Skip to content

BusinessObjects User Logon

Make MetaMiner Client users log on to BusinessObjects with their own account, so their MMC actions run as them and they see only the content BusinessObjects lets them see.

How it works

Each BusinessObjects environment has a User logon setting in the MetaMiner Administrator (MMA):

Mode Behaviour
OFF (default) MMC actions run as the environment's service account. MetaMiner roles control what each user may do
REQUIRED Each MMC user logs on to BusinessObjects with their own account when connecting. MMC actions run as that user, BusinessObjects rights apply, and the MMC shows only the folders and objects that user can see

Pulls always use the service account, so the MetaMiner Database stays complete. MetaMiner roles still apply on top of BusinessObjects rights when MetaMiner Security is on.

The user's BusinessObjects password is sent encrypted to the MetaMiner Server for the logon and is never stored. Remember me on this computer keeps a BusinessObjects logon token, not the password, protected with Windows DPAPI for that Windows user.

Before you begin

  • The BusinessObjects authentication types your users use: secEnterprise, secLDAP or secWinAD.
  • For secWinAD: Kerberos configured on the MetaMiner Server (krb5.ini and bscLogin.conf), as for any BusinessObjects SDK client. NTLM is not supported.
  • Users need the BusinessObjects rights for the actions they perform.

Set an environment to REQUIRED

  1. In MMA, select the environment and click Edit.
  2. Open the User logon tab.

  3. Set the fields:

    Field Values Effect
    Mode OFF, REQUIRED Turns per-user logon on for this environment
    Authentication secWinAD, secLDAP, secEnterprise The default authentication type in the logon dialog
    Remember logon (days, 0 = never) 0 to 30, default 7 How long a remembered logon lasts. 0 removes Remember me on this computer

  4. Click OK to save.

Image of the Edit SAP BusinessObjects Environment dialog on the User logon tab with Mode REQUIRED

../images/security/mma-environment-user-logon.png

Log on in the MetaMiner Client

  1. Connect to the MetaMiner Server and click Apply in Connection Manager.
  2. For each REQUIRED environment, the Log on to BusinessObjects dialog opens. Enter the user name and password, and choose Authentication.
  3. Optional: tick Use for all BusinessObjects environments to use the same logon for the other REQUIRED environments.
  4. Optional: tick Remember me on this computer to skip the dialog next time, within the days set by the administrator.
  5. Click OK.

Image of the Log on to BusinessObjects dialog with Authentication, Use for all BusinessObjects environments and Remember me on this computer

../images/security/mmc-bo-logon-dialog.png

If you cancel the dialog, that environment is not loaded for this connection. While MetaMiner prepares your view of a large environment, the MMC shows a short wait message.

File menu commands

Command What it does
File > Log on to BusinessObjects Logs on to a REQUIRED environment whose logon you cancelled
File > Log off BusinessObjects Ends your BusinessObjects session for an environment and deletes its remembered logon on this computer
File > Refresh BusinessObjects access Recalculates which folders and objects you can see, then reloads the environment. Use it after your BusinessObjects rights change

Image of the MMC File menu with Log off BusinessObjects expanded to list one environment

../images/security/mmc-file-menu-bo-logon.png

If your BusinessObjects session ends while you work, the MMC asks you to log on again and repeats the action once.

Features that use the service account

These features need the service account and are not available while you act as a BusinessObjects user. The MMC reports "Not available with BusinessObjects user logon":

  • Universe and business layer details, and BEx connection details
  • Web Intelligence data provider details, data provider mapping and change data provider source
  • Change universe source and universe remap
  • LCM promotion
  • Report validation run-as user

Advanced settings

Session and visibility timers

Set these as -D options of the MetaMiner Server service only if Infolytik Support advises it.

System property Default Effect
bo.user.session.idle.min 30 Minutes of inactivity after which MetaMiner logs the user's BusinessObjects session off. The next action logs on again without a prompt
bo.visibility.max.age.hours 24 Age after which a user's visible-content list is recalculated at logon

Troubleshooting

Too many sessions for this user

BusinessObjects refused the logon because the user reached a session limit. Close other BusinessObjects sessions of that user, or log off in the MMC with File > Log off BusinessObjects.

Nothing is visible after logon

The user has no view rights on the folders, or the visibility calculation failed. Use File > Refresh BusinessObjects access. MetaMiner shows no content rather than too much when it cannot confirm access.

secWinAD logon fails

Check the Kerberos configuration on the MetaMiner Server and that the user enters the account in the form the BusinessObjects cluster expects.

Next steps