Slow Login Performance Using SSO - (XIR2 with SP4)

[Former Member]

I've just got SSO working (Windows AD), but it seems to take a long time to log into Infoview

or DesktopIntelligence over Infoview.

We have configured the IIS Web Server for Single Sign On (Windows AD)

Any ideas what might be the cause?

Thank in advance

[Former Member · Accepted solution]

Hi Tim,

thank you for your answers.

One thing we have found that if we directly log in desktopintelligence

the logging file in the location C:\Program Files\Business Objects\BusinessObjects Enterprise 11.5\Logging

contains the following error code:

Timestamp ProcessID ThreadID Message

[Mon Oct 13 12:11:44 2008] 3540 3192 assert failure: (.\secssoplugin_impl.cpp:62). (0 : UnInitializePlugin() -- Unexpected Exception!).

Is there a link for the slow sso connection.? Do you have an idea for the solutions.

Best regards

Swen

[BasicTek · Accepted solution]

unfortunately there is no way of telling what those errors are for without enabling tracing and possibly packet scanning.

During a login the user credentials must be checked in AD and live queries are sent from the client(SSO) or webapp(manual logon) and possibly CMS(authorization).

Troubleshooting these issues can be extremely complex and usually requires an authentication engineer.

Regards,

Tim

[Former Member]

Hi Tim,

Thanks for the quick response.

First, the answers of your questions:

A) removing SSO and logging in with AD manually

=> the same slow performance with SSO and AD

B) logging in with enterprise accounts

=> very fast logging (also with DesktopIntelligence)

C) checking the IIS logs/times

=> the Log Files are OK, the file contains no erros

The performance logging (SSO with Windows AD) problem occurs only with DesktopIntelligence. and Designer.

When a user logs on with SSO, the operations will take about a minute. The start of the DesktopIntelligence Tool with a enterprise user is very fast.

For your Information: We use a Cluster System for BOXI.

I hope the information will help further

Best regards

Swen

Edited by: Swen Göllner on Oct 13, 2008 11:44 AM

[BasicTek]

Well the only process that is common to both SSO and manual logon with AD is the Queries sent at logon time. It may not be an error since both are working but slowly.

At this point it would be best to open a message with support to get an Authentication engineer to p[erform a series of tests/tracing on the CMS and with a packet scaner to identify where the lag is cvoming from.Enterprise accounts do not have to query AD at logon but AD account do. It seems there is something slowing this process down.

Regards,

Tim

[BasicTek]

SSO actually occurs mostly external to the BO product. See below...

After setting up up the sso.enables="true" combined with IIS (integrated auth) causes all web server requests to 401 (not authorized). Clients (IE, firefox) check browser rules (whether it is allowed to submit credentials), then send them to IIS which impersonates the user, the CMS then authorizes, and clients can view the URLs that were originally requested.

If there is slowness then it's best to verify where the issue is. Opening a message with support's authentication team would be the quickest route.

If you can do that then we can try to isolate by...

A) removing SSO and logging in with AD manually

B) logging in with enterprise accounts

C) checking the IIS logs/times

Let us know if the slowness is only during SSO, AD, or all logins.

Regards,

Tim