Week 3 Unit 1: Authentication and Single Sign On (SSO)

(1)

Week 3 Unit 1: Authentication and

(2)

Authentication and Authorization

Roles

Groups

vs.

Is this a valid user?

Does the user have rights to the

application or content?

Authentication

_{Authorization}

STS/SNC

(3)

Web Tier Authentication

• The following major logon methods are supported, with various methods of

SSO:

• Windows AD

SSO achieved via Kerberos, using the Quest Vintela plug-in

Web application server can run on any platform; however, the Central Management

Server MUST be on a Windows or Linux (as of 4.0 SP05) system

• LDAP

SSO is supported with integration through CA SiteMinder

• SAP

SSO achieved through consumption of SAP SSO tickets

• Enterprise

(4)

Details on Active Directory SSO with Kerberos

• Active Directory SSO with

Kerberos allows for end-to-end

Single Sign-On to the database

• Scheduling a report will not carry forward

the Kerberos ticket even with “Schedule

Now”

• It is not possible to set up AD SSO with

Kerberos for scheduling

• Interactive refresh enables SSO

• A detailed walkthrough can be found on

Service Marketplace:

http://service.sap.com/sap/support/notes

/1631734

(5)

Details on LDAP SSO

• LDAP Single Sign-On is enabled

using SiteMinder

• SiteMinder is an access management

application delivered by CA Technologies

• Integrates with virtually any LDAP

server, as well as Active Directory

• LDAP SSO is for “front door” entry

only and cannot be used to achieve

SSO to the database

• SSO to the database can be achieved

using secondary credentials or by mixing

with SAP SSO methods for data access

(6)

Web Services SSO

• Setting up Web services SSO for

Windows Active Directory is

required to enable SSO for the

following clients:

LiveOffice

Query as a Web Service

BI Widgets

Crystal Reports for Enterprise

Dashboard Designer

• Setup is similar to configuring the

BI launch pad, see SAP Note

1646920

(7)

Trusted Authentication

• BI trusts the underlying application

server to perform the

authentication

• The Application Server passes a shared

secret and user ID to BI to facilitate SSO

• No user password is passed to BI

• Enables most other authentication

methods such as X.509, SAML,

SecureID, etc.

• None of the desktop client tools

(8)

Configuring Trusted Authentication

• There are a number of ways to pass user information in trusted

authentication

Web Session

HTTP Header

User Principal (new method using JAAS authentication)

Remote User (new method using JAAS authentication)

Cookies and Query String not recommended, supported for legacy purposes

• It is possible to bind a different incoming user ID to an existing user in the

BI system using trusted.auth.user.namespace.enabled

• Requires the user to manually log on the first time and binds the assertion user ID with

the BI account the user logs on with

• Remember, you are trusting the application server, so you must secure the

(9)

Dimensional Semantic Layer (DSL) Connectivity

• Kerberos SSO

MS SQL Server

Oracle DB

SAP HANA

• Security Token Service (STS)

SAP NetWeaver BW

• Applicable to the following clients:

Crystal Reports for Enterprise

Web Intelligence

Dashboards

Explorer

(10)

Legacy Semantic Layer (.unv)

• Kerberos SSO

MS SQL Server

Oracle DB

• Server SNC

SAP NetWeaver BW

• Stored user credentials

All other databases

• Applicable to the

following clients:

Crystal Reports 2011

Web Intelligence

(11)

Propagating User Attributes

• Leverage metadata from

user directories like

region, department, or

time zone, and apply via

universe security

• Personalize report data

with flexible user

attributes

• Full overview on SCN

http://scn.sap.com/comm

unity/bi-platform/blog/2012/07/05/

user-attribute-mapping-in-bi4

(12)

Mobile SSO

• Mobile currently uses

username and password

only

• The username and

password can be saved

locally on the device

• This option can be disabled

by administrators if desired

• Mobile SSO remains in

the roadmap for a future

release

(13)

