDir%
%FILESERVER_EXE%
Description
The name of the executable for the Event Server.
Default values
• On Windows: EventServ er.exe
• On Unix: boe_eventsd
The default extension of executable files.
The location where 32-bit Business Intelligence platform is installed.
• On Windows: .exe
• On Unix: This placeholder is unavailable.
The name of the environment variable on the computer on which
Business Intelligence platform is installed that specifies the directories there the interpreter will search for executable files.
• On Windows: Path
• On Unix: PATH
The location where 64-bit Business Intelligence platform is installed.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI 4.0/
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI 4.0/
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40
The folder where external, thirdparty Java libraries are located.
The name of the executable for the File Server
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/java/lib/external
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/java/lib/exter nal
• On Windows: fileserver.exe
• On Unix: boe_filesd
966 2012-12-12
Server and Node Placeholder Appendix
Placeholder
%HOARD_PATH%
%HOARD_PRELOAD%
Description
The location of the memory manager.
Default values
• On Solaris: <IN
STALLDIR>/sap_bobj/enter prise_xi40/solaris_spar cv9/libhoard3.so
• On other operating systems: This placeholder is blank.
Specifies whether to preload the memory manager.
• On Solaris: LD_PRELOAD_64
• On other operating systems: This placeholder is blank.
%INSTALLROOTDIR%
%IntroscopeAgentEnterpriseM anagerHost%
%IntroscopeAgentEnterpriseM anagerPort%
%IntroscopeAgentEnterpriseM anagerTransport%
The folder where 64-bit Business
Intelligence platform is installed.
This value is specified during installation.
%INSTALLROOTDIR32%
%IntroscopeAgentEnableInstru mentation%
The folder where 32-bit Business
Intelligence platform is installed.
Indicates whether instrumentation for Java servers using Introscope
Agent Enterprise Manager is enabled.
This value is specified during installation.
TRUE or FALSE, depending on whether Introscope Agent Enterprise
Manager was enabled when Business Intelligence platform was installed
The Introscope Agent Enterprise
Manager hostname to which instrumentation data is sent.
The Introscope Agent Enterprise
Manager port to which instrumentation data is sent.
The transport that is used when sending instrumentation data to the Introscope Agent Enterprise
Manager. Allowed values are:
• TCP
• HTTP
• HTTPS
• SSL
$IntroscopeAgentEnterpriseManager
Host
$IntroscopeAgentEnterpriseManager
Port
TCP
%IntroscopeAgentEnterpriseM anagerTransportHTTP%
The class that is used when sending instrumentation data to the Introscope Agent Enterprise
Manager through HTTP.
com.wily.isengard.postoffice
hub.link.net.HttpTunnelingSocketFac
tory
967 2012-12-12
Server and Node Placeholder Appendix
Placeholder
%IntroscopeAgentEnterpriseM anagerTransportHTTPS%
%IntroscopeAgentEnterpriseM anagerTransportSSL%
%IntroscopeAgentEnterpriseM anagerTransportTCP%
%IntroscopeDir%
Description
The class that is used when sending instrumentation data to the Introscope Agent Enterprise
Manager through HTTPS.
Default values
com.wily.isengard.postoffice
hub.link.net.HttpsTunnelingSocket
Factory
The class that is used when sending instrumentation data to the Introscope Agent Enterprise
Manager through SSL.
The class that is used when sending instrumentation data to the Introscope Agent Enterprise
Manager through TCP.
com.wily.isengard.postoffice
hub.link.net.SSLSocketFactory
com.wily.isengard.postoffice
hub.link.net.DefaultSocketFactory
The folder where Introscope Agent
Enterprise Manager is installed.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/java/wily
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/java/wily
%JAVAW_EXE%
%JAVA_EXE%
%JOBSERVERCHILD_EXE%
%JOBSERVER_EXE%
%JdkBinDir%
The name of the executable for the Java Virtual Machine that has no console window.
• On Windows: javaw.exe
• On Unix: java
The name of the executable for the Java Virtual Machine.
• On Windows: java.exe
• On Unix: java
The name of the executable for the Adaptive Job Server Child.
• On Windows: JobServer
Child.exe
• On Unix: boe_jobcd
The name of the executable for the Adaptive Job Server.
•
• On Windows: JobServer.exe
On Unix: boe_jobsd
The folder where the JDK binaries are located.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/win64_x64/sapjvm/bin
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/<PLAT
FORM64>/sapjvm/bin
968 2012-12-12
Server and Node Placeholder Appendix
Placeholder
%JreBinDir%
Description
The folder where the JRE binaries are located.
Default values
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/win64_x64/sapjvm/jre/bin/
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/<PLAT
FORM64>/sapjvm/jre/bin
%JVM_ARCH_ENVIRONMENT%
Indicates whether the machine is running on the 32-bit or 64-bit
JVM.
• On Windows: This placeholder is blank.
• On 32-bit Unix: -d32
• On 64-bit Unix: -d64
%JVM_HEADLESS_MODE%
The command-line argument that specifies whether the JVM works in headless mode.
• On Windows: -Djava.awt.head
less=false
• On Unix: -Djava.awt.head
less=true
%JVM_HEAP_DUMP_ON_OUT_OF_MEM
ORY_ERROR%
The command-line parameters that specify what the JVM does when it encounters Out of Memory errors.
%JVM_IGNORE_CON
SOLE_EVENTS%
The command-line parameter that reduces the Java Virtual Machine's use of operating-system signals.
"-XX:+HeapDumpOnOutOfMemory-
Error" "-XX:HeapDumpPath=%DefaultLoggingDir%" "-XX:+ExitV-
MOnOutOfMemoryError"
• Windows: -Xrs
• Linux: This placeholder is not available.
• Other operating systems: This placeholder is blank.
%JVM_SHARED_MEMORY_SEG
MENT%
%LANGUAGEPACKSDIR%
The command-line parameters that enable JVM extensions and set the JVM's instance number.
• On Windows: "-Xjvmx" "-XsapSystem:08"
• On Unix: This placeholder is blank.
The folder where the deployment's language packs are installed.
