OpenSAP BIFOUR1 Week 3 Troubleshooting Performanc Testing Authentication

Week 3 Unit 1: Authentication and
Single Sign On (SSO)
Authentication and Authorization
Authentication
Is this a valid user?
vs.
Authorization
Does the user have rights to the
application or content?
Groups
STS/SNC
Central Management Server
Roles
Groups
2013 SAP AG. All rights reserved.
Public
Web Tier Authentication
The following major logon methods are supported, with various methods of
SSO:
Windows AD
SSO achieved via Kerberos, using the Quest Vintela plug-in
Web application server can run on any platform; however, the Central Management
Server MUST be on a Windows or Linux (as of 4.0 SP05) system
LDAP
SSO is supported with integration through CA SiteMinder
SAP
SSO achieved through consumption of SAP SSO tickets
Enterprise
Native BI authentication model. SSO can be achieved through Trusted Authentication
Public
Details on Active Directory SSO with Kerberos
Active Directory SSO with

Kerberos allows for end-to-end
Single Sign-On to the database
Scheduling a report will not carry forward

the Kerberos ticket even with Schedule
Now
It is not possible to set up AD SSO with
Kerberos for scheduling
Interactive refresh enables SSO
A detailed walkthrough can be found on
Service Marketplace:
http://service.sap.com/sap/support/notes
/1631734
Public
Details on LDAP SSO
LDAP Single Sign-On is enabled

using SiteMinder
SiteMinder is an access management

application delivered by CA Technologies
Integrates with virtually any LDAP
server, as well as Active Directory
LDAP SSO is for front door entry

only and cannot be used to achieve
SSO to the database
SSO to the database can be achieved

using secondary credentials or by mixing
with SAP SSO methods for data access
Public
Web Services SSO
Setting up Web services SSO for

Windows Active Directory is
required to enable SSO for the
following clients:
LiveOffice
Query as a Web Service
BI Widgets
Crystal Reports for Enterprise
Dashboard Designer
Setup is similar to configuring the

BI launch pad, see SAP Note
1646920
Public
Trusted Authentication
BI trusts the underlying application

server to perform the
authentication
The Application Server passes a shared

secret and user ID to BI to facilitate SSO
No user password is passed to BI
Enables most other authentication
methods such as X.509, SAML,
SecureID, etc.
None of the desktop client tools

support Trusted Authentication
Public
Configuring Trusted Authentication
There are a number of ways to pass user information in trusted

authentication
Web Session
HTTP Header
User Principal (new method using JAAS authentication)
Remote User (new method using JAAS authentication)
Cookies and Query String not recommended, supported for legacy purposes
It is possible to bind a different incoming user ID to an existing user in the

BI system using trusted.auth.user.namespace.enabled
Requires the user to manually log on the first time and binds the assertion user ID with
the BI account the user logs on with
Remember, you are trusting the application server, so you must secure the
Web Application
Public
Dimensional Semantic Layer (DSL) Connectivity
Kerberos SSO
MS SQL Server
Oracle DB
SAP HANA
Security Token Service (STS)

SAP NetWeaver BW
Applicable to the following clients:

Crystal Reports for Enterprise
Web Intelligence
Dashboards
Explorer
Analysis OLAP
Public
Legacy Semantic Layer (.unv)
Kerberos SSO
MS SQL Server
Oracle DB
Server SNC
SAP NetWeaver BW
Stored user credentials

All other databases
Applicable to the
following clients:
Crystal Reports 2011
Web Intelligence
Public
10
Propagating User Attributes
Leverage metadata from

user directories like
region, department, or
time zone, and apply via
universe security
Personalize report data

with flexible user
attributes
Full overview on SCN

http://scn.sap.com/comm
unity/biplatform/blog/2012/07/05/
user-attribute-mappingin-bi4
Public
11
Mobile SSO
Mobile currently uses

username and password
only
The username and

password can be saved
locally on the device
This option can be disabled

by administrators if desired
Mobile SSO remains in

the roadmap for a future
release
Public
12
SAP HANA: Kerberos SSO
BI on Windows
Configure AD SSO with Kerberos or

manually log on using AD credentials
No scheduling SSO
BI on Linux
Configure LDAP connectivity to Active

