SAP Knowledge Base Article - Preview

1869952 - Setting up kerberos SSO to the database requirements & troubleshooting


  • This is known as end to end SSO or SSO2DB, or kerberos delegation, or SSO to the database
  • As of BI 4.x this is supported for SQL, SSAS, Oracle, and HANA (if the database is properly integrated with AD and the kerberos information is configured correctly)
  • Other DB's have been added to the list such as Hadoop Impala, Cloudera, Teradata, Oracle Essbase and Exadata (there may be others)
  • To verify if kerberos SSO is possible in the IDT (information design tool) create a connection to the DB and verify if the kerberos SSO option is available (if not then kerberos is not possible to that DB via that connection type at this time.
  • This KBA will serve as a Primary KBA with the links to all the kerberos supported documentation and troubleshooting information that we currently have available, and get updated regularly as more information is added to our knowledge base.

Important things to note before engaging in this complex process

  • Kerberos delegation is not possible for any scheduled reports and has never been possible at any time. If you will be scheduling reports to the same DB then those reports will require a separate universe and/or connection.
  • Kerberos SSO to the DB is not possible if you logged into BI with enterprise, LDAP, SAP, siteminder, trusted authentication (including SAML), or anything other than AD/kerberos (KBA 2629070 or 1631734)
  • If reporting server that is connecting with kerberos is using APS or JDBC it will generally require java configurations settings (bsclogin.conf krb5.ini and keytab files) to locate AD controllers not DNS (see KBA 1688079)
  • SAP does not have documentation for the configuration and setup of non SAP databases, and may not be capable of reproducing this environment in house. This limits support to setting up the BI portion of the configuration only
  • Due to the complexities of this configuration, different products involved, it can be very time consuming, and many issues arise outside the BI product that cannot be solved by SAP support alone
  • Using consultants knowledgeable in SAP, Microsoft, Java, and the database vendor's products is highly recommended.  



  • SAP BusinessObjects Business Intelligence Platform 4.x 4.1 4.2 4.3 etc
  • HANA database server
  • Microsoft SQL server
  • Microsoft SQL Server Analysis Server
  • Oracle database Server including Essbase and Exadata
  • Apache Hadoop Impala
  • Cloudera
  • Teradata
  • Microsoft Active Directory kerberos
  • DB2
  • Sybase


SAP BusinessObjects Business Intelligence platform 4.0 ; SAP BusinessObjects Business Intelligence platform 4.1


zie single sign on sign-on silent sign on automatic login end to end e2e 2 on-demand mkba htkba biauth bpkba , KBA , tskba , tskb , mkb , BI-BIP-AUT , Authentication, ActiveDirectory, LDAP, SSO, Vintela , BI-BIP-SL , Semantic Layer , How To

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.