SAP Knowledge Base Article - Preview

2182400 - Setting up constrained delegation in BI 4.x


  • NOTE: If setting up AD SSO via the current KBA 2629070, it makes this KB irrelevant 
  • If AD SSO was originally setup using older KBA 1631734 shows how to set up delegated service accounts in a general way (kerberos delegation to any service) also known as unconstrained delegation
  • For a growing number of reasons you may elect to set up constrained delegation (kerberos delegation to specified services
  • This may be a security requirement from your Active Directory administrator or IT
  • This setting is also known to allow Google Chrome browsers to perform SSO without special registry keys see KBA 1887193 for more details
  • IF using Microsoft browsers such as internet explorer ( IE ) 11 on later versions of windows 10 with credential guard enabled it requires constrained delegation see KBA 2485300 
  • To note if using SSO to the DB for analysis via KBA 1688079 this solution requires additional steps see KBA 2110370 for more info

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental. 



  • SAP businessObjects business Intelligence Platform 4.x all SP's 
  • Active Directory 2003, 2008, and probably 2012 (although that is out of scope of this KBA)


SAP BusinessObjects Business Intelligence platform 4.1 ; SAP BusinessObjects Business Intelligence platform 4.2 ; SAP BusinessObjects Business Intelligence platform 4.3


biauth htkba tskba zie single sign on sign-on end to end sso2db automatic logon, BI 4.1, 4.2, 4.3 , KBA , htkba , biauth , htkb , BI-BIP-AUT , Authentication, ActiveDirectory, LDAP, SSO, Vintela , How To

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP ONE Support launchpad (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.