• On Windows: <IN
STALLDIR>
/SAP BusinessObjects Enterprise XI 4.0/Languages/
• On Unix: <IN
STALLDIR>
/sap_bobj/enter prise_xi40/Languages/
969 2012-12-12
Server and Node Placeholder Appendix
Placeholder
%LANGUAGEPACKSDIR32%
%LSTDir%
Description
The folder where the deployment's language packs are installed on
32-bit systems.
Default values
• On Windows: <IN
STALLDIR>
/SAP BusinessObjects Enterprise XI 4.0/Languages/
• On Unix: <IN
STALLDIR>
/sap_bobj/enter prise_xi40/Languages/
The folder where LST configuration files are stored.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/conf/lst
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/conf/lst
%MDAS_JVM_OS_STACK_SIZE%
Specifies the JVM stack-size for the Multidimensional Analysis
Service.
%NCSInstrumentLevelThresh old%
%PAGESERVER_EXE%
%PAGESERVER
WRAPPED_EXE%
The threshold level of trace logging for the NCS library.
The name of the executable for the Crystal Reports 2011 Processing Server.
• On AIX: -Xmso1M
• Other operating systems: This placeholder is blank.
By default, this value is 0.
• On Windows: crproc.exe
• On Unix: boe_crprocd.bin
• On Windows: crproc.exe
• On Unix: boe_crprocd
%PJSContainerDir%
The folder where APS Container
JARS are located.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/java/pjs/container
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/java/pjs/con tainer
970 2012-12-12
Server and Node Placeholder Appendix
Placeholder
%PJSServicesDir%
%Platform%
%Platform32%
%PS_JVM_OS_STACK_SIZE%
%RasBinDir%
Description
The folder where APS Service
JARS are located.
Default values
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/java/pjs/services
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/java/pjs/ser vices
The operating system of the machine that Business Intelligence platform is running on.
The 32-bit operating system of the machine running Business Intelligence platform.
JVM Stack size for APS
The operating system of the machine that Business Intelligence platform is running on.
The operating system of the machine that Business Intelligence platform is running on.
• On AIX: -Xmso1M
• On other operating systems, this placeholder is blank.
The root folder of the Report Application Server.
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/win32_x86
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/<PLAT
FORM32>/ras
%SERVER_FRIENDLY_NAME%
%SERVER_NAME%
%SMDAgentHost%
%SMDAgentPort%
The full name of the server.
The full name of the server.
The SMD Agent hostname to which instrumentation data is sent.
The SMD Agent port to which instrumentation data is sent.
The full name of the server.
The full name of the server.
This value is specified during installation.
This value is specified during installation.
971 2012-12-12
Server and Node Placeholder Appendix
Placeholder
%TRACE_CONFIGFILE_INI%
Description
The name and path of the
BO_trace.ini
file.
Default values
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/conf/BO_trace.ini
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/conf/BO_trace.ini
%WarfilesDir%
• On Windows: <IN
STALLDIR>/SAP
BusinessObjects
Enterprise XI
4.0/warfiles/webapps/
• On Unix: <IN
STALLDIR>/sap_bobj/enter prise_xi40/warfiles/we bapps/
%WEBI_LD_PRELOAD%
The name of the LD_PRELOAD environment variable for the platform.
• On Linux: $LD_PRELOAD$:libm da_api.so:libmda_common.so
• On other operating systems:
$LD_PRELOAD$
%WEBISERVER_EXE%
The name of the executable for the Web Intelligence Processing
Server.
%WEBI_LD_PRELOAD_ONCE%
The name of the
LD_PRELOAD_ONCE environment variable for the platform.
%XCCACHE_EXE%
%XCPROC_EXE%
•
•
On Windows: wireportserv er.exe
On Unix: WIReportServer
$LD_PRELOAD_ONCE$
The name of the executable for the Dashboards Cache Server.
•
• On Windows: xccache.exe
On Unix. boe_xccached
The name of the executable for the Dashboards Processing Server.
• On Windows: xcproc.exe
• On Unix: boe_xcprocd
Note:
The following placeholders can be edited at the node level. Descriptions and default values can be found in the above table. Placeholders that do not appear in this list are read-only.
•
%DefaultAuditingDir%
•
%DefaultDataDir%
•
%DefaultLoggingDir%
972 2012-12-12
Server and Node Placeholder Appendix
•
%IntroscopeAgentEnableInstrumentation%
•
%IntroscopeAgentEnterpriseManagerHost%
•
%IntroscopeAgentEnterpriseManagerPort%
•
%IntroscopeAgentEnterpriseManagerTransport%
•
%NCSInstrumentLevelThreshold%
•
%SMDAgentHost%
•
%SMDAgentPort%
•
%WarfilesDir%
Related Topics
•
To view and edit the placeholders for a node
973 2012-12-12
Server and Node Placeholder Appendix
974 2012-12-12
Auditing Data Store Schema Appendix
Auditing Data Store Schema Appendix
31.1 Overview
This appendix is a reference for any report designers that will be accessing and reporting off the Auditing
Data Store tables. The following diagram and table explanations show you the tables where the auditing data will be recorded and how those tables are related.
31.2 Schema diagram
975 2012-12-12
Auditing Data Store Schema Appendix
31.3 Auditing Data Store tables
ADS_EVENT table
This table records the basic properties for each event, central linking point for other tables in the schema.
976 2012-12-12
Auditing Data Store Schema Appendix
Column Name
Event_ID
Cluster_ID
Server_ID
Service_Type_ID
Client_Type_ID
Start_Time
Duration_ms
Added_to_ADS
User_ID
User_Name
Session_ID
Action_ID
Sequence_In_Action
Field Type
Character
(64)
Key
Primary Key
Character
(64)
Character
(64)
Character
(64)
Character
(64)
Datetime
Integer
Datetime
Character
(64)
NA
Description
A unique ID generated for the event.
Foreign key in
ADS_Auditee table
Foreign key in
ADS_Auditee table
The GUID of the auditee's cluster. This is recorded because multiple clusters may use the same ADS.
The CUID of the server that triggered the event.
Foreign key in
ADS_Auditee table
• The CUID of the service-type that triggered the event. Services on a server will record their service-type CUID.