Directory
Enable Kerberos from the LDAP
authentication plug-in
Manually log on, then SSO to HANA
becomes possible
Public
13
SAP HANA: Secondary Credentials
Save database credentials to use

for SSO using the SAP HANA
native authentication
Credentials can automatically be

captured when the user manually
logs on to BI launch pad
Minimal configuration for BI
Cannot use with SSO to BI Launch

Pad as password will be blank
Public
14
SAP HANA: HANA Authentication
Accessible under CMC >

Applications
Establishes BI as a
trusted authentication
source for HANA
Less work to configure than

Kerberos
Supported with all BI clients
except Design Studio and
Analysis Office
Works with any type of

authentication to BI
Enterprise, AD, LDAP, SAP,

etc.
Supports all platforms
Public
15
Thank you
Contact information:
open@sap.com
No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG.
The information contained herein may be changed without prior notice.
Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors.
National product specifications may vary.
These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or
warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group
products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing
herein should be construed as constituting an additional warranty.
SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in
Germany and other countries.
Please see http://www.sap.com/corporate-en/legal/copyright/index.epx#trademark for additional trademark information and notices.
Public
17
Week 3 Unit 2: Best Practices for

Troubleshooting
Agenda
BI4.0 Platform Monitoring

Managing and Configuring Logs
Troubleshooting Tools
What To Do When
Exercises
Public
SAP BusinessObjects BI 4.0 Platform Monitoring

Overview
Monitoring is a new BI 4.0 application embedded into the Central Management
Console
Provides a dashboard showing an overview of SAP Business Objects
deployment
Records the metrics surfaced by the different BI 4.0 servers
Captures historic trends and provide a graphical visualization component
Provides Threshold notifications
Delivers default watches for all the servers
Integrates with SAP Solution Manager through CA Wily Introscope
Public
Examples of Typical Monitoring Uses

1.
Understand overall system health and

server deployment metrics:
Dashboard with health status of each server in
the deployment
Understand the key deployment level metrics
and how they are performing
2.
Monitor the system health and

understand root cause of problems
Can provide an alert in case of problems
Perform root cause analysis using the
corresponding Watch (which triggered the alert)
3.
Monitor system performance

With the help of probes, configure the system
to provide alerts in the case of performance
issues
Public
Main Concepts of the BI4.0 Platform

Monitoring
Metric a system of related measures that facilitates the quantification
of some particular characteristic
Probe a utility to check the availability of SAP Business Objects BI4.0
services by simulating workflows
Watch an abstraction of a part of the BI Landscape, providing realtime statuses and historical trends of servers and workflows within the
SAP Business Objects Enterprise environment
Alert a notification generated by the monitoring application, when a
user-defined threshold value set for different metrics applied to a watch
is breached
Public
BI4.0 CMC Integration Monitoring Dashboard

Provides an overview of the entire BIPlatform landscape
The KPIs show

the deployment
level metrics
It shows all the watches along with state
The graph shows

the state of watch
selected
Alert no. in
brackets shows
unread,
unconfirmed
alerts only.
On click, user
navigates to Alert
Inbox (filtered by
alerts for that
watch) to view all
alerts for that
watch.
Public
BI4.0 CMC Integration Server Health
The server status is determined by its associated watch.
Watches provide real-time statuses of servers and workflows

within the SAP Business Objects environment.
The traffic light is associated with each watch to indicate the

watch state.
Click the server health icon to show watch details.
Click to go see
watch details
Public
Third-Party Integration
Integration with IBM Tivoli via Tivoli Enterprise monitoring agent
Integration with SAP Solution Manager (incl. CA Wily Introscope)
Open JMX framework allows simple integration with other ESM vendor tools
Provides SDK for writing new probes
Public
Agenda

What To Do When
Public

What It Is?
System-level messages generated by BI platform servers are traced and written to
log files. Traces are recordings of events that occur during the operation of a
monitored component. The traced events range from severe exception errors on one
end to simple status messages at the other.
Typical Uses
These log files are used by system administrators to monitor performance or for
debugging purposes.
Public
10
Managing and Configuring Logs Overview

