SAP Knowledge Base Article - Preview

2182400 - Setting up constrained delegation in BI 4.x


  • NOTE: If setting up AD SSO via the current KBA 2629070, it makes this KB irrelevant 
  • If AD SSO was originally setup using older KBA 1631734 shows how to set up delegated service accounts in a general way (kerberos delegation to any service) also known as unconstrained delegation
  • For a growing number of reasons you may elect to set up constrained delegation (kerberos delegation to specified services
  • This may be a security requirement from your Active Directory administrator or IT
  • This setting is also known to allow Google Chrome browsers to perform SSO without special registry keys see KBA 1887193 for more details
  • IF using Microsoft browsers such as internet explorer ( IE ) 11 on later versions of windows 10 with credential guard enabled it requires constrained delegation see KBA 2485300 
  • To note if using SSO to the DB for analysis via KBA 1688079 this solution requires additional steps see KBA 2110370 for more info

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental. 



  • SAP businessObjects business Intelligence Platform 4.x all SP's 
  • Active Directory 2003, 2008, and probably 2012 (although that is out of scope of this KBA)


SAP BusinessObjects Business Intelligence platform 4.2 ; SAP BusinessObjects Business Intelligence platform 4.3


biauth htkba tskba zie single sign on sign-on end to end sso2db automatic logon, BI 4.1, 4.2, 4.3 , KBA , biauth , htkba , htkb , BI-BIP-AUT , Authentication, ActiveDirectory, LDAP, SSO, Vintela , How To

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.