SAP HANA: Kerberos SSO

• BI on Windows

• Configure AD SSO with Kerberos or

manually log on using AD credentials

• No scheduling SSO

• BI on Linux

• Configure LDAP connectivity to Active

• Enable Kerberos from the LDAP

authentication plug-in

• Manually log on, then SSO to HANA

becomes possible

(14)

SAP HANA: Secondary Credentials

• Save database credentials to use

for SSO using the SAP HANA

native authentication

• Minimal configuration for BI

• Credentials can automatically be

captured when the user manually

logs on to BI launch pad

• Cannot use with SSO to BI Launch

(15)

SAP HANA: HANA Authentication

• Accessible under CMC >

Applications

• Establishes BI as a

trusted authentication

source for HANA

• Less work to configure than

Kerberos

• Supported with all BI clients

except Design Studio and

Analysis Office

• Works with any type of

authentication to BI

• Enterprise, AD, LDAP, SAP,

etc.

(16)

(17)

© 2013 SAP AG. All rights reserved.

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice.

Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors.

National product specifications may vary.

These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.

SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries.

Please seehttp://www.sap.com/corporate-en/legal/copyright/index.epx#trademarkfor additional trademark information and notices.

© 2013 SAP AG. All rights reserved.

(18)

Week 3 Unit 2: Best Practices for

(19)

Agenda

BI4.0 Platform Monitoring

Managing and Configuring Logs

Troubleshooting Tools

What To Do When

Exercises

(20)

SAP BusinessObjects BI 4.0 Platform Monitoring

Overview

• Monitoring is a new BI 4.0 application embedded into the Central Management

Console

• Provides a dashboard showing an overview of SAP Business Objects

deployment

• Records the metrics surfaced by the different BI 4.0 servers

• Captures historic trends and provide a graphical visualization component

• Provides Threshold notifications

• Delivers default watches for all the servers

(21)

Examples of Typical Monitoring Uses

1. Understand overall system health and

server deployment metrics:

Dashboard with health status of each server in

the deployment

Understand the key deployment level metrics

and how they are performing

2. Monitor the system health and

understand root cause of problems

Can provide an alert in case of problems

Perform root cause analysis using the

corresponding Watch (which triggered the alert)

3. Monitor system performance

With the help of probes, configure the system

to provide alerts in the case of performance

issues

(22)

Main Concepts of the BI4.0 Platform

Monitoring

Metric – a system of related measures that facilitates the quantification

of some particular characteristic

Probe – a utility to check the availability of SAP Business Objects BI4.0

services by simulating workflows

Watch – an abstraction of a part of the BI Landscape, providing

real-time statuses and historical trends of servers and workflows within the

SAP Business Objects Enterprise environment

Alert – a notification generated by the monitoring application, when a

user-defined threshold value set for different metrics applied to a watch

is breached

(23)

BI4.0 CMC Integration – Monitoring Dashboard

Provides an overview of the entire BIPlatform landscape

The KPIs show the deployment level metrics Alert no. in brackets shows unread, unconfirmed alerts only. On click, user navigates to Alert Inbox (filtered by alerts for that watch) to view all alerts for that watch. The graph shows

the state of watch selected

(24)

BI4.0 CMC Integration – Server Health

• The server status is determined by its associated watch.

• Watches provide real-time statuses of servers and workflows

within the SAP Business Objects environment.

• The traffic light is associated with each watch to indicate the

watch state.

• Click the server health icon to show watch details.

Click to go see

watch details

(25)

Third-Party Integration

• Integration with IBM Tivoli via Tivoli Enterprise monitoring agent

• Integration with SAP Solution Manager (incl. CA Wily Introscope)

• Open JMX framework allows simple integration with other ESM vendor tools

(26)

Agenda

BI4.0 Platform Monitoring

Managing and Configuring Logs

Troubleshooting Tools

What To Do When

(27)

Managing and Configuring Logs

What It Is?

