BO SSO not working using Apache Server as Reverse proxy

[Former Member]

Hi,

We have configured SSO on BO and it is working fine. BO deployment is in corporate network. Customer wanted to setup an Apache Server on dmz in order to reach BO system from any network other than corporate one.

We have setup Apache Server as reverse proxy with Tomcat following official SAP notes. This setup working fine with any authentication option on logonNoSso.jsp login page. But when using SSO, Apache Server welcomes user with an authentication box (MS Windows style).After filling username and password (the problem is we don't want to fill any authentication form since we implemented SSO authentication), website does not load any content. We traced the authentication cycle concluding it is successful.

So here are my questions:

1. Is it possible to use SSO with reversed proxy connection using Apache Server not asking for authentication form?
2. Do we have to do any further configuration for Apache Server(connecting succesfully to Tomcat on port 8080 not ajp protocol)?

Thanks.

[former_member205064]

Firstly have to create SPN for the rever proxy url.

Secondly create a browser setting

Add the url in the Local Internet and go to internet settings->local internet->Custom level

and select "Automatic logon for current username and password"

let me know if it fixes your issue.

[Former Member]

Hi Raunak,

I have followed your steps. Now I am getting a different error captured below.

[former_member205064]

check for maxHTTPHeader value in server.xml of tomcat.

Increase to 65536 restart the tomcat and then check.

[Former Member]

maxHTTPHeader is 65536. SSO without Apache Server is working.

Is there a chance that Apache Server truncates headers so authentication information cannot reach to tomcat?

[former_member205064]

Did you have SPN created for Apache Server? also do u have constraint Delegation selected? in that case add the SPN for the Apache server as well.

[Former Member]

Hi,

SPN for apache server was created after your first response. 

The AD service account has constraint delegation selected for Kerberos Only option.

The problem still occurs.

Thanks.

[former_member205064]

If that is the case then everything seems fine from the BO configuration point.

you need to check with the Apace webserver team, there is some settings which is not letting passing the request.

run the fiddler for direct tomcat SSO and the fiddler for Apache web server SSO you will have result for what in Apache server is causing the issue.

[former_member189884]

You may want to go ahead and trace the login attempt using wireshark to see if the kerberos process is correct and the spn's being requested are present.

-Josh