• Client applications (BI launch pad or Web Intelligence for example) will record their application-type CUID.
Foreign key in
ADS_Application_Type table
Records the Client Type ID of the client that established the session.
NA
NA
NA
The date and time (UTC) when the event operation started (including milliseconds).
Duration of operation in milliseconds.
The date and time (UTC) when the event was recorded in the ADS.
The CUID of the user who performed the action.
Character
(255)
Character
(64)
Character
(64)
Integer
NA
NA
NA
NA
The name associated with the ID of the user who performed the action. Recorded in the Auditor
CMS's default language.
GUID of the session during which the event was triggered. If there is no associated session, the field will be null.
ID of the user action that triggered the event. Used to group events that result from a single user action.
For multi-server (or client and multi-server) events, the server or client application in the sequence that triggered the event. In all scheduling workflows the sequence ID will always be 0.
977 2012-12-12
Auditing Data Store Schema Appendix
Column Name
Event_Type_ID
Status_ID
Object_ID
Object_Name
Object_Type_ID
Object_Folder_Path
Folder_ID
Top_Folder_Name
Top_Folder_ID
Field Type
Integer
Integer
Character
(64)
Character
(255)
Character
(64)
Character
(255)
Character
(64)
Character
(255)
Character
(64)
Key
Foreign key in
ADS_Status_Str table
Description
Foreign key in
ADS_Event_type table
Type of event (View or Save, for example).
Status of the operation (for example, "0" = succeeded, "1" = failed).
NA
NA
CUID of the object that the operation was performed on.
The name of the object the operation was performed on. Recorded in the Auditor CMS's default language.
Foreign key in
ADS_Object_Type_Str
Table
CUID of object-type that the operation was performed on.
NA
NA
NA
NA
The full folder path (for example Country/Re gion/City
) for the object the operation was performed on. Recorded in the Auditor CMS's default language. If the folder path cannot be determined this, value will be set to null.
The CUID of the folder for the object the operation was performed.
Name of top level folder for the object. For example, if the object is located in Country/Re gion/City then Country will be recorded.
The CUID of the top-level folder where the object resides. For example, if object is located in
Country/Region/City then the CUID of the
Country folder will be recorded.
ADS_EVENT_DETAIL table
This table records event detail properties.
Column Name
Event_Detail_ID
Event_ID
Type Key
Integer
Character (64)
Primary Key
Foreign key in ADS_Event
Description
GUID for the event detail.
Parent event GUID.
978 2012-12-12
Auditing Data Store Schema Appendix
Column Name
Event_Detail_Type_ID
Bunch
Event_Detail_Value
Type
Integer
Integer
Character
(longtext)
Key
Foreign key in
ADS_Event_Detail_Str
Description
Type of event detail.
NA
If the detail is part of a series, this is used to tie them together.
For example, if a report had prompts for State and Country, a user may enter "USA" for the
Country prompt, and "California" and "Nevada" for the State prompt. This would produce event details with two bunches. Bunch 1 would consist of:
• Prompt Name: Country
• Prompt Value: USA
Bunch 2 would consist of:
• Prompt Name: State
• Prompt Value: California
• Prompt Value: Nevada
NA The value of the event detail.
ADS_AUDITEE table
This table records property information for all auditee servers that are part of the deployment.
Column Name
Cluster_ID
Server_ID
Service_Type_ID
Type
Character
(64)
Character
(64)
Character
(64)
Key Description
Primary Key
• Primary Key
• ADS_Server_Name_STR
The GUID for the cluster the auditee belongs to.
CUID of the server that triggered the event. If the event is client-triggered, will record the CUID of the adaptive processing server that processed the event.
• Primary Key
• ADS_Service_Type_Str
• ADS_Supported_Events
Service-type CUID of the service that triggered the event. Client-triggered events will record an application-type
CUID.
Server_Type_ID
Character
(64)
ADS_Serv er_Type_Str
The server-type CUID for the server that triggered the event.
979 2012-12-12
Auditing Data Store Schema Appendix
Column Name
Application_Type_ID
Version
Retrieved_Events_Complet ed_By
State
Potentially_Incomplete_Data
Type Key
Character
(64)
ADS_Applica tion_Type_Str
Character
(64)
Datetime
Integer
Integer
NA
NA
NA
NA
Description
The application-type CUID for the client that triggered the event. For server events, the ID of the service-type will be recorded.
The version of the server or client that triggered the event at the time it was recorded.
The last time the Auditor CMS polled this auditee for its temporary files. This indicates that all events from this auditee competed prior to this date/time are in the ADS.
The state (Running, Not Running,
Deleted) that the auditee was in.
Shows if this auditee may have events that were not transferred to the ADS.
ADS_SERVER_NAME_STR table
This table provides a multilingual dictionary of server names. Values will be updated when servers are renamed.
Column Name Type Key Description
Cluster_ID Character (64)
The GUID of the cluster that the server belongs to.
Server_ID
Language
Server_Name
Character (64)
Character (10)
Character (255)
Primary
Key
Primary
Key
Primary
Key
NA
The CUID of the server.
Code for the language of the server name; for example EN, or DE.
The name of the server.
ADS_SERVICE_TYPE_STR table
This table provides a multilingual dictionary of service-type names.
Column Name Type
Service_Type_ID Character (64)
Key
Primary
Key
Description
The service-type or service-category CUID for the service.
980 2012-12-12
Auditing Data Store Schema Appendix
Column Name
Language
Service_Type_Name
Type
Character (10)
Key
Primary
Key
Character
(255)
NA
Description
Code for the language the service-type name is recorded in, for example EN, or DE.
The name of the service-type.
ADS_APPLICATION_TYPE_STR table
This table provides a multilingual dictionary of client application-type names.
Column Name Key
Application_Type_ID
Language
Application_Type_Name
Type
Character
(64)
Character
(10)
Character
(255)
Primary Key
Primary Key
NA
Description
The application-type CUID for the application.
Code for the language in which the application type is recorded; for example EN, or
DE
.
The text name of the application type;
Crystal Reports or Web Intelligence for example.
ADS_SUPPORTED_EVENTS table
This table records a list of supported events and associated event details for each type of service or client application.