Logging Components
SAP BI40 Processing servers logging
SAP BI40 Web application logging
SAP BI40 Client tools
Trace Log
Generic log file (.glf) extension
System-level messages generated by BI platform
Trace Log Levels
Unspecified (tracing specified trough .ini)

None (logging rare critical events)
Low
Medium
High
Public
11
Managing and Configuring Logs Overview

Configuring tracing for processing servers
"TraceLog Service" for a specific server or a group in CMC
Manually with the BO_trace.ini file
C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\conf
Configuring tracing for web applications

"Trace Log" application settings in CMC
The location for logs is in the user home folder
C:\Program Files (x86)\SAP BusinessObjects\Tomcat6\webapps\BOE\WEB-INF\TraceLog
Configuring tracing for BI40 client tools

Create environment variables (BO_TRACE_LOGDIR, BO_TRACE_CONFIGFILE)
Configuring tracing for the Upgrade Management Tool

Manually with the BO_trace.ini file (same as processing servers)
Public
12
Agenda

What To Do When
Public
13
HTTP Tracing
Useful for determining

What content (css, js, etc.) is being sent to the client (browser)
How much data is coming from the database (CMS)
If the content is being cached or not
If the content has been compressed or not
Where the slowness in loading pages may reside
How a specific page is constructed
Public
14
Fiddler: www.fiddler2.com/fiddler2
Fiddler shows you the size of the request.
If the page is cached or has an expires tag:
Allows you to find the parent and child requests so you can calculate how long it took to load
a page:
Public
15
Fiddler
Adding the size of each request body gives you the total amount of data being sent to the
client (browser), and taking the time from the first request until the last request will tell you
how long it took to load the page.
Public
16
Network Tracing

Network latency
Why and who may be closing a network connection
Errors received in the TCP/IP layer
Public
17
Wireshark: www.wireshark.org
Enable it on the correct network interface and IP:
Filter on IPs, protocol, ports
Public
18
Wireshark
Creating a flow graph of a capture:
Public
19
Wireshark
The Follow TCP Stream option allows you to easily get all the relevant packets together to
determine where the problem may be:
Change the time display format to let Wireshark calculate how much time the packet took:
Public
20
Wireshark
Mark the first packet as the reference packet:
Wireshark will now show you a listing of all the relevant packets and how much time each
one took:
Also, consider HTTPWatch: www.httpwatch.com

Public
21
OS Monitoring

How and what resources (CPU, memory, etc.) are being consumed
What files and libraries are being referenced and loaded
Public
22
Process Monitor SysInternals Tool

Includes RegMon and FileMon
Lets you determine what files, registry keys, and libraries are being used or referenced:
Allows you to easily exclude non-relevant processes:

Tip: Hit Jump To to browse to the folder location:
Public
23
Process Explorer
Useful to determine what command line options a specific process is running with
Useful to determine which threads are consuming the most CPU
Public
24
Process Explorer
See which .dlls are being referenced for a given process:
Find which processes are using a
specific .dll:
Public
25
Perfmon
One of the least used tools, but one of the best for diagnosing performance issues
Works on the principle of setting counters for what you want to monitor
Tip: Put the log into Excel and create a chart
Public
26
Unix
nmon
nmon is for Linux and AIX only
Use prstat on Solaris
Download from: http://www.ibm.com/developerworks/aix/library/au-analyze_aix/
Public
27
Agenda

What To Do When
Public
28
What To Do When
performance, hang, high memory, high CPU issue
Collect the required data
What is the actual issue? A hang is not the same as a crash
Time the issue occurred

Process IDs of all affected processes
CPU/Memory data (i.e.: task manager, perfmon, etc)
Logs (captured when the issue is occurring)

Is the issue repeatable? If so, capture the detailed workflow
HTTP/Network traces if applicable
Take a memory dump (C++ or Java thread dump)

