We are trying to implement single signon for our MRE environment. We have IIS connecting to Tomcat using Jakarta Connector.

Do we need to have Kerberos or NTLM or anyother method to have single signon?

If not, how can I achieve the Single Signon in our architecture? I have done all the configurations according to document but when try to access the BI Portal, it shows "Unexpected error". We couldn't able to find any error.

Opened a case with IBI and they mentioned nothing to do on WebFocus side. I am not fully buying that.

Any thoughts.

This message has been edited. Last edited by: FP Mod Chuck,

WFDevConsultant

Which version are you doing this with?

WebFocus 8105M

WFDevConsultant

There are a lot of moving parts to this an hopefully I can consolidate the steps for you. First of all you do not need Kerberos or NTLM

In the security and administration manual it does list everything you need to do but there are a lot of conditions to consider.

First of all you need to make sure that your reporting server is set up to use LDAP as the primary access and PTH as the secondary access and test to make sure you have that working.

Make sure you add a LDAP user ID as WebFOCUS administrator in the Security Center.

Next you need to edit the \ibi\WebFOCUS81\config\securitysettings.xml file with a text editor. In the filterPreference section of the file, set anonymousAuthEnabled to false,
formAuthEnabled to false, and j2eePreAuthFilterEnabled to true. Then save that.

Edit the \ibi\tomcat\conf\server.xml file to look like the following for the AJP Connector

< !-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" protocol="AJP/1.3"
tomcatAuthentication="false" redirectPort="8443" />

On the WebFOCUS client side in the administration console you need to make sure that the Reporting Server / Remote Services / EDASERVE entry has security set to Trusted.

Under Configuration / Security set the following parameters
IBI_Authentication_Type = WFRS, IBI_Update_User_Info = True, IBI_User_Group_Membership_ExtAuthN = EXTERNAL, IBI_User_Group_Membership_PreAuthN = EXTERNAL, IBI_External_Group_Type = WFRS, Have a valid LDAP user ID that is a Reporting Server administrator and Password in the IBI_WFRS_Service_User and IBI_WFRS_Service_Pass and last but not least set up a super user by completing the IBI_Admin_Name and IBI_Admin_Pass entries. This ID should not be an LDAP ID but one just used as the super user for WebFOCUS.

From the IIS Administration console under the Default Web Site / IIS Authentication change the Anonymous Authentication from Enabled to Disabled and Windows Authentication from Disabled to Enabled.

Restart the IIS World Wide Web Publishing Service and Restart the Apache Tomcat Service

Hopefully this will get you on your way...

This message has been edited. Last edited by: FP Mod Chuck,

I have followed all those steps but no luck.

When I try to do, http://localhost/ibi_apps - it shows "Website cannot be display" error.

WFDevConsultant

Sorry to hear that, I just wanted to make sure you had what I did to make it work on my system. I guess you need to keep after techsupport. Have you tried fiddler2 to trace how far it gets?