Xi3 1 bip-admin_en

BusinessObjects Enterprise
Administrator's Guide
BusinessObjects Enterprise XI 3.1

© 2009 SAP® BusinessObjects™. All rights reserved. SAP BusinessObjects and
its logos, BusinessObjects, Crystal Reports®, SAP BusinessObjects Rapid Mart™,
Copyright
SAP BusinessObjects Data Insight™, SAP BusinessObjects Desktop Intelligence™,
SAP BusinessObjects Rapid Marts®, SAP BusinessObjects Watchlist Security™,
SAP BusinessObjects Web Intelligence®, and Xcelsius® are trademarks or
registered trademarks of Business Objects, an SAP company and/or affiliated
companies in the United States and/or other countries. SAP® is a registered
trademark of SAP AG in Germany and/or other countries. All other names
mentioned herein may be trademarks of their respective owners.
2009-04-23

Contents
Getting Started 25Chapter 1
About this help...........................................................................................26
Who should use this help?...................................................................26
About BusinessObjects Enterprise.......................................................26
What's new in BusinessObjects Enterprise XI 3.1?...................................27
Where should I start?.................................................................................29
Planning or performing your first deployment......................................29
Configuring your deployment...............................................................30
Changing your deployment's architecture............................................30
Improving your system's performance.................................................31
Working with objects in the CMC.........................................................31
BusinessObjects Enterprise guides...........................................................32
Architecture 35Chapter 2
Architecture overview................................................................................36
Enterprise infrastructure.......................................................................38
BusinessObjects Enterprise web services...........................................39
BusinessObjects Enterprise management services.............................40
BusinessObjects Enterprise storage services......................................41
BusinessObjects Enterprise processing services................................42
Server Intelligence ...............................................................................46
Life-Cycle Management (LCM)............................................................46
Clients........................................................................................................47
Browser-based web application clients................................................48
Desktop client applications...................................................................52
Services.....................................................................................................59
BusinessObjects Enterprise Administrator's Guide 3

Service Categories...............................................................................60
Adaptive Job Server.............................................................................71
Adaptive Processing Server.................................................................72
Central Management Server................................................................73
Connection Server................................................................................75
Crystal Reports Cache Server..............................................................75
Dashboard Analytics Server.................................................................77
Dashboard Server................................................................................77
Desktop Intelligence Cache Server .....................................................78
Desktop Intelligence Job Server...........................................................78
Desktop Intelligence Processing Server .............................................79
Event Server.........................................................................................79
File Repository Servers .......................................................................80
Job Servers..........................................................................................81
List of Values Job Server......................................................................82
Multi-Dimensional Analysis Services (MDAS) Server .........................82
PM Metrics Server................................................................................83
PM Repository Server..........................................................................83
PM Rules Server..................................................................................84
Predictive Analysis Server ...................................................................84
Process Analysis Server......................................................................85
Program Job Server.............................................................................85
Publication Job Server.........................................................................86
Report Application Server....................................................................86
Sets Profile Server ..............................................................................87
Sets Query Server ...............................................................................87
Web Intelligence Processing Server....................................................88
Web Application Container Server (WACS).........................................88
Web application servers............................................................................89
Java SDK.............................................................................................90
.NET SDK.............................................................................................93
4 BusinessObjects Enterprise Administrator's Guide
Contents

Web Services ......................................................................................95
Web Application Container Service (WACS)........................................98
Databases .................................................................................................98
System databases................................................................................99
Reporting databases..........................................................................100
Auditing database...............................................................................101
Authentication and single sign-on............................................................102
Central Management Server (CMS) security.....................................102
Security plug-ins.................................................................................103
Authentication and authorization........................................................103
Information Workflows ............................................................................106
Authentication.....................................................................................107
Scheduling..........................................................................................108
Viewing...............................................................................................113
Managing and Configuring Servers 121Chapter 3
Server management overview.................................................................122
BusinessObjects Enterprise administrative tools...............................123
Working with the Servers management area in the CMC..................124
About Web Application Container Servers.........................................129
About Server Intelligence...................................................................130
Server management: what's new in this version of BusinessObjects
Enterprise...........................................................................................131
Working with nodes.................................................................................134
To add a node.....................................................................................135
To remove servers from a new node..................................................137
Recreating a Server Intelligence Agent on a local machine...............138
Viewing and changing the status of servers............................................139
To view a server's status....................................................................140
Starting, stopping, and restarting servers..........................................140
Stopping a Central Management Server............................................143
Contents

Enabling and disabling servers..........................................................144
Adding, cloning, and deleting servers......................................................145
Adding a server..................................................................................146
Cloning servers..................................................................................147
Deleting a server................................................................................149
Server groups..........................................................................................150
Creating a server group......................................................................150
Working with server subgroups..........................................................151
Modifying the group membership of a server.....................................153
User access to servers and server groups.........................................153
Configuring server settings......................................................................155
To change a server's properties.........................................................156
Working with configuration templates.................................................156
Configuring server network settings...................................................159
Changing the connect port used by Tomcat.......................................169
Managing CMS system database connections..................................169
Copying data from one CMS system database to another................170
Preparing to copy a CMS system database.......................................176
Deleting and recreating the CMS system database...........................177
Selecting a new or existing CMS database........................................180
Setting root directories and idle times of the File Repository Servers.182
Modifying performance settings.........................................................183
Configuring destinations for job servers.............................................183
Configuring Windows processing servers for your data source.........190
Configuring UNIX processing servers for your data source...............191
Adding and removing Windows server dependencies.............................198
Changing the system user account.........................................................198
Configuring tracing for servers................................................................199
To configure server tracing through the BO_trace.ini file...................200
To configure server tracing through the command line......................203
Configuring servers for SSL.....................................................................206
Contents

Creating key and certificate files........................................................207
Configuring the SSL protocol.............................................................210
Clustering Central Management Servers................................................211
Adding a CMS to a cluster..................................................................213
Adding a new node to a cluster..........................................................214
Adding clusters to the web.xml file.....................................................214
Changing the name of a CMS cluster................................................216
Backing up and restoring server configuration settings...........................217
To back up server configuration settings to a BIAR file......................218
To restore server configuration settings.............................................218
To import nodes from one cluster to another .....................................230
Working with Federation 233Chapter 4
Federation................................................................................................234
Federation terms......................................................................................236
BI application .....................................................................................236
Destination site ..................................................................................236
Local...................................................................................................236
Locally run completed instances .......................................................236
Multiple Origin sites ...........................................................................237
One-way replication ...........................................................................237
Origin site ..........................................................................................237
Remote...............................................................................................237
Remote Connection............................................................................237
Remote Scheduling............................................................................237
Replication..........................................................................................238
Replication Job...................................................................................238
Replication List...................................................................................238
Replication Object..............................................................................238
Replication package...........................................................................238
Replication refresh.............................................................................239
Contents

Two-way replication............................................................................239
Managing Replication Lists......................................................................239
Creating Replication Lists...................................................................240
Modifying Replication Lists.................................................................245
Managing Remote Connections..............................................................246
Creating Remote Connections...........................................................246
Modifying Remote Connections.........................................................248
Managing Replication Jobs.....................................................................249
Creating a Replication Job.................................................................250
Scheduling a Replication Job.............................................................253
Modifying a Replication Job...............................................................254
Viewing a log after a Replication Job.................................................254
Managing security rights..........................................................................256
Rights required on the Origin site.......................................................256
Rights required on the Destination site..............................................257
Federation specific objects.................................................................258
Replicating security on an object.......................................................259
Replicating security on an object using access levels.......................260
Replicating third-party users and groups.................................................260
Replicating universes and universe connections.....................................262
Managing Object Cleanup.......................................................................263
How to use Object Cleanup................................................................263
Object Cleanup limits.........................................................................264
Object Cleanup frequency..................................................................265
Replication types and mode options........................................................266
One-way replication ...........................................................................266
Two-way replication ...........................................................................266
Refresh from Origin or Refresh from Destination...............................267
Managing conflict detection and resolution.............................................269
One-way replication conflict resolution...............................................269
Two-way replication conflict resolution...............................................272
Contents

Using Web Services in Federation..........................................................275
Session variable ................................................................................275
File caching .......................................................................................276
Custom deployment ..........................................................................277
Remote scheduling and locally run instances.........................................278
Remote scheduling.............................................................................278
Locally run instances..........................................................................280
Instance share....................................................................................280
Importing and promoting replicated content............................................281
Importing replicated content...............................................................281
Importing replicated content and continuing replication ....................282
Promoting content from a test environment.......................................283
Re-pointing a destination site.............................................................284
Best practices..........................................................................................284
Current release limitations..................................................................288
Troubleshooting error messages........................................................290
Working with Firewalls 295Chapter 5
Understanding communication between BusinessObjects Enterprise
components.............................................................................................296
Overview of BusinessObjects Enterprise servers and communication
ports...................................................................................................296
Communication between BusinessObjects Enterprise components ..299
Configuring BusinessObjects Enterprise for firewalls..............................309
To configure the system for firewalls..................................................310
Examples of typical firewall scenarios.....................................................313
Example - Application tier deployed on a separate network..............314
Example - Rich client and database tier separated from BusinessObjects
Enterprise servers by a firewall..........................................................317
Contents

Working with Web Application Container Servers 321Chapter 6
Adding or removing services to WACS....................................................322
To add a CMC service to a WACS.....................................................322
To remove a CMC service from a WACS...........................................323
Web Application Container Server (WACS)............................................323
Do I need WACS?..............................................................................325
What are the advantages of using WACS?........................................325
Common Tasks...................................................................................326
Adding or removing additional WACS to your deployment......................329
Installing WACS..................................................................................330
Adding a new Web Application Container Server..............................332
Cloning a Web Application Container Server ....................................333
Deleting WACS servers from your deployment..................................334
Configuring HTTPS/SSL..........................................................................334
To generate a PKCS12 certificate file store.......................................335
To generate a Certificate Trust List....................................................336
To configure HTTPS/SSL...................................................................337
Supported authentication methods..........................................................340
Configuring AD Kerberos for WACS .......................................................340
Enabling Kerberos authentication in the Windows AD plug-in for
WACS.................................................................................................341
Creating configuration files.................................................................342
Configuring WACS for AD Kerberos..................................................345
Troubleshooting Kerberos..................................................................346
WACS and your IT environment..............................................................348
Using WACS with other web servers.................................................348
Using WACS with a load balancer.....................................................349
Using WACS with a reverse proxy.....................................................349
Using WACS with firewalls.................................................................350
Configuring WACS on a multihomed machine...................................351
Contents

Troubleshooting.......................................................................................352
To view server errors..........................................................................352
To view system metrics......................................................................353
To view the state of a WACS..............................................................354
Resolving port conflicts......................................................................354
To change memory settings...............................................................356
To change the number of concurrent requests...................................357
To restore system defaults.................................................................358
To prevent users from connecting to WACS through HTTP...............358
WACS properties.....................................................................................359
Modifying Default Security Behavior 361Chapter 7
BusinessObjects Enterprise and reverse proxy servers .........................362
Introduction to reverse proxy servers.................................................362
Supported reverse proxy servers ......................................................363
Understanding how BusinessObjects Enterprise web applications are
deployed ............................................................................................363
Configuring reverse proxy servers for BusinessObjects Enterprise web
applications..............................................................................................364
To configure the reverse proxy server ...............................................365
Detailed instructions for configuring reverse proxy servers for
BusinessObjects Enterprise...............................................................365
To configure Apache 2.2 reverse proxy server for BusinessObjects
Enterprise...........................................................................................367
To configure WebSEAL 6.0 reverse proxy server for BusinessObjects
Enterprise...........................................................................................368
To configure Microsoft ISA 2006 for BusinessObjects Enterprise......369
Special configuration for BusinessObjects Enterprise in reverse proxy
deployments............................................................................................373
Enabling reverse proxy for Developer Suite Web Services...............373
Enabling the root path for session cookies for ISA 2006...................376
Enabling reverse proxy for BusinessObjects Live Office...................379
Contents

Enabling reverse proxy for Business Process BI Web Services........380
Improving Performance 383Chapter 8
Improving performance............................................................................384
Assessing your system's performance....................................................384
Assessing user needs........................................................................385
Analyzing server metrics....................................................................386
Resolving performance issues................................................................396
Performance risks and solutions........................................................398
Improving Publishing performance..........................................................413
General deployment recommendations.............................................414
Configuring servers in the CMC to optimize Publishing performance.414
BIAR Command Line Tool 419Chapter 9
Biar Command Line Tool.........................................................................420
The Biar Engine Command Line Tool's Properties File ..........................423
To use the BIAR Command Line Tool......................................................429
Security Concepts 431Chapter 10
Security overview.....................................................................................432
Authentication and authorization.............................................................433
Primary authentication........................................................................434
Single sign-on support........................................................................436
Security plug-ins.................................................................................440
Processing extensions.......................................................................442
Active trust relationship............................................................................443
Logon tokens......................................................................................443
Ticket mechanism for distributed security..........................................444
Sessions and session tracking................................................................445
CMS session tracking.........................................................................446
Contents

Environment protection............................................................................446
Web browser to web server................................................................446
Web server to BusinessObjects Enterprise........................................447
Auditing web activity................................................................................447
Protection against malicious logon attempts......................................447
Password restrictions.........................................................................448
Logon restrictions...............................................................................448
User restrictions.................................................................................449
Guest account restrictions..................................................................449
Managing Licenses 451Chapter 11
Overview..................................................................................................452
Managing license information..................................................................452
To view license information......................................................................452
Adding a license key................................................................................452
To add a license key................................................................................452
Viewing current account activity..............................................................453
To view current account activity...............................................................453
Configuring Third-Party Authentication 455Chapter 12
Using NT Authentication .........................................................................456
Using NT user accounts and groups..................................................456
Windows NT security plug-in..............................................................456
NT user account and group administration........................................457
Mapping NT user accounts and groups.............................................458
Modifying the web.config file for NT single sign-on............................466
Using LDAP authentication......................................................................467
Managing LDAP accounts..................................................................467
Using AD authentication..........................................................................486
Windows AD security plug-in..............................................................488
Contents

Using AD users and groups...............................................................489
Configuring manual AD authentication...............................................496
Configuring AD single sign on............................................................519
Enabling Trusted Authentication..............................................................561
Configuring the server for Trusted Authentication..............................562
Configuring Trusted Authentication for the client...............................563
Configuring Trusted Authentication for Business Process BI.............570
Managing Auditing 571Chapter 13
How does auditing work?.........................................................................572
Configuring auditing.................................................................................578
Which events can I audit?..................................................................581
Enabling auditing of user and system events..........................................597
To enable auditing events for client applications................................600
Auditing Configuration Template..............................................................600
To set the Configuration template......................................................601
Configuring the universe connection.......................................................602
Using sample auditing reports.................................................................603
Controlling synchronization of auditing actions.......................................604
Optimizing system performance while auditing.......................................605
Auditing Reports 607Chapter 14
Using auditing reports..............................................................................608
Why are reports important?................................................................608
Auditing report names........................................................................611
Viewing sample auditing reports..............................................................623
Creating custom auditing reports.............................................................624
Auditing database schema reference......................................................624
Audit_Event........................................................................................624
Audit_Detail .......................................................................................625
Contents

Server_Process..................................................................................626
Event_Type........................................................................................627
Application_Type................................................................................628
Detail_Type tables..............................................................................628
Event and Detail reference tables...........................................................629
Server Command Lines 649Chapter 15
Command lines overview.........................................................................650
Standard options for all servers...............................................................651
UNIX signal handling..........................................................................654
Central Management Server...................................................................654
Central Configuration Manager (CCM)....................................................659
Crystal Reports Processing Server and Crystal Reports Cache Server...660
Job servers..............................................................................................663
Report Application Server........................................................................666
Web Intelligence Processing Server........................................................670
Input and Output File Repository Servers...............................................672
Event Server............................................................................................675
UNIX Tools 677Chapter 16
Script utilities............................................................................................678
ccm.sh................................................................................................678
cmsdbsetup.sh...................................................................................684
configpatch.sh....................................................................................684
serverconfig.sh...................................................................................684
uninstallBOBJE.sh..............................................................................686
Script templates.......................................................................................686
startservers.........................................................................................686
stopservers.........................................................................................687
silentinstall.sh.....................................................................................687
Contents

Scripts used by BusinessObjects Enterprise...........................................688
bobjerestart.sh....................................................................................688
env.sh.................................................................................................688
env-locale.sh......................................................................................688
initlaunch.sh.......................................................................................689
patchlevel.sh......................................................................................689
postinstall.sh.......................................................................................690
setup.sh..............................................................................................690
setupinit.sh.........................................................................................690
Working with the Central Management Console 691Chapter 17
Overview..................................................................................................692
Using the CMC........................................................................................692
Logging on to the CMC......................................................................693
Navigating within the CMC.................................................................694
Setting CMC preferences...................................................................694
Making initial security settings.................................................................697
Setting the Administrator password...................................................697
Disabling a user account....................................................................698
Setting Rights 699Chapter 18
How rights work in BusinessObjects Enterprise......................................700
Access levels......................................................................................701
Advanced rights settings....................................................................701
Inheritance..........................................................................................702
Type-specific rights.............................................................................709
Determining effective rights................................................................711
Managing security settings for objects in the CMC.................................712
To view rights for a principal on an object..........................................712
To assign principals to an access control list for an object.................714
Contents

To modify security for a principal on an object...................................714
To set rights on a top-level folder in BusinessObjects Enterprise......715
Checking security settings for a principal...........................................716
Working with access levels......................................................................720
Choosing between View and View On Demand access levels..........723
To copy an existing access level........................................................725
To create a new access level.............................................................725
To rename an access level.................................................................725
To delete an access level...................................................................726
To modify rights in an access level.....................................................726
Tracing the relationship between access levels and objects..............728
Managing access levels across sites.................................................728
Breaking inheritance................................................................................730
To disable inheritance.........................................................................731
Using rights to delegate administration...................................................732
Choosing between Modify the rights users have to objects options...734
Owner rights.......................................................................................736
Summary of recommendations for rights administration.........................737
Managing Users and Groups 739Chapter 19
Account management overview..............................................................740
User management..............................................................................740
Group management...........................................................................741
Available authentication types ...........................................................743
Managing Enterprise and general accounts............................................745
To add subgroups...............................................................................750
Adding users to groups......................................................................752
Changing password settings..............................................................753
Enabling Trusted Authentication........................................................755
Granting access to users and groups................................................757
Controlling access to user inboxes....................................................757
Contents

Configuring the InfoView logon screen...............................................757
Managing aliases.....................................................................................759
Managing Applications 765Chapter 20
Overview..................................................................................................766
Setting user rights on applications...........................................................766
Managing Discussions settings...............................................................767
To manage Discussions settings in the CMC ....................................767
To search for a discussion thread......................................................767
To sort your discussion thread search results....................................769
To delete a discussion thread.............................................................769
Setting user rights..............................................................................770
Managing InfoView settings.....................................................................770
To change display settings for InfoView.............................................770
Managing Web Intelligence settings........................................................771
To modify display settings in Web Intelligence...................................772
Managing BI Widgets settings.................................................................772
Managing Polestar settings.....................................................................773
To modify Polestar application properties..........................................773
Managing Data Sources and Connections 775Chapter 21
Overview..................................................................................................776
Data source connections.........................................................................776
Managing universes.................................................................................777
To delete universes............................................................................777
Managing universe connections..............................................................777
To delete a universe connection.........................................................777
Controlling access to universe connections.......................................777
Contents

Working with Content Objects 779Chapter 22
Overview..................................................................................................780
General object management...................................................................780
To copy an object...............................................................................780
To move an object..............................................................................781
To create an object shortcut...............................................................781
Relationships......................................................................................787
Report object management.....................................................................789
What are report objects and instances?.............................................789
Setting report refresh options.............................................................790
Setting report processing options.......................................................792
Processing extensions.......................................................................803
Applying processing extensions to reports.........................................804
Working with hyperlinked reports ......................................................808
Program object management..................................................................812
What are program objects and instances?.........................................812
Setting program processing options...................................................814
Authentication and program objects...................................................819
Object package management..................................................................821
What are object packages, components, and instances?..................821
Adding objects to an object package.................................................823
Configuring object packages and their objects..................................824
Authentication and object packages..................................................824
Scheduling Objects 825Chapter 23
Overview..................................................................................................826
Scheduling...............................................................................................826
About the recurrence options and parameters...................................826
Scheduling objects using object packages........................................832
Contents

Scheduling an object with events.......................................................832
Setting general scheduling options..........................................................835
Setting notification for the success or failure of a scheduling job.......835
Specifying alert notification.................................................................839
Selecting a destination.......................................................................841
Choosing a format..............................................................................852
Selecting cache options for Web Intelligence or Desktop Intelligence
documents..........................................................................................863
Scheduling an object for a user or group...........................................864
Selecting server group settings..........................................................865
Managing instances.................................................................................866
Managing and viewing the history of instances..................................867
Setting instance limits for an object....................................................873
Using calendars.......................................................................................874
Calendars overview............................................................................874
Creating calendars.............................................................................875
Adding dates to a calendar.................................................................876
Deleting calendars..............................................................................881
Specifying calendar rights..................................................................882
Managing events.....................................................................................882
Managing events overview.................................................................882
File-based events...............................................................................883
Schedule-based events......................................................................885
Custom events...................................................................................886
Specifying event rights.......................................................................887
To run objects now...................................................................................888
Organizing Objects 889Chapter 24
Overview..................................................................................................890
Organizing objects overview....................................................................890
About folders .....................................................................................890
Contents

About categories................................................................................891
Working with folders................................................................................891
Creating and deleting folders.............................................................891
Copying and moving folders...............................................................893
Adding new objects to a folder...........................................................894
Specifying folder rights.......................................................................895
Setting limits for folders, users, and groups.......................................895
Managing Personal Folders...............................................................897
Working with categories...........................................................................897
Specifying category rights..................................................................900
Adding Objects to the Repository 901Chapter 25
Overview..................................................................................................902
Options for adding Crystal reports.....................................................902
Publishing Wizard procedures.................................................................903
Saving objects directly to the CMS..........................................................917
Publishing and Publications 919Chapter 26
Overview..................................................................................................920
About Publishing......................................................................................920
What is a publication?........................................................................920
Publishing workflow............................................................................922
Rights required for Publishing............................................................923
Publication concepts................................................................................925
Report bursting...................................................................................925
Delivery rules......................................................................................927
Dynamic recipients.............................................................................929
Destinations........................................................................................931
Formats..............................................................................................935
Personalization...................................................................................937
Contents

Subscription........................................................................................938
To create a new publication in the CMC..................................................939
To create a new publication in InfoView...................................................939
Managing Profiles 941Chapter 27
How profiles work....................................................................................942
Profiles and the Publishing workflow..................................................942
Profile targets and profile values.............................................................944
To specify a global profile target.........................................................945
Specifying profile values.....................................................................946
Resolving conflicts between profiles........................................................949
Conflicts between profile values.........................................................950
Specifying profile rights............................................................................951
Content Search 953Chapter 28
Content Search overview.........................................................................954
Searchable document types...............................................................954
Search syntax and interpretation.......................................................956
Multilingual search..............................................................................958
Content Search and instances...........................................................959
Facets and labels...............................................................................959
Prompts and Parameters...................................................................959
Reports with view time security..........................................................960
Suggested queries.............................................................................961
Limited number of search results.......................................................962
Excluding documents from Content Search.......................................962
Servers and architecture..........................................................................963
Deploying the Content Search service....................................................964
Planning your Content Search deployment........................................964
Installation and Upgrade....................................................................966
Contents

Configuration...........................................................................................966
Managing Content Search application settings..................................966
Setting rights for the Content Search application...............................970
Disabling and removing Content Search............................................970
Maximum group instances indexed....................................................971
JVM Heap Size...................................................................................972
Understanding and managing the indexing process...............................973
Preparing for the initial indexing.........................................................973
Creating the initial index.....................................................................974
Managing the indexing program object..............................................974
Terminating the indexing process.......................................................977
Troubleshooting.......................................................................................978
To troubleshoot an indexing failure ...................................................978
To clean up after unplanned system downtime .................................979
Rights Appendix 981Chapter 29
About the rights appendix........................................................................982
General rights..........................................................................................982
Rights for specific object types................................................................986
Folder rights.......................................................................................986
Categories..........................................................................................986
Notes..................................................................................................987
Crystal reports....................................................................................988
Desktop Intelligence documents........................................................989
Web Intelligence documents..............................................................990
Users and groups...............................................................................992
Access levels......................................................................................993
Dashboards........................................................................................994
Universes...........................................................................................995
Applications........................................................................................998
Contents

Server Properties Appendix 1027Chapter 30
About the server properties appendix....................................................1028
Common Server Settings.......................................................................1028
Core Server Settings.............................................................................1030
Crystal Reports Server Settings............................................................1045
Web Intelligence Server Settings...........................................................1056
Web Intelligence Server Memory Threshold Settings .....................1064
Desktop Intelligence Server Settings.....................................................1065
Voyager Server Settings........................................................................1074
Performance Management Server Settings..........................................1076
More Information 1077Appendix A
Index 1081
Contents

About this help
This help provides you with information and procedures for deploying and
configuring your BusinessObjects Enterprise system. Procedures are provided
for common tasks. Conceptual information and technical details are provided
for all advanced topics.
For daily maintenance tasks and procedures for working with the CMC, see
the BusinessObjects Enterprise Administrator's Guide.
For information about installing BusinessObjects Enterprise, see the
BusinessObjects Enterprise Installation Guide.
Who should use this help?
This help covers deployment and configuration tasks. We recommend
consulting this guide if you are:
• planning your first deployment
• configuring your first deployment
• making significant changes to the architecture of an existing deployment
• improving your system's performance.
This help is intended for system administrators who are responsible for
configuring, managing, and maintaining a BusinessObjects Enterprise
installation. Familiarity with your operating system and your network
environment is beneficial, as is a general understanding of web application
server management and scripting technologies. However, to assist all levels
of administrative experience, this help aims to provide sufficient background
and conceptual information to clarify all administrative tasks and features.
About BusinessObjects Enterprise
BusinessObjects Enterprise is a flexible, scalable, and reliable solution for
delivering powerful, interactive reports to end users via any web
application—intranet, extranet, Internet or corporate portal. Whether it is
used for distributing weekly sales reports, providing customers with
Getting Started
1 About this help

personalized service offerings, or integrating critical information into corporate
portals, BusinessObjects Enterprise delivers tangible benefits that extend
across and beyond the organization. As an integrated suite for reporting,
analysis, and information delivery, BusinessObjects Enterprise provides a
solution for increasing end-user productivity and reducing administrative
efforts.
What's new in BusinessObjects Enterprise
XI 3.1?
This version of BusinessObjects Enterprise introduces many new features
and enhancements. The following table briefly describes these features and
where to find more information about them.
Documentation resourcesWhat's New
• About Server Intelli-
gence on page 130
• Server management:
what's new in this ver-
sion of BusinessObjects
Enterprise on page 131
Server management: Server management is
now handled through the CMC and the Server
Intelligence Agent (SIA).
• Federation on page 234
Federation: This cross-site replication tool al-
lows you to manage content from a BusinessOb-
jects Enterprise deployment (Origin site) and
replicate it to other BusinessObjects Enterprise
deployments (Destination sites).
• About Publishing on
page 920
• For more information,
see the BusinessObjects
Enterprise Publisher's
Guide. The latest ver-
sion of the PDF is avail-
able on the Business
Objects technical sup-
port site.
Publishing: This version features user interface
improvements to the Publishing feature. Also,
all report bursting methods are now supported
for Web Intelligence document publications.
1Getting Started
What's new in BusinessObjects Enterprise XI 3.1?

Documentation resourcesWhat's New
• Instance Manager on
page 869
• Managing instances on
page 866
Instance Manager: In this release, the Instance
Manager shows more details for listed in-
stances.
• Web Application Contain-
er Server (WACS) on
page 323
Web Application Container Server (WACS): The
WACS is a service that hosts the CMC for users
that are installing BusinessObjects Enterprise
on a Windows environment and don't want to
deploy the CMC to a Java application server.
• Scheduling AD updates
on page 494
Windows Active Directory authentication: Multi-
forest support is integrated into the process of
using the CMC to set up AD authentication with
either the Kerberos or NTLM protocols.
• Network environment
options on page 160
Server settings: BusinessObjects servers now
support IPv6.
• To configure Microsoft
ISA 2006 for Busines-
sObjects Enterprise on
page 369
Reverse proxy: Microsoft ISA 2006 is now
supported as a reverse proxy server.
Online documentation library
A completely new interface to the full documentation set now has guides for
all Business Objects products. The new online documentation library has
the most up-to-date version of the Business Objects product documentation,
posted upon publication and updated regularly. You can browse the library
contents, run full-text searches, read guides on line, and download PDFs.
http://support.businessobjects.com/documentation/product_guides/default.asp
Getting Started
1 What's new in BusinessObjects Enterprise XI 3.1?

Where should I start?
Depending on your situation, you may want to focus on specific sections of
this help, and there may be other resources available for you. For each of
the following situations, there is a list of suggested tasks and reading topics.
• Planning or performing your first deployment on page 29
• Configuring your deployment on page 30
• Changing your deployment's architecture on page 30
• Improving your system's performance on page 31
• Working with objects in the CMC on page 31
Planning or performing your first deployment
If you are planning or performing your first deployment of BusinessObjects
Enterprise, it is recommended that you perform the following tasks and read
the corresponding sections:
• To get familiar with the components, read Architecture overview on
page 36.
• To assess your needs and design a deployment architecture that works
best for you, read the BusinessObjects Enterprise Deployment Planning
Guide.
• Understanding communication between BusinessObjects Enterprise
components on page 296
• Security overview on page 432
• If you plan to use third-party authentication, read Configuring Third-Party
Authentication on page 455
• For advice about assessing your anticipated performance needs, see
Improving performance on page 384.
• For more information about installing BusinessObjects Enterprise, see
the BusinessObjects Enterprise Installation Guide.
• After you install, read Server management overview on page 122.
1Getting Started

Configuring your deployment
If you have just completed your installation of BusinessObjects Enterprise
and need to perform initial configuration tasks, such as firewall configuration
and user management, it is recommended that you read the following
sections:
• Server management overview on page 122
• If you plan to use third-party authentication, read Configuring Third-Party
Authentication on page 455
• For advice about assessing and improving your system's performance,
see Improving performance on page 384.
• If you want to monitor your existing system, read Managing Auditing on
page 571 and Auditing Reports on page 607.
Changing your deployment's architecture
Are you expecting a significant increase in server traffic? Do you need to
accommodate a sudden influx of users? Do you need to incorporate new
kinds of content from new sources? Or do you need to update a deployment
that didn't adequately anticipate the volume of objects being processed on
a daily basis?
If you need to revise your deployment to account for significant changes in
how you use the system, it is recommended that you read the following
sections:
• If you are installing new server components, see Server management
overview on page 122.
• If you are importing or configuring new users, see Account management
Getting Started
1 Where should I start?