Column Name Key
Cluster_ID
Type
Character
(64)
Primary Key
Description
The cluster GUID that the service belongs to.
Service_Type_ID
Event_Type_ID
Event_Detail_Type_ID
Character
(64)
Integer
Integer
Primary Key
Service-type CUID of the service that triggered the event. If the event is triggered by a client application, then an application-type CUID is recorded.
Foreign key in
ADS_Event_Type
ID for the type of event recorded (ID of
Save, for example).
ADS_EVENT_DE
TAIL_TYPE_STR
CUID that identifies the type of event detail captured for that event (File Path, for example).
981 2012-12-12
Auditing Data Store Schema Appendix
ADS_CLUSTER table
This table records information on any clusters that contain Auditees.
Column Name Type Key Description
Cluster_ID
Character
(64)
• Primary Key
• ADS_Cluster_Str
The GUID of the Cluster.
Retrieved_Events_Completed_By
Last_Poll_Time
Potentially_Incomplete_Data
Datetime
Datetime
Integer
NA
NA
NA
Shows how current the auditing information in the database for that cluster is. Records the oldest retrieved auditing timestamp for all currently running auditee servers at any given moment. This indicates all events completed prior to this date are in the ADS.
The last time the auditor CMS polled the auditees in this cluster.
Indicates potentially incomplete audit information within the cluster: "0"
= all servers have transferred data normally; and "1" = at least one running or non-running server in the cluster has its Potentially Incom-
plete Data flag set, meaning that one auditee has events that haven't transferred to the ADS.
ADS_CLUSTER_STR table
This table provides a reference record of the different clusters in your deployment.
Column Name Description
Cluster_ID
Language
Cluster_Name
Type
Character
(64)
Character
(10)
Character
(255)
Key
Primary
Key
NA
NA
A unique ID of the cluster.
Code for the language setting for the cluster, for example, EN, or DE.
The name of the cluster.
ADS_EVENT_TYPE table
This table provides a reference record for the different categories of events.
982 2012-12-12
Auditing Data Store Schema Appendix
Column Name
Event_Type_ID
Event_Catagory_ID
Type
Integer
Integer
Key Description
Compound:
• Primary Key
• ADS_Event_Type_Str
The unique identifier for the type of event.
ADS_Event_Category_Str table
Category of event. For example, common, Web Intelligence, or Life-
Cycle Management.
ADS_EVENT_TYPE_STR Table
This table provides a multilingual dictionary of event type names.
Column Name
Event_Category_ID
Language
Event_Type_Name
Type
Integer
Character
(10)
Character
(255)
Key
Primary Key
Description
The event-type ID for the event.
Primary Key
NA
Code for the language that the event category name is recorded in; for example
EN
, or DE.
The text name of the event type; View or
Logon for example.
ADS_EVENT_CATEGORY_STR Table
This table provides a multilingual dictionary of event category names.
Column Name Type Description
Event_Type_ID Integer
Key
Primary
Key
The event-category ID.
Language
Character
(10)
Primary
Key
Code for the language that the event category name is recorded in; for example
EN
, or DE.
Event_Category_Name
Character
(255)
NA The name of the event category.
ADS_EVENT_DETAIL_TYPE_STR table
This table provides a multilingual dictionary of event detail type names.
983 2012-12-12
Auditing Data Store Schema Appendix
Column Name
Event_Detail_ID
Language
Event_Detail_Type_Name
Type
Integer
Character
(10)
Character
(255)
NA
Key
Primary
Key
Primary
Key
Description
The event detail-type ID for the event detail.
Code for the language that the event detail name is recorded in; for example EN, or DE.
The text name of the event detail type.
ADS_OBJECT_TYPE_STR Table
This table provides a multilingual dictionary of event object names.
Column Name Key Description
Object_Type_ID
Type
Character
(64)
Primary Key Object-type CUID of the object
Language
Character
(10)
Primary Key
Code for the language that the object type name is recorded in; for example
EN
, or DE.
Object_Type_Name
Character
(255)
NA Name of the object type.
ADS_STATUS_STR Table
This table provides a multilingual dictionary of event status names.
Column Name Type
Status_ID
Event_Type_ID
Language
Status_Name
Integer
Integer
Character
(10)
Character
(255)
Key
Primary
Key
Primary
Key
Primary
Key
NA
Description
The numerical representation of the operation's status.
ID of the event's event-type. For example, 1002 for View.
Code for the language that the event status is recorded in; for example EN, or DE.
A text description of the event's status; Succeeded or Failed, for example.
984 2012-12-12
Auditing Data Store Schema Appendix
ADS_EVENT_DELETES
Do not use or report off of this table. It is intended for internal system use, and may be removed in future releases.
985 2012-12-12
Auditing Data Store Schema Appendix
986 2012-12-12
System Copy Worksheet
System Copy Worksheet
32.1 System copy worksheet
Property
Cluster key.
Names of the nodes.
The machine name and the BI platform installation folder for each machine in the deployment.
The BI platform administrator password.
Value
CMS database connections, the user names and passwords associated with those connections for each machine in the deployment.
Auditing database connections, the user names and passwords associated with those connections for each machine in the deployment.
For each machine in the deployment, details of any other database client connections for each machine in the source system used by universes and reports.
For each machine in the deployment, database client types and versions.
The version, support package, and patch level.
987 2012-12-12
System Copy Worksheet
Property
The file store locations for every Input FRS and
Output FRS in the deployment.
Value
If you plan to copy Lifecycle management (LCM), the location of the LCM Override folder and LCM subversion files.
If you plan on copying the monitoring database, the monitoring database folder.
The semantic layer folder path.
988 2012-12-12
More Information
More Information
Information Resource Location
SAP BusinessObjects product information http://www.sap.com
SAP Help Portal
Navigate to http://help.sap.com/businessobjects and on the "SAP BusinessObjects Overview" side panel click All Products.
You can access the most up-to-date documentation covering all SAP
BusinessObjects products and their deployment at the SAP Help Portal.
You can download PDF versions or installable HTML libraries.
Certain guides are stored on the SAP Service Marketplace and are not available from the SAP Help Portal. These guides are listed on the Help
Portal accompanied by a link to the SAP Service Marketplace. Customers with a maintenance agreement have an authorized user ID to access this site. To obtain an ID, contact your customer support representative.