If you have a core dump, run a backtrace
Public
29
Thank you
open@sap.com
Public
31
Week 3 Unit 3: Troubleshooting

Clients with Fiddler
Troubleshooting Clients with Fiddler
Collect HTTP traffic

between client and
server
Demo of how to use

Fiddler to compare
response times between
XI 3.1 and BI 4.x
Capture a regression in
Web Intelligence drill
filters
Expedite delivery of a fix

using the collected
output
Public
Thank you
open@sap.com
Public
Week 3 Unit 4: Troubleshooting BI

Platform with Wireshark
Troubleshooting BI Platform with Wireshark
Capture all network

traffic with Wireshark
Demo of how to use

Wireshark to monitor the
Kerberos protocol
between Application
Server and KDC
Fundamental for
resolving problems that
occur in the network
stack
Public
Thank you
open@sap.com
Public
Week 3 Unit 5: Troubleshooting

with BW Transaction
BW Workflows on the BI Platform
Dont underestimate
the importance of
splitting APS to
isolate MDAS, DSL,
and DF workflows.
Note 1609534 How to enable SAPJCO

trace on Adaptive Processing Server in
Business Intelligence 4.x
Public
Process Overview Using Transaction /nSM50
Public
Query Monitor Using Transaction /nRSRT
Public
Trace Tool Using Transaction /nRSTT
Public
Performance Analysis Using Transaction /nST05
Types of traces include: RFC, SQL, and HTTP.
Use SQL trace to validate the effectiveness of RSRT settings, by checking

modifications to SQL statements (i.e. flag selection of structure elements)
Public
Validating MDX Expressions Using Transaction /nMDXTEST
1711416 - BI 4.0: How to enable MDA tracing for OLAP-based universes

See video: How
to Retrieve and
Use MDX
Statements
from MDA Logs
Copy/paste the
Select
statement into
MDXTEST
select Run
mode
Check the output in

the list viewer to
ensure accuracy of
data / columns /
runtime / stability
possible correction
Notes.
Public
Gathering Runtime Statistics in BW:

Using Transactions RSDDSTAT, and SE16 Table: RSDDSTAT_OLAP
Table
RSDDSTAT_OLAP
Filter By
EventID
Gather
runtimes
Filter!
(User/Date)
Overview of EventIDs:
http://help.sap.com/saphelp_erp60_sp/helpdata/en/45/f0
488a1aa03115e10000000a1553f7/content.htm
Public
Gathering Runtime Statistics in BW Using

Transaction /nSTAD
Click RFC to
see the
statistical record
Choose
view
Restrict
time
Filter by User
Double-click
RFC row with
long Response
time
Click Calls to see the single BAPI usage

(e.g. BAPI_MDDATASET_GET_AXIS_DATA)
Check size of dataset sent.

Public
Workload Monitor Using Transaction /nST03N
An overview cockpit for gathering up

runtime statistics at a global
(instance) level.
Can be navigated using predefined

selections/views
Integrated functions allow drilling

down into details and into individual
stat levels (as per /nSTAD)
Public
10
BW Analysis Using Transaction /nDB02
A neat way to interpret cube content & table storage on the host.
Can quickly focus on objects that have worrying metrics (facts,

compression..)
Public
11
Cube Data Browser Using /nListcube
Browse the
source cube
See the raw

data before the
BEx OLAP
layer.
Helps target
specific rows,
without hit-andhope!
Public
12
Online resources
How to performance optimize Web Intelligence on BW BICS reporting:

https://scn.sap.com/docs/DOC-33706
How to performance optimize Web Intelligence on BW MDX reporting:

www.service.sap.com/~sapidb/011000358700000750762010E
Public
13
Thank you
open@sap.com
Public
15
Week 3 Unit 6: Performance