• For information about installing new components, you can find more
information in the BusinessObjects Enterprise Installation Guide.
Improving your system's performance
If you want to assess your deployment's efficiency and fine-tune it in order
to maximize resources, it is recommended that you read the following
sections:
• If you want to monitor your existing system, read Managing Auditing on
page 571 and Auditing Reports on page 607.
• For daily maintenance tasks and procedures for working with servers in
the CMC, see Server management overview on page 122.
Working with objects in the CMC
If you are working with objects in the CMC, read the following sections:
• To get started with the CMC, see Using the CMC on page 692.
• For information about setting up users and groups in the CMC, see
Account management overview on page 740.
• To add objects to BusinessObjects Enterprise, see Overview on page 902.
• To set security on objects, see How rights work in BusinessObjects
Enterprise on page 700.
• For general information about working with objects, see General object
management on page 780.
• To organize objects, see Organizing objects overview on page 890.
• To schedule objects in BusinessObjects Enterprise, see Scheduling on
page 826
1Getting Started

BusinessObjects Enterprise guides
The following table provides a list of BusinessObjects Enterprise guides and
their contents.
DescriptionGuide
Covers the key concepts you should con-
sider before you begin deploying Busines-
sObjects Enterprise. This guide includes
an overview of the architecture, tips for as-
sessing your existing environment, deter-
mining your organization's needs, and
preparing for the installation.
Planning Guide
Leads you through the steps required to
run the setup program and complete your
installation of BusinessObjects Enterprise.
There are UNIX and Windows versions of
this guide available.
Installation Guide
Covers topics related to the deployment of
web applications to web application servers
with BusinessObjects Enterprise. There are
UNIX and Windows versions of this guide
available.
Web Application Deployment
Guide
Provides content for server and content
administration. The server administration
topics includes server configuration, man-
aging authentication, configuring firewalls,
and measuring system performance. The
content administration topics include work-
ing with the CMC, configuring rights and
access levels, managing users, and work-
ing with Business Objects applications and
objects.
Administrator's Guide
Getting Started
1 BusinessObjects Enterprise guides

DescriptionGuide
Provides an overview of the publishing
process, working with publications, publish-
ing Crystal reports, publishing Web Intelli-
gence documents, publishing Desktop In-
telligence documents, and publishing secu-
rity.
Publisher's Guide
Details content migration from legacy
Business Objects software, such as Classic
or Enterprise 5 or 6, to BusinessObjects
Enterprise XI 3.1.
BusinessObjects 5/6 to XI 3.1
Migration Guide
Information for upgrades from BusinessOb-
jects Enterprise XI to BusinessObjects En-
terprise XI 3.1.
Upgrade Guide
Provides an overview of InfoView and
working with Crystal Reports, Web Intelli-
gence, objects, discussions, encyclopedia,
and Voyager workspaces.
InfoView User's Guide
For a complete list of all of our product documentation please visit:
http://support.businessobjects.com/documentation/product_guides/default.asp
1Getting Started
BusinessObjects Enterprise guides

Getting Started
1 BusinessObjects Enterprise guides

Architecture overview
This section outlines the overall platform architecture, system, and service
components that make up the BusinessObjects Enterprise Business
Intelligence (BI) platform. This information will help administrators understand
the system essentials, and help to form a plan for the deployment,
management, and maintenance of an BusinessObjects Enterprise installation.
Business Intelligence is the process of taking raw data stored in databases,
and turning it into useful information in the form of reports that can be used
to make business decisions. BI reports can be used internally and externally
throughout an organization to make tactical decisions, reduce costs,
streamline operations, build better products, increase sales, or deepen
customer relationships.
BusinessObjects Enterprise includes specialized services including Web
Intelligence, Desktop Intelligence, and Crystal Reports components, and a
set of Dashboard and Analytics services for metrics management, predictive
analysis, and process analysis. These services are available to software
created by your own organization through several application programming
interfaces (APIs).
BusinessObjects Enterprise is designed for high performance across a broad
spectrum of user and deployment scenarios. For example, specialized
platform services handle either on-demand data access and report generation,
or report scheduling based on times and events. You can offload processor
intensive scheduling and processing to dedicated servers to improve
performance. The architecture is designed to meet the needs of virtually any
BI deployment, and is flexible enough to grow from several users with a
single tool, to tens of thousands of users with multiple tools and interfaces.
Developers can access the platform using a set of web services and Java
and .NET APIs to integrate BusinessObjects Enterprise into your
organization's systems, and to share dynamically updated documents with
users on separate networks.
End users can access, create, edit, and interact with reports using specialized
tools and applications that include:
• Crystal Reports.
• Web Intelligence.
• Desktop Intelligence.
• Voyager.
Architecture
2 Architecture overview

• Dashboard and Analytics.
• Dashboard Builder.
IT departments can use data and system management tools that include:
• Central Management Console.
• Central Configuration Manager.
• Import Wizard.
• Publishing Wizard.
• Universe Designer.
• Repository Diagnostic Tool.
To provide flexibility, reliability, and scalability, the components that make
up BusinessObjects Enterprise can be installed on one or many machines.
You can even install two BusinessObjects Enterprise deployments
simultaneously on the same hardware, although this configuration is
recommended only for upgrade or testing purposes.
Server processes can be "vertically scaled" (where one computer runs
several, or all, server-side processes) to reduce cost, or "horizontally scaled"
(where server processes are distributed between two or more networked
machines) to improve performance. It is also possible to run duplicate
instances of a server process on the same machine, or across several
networked machines.
Note:
While it is possible to deploy a mixture of Windows and Unix platforms at
the tier level (such as a Unix web application server with a Windows CMS),
it is recommended that you do not mix operating systems for server processes
(such as a cluster of two CMS systems where one runs Windows and the
other runs Unix).
2Architecture

Enterprise infrastructure
The Enterprise Infrastructure provides the basic messaging mechanism
needed for BusinessObjects Enterprise components to communicate with
one another. The Enterprise Infrastructure is a series of services that are
designed to communicate via CORBA (Common Object Request Broker
Architecture), which runs over TCP/IP.
Some CORBA applications use a name server. The name server service is
a facility of the underlying CORBA architecture that binds the BusinessObjects
Enterprise servers together. The name server provides a directory of the
servers registered in the BusinessObjects Enterprise environment and helps
establish connections between clients and these servers. The name server
service is a part of the Central Management Server (CMS).
Architecture

The Enterprise Infrastructure provides the framework for establishing
connections between clients and servers:
• It is the centerpiece of BusinessObjects Enterprise technology, and
facilitates communication between servers.
• A client object can transparently make requests to server objects using
the Enterprise Infrastructure.
• A server object is a server that participates in serving requests to client
objects.
• A client object is a client that makes requests to servers on the
Enterprise Infrastructure.
Note:
In the BusinessObjects Enterprise environment, most services act as clients
and servers to each other during transactions between the servers.
When a BusinessObjects Enterprise server starts, it registers itself with the
name server in the CMS. The server provides information about itself, such
as its IP address, TCP port, and description of the server, and a list of services
it provides, to the name server.
Each individual server polls the CMS every 60 seconds to get an updated
list of provided services.
BusinessObjects Enterprise web services
The web services are server-side components that process requests from
client applications and communicate these requests to the appropriate server.
They include support for report viewing, and logic to understand and direct
web requests to the appropriate BusinessObjects Enterprise server.
BusinessObjects Enterprise web services are hosted on the web application
server. Web services use the BusinessObjects Enterprise SDK to interface
with the rest of the BusinessObjects Enterprise services. The web application
server acts as a gateway between the browser and the rest of the components
in BusinessObjects Enterprise.
Note:
When configuring servers using the Central Management Console, the CMS
holds the configuration settings and the CMS communicates with all
BusinessObjects Enterprise servers.
2Architecture

Business Objects web services provide a Java and .NET consumers API
accessed by rich clients in the user interaction tier, such as Live Office and
Crystal Reports.
Web Services consists of software components that can be called remotely
using the Simple Object Access Protocol (SOAP). SOAP is a protocol for
exchanging information that is not dependent on a specific platform, object
model, or programming language.
BusinessObjects Enterprise Web Services provide services in the following
areas:
• Session: Authentication and user privilege management.
• BI platform: Exposes advanced platform features such as scheduling,
search, user and group administration, server administration, platform
events, and calendars.
• Report Engine: Displays Web Intelligence and Crystal Reports in HTML,
PDF, Excel, and XML format.
• Query: Builds ad hoc queries based on the Business Objects universe
semantic layer.
BusinessObjects Enterprise management services
The management services manage the BusinessObjects Enterprise system.
These services maintain all security information, send requests to the
appropriate services, manage auditing information, and maintain a record
of each and every instance and its location.
The management services are provided by:
• Central Management Service running on the Central Management Server
(CMS)
The CMS is responsible for authenticating users and groups, and keeping
track of the availability of the other BusinessObjects Enterprise services.
It also maintains the BusinessObjects Enterprise system database, which
includes information about users, groups, security levels, BusinessObjects
Enterprise content, and services. The CMS also maintains a separate
audit database of information about user actions and manages the
BusinessObjects system database.
Architecture

Note:
• All servers communicate with the CMS when they start up.
• The Audit Database is optional in a regular system deployment. It
allows for extra auditing and tracking of some system information.
• Event Service running on the Event Server
The Event Server manages file-based events. It monitors the directory
you specified when setting up a file-based event. When the appropriate
file appears in the monitored directory, the Event Server triggers a
file-based event.
BusinessObjects Enterprise storage services
The storage services are responsible for storing objects and object instances.
The storage services are:
• Input File Repository Service running on the Input File Repository Server
The Input File Repository Service manages all of the report and program
objects that have been published to the system. It can store the following
files: .rpt, .car, .exe, .bat, .js, .xls, .doc, .ppt, .rtf, .txt, .pdf,
.wid, .rep, or .unv.
• Output File Repository Service running on the Output File Repository
Server
The Output File Repository Service manages all of the report instances
generated by the Crystal Reports Job Service and the program instances
generated by the Program Job Service. It also manages instances
generated by the Desktop or Web Intelligence Processing Services, and
the List of Values (LOV) Job Service.
It can store the following files: .rpt, .csv, .xls, .doc, .rtf, .txt, .pdf,
.wid, or .rep.
Note:
.rpt and .wid files are stored as report documents with saved data.
• Crystal Reports Cache Service running on the Crystal Reports Cache
Server
2Architecture

The Crystal Reports Cache Service maintains a folder of cached report
EPF files and determines if a request can be fulfilled with a cached report
page. If the request cannot be fulfilled with a cached report page, it passes
the request to the Crystal Reports Processing Service.
The benefit of caching is that BusinessObjects Enterprise doesn't have
to generate .epf files each time a page is viewed. Therefore, report pages
that have been cached can be shared among users.
• Desktop Intelligence Cache Service running on the Desktop Intelligence
Cache Server
The Desktop Intelligence Cache Service handles viewing requests for
Desktop Intelligence documents and manages the viewable pages created
by the Desktop Intelligence Processing Service.
BusinessObjects Enterprise processing services
The processing services access the data and generate reports. This is the
only tier that interacts directly with the databases that contain report data.
Which services become involved with reporting is determined by whether
the object is being scheduled or viewed on demand. Viewer choice also plays
a role in determining which services and servers are involved in reporting.
The processing services are:
• Program Job Service running on the Program Job Server
The Program Job Service processes program objects, as requested by
the CMS, and generates program instances.
• Crystal Reports Job Service running on the Crystal Reports Job Server
The Crystal Reports Job Service schedules and processes report objects,
creating report instances at the request of the Central Management Server
(CMS).
Note:
Both the Program Job Service and the Crystal Reports Job Service retrieve
the document to be run from the Input File Repository Service, run the
report or program, and then save the processed file to the Output File
Repository Service as an instance.
Architecture

• Web Intelligence Job Service running on the Adaptive Job Server
The Web Intelligence Job Service receives scheduled Web Intelligence
document requests from the CMS and forwards them to the Web
Intelligence server for processing.
Note:
It is not the Adaptive Job Server itself that processes Web Intelligence
documents, but rather the Web Intelligence Job Service hosted by the
Adaptive Job Server (AJS). The AJS can be configured to run with or
without the Web Intelligence Job Service.
• Web Intelligence Processing Service running on the Web Intelligence
Processing Server
The Web Intelligence Processing Service processes Web Intelligence
Document requests.
• List of Values (LOV) Job Service running on the LOV Job Server
The List of Values Job Service receives scheduling requests from the
Business View manager and processes scheduled List of Values objects
to populate them with values retrieved from a database.
• Desktop Intelligence Job Service running on the Desktop Intelligence Job
Server
The Desktop Intelligence Job Service processes scheduling requests
received from the CMS for Desktop Intelligence documents and generates
instances of the Desktop Intelligence document.
• Desktop Intelligence Processing Service running on the Desktop
Intelligence Processing Server
The Desktop Intelligence Processing Service processes viewing requests
for Desktop Intelligence documents, generating Desktop Intelligence
documents.
• Connection Service running on the Connection Server
The Connection Service is responsible for the database connectivity to
access data. It is invoked when users want to edit and view Desktop or
Web Intelligence documents through InfoView. It is also used by some
EPM services.
2Architecture

Note:
The Connection Service libraries are present on the Web Intelligence
Processing Server, and Desktop Intelligence Processing Server. These
libraries allow services to query the database directly without
communicating with the Connection Server service.
• Publishing Post Processing Service running on the Adaptive Processing
Server
This service is responsible for any post processing of a publication job,
including PDF merging and publication extension processing.
• Web Application Container Service (WACS)
The Web Application Container Service (WACS) provides a platform for
hosting BusinessObjects Enterprise web applications, such as the Central
Management Console (CMC).
Web applications such as the CMC are automatically deployed to WACS.
WACS does not support deploying Business Objects or external web
applications, whether manually or by using the wdeploy tool.
The viewing processing services are:
• Crystal Reports Processing Service running on the Crystal Reports
Processing Server
The Crystal Reports Processing Service is responsible for generating
Crystal Reports pages for viewing. The Crystal Reports Processing Service
retrieves data for the report from the latest instance or directly from a
database. After it generates the report, the Processing Service converts
the requested data to one or more EPF files. These files are then sent to
the Crystal Reports Cache Service.
• Web Intelligence Processing Service running on the Web Intelligence
Processing Server
The Web Intelligence Processing Service is responsible for generating
Web Intelligence documents. The Web Intelligence Processing Service
obtains document creation requests from the web application server and
then communicates with the Input File Repository Service in order to
obtain a copy of the Web Intelligence Document (WID) file and the
universe definition. When viewing an existing instance of a WID, the Web
Intelligence Processing Service communicates with the Output File
Repository Service to obtain an existing historical instance of a WID.
Architecture

• Report Application Service running on the Report Application Server
Report Application Service resolves Dynamic Recipient Lists at design
time and Runtime in Publishing, as well as with LiveOffice. The RAS also
provides the ad hoc reporting capabilities that allow users to create and
modify reports over the Web.
As with the Crystal Reports Processing Service, the RAS supports Java
viewer SDKs. The Report Application Service also includes an SDK for
report creation and modification, providing you with tools for building
custom report interaction interfaces.
• Multi-Dimensional Analysis Service running on the Multi-Dimensional
Analysis Server
The Multi-Dimensional Analysis Server (MDAS) is a dedicated server
intended to interact with OLAP data sources and to support Voyager.
The MDAS needs an appropriate OLAP database client configured for
the appropriate OLAP data source. The list of providers is dynamically
generated, based on which database drivers are installed on the MDAS.
If more than one MDAS exists, the server contacted is selected randomly,
so the same drivers should be installed on all servers. Connections to
OLAP data sources are defined and managed from the CMC. Entries can
include:
• Oracle
• SAP
• Essbase
• Microsoft Analysis Services 8.0 (MSAS 2000)
• Microsoft Analysis Services 9.0 (MSAS 2005)
• Search Service running on the Adaptive Processing Server
The Search Service processes search requests and executes the indexing.
Your deployment can include multiple Search service, and search requests
are actively processed by all available servers. However, only one Search
service performs the indexing process.
• Client Auditing Proxy Service running on the Adaptive Processing Server
The Client Auditing Proxy Service monitors connected Rich Web
Intelligence and Rich Desktop Intelligence clients and forwards the
information to the auditing server. Rich clients working locally, not
2Architecture

connected to a repository, are not audited by the Client Auditing Proxy
Service.
• Publishing Service running on the Adaptive Processing Server
The Publishing Service coordinates the publication of an object by
communicating with other services to process the publication.
Server Intelligence
Server Intelligence is a component of the Central Management Console
(CMC) that simplifies administrative procedures previously carried out by
the Central Configuration Manager (CCM), such as the management of CMC
server processes. This includes the addition and removal of server processes,
server process configuration, and the automatic restart or shutdown of servers
that encounter unexpected conditions.
Server Intelligence also archives server process information in the CMS
database so you can easily restore default server settings, or create
redundant instances of server processes with the same settings.
Note:
The CCM is a tool that allows you to configure and manage the Server
Intelligence Agent. The Server Intelligence Agent is the component that
allows you to manage all servers through the CMC. You can also use the
CCM to create and manage nodes in your deployment.
Life-Cycle Management (LCM)
BusinessObjects Enterprise contains new Life-Cycle Management modules
that gives you control over your life cycles of system objects.
Life-Cycle Management refers to the set of processes involved in managing
information related to a product life cycle, from the stage of concept through
delivery. It establishes procedures for governing the entire product life cycle,
which includes phases such as development, production, testing, and so on.
The BI resources that are present in the development repository must be
transferred to the testing repository for testing deployment. These phases
can occur at the same site or at different geographical locations. The time
Architecture

required to transfer the resources from one repository to another repository
must be minimal, to obtain a high-quality and competitive product. These
resources also have dependencies that have to be moved from one repository
to another. The dependencies of resources add more complexity to the
problem, because these resources have to move along with the dependents.
For more information, see the BusinessObjects Enterprise Life-Cycle Manager
User's Guide for XI 3.1.
Life-Cycle Manager
BusinessObjects LifeCycle Manager (LCM) is a web-based tool that enables
you to move BI resources from one system to another system, without
affecting the dependencies of these resources. It also enables you to manage
different versions of BI resources, manage dependencies of BI resources,
and roll back a promoted resource to restore the destination system to its
previous state.
The LCM tool is a plug-in for the BusinessObjects Enterprise application.
You can promote a BI resource from one system to another system only if
the same version of the BusinessObjects Enterprise application is installed
on both the source and destination systems.
Clients
Two different types of applications are available: web browser clients, and
rich desktop application clients installed on a Microsoft Windows operating
system.
Browser-based web applications
This category is made up of light-weight, web browser-based client front-ends
that run on all supported operating system platforms. A web application
server receives client requests and interfaces with the BusinessObjects
Enterprise intelligence and processing tiers to return data to the users' web
browsers. This approach allows you to provide business intelligence (BI)
access to large groups of users, without the challenges of deploying desktop
software products. Communication is conducted over HTTP and can be
secured with SSL by enabling HTTPS encryption on the web application
server. Examples of this type of application include the InfoView, Web
Intelligence, Central Management Console (CMC), and report viewers.
2Architecture
Clients

Desktop applications
The second category is made up of locally installed, rich-client applications
installed on a supported Microsoft Windows operating system. This approach
allows you to offload BI processing from BusinessObjects Enterprise onto
individual client computers. Most desktop applications directly access your
organization's data through drivers installed on the desktop, and communicate
with your BusinessObjects Enterprise deployment through CORBA or
encrypted CORBA SSL. Examples of this type of application include Crystal
Reports, Desktop Intelligence, and Live Office clients.
Note:
Although Live Office is a desktop application, it communicates with
BusinessObjects Enterprise web services over HTTP. You can configure
BusinessObjects Enterprise so that Microsoft Office documents containing
Live Office components dynamically update, even when sent to recipients
outside your organization's secured network.
Browser-based web application clients
Browser-based web application clients reside on a web application server,
and run in a web browser.
Web applications are automatically deployed by the setup program when
you install BusinessObjects Enterprise. Java web applications can also be
reconfigured or deployed after the initial installation using the bundled wdeploy
command-line tool. The wdeploy tool is designed to speed up and simplify
deployment to Java web application severs. Based on the Apache Ant
scripting tool, wdeploy allows you to deploy WAR files to a web application
server in two ways:
1. Standalone mode.
All web application resources are deployed together on a web application
server that serves both dynamic and static content.
2. Split mode.
The application's dynamic and static resources are separated: static
content is deployed to a web server; dynamic content is deployed to a
web application server.
Architecture
2 Clients

For more information about wdeploy, see the BusinessObjects Enterprise
Web Application Deployment Guide.
BusinessObjects Mobile
BusinessObjects Mobile allows your organization access to information from
any wireless device. Management and information workers can stay
up-to-date and make decisions with access to the latest information. Sales
and field service staff can provide the right customer, product, and work order
information, where and when it's needed, helping to shorten sales cycles,
and increasing customer satisfaction.
Central Management Console (CMC)
The Central Management Console (CMC) is a web-based tool to perform
regular administrative tasks, including user, content, and server management.
It also allows you to publish, organize, and set security levels for all of your
BusinessObjects Enterprise content. Because the CMC is a web-based
application, you can perform all of these administrative tasks through a web
browser on any machine that can connect to the server.
All users can log on to the CMC to change their user preference settings.
Only members of the Administrators group can change management settings,
unless explicitly granted the rights to do so.
Dashboard and Analytics
Dashboard and Analytics is a suite of products that helps users track and
analyze key business metrics via management dashboards, scorecards, and
alerting. These products allow goals to be set around metrics and assigned
to owners; they also support group decision-making and analysis via
integrated collaboration and workflow capabilities.
Dashboard and Analytics includes the following products:
• Dashboard Builder
• Performance Manager
• Set Analysis
• Predictive Analysis
2Architecture
Clients

• Process Analysis
The Dashboard and Analytics repository stores the metrics, goals, sets and
calendar definitions, used by Dashboard and Analytics users to create
dashboards and analytics. Each time users refresh a metric, the values for
the metric refresh are written to the Dashboard and Analytics repository.
Note:
To use Dashboard and Analytics features, you must purchase a
BusinessObjects Enterprise license that includes the use of Dashboard and
Analytics as part of its agreement.
BusinessObjects Enterprise InfoView
InfoView is a web-based interface that end users access to view, schedule,
and keep track of published reports. InfoView can access, interact with, and
export, any type of business intelligence including reports, analytics,
dashboards, scorecards, and strategy maps.
InfoView allows users to manage:
• BI catalog browsing and searching.
• BI content access (creating, editing, and viewing).
• BI content scheduling and publishing.
Report viewers
BusinessObjects Enterprise includes report viewers that support different
platforms and different browsers in the client tier, and which have different
report viewing functionality.
Report viewers fall into two categories:
• Client-side report viewers (Active X viewer, Java viewer)
Client-side report viewers are downloaded and installed in the user's
browser. When a user requests a report, the application server processes
the request, and retrieves the report pages from the BusinessObjects
Enterprise framework. The web application server then passes the report
pages to the client-side viewer, which processes the report pages and
displays them directly in the browser.
Architecture
2 Clients

• Zero-client report viewers (DHTML viewer)
Zero-client report viewers reside on the web application server. When a
user requests a report, the web application server processes the request,
and then retrieves the report pages from the BusinessObjects Enterprise
framework. The web application server processes the report and creates
DHTML pages that the viewer displays in the user's web browser.
All report viewers help process requests for reports, and present report pages
that appear in the user's browser.
For more information on the specific functionality or platform support provided
by each report viewer, see the BusinessObjects Enterprise InfoView User's
Guide or the Crystal Reports Developer's Guide, available at the customer
support portal: http://support.businessobjects.com/documentation/prod
uct_guides/default.asp.
Voyager
Voyager is an AJAX-based online analytical processing (OLAP) tool for
working with multi-dimensional data, combining information from different
systems within a single workspace. Users access Voyager from within the
BusinessObjects Enterprise InfoView portal. Users can create new analysis
workspaces, and view and edit workspaces that have been saved to the
BusinessObjects Enterprise repository.
Voyager is accessed from BusinessObjects InfoView in a web browser, which
can be distributed to a large number of users, including those outside of your
secure network, on the internet.
The Voyager OLAP feature set complements both Crystal Reports (for direct
data access to OLAP cubes for production reporting) and Web Intelligence
(for ad hoc analytic reporting with universes built on OLAP data sources).
Voyager offers a comprehensive range of business and time calculations,
and includes features such as time sliders to make the analysis of OLAP
data as simple as possible.
Voyager requires a connection to a supported OLAP data source, such as
Microsoft Analysis Services, SAP BW, or Oracle Hyperion Essbase.
Therefore, you must create a connection to data before analysts can begin
using Voyager to analyze data.
2Architecture
Clients

Note:
The Voyager web application is available only as a Java web application.
There is no corresponding Voyager application for .NET.
Web Intelligence
A web-based tool that provides query, reporting, and analysis functionality
for relational data sources in a single web-based product. Web Intelligence
allows users to create reports, perform ad hoc queries, analyze data, and
apply report formatting in a drag-and-drop interface. Web Intelligence hides
the complexity of underlying data sources. Reports can be published to the
BusinessObjects Enterprise web portal, or to Microsoft Office applications
using BusinessObjects Live Office.
Desktop client applications
Desktop client applications interact with the BusinessObjects Enterprise
intelligence or processing servers. They do not communicate with the web
application server. Communication between the clients and the servers can
be secured with SSL encryption (CORBA SSL).
Desktop products are installed client applications that run on Microsoft
Windows operating systems. They can store resources locally and access
your organization's data through locally installed database driver or the
Central Management Console (CMC).
Business View Manager
A Windows-based tool that allows users to build semantic layer objects that
simplify underlying database complexity, and set row- and column-level
security. It is a multi-tier system that enables companies to build
comprehensive and specific Business View objects that help report designers
and end-users access the information they require.
The objects (such as filters) set row-level security. You can simplify data
access for report designers by insulating them from the raw data structures.
You can build connections to multiple data sources, join tables, alias field
names, create calculated fields, and then utilize this simplified structure as
Architecture
2 Clients

a Business View in BusinessObjects Enterprise. Report designers can then
use the Business View as the basis for their reports, rather than accessing
the data directly and building their own queries.
This designer provides a wide range of capabilities for creating Data
Connections, Dynamic Data Connections, Data Foundations, Business
Elements, and Business Views. The Business View Manager allows you to
design relational views of information. This designer also allows you to set
detailed column and row-level security for various objects in a report.
Central Configuration Manager (CCM)
The CCM is a server troubleshooting and node configuration tool provided
in two forms. In a Microsoft Windows environment, the CCM allows you to
manage local and remote servers through its graphical user interface (GUI)
or from a command line. In a Unix environment, the CCM shell script (ccm.sh)
allows you to manage servers from the command-line.
The CCM allows you to create and configure Server Intelligence Agent (SIA)
nodes and start or stop your web application server. On Windows, it also
allows you to configure network parameters, such as Secure Socket Layer
(SSL) encryption. These parameters apply to all servers within a node.
Note:
Most server management tasks are now handled through the CMC, not
through the CCM. The CCM was the primary tool for server management in
previous versions of BusinessObjects Enterprise, but the CCM is now used
for troubleshooting and node configuration.
Crystal Reports Designer
Crystal Reports Designer allows database experts or application developers
to create and integrate detailed reports that can be easily shared with others
using Crystal Reports Viewer or a web browser.
Crystal Reports Viewer
The Crystal Reports Viewer is available as a free download from
http://www.businessobjects.com/product/catalog/crystalreports, and allows
2Architecture
Clients

users to open reports in read-only mode. Reports cannot be refreshed, as
the data used is saved within the report itself.
Data Source Migration Wizard
The Data Source Migration Wizard allows you to migrate reports that are
based on Crystal Reports queries, dictionaries, or InfoViews, to a
BusinessObjects Enterprise deployment.
You can migrate two types of objects: reports and data sources. The wizard
converts the data source of each report into an object that is usable in
BusinessObjects Enterprise, and then resets the data source location of the
report to point to the new object. The result is that you can use the new
features of BusinessObjects Enterprise while keeping the functionality of the
reports and data sources from your previous installation.
Desktop Intelligence
A Windows-based integrated query, reporting and analysis tool that allows
you to access data using familiar business terms, rather than using technical
database query methods, like SQL. The complexity of the underlying data
storage is abstracted in the semantic data layer known as the Business
Objects Universe.
Designers can create reports, then publish them to InfoView, where they can
be viewed and scheduled. Users can share and distribute Desktop Intelligence
documents by exporting them in different formats.
Import Wizard
A locally-installed Windows application that guides administrators through
the process of importing users, groups, and folders into BusinessObjects
Enterprise. It also allows you to import objects, events, server groups,
repository objects, and calendars in BusinessObjects Enterprise.
Architecture
2 Clients

Live Office
BusinessObjects Live Office integrates with the Microsoft Office environment,
allowing for dynamically updated data to be embedded within Microsoft
Outlook, PowerPoint, Excel, and Word documents. Plus, you can share your
documents with others over the web for collaborative decision-making. From
within Microsoft Office, you can use intuitive wizards and toolbars to easily
connect to a Crystal report, Web Intelligence document, or use ad hoc data
selections. Then format your data using familiar Microsoft Office tools.
Using Live Office, you can publish "live" documents to BusinessObjects
Enterprise for sharing with your coworkers through a business intelligence
portal. Or, take it outside the firewall and e-mail it to an off-site partner or
coworker.
Note:
Web services applications are currently only supported with the following
load balancer configurations:
1. Source IP address persistence.
2. Source IP and destination port persistence (available only on a Cisco
Content Services Switch).
3. SSL persistence.
Note:
SSL persistence may cause security and reliability issues on some web
browsers. Check with your network administrator to determine if SSL
persistence is appropriate for your organization.
For information on configuring web services to work with Live Office, see the
BusinessObjects Enterprise Web Services Administrator Guide.
Publishing Wizard
The Publishing Wizard enables both administrators and end users to publish
reports to BusinessObjects Enterprise. By assigning object rights to individual
folders on a given server, you control who can publish reports and where
they are published.
Use the Publishing Wizard if you have access to the application and you
want to add multiple objects or an entire directory of objects to
2Architecture
Clients

BusinessObjects Enterprise. Once an object is added, it appears in the folder
that you specified in InfoView (or your customized web desktop) and in the
Folders management area of the CMC.
For more information, see the Adding Objects to the Repository chapter of
BusinessObjects Enterprise Administrator's guide.
Query as a Web Service (QaaWS)
Query as a Web Service provides new and easy ways to analyze information
through user-driven client solutions for businesses. Business Intelligence
(BI) content is usually bound to a specific user interface of BI tools. Query
as a Web Service changes this by allowing BI content to be delivered to any
user interface that can process web services.
Using Query as a Web Service, business users define their own query from
a universe, and then easily and securely publish that query as a standalone
web service.
Query as a Web Service provides new client solutions for businesses. For
example, it enables Crystal Xcelsius to aggregate multiple disparate data
sources into a trusted BI view.
Query as a Web Service also enables a range of client-side solutions in tools
such as:
• Microsoft Office, Excel, and InfoPath.
• SAP Application Server.
• OpenOffice.
• Business rules and process management applications.
• Enterprise Services.
Report Conversion Tool
The Report Conversion Tool converts Desktop Intelligence reports to the
Web Intelligence format and publishes the converted reports to the CMS.
It retrieves reports from the CMS, in the Public, Favorites, or Inbox folders.
Once converted, you can publish to the same folder as the original Desktop
Intelligence report or to a different folder. The tool does not convert all
Desktop Intelligence features and reports. The level of conversion depends
Architecture
2 Clients

on the features in the original report. Some features prevent the report from
being converted. Other features are modified, reimplemented, or removed
by the tool during conversion.
The tool assigns one of three statuses to each report:
• Fully Converted.
• Partly Converted.
• Not Converted.
The Report Conversion Tool also lets you audit your converted reports. This
helps identify reports that cannot be fully converted by the Report Conversion
Tool and explains why.
Repository Diagnostic Tool
The Repository Diagnostic Tool (RDT) can scan, diagnose, and repair
inconsistencies that may occur between the Central Management Server
(CMS) system database and the File Repository Servers (FRS) filestore.
RDT scans the CMS system database and identifies inconsistencies. It can
also repair the logged inconsistencies, and report the repair status and
completed actions. To determine synchronization between the file system
and database, RDT should be used after the user first completes a hot
back-up. Or the customer can use the RDT after a restoration and prior to
starting their BusinessObjects Enterprise services. The user can set a limit
for the number of errors the RDT will find and repair before stopping.
Translation Manager
BusinessObjects Enterprise provides support for multilingual documents and
universes. A multilingual document contains localized versions of universe
metadata and document prompts. A user can create reports, for example,
from the same universe in their chosen languages.
The Translation Manager is the tool that defines the multilingual universes
and manages translation of universes and their Web Intelligence documents
and prompts.
Translation Manager:
2Architecture
Clients

• Translates universe or a Web Intelligence documents for a multilingual
audience.
• Defines the metadata language parts of the document and the appropriate
translation. It generates external XLIFF format and imports XLIFF files to
get translated information.
• Lists the universe or Web Intelligence document structure to be translated.
• Lets you translate the metadata through the interface.
• Lets you translate the metadata using external translation tools by
exporting and importing XLIFF files.
• Creates a multilingual document where several languages can be saved.
Universe Builder
A universe is a semantic layer of abstraction that exists between
BusinessObjects Enterprise and the data in your organization's database.
Universe Builder allows you to create universes from XML metadata and
Oracle Analytic Services.
Universe data sources can be multi-dimensional objects (dimensions,
measures, details), enabling the end user to analyze the data without needing
to know the details of the underlying database structure.
Once you start Universe Builder, you connect to a metadata source, then
using a universe creation wizard, map metadata structures to equivalent
classes, objects, dimensions, and details, used in a standard BusinessObjects
universe.
You can create universes from metadata sources with both Universe Builder
and Designer. Universe Builder is a stand-alone product that provides an
independent user interface for universe creation from metadata sources.
Designer is used for the universe generation at the end of the creation
process.
Universe Designer
Universe Designer provides a connection wizard that allows you to connect
to your database. You can create multiple connections with Universe
Designer, but only one connection can be defined for each universe. This
database connection is saved with the universe.
Architecture
2 Clients

The objects (such as filters) set row-level security. This semantic layer is the
foundation for empowering end users to customize query and analysis. It
abstracts the complexity of data by using business language rather than data
language to access, manipulate, and organize data.
Universe Designer provides a graphical interface to select and view tables
in a database. The database tables are represented as table symbols in a
schema diagram. You can use this interface to manipulate tables, create
joins between tables, create alias tables, create contexts, and solve loops
in your schema. Web Intelligence users do not see this schema.
Web Intelligence Rich Client
Web Intelligence Rich Client allows you to continue to work with Web
Intelligence documents (WID) when you are unable to connect to a CMS,
when you want to perform calculations locally rather than on the server, on
when you want to work with Web Intelligence documents without installing
a CMS or application server.
Web Intelligence Rich Client can also be used when connected to a CMS.
Xcelsius
Xcelsius is a data visualization tool that transforms BI data into engaging
presentations and dashboards. It enables the integration of dynamically
updated data into Microsoft Office, PDF, and web documents with Business
Objects queries and reports. Xcelsius is comprised of designer and viewing
extensions leveraging Business Objects web services.
Services
BusinessObjects Enterprise uses the terms server and service to refer to
the two types of software running on a BusinessObjects Enterprise machine.
A service is a server subsystem that performs a specific function. The service
runs within the memory space of its server under the process id of the parent
container (server). For example, the Web Intelligence Scheduling and
Publishing Service is a subsystem that runs within the Adaptive Job Server.
2Architecture
Services