SAP Service Marketplace
Docupedia
Developer resources http://service.sap.com/bosap-support > Documentation
• Installation guides: https://service.sap.com/bosap-instguides
• Release notes: http://service.sap.com/releasenotes
The SAP Service Marketplace stores certain installation guides, upgrade and migration guides, deployment guides, release notes and Supported
Platforms documents. Customers with a maintenance agreement have an authorized user ID to access this site. Contact your customer support representative to obtain an ID. If you are redirected to the SAP Service
Marketplace from the SAP Help Portal, use the menu in the navigation pane on the left to locate the category containing the documentation you want to access.
https://cw.sdn.sap.com/cw/community/docupedia
Docupedia provides additional documentation resources, a collaborative authoring environment, and an interactive feedback channel.
https://boc.sdn.sap.com/ https://www.sdn.sap.com/irj/sdn/businessobjects-sdklibrary
989 2012-12-12
More Information
Information Resource Location
SAP BusinessObjects articles on the SAP Community Network https://www.sdn.sap.com/irj/boc/businessobjects-articles
These articles were formerly known as technical papers.
Notes https://service.sap.com/notes
These notes were formerly known as Knowledge Base articles.
Forums on the SAP Community
Network https://www.sdn.sap.com/irj/scn/forums
Training http://www.sap.com/services/education
From traditional classroom learning to targeted e-learning seminars, we can offer a training package to suit your learning needs and preferred learning style.
Online customer support
Consulting http://service.sap.com/bosap-support
The SAP Support Portal contains information about Customer Support programs and services. It also has links to a wide range of technical information and downloads. Customers with a maintenance agreement have an authorized user ID to access this site. To obtain an ID, contact your customer support representative.
http://www.sap.com/services/bysubject/businessobjectsconsulting
Consultants can accompany you from the initial analysis stage to the delivery of your deployment project. Expertise is available in topics such as relational and multidimensional databases, connectivity, database design tools, and customized embedding technology.
990 2012-12-12
Index
A
server groups 372, 373 servers 372, 373
access control lists
access levels 117, 125, 139 administration 139
tasks, rights required for 131
accounts
Information platform services 283
Adaptive Job Server 25, 46, 607, 888,
Adaptive Processing Server 25, 46,
adding 365 cluster members 365
administration
servers and server groups 372, 373
Administration options
destination properties 570 managing 570 managing settings 570
aliases
creating 112 for existing users 112 for new users 112
Platform Search 573 properties 573
auditing
auditing (continued) auditing data store
database connection settings 649
event detail ID 660, 669, 672, 673,
event details 660, 669, 672, 673,
674 event properties 660, 672, 673, 674 event types 660, 674
custom access level modified
event-type ID 660, 669, 672, 673,
events
list of 650 properties and details 650
lifecycle management console
991 2012-12-12
Index auditing (continued)
auditing database 467 auditing log files 467
Web Application Container Server
Authentication
authorizations
Content Administration Workbench
for Information platform services
automatically starting servers 359
B
backing up the BI platform 467
BackupCluster.bat 472 backupcluster.sh 472
BI launch pad (continued)
BI platform
communication between servers
deployment with reverse proxy
disaster recovery planning 145
primary authentication process 212
configure Kerberos and browsers
configuring hosts file for firewall
BI Widgets see Widgets for SAP
BusinessObjects Business
bulk adding
Business Process BI Service adding to a Web Application
removing from a Web Application
BW
integrating with the BI platform 749
BW Publisher
configuring as a service 751 configuring on UNIX 751 distributing components 751
BW Publisher service 751 configuring 751
creating RFC destination 752 starting 752
C
CCM
enabling and disabling servers
user credentials, changing for
starting, stopping, and restarting
Central Configuration Manager (CCM)
Central Management Console (CMC)
Central Management Server 25, 46,
Central Management Server. See
clients
Data Federation Administration
Data Federator. See Data
Federation Administration Tool
Information Designer. See
SAP BusinessObjects Analysis,
edition for Microsoft Office 71
992 2012-12-12
Index clients (continued)
SAP BusinessObjects Dashboards
Translation Management Tool 68
Widgets for SAP BusinessObjects
Business Intelligence platform
Central Management Console
SAP BusinessObjects Web
clients, desktop
Central Configuration Manager
Repository Diagnostic Tool 28, 70
Upgrade management tool 29, 70
cloning
Web Application Container Servers
Cluster Definition tool 766, 771
Cluster Definition transport 766, 771
CMC
delegated administration
enabling and disabling servers
CMC (continued) starting, stopping, and restarting
tab access
managing permission to
permissions, inheritance of 562
Windows server dependencies,
installing new cluster member
configuring 386, 387, 423, 424,
enabling and disabling other
SAP HANA database, selecting
SQL Anywhere database, selecting
starting 359 stopping 359 troubleshooting 359
troubleshooting multihomed
CMS system database 421, 422, 423,
deleting 425, 426 recreating 425, 426
SAP HANA database, selecting
CMS system database (continued)
SQL Anywhere database, selecting
command line options for promotion
command-line options 846, 854, 856,
Dashboard Analytics Server 857
Input and Output File Repository
between BI platform servers 172
between browser and Web
Comparing different versions 496
Comparing different versions of an
Cluster Definition tool 766, 771
configuring
reverse proxy servers 200, 201
993 2012-12-12
Index configuring (continued)
configuring auditing, see auditing 645
Content Administration Workbench 757 adding BI platform systems 757
applying authorizations 755 defining user access levels 755
overview of report publishing 753
publishing reports in background
synchronizing report information
762 updating data source of reports 762
copying
creating
cryptographic officers 159 adding members 159
Crystal reports
Crystal Reports
Crystal Reports 2010 Processing
Crystal Reports 2010 Report
Crystal Reports Cache Server 607
Crystal Reports Processing Server
607, 849 command-line options 849
