Unable to automatically connect to an SAP BW data source when using SSO

You are unable to connect to an SAP BW data source when using SSO even though the data source is configured to use an external SAP namespace for authentication.

This problem occurs if all of the following conditions are met:

  • An SAP namespace is configured in IBM® Cognos® pointing to SAP BW System A.
  • IBM Cognos users are logged on to the SAP namespace using credentials (a user name and password), and not through the SAP Portal using single sign-on.
  • A data source referring to SAP BW system B is defined and is configured to use an external namespace for data source authentication. The namespace referred to as external is the SAP namespace configured for authenticating users to IBM Cognos components.
  • SSO tickets are enabled for the SAP BW server associated with the SAP namespace.

The SAP provider generates and caches SAP logon tickets to be used for authentication with an SAP data source. The provider uses the current user credentials, user name and password, to generate an SAP logon ticket.

If the SAP BW system associated with the data source does not accept logon tickets because of the SAP server configuration, or if the logon ticket presented is not valid because it originates from a system in a different SAP SSO domain, data source authentication will fail.

To solve this problem, you can federate the SAP systems into one SAP SSO domain so that the ticket generated for the user in one system is valid in the other system as well. If this solution is not possible, disable the use of SAP BW SSO tickets for the provider to trigger it to fall back to passing the credentials of the current user instead of a logon ticket. The credentials must be valid for all systems accessed as a data source.

You can disable SAP SSO tickets either on the SAP BW system used as a data source, or by specifying the bapiSSOSupport parameter in the bapiint_config.xml file installed with IBM Cognos components. As a result, the provider will use the entered credentials of the current user for data source authentication.

To disable the use of SSO tickets for data source authentication in the bapiint_config.xml file, perform the following steps for all IBM Cognos application tier components installed in your system.

Procedure

  1. Stop the IBM Cognos service.
  2. Open the bapiint_config.xml file.

    This file is located in the install_location/configuration directory.

  3. Search for the bapiSSOSupport parameter, and change its value to 0, as shown in the following example:

    <bapiSSOSupport value="0"

    If this parameter is not specified in the file, you must add it under the root element.

  4. Save the bapiint_config.xml file.
  5. Start the IBM Cognos service.