While the term server can refer to a physical machine on which a software
system is running, it is also used to describe an operating system level
process (or daemon) hosting one or more services. For example, the Central
Management Server (CMS) and Adaptive Processing Server are servers. A
server runs under a specific operating system account and has its own PID.
A node is a collection of BusinessObjects Enterprise servers running on the
same host. One or more nodes can be on a single host.
BusinessObjects Enterprise can be installed on a single machine, spread
across different machines on an intranet, or separated over a wide area
network (WAN).
For more information servers and server properties, see the “Server
Properties” appendix in the BusinessObjects Enterprise XI 3.1 Administrator's
Guide.
Service Categories
The Central Management Console (CMC) Server tab groups servers
hierarchically by service category. Each service category contains servers
that perform similar functions.
The following section describes each service category and the servers it
contains.
Core Services
The CMC Servers tab allows you to create new servers by selecting from a
list of "Core Services" and choosing a specific service. Depending on the
service you select, you may be able to choose other services to be hosted
on the server.
Business Process BI Service
Business Process BI Service is a web service that enables BusinessObjects
Enterprise technology to be integrated into custom web applications. It
receives requests from a web application, coordinates the retrieval and
processing of the relevant data, and returns a processed report to the web
application.
Architecture
2 Services

Hosted by an Adaptive Processing Server. For more information on the
Adaptive Processing Server, see Adaptive Processing Server on page 72.
Additional services that can be hosted with this service:
• Central Management Console Service
• Web Services SDK and QaaWS Service
Central Management Console Service
The Central Management Console (CMC) is an web-based administration
portal for the Central Management Server (CMS), which, in turn, manages
the entire BusinessObjects Enterprise system. The CMC communicates
directly with the CMS to view or change configuration settings.
Without the CMC, you cannot manage a BusinessObjects Enterprise
deployment.
• Business Process BI Service
• Web Services SDK and QaaWS Service
Central Management Service
The Central Management Service receives authentication and report
scheduling queries from other BusinessObjects Enterprise servers, and
system. This is known as the "CMS system database." All the platform
services are managed and controlled by the CMS. The CMS also manages
access to the system file store where the physical documents are managed.
The system repository database is maintained using the provided MySQL
database, or by using the supported database of your choice.
Hosted by a Central Management Server. For more information on the Central
Management Server, see Central Management Server on page 73.
Additional service that can be hosted with this service:
• Single Sign-On Service
Client Auditing Proxy Service
The Client Auditing Proxy Service monitors connected Rich Web Intelligence
and Rich Desktop Intelligence clients and forwards the information to the
2Architecture
Services

auditing server. Rich clients working locally, not connected to a repository,
are not audited by the Client Auditing Proxy Service.
• Publishing Post Processing Service
• Publishing Service
• Search Service
Destination Delivery Scheduling Service
The Destination Delivery Scheduling Service is hosted by a Job Server that
runs a pre-determined time, and publishes the results to the output location
specified when the schedule was created. Output can be published to the
BusinessObjects Enterprise file system, FTP, SMTP or a user's Inbox.
Hosted by a Job Server. For more information on the Job Server, see Job
Servers on page 81.
• Destination Configuration Service
Event Service
The Event Service is used to trigger reports to run when a file-based event
occurs on a File Repository Server (FRS). For example, if data file is updated
or added to an FRS, a report can automatically be run on it.
Hosted by an Event Server. For more information on the Event Server, see
Event Server on page 79.
No other services run on a server with this service.
Input Filestore Service
The Input Filestore Service maintains a list of published report and program
objects that can be used in the generation of new reports. For example, a
Job Server requests a report from an Input Filestore service when the report
has been scheduled to run. The Input Filestore Service provides the report
as 'input' into the reporting process.
Architecture
2 Services

Hosted by a File Repository Server. For more information on the File
Repository Server, see File Repository Servers on page 80 and Input File
Repository Servers on page 80.
No other services run on this server with this service.
Output Filestore Service
The Output Filestore Service maintains collection of completed reports. For
example, a Job Server requests a report from an Output Filestore service
when the report has run and the report needs to be sent to a specific
destination, such as an user's inbox. The Output Filestore Service provides
the report as 'output' of the reporting process.
Hosted by a File Repository Server. For more information on the File
Repository Server, see File Repository Servers on page 80 and Output File
Repository Servers on page 81.
Program Scheduling Service
The Program Scheduling Service runs executable objects at a pre-determined
time.
Servers on page 81.
Publishing Post Processing Service
The Publishing Post Processing Service can perform actions on reports after
they have completed running. For example, reports can be sent to a variety
of destinations, such an a directory or user inbox, upon completion.
• Client Auditing Proxy Service
• Search Service
2Architecture
Services

Publishing Service
The Publishing Service is the central report publishing service, and
coordinates with the Publishing Post Processing Service and Destination
Job Service to publish reports the desired destination.
• Search Service
Replication Service
The Replication Service processes replication jobs that mirror reports in
different parts of the BusinessObjects Enterprise system.
Servers on page 81.
• Web Intelligence Scheduling and Publishing Service
Search Service
The Search Service indexes all content in the Central Management Server
(CMS) repository. This index is then used when a user searches for a term
in BusinessObjects Enterprise clients.
• Publishing Post Processing Service
Web Services SDK and QaaWS Service
The Web Services SDK and Query as a Web Service (QaaWS) service act
as a bridge between custom web applications and the BusinessObjects
Architecture
2 Services

Enterprise system, allowing developers to implement Business Objects
functionality in a custom web application.
• Central Management Console Service
Crystal Reports Services
The CMC Servers tab allows you to create new Crystal Reports servers by
selecting from a list of "Crystal Reports Services" and choosing a specific
service. Depending on the service you select, you may be able to choose
other services to be hosted on the server.
Crystal Reports Cache Service
The Crystal Reports Cache Service limits the number of database accesses
generated by Crystal Reports by managing a cache of reports. Administrators
can configure how long reports are held in the cache, the size of the cache,
as well as other properties.
If the Crystal Reports Cache Service is disabled, reports cannot query their
data sources.
Hosted by a Crystal Reports Cache Server. For more information on the
Crystal Reports Cache Server, see Crystal Reports Cache Server on page 75.
Crystal Reports Processing Service
The Crystal Reports Processing Service accepts and processes Crystal
Reports. It can share data between reports to reduce the number of database
accesses, and can be configured to limit the number of concurrent jobs to
prevent the service from becoming overloaded.
Without this service, Crystal Reports cannot be run.
2Architecture
Services

Hosted by a Crystal Reports Processing Server. For more information on
the Crystal Reports Processing Server, see Crystal Reports Processing
Server on page 76.
Crystal Reports Scheduling Service
The Crystal Reports Scheduling Service is hosted by a Job Server that runs
Crystal Reports at a pre-determined time, then publishes the results to the
output location specified when the schedule was created. Reports can be
published to the BusinessObjects Enterprise file system, FTP, SMTP or a
user's Inbox.
Without this service, you will not be able to schedule Crystal Reports to run
unattended, and all Crystal Reports would have to be run manually from the
Crystal Reports client.
Servers on page 81.
Crystal Reports Viewing and Modification Service
Hosted by a Report Application Server. For more information on the Report
Application Server, see Report Application Server on page 86.
List Of Values Scheduling Service
The List of Values Scheduling Service periodically generates a list of options
to include in pick-lists. A list of values is a list that contains the distinct data
values associated with an object. When you create a dimension or detail
object in Universe Designer, it is automatically assigned an associated List
Of Values (LOV). This list does not physically exist when you create an
object, but by default the object has the ability to query the database to return
a list of its values when used to build a query.
Architecture
2 Services

Servers on page 81.
Desktop Intelligence Services
The CMC Servers tab allows you to create new Desktop Intelligence servers
by selecting from a list of "Desktop Intelligence Services" and choosing a
specific service. Depending on the service you select, you may be able to
choose other services to be hosted on the server.
Connection Service
The Connection Service opens and maintains a database or Online Analytical
Processing (OLAP) data source connection, through a business view or
universe. This allows the Connection Service to act as an intermediary
between BusinessObjects Enterprise services and a range of supported data
formats.
The Connection Server can also be traced so that database activity can be
analyzed and later optimized.
Without the Connection Service running, BusinessObjects Enterprise
components will not be able to access a data source.
Hosted by a CS Container Server. For more information on the CS Container
Server, see Connection Server on page 75.
No other services run on a server with this service.
Desktop Intelligence Cache Service
The Desktop Intelligence Cache Service limits the number of database
accesses generated by Desktop Intelligence reports by managing a cache
of reports. Administrators can configure how long reports are held in the
cache, the size of the cache, as well as other properties.
If the Desktop Intelligence Cache Service is disabled, reports cannot query
their data sources.
2Architecture
Services

Hosted by a Desktop Intelligence Cache Server. For more information on
the Desktop Intelligence Cache Server, see Desktop Intelligence Cache
Server on page 78.
Desktop Intelligence Processing Service
The Desktop Intelligence Processing Service accepts and processes Desktop
Intelligence reports. It can share data between reports to reduce the number
of database accesses, and can be configured to limit the number of
concurrent jobs to prevent the service from becoming overloaded.
Without this service, Desktop Intelligence reports cannot be run.
Hosted by a dpsprocFullClient Server.
Desktop Intelligence Scheduling Service
The Desktop Intelligence Scheduling Service is hosted by a Job Server that
runs Desktop Intelligence reports at a pre-determined time, and publishes
the results to the output location specified when the schedule was created.
Reports can be published to the BusinessObjects Enterprise file system,
FTP, SMTP or a user's Inbox.
Without this service, you will not be able to schedule Desktop Intelligence
reports to run unattended, and all Desktop Intelligence reports would have
to be run manually from the Desktop Intelligence client.
Servers on page 81.
Architecture
2 Services

Performance Management Services
Services in "Performance Managament" services category provide
BusinessObjects Enterprise Dashboard and Analytics functionality for data
analysis. The following services are used by Dashboard and Analytics:
Hosted byService
portfolioEngine ServerDashboard Analytics Service
dashboardEngine ServerDashboard Service
probeEngine ServerPM Metric Aggregation Service
PM Repository ServerPM Repository Management Service
probeEngine ServerPM Rules Service
Mining Engine ServerPredictive Analytic Service
spcEngine ServerProcess Analysis Service
iProfiler ServerSets Profile Service
queryManager ServerSets Query Service
Voyager Services
The CMC Servers tab allows you to create new Multi-Dimensional Analysis
server by selecting from a list of "Voyager Services" and choosing a specific
service.
Multi-Dimensional Analysis Service
The Multi-Dimensional Analysis Service is hosted by the Multi-Dimensional
Analysis Services Server (MDAS) and is used by the Voyager client to access
three-dimensional Online Analytical Processing (OLAP) data.
It also converts the raw data into XML packages, which the requesting client
application can render into a variety of formats: Excel spreadsheets, PDF,
or Voyager crosstabs and charts.
2Architecture
Services

Note:
OLAP single sign-on (SSO) is only supported for Microsoft Analysis Services
and SAP BW.
The Multi-Dimensional Analysis Service communicates with the Input File
Repository Server (FRS), to retrieve workspaces, and gets data from the
OLAP database server. As the Voyager client renders results on the web
application server, the Multi-Dimensional Analysis Service returns results to
the client in XML format, which is formatted and displayed by the Voyager
client.
There are no additions services hosted with this service.
For more information, see Multi-Dimensional Analysis Services (MDAS)
Server on page 82. To read an example workflow of the Multi-Dimensional
Analysis Services Server viewing a workspace, see Viewing a Voyager
workspace on page 115.
Web Intelligence Services
The CMC Servers tab allows you to create new Web Intelligence servers by
selecting from a list of "Web Intelligence Services" and choosing a specific
service. Depending on the service you select, you may be able to choose
other services to be hosted on the server.
Web Intelligence Processing Service
The Web Intelligence Processing Service is a subsystem of the Web
Intelligence Processing Server that runs Web Intelligence reports submitted
to the server by Web Intelligence clients and the Web Intelligence Scheduling
and Publishing Service. The resulting Web Intelligence report is the passed
back to the originator.
Although the Web Intelligence Processing Service does not query the
database or generate the final report itself, it does coordinate with Input and
Output File Servers (to fetch the document on which the report is based) and
the Report Engine and Connection Servers (to retrieve data from the
Universe, or database, and process the report).
Without at least one Web Intelligence Processing service running, Web
Intelligence clients would not be able to open, view, or run reports, and
scheduled Web Intelligence reports would fail to run.
Architecture
2 Services

For more information on the Web Intelligence Processing Server, see Web
Intelligence Processing Server on page 88. For information about scheduled
Web Intelligence reports, see Web Intelligence Scheduling and Publishing
Service on page 71. For Web Intelligence workflow scenarios, see the
Scheduling and Viewing sections of Information Workflows on page 106.
Web Intelligence Scheduling and Publishing Service
The Web Intelligence Scheduling and Publishing Service is hosted by an
Adaptive Job Server that runs Web Intelligence reports at a pre-determined
time, and publishes the results to the output location specified when the
schedule was created. You can schedule Web Intelligence reports with the
Central Management Console (CMC). Reports can be published to the
BusinessObjects Enterprise file system, FTP, SMTP or a user's Inbox.
Without this service, you will not be able to schedule Web Intelligence reports
to run unattended, and all Web Intelligence reports would have to be run
manually from the Web Intelligence client.
The Web Intelligence Scheduling and Processing Service is hosted by an
Adaptive Job Server. For more information on Adaptive Job Servers, see
Adaptive Job Server on page 71.
• Destination Configuration Service (allows reports to be sent to different
locations).
• Replication Service
Adaptive Job Server
The Adaptive Job Server is a specialized job server that hosts
BusinessObjects Enterprise services, such as the Replication Service, Web
Intelligence Scheduling and Publishing Services, and the Destination
Configuration Service.
The Adaptive Job Server runs as a container for the selected services, which
all run under a single account in the same memory space and under the
2Architecture
Services

same process id (PID). If you stop the Adaptive Job Server, you stop all of
the contained job services.
An Adaptive Job Server can host the following services:
• Web Intelligence Scheduling and Publishing Service (runs and publishes
Web Intelligence reports at a pre-determined time).
See also: Job Servers on page 81.
Example:
The following Adaptive Job Server is created by the BusinessObjects
Enterprise setup program:
• <HOSTNAME>.AdaptiveJobServer
Adaptive Processing Server
An Adaptive Processing Server is a generic server that hosts services
responsible for processing requests from a variety of sources. An Adaptive
Processing Server can host the following services:
• Client Auditing Proxy Service (collects auditing information from connected
Rich Desktop and Web Intelligence Clients).
• Publishing Post Processing Service (responsible for any post processing
of a publication job, including PDF merging and publication extension
processing).
• Publishing Service (coordinates the publication of an object by
communicating with other services).
• Search Service (processes search requests and executes the indexing).
Example:
The following Adaptive Processing Servers are created by the
BusinessObjects Enterprise setup program:
• <HOSTNAME>.AdaptiveProcessingServer
Architecture
2 Services

Central Management Server
The Central Management Server (CMS) maintains a database of information
about your BusinessObjects Enterprise system. This is known as the "CMS
system database." All the platform services are managed and controlled by
the CMS. The CMS also manages access to the system file store where the
physical documents are managed. The system repository database is
maintained using the provided MySQL database, or by using the supported
database of your choice.
CMS data includes information about users and groups, security levels,
content, and services. The CMS can also maintain an optional auditing
database of information about user actions, to perform four main tasks:
• Maintaining security
The CMS enforces the application of rights at both the folder and object
level, and supports inheritance at the user and group level. It also supports
aggregation through a flexible, group-user membership model.
An integrated security system is available for customers who do not
currently use an entitlement database, although BusinessObjects
Enterprise is designed for integration with multiple concurrent third-party
security systems, such as LDAP, Siteminder, or Microsoft Active Directory.
When a change is made to a user in the entitlement database, the change
is then propogated to BusinessObjects Enterprise.
• Managing objects
The CMS keeps track of the object location and maintains the folder
hierarchy. "InfoObjects" are system metadata objects that contain contain
index information, and the actual documents or objects are stored in a
file store. The separation of the object definition (metadata) from the
document allows for fast object processing as only the required information
is retrieved from the system's repository. The CMS also runs scheduled
report jobs.
• Managing servers
The CMS handles load balancing and automated clustering to avoid
bottlenecks and maximize hardware efficiency. In some multi-server
environments, BusinessObjects Enterprise may not require a separate
third-party load balancing system.
2Architecture
Services

• Managing auditing
User actions can be monitored and written to a central audit database.
This information allows system administrators to better track and manage
their BusinessObjects Enterprise deployment.
The auditing functionality allows administrators to better understand which
users accessed the enterprise system, which documents they interacted
with. Usage data is collected from the system interactions recorded in
the auditing database. A sample universe and sample auditing reports
are also available to provide fast access to information such as the most
accessed reports, peak system use times, and average user session
times.
Note:
It is strongly recommended that you back up and audit the CMS system
database frequently.
Caution:
The CMS database should not be accessed directly. System information
should only be retrieved using the calls that are provided in the
BusinessObjects Enterprise software development kit (SDK).
Restriction:
You may access the optional audit database in read-only mode to create
custom audit reports.
On Windows, the Setup program can install and configure its own MySQL
database if you do not already have a database server allocated for the
deployment. You can switch to a different database later if your deployment
needs change.
A Central Management Server hosts the following services:
• Central Management Service (core CMS service).
• Single Sign-On Service (allows users to sign on to BusinessObjects
Enterprise with credentials from a common authentication system).
Example:
The following Central Management Server is created by the BusinessObjects
• <HOSTNAME>.CentralManagementServer
Architecture
2 Services

Connection Server
Responsible for handling connection and interaction with the various
datasources and providing a common feature set to its clients, by emulating
the missing features if necessary.
The Connection Server provides database access to the raw source data.
It supports relational databases (Oracle, MySQL, Microsoft SQL Server,
DB2, Sybase) as well as OLAP (SAP BW, Microsoft Analysis Services,
Hyperion Essbase). The Connection Server is responsible for handling
connection and interaction with the various datasources and providing a
common feature set to its clients, by emulating the missing features if
necessary.
The Connection Server can be accessed through a Dynamic Link Library
(inproc), a CORBA server (called through CORBA or HTTP), or by using the
Java API.
A Connection Server hosts the following service:
• Connection Service (provides a database connection to other servers).
Example:
The following Connection Server is created by the BusinessObjects
• <HOSTNAME>.ConnectionServer
Crystal Reports Cache Server
The Crystal Reports Cache Server intercepts report requests sent from clients
to the page server. If the cache server cannot fulfill the request with a cached
report page, it passes the request on to the page server, which runs the
report and returns the results. The cache server then caches the report page
for future use, and sends the report to the viewer.
A Crystal Reports Cache Server hosts the following service:
• Crystal Reports Cache Service (creates and maintains a cache of
recently-viewed reports).
2Architecture
Services

Example:
The following Crystal Reports Cache Server is created by the
• <HOSTNAME>.CrystalReportsCacheServer
Crystal Reports Processing Server
The Crystal Reports Processing Server is responsible for responding to page
requests by processing reports and generating encapsulated page format
(EPF) pages. The key benefit of EPF is that it supports page-on-demand
access so only the requested page is returned, instead of the entire report.
This enhances performance and reduces unnecessary network traffic for
large reports.
The EPF pages contain formatting information that defines report layout.
The Processing Server retrieves data for the report from an instance or
directly from the database (depending on the user request and the rights he
or she has to the report object). When retrieving data from the database, the
Processing Server automatically disconnects from the database after it fulfills
its initial request and if necessary, reconnects to retrieve additional data.
This helps conserve database traffic and limit the unnecessary use of
database licenses.
The Cache Server and Processing Server work closely together. Specifically,
the Processing Server responds to page requests made by the Cache Server.
The Processing Server and Cache Server also interact to ensure cached
EPF pages are reused as frequently as possible, and new pages are
generated as required. BusinessObjects Enterprise takes advantage of this
behavior by ensuring that the majority of report-viewing requests are made
to the Cache Server and Processing Server. However, if a user's default
viewer is the DHTML viewer, the report is processed by the Report Application
Server.
Runs Crystal report queries and returns data to Crystal Reports Cache Server.
A Crystal Reports Processing Server hosts the following services:
• Crystal Reports Processing Service
Architecture
2 Services

Example:
The following Crystal Reports Processing Server is created by the
• <HOSTNAME>.CrystalReportsProcessingServer
Dashboard Analytics Server
Server process used by the Dashboard Builder component to create and
manage corporate and personal dashboard analytic content.
A Dashboard Analytics Server hosts the following service:
• Dashboard Analytics Service (provides core Dashboard Analytics
functionality).
Example:
The following Server is created by the BusinessObjects Enterprise setup
program:
• <HOSTNAME>.DashboardAnalyticsServer
Dashboard Server
Server process used by the Dashboard Builder component to create and
manage corporate and personal dashboards. Dashboard Builder offers
metrics, alerts, and dashboard management capabilities to help organizations
monitor and understand their business activities.
A Dashboard Server hosts the following service:
• Dashboard Service (provides core Dashboard functionality).
Example:
The following Dashboard Server is created by the BusinessObjects
2Architecture
Services

• <HOSTNAME>.DashboardServer
Desktop Intelligence Cache Server
The Desktop Intelligence Cache Server intercepts report requests sent from
clients to the page server. If the cache server cannot fulfill the request with
a cached report page, it passes the request on to the page server, which
runs the report and returns the results. The cache server then caches the
report page for future use, and sends the report to the viewer.
A Desktop Intelligence Cache Server hosts the following service:
• Desktop Intelligence Cache Service (creates and maintains a cache of
viewed reports).
Example:
The following Desktop Intelligence Cache Server is created by the
• <HOSTNAME>.DesktopIntelligenceCacheServer
Desktop Intelligence Job Server
The Desktop Intelligence Job Server processes scheduling requests received
from the CMS for Desktop Intelligence documents, and generates the instance
of the Desktop Intelligence document.
A Desktop Intelligence Job Server hosts the following services:
• Desktop Intelligence Scheduling Service
Example:
The following Desktop Intelligence Job Server is created by the
• <HOSTNAME>.DesktopIntelligenceJobServer
Architecture
2 Services

Desktop Intelligence Processing Server
A Desktop Intelligence Processing Server hosts the following services:
• Desktop Intelligence Processing Service (processes viewing requests for
Desktop Intelligence documents, generating Desktop Intelligence
documents).
• Single Sign-On Service (allows users to sign on to BusinessObjects
Enterprise with credentials from a common authentication system).
Example:
The following Desktop Intelligence Processing Server is created by the
• <HOSTNAME>.DesktopIntelligenceProcessingServer
Event Server
The Event Server monitors the system for events, which can act as a trigger
for running a report. When you set up a event trigger within BusinessObjects
Enterprise, the Event Server monitors the condition and notifies the CMS
that the file-based event has occurred. The CMS can then start any jobs that
are dependent upon the event ocurring.
Note:
Schedule-based and custom events are managed through the CMS.
An Event Server hosts the following service:
• Event Service (monitors file-based events)
Example:
The following Event Server is created by the BusinessObjects Enterprise
setup program:
2Architecture
Services

• <HOSTNAME>.EventServer
File Repository Servers
File repository servers are responsible for the creation of file system objects,
such as exported reports, and imported files in non-native formats.
Input and Output File Repository Server (FRS) processes run on each
BusinessObjects Enterprise server machine.
The FRSes are responsible for listing files on the server, querying for the
size of a file, querying for the size of the entire file repository, adding files to
the repository, and removing files from the repository.
Caution:
To avoid conflicts between input and output objects, the Input and Output
FRSes cannot share the same file system directory. In larger deployments,
there may be multiple Input and Output FRSes. All Input File Repository
Servers share the same directory. Likewise, all Output File Repository Servers
share the same directory.
Input File Repository Servers
The Input FRS stores report and program objects that have been published
to the system by administrators or end users (using the Publishing Wizard,
the CMC, the Import Wizard, or a Business Objects designer component
such as Crystal Reports, or Web Intelligence report panels).
Note:
Objects with associated files, such as text files, Microsoft Word files, or PDFs,
are stored on the Input File Repository Server.
A Input File Repository Server hosts the following service:
• Input Filestore Service
The following Input File Repository Server is created by the BusinessObjects
• <HOSTNAME>.InputFileRepository
Architecture
2 Services

Output File Repository Servers
The Output FRS stores all of the report instances generated by the Report
Job Server or the Web Intelligence Processing Server, and the program
instances generated by the Program Job Server.
Tip:
If you use the BusinessObjects Enterprise SDK, you can also publish reports
from within your own code.
An Output File Repository Server hosts the following service:
• Output Filestore Service
The following Output File Repository Server is created by the BusinessObjects
• <HOSTNAME>.OutputFileRepository
Job Servers
A Job Servers is a generic process that processes scheduled actions on
objects at the request of the CMS. When you add a Job server to the
BusinessObjects Enterprise system, you can configure the Job server to:
• Process report and document objects.
• Process program objects.
• Process publication objects.
• Send objects or instances to specified destinations.
A Job Server can host the following services:
See also: Adaptive Job Server on page 71.
2Architecture
Services

Example:
The following Job Servers are created by the BusinessObjects Enterprise
setup program:
• <HOSTNAME>.AdaptiveJobServer
• <HOSTNAME>.CrystalReportsJobServer
• <HOSTNAME>.DesktopIntelligenceJobServer
• <HOSTNAME>.DestinationJobServer
• <HOSTNAME>.ListOfValuesJobServer
• <HOSTNAME>.ProgramJobServer
• <HOSTNAME>.PublicationJobServer
• <HOSTNAME>.WebIntelligenceProcessingServer
List of Values Job Server
The List of Values Job Server is a specialized container that manages lists
of distinct data values associated with an object in the BusinessObjects
Enterprise system.
A list of values is a selection of valid terms that can be used in the context
of a specific query or phrase. This reduces the likelihood of an invalid query
or phrase being created.
Example:
The following List of Values Job Server is created by the BusinessObjects
• <HOSTNAME>.ListOfValuesJobServer
Multi-Dimensional Analysis Services (MDAS) Server
The Multi-Dimensional Analysis Services (MDAS) Server is a container for
the Multi-Dimensional Analysis Service, which provides the BusinessObjects
Architecture
2 Services

Voyager client with an extensible framework for accessing multi-dimensional
Online Analytical Processing (OLAP) data.
To avoid delays in processing OLAP client requests, run multiple MDAS
Servers on several different machines. Disabling this server will prevent the
Voyager client from accessing OLAP data sources.
For more information on the Multi-Dimensional Analysis Service, see
Multi-Dimensional Analysis Services (MDAS) Server on page 82. To read
an example workflow of the Multi-Dimensional Analysis Services Server
viewing a workspace, see Viewing a Voyager workspace on page 115.
Example:
The following Multi-Dimensional Analysis Services Server is created by the
• <HOSTNAME>.MultiDimensionalAnalysisServicesServer
PM Metrics Server
Dashboard and Analytics server to populate metrics created using the Metric
Engine. For more information, consult the Dashboard and Analytics Setup
and Administration Guide.
A PM Metrics Server hosts the following service:
• PM Metric Aggregation Service
Example:
The following PM Metrics Server is created by the BusinessObjects
• <HOSTNAME>.PMMetricsServer
PM Repository Server
Dashboard and Analytics server to read and store performance information
from the Dashboard and Analytics repository.
2Architecture
Services

A PM Repository Server hosts the following service:
• PM Repository Management Service
Example:
The following PM Repository Server is created by the BusinessObjects
• <HOSTNAME>.PMRepositoryServer
PM Rules Server
Dashboard and Analytics server to create rules and alerts. Rules and alerts
automate the process of detecting and interpreting change, and delivering
relevant analysis. Rules enable you to proactively monitor your business and
take appropriate and timely action in response to specific events. For more
information, consult the Dashboard and Analytics Setup and Administration
Guide.
A PM Rules Server hosts the following service:
• PM Rules Service
Example:
The following PM Rules Server is created by the BusinessObjects Enterprise
setup program:
• <HOSTNAME>.PMRulesServer
Predictive Analysis Server
Server used for Predictive Analysis (Data Mining) using KXEN engine, which
quickly uncovers key business drivers from your data and forecasts future
business conditions. It helps users make proactive decisions more easily by
providing insight in familiar terms through dashboards across the organization.
For more information, consult the Dashboard and Analytics Setup and
Administration Guide.
A Predictive Analysis Server hosts the following service:
Architecture
2 Services

• Predictive Analytic Service
Example:
The following Predictive Analysis Server is created by the BusinessObjects
• <HOSTNAME>.PredictiveAnalysisServer
Process Analysis Server
The process analysis server monitors server activity. This helps your
organization to automate the tracking of quality variables by using alarm
rules and control chart types defined by your quality improvement initiatives.
For more information, consult the Dashboard and Analytics Setup and
Administration Guide.
A Process Analysis Server hosts the following service:
• Process Analysis Service
Example:
The following Process Analysis Server is created by the BusinessObjects
• <HOSTNAME>.ProcessAnalysisServer
Program Job Server
A Program Job Server runs exectuable objects at a pre-determined time.
A Job Server hosts the following services:
2Architecture
Services

Example:
The following Program Job Server is created by the BusinessObjects
• <HOSTNAME>.ProgramJobServer
Publication Job Server
The Publication Job Server processes requests that it receives from the CMC
or InfoView and sends the requested objects or instances to the specified
destination. If the request is for an object, the Publication Job Server retrieves
the object from the Input File Repository Server. If the request is for a report
or program instance, the Publication Job Server retrieves the instance from
the Output File Repository Server. The Publication Job Server can send
objects and instances to a destination inside the BusinessObjects Enterprise
system, such as a user’s inbox. It can also send objects outside the system,
via e-mail.
A Publication Job Server hosts the following services:
Example:
The following Publication Job Server is created by the BusinessObjects
• <HOSTNAME>.PublicationJobServer
Report Application Server
Provides ad-hoc reporting capabilities that allow users to create and modify
Crystal reports via the RAS Software Development Kit (SDK). This SDK
Architecture
2 Services

supports the Java viewer SDKs and does not require a specific license; it is
included with your BOE package.
The RAS is also used to resolve Dynamic Recipient Lists at runtime or during
the design phase when working with publications, as well as with LiveOffice.
Example:
The following Report Application Server is not created by the
BusinessObjects Enterprise setup program by default:
• <HOSTNAME>.ReportApplicationServer
Sets Profile Server
Manages Performance Management profile information.
A Sets Profile Server hosts the following service:
• Sets Profile Service
Example:
The following Sets Profile Server is created by the BusinessObjects
• <HOSTNAME>.SetsProfileServer
Sets Query Server
Runs Performance Management set queries.
A Sets Query Server hosts the following service:
• Sets Query Service
Example:
The following Sets Query Server is created by the BusinessObjects
2Architecture
Services

• <HOSTNAME>.SetsQueryServer
Web Intelligence Processing Server
A Web Intelligence Processing Server is a specialized Job Server that accepts
a Web Intelligence report, coordinates with other servers to run the report,
and returns the result to the originator.
Each Web Intelligence Processing Server can be configured with a maximum
number of concurrent jobs (Maximum Jobs Allowed) value. To ensure that
server performance is not degraded by a large number of concurrent jobs,
run multiple Web Intelligence Processing Servers on different machines.
A Web Intelligence Processing Server hosts the following services:
• Web Intelligence Processing Service
For more information, see Web Intelligence Processing Service on page 70.
Example:
The following Web Intelligence Processing server is created by the
• <HOSTNAME>.WebIntelligenceProcessingServer
Web Application Container Server (WACS)
The Web Application Container Server allows the Central Management
Console (CMC) to run on installations that do not include a Java web
application server, or those that want to maintain separation between the
CMC and web applications on the deployment web application server.
A Web Application Container Server hosts the following service:
• Web Application Container Service.
• Central Management Console Service.
Architecture
2 Services

Example:
The following Web Application Container Server is created by the
BusinessObjects Enterprise setup program, if you opted to install it:
• <HOSTNAME>.WebApplicationContainerServer
Web application servers
A third-party web application server acts as the translation layer between
the end user's web browser and BusinessObjects Enterprise Software
Development Kit (SDK) interface running on a web application server. Web
application servers running on Windows, Unix, and Linux are supported.
You can use a combination of these options:
1. A Java web application server (Windows, Unix, Linux)
The setup program can also automatically deploy InfoView and the CMC
to:
• Tomcat 5.5
• WebLogic 9
• WebLogic 10
• WebSphere 6.1
• Oracle Application Server 10g R3
• Sun Java Application Server 9.0
The following web application servers are also supported, but InfoView
and the CMC must be manually deployed:
• SAP web application server 7
• WebSphere Community Edition 2.0
• Jboss 4.04
Note:
The BusinessObjects Enterprise setup program will install and deploy
InfoView and the CMC to Tomcat 5.5 by default.
2. Microsoft Internet Information Server (IIS) .NET web application server
(Windows only)
2Architecture

InfoView is supported on Microsoft Information Server (IIS), and, when
detected, the BusinessObjects Enterprise setup program will automatically
install and delpoy InfoView to IIS.
The CMC is not supported on IIS. In order to manage your
BusinessObjects Enterprise system with the CMC, you must deploy the
CMC to a Java web application server or install the Web Application
Container Service (WACS).
3. Web Application Container Service (WACS)
If you plan to use .NET InfoView, and you do not want to use a Java
application server to host your CMC, then you can use WACS to host the
WACS simplifies system administration by removing several manual
workflows that were previously required for configuring application servers
and deploying web applications, and by providing a simplified, consistent
administrative interface.
applications, whether manually or by using wdeploy.
Java SDK
The BusinessObjects Enterprise Java 2 Enterprise Edition (J2EE) software
development kit (SDK) allows you to create Java web applications that run
on the web application server in your BusinessObjects Enterprise deployment.
SDKs give you the ability to create web applications that integrate powerful
reporting features, such as those offered by Web Intelligence or InfoView.
The following Java SDKs are included with BusinessObjects Enterprise.
• BusinessObjects Enterprise Java SDK.
• Report Engine Java SDK.
• Report Application Server (RAS) Java SDK.
• Viewers Java SDK.
• Web services Java SDK.
• JavaServer Faces Components (JSF) for BusinessObjects Enterprise
SDK.
Architecture
2 Web application servers