Custom Data Access Service 902
customizing logon
Customizing Weight for Ranking
D
Dashboard Analytics Server 888
Dashboards Processing Server 607,
data
Data Access
Data Federation Administration Tool
data security
cluster keys 156 cryptographic keys 156 cryptography 156
default data processing mode 154
overview 153 two-key cryptography 153
selecting for the CMS 423, 424
default settings
Web Application Container Servers
destination sites
disabling
disaster recovery planning 145
discussion threads 566 cancelling search 566 searching 566
discussions
distributing
dynamic-link libraries, processing
E
enabling
994 2012-12-12
Index
see SAP BusinessObjects Explorer
exporting job
F
importing and promoting replicated
locally run instances 736, 738
managing conflicts 729, 730, 731
managing security 706, 707, 708,
one-way replication 711, 712 refresh from destination 711, 712 refresh from origin 711, 712
repointing destination sites 739,
third-party users and groups,
File Repository Servers 25, 46, 888
File Repository Servers (continued)
file system
FIPS-compliant mode
Federal Information Processing
Standard 154 security setting 154
turning off Windows 155 turning on Unix 155
configuration
for Oracle E-Business
configuring for JD Edwards
configuring for PeopleSoft
configuring for Siebel integration
forcing servers to register by name
server communications, and 172
Web Application Container Server
folder
folders object rights
groups (continued)
specifying group membership 99
viewing
Guest accounts
H
Home Page
host systems
hosts
hosts file, configuring for NAT firewall
HTTPS configuring Web Application
Container Servers (WACS)
G
green checkmark, for default system
I
Import Wizard
see Upgrade management tool 29,
Importing job
inboxes
infoobject
managing different versions 493
information design tool, rights 879
995 2012-12-12
Index
Information platform services
InfoSet Connectivity transport 766
of CMC tab access permissions
initializing CMS system database 425,
Input File Repository 25, 46, 607, 888
installation
installation directory, location 389
installing
instrumentation 833 logging 833
non-java servers 831 overview 831
integration
IPv6
ISA 2006
configuring for Oracle 10gR3 207 configuring for Sun Java 8.2 207 configuring for Tomcat 5.5 207
configuring for WebSphere CE 2.0
iViews
J
JAAS, configuration file 263, 264, 447
Java application server, Kerberos 261
Java Management Extensions (JMX)
JD Edwards EnterpriseOne integration
job
editing 515 modifying 515 searching 515
job history
job instances
K
single sign-on for Java 276, 451,
KPIs (key performance indicators) 601
L
LDAP
configuring 231 authentication plug-in 231
configuring single sign-on 239
groups
hosts
mapping against Windows AD 243
Secure Sockets Layer (SSL) 230
overview 87, 353 purchasing 87, 353 viewing 87, 353
license keys
and CMS database migration 427
Lightweight Directory Access Protocol.
limiting
Live Office configuration for reverse proxy
Web Application Container Servers
locating dependencies of an object 518
log in
log on
protection against malicious
logon
M
Discussion threads, deleting 568
managing dependencies 516, 517
mapped users, managing aliases 111
mapping roles 291, 314, 330, 335, 341
996 2012-12-12
Index
memory settings changing on a Web Application
metrics
Mobile
Monitoring Data Categories 625
Web Application Container Server
N navigation tree
Network Address Translation
configuring, server hosts file 183
network interface
networking environments
IPv4
node management scripts, location
movenode.sh 404 serverconfig.sh 404
nodes (continued) recreating (continued)
non-primary network interface 385
Normalizing the Search Results
number of logons, logon tokens 148 number of minutes, logon tokens 148
O object conflicts
objects
ODBC
CMS database
odbc.ini
Open SQL Connectivity transport 766
OpenDocument
Oracle
Oracle E-Business Suite mapping roles to Information
Oracle E-Business Suite integration
Oracle EBS
update aliases 343 update roles 343
origin sites
Output File Repository 25, 46, 607, 888
P
PeopleSoft Analytic Server 804
PeopleSoft Enterprise integration
PeopleSoft EPM Security Bridge
performance recommendations 803
Personal Security Environment
PlatformServices.properties 367
plug-ins
port numbers
Web Application Container Server
ports
principals
assigning advanced rights to 127 assigning rights to 127
rights, on top level folders 128
997 2012-12-12
Index
Processing Server
program objects
promoting a job when repositories are
promoting job
when the repositories are
promotion command line options 532
promotion management application
promotion management folder 501
PSE
publishing
multiple reports using roles 759 reports in a role or system 759
to multiple BI platform systems 757
publishing, assigning rights for 346
Q
queries
Query HTML panel, access rights 569
R refresh mode options, for federation
registered services
relationship queries
remote connections
creating 720 creating folders 720
Remote Method Invocation (RMI) 603
replicating
third-party users and groups 713
replication jobs
configuration options 723 creating 722, 723
replication lists
creating 716, 717 dependency options 716, 717
Report Application Server
report conversion tool
report objects
rights for creating/modifying 373
reports
Repository Diagnostic Tool 28, 70
requirements
restarting servers 357, 358, 359
RESTful web services administration
enabling error message stack 453
session pool 455 session pool size 455 session pool timeout 455
setting session token timeout value
restore
RestoreCluster.bat 479 restorecluster.sh 479
restoring
restoring SAP the BI platform
restoring the BI platform
restrictions 153 guest account 153
logon 152 password 152 user 152
reverse proxy servers
configuring with BI platform 200,
deployment with a Web Application
deployment with BI platform 199,
using with Web Application
RFC destination 752 for BW Publisher service 752
998 2012-12-12
Index rights (continued)
managing security 706, 707, 708,
rights
replicating 706, 707, 708, 710
server groups 372, 373 servers 372, 373
Web Intelligence documents 864
creating for administration 754
roles (continued)
mapping 291, 314, 316, 330, 332,
rollback
job in promotion management 525
Rolling back a job
after the password expires 526
Rolling back infoobjects
after the password expires 527
row-level security, processing
S
SAML
SAP
updating aliases 293 updating roles 293
SAP BusinessObjects Analysis, edition
SAP BusinessObjects Business
Intelligence platform
Web Application Container Server
