2182400 - Setting up constrained delegation in BI 4.x

• NOTE: If setting up AD SSO via the current KBA 2629070, it makes this KB irrelevant 
• If AD SSO was originally setup using older KBA 1631734 shows how to set up delegated service accounts in a general way (kerberos delegation to any service) also known as unconstrained delegation
• For a growing number of reasons you may elect to set up constrained delegation (kerberos delegation to specified services) 
• This may be a security requirement from your Active Directory administrator or IT
• This setting is also known to allow Google Chrome browsers to perform SSO without special registry keys see KBA 1887193 for more details
• IF using Microsoft browsers such as internet explorer ( IE ) 11 on later versions of windows 10 with credential guard enabled it requires constrained delegation see KBA 2485300 
• To note if using SSO to the DB for analysis via KBA 1688079 this solution requires additional steps see KBA 2110370 for more info

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental.” 

• SAP businessObjects business Intelligence Platform 4.x all SP's 
• Active Directory 2003, 2008, and probably 2012 (although that is out of scope of this KBA)

biauth htkba tskba zie single sign on sign-on end to end sso2db automatic logon, BI 4.1, 4.2, 4.3 , KBA , biauth , htkba , htkb , BI-BIP-AUT , Authentication, ActiveDirectory, LDAP, SSO, Vintela , How To