System-level messages generated by BI platform servers are traced and written to

log files. Traces are recordings of events that occur during the operation of a

monitored component. The traced events range from severe exception errors on one

end to simple status messages at the other.

Typical Uses

These log files are used by system administrators to monitor performance or for

debugging purposes.

(28)

Managing and Configuring Logs – Overview

Logging Components

• SAP BI40 Processing servers logging

• SAP BI40 Web application logging

• SAP BI40 Client tools

Trace Log

• Generic log file (.glf) extension

• System-level messages generated by BI platform

Trace Log Levels

• Unspecified (tracing specified trough .ini)

• None (logging rare critical events)

• Low

• Medium

(29)

Managing and Configuring Logs – Overview

Configuring tracing for processing servers

• "TraceLog Service" for a specific server or a group in CMC

• Manually with the BO_trace.ini file

• C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\conf

Configuring tracing for web applications

• "Trace Log" application settings in CMC

• The location for logs is in the user home folder

• Manually with the BO_trace.ini file

• C:\Program Files (x86)\SAP BusinessObjects\Tomcat6\webapps\BOE\WEB-INF\TraceLog

Configuring tracing for BI40 client tools

• Manually with the BO_trace.ini file

• Create environment variables (

BO_TRACE_LOGDIR, BO_TRACE_CONFIGFILE

)

Configuring tracing for the Upgrade Management Tool

(30)

Agenda

BI4.0 Platform Monitoring

Managing and Configuring Logs

Troubleshooting Tools

(31)

HTTP Tracing

Useful for determining

What content (css, js, etc.) is being sent to the client (browser)

How much data is coming from the database (CMS)

If the content is being cached or not

If the content has been compressed or not

Where the slowness in loading pages may reside

How a specific page is constructed

(32)

Fiddler: www.fiddler2.com/fiddler2

Fiddler shows you the size of the request.

If the page is cached or has an expires tag:

Allows you to find the parent and child requests so you can calculate how long it took to load

a page:

(33)

Fiddler

Adding the size of each request body gives you the total amount of data being sent to the

client (browser), and taking the time from the first request until the last request will tell you

how long it took to load the page.

(34)

Network Tracing

Useful for determining

Network latency

Why and who may be closing a network connection

Errors received in the TCP/IP layer

(35)

Wireshark: www.wireshark.org

Enable it on the correct network interface and IP:

(36)

Wireshark

(37)

Wireshark

The “Follow TCP Stream” option allows you to easily get all the relevant packets together to

determine where the problem may be:

(38)

Wireshark

Mark the first packet as the reference packet:

Wireshark will now show you a listing of all the relevant packets and how much time each

one took:

(39)

OS Monitoring

Useful for determining

How and what resources (CPU, memory, etc.) are being consumed

What files and libraries are being referenced and loaded

(40)

Process Monitor – SysInternals Tool

Includes RegMon and FileMon

Lets you determine what files, registry keys, and libraries are being used or referenced:

Allows you to easily exclude non-relevant processes:

Tip: Hit “Jump To” to browse to the folder location:

(41)

Process Explorer

Useful to determine what command line options a specific process is running with

Useful to determine which threads are consuming the most CPU

(42)

Process Explorer

See which .dlls are being referenced for a given process:

Find which processes are using a

specific .dll:

(43)

Perfmon

One of the least used tools, but one of the best for diagnosing performance issues

Works on the principle of setting counters for what you want to monitor

(44)

Unix

nmon

nmon is for Linux and AIX only

Use prstat on Solaris

(45)

Agenda

BI4.0 Platform Monitoring

Managing and Configuring Logs

Troubleshooting Tools

(46)

What To Do When

performance, hang, high memory, high CPU issue

• Collect the required data

• What is the actual issue? A hang is not the same as a crash

• Time the issue occurred

• Process IDs of all affected processes

• CPU/Memory data (i.e.: task manager, perfmon, etc)