BusinessObjects Enterprise Java SDK
The BusinessObjects Enterprise Java SDK allows you to incorporate
BusinessObjects Enterprise functionality into your own web applications.
1. Authentication and session management.
Users can be authenticated by using the BusinessObjects Enterprise
authentication protocol or some other protocol, such as LDAP or Kerberos.
Once the user is authenticated, a user session is created. The user
session maintains state information as the user performs actions and
navigates to different pages within the BusinessObjects Enterprise web
application.
2. Working with repository objects.
The information entity in BusinessObjects Enterprise is the InfoObject.
All operations involve the retrieval and manipulation of InfoObjects from
the Central Management Server (CMS).
3. Report operations.
The BusinessObjects Enterprise Java SDK supports many types of report
documents: Crystal reports, Web Intelligence and Desktop Intelligence
documents, as well as Microsoft Excel, and Adobe's Portable Document
Format (PDF), among others.
4. Administering BusinessObjects Enterprise.
Many aspects of a BusinessObjects Enterprise deployment can be
administered programmatically, such as managing server process and
server process groups, and server auditing.
Report Engine Java SDK
The Report Engine Java SDK includes libraries that you can use to build a
web report design tool. Applications built with this SDK can view, create, or
modify, a variety of different Web Intelligence and Desktop Intelligence
documents. Users can modify documents by adding, removing, and modifying
objects such as tables, charts, conditions, and filters.
2Architecture

Report Application Server (RAS) Java SDK
The Report Application Server (RAS) Java SDK is an API for developing
Java web applications with advanced report creation and modification
functionality. With the RAS Java SDK, you can create Java client applications
that interact with the RAS server from a web application server.
Web application users can create or modify Crystal reports by adding,
removing, or modifying tables, charts, parameters, and fields.
Viewers Java SDK
The Viewers SDK is an API that lets you incorporate reports in a range of
different formats within your web application.
Viewers are a 'thin-client' technology - users of your web application don't
need to install any additional software in order to view the reports. Two Java
viewers are available:
1. DHTML report page viewer.
This viewer provides basic thin-client report viewing capabilities to present
data and allow drill-down, page navigation, zooming, prompting, text
searching, highlighting, exporting, and printing.
2. Report parts viewer.
This viewer provides the ability to view individual report parts including
charts, text, and fields.
JavaServer Faces (JSF) SDK
The JavaServer Faces (JSF) SDK consists of JavaServer Faces components
and managed Java beans built on top of the BusinessObjects EnterpriseJava
SDK. The components encapsulate common BusinessObjects Enterprise
functionality, such as logging on to the system, navigating through folders
and categories, listing managed content, and viewing Crystal reports.
JSF component functionality can be divided into several main areas of
BusinessObjects Enterprise application development.
Architecture

1. Identifying end users in a BusinessObjects Enterprise system.
Individual users can be associated with their actions, such as logging on
or off, and changing a password.
2. Listing and navigating managed content.
Users can navigate repetitive information using nested lists rendered from
a data source.
3. Scheduling of managed content.
Your application's users can schedule reports to run at custom intervals
if you create pages that enable a user to set scheduling options.
4. Viewing managed content.
The ReportPageViewer component lets you quickly add the ability to
view reports on a page.
.NET SDK
The BusinessObjects Enterprise .NET software development kit (SDK) allows
you to create .NET web applications that run on the web application server
in your BusinessObjects Enterprise deployment.
SDKs give you the ability to create web applications that integrate powerful
reporting features, such as those offered by Crystal Reports or InfoView.
Web applications that use the SDK run within the web application server and
connect to the Report Application Server (RAS) running in the
BusinessObjects Enterprise processing tier.
BusinessObjects Enterprise installations that use the .NET Framework include
Primary Interop Assemblies (PIAs) that allow you to use the BusinessObjects
Enterprise .NET SDK with ASP.NET, and a set of .NET Server Components
that you can use to simplify the development of custom applications. This
configuration requires the use of a Microsoft Internet Information Services
(IIS) web server.
The following .NET SDKs are included with BusinessObjects Enterprise.
• BusinessObjects Enterprise .NET SDK.
• Report Engine .NET SDK
2Architecture

• Report Application Server (RAS) .NET SDK.
• Crystal Reports .NET SDK.
• Web services .NET SDK.
BusinessObjects Enterprise .NET SDK
The BusinessObjects Enterprise .NET SDK allows you to incorporate
BusinessObjects Enterprise functionality into your own web applications.
1. Authentication and session management.
Users can be authenticated by using the BusinessObjects Enterprise
authentication protocol or some other protocol, such as LDAP or Kerberos.
Once the user is authenticated, a user session is created. The user
session maintains state information as the user performs actions and
navigates to different pages within the BusinessObjects Enterprise web
application.
2. Working with repository objects.
The information entity in BusinessObjects Enterprise is the InfoObject.
All operations involve the retrieval and manipulation of InfoObjects from
the Central Management Server (CMS).
3. Report operations.
The BusinessObjects Enterprise .NET SDK supports many types of report
documents: Crystal reports, Web Intelligence and Desktop Intelligence
documents, as well as Microsoft Excel, and Adobe's Portable Document
Format (PDF), among others.
4. Administering BusinessObjects Enterprise.
Many aspects of a BusinessObjects Enterprise deployment can be
administered programmatically, such as managing server process and
server process groups, and server auditing.
Report Engine .NET SDK
The Report Engine .NET SDK includes libraries that you can use to build a
web report design tool. Applications built with this SDK can view, create, or
modify, a variety of different Web Intelligence and Desktop Intelligence
Architecture

documents. Users can modify documents by adding, removing, and modifying
objects such as tables, charts, conditions, and filters.
Report Application Server (RAS) .NET SDK
The Report Application Server (RAS) SDK is a API for developing .NET web
applications with advanced report creation and modification functionality.
With the RAS .NET SDK, you can create .NET client applications that interact
with the RAS server from a web application server.
Web application users can create or modify Crystal reports by adding,
removing, or modifying tables, charts, parameters, and fields.
Crystal Reports .NET SDK
The Crystal Reports .NET SDK allows you to incorporate BusinessObjects
Enterprise functionality into your own web applications, including:
1. Core functions.
Embed Crystal Reports Designer in your applications for report creation.
2. Database connections.
Log on to a database server and access data.
3. Report data manipulation.
Filter, group, sort, and total report data.
4. Report appearance and report objects.
Format, work with field and text objects, and enhance report presentation.
5. Printing and Exporting.
Export reports to other formats, and print reports.
Web Services
Business Objects Web Services provide a Java API accessed by rich clients
in the user interaction tier, such as Live Office and Crystal Reports.
2Architecture

Web Services consists of software components that can be called remotely
using the Simple Object Access Protocol (SOAP). SOAP is a protocol for
exchanging information that is not dependent on a specific platform, object
model, or programming language.
BusinessObjects Enterprise Web Services includes functionality in the
following areas:
• Session
Authentication and user privilege management.
• BI platform
Exposes advanced platform features such as scheduling, search, user
and group administration, server administration, platform events, and
calendars.
• Report Engine
Displays Web Intelligence and Crystal Reports in HTML, PDF, Excel, and
XML format.
• Query
Builds ad-hoc queries based on the Business Objects universe semantic
layer.
Business Objects web services uses standards such as XML, SOAP, AXIS
2.0 and WSDL. The platform follows WS-Interoperability Basic Profile
1.0 web services specification.
Note:
Web Services applications are currently only supported with the following
load balancer configurations:
1. Source IP address persistence.
2. Source IP and destination port persistence (available only on a Cisco
Content Services Switch).
3. SSL persistence.
Note:
SSL persistence may cause security and reliability issues on some web
browsers. Check with your network administrator to determine if SSL
persistence is appropriate for your organization.
For information on installing and configuring Web Services, see the
BusinessObjects Enterprise Web Services Administrator Guide.
Architecture

Query as a Web Service
Business Objects Query as a Web Service is a wizard-based application that
allows queries to be made into a web service and integrated with web-ready
applications. Queries can be saved to create a catalog of standard queries
that application builders can select as required.
Business Intelligence (BI) content is usually bound to a specific user interface
of BI tools. Query as a Web Service changes this by allowing BI content to
be delivered to any user interface that can process web services.
Query as a Web Service is designed to work on top of any Microsoft Windows
application the same way as other web services. Query as a Web Service
is based on the W3C web service specifications SOAP, WSDL, and XML. It
has two main components:
1. Server component
The server component (included in BusinessObjects Enterprise) stores
the Query as a Web Service catalog and hosts the published web services.
2. Client tool
This is how business users create and publish their queries as a web
service on the server. You can install the client tool on several machines
that can access and share the same Query as a Web Service catalog
stored on the server. The client tool communicates with the server
components via web services.
Query as a Web Service allows web queries to be used as part of a range
of client-side solutions.
• Microsoft Office, Excel, and InfoPath.
• SAP Application Server.
• OpenOffice.
• Business rules and process management applications.
• Enterprise Service Bus platforms.
2Architecture

Web Application Container Service (WACS)
If you plan to use a supported Java application server to deploy
BusinessObjects Enterprise web applications, or if you are installing
BusinessObjects Enterprise on a UNIX system, you do not need to install
and use WACS.
Using WACS to host the CMC provides you with a number of advantages:
• WACS requires a minimum effort to install, maintain, and configure.
• All hosted applications are predeployed on WACS, so that no additional
manual steps are required.
• WACS is supported by Business Objects.
• WACS removes the need for Java application server administration and
maintenance skills.
• WACS provides an administrative interface that is consistent with other
Business Objects servers.
Databases
BusinessObjects Enterprise uses three different of databases:
1. System database
An internal database that stores configuration, authentication, user, and
other information related to BusinessObjects Enterprise. System
databases can be created and used on a wide variety of database
platforms.
2. Reporting database
Your organization's database, used to create reports, generate statistics,
and collect business intelligence. An even wider variety of database
platforms are supported for reporting databases than for system
databases.
3. Auditing database
Architecture
2 Databases

An internal database that stores information on security events such as
user login, logout, and object access events.
Please review the online BusinessObjects Enterprise supported platforms
document for information related to supported database release versions,
patch levels, or caveats at the Business Objects customer support site:
http://support.businessobjects.com/documentation/supported_platforms.
System databases
Central Management System (CMS) Database
The Central Management System (CMS) server is the only server that
accesses the CMS system database. The CMS can also maintain an optional
auditing database of information about user actions with the Enterprise
system. The data stored inside the CMS system database allows the CMS
to perform the following tasks:
• Maintaining security
The CMS enforces the application of all rights at the global, folder, and
object level, and supports inheritance at the user and group level.
• Managing objects
The CMS keeps track of the object location and maintains the folder
hierarchy. InfoObjects are system metadata objects that contain index
information. The actual documents/objects are stored in a the FRS. The
separation of the object definition (metadata) from the actual document
allows the system to retrieve only the required information from the system
database, thus providing faster object processing.
• Managing servers
The CMS handles load balancing to help avoid bottlenecks and maximizes
hardware efficiency.
You provide the CMS with database connectivity and credentials when you
install BusinessObjects Enterprise, so the CMS can create the CMS database
using your organization's preferred database servers. Before you install and
2Architecture
Databases

connect the CMS to your own database server, you must create a new,
empty database on your database server.
Note:
• It is strongly recommended that you backup the CMS database and audit
the database frequently.
• The CMS database cannot be accessed or modified directly. You should
only make changes to the system database through BusinessObjects
Enterprise interfaces such as the CMC that interact with the CMS.
• Administrators can access the audit database directly to create custom
audit reports.
Reporting databases
Universes
The universe abstracts the data complexity by using business language
rather than data language to access, manipulate, and organize data. This
business language is stored as objects in a universe file. Web Intelligence
and Crystal Reports use universes to simplify the user creation process
required for simple to complex end-user query and analysis.
Universes are a core component of BusinessObjects Enterprise. All universe
objects and connections are stored and secured in the central repository by
the Connection Server. Universe designers need to login to BusinessObjects
Enterprise to access the system and create universes. Universe access and
row-level security can also be managed at the group or individual user level
from within the design environment.
The semantic layer allows Web Intelligence to deliver documents, by utilizing
multiple synchronized data providers, including online analytical processing
(OLAP) and common warehousing metamodel (CWM) data sources.
Architecture
2 Databases

Views
Business Views simplify report creation and interaction by abstracting the
complexity of data for report developers. Business Views help separate the
data connections, data access, business elements, and access control.
Business Views can only be used by Crystal Reports and are designed to
simplify the data access and view-time security required for Crystal report
creation. Business Views support the combination of multiple data sources
in a single view. Business Views are fully supported in BusinessObjects
Enterprise.
BusinessObjects Enterprise includes a series of dedicated, pre-configured
platform management services for tasks such as password management,
server metrics, and user access control for decentralized management
functions.
Auditing database
The CMS acts as the system auditor; the BusinessObjects Enterprise server
that you monitor is the auditee.
As the auditor, the CMS controls the overall audit process. Each server writes
audit records to a log file local to the server. At regular intervals, the CMS
communicates with the auditee servers to request copies of records from
the auditee's local log files. When the CMS receives these records it writes
data from the log files to the central auditing database.
The CMS also controls the synchronization of audit actions that occur on
different machines. Each auditee provides a time stamp for the audit actions
that it records in its log file. To ensure that the time stamps of actions on
different servers are consistent, the CMS periodically broadcasts its system
time to the auditees. The auditees then compare this time to their internal
clocks. If differences exist, the auditees correct the time stamps that are
recorded in their log files for subsequent audit actions.
Note:
• You must configure the auditing database on the CMS before you can
begin to audit.
2Architecture
Databases

• The CMS acts as both an auditor and as an auditee when you configure
it to audit an action that the CMS controls.
• In a CMS cluster, the cluster assigns the first CMS to start to act as a
system auditor. If the machine that is running this CMS fails, another CMS
from the cluster takes over and begins acting as the auditor.
Authentication and single sign-on
System security is managed by the Central Management Server (CMS),
security plug-ins, and third-party authentication tools, such as SiteMinder or
Kerberos. These components authenticate users and authorize user access
for BusinessObjects Enterprise, its folders, and other objects.
This section discusses key components of system security, including:
• CMS security.
• Third-party security plug-ins.
Note:
Because these components are responsible for additional tasks, several are
described in more detail in other sections.
Central Management Server (CMS) security
The CMS handles security information, such as user accounts, group
memberships, and object rights that define user and group privileges.
When you set up your system, the CMS allows you to create user accounts
and groups within BusinessObjects Enterprise, or reuse existing user
accounts and groups that are stored in a third-party system (such as LDAP
or Windows Active Directory). The CMS supports third-party authentication,
so users can log into BusinessObjects Enterprise with their current LDAP,
or Windows AD credentials.
When users log on, the CMS coordinates the authentication process with its
security plug-ins; the CMS then grants the user a logon token and an active
session on the system. The CMS also responds to authorization requests
made by the rest of the system. When a user requests a list of reports in a
particular folder, the CMS authorizes the request only when it has verified
that the user's account or group membership has sufficient privileges.
Architecture
2 Authentication and single sign-on

Security plug-ins
Security plug-ins expand and customize the ways in which users are
authenticated. BusinessObjects Enterprise ships with the BusinessObjects
Enterprise security plug-in as a default, and with LDAP and Windows Active
Directory security plug-ins. Each security plug-in offers several key benefits.
Security plug-ins automate account creation and management by allowing
you to map user accounts and groups from third-party systems into
BusinessObjects Enterprise. You can map third-party user accounts or groups
to existing BusinessObjects Enterprise user accounts or groups, or you can
create new Enterprise user accounts or groups that correspond to each
mapped entry in the external system.
The security plug-ins dynamically maintain third-party user and group listings.
So, once you map an LDAP or Windows Active Directory group into
BusinessObjects Enterprise, all users who belong to that group can log into
BusinessObjects Enterprise. When you make subsequent changes to the
third-party group membership, you need not update or refresh the listing.
BusinessObjects Enterprise supports the following security plug-ins:
• BusinessObjects Enterprise security plug-in
• LDAP security plug-in
• Windows AD and NT security plug-in
Note:
The third-party Windows NT, LDAP, and Windows AD security plug-ins work
only once you have mapped groups from the external user database to
BusinessObjects Enterprise.
Authentication and authorization
Authentication is the process of verifying the identity of a user who attempts
to access the system. This process is distinct from authorization. Authorization
is the process of verifying that the user has been granted sufficient rights to
perform the requested action upon the specified object.
BusinessObjects Enterprise is fully customizable, therefore authentication
processes can vary from system to system.
2Architecture

BusinessObjects Enterprise supports these methods of authentication:
• Enterprise authentication
• Windows NT authentication
• Lightweight Directory Access Protocol (LDAP) authentication
• Windows AD authentication
BusinessObjects Enterprise authentication
The system default, BusinessObjects Enterprise authentication, is used in
environments that prefer to maintain a distinct set of accounts for use with
BusinessObjects Enterprise authentication is always enabled; it cannot be
disabled.
• Use the system default Enterprise Authentication if you prefer to create
distinct accounts and groups for use with BusinessObjects Enterprise, or
if you have not already set up a hierarchy of users and groups in a
Windows NT server, an LDAP directory server, or a Windows AD server.
Windows NT authentication
BusinessObjects Enterprise supports NT authentication with the Windows
NT security plug-in, which is included by default when the product is installed
on Windows. Support for NT authentication means that users or groups
created with NT, Windows 2000 and Windows 2003 can be used to
authenticate with BusinessObjects Enterprise. This allows you to map
previously created NT user accounts and groups, instead of setting up each
user and group within BusinessObjects Enterprise.
Note:
Although a user can configure Windows NT authentication for
BusinessObjects Enterprise and custom applications through the CMC, the
CMC and InfoView themselves do not support Windows NT authentication.
LDAP authentication
Lightweight Directory Access Protocol (LDAP) is a set of protocols used to
access information stored in directories. A very common use for an LDAP
directory is to maintain user and group account information.
BusinessObjects Enterprise supports the use of an existing LDAP account
directory, eliminating the need to recreate user and group accounts in
Architecture
2 Authentication and single sign-on

BusinessObjects Enterprise. By mapping your LDAP groups to
BusinessObjects Enterprise, users are able to log into Enterprise with their
LDAP user name and password.
Directories that support LDAP include:
• Sun iPlanet Directory Server
• Lotus Domino Directory Server
• IBM Secureway
• Novell Directory Services (NDS)
LDAP authentication is enabled using the Manage Authentication section of
the CMC.
Note:
You can specify that BusinessObjects Enterprise use a Secure Sockets
Layer (SSL) connection to communicate to the LDAP directory server for
additional security. For more information, see the BusinessObjects Enterprise
Administrator's Guide.
Active Directory authentication
Windows AD security plug-in enables you to map user accounts and groups
from your Windows 2000 Active Directory (AD) system to BusinessObjects
Enterprise; it also enables BusinessObjects Enterprise to verify all login
requests that specify Windows AD Authentication. Users are authenticated
against the Windows AD system, and have their membership in a mapped
AD group verified before the Crystal Management Server (CMS) grants them
an active BusinessObjects Enterprise session.
Note:
Although a user can configure Windows NT authentication for
BusinessObjects Enterprise and custom applications through the CMC, the
CMC and InfoView themselves do not support Windows AD authentication
with NTLM. The only methods of authentication that the CMC and InfoView
support are Windows AD with Kerberos, LDAP, Enterprise, and Trusted
Authentication.
Trusted Authentication
Users prefer to log into the system once, without needing to provide
passwords several times during a session. Trusted Authentication provides
2Architecture

a Java single sign-on solution for integrating your BusinessObjects Enterprise
authentication solution with third-party authentication solutions. Applications
that have established trust with the Central Management Server can use
Trusted Authentication to allow users to log on without providing their
passwords. To enable Trusted Authentication, you must configure both the
server, through the CMC, and the client, in the web.xml file. For more
information, see BusinessObjects Enterprise Administrator's Guide.
Primary authentication
Primary authentication occurs when a user first attempts to access the
system. One of two things can happen during primary authentication:
• If single sign-on is not configured, the user provides their credentials,
such as their user name, password and authentication type. These details
are entered by the users on the logon screen.
• If a method of single sign-on is configured, the credentials for the users
are silently propagated. These details are extracted using other methods
such as Kerberos and SiteMinder.
The authentication type may be Enterprise, Windows NT, LDAP, or Windows
AD authentication, depending upon which type(s) you have enabled and set
up in the Authentication management area of the Central Management
Console (CMC). The user's web browser sends the information by HTTP to
your web server, which routes the information to the CMS or the appropriate
BusinessObjects Enterprise server.
Information Workflows
When tasks are performed in BusinessObjects Enterprise, such as logging
in, scheduling a report, or viewing a report, information flows through the
system and the servers communicate with each other. The following section
describes some of the process flows as they would happen in the
BusinessObjects Enterprise system.
Architecture
2 Information Workflows

Authentication
Logging on to BusinessObjects Enterprise
1. The web client sends the login request via the web server to the web
application server.
2. The web application server determines that the request is a logon request.
The web application server sends the username, password, and
authentication type to the specified CMS for authentication.
3. The CMS validates the username and password against the appropriate
database (in this case BusinessObjects Enterprise authentication is
authenticated against the system database).
4. Upon successful validation, the CMS creates a session for the user in its
own memory.
5. The CMS sends a response to the web application server to let it know
that the validation was successful. The web application server generates
a logon token for the user session in its memory. For the rest of this
session, the web application server uses the logon token to validate the
user against the CMS.
6. The web application server generates an HTML page to send to the client.
The web application server sends the response back to the user's machine
where it is rendered in the web client.
Starting the Server Intelligence Agent
1. The Server Intelligence Agent (SIA) starts up and looks in the cache for
a list of CMSes (local or remote) to connect to. This CMS list is kept
up-to-date and refreshed as soon as a new CMS appears. According to
the information in the cache, the SIA either: (1) starts the local CMS and
connects to it or (2) connects to a remote CMS.
2. After the SIA has successfully connected, it asks the CMS for a list of
server service(s) to manage. The CMS finds information on server services
and their configuration from the system database.
3. The system database returns the list of servers and the associated
configuration information back to the CMS (for example, Adaptive Job
Server, Destination Job Server, Desktop Intelligence Processing Server,
and Crystal Reports Processing Server).
2Architecture

4. The CMS sends the list of servers and the configuration information to
the SIA.
5. The SIA starts the servers (for example, Adaptive Job Server, Destination
Job Server, Desktop Intelligence Processing Server, and Crystal Reports
Processing Server) and begins monitoring them. The SIA starts the servers
according to the associated configuration information.
Scheduling
Setting a schedule for a Crystal Report to run now
1. The user schedules a report and the request is sent to the web application
server.
2. The web application server passes the request to the CMS.
3. The CMS determines whether or not the user has the appropriate rights
to schedule the report.
4. If the user has the appropriate rights to schedule the report, the CMS
commits the scheduled object request to the CMS system database.
5. When the scheduled time arrives, the CMS locates an available Crystal
Reports Job Server based on the Maximum Jobs Allowed value configured
for each Crystal Reports Job Server.
6. The CMS sends the job information to the Crystal Reports Job Server.
7. The Crystal Reports Job Server determines the location of the Input File
Repository Server that houses this report. The Crystal Reports Job Server
then requests the report template from the Input FRS.
8. The Input FRS locates the report template and then streams to the Crystal
Reports Job Server.
9. The report template is placed in a temporary directory on the Crystal
Reports Job Server.
10. The Crystal Reports Job Server launches a child process
(JobServerChild.exe) to coordinate running the report.
11. JobServerChild.exe launches ProcReport.dll and passes it all instances
received from the Crystal Reports Job Server. ProcReport.dll calls
Crpe32.dll.
12. The report is created when the Crpe32.dll completes the following tasks:
• Open the report.
Architecture

• Connect to the production database.
• Process the report.
• Create and save the report instance.
• Pass the report back to JobServerChild.exe.
13. The Crystal Reports Job Server updates the CMS periodically with the
job status. At this time the status shows that the report is processing.
14. JobServerChild.exe uploads the report instance to the Output FRS.
15. The Output FRS notifies the JobServerChild.exe that the report has been
saved successfully.
16. JobServerChild.exe notifies the Crystal Reports Job Server that the report
creation has completed.
17. The Report Job Server updates the CMS with the job status. The
JobServerChild.exe clears itself from memory.
18. The CMS updates the job status in its memory, and then writes the
instance information to the BusinessObjects Enterprise System database.
Running a schedule for a Crystal Report to a default location
1. The Central Management Server (CMS) constantly checks the system
database to determine if there is any schedule to be run at that time.
2. When the time specified by the schedule arrives, the CMS locates an
available Crystal Reports Job Server based on the Maximum Jobs Allowed
value configured on each Crystal Reports Job Server. The CMS sends
the job information to the Crystal Reports Job Server. The information
the CMS sends to the Crystal Reports Job Server is Report ID, Format,
Destination, Logon information, parameters, and selection formulas.
3. The Crystal Reports Job Server communicates with the Input File
Repository Server (FRS) to obtain a report template as per the requested
Report ID.
4. The Crystal Reports Job Server launches the JobChildserver process.
5. The child process (JobChildserver) launches the ProcReport.dll upon
receiving the template from the Input File Repository Server via the
Enterprise Infrastructure. The ProcReport.dll contains all of the parameters
that were passed from the CMS to the Crystal Reports Job Server.
6. The ProcReport.dll launches the Crpe32.dll that processes the report
according to all the parameters that were passed.
2Architecture

7. While still processing, records are retrieved from a database server as
defined within a report.
8. The Crystal Reports Job Server updates the CMS periodically with the
job status. At this time the status shows that it is processing.
9. Once the report is compiled into the memory of the Crystal Reports Job
Server, it needs to be exported to a different format, such as Portable
Document Format (PDF). When exporting to PDF, the PDF .dll is used.
10. The report with saved data also needs to be submitted to the default
location. Then it will be sent to the Output FRS.
11. Once that process is finished, the Crystal Reports Job Server updates
the CMS with the job status. At this time the status is reported as a
success.
Setting a schedule for a Crystal Report
1. The web client submits a schedule request in an URL, typically via the
web server to the web application server.
2. The web application server interprets the URL request and determines
that the request is a schedule request. The web application server sends
the schedule time, database login values, parameter values, destination,
and format to the specified CMS.
3. The CMS ensures that the user has rights to schedule the object. If the
user has sufficient rights, the CMS adds a new record to the system
database. The CMS also adds the instance to its list of pending schedules.
Setting a schedule for a Web Intelligence document
1. The user sets a schedule for a document and the request is sent to the
web server. The web server passes the document schedule request to
the web application server.
2. The web application server passes the document schedule request to
the CMS.
3. The CMS determines whether or not the user has the appropriate rights
to schedule the document. If the user has the appropriate rights to
schedule the document, the user then sets the different scheduling
parameters, and the CMS commits the scheduled object request to the
Architecture

CMS system database. An instance of the Web Intelligence document is
created in the CMS that contains all the relevant scheduling information.
Running a schedule for a Web Intelligence Document
1. The CMS monitors the system database to determine if there is a schedule
run at that time.
2. When the scheduled time arrives, the CMS sends the schedule request
and all the information about the request to the Adaptive Job Server that
houses the Web Intelligence Scheduling and Publishing Service.
3. The Adaptive Job Server (Web Intelligence Scheduling and Publishing
Service) locates an available Web Intelligence Processing Server based
on the Maximum Jobs Allowed value configured on each Web Intelligence
Processing Server.
4. The Web Intelligence Processing Server determines the location of the
Input File Repository Server (FRS) that houses the document and the
universe metalayer file on which the document is based. The Web
Intelligence Processing Server then requests the document from the Input
FRS. The Input FRS locates the Web Intelligence document as well as
the universe file on which the document is based and then streams them
to the Web Intelligence Processing Server.
5. The Web Intelligence document is placed in a temporary directory on the
Web Intelligence Processing Server. The Web Intelligence Processing
Server opens the document in memory. The QT.dll generates the SQL
from the Universe on which the document is based. The Connection
Server (component of the Web Intelligence Process Server) connects to
the database. The query data passes through QT.dll back to the Document
Engine where the document is processed. A new successful instance is
created.
6. The Web Intelligence Processing Server uploads the document instance
to the Output FRS.
7. The Web Intelligence Processing Server notifies the Adaptive Job Server
(Web Intelligence Scheduling and Publishing Service) that document
creation is completed. If the document is scheduled to go to a destination
(file system, FTP, SMTP, or Inbox), the Adaptive Job Server retrieves the
processed document from the Output FRS and delivers it to the specified
destination(s). Assume that this is not the case in this example.
8. The Adaptive Job Server (Web Intelligence Scheduling and Publishing
Servrice) updates the CMS with the job status.
2Architecture

instance information to the BusinessObjects Enterprise system database.
Running a schedule for a program
1. The user schedules an object and the request is sent to the web server.
2. The web server passes the object schedule request to the web application
server.
4. The CMS determines if the user has the appropriate rights to schedule
the object.
5. If the user has the appropriate rights to schedule the object, the CMS
6. When the scheduled time arrives, the CMS locates an available Program
Job Server based on the Maximum Jobs Allowed value configured on
each Program Job Server.
7. The CMS sends the job information to the Program Job Server.
8. The Program Job Server communicates with the Input File Repository
Server and requests the program object.
9. The Input File Repository Server returns the program object back to the
Program Job Server.
10. The Program Job Server launches the scheduled object.
11. The Program Job Server updates the CMS periodically with the job status.
At this time the status reported is that the program is processing.
12. The Program Job Server sends a log file to the Output File Repository
Server.
13. The Output File Repository Server notifies the Program Job Server that
the object was scheduled successfully by sending an object log file.
14. The Program Job Server updates the CMS with the job status.
15. The CMS updates the job status in its memory, and then writes the object
Sending an instance to a destination
1. The user schedules an object and the request is sent to the web server.
2. The web server passes the object schedule request to the web application
server.
Architecture

4. The CMS determines if the user has the appropriate rights to schedule
the object.
5. If the user has the appropriate rights to schedule the object, the CMS
6. When the scheduled time arrives, the CMS locates an available Program
Job Server based on the Maximum Jobs Allowed value configured on
each Program Job Server.
7. The CMS sends the job information to the Program Job Server.
8. The Program Job Server communicates with the Input File Repository
Server and requests the program object.
9. The Input File Repository Server returns the program object back to the
Program Job Server.
10. The Program Job Server launches the scheduled object.
11. The Program Job Server updates the CMS periodically with the job status.
At this time the status reported is that the program is processing.
12. The Program Job Server sends a log file to the Output File Repository
Server.
13. The Output File Repository Server notifies the Program Job Server that
the object was scheduled successfully by sending an object log file.
14. The Program Job Server updates the CMS with the job status.
15. The CMS updates the job status in its memory, and then writes the object
Viewing
Viewing an instance when the page exists on the Cache Server
1. The web client sends a view request in a URL to the web application
server.
2. The web application server interprets the request and determines that it
is a request to view the first page of the selected report instance. The
web application server sends a request to the CMS to ensure that the
user has rights to view the instance.
3. The CMS checks the system database to verify the user rights.
2Architecture

4. The CMS sends a response to the web application server to confirm the
user has sufficient rights to view the instance.
5. The web application server sends a request to the Crystal Reports Cache
Server requesting the first page of the report instance. The Crystal Reports
Cache Server checks to see if the page already exists. If the page does
exist, the Crystal Reports Cache Server returns the page to the web
application server.
6. The web application server sends the .epf page to the web client where
it is rendered in the ActiveX viewer.
Viewing a page of a report instance when the cache file of the
page does not exist
1. The user sends the view request through the web server to the web
application server.
2. The web application server recognizes the request as a request to view
a report page. The web application server checks the CMS to ensure the
user has sufficient rights to view the report.
3. The CMS determines if the user has the appropriate rights to view the
report.
user has sufficient rights to view the report.
Server for the requested report page (EPF file).
6. The Crystal Reports Cache Server determines if the requested EPF file
exists in the cache directory.
7. The requested EPF file is not found in the cache directory.
8. The Crystal Reports Cache Server sends the request to the Crystal
Reports Page Server.
9. The Crystal Reports Page Server queries the Output FRS for the
requested report instance.
10. The Output FRS sends the requested report instance to the Crystal
11. The Crystal Reports Page Server opens the report instance and checks
the report to determine if it has data.
12. The Crystal Reports Page Server determines that the report contains
data and creates the .EPF file for the requested report page without having
to connect to the production database.
Architecture