Testing with JMeter
Performance Testing
Value Proposition
Users are happier with applications that perform well
Effective use of server resources results in
lower total cost of ownership
Lower TCO
Drive additional consumption and

wide-spread usage based on
confidence in platform response
Increased
Customer
Satisfaction
Performance
Testing
Expanded
Usage
Improved
ROI
Business use is more effective, resulting in

increased returns on the investment
As business applications become more complex, it is imperative to consider the impact performance has
on our end users. By testing and tuning performance-related aspects, such as response time and
throughput, we enable a number of benefits.
Public
Performance Testing
The Dream
Wiki content explaining how to correlate dynamic
data for WebI, Crystal, Dashboards, etc.
SAP
Enablement
for core BI
Clients
Large or Small,
performance
testing for all
Better SAP
BI for
Everyone
Ecosystem
collaboration
Customers and Partners contribute use cases and experiences

Public
Performance Testing
Results Analysis
Throughput
Java Process
Performance
Server Resource
Utilization
Response Time
Overall
Performance
Public
Apache JMeter An Overview
Apache JMeter is open source software, a

100% pure Java desktop application designed
to load test functional behavior and measure
performance.
May be used to test performance both on static and
dynamic resources (Files, Servlets, Perl scripts, Java
Objects, Databases and Queries, FTP Servers, and
more).
Can be used to simulate heavy load on a server,
network, or object to test its strength or to analyze
overall performance under different load types.
Used to make a graphical analysis of performance or to
test your server/script/object behavior under heavy
concurrent load.
Public
JMeter Capabilities
Can load and performance test many
different server types:
Web - HTTP, HTTPS
SOAP
Database via JDBC
LDAP
JMS
Highly Extensible:
Full multithreading framework allows concurrent
sampling by many threads and simultaneous
sampling of different functions by separate thread
groups.
Data analysis and visualization plugins allow great
extensibility as well as personalization.
Functions can be used to provide dynamic input to a
test or provide data manipulation.
Public
Thank you
open@sap.com
Public

OpenSAP BIFOUR1 Week 3 Troubleshooting Performanc Testing Authentication

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

OpenSAP BIFOUR1 Week 3 Troubleshooting Performanc Testing Authentication

Uploaded by

Copyright:

Available Formats

Week 3 Unit 1: Authentication and

Single Sign On (SSO)

Authentication and Authorization

2013 SAP AG. All rights reserved.

Web Tier Authentication

2013 SAP AG. All rights reserved.

Details on Active Directory SSO with Kerberos

Active Directory SSO with

Scheduling a report will not carry forward

2013 SAP AG. All rights reserved.

Details on LDAP SSO

LDAP Single Sign-On is enabled

SiteMinder is an access management

LDAP SSO is for front door entry

SSO to the database can be achieved

2013 SAP AG. All rights reserved.

Web Services SSO

Setting up Web services SSO for

Setup is similar to configuring the

2013 SAP AG. All rights reserved.

BI trusts the underlying application

The Application Server passes a shared

None of the desktop client tools

2013 SAP AG. All rights reserved.

Configuring Trusted Authentication

There are a number of ways to pass user information in trusted

It is possible to bind a different incoming user ID to an existing user in the

2013 SAP AG. All rights reserved.

Dimensional Semantic Layer (DSL) Connectivity

Security Token Service (STS)

Applicable to the following clients:

2013 SAP AG. All rights reserved.

Legacy Semantic Layer (.unv)

Stored user credentials

2013 SAP AG. All rights reserved.

Propagating User Attributes

Leverage metadata from

Personalize report data

Full overview on SCN

2013 SAP AG. All rights reserved.

Mobile currently uses

The username and

This option can be disabled

Mobile SSO remains in

2013 SAP AG. All rights reserved.

SAP HANA: Kerberos SSO

Configure AD SSO with Kerberos or

Configure LDAP connectivity to Active

2013 SAP AG. All rights reserved.

SAP HANA: Secondary Credentials

Save database credentials to use

Credentials can automatically be

Minimal configuration for BI

Cannot use with SSO to BI Launch

2013 SAP AG. All rights reserved.

SAP HANA: HANA Authentication

Accessible under CMC >

Less work to configure than

Works with any type of

Enterprise, AD, LDAP, SAP,

2013 SAP AG. All rights reserved.

2013 SAP AG. All rights reserved.

2013 SAP AG. All rights reserved.

Week 3 Unit 2: Best Practices for