• Logs (captured when the issue is occurring)

• Is the issue repeatable? If so, capture the detailed workflow

• HTTP/Network traces if applicable

• Take a memory dump (C++ or Java thread dump)

(47)

Thank you

Contact information:

[email protected]

(48)

(49)

Week 3 Unit 3: Troubleshooting

(50)

Troubleshooting Clients with Fiddler

• Collect HTTP traffic

between client and

server

• Demo of how to use

Fiddler to compare

response times between

XI 3.1 and BI 4.x

• Capture a regression in

Web Intelligence drill

filters

• Expedite delivery of a fix

using the collected

output

(51)

Thank you

Contact information:

[email protected]

(52)

(53)

Week 3 Unit 4: Troubleshooting BI

(54)

Troubleshooting BI Platform with Wireshark

• Capture all network

traffic with Wireshark

• Demo of how to use

Wireshark to monitor the

Kerberos protocol

between Application

Server and KDC

• Fundamental for

resolving problems that

occur in the network

stack

(55)

Thank you

Contact information:

[email protected]

(56)

(57)

Week 3 Unit 5: Troubleshooting

(58)

BW Workflows on the BI Platform

• Note 1609534 – How to enable SAPJCO

trace on Adaptive Processing Server in

• Don’t underestimate

the importance of

splitting APS to

isolate MDAS, DSL,

and DF workflows.

(59)

(60)

(61)

(62)

Performance Analysis Using Transaction /nST05

• Types of traces include: RFC, SQL, and HTTP.

• Use SQL trace to validate the effectiveness of RSRT settings, by checking

(63)

Validating MDX Expressions Using Transaction /nMDXTEST

See video: How

to Retrieve and

Use MDX

Statements

from MDA Logs

• 1711416 - BI 4.0: How to enable MDA tracing for OLAP-based universes

• Copy/paste the

Select

statement into

MDXTEST –

select Run

mode

• Check the output in

the list viewer to

ensure accuracy of

data / columns /

runtime / stability

possible correction

Notes.

(64)

Gathering Runtime Statistics in BW:

Using Transactions RSDDSTAT, and SE16 Table: RSDDSTAT_OLAP

Filter!

(User/Date)

Table

RSDDSTAT_OLAP

Filter By

EventID

Gather

runtimes

(65)

Gathering Runtime Statistics in BW Using

Transaction /nSTAD

Choose

view

Filter by User

Double-click

RFC row with

long Response

time

Restrict

time

Click RFC to

see the

statistical record

Click “Calls” to see the single BAPI usage

(e.g. BAPI_MDDATASET_GET_AXIS_DATA)

(66)

Workload Monitor Using Transaction /nST03N

• An overview ‘cockpit’ for gathering up

runtime statistics at a global

(instance) level.

• Can be navigated using predefined

selections/views

• Integrated functions allow drilling

down into details and into individual

stat levels (as per /nSTAD)

(67)

BW Analysis Using Transaction /nDB02

• A neat way to interpret cube content & table storage on the host.

• Can quickly focus on objects that have worrying metrics (facts,

(68)

Cube Data Browser Using /nListcube

• Browse the

source cube

• See the raw

data before the

BEx OLAP

layer.

• Helps target

specific rows,

without

hit-and-hope!

(69)

Online resources

• How to performance optimize Web Intelligence on BW BICS reporting:

https://scn.sap.com/docs/DOC-33706

• How to performance optimize Web Intelligence on BW MDX reporting:

(70)

(71)

(72)

Week 3 Unit 6: Performance

(73)

Performance Testing

Value Proposition

Performance

Testing

Increased

Customer

Satisfaction

Improved

ROI

Expanded

Usage

Lower TCO

As business applications become more complex, it is imperative to consider the impact performance has

on our end users. By testing and tuning performance-related aspects, such as response time and