13. The Crystal Reports Page Server sends the EPF file to the Crystal Reports
Cache Server.
14. The Crystal Reports Cache Server writes the EPF file to the cache
directory.
15. The Crystal Reports Cache Server sends the requested page to the web
application server.
16. The web application server forwards the file to the web server.
17. The web server sends the requested page to the report viewer.
Viewing a Voyager workspace
1. The web client sends a request via the web server to the web application
server to view a new workspace. The web client communicates with the
web application server using DHTML AJAX technology (Asynchronous
JavaScript and XML). The AJAX technology allows for partial page
updates, so a new page does not have to be rendered for each new
request.
2. The web application server translates the request and sends it to the
platform (CMS) to determine whether a user is entitled to view or create
a new workspace.
3. The CMS retrieves the user's credentials from the system database.
4. If the user is allowed to view or create a workspace, the CMS confirms
this to the web application server. At the same time, it also sends a list
of one or more available MDAS Servers via CORBA.
5. The web application server picks an MDAS Server from the list of available
choices and sends a CORBA request to the MDAS Server to find the
appropriate OLAP server(s) to create a new, or refresh an existing,
workspace.
6. The MDAS server needs to communicate with the Input FRS to retrieve
the appropriate workspace document that has information about the
underlying OLAP Database and an initial OLAP query saved with it. The
Input FRS retrieves the appropriate Information Analyzer workspace
(.amw) from the underlying directory (via OS) and then streams that
workspace back to the MDAS.
7. The MDAS Server opens the workspace, formulates a query, and sends
it to the OLAP Database Server. The MDAS Server has to have an
appropriate OLAP database client configured for the OLAP data source.
The translation of the web client query into the appropriate OLAP query
2Architecture

needs to occur. The OLAP Database Server sends the query result back
to the MDAS Server.
8. The MDAS Server, based on the request to either create, view, print, or
export, prerenders the result to enable the Java WAS to finish the
rendering more quickly. The MDAS Server sends XML packages of
prerendered result back to the web application server.
9. The web application server renders the workspace and sends the
formatted page or portion of the page to the web client via the web server.
The web client displays the updated or newly requested page. This is a
zero-client solution that does not need to download any Java or ActiveX
components.
On Demand
Viewing a report on demand
1. The web client sends the view on demand request in an URL typically
via the web server to the web application server.
2. The web application server interprets the requested page and the values
sent in the URL request and determines that it is a request to view the
first page of the selected report object.
3. The web application server sends a request to the CMS to ensure that
the user has rights to view the object. The CMS checks the system
database to verify the user rights.
user has sufficient rights to view the object.
Server requesting the first page of the report object.
6. The Crystal Reports Cache Server checks to see if the page already
exists. Unless the report meets the requirements for On Demand report
sharing (within a set time of another On Demand request, database login,
parameters), the Crystal Reports Cache Server sends a request for the
Crystal Reports Processing Server to generate the page.
7. The Crystal Reports Processing Server requests the report object from
the Input File Repository Server. The Input File Repository Server streams
a copy of the object to the Crystal Reports Processing Server. The Crystal
Reports Processing Server opens the report in its memory and checks
to see if the report contains data.
Architecture

8. Assuming that there is no data in the report object, the Crystal Reports
Processing Server must connect to the database to query for data.
9. The Crystal Reports Processing Server sends the .epf page to the Crystal
Reports Cache Server. The Crystal Reports Cache Server stores a copy
of the .epf page in its cache directory in anticipation of new viewing
requests.
Note:
An .etf page may also be generated and sent to the Crystal Reports Cache
Server in this step. The .etf page (left pane group tree navigation of the
report) is generated when the first page of report is generated and when
the report is grouped. There is only one .etf page per report, but the size
of this .etf page can be substantial.
10. The Crystal Reports Cache Server sends the .epf page to the web
application server.
11. The web application server sends the .epf page to the web server. The
web server sends the .epf page to the user's machine where it is rendered
in the viewer in the web client.
Viewing a Web Intelligence document on demand
1. A web browser sends the view request to the web application server via
the web server.
2. The web application server determines that the request is for a Web
Intelligence document, and sends a request to the CMS to ensure the
user has the appropriate rights to view the document.
user has sufficient rights to view the document.
4. The web application server sends a request to the Web Intelligence
Processing Server, requesting the document.
5. The Web Intelligence Processing Server requests the document from the
Input File Repository Server as well as the universe file on which the
requested document is built. The universe file contains metalayer
information, including row- and column-level security.
6. The Input File Repository Server streams a copy of the document to the
Web Intelligence Processing Server, as well as the universe file on which
the requested document is built.
7. The Web Intelligence Report Engine opens the document in memory.
8. The Web Intelligence Report Engine uses QT component (inproc) and
ConnectionServer (inproc). The QT component
2Architecture

generates/validates/regenerates the SQL and connects to the database
to run the query. The ConnectionServer uses the SQL to get the data
from the database to the Report Engine where the document is processed.
9. The Web Intelligence Processing Server sends the viewable document
page that was requested to the web application server. The web
application server forwards this viewable page to the web server. The
web server sends the viewable page to the user's machine, where it is
rendered in a web browser.
Viewing a Desktop Intelligence document on demand using the web view format
1. The web client sends the view Desktop Intelligence document request in
an URL to the web server.
2. The web server sends the request to the web application server.
sent in the URL request and determines it is a request to view a Desktop
Intelligence document. The web application server sends a request to
the CMS to ensure that the user has rights to view the document.
4. The CMS checks the system database to verify the user rights.
user has sufficient rights to view the document.
6. The web application server sends a request to the Desktop Intelligence
Cache Server requesting the document.
7. The Desktop Intelligence Cache Server checks whether the page is
already cached. If it is, the Desktop Intelligence Cache Server returns
that viewable page back to the web application server. If not, the Desktop
Intelligence Cache Server asks the Desktop Intelligence Processing
Server to generate the requested viewable page of the Desktop
Intelligence document.
8. The Desktop Intelligence Processing Server requests the document and
the universe on which the document is based from the Input FRS. The
Input FRS streams a copy of the document and the universe to the
Desktop Intelligence Processing Server. The Desktop Intelligence report
engine opens the document and the universe in its memory. The Desktop
Intelligence Processing Server generates the SQL from the universe that
the report is based on.
9. The Connection Server library (part of the Desktop Intelligence Processing
Server) connects to the database to run the query. The query data is
passed back to the report engine where the document is processed.
Architecture

10. The Desktop Intelligence Processing Server sends the requested viewable
page (HTML pages) of the document to the Desktop Intelligence Cache
server.
11. The Desktop Intelligence Cache server stores that viewable page locally
(HTML pages) in anticipation of future requests to view that already
created page. The Desktop Intelligence Cache server then passes the
viewable page (obtained from the Desktop Intelligence Processing Server)
back to the web application server.
12. The web application server does not need to convert that viewable page
to HTML because it is already in HTML format and passes the page to
the web server.
13. The web server sends the HTML page (viewable page of the document)
to the user's machine where it is rendered in the web browser.
Viewing a report on demand when the default view format is set to Web Java
1. The web client sends the view on demand request via the web server to
the web application server.
sent in the URL request and determines that it is a request to view the
first page of the selected report object.
3. The web application server sends a request to the CMS to ensure that
the user has rights to view the object. The CMS checks the system
database to verify the user rights.
user has sufficient rights to view the object.
Server requesting the first page of the report object.
6. The Crystal Reports Cache Server checks to see if the page already
exists. Unless the report meets the requirements for On Demand report
sharing (within a set time of another On Demand request, database login,
parameters), the Crystal Reports Cache Server sends a request for the
Crystal Reports Processing Server to generate the page.
7. The Crystal Reports Processing Server requests the report object from
the Input File Repository Server. The Input File Repository Server streams
a copy of the object to the Crystal Reports Processing Server. The Crystal
Reports Processing Server opens the report in its memory and checks
to see if the report contains data.
8. Assuming that there is no data in the report object, the Crystal Reports
Processing Server must connect to the database to query for data.
2Architecture

9. The Crystal Reports Processing Server sends the .epf page to the Crystal
Reports Cache Server. The Crystal Reports Cache Server stores a copy
of the .epf page in its cache directory in anticipation of new viewing
requests. An .etf page may also be generated and sent to the Crystal
Reports Cache Server in this step. The .etf page (left-pane group tree
navigation of the report) is generated when the first page of the report is
generated and when the report is grouped. There is only one .etf page
per report, but the size of this .etf page can be substantial.
10. The Crystal Reports Cache Server sends the .epf page to the web
application server.
11. The web application server sends the .epf page to the web server. The
web server sends the .epf page to the user's machine where it is rendered
in the viewer in the web client.
Architecture

Managing and Configuring
Servers
3

Server management overview
Tip:
For the latest version of this documentation, consult the BusinessObjects
Enterprise XI Administrator's Guide. The latest version of this guide is
available on the Business Objects web site: http://support.businessob
jects.com/documentation/product_guides/default.asp
The following table provides definitions for important concept used throughout
this section.
Definition usedConcept
A subsystem that provides a function. For example the
Destination Configuration service is used to configure target
recipients for Crystal for Crystal Reports.
Service
An OS level process hosting one or more services. Examples
include the Central Management Server (CMS) and Adaptive
Processing Server. The Adaptive Processing Server can
host the "Client Auditing Proxy Service", "Publishing Service",
"Search Service", etc.
Server
A collection of BusinessObjects Enterprise servers, all run-
ning on the same host and managed by a single SIA. One
or more nodes can be on a single host.
Node
A physical computer or a virtual machine.Host
A SIA is deployed on every node. It starts, stops, monitors
and manages all servers on its node. If a server crashes or
ceases to function, the SIA will restart the server.
Server Intelli-
gence Agent
(SIA)
This section provides information on a range of server tasks that allow you
to customize the behavior of BusinessObjects Enterprise. It also includes
information on the server settings that you can alter to accommodate the
needs of your organization. The default values for these settings have been
chosen to maximize the reliability, predictability, and consistency of operation
of a typical BusinessObjects Enterprise installation. The default settings
ensure the highest degree of data accuracy and timeliness. For example,
by default, data sharing between reports is disabled. When running reports
on demand, disabling data sharing means that every user can always assume
that they will receive the latest data.
Managing and Configuring Servers
3 Server management overview

If you prefer to place more emphasis on the efficiency, economy, and
scalability of BusinessObjects Enterprise, you can tune server settings to
set your own balance between system reliability and performance. For
example, enabling data sharing between reports markedly increases system
performance when user loads are heavy. To take advantage of this feature
while ensuring that every user receives data that meets your criteria for
timeliness, you can also specify how long data will be shared between users.
BusinessObjects Enterprise administrative tools
BusinessObjects Enterprise includes two key administrative tools that allow
you to access a variety of server settings:
• Central Management Console (CMC)
The CMC is the web-based administration tool that allows you to view
and to modify server settings while BusinessObjects Enterprise is running.
For instance, you use the CMC to change the status of a server, change
server settings, access server metrics, or create server groups. Because
the CMC is a web-based interface, you can configure your
BusinessObjects Enterprise servers remotely over the Internet or through
your corporate intranet.
For more information about the Servers management area of the CMC,
see Working with the Servers management area in the CMC on page 124.
• Central Configuration Manager (CCM)
The CCM is a troubleshooting tool that allows you to configure and
manage the Server Intelligence Agent. The Server Intelligence Agent is
the component that allows you to manage all servers through the CMC.
You can also use the CCM to create and manage nodes in your
deployment. Note that most server management tasks are now handled
through the CMC, not in the CCM. (The CCM was the primary tool for
server management in previous versions.) After you configure and enable
nodes in the CCM, you can perform other server management tasks in
the CMC. For more information, see About Server Intelligence on page 130.
The CCM is now used primarily for node configuration, and for
troubleshooting when you cannot access the CMC. For example, if you
need to reconfigure the CMS and do not have access to the CMC, you
can click Manage Servers in the CCM to log in and view all servers in
3Managing and Configuring Servers

your deployment. For more information, see Starting, stopping, and
restarting servers on page 140.
When managing servers through the Central Configuration Manager
(CCM) in a side-by-side deployment, where two BusinessObjects
Enterprise systems work alongside one another, you must ensure that
you connect to the correct deployment so that you don't accidentally edit,
disable, or delete the servers connected to another system. It is
recommended that you follow these best practices:
• Specify the port number when connecting to the deployments.
For example, mymachine:6400 or mymachine:6403.
• Administer the BusinessObjects Enterprise deployment from the local
machine, and administer the previous version's deployment remotely,
from a different machine.
• Use different passwords for the administrator accounts for the two
deployments.
Working with the Servers management area in the
CMC
The Servers management area of the CMC is your primary tool for server
management tasks. It provides a list of all of the servers in your
BusinessObjects Enterprise. For most management and configuration tasks,
you need to select a server in the list and choose a command from the
Manage or Action menu.
About the navigation tree
The navigation tree on the left side of the Servers management area provides
a number of ways to view the Servers list. Select items in the navigation tree
to change the information displayed in the Details pane.
DescriptionNavigation tree option
Displays a complete list of all servers
in the deployment.
Servers List

Displays a flat list of all available
server groups in the Details pane.
Select this option if you want to con-
figure a server group's settings or
security. For more information, see
Server groups on page 150.
Server Groups List
Lists the server groups and the
servers within each server group.
When you select a server group, its
servers and server groups are dis-
played in the Details pane in a hierar-
chical view.
Server Groups
Displays a list of the nodes in your
deployment. Nodes are configured
in the CCM. For more information,
see Working with nodes on page 134.
Nodes

Provides a list of the types of services
that may be in your deployment.
Service categories are divided into
core BusinessObjects Enterprise
services and services associated with
specific Business Objects compo-
nents. Service categories include:
• Core Services
• Crystal Reports
• Desktop Intelligence
• Performance Management
• Voyager
• Web Intelligence
Select a service category in the navi-
gation list to view the servers in the
category.
Service Categories

Displays the servers according to
their current status. This is a valuable
tool for checking to see which of your
servers are running or stopped. If you
are experiencing slow performance
on the system, for example, you can
use the Server Status list to quickly
determine if any of your servers are
in an abnormal state. Possible server
states include the following:
• Stopped
• Starting
• Initializing
• Running
• Stopping
• Started with Errors
• Failed
• Waiting for resources
For more information about changing
the state of a server, see Viewing and
changing the status of servers on
page 139.
Server Status
About the Details pane
Depending on which options you have selected in the navigation tree, the
Details pane on the right side of the Servers management area shows a list
of servers, server groups, states, categories, or nodes. The following table
describes the information listed for servers in the Details pane.
Note:
For nodes, server groups, categories, and states, the Details pane usually
shows names and descriptions.

DescriptionDetails pane column
Displays the name of the server.Server Name or Name
Displays the current status of the
server. You can sort by server state
using the Server Status list in the
navigation tree. Possible server
states include the following:
• Stopped
• Starting
• Initializing
• Running
• Stopping
• Started with Errors
• Failed
• Waiting for resources
For more information about changing
the state of a server, see Viewing and
changing the status of servers on
page 139.
State
Displays whether the server is en-
abled or disabled.
Enabled
If the server is marked as Stale, then
it requires a restart. For example, if
you change certain server settings in
the server's Properties dialog box,
you may need to restart the server
before the changes will take effect.
For information on restarting servers,
see Starting, stopping, and restarting
servers on page 140.
Stale

DescriptionDetails pane column
Displays the type of server.Kind
Displays the Host Name for the
server.
Host Name
Displays the unique Process ID
number for the server.
PID
Displays a description of the server.
You can change this description in
the server's Properties page. For
more information, see To change a
server's properties on page 405.
Description
Displays the date that the server was
last modified, or when the server's
state was changed. This column is
very useful if you want to check the
status of recently changed servers.
Date Modified
About Web Application Container Servers
Web Application Container Servers (WACS) can be used to host
BusinessObjects Enterprise web applications such as the Central
Management Console (CMC) on Windows operating systems. WACS requires
a minimum effort to install, maintain, and configure, and provide an
administrative interface that is consistent with other BusinessObjects
Enterprise servers.
Related Topics
• Web Application Container Server (WACS) on page 323

About Server Intelligence
Server Intelligence is the underlying server management architecture that
simplifies the administration and deployment of BusinessObjects Enterprise
servers and services. Instead of manually administering servers via the
Central Configuration Manager, you can now handle most server
administration tasks online using the Central Management Console.
Server Intelligence allows you to use the CMC for all daily maintenance
tasks, such as adding and configuring new servers, or starting and stopping
existing servers. And it also allows you to automate certain server processes,
such as restarting or shutting down servers that stop unexpectedly. If a CMS
system database becomes unavailable, it is automatically reconnected.
Server Intelligence also manages server configuration information, storing
it in the CMS so you can easily restore default server settings or create
duplicate "clone" servers with the same settings. All of these features make
it easier to fine-tune your system's performance and fault tolerance.
Note:
Server Intelligence simplifies many procedures that you needed to perform
manually in earlier versions of BusinessObjects Enterprise. Many of the tasks
that used to be carried out in the CCM are now managed in the CMC. To
understand the differences in these procedures, experienced administrators
should carefully read the new server management procedures in this section.
About the Server Intelligence Agent (SIA)
Server Intelligence is managed via the Server Intelligence Agent (SIA), the
component that processes the server management tasks. An SIA is deployed
on each node within your BusinessObjects Enterprise deployment. A node
is a collection of BusinessObjects Enterprise servers, running on the same
host and managed by a single SIA.
The SIA maintains server status according to the settings you specify in the
CMC. It processes the CMC's requests to start, stop, monitor, and manage
all servers on the node, and it also monitors potential problems and
automatically restarts servers that have shut down unexpectedly. The SIA
ensures optimal performance by continually monitoring server status
information, which is stored in the CMS database. When you change a

server's settings or add a new server in the CMC, the CMS notifies the SIA,
and the SIA performs the task.
The SIA is automatically configured during installation, but you can change
these default settings through the CCM.
Server management: what's new in this version of
This section summarizes the key differences in server management tasks
between BusinessObjects Enterprise XI Release 2 and BusinessObjects
Enterprise XI 3.x. One of the key improvements in this version of
BusinessObjects Enterprise is that most server management tasks are now
handled through the CMC instead of the CCM. Although this change makes
servers easier to manage, administrators who are accustomed to using earlier
versions of BusinessObjects Enterprise will notice several changes in how
many common tasks are performed.
Most of the procedural changes are the result of the introduction of Server
Intelligence, a new feature that allows you to handle most server management
tasks via the CMC. For general information about Server Intelligence, see
About Server Intelligence on page 130.
The following table provides a list of some of the procedures that are affected
by the introduction of Server Intelligence, and links are included for the new
step procedures:
BusinessObjectsEnter-
prise XI 3.x
BusinessObjects En-
terprise XIR2
Procedure
You can perform a Cus-
tom installation. During
the Custom installation,
make sure you select
the CMS and deselect
the mySQL installation
option.
Performed an Expand
installation.
Adding a new machine
with a CMS to a cluster.

prise XI 3.x
BusinessObjects En-
terprise XIR2
Procedure
You can now use either
the CMC or the CCM to
view and change the
state of servers located
on any machine in the
cluster.
In the CMC, you can
now use the Server Sta-
tus option in the naviga-
tion tree to view servers
according to their cur-
rent state.
In the CMC, you can
now use the Server Sta-
tus option in the naviga-
tion tree to view servers
according to their cur-
rent state. (In the CCM,
click Manage Servers
button to log in and view
all servers from your
deployment.)
The server's state was
displayed in the CCM
and the CMC, but only
the CMC allowed you to
change server states on
any machine in the
cluster. The CCM could
manage servers only on
one machine at a time .
Viewing or changing a
server's state.
You can now add and
delete servers in the
CMC. For more informa-
tion, see Adding,
cloning, and deleting
Servers were added
and deleted in the CCM.
Adding or deleting a
server

prise XI 3.x
BusinessObjects En-
terprise XIR2
Procedure
You can use the Cus-
tom installation to add a
new machine to a clus-
ter.
If testing can be per-
formed after adding a
new machine, then you
can add it via the CMC.
For more information,
see Adding, cloning,
and deleting servers on
page 145. If no down
time is allowed, perform
a standalone installation
and move node or serv-
er information from one
deployment to another.
For more information,
see To import nodes
from one cluster to an-
other on page 230.
Performed a standalone
installation and used a
copy of destination
cluster CMS database
to verify that everything
worked fine on the new
machine. In the CCM,
the CMS was pointed to
a new cluster's CMS
database and other
configuration changes
were made to account
for this change. For ex-
ample, for an Oracle
CMS database, you
changed the database
information in the
tns.ora file and changed
all database references
from -ns oldCMS to -ns
newCMS.
Adding a new machine
to a cluster
In the CCM, select the
node on which the
servers runs, then up-
date the password or
account
Selected the servers
one by one in the CCM,
and for each server up-
dated the password or
account
Changing the OS ac-
count or password for
BusinessObjects Enter-
prise servers

prise XI 3.x
BusinessObjects En-
terprise XIR2
Procedure
Perform a Custom instal-
lation. During the Cus-
tom installation, make
sure you select the CMS
and deselect the
mySQL installation op-
tion.
Performed an Expand
installation.
Clustering two machines
together during installa-
tion.
Double-click the server
in the CMC to view and
change the port set-
tings. For more informa-
tion, see Configuring
port numbers on
page 166.
In the CCM, you added
-port and -request
port options to the
server's command line.
Configuring for a firewall
using static port binding
Double-click the server
in the CMC to view and
change the port set-
tings. For more informa-
tion, see Configuring
port numbers on
page 166.
In the CCM, you added
-port and -request
port options to the
server's command line.
Configuring for a multi-
homed deployment
Working with nodes
A node is a collection of BusinessObjects Enterprise servers, all running on
the same host and managed by a single Server Intelligence Agent (SIA).
The SIA monitors the servers on the node and ensures they are running
properly. For more information about the SIA, see About the Server
Intelligence Agent (SIA) on page 130.
3 Working with nodes

Nodes are a new feature in this version of BusinessObjects Enterprise. In
previous versions, servers were associated with a particular machine. Now
that servers are organized by node, it is much easier to transfer servers and
configuration settings between machines. You can also have multiple nodes
on a single host.
You can use nodes to cluster servers together. You may want to organize
your servers on multiple nodes depending on how you plan to manage your
servers. For example, if you want to be able to start and stop the CMS without
affecting other servers, you'll want to store it on a separate node.
Note:
You can have one or more nodes on the same machine. Multiple nodes allow
you to run processes under different OS user accounts. (All servers on each
node run under the same OS user account.)
For more information about clustering, see Clustering Central Management
Servers on page 211.
To add a node
Nodes are initially created by the installation setup program during installation,
but you can also add additional nodes. To create a new node on a new
machine, you can perform a Custom installation. On a machine where
BusinessObjects Enterprise is installed, you can create a new node using
the CCM. This procedure describes how to add a node from the CCM. For
more information about Custom installations, please consult the
BusinessObjects Enterprise Installation Guide. Once you have added a node,
use the CCM to configure the node's database information. This is important
if a CMS is managed by the new node. Failure to configure this information
could cause the system to fail.
Note:
To recreate a SIA that already exists in the CMS system database, see
Recreating a Server Intelligence Agent on a local machine on page 138.
1. In the CCM, click Add Server Intelligence Agent.
Note:
The same procedure is used for creating a node and for creating a new
Server Intelligence Agent. You cannot have one without the other.
Working with nodes

2. In the "Server Intelligence Agent Wizard", provide a name and port number
for the new Server Intelligence Agent (SIA).
Note:
The node name cannot be changed after you create it.
3. Choose whether or not you want to install default servers with the new
node by selecting or deselecting Create default servers on the new
node.
• Deselect this check box if you do not want to install the default servers.
For example, you may plan to clone servers onto the new node from
an existing deployment. For more information about cloning, see
Cloning servers on page 147.
• Select this check box if you want to install all new default servers.
Note:
• This option only creates servers for which binaries already exist on
the target machine, and this does not necessarily reflect all possible
• If you need to remove default servers after the node has already been
created, see To remove servers from a new node on page 137.
4. Make sure that the Recreate Server Intelligence Agent on the local
host if it already exists in the CMS system database check box is not
selected.
5. Click Next.
6. Provide the CMS port number and CMS system database name.
Note:
• In order to add a new SIA on a deployed system, a CMS must be
running.
• If you are planning to use auditing features then you should also
provide information about your auditing database.
7. Provide your connection information for the CMS database, then click
Next.
The Server Intelligence Agent Wizard creates a new node with its own
Server Intelligence Agent. Information about the new node is added to
the CMS system database you selected. The new node automatically
includes all default BusinessObjects Enterprise services.

Note:
You can have one or more nodes on the same machine. Multiple nodes allow
you to run processes under different OS user accounts. All servers on each
node would run under the same OS user account.
Tip:
Once you have added a node, use the CCM to configure the node's database
information. This is very important if a CMS will ever be managed by the
node.
To remove servers from a new node
When you create a new node, you can choose whether to create default
servers or not. If you choose to create default servers, the node will be
automatically populated with all default servers. If you do not want to include
the default servers, make sure the Create default servers on the new node
button is not selected when you create the node. However, if you want to
remove some of the default servers after you have already created the node,
use the following procedure. For more information about adding and deleting
servers, see Adding, cloning, and deleting servers on page 145.
1. After you create a new node, do not start the Server Intelligence Agent
(SIA) for the node. If necessary, stop the SIA.
Note:
For information on adding nodes, see To add a node on page 135.
2. Go to the "Servers" management area of the CMC.
3. In the navigation tree, select the new node.
The list of servers in the node appear on the right.
4. Disable the servers you want to remove.
For more information, see Enabling and disabling servers on page 144.
5. Stop the servers you want to remove.
6. Delete the servers you want to remove.
For more information on deleting servers, see Deleting a server on
page 149.
Working with nodes

Recreating a Server Intelligence Agent on a local
machine
You can recreate a Server Intelligence Agent (SIA) on a local machine if it
already exists in the CMS system database. (This is also known as "adopting"
a node.) You should recreate a Server Intelligence Agent only in serious
situations; for example, if a machine hosting BusinessObjects Enterprise
servers is lost, damaged, or has failed and you need to recreate the node
on the new machine replacement. You can recreate only nodes that do not
exist on any physical machines in your deployment. (Make sure that no other
machines host the same node.)
Note:
Be very careful when recreating a SIA. If performed incorrectly, this procedure
may cause port conflicts. Do not recreate a SIA on a live system. Before you
recreate the node, you should first install BusinessObjects Enterprise on the
machine. If you are performing a Custom installation, make sure that you
install all servers that used to be on this node.
To recreate a Server Intelligence Agent on a local machine
This procedure is used to add a node and Server Intelligence Agent to a
local machine when the SIA already exists in the CMS system database.
You may want to use this procedure if you are replacing a machine with
Note:
Although BusinessObjects Enterprise allows you to have nodes on different
operating systems, recreating nodes is supported only for servers that are
using the same operating system. For example, BusinessObjects Enterprise
does not support recreating a Server Intelligence Agent on a Solaris machine
when the original SIA that exists in the CMS system database was on a
Windows machine.
1. In the CCM, click Add Server Intelligence Agent.
Note:
The same procedure is used for creating a node and for creating a new
Server Intelligence Agent. You cannot have one without the other.

2. In the "Server Intelligence Agent Wizard", provide a name and port number
for the new Server Intelligence Agent (SIA).
3. Select the Create default servers on the new node check box, then
click Next .
Note:
This option only creates servers for which binaries already exist on the
target machine, and this does not necessarily reflect all possible
4. Provide the CMS port number and CMS system database name for the
inactive cluster, then click Next.
Note:
If you are using auditing, you can also provide information about your
system's auditing database.
5. Select the Recreate Server Intelligence Agent on the local host if it
already exists in the CMS system database check box.
6. Provide your connection information for the CMS database, then click
Next.
The setup program creates a new node on the inactive cluster. Information
about the new node is added to the CMS system database you selected.
Viewing and changing the status of
servers
The status of a server is its current state of operation: a server can be running,
starting, stopping, stopped, failed, initializing, enabled, disabled, or waiting
for resources. To respond to BusinessObjects Enterprise requests, a server
must be running and enabled. A server that is disabled is still running as a
process; however, it is not accepting requests from the rest of
BusinessObjects Enterprise. A server that is stopped is no longer running
as a process.
This section shows how to modify the status of servers by using the CMC.
Related Topics
• To view a server's status on page 140
• Starting, stopping, and restarting servers on page 140
Viewing and changing the status of servers

• Enabling and disabling servers on page 144
• Stopping a Central Management Server on page 143
• To start a server automatically on page 143
To view a server's status
The Servers List includes a State column that provides the status for
each server in the list.
2. If you want to view a list of all of the servers that currently have a particular
status, expand the Server Status option in the navigation tree and select
the status you want.
A list of servers with the selected status appears in the Details pane.
Note:
This can be particularly useful if you need to quickly view a list of servers
that are not starting properly or have stopped unexpectedly.
Starting, stopping, and restarting servers
Starting, stopping, and restarting servers are common actions that you
perform when you configure servers or take them offline for other reasons.
For example, if you want to change the name of a server, then you must first
stop the server. Once you have made your changes, you start the server
again to effect your changes. If you make changes to a server's configuration
settings, the CMC will prompt you if you need to restart the server.
The remainder of this section tells you when a certain configuration change
requires that you first stop or restart the server. However, because these
tasks appear frequently, the concepts and differences are explained first,
and the general procedures are provided for reference.
3 Viewing and changing the status of servers

DescriptionAction
You may need to stop BusinessOb-
jects Enterprise servers before you
can modify certain properties and
settings.
Stopping a server
If you have stopped a server to con-
figure it, you need to start it to effect
your changes and to have the server
resume processing requests.
Starting a server
Restarting a server is a shortcut to
stopping a server completely and
then starting it again. If you need to
restart a server after changing a
server setting, you will be prompted
by the CMC.
Restarting a server
You can set servers to start automat-
ically when the Server Intelligence
Agent starts.
Starting a server automatically
Stops a server immediately (whereas
when you stop a server, it will stop
when it has completed its current
processing activities).
Force Termination
Tip:
When you stop (or restart) a server, you terminate the server's process,
thereby stopping the server completely. If you want to prevent a server from
receiving requests without actually stopping the server process, you can also
disable servers. We recommend that you disable servers before stopping
them so that they can finish processing any jobs they have in progress. For
details, see Enabling and disabling servers on page 144.

To start, stop, or restart servers with CMC
A list of servers appears. For each server, the CMC provides information
about the server's state and whether or not the server is enabled. Possible
states include: Initializing, Starting, Running, Enabled, Disabled,
Stopping, Stopped, Failed, and Waiting for resources.
Note:
To view a list of all of the servers that currently have a particular status,
expand the Server Status option in the navigation tree and select the
status you want. For more information about server states, see Viewing
and changing the status of servers on page 139.
2. Select the server whose status you want to change.
3. Depending on the action you need to perform, click Start, Stop, or
Restart.
Note:
You can also choose these commands from the Action menu.
4. Click Refresh to update the page.
To start, stop, or restart a Windows server with the CCM
1. In the CCM, click the Manage Servers button.
2. Log into the CMS.
3. In the "Manage Servers" dialog box, select the server that you want to
start, stop, or restart.
4. Click Start, Stop, or Restart.
5. Click Close to return to the CCM.
Note:
In previous versions of BusinessObjects Enterprise, the CCM was the primary
tool for managing servers.
To start, stop, or restart a UNIX server with the CCM
Use the ccm.sh script. For reference, see the Unix Tools chapter.

To start a server automatically
Note:
By default, servers in your deployment are started automatically when the
Server Intelligence Agent starts. This procedure shows where to set this
option.
1. Go to the Servers management area of the CMC.
2. Select the server you want to start automatically, then choose Properties
from the Manage menu.
3. In the Properties dialog box, select the Automatically start this server
when the Server Intelligence Agent starts check box, then click OK.
Note:
If the automatic start setting is deselected for all CMSs in the cluster, you
need to use the CCM to restart the system. Right-click the SIA, choose
Properties. On the Startup tab, change the Autostart setting to Yes, then
click Save. Restart the SIA.
Stopping a Central Management Server
If your BusinessObjects Enterprise installation has more than one active
Central Management Server (CMS) , you can shut down a single CMS without
losing data or affecting system functionality. Another CMS on the node will
assume the workload of the stopped server. Clustering multiple CMSs enables
you to perform maintenance on each of your Central Management Servers
in turn without taking BusinessObjects Enterprise out of service.
However, if your BusinessObjects Enterprise deployment has a single CMS,
shutting it down will make BusinessObjects Enterprise unavailable to your
users and will interrupt the processing of reports and programs. To avoid
this problem, the Server Intelligence Agent for each node ensures that at
least one CMS is running at all times. You can still stop a CMS by stopping
its SIA, but before stopping the SIA, you should disable the processing
servers via the CMC so that they can finish any jobs in progress before
BusinessObjects Enterprise shuts down, because all other servers on the
node will also shut down.

