BusinessObjects Enterprise Administrator's Guide

Setting up NT single sign-on

You can configure BusinessObjects Enterprise to allow users to use various BusinessObjects Enterprise applications without being prompted to log on. Users need only to enter their NT user name and password information once at the beginning of the NT session. For instance, if you have set up NT single sign-on, when you launch the CMC, NT authentication occurs in the background. You are not required to enter any additional information.

Note:    This feature is available if you are using a Microsoft Internet Information Server (IIS) web server and users are using Internet Explorer as their web browser. See the Platforms.txt file included with your product distribution for a complete list of version requirements.

BusinessObjects Enterprise provides its own form of "anonymous single sign-on," which uses Enterprise authentication, as opposed to Windows NT authentication. Design your own web applications accordingly (or modify InfoView) if you want to use NT single sign-on.

When a user launches InfoView, he or she can log on using the Guest account (Enterprise authentication). You can disable this feature—for more information, see Disabling the Guest account. However, even when you disable the Guest account, BusinessObjects Enterprise is designed to display a logon page. With single sign-on enabled, the user can select Windows NT from the Authentication list and click Log On without entering his or her user name or password. In the developer documentation, refer to the tutorial for an example on creating a web application that uses single sign-on.

Setting up NT single sign-on to BusinessObjects Enterprise includes the following tasks:

• Configuring IIS for NT single sign-on
• Enabling NT single sign-on in CMC
• Modifying the web.config file for NT single sign-on

Note:    BusinessObjects Enterprise does not support the Kerberos protocol for Windows NT. For information on how to set up end-to-end single sign on with AD and Kerberos, see Configuring Kerberos single sign-on.