SAP BusinessObjects Business
Intelligence platform servers configure Kerberos and browsers
SAP BusinessObjects Dashboards 72
SAP BusinessObjects Explorer 72, 573 application properties 573 managing settings 573
SAP BusinessObjects Web Intelligence
SAP HANA
SAP HANA database
SAP StreamWork
saving
scheduling
script parameters, nodes
SDK
search options 515 search parameters 515
Search-time integration with NWES
Searching from NetWeaver Enterprise
Secure Network Communication
(SNC), integrating with
Secure Network Communications
BI platform servers 295 client versus server 295
Secure Socket Layer (SSL)
999 2012-12-12
Index
Secure Sockets Layer (SSL) 150, 164,
Secure Sockets Layer, configuring for
environment protection 150 firewalls 150
Guest account restrictions 153
protection against malicious logon
web browser to web server 150 web servers 150
Security Definition Editor
selecting object dependents 517
server dependencies
server groups
subgroups 371 subgroups of servers 369, 371
Server Intelligence Agent (continued) nodes (continued)
recreating 395, 396, 397, 398,
user credentials, changing for
starting servers automatically 359
Windows server dependencies,
Server Intelligence Agent (SIA)
Adaptive Job Server Metrics
Email Destination Default Settings Valid
File System Destination Default Settings
FTP Destination Default Settings Valid
Inbox Destination Default Settings Valid
Maximum Concurrent Jobs Allowed 950
Adaptive Processing Server metrics
server metrics (continued)
Adaptive Processing Server metrics (continued)
Last Content Store Generation Timestamp
Last Index Update Timestamp 944
Number of Active Connections to Loaded
Number of Documents Indexed 944
Number of failed extraction attempts since the
Number of Loaded Connectors 944
Number of page faults during GC (last 15
Number of page faults during GC (last 5
Number of Queries Consuming Memory 944
Number of Queries in Query Analyze Step
Number of Queries in Query Execution Step
Number of Queries in Query Optimization
Number of Queries Using Disk 944
Number of Queries Waiting for Resources
Number of Successful Extraction Attempts
Percentage of stopped system during GC (last
Percentage of stopped system during GC (last
Data Federation Service is available 944
JVM Deadlocked Threads Counter 944
Threads in Transport Layer 944
Total Bytes of Disk Used by Query Execution
DSLServiceMetrics.activeConnectionCount
Total Bytes of Memory Used by Metadata
DSLServiceMetrics.activeOLAPConnectionCount
Total Bytes of Memory Used by Query
DSLServiceMetrics.activeSessionCount 944
DSLServiceMetrics.queryCount 944
Total Bytes Produced by Query Execution
Total Bytes Transferred from Data Sources
1000 2012-12-12
Index server metrics (continued)
Adaptive Processing Server metrics
Transport Layer Thread Pool Size 944
Central Management Service metrics
Auditing Database Connection Name 938
Auditing Database Last Updated On 938
Auditing Database User Name 938
Auditing Thread Last Polling Duration
server metrics
(continued)
(continued)
(continued)
Pending System Database Requests 938
System Database Connection Name 938
System Database Server Name 938
server metrics (continued)
File Repository Server metrics
Available Disk Space in Root Directory
Available Disk Space in Root Directory
Free Disk Space in Root Directory (GB)
Total Disk Space in Root Directory (GB)
Auditing Thread Utilization 938
Connection Server metrics
Average Commit Response Time Since
Average Query Response Time Since
Crystal Reports Server Metrics
Average Processing Time (msec) 953
Web Application Container Server metrics
List of Running WACS Connectors 950
WACS Connector(s) Failed at Startup 950
Web Intelligence Server Metrics
Connection to Auditing Database is
Currently Used System Database
Currently Open Connections 953
Currently Open Report Jobs 953
Maximum Processing Time (msec) 953
Minimum Processing Time (msec) 953
Number of Open Connections 953
Current number of active sessions 956
Current number of client calls 956
Current number of sessions 956
Memory high threshold count 956
Memory max threshold count 956
Established System Database
Existing Concurrent User Accounts 938
Existing Named User Accounts 938
Number of out-of-date documents in cache
Number of remote extension errors 956
Number of sessions timeout 956
Number of swapped documents 956
Longest Query Response Time Since
Number of Commits Since Startup 938
Number of Logons Since Startup 938
Number of Objects in CMS System Cache
Number of Objects in CMS System DB
Number of Queries Since Startup 938
Number of Sessions Established by All
Number of Sessions Established by
Number of Sessions Established by
Number of Sessions Established by
Average Processing Time (msec) 958
Maximum Processing Time (msec) 958
Minimum Processing Time (msec) 958
Number of Open Connections 958
Event Server metrics
Total number of client calls 956
Server metrics
server metrics About
Auditing Metrics
Current Number of Auditing
common metrics
1001 2012-12-12
Index server metrics About (continued) common metrics (continued)
server settings
ccm.sh
backing up server settings 471
nodes
Auto Reconnect to System
BEx Web Applications Service
Properties
JCo Server Connection Count
JCo Server Gateway Service
JCo Server RFC Destination
Bind to Hostname or IP Address
888 bscLogin.conf File Location 888
Certificate Store File Location 888
Certificate Trust List File Location
servers (continued)
Certificate Trust List Private Key
changing 356 state 356 status 356
Common Server Properties
Automatically start this server
Set Configuration Template 885
Use Configuration Template
configuring servers to use service
Connection Server Properties
Transient Object Inactivity
Transient Object Timer Interval
Core Services Properties
Auto Reconnect to System
Bind to Hostname or IP
Address 888 bscLogin.conf File Location 888
Certificate Store File Location
Certificate Trust List File
servers (continued)
Core Services Properties
(continued)
Certificate Trust List Private
Enable Client Authentication
Enable HTTP through Proxy
Idle Transient Object Timeout
Maximum Concurrent Requests
Maximum Connection Wait
Maximum HTTP Header Size
Maximum Number of Active
Connections Per User
Maximum Number of Idle
Connections Per User
Maximum Retries for File
Private Key Access Password
System Database Connections
Visualization Engine Cleanup
Visualization Engine Swap
1002 2012-12-12
Index servers (continued)
Crystal Reports Server Properties
Allow Report Jobs to Stay
Connected to the Database until the Report Job is
Database Records Read When