Note:
You may encounter situations where the CMS has been stopped and you
need to restart the system from the CCM. For example, if you shut down all
of the CMSs on a node and all of the CMSs are not set to automatically start
when the SIA starts, then you need to use the CCM to restart the system.
In the CCM, right-click the SIA and choose Properties. On the Startup tab,
change the Autostart setting to Yes, then click Save. Restart the SIA.
If you want to configure your system so that you can start and stop a Central
Management Server without starting and stopping other servers, you have
two options:
• For all of the other servers on the node, clear the selection of the
Automatically start this server when the Server Intelligence Agent
starts check box. You can edit this setting in the Servers management
area of the CMC. Select the server, choose Properties from the Manage
menu and then clear the check box.
• Put the CMS on a separate node. Create a new node and clone the CMS
to the node. With the CMS on its own node, you can easily shut down
the node without affecting other servers. For more information about
creating nodes, see Working with nodes on page 134. For information
about cloning servers, see Cloning servers on page 147.
See Viewing and changing the status of servers on page 139 for general
information about changing server status in the CMC.
For more information on node clusters, see Clustering Central Management
Servers on page 211.
Enabling and disabling servers
When you disable a BusinessObjects Enterprise server, you prevent it from
receiving and responding to new BusinessObjects Enterprise requests, but
you do not actually stop the server process. This is especially useful when
you want to allow a server to finish processing all of its current requests
before you stop it completely.
For example, you may want to stop a Job Server before rebooting the
machine it is running on. However, you want to allow the server to fulfill any
outstanding report requests that are in its queue. First, you disable the Job
Server so it cannot accept any additional requests. Next, go to the Central

Management Console to monitor when the server completes the jobs it has
in progress. (From the Servers management area, choose the server name
and then the metrics tab). Then, once it has finished processing current
requests, you can safely stop the server.
Note:
• The CMS must be running in order for you to enable and/or disable other
servers.
• A CMS cannot be enabled or disabled.
To enable and disable servers with CMC
2. Select the server whose status you want to change.
3. Depending on the action you need to perform, click Enable or Disable.
To enable or disable a Windows server with the CCM
1. In the CCM, click Manage Servers.
2. When prompted, log on to your CMS with the credentials that provide you
with administrative privileges to BusinessObjects Enterprise.
3. In the "Manage Servers " dialog box, select the server that you want to
enable or disable.
4. Click Enable or Disable.
5. Click OK to return to the CCM.
To enable or disable a UNIX server with the CCM
Use the ccm.sh script. For reference, see the Unix Tools chapter.
Adding, cloning, and deleting servers
Tip:
If you want to add new hardware to BusinessObjects Enterprise by installing
server components on new, additional machines, run the BusinessObjects
Enterprise installation and setup program from your product distribution. The
setup program allows you to perform an Custom installation. During the

Custom installation, specify the CMS from your existing deployment, and
select the components that you want to install on the local machine. For
details on custom installation options, see the BusinessObjects Enterprise
Installation Guide.
Adding a server
These steps add a new instance of a server to the local machine. You can
run multiple instances of the same BusinessObjects Enterprise server on
the same machine.
To add a server
1. In the CMC, go to the "Servers" management area.
2. On the Manage menu, click New, then click New Server.
The "Create New Server" dialog box appears.
3. Choose the Service Category.
4. Choose a type of server from the Select Service list, then click Next.
5. To add an additional service to the server, select the service in the
Available Additional Services list and click >.
Note:
Additional services are not available for all server types.
6. After adding the additional services you want, click Next.
7. If your BusinessObjects Enterprise architecture is composed of multiple
nodes, choose the node where you want to add the new server from the
Node list.
8. Type a name for the server in the Server Name box.
Each server on the system must have a unique name. The default naming
convention is NODENAME.servertype (a number is appended if there is
more than one server of the same type on the same host machine).
9. To include a description for the server, type it into the Description box.
10. Click Create.
The new server appears in the list of servers in the Servers area of the
CMC, but it is neither started nor enabled automatically.
3 Adding, cloning, and deleting servers

Note:
• For more information about configuring individual servers, see
Configuring server settings on page 155.
• To change the default port numbers for the server, see Configuring
port numbers on page 166.
11. Use the CMC to start and enable the new server when you want it to
begin responding to BusinessObjects Enterprise requests.
Note:
For details, see Viewing and changing the status of servers on page 139.
Cloning servers
BusinessObjects Enterprise XI 3.x allows you to clone servers. In previous
versions of BusinessObjects Enterprise, you had to create a new server
instance and then configure all of the settings for that server. Now, if you
want to add a new server instance, you can clone an existing server. The
cloned server retains the configuration settings of the original server. This
can be particularly useful if you are expanding your deployment and want to
create new server instances that use almost all of the same server
configuration settings as an existing server.
Cloning also simplifies the process of moving servers between nodes. If you
want to move an existing CMS to another node, you can clone it to the new
node. The cloned CMS appears on the new node and retains all of the
configuration settings of the original CMS.
There are some special considerations to keep in mind when cloning servers.
You may not want all settings to be cloned, so it's good practice to check the
cloned server to make sure it meets your needs. For example, if you clone
a CMS, make sure you change the port number settings that were copied
from the original CMS to the cloned CMS.
Note:
• Before you clone servers, make sure that all machines in your deployment
have the same version of BusinessObjects Enterprise (and any patches
if applicable).

• You can clone servers existing on different or the same machines.
However, you can clone servers only to machines where the required
binaries for the server are installed.
• When you clone a server, it does not necessarily mean that the new
server will use the same OS credentials. The user account is controlled
by the Server Intelligence Agent that the server is running under.
Using placeholders for server settings
Server setting placeholders are listed on a dedicated page in the Central
Management Console (CMC). When you double-click any server listed under
"Servers" in the CMC, a link is provided on the left-hand navigation pane for
“Placeholders”. The "Placeholders" page lists all the available placeholder
names and their associated values for the selected server. Placeholders
contain read-only values and the placeholder names begin and end with the
percentage character %.
Note:
You can always overwrite a placeholder setting with a specific string in the
CMC Server "Properties" page.
Example:
Placeholders are useful when cloning servers. For example, multi-drive
machine A has BusinessObjects Enterprise installed on D:Program
FilesBusiness ObjectsBusinessObjects Enterprise 12.0. So the %Default
AuditingDir% placeholder will be D:Program FilesBusiness
ObjectsBusinessObjects Enterprise 12.0Auditing.
On another machine, machine B, there is only one disc drive (no drive D)
and BusinessObjects Enterprise is installed on C:Program
FilesBusiness ObjectsBusinessObjects Enterprise 12.0. In this
case the %DefaultAuditingDir% placeholder will be C:Program
FilesBusiness ObjectsBusinessObjects Enterprise
12.0Auditing
To clone the Event Server from machine A to machine B, if placeholders
are used for the Auditing Temporary Directory, the placeholders will resolve
themselves and the Event Server will work properly. If no placeholders are
used, the Event Server will fail unless you manually overwrite the Auditing
Temporary Directory setting.
3 Adding, cloning, and deleting servers

To clone a server
1. On the machine you want to add the cloned server, log onto the CMC.
2. In the CMC, choose Servers from the navigation list.
3. On the Actions menu, click Clone Server.
The "Clone Server" dialog box appears.
4. In the "Clone Server" dialog box, type a name for the server (or use the
default name) in the New Server Name field.
5. On the Clone to Node list, choose the node where you want to add the
cloned server, then click OK.
The new server appears on the Servers list in the "Servers" management
area of the CMC.
Note:
Port number settings are also cloned. In many cases, such as cloning a
CMS, you will want to change the port number to avoid port conflicts
between the original server and its clone.
Deleting a server
These steps delete an instance of a server.
To delete a server
Note:
For information on stopping servers, see Starting, stopping, and restarting
2. Stop the server that you want to delete.
3. Select the server and choose Delete from the Manage menu.
4. When prompted for confirmation, click OK.

Server groups
Server groups provide a way of organizing your BusinessObjects Enterprise
servers to make them easier to manage. That is, when you manage a group
of servers, you need only view a subset of all the servers on your system.
More importantly, server groups are a powerful way of customizing
BusinessObjects Enterprise to optimize your system for users in different
locations, or for objects of different types.
If you group your servers by region, you can easily set up default processing
settings, recurrent schedules, and schedule destinations that are appropriate
to users who work in a particular regional office. You can associate an object
with a single server group, so the object is always processed by the same
servers. And you can associate scheduled objects with a particular server
group to ensure that scheduled objects are sent to the correct printers, file
servers, and so on. Thus, server groups prove especially useful when
maintaining systems that span multiple locations and multiple time zones.
If you group your servers by type, you can configure objects to be processed
by servers that have been optimized for those objects. For example,
processing servers need to communicate frequently with the database
containing data for published reports. Placing processing servers close to
the database server that they need to access improves system performance
and minimizes network traffic. Therefore, if you had a number of reports that
ran against a DB2 database, you might want to create a group of Processing
Servers that process reports only against the DB2 database server. If you
then configured the appropriate reports to always use this Processing Server
group for viewing, you would optimize system performance for viewing these
reports.
After creating server groups, configure objects to use specific server groups
for scheduling, or for viewing and modifying reports. Use the navigation tree
in the Servers management area of the CMC to view server groups. The
Server Groups List option displays a list of server groups in the details pane,
and the Server Groups option allows you to view the servers in the group.
Creating a server group
To create a server group, you need to specify the name and description of
the group, and then add servers to the group.
3 Server groups

To create a server group
2. Choose Manage>New>Create Server Group.
The Create Server Group dialog box appears.
3. In the Name field, type a name for the new group of servers.
4. Use the Description field to include additional information about the
group.
5. Click OK.
6. In the "Servers" management area, click Server Groups in the navigation
tree and select the new server group.
7. Choose Add Members from the Actions menu.
8. Select the servers that you want to add to this group; then click the >
arrow.
Tip:
Use CTRL+click to select multiple servers.
9. Click OK.
You are returned to the "Servers" management area, which now lists all
the servers that you added to the group. You can now change the status,
view server metrics, and change the properties of the servers in the group.
For more information, see Viewing and changing the status of servers on
page 139.
Working with server subgroups
Subgroups of servers provide you with a way of further organizing your
servers. A subgroup is just a server group that is a member of another server
group.
For example, if you group servers by region and by country, then each
regional group becomes a subgroup of a country group. To organize servers
in this way, first create a group for each region, and add the appropriate
servers to each regional group. Then, create a group for each country, and
add each regional group to the corresponding country group.
Server groups

There are two ways to set up subgroups: you can modify the subgroups of
a server group, or you can make one server group a member of another.
The results are the same, so use whichever method proves most convenient.
To add subgroups to a server group
2. Click Server Groups in the navigation tree and select the server group
you want to add subgroups to.
This group is the parent group.
3. Choose Add Members from the Actions menu.
4. Click Server Groups in the navigation tree, select the server groups that
you want to add to this group, and then click the > arrow.
Tip:
Use CTRL+click to select multiple server groups.
5. Click OK.
You are returned to the "Servers" management area, which now lists the
server groups that you added to the parent group.
To make one server group a member of another
2. Click the group that you want to add to another group.
3. Choose Add to Server Group from the Actions menu.
4. In the Available server groups list, select the other groups that you want
to add the group to, then click the > arrow.
Tip:
Use CTRL+click to select multiple server groups.
5. Click OK.
3 Server groups

Modifying the group membership of a server
You can modify a server's group membership to quickly add the server to
(or remove it from) any group or subgroup that you have already created on
the system.
For example, suppose that you created server groups for a number of regions.
You might want to use a single Central Management Server (CMS) for
multiple regions. Instead of having to add the CMS individually to each
regional server group, you can click the server's "Member of" link to add it
to all three regions at once.
To modify a server's group membership
2. Locate the server whose membership information you want to change.
3. Choose Properties from the Manage menu.
4. In the "Properties" dialog box, click Existing Server Groups in the
navigation list.
In the details panel, the Available server groups list displays the groups
you can add the server to. The Member of Server Groups list displays
any server groups that the server currently belongs to.
5. To change the groups that the server is a member of, use the arrows to
move server groups between the lists, then click OK.
User access to servers and server groups
You can use rights to grant people access to servers and server groups,
allowing them to perform tasks such as starting and stopping servers.
Depending on your system configuration and security concerns, you may
want to limit server management to the BusinessObjects Enterprise
administrator. However, you may need to provide access to other people
using those servers. Many organizations have a group of IT professionals
dedicated to server management. If your server team needs to perform
regular server maintenance tasks that require them to shut down and start
up servers, you need to grant them rights to the servers. You may also want
Server groups

to delegate BusinessObjects Enterprise server administration tasks to other
people. Or you may want different groups within your organization to have
control over their own server management.
To grant access to a server or server group
2. Select the server or server group you want to grant access to.
4. In the "Properties" dialog box, click User Security.
5. Click Add Principals to add users or groups that you want to give access
to the selected server or server group.
The "Add Principals" dialog box appears.
6. Select the user or group you want to grant access to the specified server
or server group, then click >.
7. Click OK.
8. In the "Assign Security" dialog box, choose the security settings you want
for the user or group.
For detailed information about assigning rights, refer to the Setting Rights
chapter.
Object rights for the Report Application Server
To allow users to create or modify reports over the Web through the Report
Application Server (RAS), you must have RAS Report Modification licenses
available on your system. You must also grant users a minimum set of object
rights. When you grant users these rights to a report object, they can select
the report as a data source for a new report or modify the report directly:
• View objects (or “View document instances” as appropriate)
• Edit objects
• Refresh the report's data
• Export the report's data
User must also have permission to add objects to at least one folder before
they can save new reports back to BusinessObjects Enterprise.
3 Server groups

To ensure that users retain the ability to perform additional reporting tasks
(such as copying, scheduling, printing, and so on), it's recommended that
you first assign the appropriate access level and update your changes. Then,
change the access level to Advanced, and add any of the required rights
that are not already granted. For instance, if users already have View On
Demand rights to a report object, you allow them to modify the report by
changing the access level to Advanced and explicitly granting the additional
Edit objects right.
When users view reports through the Advanced DHTML viewer and the RAS,
the View access level is sufficient to display the report, but View On Demand
is required to actually use the advanced search features. The extra Edit
objects right is not required.
Configuring server settings
This section includes technical information and procedures that show how
you can modify settings for BusinessObjects Enterprise servers.
The majority of the settings discussed in this section allow you to integrate
BusinessObjects Enterprise more effectively with your current hardware,
software, and network configurations. Consequently, the settings that you
choose will depend largely upon your own requirements.
Most of the following procedures involve making changes in a server's
Properties dialog box in the CMC. It is important to note that not all changes
occur immediately. If a setting cannot change immediately, the Properties
dialog box displays both the current setting (in red text) and the desired
setting. When you return to the Servers management area, the server will
be marked as Stale. When you restart the server, it will use the desired
settings from the Properties dialog box and the Stale flag is removed from
the server.
Note:
This section does not show how to configure your Web application server to
deploy BusinessObjects Enterprise applications. This task is typically
performed when you install BusinessObjects Enterprise. For details, see the
BusinessObjects Enterprise Installation Guide.
Related Topics
• To change a server's properties on page 405
• Changing the connect port used by Tomcat on page 169

• Configuring port numbers on page 166
• Copying data from one CMS system database to another on page 170
• Deleting and recreating the CMS system database on page 177
• Selecting a new or existing CMS database on page 180
• Setting root directories and idle times of the File Repository Servers on
page 182
• Modifying performance settings on page 183
• Configuring destinations for job servers on page 183
• Configuring Windows processing servers for your data source on page 190
• Configuring UNIX processing servers for your data source on page 191
To change a server's properties
2. Select the server whose settings you want to change.
4. Make the changes you want, then click Save or Save & Close.
Note:
Not all changes occur immediately. If a setting cannot change immediately,
the Properties dialog box display both the current setting (in red text) and
the desired setting. When you return to the Servers management area,
the server will be marked as Stale. When you restart the server, it will
use the desired settings from the Properties dialog box and the Stale flag
is removed from the server.
Working with configuration templates
Configuration templates allow you to easily configure multiple instances of
servers. Configuration templates store a list of settings for each service type,
which you can use to configure additional server instances. For example, if
you have a dozen Web Intelligence Processing Servers that you want to
configure identically, you only need to configure settings for one of them.
You can then use the configured service to define the configuration template
for Web Intelligence Processing Servers, and then apply the template to the
other 11 service instances.
3 Configuring server settings

Each type of BusinessObjects Enterprise service has its own configuration
template. For example, there is one configuration template for the Web
Intelligence Processing service type, one for the Publishing service type,
and so on. The configuration template is defined in the server properties in
the Central Management Console (CMC).
When you make a server use a configuration template, existing settings for
the server are overwritten with the values from the template and lost. If you
later decide to stop using the template, the original settings are not restored.
Subsequent changes to the configuration template no longer affect the server.
It is good practice to use configuration templates as follows:
1. Set the configuration template on one server. For information, see To set
a configuration template on page 157.
2. Assuming you want the same configuration on all servers of the same
type, check Use Configuration Template for all servers of the same
type, including the one where you set the configuration template. For
information, see To apply a configuration template to a server on page 158.
3. Later, if you want to change the configuration of all services of this type,
view the properties of any one of the services, deselect the Use
Configuration Template check box. Change the settings you want, then
select Set Configuration Template for this server and click Save. All
services of that type are updated. By not having a server that is always
set as the configuration template, you ensure that you will not accidentally
change configuration settings for all servers of that type.
To set a configuration template
You can set a configuration template for each type of service. You cannot
set multiple configuration templates for one type of service. You can use any
server's "Properties" page to configure the settings that will be used by the
configuration template for a service type that is hosted on the server.
2. Select the server that hosts services whose configuration template you
want to set.
Note:
You can also double-click the server to open its "Properties" page.

4. Configure the service settings that you want to use in the template, select
the Set Configuration Template check box and click Save or Save &
Close.
The configuration template for the service type that you selected is defined
according to the settings of the current server. Other servers of the same
type hosting the same services will be automatically and immediately
reconfigured to match the configuration template if they have the Use
Configuration Template option enabled in their properties.
Note:
If you don't explicitly define the settings for the configuration template,
the service's default settings are used.
5. To apply the configuration template to other services of the same type,
proceed to To apply a configuration template to a server on page 158.
6. If you need to restore the original default settings for the service, see To
restore system defaults on page 159.
To apply a configuration template to a server
Before you apply a configuration template, ensure that you have defined the
configuration template settings for the type of server you want to apply the
template to. If you haven't explicitly defined the configuration template
settings, the default settings for the service are used. For more information,
see To set a configuration template on page 157.
Note:
Servers that do not have the Use Configuration Template setting enabled
will not be updated when you modify the settings of the configuration template.
2. Select the server that is hosting a service you want to apply the
configuration template to.
Note:
4. Select the Use Configuration Template check box and click Save or
Save & Close.

Note:
If the server requires you to restart it in order for the new settings to take
effect, it will show up as "stale" in the servers list.
The appropriate configuration template is applied to the current server. Any
subsequent changes to the configuration template change the configuration
of all servers that use the configuration template.
Unchecking Use Configuration Template does not restore the server
configuration to the values as they were when the configuration template
was applied. Subsequent changes to the configuration template do not affect
the configuration of the servers that are using the configuration template.
For information about setting the configuration template, see To set a
configuration template on page 157.
To restore system defaults
You may want to restore a service's configuration to the settings it was initially
installed with (for example, if you misconfigure the servers, or experience
performance issues).
2. Select the server hosting a service that you want to restore system defaults
for.
Note:
4. Select the Restore System Defaults check box and click Save or Save
& Close.
The original factory default settings for the particular service type are
restored.
Configuring server network settings
The networking settings for BusinessObjects Enterprise servers are managed
through the CMC. These settings are divided into two categories: port settings
and host identification.

Default settings
During installation, server host identifiers are set to Auto assign. Each server
can however be assigned either a specific IP address or a hostname. The
default CMS port number is 6400. The other BusinessObjects Enterprise
servers dynamically bind to available ports. Port numbers are automatically
managed by BusinessObjects Enterprise, but you can use the CMC to specify
port numbers
Network environment options
BusinessObjects Enterprise supports both Internet Protocol 6 (IPv6) and
Internet Protocol version 4 (IPv4) network traffic. You can use
BusinessObjects server and client components in any of the following
environments :
• IPv4 network: all server and client components run with IPv4 protocol
only.
• IPv6 network: all server and client components run with IPv6 protocol
only.
• Mixed IPv6/IPv4 network: server and client components can run with both
IPv6 and IPv4 protocols.
Note:
Network configuration should be performed by the system and network
administrator. BusinessObjects Enterprise does not provide a mechanism
to designate a networking environment. You can use the CMC to bind to a
specific IPv6 or IPv4 IP address for any of your BusinessObjects Enterprise
servers.
Mixed IPv6/IPv4 environment
The IPv6/IPv4 networking environment enables the following :
• BusinessObjects Enterprise servers can service both IPv6 and IPv4
requests when running in mixed IPv6/IPv4 mode.
• Client components can interoperate with servers as IPv6-only nodes,
IPv4-only nodes, or IPv6/IPv4 nodes.
The mixed mode is particularly useful in the following scenarios:
• You are moving from an IPv4-only node to an IPv6-only node environment.
All the client and server components will continue to seamlessly

interoperate until the transition is complete. You can then deactivate the
IPv4 settings for all the servers.
• Third party software that is not IPv6 compatible will continue to function
in the IPv6/IPv4 node environment.
Note:
DNS names do not resolve properly if IPv6-only node is used with Windows
2003. It is recommended that your deployment runs as both IPv6/IPv4 if IPv4
stack is disabled on Windows 2003.
Server host identification options
Host identification options can be specified in the CMC for every
BusinessObjects Enterprise server. The following table summarizes the
options available in the Common Settings area:

DescriptionOption
This is the default setting for all servers. When Auto-Assign
is selected, the server automatically binds the server's Request
Port onto the first network interface on the machine.
Note:
It is good practice to select the Auto-Assign checkbox for the
Host Name setting. However in some cases, such as when the
server is running on multi-homed machine, or when the server
needs to inter-operate with a certain firewall configuration, you
should consider using either a specific hostname or IP address.
For more information see Configuring a multihomed machine
on page 163 and the “Working with Firewalls” chapter in the
BusinessObjects Enterprise Administrator's Guide.
Auto assign
Specifies the host name of the network interface that the server
listens for requests on. For the CMS, this setting specifies the
host name of the network interface that the CMS binds the
Name Server Port and the Request Port.
Hostname
Specifies the IP address of the network interface that the server
listens for requests on. For the CMS this setting specifies the
address of the network interface that the CMS binds the Name
Server Port and the Request Port. For every server, separate
fields are provided to specify IPv4 and/or IPv6 IP addresses.
IP Address
Note:
Important: If you specify Auto-Assign on multi-homes machines, the CMS
may automatically bind to the wrong network interface. To prevent this from
happening, make sure the network interfaces on the host machine are listed
in the correct order (using the machine's OS tools). You must also specify
the Host Name setting for the CMS in the CMC. For more information, see
To troubleshoot multiple network interfaces on page 165.
Note:
If you are working with multihomed machines or in certain NAT firewall
configurations, you may need to specify the Host Name using fully qualified
domain names instead of host names. For details, see Configuring a
multihomed machine on page 163 or the "Working with Firewalls" chapter.

To modify a server's host identification
2. Select the server, then choose Stop Server from the Actions menu.
4. Under Common Settings, select one of the following options:
DescriptionOption
The server will bind to one of the available network inter-
faces.
Auto assign
Enter the host name of the network interface on which
server listens for requests.
Hostname
Enter in the fields provided either an IPv4 or an IPv6 IP ad-
dress for the network interface on which server listens for
requests.
Note:
To enable the server to operate as a dual IPv4/IPv6 node,
enter a valid IP address in both fields.
IP Address
5. Click Save or Save & Close.
The changes are reflected in the command line displayed on the
"Properties" tab.
6. Start and enable the server.
Configuring a multihomed machine
A multihomed machine is one that has multiple network addresses. You may
accomplish this with multiple network interfaces, each with one or more IP
addresses, or with a single network interface that has been assigned multiple
IP addresses.
If you have multiple network interfaces, each with a single IP address, change
the binding order so that the network interface at the top of the binding order
is the one you want the BusinessObjects Enterprise servers to bind to. If
your interface has multiple IP addresses, use the Host Name option in the
CMC to specify a network interface card for the BusinessObjects Enterprise
server. It can be specified by host name or IP address. For more information

about configuring the Host Name setting, see To troubleshoot multiple
network interfaces on page 165.
Tip:
This section shows how to restrict all servers to the same network address,
but it is possible to bind individual servers to different addresses. For instance,
you might want to bind the File Repository Servers to a private address that
is not routable from users' machines. Advanced configurations such as this
require your DNS configuration to route communications effectively between
all the BusinessObjects Enterprise server components. In this example, the
DNS must route communications from the other BusinessObjects Enterprise
servers to the private address of the File Repository Servers.
Configuring the CMS to bind to a network address
Note:
On a multi-homed machine, the Host Identifier can be set to the fully qualified
domain name or the IP address of the interface that you want the server to
bind to.
To configure the CMS to bind to a network address
2. Select the CMS and choose Properties from the Manage menu.
3. Under "Common Settings", select one of the following options:
• Hostname: enter the host name of the network interface to which the
server will bind.
• IP Address: enter in the fields provided either an IPv4 or an IPv6 IP
address for the network interface to which the server will bind.
Note:
To enable the server to operate as a dual IPv4/IPv6 node, enter a
valid IP address in both fields.
Caution:
Do not select Auto assign.
4. For Request Port you can do one of the following:
• Select the Auto assign option.
• Enter a valid port number in the field provided.
5. Make sure that a port number is specified in the Name Server Port dialog
box.

Note:
The default port number is 6400.
Configuring the remaining servers to bind to a network address
The remaining BusinessObjects Enterprise servers select their ports
dynamically by default. For information on disabling the Auto assign setting
that dynamically propagates this information, see To change the port a server
uses for accepting requests on page 168.
To troubleshoot multiple network interfaces
On a multi-homed machine, the CMS may automatically bind to the wrong
network interface. To prevent this from happening, you can ensure the
network interfaces on the host machine are listed in the correct order (using
the machine's OS tools), or make sure you specify the Host Name setting
for the CMS in the CMC. If the primary network interface is not routable, you
can use the following procedure to configure BusinessObjects Enterprise to
bind to a non-primary routable network interface. Perform these steps
immediately after installing BusinessObjects Enterprise on the local machine,
before you install BusinessObjects Enterprise on other machines.
1. Open the CCM and stop the SIA for the node on the machine that has
multiple network interfaces.
2. Right-click the SIA and choose Properties.
3. In the "Properties" dialog box, click the "Configuration" tab.
4. To bind the SIA to a specific network interface, type in the Port field one
of the following:
• the hostname of the target network interface and port number (use
the hostname:port number format)
• the IP address of the target network interface and port number (use
the IP address:port number format)
5. Click OK and select the "Startup" tab.
6. From the "Local CMS Servers" list select the CMS and click Properties.
7. To bind the CMS to a specific network interface, type in the Port field one
of the following:
• the hostname of the target network interface and port number (use
the hostname:port number format)
• the IP address of the target network interface and port number (use
the IP address:port number format)

8. Click OK to apply the new settings.
9. Start the SIA and wait for the servers to start.
10. Launch the Central Management Console (CMC), and go to the "Servers"
management area. Repeat steps 11-14 for each server.
13. Under Common Settings, select one of the following options:
• Hostname: enter the host name of the network interface to which the
server will bind.
• IP Address: enter in the fields provided either an IPv4 or an IPv6 IP
address for the network interface to which the server will bind.
Note:
To enable the server to operate as a dual IPv4/IPv6 node, enter a
valid IP address in both fields.
Caution:
Do not select Auto assign.
15. Return to the CCM and restart the SIA.
The SIA restarts all servers on the node. All servers on the machine now
bind to the correct network interface.
Configuring port numbers
During installation, the CMS is set up to use default port numbers. The default
CMS port number is 6400. This port falls within the range of ports reserved
by Business Objects (6400 to 6410). BusinessObjects Enterprise
communication on these ports should not conflict with third-party applications.
When started and enabled, each of the other BusinessObjects Enterprise
servers dynamically binds to an available port (higher than 1024), registers
with this port on the CMS, and then listens for BusinessObjects Enterprise
requests. If necessary, you can instruct each server component to listen on
a specific port (rather than dynamically selecting any available port).

Port numbers can be specified on each server's Properties tab in the CMC.
This table summarizes the options under the "Common Settings" area as
they relate to port usage for specific server types:
Other ServersCMSSetting
Specifies the port on which
the server listens for all re-
quests. When Auto assign
is selected, the server auto-
matically uses a port number
assigned by the OS.
Specifies the port that the
CMS uses for accepting all
requests from other servers
(except for Name Server re-
quests). Uses the same net-
work interface as the Name
Server Port. When Auto as-
sign is selected, the server
automatically uses an OS-
assigned port number.
Request Port
Not applicable.
Specifies the BusinessOb-
jects Enterprise port on
which the CMS listens for
name service requests. The
default is 6400.
Name Server Port
To change the default CMS port in the CMC
If there is a CMS already running on the cluster, you can use the CMC to
change the default CMS port number.
2. Double-click the CMS in the server list.
3. Replace the Name Server Port number with the port that you want the
CMS to listen on. (The default port is 6400.)
Note:
• The CMS uses the same network interface card for the request port
and the name server port.
• The settings you choose on the Properties page are reflected in the
server command line, which also appears on the Properties page.
4. Click Save & Close.
5. Restart the CMS.

The CMS begins listening on the port number you specified. The Server
Intelligence Agent dynamically propagates the new settings to the other
servers on the node, if those servers have the Auto-Assign option selected
for the request port. (It may take several minutes for your changes to
appear in the Properties settings of all node members.) If no CMS is
running on the cluster, you must use the CCM to change the port number.
To change the default CMS port in the CCM
If no CMS is running on the cluster, you must use the CCM to change the
CMS port number.
1. Open the CCM and stop the SIA for the node.
3. In the "Properties" dialog box, click the "Startup" tab.
4. From the "Local CMS Servers" list select the CMS and click Properties.
5. To bind the CMS to a specific port, type in the Port field one of the
following:
• port number
• the hostname of the target NIC and port number (use the
hostname:port number format)
• the IP address of the target NIC and port number (use the IP
address:port number format)
6. Click OK to apply the new settings.
7. Start the SIA and wait for the servers to start.
To change the port a server uses for accepting requests
4. Under Common Settings, deselect the Auto-Assign check box for
Request Port, then type the port number you want the server to listen
on.
6. Start and enable the server.
The server binds to the new port, registers with the CMS, and begins listening
for BusinessObjects Enterprise requests on the new port.

Changing the connect port used by Tomcat
During the installation, the default port used for Tomcat is 8080. If this port
is already in use by another instance of Tomcat, or if another application is
using this port, you will need to change the connect port used by Tomcat.
To change the Tomcat connect port
1. Stop Tomcat server by selecting the server name and clicking on the stop
button.
2. Open the server.xml file for Tomcat in a text editor.
On Windows, this file can normally be found in the following directory:
C:Program FilesBusiness ObjectsTomcatconf
3. Locate the following string:
<Connector URIEncoding="UTF-8" acceptCount="100" connection
Timeout="20000" debug="0" disableUploadTimeout="true" en
ableLookups="false" maxSpareThreads="75" maxThreads="150"
minSpareThreads="25" port="8080" redirectPort="8443" />
4. Change port 8080 to an available port number.
5. Save and close the file.
Managing CMS system database connections
If the CMS system database is unavailable, for example due to a hardware
or software failure or a network problem, the CMS goes into the “Waiting for
resources” state. If the system database is on a BusinessObjects Enterprise
deployment that has multiple CMSs, then subsequent requests are forwarded
to any CMSs in the cluster that have an active connection to the system
database. While a CMS is in the “Waiting for resources” state, any current
requests that do not require database access continue to be processed, but
requests that require access to the CMS database will fail.
By default, a CMS in the “Waiting for resources” state periodically attempts
to reestablish the number of connections that are specified in the “System
Database Connections Requested” property. As soon as the database

connections are established, goes into the “Running” state, and resumes
normal operations.
In some cases, you may want to prevent the CMS from automatically
reestablishing a connection to the database. For example, you may want to
verify the integrity of the database before database connections are
reestablished. To do so, on the "Properties" page of the CMS server, check
Disable Auto Reconnect to System and Auditing Databases.
Related Topics
• To change a server's properties on page 405
Copying data from one CMS system database to
another
BusinessObjects Enterprise enables you to copy the contents of one CMS
system database into another database. You can copy CMS data from a
different CMS database (versions 8.5 through 10 of Crystal Enterprise and
version XI and XI R2 of BusinessObjects Enterprise) into your current CMS
system database. Or, you can copy the data from your current CMS system
database into a different data source.
Throughout this section, the "source" CMS database refers to the database
that holds the data you are copying; this data is copied into the "destination"
(or "target") database. The destination database is initialized before the new
data is copied in, so any existing contents of the destination database are
permanently deleted (all BusinessObjects Enterprise tables are destroyed
permanently and then recreated). Once the data has been copied, the
destination database is established as the current database for the CMS.
Tip:
If you want to import users, groups, folders, and reports from one system to
another, without deleting the contents of the current CMS database, use the
Import Wizard. For more information, click Help in the Import Wizard.
Depending on the platform of your system and the version of your CMS
database, copying a CMS database may include the following tasks:
• Preparing to copy a CMS system database on page 176
• Changing the name of a CMS cluster on page 216

When you finish copying data from the source database to the destination
database, complete these steps before allowing users to access the system.
Server groups from the old installation appear in the new system, but they
will be empty. New servers are automatically detected and added to the
servers list (outside of any group) in a disabled state. You must enable these
servers before they can be used. You may add the new servers to the
imported groups as appropriate.
Reports that depend on a particular server group for scheduled processing
will not execute until a job server is added to that group. Reports that depend
on a particular server group for processing are not available until servers are
added to that group.
Note:
When upgrading from an older version of Crystal Enterprise, servers that
existed in the source installation do not appear in the upgraded install. This
occurs because there cannot be a mix of old and new servers in a
BusinessObjects Enterprise installation.
Note:
If errors occurred during an upgrade, a db_migration log file was created
in the logging directory on the machine where you performed the migration.
You will be prompted if you need to check the log file. The default logging
directory is: C:Program FilesBusiness ObjectsBusinessObjects
Enterprise 12.0Logging on Windows and BusinessObjects_root/log
ging on UNIX (where BusinessObjects_root is the absolute path to the root
Business Objects directory of your BusinessObjects Enterprise installation).
To copy a CMS system database on Windows
Note:
If you are copying a CMS database from an R3 source destination to an R3
target destination, you can change the CMS location, name, and database
type. However, you cannot change the BusinessObjects Enterprise installation
path, operating system, and machine name.
1. Open the Central Configuration Manager (CCM) and stop the Server
Intelligence Agent (SIA).
3. Click the Configuration tab, and then click Specify.

