The following document is intended to summarize the various SSO options available to users, from authenticating to the BI platform all the way down to the database. The document does not cover the 'how to' as various white papers exist.
The first table summarizes the various ways the system can perform single sign-on to the web based appplications.
| Front End SSO | Web Access Point | AD Kerberos SSO | SAPSSO2 tickets | Trusted Authentication | SiteMinder (4.x agent) |
| OpenDocument | Yes | Yes | Yes | Yes | |
| BI Portal | Yes | Yes | Yes | Yes | |
| CMC | No | No | No | No | |
| DSWSBOBJE | Yes | No | Yes*,web only | No | |
| biprws | Yes | No | Yes | No |
-OpenDocument refers to the direct link to report functionality.
-BI Portal is the main portal used to access & view reports
-CMC = Central Management Console
-dswsbobje = web services.
Note that to support Kerberos SSO, your CMS (Central Management Server) must be installed on a windows machine.
Trusted Authentication can generally be used for any authentication method which is not natively supported by BI4, such as SAML, x509 etc.
Thick Clients, such as Crystal Reports Designer, Web Intelligence and others can also be configured for SSO to logon to BI4.
The following table summarizes this:
| Client | AD kerberos |
| Crystal Reports 2011 | Yes |
| Crystal Reports for Enterprise | Yes |
| Webi Rich Client | Yes |
| Information Design Tool | Yes |
| Universe Designer | Yes |
| Live Office | Yes |
| BI Widgets | Yes |
| QUAAWS | Yes |
| Dashboard Designer (Xcelsius) | Yes |
| Visual Intelligence | Yes |
Note that for the Java based clients, you will need to perform some additional steps to support AD SSO, such and configuring a krb5.ini file. This applies to clients such as Crystal Reports for Enterprise, Information Design Tool, and Visual Intelligence. Please refer to the Authentication chapter of the respective client tool for more information.
The clients can also be further configured further to perform single sign-on to the database, which is elaborated further in tables below.
Once a user has been authenticated to the BI platform, their SSO ticket can in some cases be passed further down to the database for a seamless end to end SSO story.
SSO to database based on Kerberos can be configured for the following databases, note that the user must logon to the BI platform using Active Directory for the kerberos ticket to be passed down to the database. Note however that this cannot be used for scheduling, as the kerberos ticket will not be available to the system when the user is not online. For scheduled tasks, the database credentials must be stored.
| Kerberos |
| HANA (not for Olap Analysis) |
| SQL Server (incl. Analysis Server) |
| Oracle |
| Teradata via ODBC through UNX (4.1 only) |
Yes, there are plans to expand this list in the future.
For SAP data access, the following methods can be configured. You will need to configure the correct method depending on the client tool being used. "SNC" is configured on the "SNC Settings" tab of the SAP authentication configuration area of the Central Management Console. "STS (Security Token Service)" is configured on the "Options" tab of the SAP authentication configuration area, in the "SAP SSO Service" section.
SAP Data SSO
| SNC | STS |
| Webi .unv connections | Webi .unx connections |
| Universe Design Tool | Webi BICS connections |
| Crystal Reports 2011 | Crystal Reports for Enterprise |
| Analysis for Office also supports client side SNC for direct access to BW. | Information Design Tool |
Explorer | |
| Analysis for Office | |
| Analysis Olap | |
| Dashboards |
In order to gain SSO access to SAP data, a user does NOT have to logon with their SAP credentials. For an example of how users can authenticate using Active Directory and then single sign-on to SAP systems, please refer to this how to: http://wiki.sdn.sap.com/wiki/display/BOBJ/How+to+map+SAP+users+and+AD+users+in+XI3.1+CMC . Although it refers to XIr3, this is still applicable to BI4.
The SAP authentication can also be leveraged from thick clients. A user logging onto Webi Rich Client can leverage STS for example to access BW data.
HANA SSO summary:
| Tool | User/Password | Kerberos | SAML (BI 4.1) |
Explorer | Y | Y (1) | Y |
Dashboards | Y | Y (1) | Y |
Web Intelligence | Y | Y (1) | Y |
Crystal Reports 2011 | Y | Y (1) | Y |
Crystal Reports for Enterprise | Y | Y (1) | Y |
Analysis, Edition for Office | Y | Y (1) | Y |
Analysis, Edition for OLAP | Y | N | Y |
(1) * BI must be running on windows or linux.
SAML to HANA is based on a trust directly between BI4 and HANA. This does not mean that you can use SAML to signon to BI4 and that same SAML assertion ticket gets passed down to HANA. BI4 must be configured as a trusted identity provider in HANA. The same users must exist in HANA and BI4.
What other SSO options do I have?
The BI platform also supports storing database credentials to be used for accessing the database. In some cases, as with kerberos & offline scheduling, this cannot be avoided. Also, for database sources which are not currently listed, stored credentials are the best options available at this time.