Previewing or Refreshing
Maximum Concurrent Report
Maximum Lifetime Jobs Per
Maximum Number of
Number of database records to read when previewing or
Oldest On-Demand Data Given
Share Report Data Between
Viewer Refresh Always Yields
Dashboards Server Properties
Allow Report Jobs to Stay
Connected to the Database until the Report Job is
Database Records Read When
Previewing or Refreshing
Idle Connection Timeout
Maximum Lifetime Jobs Per
servers (continued)
Dashboards Server Properties
(continued)
Maximum Number of
Oldest On-Demand Data Given
Security Cache Timeout
Share Data Between Clients
Data Federation Service Properties
Connection Inactivity Timeout
Statement Inactivity Timeout
DSLBridge Engine Cleanup
Enable Client Authentication 888
host identification options 381
Idle Transient Object Timeout 888
Maximum Concurrent Requests
Maximum Connection Wait Time
Maximum Number of Active
Connections Per User Session
Maximum Number of Idle
Connections Per User Session
servers (continued)
Maximum Retries for File Access
modifying group membership 372
Multi-Dimensional Analysis Service
Properties
Maximum number of cells
Maximum number of members
Private Key Access Password 888
standard command-line options
System Database Connections
Visualization Engine Cleanup
Visualization Engine Swap Timeout
Web Intelligence Server Settings
Memory Maximum Threshold
Web Intelligence Services properties
Allow Document Map Maximum
1003 2012-12-12
Index servers (continued)
Web Intelligence Services properties (continued)
Binary Stream Maximum Size
Default Monitored Resource
Cleanup Timeout (in
Default Monitored Resource
Swap Timeout (in seconds)
Document Cache Clean-up
Enable Current Activity Logs
Enable List of Values Cache
Enable PJS Service Monitoring
List of Values Batch Size
Maximum Character Stream
Maximum Custom Sort Size
Maximum Document Cache
Maximum Document Cache
Maximum Document in Cache
Maximum Documents Before
Maximum Documents per User
Maximum List of Values Size
Memory Maximum Threshold
Monitoring Thread Loop Delay
servers (continued)
Web Intelligence Services properties (continued)
PJS Service Monitoring Thread
Retry Count on PJS Service
Universe Cache Maximum Size
Visualization Engine Cleanup
Visualization Engine Swap
service account
setting
Setting
shared libraries, as processing
Siebel integration
Crystal Reports menu item,
recompiling the Siebel application
single sign-on 42, 214, 276, 282
setting up
single sign-on (continued)
single sign-on, configuring for JD
single sign-on, configuring for Oracle
single sign-on, configuring for
single sign-on, configuring for SAP
single sign-on, configuring for Siebel
SiteMinder
setting up single sign-on with LDAP
sites
managing rights 706, 707, 708, 710
SNC see Secure Network
Software Development Kit (SDK) 39
specific rights
specifying
SQL Anywhere
SQL Anywhere database
configuring servers 164, 167, 168
configuring Web Application
Container Servers (WACS)
sslconfig.exe 169 thick clients 169
translation management tool 170
1004 2012-12-12
Index
SSL. See Secure Sockets Layer (SSL)
statistics, auditing web activity 151
status, viewing and changing for
supported job
synchronizing report information 762
System Landscape Directory (SLD
System Landscape Directory (SLD) 44
Web Application Container Server
T tab access, CMC
managing permission to configure
permissions, inheritance of 562
third-party groups, replicating 713
third-party security plug-ins 213
third-party users, replicating 713
tickets 148 for distributed security 148 logon tokens 148
Tomcat
top-level
trace log
trace log level
translation management tool
Translation Management Tool 68
transports 766 checking for conflicts 766
Content Administration Workbench
parameter personalization 766, 775
Row-level security definition 770
Security Definition Editor 766
troubleshooting
Web Application Container Servers
troubleshooting network interfaces 386
trust, active trust relationship 147
type-specific rights (continued)
Web Intelligence documents 864
U
universe connections
universe design tool, rights 878
Universe Designer
Unix
updating recurring and pending
status
Upgrade management tool 29, 70
Upgrade Subversion content 496
user accounts
1005 2012-12-12
Index
user aliases 113 assigning 113
creating 112 for existing users 112 for new users 112
user attributes
user credentials, changing for nodes
user groups
users
assigning advanced rights to 127 assigning rights to 127
rights, on top-level folders 128
V variables
installation directory 24, 389 node management scripts 389
version management settings 494
viewing
Web Application Container Server
viewing current account 88, 354
see SAP BusinessObjects Analysis
W
WAR files and BI platform web applications
BI platform web applications 200
BOE war file
Web Application Container Server
Kerberos configuration files 446
removing web services from 438
system metrics 460 troubleshooting 460
using with other web servers 456
using with proxy servers 457, 458
Web Intelligence documents
Web Intelligence Processing Server
web servers
web services adding to a Web Application
configuration for reverse proxy
custom deployment 734, 735 file caching 734, 735
removing from a Web Application
WebLogic
WebSphere
widgets
Widgets for SAP BusinessObjects
Business Intelligence platform 69
Windows
server dependencies, adding 411
Windows AD
accounts and groups 257 scheduling updates 257
access control lists, assigning
principals to 127 advanced rights, assigning 127
running a scheduled program
running a scheduled SAP Crystal
running a scheduled Web
setting a schedule for a Crystal
1006 2012-12-12
Index workflows (continued) setting a schedule for a program
setting a schedule for a Web
setting top-level folder rights 128
workflows (continued) viewing a cached Crystal report
viewing a Crystal Reports 2011
viewing a non-cached Crystal
viewing a Web Intelligence
workflows (continued)
X
Xcelsius. See SAP BusinessObjects
1007 2012-12-12
Index
1008 2012-12-12
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
License Management
User & Group Management
Security Settings
Authentication
Server Administration
Database Management
Backup & Restore
Frequently asked questions
You can add a license key in the Central Management Console (CMC) under the License Keys section.
Create a user account in the Central Management Console (CMC) under the Users and Groups section.
You can configure SSL for servers by creating key and certificate files and configuring the SSL protocol in the Central Management Console (CMC).