4. Choose Copy, then click OK.
5. Choose the version information for the source CMS database.
6. Select the database type for the source CMS database, and then specify
its database information (including host name, user name, and password).
7. Select the database type for the destination CMS database, and then
specify its database information (including host name, user name, and
password).
8. When the CMS database has finished copying, click OK.
9. If you are upgrading from an earlier version than R3, you will be prompted
to build a Server Intelligence Agent.
a. Click OK.
b. Specify the administrator password, and then click OK.
c. When the SIA is built, click OK.
10. Proceed to To change the directories of the Input and Output File
Repository Servers on Windows on page 173.
To copy a CMS system database on Unix
Note:
If you are copying a CMS database from an R3 source destination to an R3
target destination, you can change the CMS location, name, and database
type. However, you cannot change the BusinessObjects Enterprise installation
path, operating system, and machine name.
1. Run cmsdbsetup.sh (located in <InstallDirectory>/bobje/, by
default).
2. Select the "copy" option (option 4), then confirm your choice.
3. Select the version information for the source CMS database.
4. Select the database type for the source CMS database, then specify its
database information (including host name, user name, and password).
5. Select the database type for the destination CMS database, and then
specify its database information (including host name, user name, and
password).
The CMS database is copied to the destination machine. A message
appears when the copy is complete.
6. If you are upgrading from an earlier version than R3, you will be prompted
to build a Server Intelligence Agent. Specify the administrator password.

A message appears when the SIA is built.
7. Proceed to To change the directories of the Input and Output File
Repository Servers on Unix on page 174.
Changing the directories of the Input and Output File Repository
Servers
In order to upgrade your objects after you copy a CMS system database to
a new CMS database, you need to point your Input and Output File Repository
servers to new source directories. The following procedures show how to do
this on Windows and on Unix.
To change the directories of the Input and Output File Repository Servers on
Windows
1. If you copied CMS data from a different CMS system database into your
current CMS database, you need to make your old input and output
directories available to the new Input and Output File Repository Servers.
You can do this in several ways:
• Copy the contents of the original input root directory into the root
directory that the new Input File Repository Server is already configured
to use. Then copy the contents of the original output directory into the
root directory that the new Output File Repository is already configured
to use.
• Reconfigure the new Input and Output File Repository Servers to use
the old input and output root directories.
• If the old Input and Output File Repository Servers are running on a
dedicated machine, you can run the BusinessObjects Enterprise setup
program to upgrade the servers directly. Then you need not move the
input and output directories.
2. Use the CCM to start the SIA on the local machine.
3. Make sure your web application server is running.
4. Log on to the CMC with the default Administrator account, using Enterprise
authentication.
Tip:
If you just replaced your CMS system database with data from an older
system, keep in mind that you now need to provide the Administrator
password that was valid in the older system.

5. In the CMC, go to the License Keys management area and check that
your BusinessObjects Enterprise license keys are entered correctly.
6. Go to the Servers management area of the CMC and start and enable
the Input File Repository Server and the Output File Repository Server.
7. For each File Repository Server, choose Properties on the Manage
menu, then check that the File Store Directory points to the correct
location.
8. If objects in your source database require updating, click Update Objects.
9. When prompted, log on to your CMS with credentials that provide you
with administrative privileges to BusinessObjects Enterprise.
The Update Objects dialog box tells you how many objects require
updating. Objects typically require updating because their internal
representation has changed in the new version of BusinessObjects
Enterprise, or because the objects require new properties to support the
additional features offered by BusinessObjects Enterprise. Because your
Central Management Server was stopped when the data was copied, you
need to update the objects now.
10. If there are objects that require updating, click Update, otherwise click
Cancel.
Note:
LDAP and Windows AD authentication will not be available until after the
Update Objects task has been completed.
11. Start and enable the remaining BusinessObjects Enterprise servers.
Verify that BusinessObjects Enterprise requests are handled correctly, and
check that you can view and schedule reports successfully.
To change the directories of the Input and Output File Repository Servers on
Unix
1. If you copied CMS data from a different CMS system database into your
current CMS database, you need to make your old input and output
directories available to the new Input and Output File Repository Servers.
You can do this in several ways:
• Copy the contents of the original input root directory into the root
directory that the new Input File Repository Server is already configured
to use. Then copy the contents of the original output directory into the
root directory that the new Output File Repository is already configured
to use.

• Reconfigure the new Input and Output File Repository Servers to use
the old input and output root directories.
• If the old Input and Output File Repository Servers are running on a
dedicated machine, you can run the BusinessObjects Enterprise setup
program to upgrade the servers directly. Then you need not move the
input and output directories. For more information, see Setting root
directories and idle times of the File Repository Servers on page 182.
2. Make sure your web application server is running.
3. Log on to the Central Management Console with the default Administrator
account, using Enterprise authentication.
Tip:
If you just replaced your CMS database with data from an older system,
keep in mind that you now need to provide the Administrator password
that was valid in the older system.
4. Use the Central Management Console (CMC) to start the CMS on the
local machine.
5. Go to the License Keys management area and check that your
BusinessObjects Enterprise license keys are entered correctly.
6. Go to the Servers management area of the CMC and start and enable
7. Click the link to each File Repository Server and, on the Properties tab,
check that the File Store Directory points to the correct location.
8. Run the ccm.sh script. If you migrated a source database from an earlier
version of BusinessObjects Enterprise, enter the following command:
./ccm.sh -updateobjects authentication info
See the UNIX Tools chapter of the BusinessObjects Enterprise
Administrator's Guide for information on the authentication information
required by ccm.sh.
Objects typically require updating because their internal representation
has changed in the new version of BusinessObjects Enterprise, or because
the objects require new properties to support the additional features
offered by BusinessObjects Enterprise XI.
9. Use the CMC to start and enable the remaining BusinessObjects
Enterprise servers.

10. Verify that BusinessObjects Enterprise requests are handled correctly,
and check that you can view and schedule reports successfully.
Preparing to copy a CMS system database
Before copying a CMS system database, take the source and the destination
environments offline by disabling and subsequently stopping all servers.
Back up both CMS databases, and back up the root directories used by all
Input and Output File Repository Servers. If necessary, contact your database
or network administrator.
Ensure that you have a database user account that has permission to read
all data in the source database, and a database user account that has Create,
Delete, and Update rights to the destination database. Also ensure also that
you can connect to both databases—through your database client software
or through ODBC, according to your configuration—from the CMS machine
whose database you are replacing.
If you are copying the CMS database as part of an upgrade installation, make
a note of the license keys you purchased for the current version of
BusinessObjects Enterprise. License keys that are present in the destination
database are retained only if the source database contains no license keys
that are valid for the current version of BusinessObjects Enterprise. License
keys in the destination database are replaced with license keys from the
source database when the source license keys are valid for the current
version of BusinessObjects Enterprise. License keys from earlier versions
of Crystal Enterprise are not copied.
If you are copying CMS data from a different CMS database (version 8.5, 9,
or 10 of Crystal Enterprise or version XI or XI R2 of BusinessObjects
Enterprise) into your current CMS database, your current CMS database is
the destination database whose tables are deleted before they are replaced
with the copied data. In this scenario, make note of the current root directories
used by the Input and Output File Repository Servers in the source
environment. Report files are not moved from one directory location to
another. After you copy the database, you will connect your new Input and
Output File Repository Servers to the old root directories, thus making the
report files available for the new system to process. Log on with an
administrative account to the CMS machine whose database you want to
replace. Complete the procedure that corresponds to the version of the
source environment:

If you are copying a CMS database from its current location to a different
database server, your current CMS database is the source environment. Its
contents are copied to the destination database, which is then established
as the active database for the current CMS. This is the procedure to follow
if you want to move the default CMS database on Windows from the local
Microsoft Data Engine (MSDE) to a dedicated database server, such as
Microsoft SQL Server, Informix, Oracle, DB2, or Sybase. Log on with an
administrative account to the machine that is running the CMS whose
database you want to move. Complete the following procedure:
Note:
• When you upgrade a CMS database from an earlier version, the database
and database schema are upgraded to the format required by the current
version of BusinessObjects Enterprise.
• When you copy data from one database to another, the destination
database is initialized before the new data is copied in. That is, if your
destination database does not contain the four BusinessObjects Enterprise
XI system tables, these tables are created. If the destination database
does contain BusinessObjects Enterprise XI system tables, the tables
will be permanently deleted, new system tables will be created, and data
from the source database will be copied into the new tables. Other tables
in the database, including previous versions of Crystal Enterprise system
tables, are unaffected.
Deleting and recreating the CMS system database
This procedure shows how to recreate (re-initialize) the current CMS system
database. By performing this task, you destroy all data that is already present
in the database. This procedure is useful, for instance, if you have installed
BusinessObjects Enterprise in a development environment for designing and
testing your own, custom web applications. You can re-initialize the CMS
system database in your development environment every time you need to
clear the system of all its data.

Caution:
By implementing the steps outlined in this workflow, you will delete of all data
in the CMS database as well as objects such as reports and users. Do not
perform these steps on a production deployment.
In this version of BusinessObjects Enterprise, server configuration information
is stored in the CMS system database. It is very important that you back up
all server configuration files before re-initializing the CMS system database.
When you recreate the database, your server configuration information will
be erased and you must have a backup in order to restore this information.
When you recreate the system database, your existing license keys should
be retained in the database. However, if you need to enter license keys
again, log on to the CMC with the default Administrator account (which will
have been reset to have no password). Go to the Authorization management
area and enter your information on the License Keys tab.
Note:
If you re-initialize your CMS system database, all data in your current CMS
system database will be destroyed. Consider backing up your current
database before beginning. If necessary, contact your database administrator.
To recreate the CMS system database on Windows
1. Use the CCM to stop the Server Intelligence Agent (SIA).
Note:
For this procedure, you cannot run the CCM on a remote machine; it must
be run on a machine with at least one valid node.
3. In the Properties dialog box, in the CMS Data Source area, click Specify.
4. In the CMS Database Setup dialog box, click Recreate the current Data
Source.
Note:
All servers and objects from the machine where you ran the CCM in step
1 will also be recreated.
5. Click OK and, when prompted to confirm, click Yes.
The CCM notifies you when the CMS system database setup is complete.
6. Click OK.

You are returned to the CCM.
7. Restart the Server Intelligence Agent and enable services.
While it is starting, the Server Intelligence Agent starts the CMS. The
CMS writes required system data to the newly emptied data source.
8. If prompted, click Update Objects.
9. If your deployment has more than one machine, you need to re-create
the nodes on the other machines.
Note:
When you recreate the CMS system database, the information stored on
the other machines continues to refer to the original database. The nodes
must be recreated so this information is updated to the recreated CMS
system database. For more information, see Working with nodes on
page 134.
To recreate the CMS system database on UNIX
Use the cmsdbsetup.sh script. For reference, see the UNIX Tools chapter
of the BusinessObjects Enterprise Administrator's Guide.
1. Run cmsdbsetup.sh (located in <InstallDirectory>/bobje/, by
default).
2. Select the "reinitialize" option (option 5), then confirm your choice.
The cmsdbsetup.sh script begins recreating the CMS system database.
3. Provide your administrator password and the CMS port number you want.
4. When the database creation is complete, exit the cmsdbsetup.sh script.
5. Provide the database information (for example: host name, user name,
and password).
A notification message appears when the CMS database has been pointed
to the new location.
6. If you are prompted to rebuild the Server Intelligence Agent (SIA), provide
the administrator password and the port number you want to CMS to
communicate on.
Note:
You will be prompted for this information only if you point to an empty
CMS database.

7. Use the following command to run the ccm.sh script (located in <In
stallDirectory>/bobje/, by default):
ccm.sh -start SIANAME
8. To enable the services, use the following command:
ccm.sh -enable all -cms CMSNAME:PORT -username administrator
-password password
Note:
Since you just recreated the CMS database, the administrator password
is blank.
9. To update the objects, use the following command:
ccm.sh -updateobjects -cms CMSNAME:PORT -username administra
tor -password password
Selecting a new or existing CMS database
You can use the CCM to specify a new or existing CMS system database
for a node. Generally, there are only a few times when you need to complete
these steps:
• If you have changed the password for the current CMS system database,
these steps allow you to disconnect from, and then reconnect to, the
current database. When prompted, you can provide the CMS with the
new password.
• If you want to select and initialize an empty database for BusinessObjects
Enterprise, these steps allow you to select that new data source.
• If you have restored a CMS system database from backup (using your
standard database administration tools and procedures) in a way that
renders the original database connection invalid, you will need to
reconnect the CMS to the restored database. (This might occur, for
instance, if you restored the original CMS database to a newly installed
database server.)
Note:
In earlier versions of BusinessObjects Enterprise, this procedure was used
to add a CMS to a cluster. Do not use this procedure to add a CMS to a

cluster. Clustering is now handled by nodes. For information on moving
servers between clusters, see Backing up and restoring server configuration
settings on page 217.
To select a new or existing CMS database on Windows
Note:
This procedure is not used for clustering CMS services. For information on
moving servers between clusters, see Backing up and restoring server
configuration settings on page 217.
Note:
When you select a new or existing CMS database on Windows, the
BusinessObjects installation path, operating system, and machine name
cannot change.
1. Use the CCM to stop the Server Intelligence Agent (SIA).
2. Select the SIA and click Specify CMS System Database Data Source
on the toolbar.
3. In the Configuration tab of the "Properties" dialog box, under CMS Data
Source, click Specify.
4. The remaining steps depend upon the connection type you selected:
• If you selected ODBC, the Windows "Select Data Source" dialog box
appears. Select the ODBC data source that you want to use as the
CMS database; then click OK. (Click New to configure a new DSN.)
When prompted, provide your database credentials and click OK.
• If you selected a native driver, you are prompted for your database
Server Name, your Login ID, and your Password. Provide this
information and then click OK.
The CCM notifies you when the CMS database setup is complete.
5. In the "Properties" dialog box, click OK.
6. Restart the Server Intelligence Agent.
To select a new or existing CMS database on UNIX
Use the cmsdbsetup.sh script. For reference, see the UNIX Tools chapter.

1. Run the cmsdbsetup.sh script (located by default in <InstallDirecto
ry>/bobje/).
2. Select the update action (option 6).
3. When prompted, provide the database type of the new CMS database.
4. Provide the database information (for example: host name, user name,
and password).
A notification message appears when the CMS database has been pointed
to the new location.
5. If you are prompted to rebuild the Server Intelligence Agent (SIA), provide
the administrator password and the port number you want to CMS to
communicate on.
Note:
You will be prompted for this information only if you point to an empty
CMS database.
Setting root directories and idle times of the File
Repository Servers
The Properties tabs of the Input and Output File Repository Servers enable
you to change the locations of the default root directories. These root
directories contain all of the report objects and instances on the system. You
may change these settings if you want to use different directories after
installing BusinessObjects Enterprise, or if you upgrade to a different drive
(thus rendering the old directory paths invalid).
Note:
• The Input and Output File Repository Servers must not share the same
root directory, because modifications to the files and subdirectories
belonging to one server could have adverse effects on the other server.
In other words, if the Input and Output File Repository Servers share the
same root directory, then one server might damage files belonging to the
other.
• If you run multiple File Repository Servers, all Input File Repository
Servers must share the same root directory, and all Output File Repository
Servers must share the same root directory (otherwise there is a risk of
having inconsistent instances).

• It is recommended that you replicate the root directories using a RAID
array or an alternative hardware solution.
• The root directory should be on a drive that is local to the server.
You can also set the maximum idle time of each File Repository Server. This
setting limits the length of time that the server waits before it closes inactive
connections. Before you change this setting, it is important to understand
that setting a value too low can cause a user's request to be closed
prematurely. Setting a value too high can cause excessive consumption of
system resources such as processing time and disk space.
To modify settings for a File Repository Server
2. Select the File Repository Server you want to change.
4. In the "Properties" dialog box, make your changes and then click Save
or Save & Close.
Modifying performance settings
You can change performance settings for BusinessObjects Enterprise servers.
For information about assessing your system's performance and using these
configuration settings, see the Improving Performance chapter of the
Configuring destinations for job servers
By default, when the system runs a scheduled report or a program object, it
stores the output instance it creates on the Output File Repository Server
(FRS). However, you can specify a different destination. If you do, the system
will store one output instance on the Output FRS, and one at the specified
destination.
You also specify a destination when you use the Send to feature, which
sends an existing object to a specified destination.

In order for the system to work with destinations other than the default, the
destination you are sending to must be enabled and configured on all
Destination Job Servers in the system.
For example, to be able to schedule a report object for output to an
unmanaged disk, you have to enable and configure the Unmanaged Disk
destination on the Destination Job Server in the system. To send a report
instance by email, you have to configure the Email (SMTP) destination on
the Destination Job Servers.
Configuring destinations for job servers includes:
• To enable or disable destinations for a job server on page 184
• Configuring the destination properties for job servers on page 185
For information about selecting destinations for objects see the
To enable or disable destinations for a job server
For a job server to store output instances in a destination other than the
default, you have to enable and configure the other destinations on the job
servers. See also Configuring the destination properties for job servers on
page 185.
Note:
On the Destination Job Server, the managed (Inbox) destination is enabled
and configured by default on all job servers. This allows you to use the "Send
to" feature and to distribute reports to users within the BusinessObjects
Enterprise system. If you want, you can enable and configure additional
destinations on the Destination Job Server.
2. Select the job server for which you want to enable or disable a destination.
4. In the Properties dialog box, click Destinations in the navigation list
5. To enable a destination, select it in the Destination list and click Add.
Note:
If you enabled the destination, you must also configure the destination.
See Configuring the destination properties for job servers on page 185.

6. To disable a destination, select it in the Destination list and click Remove.
7. Click Save or Save & Close .
Configuring the destination properties for job servers
This procedure applies to the following servers:
• Program Job Server
• Report Job Server
• Destination Job Server
• Desktop Intelligence Job Server
For a job server to store output instances in a destination other than the
default, you have to enable and configure the other destinations on the
appropriate job servers. See also Configuring destinations for job servers
on page 183.
To set the destination properties for a job server
2. Select the job server whose setting you want to change.
4. In the Properties dialog box, click Destinations in the navigation list
5. Select a destination from the list, then click Add.
6. Set the properties for the destination. For information about the properties
for each destination, see:
• Inbox destination properties on page 186
• File System destination properties on page 189
• FTP destination properties on page 188
• Email destination properties on page 186
8. Make sure the destination has been enabled. See To enable or disable
destinations for a job server on page 184.

Inbox destination properties
The Inbox destination stores an object or instance in the user inboxes on
the BusinessObjects Enterprise system. A user inbox is automatically created
when you add a user. For more information, see Configuring the destination
properties for job servers on page 185 and "Setting rights" in the
Note:
On the Destination Job Server, the managed (Inbox) destination is enabled
and configured by default on all job servers. This allows you to use the "Send
to" feature and to distribute reports to users within the BusinessObjects
Enterprise system. If you want, you can enable and configure additional
destinations on the Destination Job Server.
Send list
Specify which users or user groups you want to receive instances from that
have been generated or processed by the job server.
Target Name
Use the default automatically-generated name for the instance, or provide
a specific name. You can add variables to the specific name by clicking them
in the Add placeholder list.
Send document as
Select the options you want:
• Shortcut
The system sends a shortcut to the specified destination.
• Copy
The system sends a copy of the object instance to the destination.
Email destination properties
The following settings are available for email destinations. See also
Configuring the destination properties for job servers on page 185.

Domain Name
Enter the fully qualified domain of the SMTP server.
Host
Enter the name of the SMTP server.
Port
Enter the port that the SMTP server is listening on. (This standard SMTP
port is 25.)
Authentication
Select Plain or Login if the job server must be authenticated using one of
these methods in order to send email.
User Name
Provide the Job Server with a user name that has permission to send email
and attachments through the SMTP server.
Password
Provide the Job Server with the password for the SMTP server.
From
Provide the return email address. Users can override this default when they
schedule an object.
To, Cc, Subject, and Message
Set the default values for users who schedule reports to this SMTP
destination. Users can override these defaults when they schedule an object.
Add placeholder
You can add placeholder variables to the message body using the Add
placeholder list. For example, you can add the report title, author, or the
URL for the viewer in which you want the email recipient to view the report.
Add Attachment
Select this check box if you want to attach a copy of the report or program
instance to the email. When you add an attachment, you can choose between
the following naming conventions:

• Automatically Generated
Select this option if you want BusinessObjects Enterprise to generate a
random file name.
• Specific Name
Select this option if you want to enter a file name. You can also add a
variable to the file name. To add a variable, choose a placeholder for a
variable property from the Add placeholder list.
• Add File Extension
Adds the .%EXT% extension to the specified filename. This is similar to
selecting File Extension from the Add placeholder list. By adding an
extension to the file name, Windows will know which program to use to
open the file.
Note:
Users can override these settings when they schedule an object.
FTP destination properties
The following settings are available for FTP destinations. See also Configuring
the destination properties for job servers on page 185.
Host
Enter your FTP host information.
Port
Enter the FTP port number (the standard FTP port is 21).
User Name
Specify a user who has the necessary rights to upload a report to the FTP
server.
Password
Enter the user's password.
Account

Enter the FTP account information, if required.
Account is part of the standard FTP protocol, but it is rarely implemented.
Provide the appropriate account only if your FTP server requires it.
Directory
Enter the FTP directory that you want the object to be saved to. A relative
path is interpreted relative to the root directory on the FTP server.
Automatically Generated
random file name.
Specific Name
Select this option if you want to enter a file name—you can also add a variable
to the file name. To add a variable, choose a placeholder for a variable
property from the list.
Add File Extension
extension to the file name, Windows will know which program to use to open
the file.
File System destination properties
A file system destination is an unmanaged disk destination on a system
outside the BusinessObjects Enterprise system. See also Configuring the
destination properties for job servers on page 185.
Directory
Type the absolute path to the directory. The directory can be on a local drive
of the Job Server machine, or on any other machine that you can specify
with a UNC path.
Automatically Generated
random file name.

Specific Name
Select this option if you want to enter a file name—you can also add a variable
to the file name. To add a variable, choose a placeholder for a variable
property from the list.
Add File Extension
extension to the file name, Windows will know which program to use to open
the file.
User Name
Specify a user who has permission to write files to the destination directory.
Password
Type the password for the user.
In this example, the destination directory is on a network drive that is
accessible to the Job Server machine through a UNC path. Each file name
will be randomly generated, and a user name and password have been
specified to grant the Job Server permission to write files to the remote
directory.
Configuring Windows processing servers for your
data source
When started on Windows, the report processing servers by default log on
to the local system as services with the Windows "LocalSystem" account.
This account determines the permissions that each service is granted on the
local machine. This account does not grant the service any network
permissions.
In the majority of cases, this account is irrelevant in relation to the server's
task of processing reports against your data source. (The database logon
credentials are stored with the report object.) Thus, you can usually leave
each server's default logon account unchanged or, if you prefer, you can
change it to a Windows user account with the appropriate permissions.

However, there are certain cases when you must change the logon account
used by the processing servers. These cases arise either because the server
needs additional network permissions to access the database, or because
the database client software is configured for a particular Windows user
account. This table lists the various database/ driver combinations and shows
when you must complete additional configuration.
Tip:
Running a service under an Administrator account does not inadvertently
grant administrative privileges to another user, because users cannot
impersonate services.
For a detailed list of supported environments and hardware requirements,
consult the Products Availability Report (PAR) document available on the
Business Objects support site http://support.businessobjects.com/documen
tation/supported_platforms.
For details on changing the user accounts, see Changing the system user
account on page 198. For a complete list of supported databases and drivers,
refer to the platform.txt file included with your installation.
Configuring UNIX processing servers for your data
source
The Job Servers and Processing Servers support native and ODBC
connections to a number of reporting databases. This section discusses the
environment variables, software, and configuration files that must be available
to the servers in order for them to process reports successfully. Whether
your reports use native or ODBC drivers, ensure that the reporting
environment configured on the server accurately reflects the reporting
environment configured on the Windows machine that you use when
designing reports.
For a complete list of tested database software and version requirements,
refer to the BusinessObjects Enterprise supported platform document guide
online on our support web site: http://support.businessobjects.com/documen
tation/supported_platforms.
Click the appropriate link to jump to that section:
• Native drivers on page 192
• ODBC drivers on page 193

Native drivers
If you design reports using native drivers, you must install the appropriate
database client software on each Job Server and/or Processing Server
machine that will process the reports. The server loads the client software
at runtime in order to access the database that is specified in the report. The
server locates the client software by searching the library path environment
variable that corresponds to your operating system (LD_LIBRARY_PATH on
Sun Solaris, LIBPATH on IBM AIX, and so on), so this variable must be defined
for the login environment of each Job Server and Processing Server.
Depending on your database, additional environment variables may be
required for the Job Server and Processing Server to use the client software.
These include:
• Oracle
The ORACLE_HOME environment variable must define the top-level
directory of the Oracle client installation.
• Sybase
The SYBASE environment variable must define the top-level directory of
the Sybase client installation. The SYBPLATFORM environment variable
must define the platform architecture.
• DB2
The DB2INSTANCE environment variable must define the DB2 instance
that is used for database access. Use the DB2 instance initialization script
to ensure that the DB2 environment is correct.
Note:
For complete details regarding these and other required environment
variables, see the documentation included with your database client software.
As an example, suppose that you are running reports against both Sybase
and Oracle. The Sybase database client is installed in /opt/sybase, and
the Oracle client is installed in /opt/oracle/app/oracle/product/8.1.7.
You installed BusinessObjects Enterprise under the crystal user account
(as recommended in the BusinessObjects Enterprise Installation Guide).

If the crystal user's default shell is a C shell, add these commands to the
crystal user's login script:
setenv LD_LIBRARY_PATH /opt/oracle/app/oracle/prod
uct/8.1.7/lib:opt/sybase/lib:$LD_LIBRARY_PATH
setenv ORACLE_HOME /opt/oracle/app/oracle/product/8.1.7
setenv SYBASE /opt/sybase
setenv SYBPLATFORM sun_svr4
If the crystal user's default shell is a Bourne shell, modify the syntax
accordingly:
LD_LIBRARY_PATH=/opt/oracle/app/oracle/prod
uct/8.1.7/lib:opt/sybase/lib:$LD_LIBRARY_PATH;export LD_LI
BRARY_PATH
ORACLE_HOME=/opt/oracle/app/oracle/product/8.1.7;export ORA
CLE_HOME
SYBASE=/opt/sybase;export SYBASE
SYBPLATFORM=sun_svr4;export SYBPLATFORM
ODBC drivers
If you design reports off ODBC data sources (on Windows), you must set up
the corresponding data sources on the Job Server and Processing Server
machines. In addition, you must ensure that each server is set up properly
for ODBC. During the installation, BusinessObjects Enterprise installs ODBC
drivers for UNIX, creates configuration files and templates related to ODBC
reporting, and sets up the required ODBC environment variables. This section
discusses the installed environment, along with the information that you need
to edit.
Note:
• If you report off DB2 using ODBC, your database administrator must first
bind the UNIX version of the driver to every database that you report
against (and not just each database server). The bind packages are
installed below the crystal/enterprise/platform/odbc/lib directory;
their filenames are iscsso.bnd, iscswhso.bnd, isrrso.bnd, isrrwh
so.bnd, isurso.bnd, and isurwhso.bnd. Because Crystal Reports runs
on Windows, ensure that the Windows version of the driver has been
bound to each database.
• On UNIX, BusinessObjects Enterprise does not include the Informix
client-dependent ODBC driver (CRinf16) that is installed on Windows.

The UNIX version does, however, include the clientless ODBC driver for
Informix connectivity.
ODBC environment variables
The environment variables related to ODBC reporting are: the library path
that corresponds to your operating system (LD_LIBRARY_PATH on Sun Solaris,
LIBPATH on IBM AIX, and so on), ODBC_HOME, and ODBCINI . The
BusinessObjects Enterprise installation includes a file called env.csh that
is sourced automatically every time you start the BusinessObjects Enterprise
servers with the CCM. Thus, the environment for the Job Server and
Processing Server is set up automatically:
• The INSTALL_ROOT/bobje/enterprise120/platform/odbc/lib
directory of your installation is added to the library path environment
variable.
• The ODBC_HOME environment variable is set to the INSTALL_ROOT/bob
je/enterprise120/platform/odbc directory of your installation.
• The ODBCINI environment variable is defined as the path to the .odbc.ini
file that was created by the BusinessObjects Enterprise installation.
Modify the environment variables in the env.csh script only if you have
customized your configuration of ODBC. The main ODBC configuration file
that you need to modify is the system information file.
Working with the ODBC system information file
The system information file (odbc.ini) is created in the HOME directory of
the user account under which you installed BusinessObjects Enterprise
(typically the crystal user account). In this file, you define each of the ODBC
data sources (DSNs) that the Job Server and Processing Server need in
order to process your reports. The BusinessObjects Enterprise installation
completes most of the required information—such as the location of the
ODBC directory and the name and location of each installed ODBC
driver—and shows where you need to provide additional information.
Tip:
A template of the system information file is installed to INSTALL_ROOT/bob
je/defaultodbc.ini
The following example shows the contents of a system information file that
defines a single ODBC DSN for servers running on UNIX. This DSN allows

the Job Server and Processing Server to process reports based on a System
DSN (on Windows) called CRDB2:
[ODBC Data Sources]
CRDB2=MERANT 3.70 DB2 ODBC Driver
[CRDB2]
Driver=/opt/bobje/enterprise120/platform/odbc/lib/crdb216.so
Description=MERANT 3.70 DB2 ODBC Driver
Database=myDB2server
LogonID=username
[ODBC]
Trace=0
TraceFile=odbctrace.out
TraceDll=/opt/bobje/enterprise120/platform/odbc/lib/odbctrac.so
InstallDir=/opt/bobje/enterprise120/platform/odbc
As shown in the example above, the system information file is structured in
three major sections:
• The first section, denoted by [ODBC Data Sources], lists all the DSNs
that are defined later in the file. Each entry in this section is provided as
dsn=driver, and there must be one entry for every DSN that is defined
in the file. The value of dsn must correspond exactly to the name of the
System DSN (on Windows) that the report was based off.
• The second section sequentially defines each DSN that is listed in the
first section. The beginning of each definition is denoted by [dsn]. In the
example above, [CRDB2] marks the beginning of the single DSN that is
defined in the file.
Each DSN is defined through a number of option=value pairs. The options
that you must define depend upon the ODBC driver that you are using.
These pairs essentially correspond to the Name=Data pairs that Windows
stores for each System DSN in the registry:
HKEY_LOCAL_MACHINESOFTWAREODBCodbc.inidsn
However, the options for a particular ODBC driver on UNIX may not
correspond by name to the options available for a Windows version of
the same driver. For example, some Windows drivers store a UID value
in the registry, and on UNIX you may need to specify this value with the
LogonID option.
The final section of the file, denoted by [ODBC], includes ODBC tracing
information. You need not modify this section.

When the installation creates the system information file, it completes some
fields and sets up a number of default DSNs—one for each of the installed
ODBC drivers. The standard options that are commonly required for each
driver are included in the file (Database=, LogonID=, and so on). Edit the file
and provide the corresponding values that are specific to your reporting
environment.
This example shows the entire contents of a system information file created
when BusinessObjects Enterprise was installed to the /usr/local directory.
[ODBC Data Sources]
CRDB2=MERANT 3.70 DB2 ODBC Driver
CRINF_CL=MERANT 3.70 Informix Dynamic Server ODBC Driver
CROR8=MERANT 3.70 Oracle8 ODBC Driver
CRSS=MERANT 3.70 SQL Server ODBC Driver
CRSYB=MERANT 3.70 Sybase ASE ODBC Driver
CRTXT=MERANT 3.70 Text ODBC Driver
[CRDB2]
Driver=/usr/local/bobje/enterprise120/plat
form/odbc/lib/crdb216.so
Description=MERANT 3.70 DB2 ODBC Driver
Database=
LogonID=
[CRINF_CL]
Driver=/usr/local/bobje/enterprise120/platform/odbc/lib/crif
cl16.so
Description=MERANT 3.70 Informix Dynamic Server ODBC Driver
ServerName=
HostName=
PortNumber=
Database=
LogonID=
[CROR8]
form/odbc/lib/cror816.so
Description=MERANT 3.70 Oracle8 ODBC Driver
ServerName=
ProcedureRetResults=1
LogonID=
[CRSS]
form/odbc/lib/crmsss16.so
Description=MERANT 3.70 SQL Server ODBC Driver
Address=
Database=
QuotedId=Yes

LogonID=
[CRSYB]
form/odbc/lib/crase16.so
Description=MERANT 3.70 Sybase ASE ODBC Driver
NetworkAddress=
Database=
LogonID=
[CRTXT]
form/odbc/lib/crtxt16.so
Description=MERANT 3.70 Text ODBC Driver
Database=
[ODBC]
Trace=0
TraceFile=odbctrace.out
TraceDll=/usr/local/bobje/enterprise120/platform/odbc/lib/odbc
trac.so
InstallDir=/usr/local/bobje/enterprise120/platform/odbc
Adding a DSN to the default ODBC system information file
When you need to add a new DSN to the installed system information file
(.odbc.ini), first add the new DSN to the bottom of the [ODBC Data
Sources] list. Then add the corresponding [dsn] definition just before the
[ODBC] section.
For example, suppose that you have a Crystal report that uses ODBC drivers
to report off your Oracle8 database. The report is based off a System DSN
(on Windows) called SalesDB. To create the corresponding DSN, first append
this line to the [ODBC Data Sources] section of the system information file:
SalesDB=MERANT 3.70 Oracle8 ODBC Driver
Then define the new DSN by adding the following lines just before the system
information file's [ODBC] section:
[SalesDB]
form/odbc/lib/cror816.so
Description=MERANT 3.70 Oracle8 ODBC Driver
ServerName=MyServer
ProcedureRetResults=1
LogonID=MyUserName

Once you have added this information, the new DSN is available to the Job
Server and Processing Server, so they can process reports that are based
off the SalesDB System DSN (on Windows).
Adding and removing Windows server
dependencies
When installed on Windows, each Server Intelligence Agent (SIA) in
BusinessObjects Enterprise is dependent on the Event Log and Remote
Procedure Call (RPC) services. If you are having problems with an SIA,
check to ensure that all three services appear on the SIA's Dependency tab.
To add and remove server dependencies
1. Use the CCM to stop the Server Intelligence Agent (SIA) whose
dependencies you want to modify.
3. Click the Dependency tab.
4. To add a dependency to the list, click Add.
The Add Dependency dialog box provides you with a list of all available
dependencies. Select the dependency or dependencies, as required, and
then click Add.
5. To remove a dependency from the list, select it and click Remove.
6. Click OK.
7. Restart the SIA.
Changing the system user account
If the incorrect user account is running the Server Intelligence Agent, you
can change it in the Central Configuration Manager (CCM). Note that all
servers managed by a Server Intelligence Agent run under the same account.
3 Adding and removing Windows server dependencies

To change an SIA's user account
1. Use the CCM to stop the Server Intelligence Agent.
2. Right-click the Server Intelligence Agent and choose Properties.
3. Clear the System Account check box.
4. Enter the user name and password information.
When started, the server process will log on to the local machine with
this user account. In addition, all objects processed by this server will be
formatted using the printer settings associated with the user account that
you enter.
Note:
All servers managed by a Server Intelligence Agent run under the same
account.
5. Click OK.
6. Restart the Server Intelligence Agent.
Configuring tracing for servers
Every BusinessObjects Enterprise server or process has its own log trace
files. The trace log file name is composed of the process (server) name,
process ID, and full date. For example, AAAnalyt
ics_2344_2008_09_10_21_24_666_trace.log. The _trace.log files are
by default stored in the following directories :
• On Windows: <INSTALLDIR>Business ObjectsBusinessObjects
Enterprise 12.0logging
• On UNIX: <INSTALLDIR>/bobje/logging
To help administrators identify and resolve problems with BusinessObjects
Enterprise servers, all errors and critical events (asserts) are by default traced
and written to a log file. In addition to errors and asserts, servers can be
traced for warning and success messages.
You can modify the tracing severity threshold or any other tracing-related
settings through either of the following:
• BO_trace.ini file

• Server command line through the CMC
To configure server tracing through the BO_trace.ini
file
The BO_trace.ini file is read every minute and by default it is configured to
disable tracing. To activate and configure tracing using the BO_trace.ini
file, please follow these steps:
4. To specify the default location for the BO_trace.ini, enter the following
under "Command Line Parameters":
-configFile <$INSTALLDIRBusinessObjects Enterprise
12.0logginglogConfigBO_trace.ini>
6. Restart the server.
7. Open the BO_trace.ini file.
• The default location on Windows is: <INSTALLDIR>BusinessObjects
Enterprise 12.0logginglogConfig.
• The default location on UNIX is: <INSTALLDIR>/bobje/logging/Log
Config.
8. Uncomment the required lines under the "Trace Syntax and Setting"
section.
9. Modify the server tracing parameters as required.
The table below lists all the available parameters for configuring server
tracing.
3 Configuring tracing for servers

DescriptionPossible valuesParameter
Enables tracing for the current
process or server if set to true.
Default value is false.
false, trueactive
Specifies the threshold for
tracing messages. All mes-
sages beyond the threshold will
be traced. Default value is m
(medium).
'<<', '<=', '==', '>=', '>>', xs, s,
m, l, xl
Note:
importance = xs is the most
verbose option available while
importance = xl is the least.
importance
Specifies to automatically en-
able trace for severe system
events. Default value is true.
false, truealert
Specifies the threshold severity
over which massages can be
traced. Default value is 'E'.
' ', 'W', 'E', 'A', success, warn
ing, error, assert
severity
Specifies the number of mes-
sages in a trace log file before
a new one is created. Default
value is 100000.
Possible values are integers
>= 1000
size
Specifies whether or not to
keep the old log file after a new
file is created. Default value is
false.
false, truekeep

Specifies an annotation to use
in the output log file. The de-
fault value is “”. For example,
if
consultant = "hello"
this string will be inserted into
the log file.
Strings or integersconsultant
Specifies the output log file di-
rectory. By default log files are
stored in the Logging folder.
For example, for Windows:
log_dir="C:Program
FilesBusinessObjects
Enterprise 12.0logging"
For UNIX:
log_dir="/usr/bobje/log
ging"
Stringlog_dir
Specifies if the log file should
be closed after a trace is writ-
ten to the log file. Default value
is off.
on, offalways_close
10. Save and close the BO_trace.ini file.
The settings specified in the BO_trace.ini file override whatever is specified
for server tracing in the CMC command line. Your configuration should take
affect within a minute of saving the BO_trace.ini file.
Example:
active=false;
severity='E';
importance='==';
size=1000000;
keep=false;

To configure server tracing through the command
line
You can configure server tracing for each BusinessObjects Enterprise server
through the CMC by specifying particular parameters in the command line.
This approach is used when you want to modify the default location of the
server's tracing log file, or to disable tracing.
4. Use the field under "Command Line Parameters" to enter or modify the
tracing parameters.
The table below lists all the available parameters for configuring server
tracing.

Specifies the importance level
of messages to trace. The de-
fault value is -trace e (i.e. only
error messages are traced). If
set to -trace xs all messages
are traced. Use -trace xl if you
want to limit tracing to the most
serious/critical messages.
off, xs, s, m, l, xl, e, a-trace
If set to on, a complete stack
trace following a critical error is
written to the log file. If no val-
ue is specified, stackdump is
set to on. The default value is
-stackdump off.
off, on-stackdump
Records all "Request Trace"
messages to the log file and
the console in debug builds.
Request trace messages in-
clude request ID information,
therefore a single transaction
can be traced through the
system across several servers.
The default value is -reqtrace
off.
off, on-reqtrace
Turns off SASSERT,
SASSERTMSG, SVERIFY, and
SASSERTMSG_EX messages.
Assert messages will not be
written to the log file, and will
not appear in the console for
debug builds. By default, assert
messages are traced.
-noassert

Turns on/off the native assert
behavior for the build architec-
ture. The native assert behav-
ior in debug UNIX builds is to
dump core. The native assert
behavior in debug Windows
builds is to pop up a dialog box
with diagnostic information.
Both platforms do not trace as-
sert messages in release
builds.
off, on-nativeassert
Specifies whether or not to
trace the Business Objects de-
veloper libraries. The default
value is -sdktrace off.
off, on-sdktrace
Sets filters for tracing. To trace
messages written to a particu-
lar set of files, enter a comma-
separated list of filenames. To
filter out particular files, prefix
the comma-separated list of
filenames with the ^ character.
For example, ^filename1, file-
name2.
-filelogfilter
Specifies the directory where
the log file is located. For Win-
dows, the default is the value
of the logginPath registry. On
UNIX, the default folder is the
current working directory -
generally the same directory
containing the application being
traced.
-loggingPath
Specifies the directory hosting
the <app_name>_trace.ini file.
Full path to BO_trace.ini file.-configFileDir
Specifies the name and loca-
tion of the trace.ini file.
<app_name>_trace.ini-configFile

Specifies the directory contain-
ing the logging extension DLLs.
For Windows, the default is the
value of the logginPluginDir
registry. On UNIX, the default
folder is the current working di-
rectory - generally the same
directory containing the applica-
tion being traced.
-loggingplugindir
Specifies if the log file should
be closed after a trace is writ-
ten to the file. The default value
is -alwaysclose off.
off, on-alwaysclose
Specifies to turn off tracing.
Once tracing is disables via this
option, it cannot be reactivated
through the
<app_name>_trace.ini file. The
default value is -nevertrace off.
off, on-nevertrace
6. Restart the server.
Configuring servers for SSL
You can use the Secure Sockets Layer (SSL) protocol for all network
communication between clients and servers in your BusinessObjects
Enterprise deployment.
To set up SSL for all server communication you need to perform the following
steps:
• Deploy BusinessObjects Enterprise with SSL enabled.
• Create key and certificate files for each machine in your deployment.
• Configure the location of these files in the Central Configuration Manager
(CCM) and your web application server.
3 Configuring servers for SSL

Note:
If you are using thick clients, such as Crystal Reports or Designer you will
also need to configure these for SSL if you will be connecting to the CMS
from these thick client. Otherwise, you will get errors when you attempt to
connect to a CMS that has been configured for SSL from a thick client that
has not been configured the same way.
Creating key and certificate files
To set up SSL protocol for your server communication, use the SSLC
command line tool to create a key file and a certificate file for each machine
in your deployment.
Note:
• You need to create certificates and keys for all machines in the
deployment, including machines running thick client components such
as Crystal Reports. For these client machines, use the sslconfig
command line tool to do the configuration.
• For maximum security, all private keys should be protected and should
not be transferred through unsecured communication channels.
To create key and certificate files for a machine
1. Run the SSLC.exe command line tool.
The SSLC tool is installed with your BusinessObjects Enterprise software.
(On Windows, for example, it is installed by default in C:Program
FilesBusiness ObjectsBusinessObjects Enterprise 12.0win32_x86.)
2. Type the following command:
sslc req -config sslc.cnf -new -out cacert.req
This command creates two files, a Certificate Authority (CA) certificate
request (cacert.req) and a private key (privkey.pem).
3. To decrypt the private key, type the following command:
sslc rsa -in privkey.pem -out cakey.pem
This command creates the decrypted key, cakey.pem.
4. To sign the CA certificate, type the following command:

sslc x509 -in cacert.req -out cacert.pem -req -signkey cakey.pem -days
365
This command creates a self-signed certificate, cacert.pem, that expires
after 365 days. Choose the number of days that suits your security needs.
5. Using a text editor, open the sslc.cnf file, which is stored in the same
folder as the SSLC command line tool.
Note:
Using a text editor is highly recommended for Windows because Windows
Explorer may not properly recognize and display files with the .cnf
extension.
6. Perform the following steps based on settings in the sslc.cnf file.
• Place the cakey.pem and cacert.pem files in the directories specified
by sslc.cnf file's certificate and private_key options.
By default, the settings in the sslc.cnf file are:
certificate = $dir/cacert.pem
private_key = $dir/private/cakey.pem
• Create a file with the name specified by the sslc.cnf file's database
setting.
Note:
By default, this file is $dir/index.txt. The file can be empty.
• Create a file with the name specified by the sslc.cnf file's serial
setting.
Ensure that this file provides an octet-string serial number (in
hexadecimal format).
Note:
To ensure that you can create and sign more certificates, choose a
large hexadecimal number with an even number of digits, such as
11111111111111111111111111111111.)'
• Create the directory specified by the sslc.cnf file's new_certs_dir
setting.
7. To create a certificate request and a private key, type the following
command:

sslc req -config sslc.cnf -new -out servercert.req
The certificate and key files generated are placed under the current
working folder.
8. Make a copy of the private key.
copy privkey.pem server.key
9. To sign the certificate with the CA certificate, type the following command:
sslc ca -config sslc.cnf -days 365 -out servercert.pem -in servercert.req
This command creates the servercert.pem file, which contains the signed
certificate.
10. Use the following commands to convert the certificates to DER encoded
certificates:
sslc x509 -in cacert.pem -out cacert.der -outform DER
sslc x509 -in servercert.pem -out servercert.der -outform DER
Note:
The CA certificate (cacert.der) and its corresponding private key
(cakey.pem) need to be generated only once per deployment. All machines
in the same deployment must share the same CA certificates. All other
certificates need to be signed by the private key of any of the CA
certificates.
11. Create a text file for storing the plain text passphrase used for decrypting
the generated private key.
12. Store the following key and certificate files in a secure location (under the
same directory) that can be accessed by the machines in your
BusinessObjects Enterprise deployment:
• the trusted certificate file (cacert.der)
• the generated server certificate file (servercert.der)
• the server key file (server.key)
• the passphrase file
This location will be used to configure SSL for the CCM and your web
application server.

Configuring the SSL protocol
After you create keys and certificates for each machine in your deployment,
and store them in a secure location, you need to provide the Central
Configuration Manager (CCM) and your web application server with the
secure location.
To configure the SSL protocol in the CCM
1. In the CCM, right-click the Server Intelligence Agent and choose
Properties.
2. In the Properties dialog box, click the Protocol tab.
3. Make sure Enable SSL is selected, and provide the file path for the
directory where you stored the key and certificate files.
Note:
Make sure you provide the directory for the machine that the server is
running on.
To configure the SSL protocol for the web application server
1. If you have a J2EE web application server, run the Java SDK with the
following system properties set. For example:
-Dbusinessobjects.orb.oci.protocol=ssl -DcertDir=d:ssl
-DtrustedCert=cacert.der -DsslCert=clientcert.der -DsslKey=client.key
-Dpassphrase=passphrase.txt
The following table shows the descriptions that correspond to these
examples:
DescriptionExample
The directory to store all the certifi-
cates and keys.
DcertDir=d:ssl

DescriptionExample
Trusted certificate file. If specifying
more than one, separate with
semicolons.
DtrustedCert=cacert.der
Certificate used by the SDK.DsslCert=clientcert.der
Private key of the SDK certificate.DsslKey=client.key
The file that stores the passphrase
for the private key.
Dpassphrase=passphrase.txt
2. If you have an IIS web application server, run the sslconfig tool from
the command line and follow the configuration steps.
Clustering Central Management Servers
If you have a large or mission-critical implementation of BusinessObjects
Enterprise, you will probably want to run several CMS machines together in
a cluster. A cluster consists of two or more CMS servers working together
against a common CMS system database. If a machine that is running one
CMS fails, a machine with another CMS will continue to service
BusinessObjects Enterprise requests. This "high availability" support helps
to ensure that BusinessObjects Enterprise users can still access information
when there is an equipment failure.
This section shows how to add a new CMS cluster member to a production
system that is already up and running. When you add a new CMS to an
existing cluster, you instruct the new CMS to connect to the existing CMS
system database and to share the processing workload with any existing
CMS machines. For information about your current CMS, go to the Servers
management area of the CMC.

Before clustering CMS machines, you must make sure that each CMS is
installed on a system that meets the detailed requirements (including version
levels and patch levels) for operating system, database server, database
access method, database driver, and database client outlined in the plat
forms.txt file included in your product distribution.
In addition, you must meet the following clustering requirements:
• For best performance, the database server that you choose to host the
system database must be able to process small queries very quickly. The
CMS communicates frequently with the system database and sends it
many small queries. If the database server is unable to process these
requests in a timely manner, BusinessObjects Enterprise performance
will be greatly affected.
• For best performance, run each CMS cluster member on a machine that
has the same amount of memory and the same type of CPU.
• Configure each machine similarly:
• Install the same operating system, including the same version of
operating system service packs and patches.
• Install the same version of BusinessObjects Enterprise (including
patches, if applicable).
• Ensure that each CMS connects to the CMS system database in the
same manner: whether you use native or ODBC drivers. Make sure
that the drivers are the same on each machine, and are a supported
version.
• Ensure that each CMS uses the same database client to connect to
its system database, and that it is a supported version.
• Check that each CMS uses the same database user account and
password to connect to the CMS system database. This account must
have create, delete, and update rights on the system database.
• Ensure that the nodes on which each CMS is located are running
under the same operating system account. (On Windows, the default
is the "LocalSystem" account.)
• Verify that the current date and time are set correctly on each CMS
machine (including settings for daylight savings time).
• Ensure that the same .war files are installed on all web application
servers in the cluster. For more information on .war file deployment,
see the BusinessObjects Enterprise Installation Guide.
3 Clustering Central Management Servers

• Ensure that each and every CMS in a cluster is on the same Local Area
Network.
• If your cluster has more than eight CMS cluster members, ensure that
the command line for each CMS includes the -oobthreads <numCMS>
option, where <numCMS> is the number of CMS servers in the cluster. This
option ensures that the cluster can handle heavy loads. For information
about configuring server command lines, see the Server Command Lines
appendix of the BusinessObjects Enterprise Administrator's Guide.
• If you want to enable auditing, each CMS must be configured to use the
same auditing database and to connect to it in the same manner. The
requirements for the auditing database are the same as those for the
system database in terms of database servers, clients, access methods,
drivers, and user IDs.
Tip:
By default, a cluster name reflects the specific name of the first CMS that
you install. To modify the default name, see Changing the name of a CMS
cluster on page 216.
Adding a CMS to a cluster
There are several ways to add a new CMS cluster member. Follow the
appropriate procedure:
• If you want to install a new node with a CMS on a new machine, then see
Adding a new node to a cluster on page 214.
• If you already have a node with CMS binary files, then you can add a new
CMS server from the CMC. See Adding a server on page 146.
• If you already have a node with CMS binary files, you can also add a new
CMS server by cloning an existing CMS server. See Cloning servers on
page 147.
Note:
Back up your current CMS system database before making any changes. If
necessary, contact your database administrator.

Adding a new node to a cluster
When you add a node, you are prompted to either create a new CMS or to
cluster the node to an existing CMS. For detailed instructions on adding a
node, see Working with nodes on page 134.
If you want to cluster a node to an existing CMS, you can also use the
installation setup program. Run the BusinessObjects Enterprise installation
and setup program on the machine where you want to install the new CMS
cluster member. The setup program allows you to perform a Custom
installation. During the Custom installation, specify the existing CMS whose
system you want to expand, and select the components that want to install
on the local machine. In this case, specify the name of the CMS that is running
your existing system, and choose to install a new CMS on the local machine.
Then provide the Setup program with the information it needs to connect to
your existing CMS system database. When the Setup program installs the
new CMS on the local machine, it automatically adds the server to your
existing cluster.
Adding clusters to the web.xml file
If you have added additional CMSs, and you are using a Java application
server, you can modify the web.xml file in the PlatformServicesWEB-INF
directory of your web application deployment.
To modify the web.xml to define clusters
1. Open the web.xml:
In a default deployment on Tomcat 5.5 the file is located in the following
directory:
C:Program FilesBusiness ObjectsTomcat55webappsPlatform
ServicesWEB-INF
2. Locate the following section in the file:
<!-- EXAMPLE:
<context-param>
<param-name>cms.clusters</param-name>

<param-value>@samplecluster, @samplecluster2, @sam
plecluster3</param-value>
</context-param>
<context-param>
<param-name>cms.clusters.samplecluster</param-name>
<param-value>cmsone:6400, cmstwo</param-value>
</context-param>
<context-param>
<param-name>cms.clusters.samplecluster2</param-name>
<param-value>cms3, cms4, cms5</param-value>
</context-param>
<context-param>
<param-name>cms.clusters.samplecluster3</param-name>
<param-value>aps05</param-value>
</context-param>
-->
3. Remove the comment tags from this section.
4. In the param-value tag under <param-name>cms.clusters</param-
name>, list the names of each cluster in your deployment.
A “@” character must go before each cluster name in this tag as shown
in the example. Separate each cluster name with a comma.
Tip:
Remove the sample cluster names from the section.
5. In the param-name tag after the cluster list, type the name of the first
cluster .
In the example replace “samplecluster” in
<param-name>cms.clusters.samplecluster</param-name>
with the cluster name. Cluster names should not include the “@” character
in this tag.
6. In the param-value tag, list the name of each CMS in the cluster and
enter the CMS port number if required.
Note:
Separate each CMS name with a comma. The port number is separated
from the CMS name with a colon; The port number is assumed to be
6400 unless a specific port number is provided.
7. Repeat steps 5-6 for each cluster in your deployment.
8. Save your changes.

9. Restart your application server.
Changing the name of a CMS cluster
This procedure allows you to change the name of a cluster that is already
installed. After changing the name of the CMS cluster, the Server Intelligences
Agent automatically reconfigures each Business Objects server so that it
registers with the CMS cluster, rather than with an individual CMS.
Note:
For experienced administrators of BusinessObjects Enterprise, please note
that you can no longer use the -ns option on the server command line to
configure which CMS a server should register with. This is now handled
automatically by the SIA.
To change the cluster name on Windows
1. Use the CCM to stop the Server Intelligence Agent for the node that
contains a Central Management Server that is a member of the cluster
whose name you want to change.
2. Right-click the Server Intelligence Agent and choose Properties.
3. In the Properties dialog box, click the Configuration tab.
4. Select the Change Cluster Name to check box.
5. Type the new name for the cluster.
Note:
Make sure you use a specific CMS name for the cluster. (Do not use the
@cluster convention used in previous versions of BusinessObjects
Enterprise.)
6. Click OK and then restart the Server Intelligence Agent.
The CMS cluster name is now changed. All other CMS cluster members
are dynamically notified of the new cluster name (although it may take
several minutes for your changes to propagate across cluster members).
7. Go to the Servers management area of the CMC and check that all of
your servers remain enabled. If necessary, enable any servers that have
been disabled by your changes.

To change the cluster name on UNIX
Use the cmsdbsetup.sh script. For reference, see the Unix Tools chapter
Backing up and restoring server
configuration settings
The Import Wizard lets you to back up your server configuration settings to
a BIAR file, and then use that BIAR to restore those settings at a later date.
Server groups are objects that group related servers together. If you are
restoring servers and you are not restoring their related server groups, and
the destination system does not contain the same server groups (matched
by CUID), you lose the relationship between the server group and the
exported server. When you re-import the server, you need to either manually
add the server to the desired server groups or create new server groups.
You can set up reports to run on particular server groups. If you are exporting
reports and the related server groups are not imported, and do not already
exist on the destination, the reports lose their relationship to the server group.
If you want the report to use particular server group, and that group does
not exist on the destination, you need to manually configure the server groups.
Similarly, if you are importing servers, server groups, or reports without
importing the users that have rights on those objects, and those users do
not already exist on the destination environment, the rights on those objects
are dropped. You may have security settings on those objects that are not
correctly set.
Note:
• The Import Wizard supports the backing up and restoring of entire
deployments, including all of the servers and nodes in the deployments.
• The Import Wizard Command Line Tool does not support the importing
and exporting of server configuration settings.
• If your destination deployment already has servers with the same server
identifier as the servers in your BIAR file, then those servers may fail to
import. If the import process fails, determine which servers on the
Backing up and restoring server configuration settings

destination system have conflicting server identifiers. You can see the
server list by viewing the Import Wizard's Detail Log, or by opening the
log file ImportWiz.log.
If there are servers that conflict because they have the same server
identifiers, use the CMC to delete those servers from the destination
deployment, and repeat the server import process.
By default, ImportWiz.log is located in C:Program FilesBusiness
ObjectsBusinessObjects Enterprise 12.0Logging
To back up server configuration settings to a BIAR
file
1. Specify the BusinessObjects Enterprise XI 3.x system as the source
environment.
2. Specify Business Intelligence Archive Resource (BIAR) File as the
destination environment.
3. On the "Select objects to import" screen, select Export server
configuration, and click Next until the "Ready to Import" screen appears.
4. On the "Ready to Import" screen, click Finish to start the import.
The "Import Progress" screen appears. After the import is complete, the
dialog box displays a summary of the import.
5. Click Done to close the Import Wizard.
All of the servers in your BusinessObjects Enterprise deployment are backed
up on the BIAR file.
To restore server configuration settings
Before you restore the server configuration settings from a BIAR file, you
should first backup your existing configuration. Once you restore the
configuration settings, the only way to revert back to the state before the
restore is by importing the settings from the second BIAR file.
It is recommended that when you add or delete a BusinessObjects Enterprise
server from a BusinessObjects Enterprise cluster, you export the server
configuration settings for the entire cluster to a BIAR file. This prevents a
situation where the cluster contains more servers than the BIAR file that you
3 Backing up and restoring server configuration settings

are importing from does, so that you do not have to manually delete the
servers before restoring your server configuration settings from the BIAR
file.
Note:
• If you've created additional servers or nodes after you backed up your
configuration settings, and use the Import Wizard to restore the
configuration settings, the Import Wizard doesn't update or delete these
servers or nodes. However if such servers used configuration templates
then they can become reconfigured. This is because during restore
process the configuration templates are updated, affecting the server's
configuration. If you want to get your system to the same server
configuration state as it was at the time of the backup, and your
BusinessObjects Enterprise deployment has more servers than the BIAR
file that you are restoring from does, you may want to delete the servers
through the CMC before you restore. If you delete servers from your
BusinessObjects Enterprise deployment, you must ensure that the
deployment has at least one CMS to run the Import Wizard.
• Do not restore server configuration settings from a Windows deployment
to a UNIX deployment or from a UNIX deployment on a Windows
deployment. Always restore server configuration settings from a Windows
deployment to a Windows deployment and from Unix deployment to Unix
deployment.
1. Specify the BIAR file that contains the server configuration settings that
you want to import as the source environment.
2. Specify your BusinessObjects Enterprise XI 3.x system as the destination
environment.
3. On the "Select objects to import" screen, select Restore Full Cluster
Server Configuration, and click Next.
Note:
If you select Import node(s) from a different cluster, you can't select
Restore Full Cluster Server Configuration .
4. On the "Import Scenarios" screen, specify what you want the Import
Wizard to do if it finds an object with the same unique identifier on the
destination environment.
Note:
When you are importing objects from a BIAR file, the option to match
objects by name and path is not available.

The options that you can select are:
• Update the destination object, in case of name conflict, rename
it.
Use this option when you want to restore all server objects that are in
a BIAR file to a deployment. If the deployment already has other
servers with the same names, then some of the updated servers may
be renamed.
If a server in the BIAR files has a unique identifier that matches a
server's unique identifier on the deployment, then the server on the
deployment will be overwritten with the configuration settings of the
server located in the BIAR file.
If, during the import process, the Import Wizard discovers that the
deployment already has another server with the same name as the
server from the BIAR file, the Import Wizard imports the server and
renames it. The server's new name will be server name as it appears
in the BIAR file, appended with a number in brackets.
• Update the destination object, in case of name conflict, do not
rename it.
Use this option when you want to restore all server objects from the
BIAR file to a deployment, except the servers with different unique
identifiers but with the same names.
• Do not import the object
Use this option if you do not want servers on deployment to be
overwritten with settings from the BIAR file. This will cause only servers
not existing on your deployment (but existing in the BIAR file) to be
restored.
See Restoring server configuration scenarios on page 221 for examples
that describe how server configuration settings can be restored from BIAR
files.
5. On the "Incremental import" screen, select whether you want to overwrite
object contents or overwrite right contents.
6. Click Next until the "Ready to Import" screen appears.
7. On the "Ready to Import" screen, click Finish.
The "Import Progress" screen appears. After the import is complete, the
screen displays a summary of the import.

8. Click Done to close the Import Wizard.
Restoring server configuration scenarios
This section describes scenarios for using the Import Wizard to restore server
configuration settings from a BIAR file, and illustrates how selecting different
import scenarios affects how server settings are imported.
For all of the scenarios, the initial configuration is described in the following
tables.
Table 3-7: Initial Server Configuration Settings on the Deployment
ValueProperty
Unique
Identifier
Server Name
6401Request Port1mynode.cms
2Maximum Idle Time2mynode.eventserver
When you export these settings to a BIAR file, the file contains the same
server settings.
Table 3-8: Initial Server Configuration Settings in the BIAR file
ValueProperty
Unique
Identifier
Server Name
All of the following scenarios assume that we are importing the server
configuration settings from this BIAR file.

Suppose that you modify the server configuration settings on the deployment
so that the deployment now has the configuration settings described in the
following table.
Table 3-9: New Server Configuration Settings on the Deployment
ValueProperty
Unique
Identifier
Server Name
The following two scenarios describe how the options on the "Import scenario"
screen affect the process of restoring server configuration settings from the
BIAR file.
Scenario 1
This scenario describes what the Import Wizard does when, on the Import
scenario screen, you select Use the object's unique identifier to determine
whether it already exists in the destination system, and then select one
of the following options.
• Update the destination object. In case of name conflict, rename it,
or
• Update the destination object. In case of name conflict, do not import
it.
The deployment's initial configuration settings are described in the following
table.
ValueProperty
Unique
Identifier
Server Name

ValueProperty
Unique
Identifier
Server Name
When you import the servers from the BIAR file, the Import Wizard finds
servers in the BIAR file and on the deployment with matching unique
identifiers. The Import Wizard overwrites the values on the deployment with
the values from the BIAR file. In other words, the deployment's original
settings are restored.
The server configuration settings on the deployment after this workflow are
described in the following table.
Table 3-11: New Server Configuration Settings on the Deployment
ValueProperty
Unique
Identifier
Server Name
Scenario 2
This example explains what happens when, on the Import scenario screen,
you select the Use the object's unique identifier to determine whether
it already exists in the destination system. and Do not import the object
options.
table.

ValueProperty
Unique
Identifier
Server Name
When you match by unique identifier and choose the Do not import the
object option, the Import Wizard finds servers with the matching unique
identifiers, and does not import the server configuration settings. The servers
on the deployment are not updated.
Scenario 3
The following examples show what happens when you modify the server
configuration settings on the deployment, and then try to restore the settings
from the BIAR file that you imported the settings to. Suppose that you make
the following three changes on the deployment.
• Rename the mynode.cms server to mynode.primarycms.
• Add a new server, called mynode.cms, with the Request Port property
set to 6404.
When a new server is added, it is automatically assigned a new unique
identifier.
• Delete the event server.
The following table describes the server settings on the destination
deployment after these modifications.

Table 3-13: Server Configuration Settings on the Destination Deployment
ValueProperty
Unique
Identifier
Server Name
6402Request Port1mynode.primarycms
When you restore the server configuration settings from the BIAR file, the
particular settings that are imported to the deployment depends on the options
that you select on the "Import scenarios" screen.
Scenario 3.1
Suppose that you use the Import Wizard to restore the server configuration
settings from the BIAR file, and that on the Import scenarios screen, you
select Use the object's unique identifier to determine whether it already
exists in the destination system and Update the destination object, in
case of name conflict, rename it.
Use this option when you want to restore all servers from a BIAR file to a
deployment.
table.
ValueProperty
Unique
Identifier
Server Name

When you match by unique identifier and choose the Update the destination
object, in case of name conflict, rename it option, the Import Wizard finds
that the unique identifier for mynode.cms from BIAR is 1, and that the unique
identifier of the mynode.primarycms server on the deployment is also 1.
However, when it detects that the deployment already has another server
with mynode.cms name, it renames the restored server.
Furthermore, because the mynode.cms server doesn't exist in the BIAR file,
that server is not updated during the import process.
This results in the deployment described in the following table.
Table 3-15: Server Configuration Settings on the Deployment
ResultValueProperty
Unique
Identifier
Server Name
This server is
restored with
a new name.
6401Request Port1mynode.cms(2)
This server is
restored.
2
Maximum Idle
Time
2mynode.eventserver
This server is
not updated,
because it
does not exist
in the BIAR
file.
Scenario 3.2
exists in the destination system and Update the destination object, in
case of name conflict, do not import it.

Use this option when you want to restore all server objects from a BIAR file
to a deployment, except servers with different unique identifiers but with the
same name.
table.
ValueProperty
Unique
Identifier
Server Name
When you match by unique identifier and choose the Update the destination
object, in case of name conflict, do not import it option, the Import Wizard
does not import the server settings from the BIAR file for mynode.cms, even
though the unique identifiers of mynode.cms (in the BIAR file) and
mynode.primarycms (on the deployment) are the same. This is because the
Import Wizard detects a server on the destination with the same name, and
does not import the server.
The results in the deployment are described in the following table.
ResultValueProperty
Unique
Identifier
Server Name
This server is
not updated.
This server is
restored.
2
Maximum Idle
Time
2mynode.eventserver

ResultValueProperty
Unique
Identifier
Server Name
This server is
not updated,
because it
does not exist
in the BIAR
file.
Scenario 3.3
exists in the destination system and Do not import the object on the
"Import scenario" screen.
Use this option when you do not want the servers on a deployment to be
overwritten by servers from a BIAR file. This option only restores servers
that do not exist on the deployment, but that are in the BIAR file.
table.
ValueProperty
Unique
Identifier
Server Name

When you match by unique identifier and choose the Do not import the
object option, the Import Wizard does not import the server settings from
the BIAR file for mynode.cms, even though the unique identifiers of
mynode.cms (on the BIAR file) and mynode.primarycms (on the destination
environment) match. This is because you've selected to not import objects
where the source and destination environments have the same unique
identifier.
The results in the deployment are described in the following table.
ResultValueProperty
Unique
Identifier
Server Name
This server is
not updated,
because
you've cho-
sen not to
overwrite ex-
isting servers
on the deploy-
ment.
This server is
restored.
2
Maximum Idle
Time
2mynode.eventserver
This server is
not updated,
because it
does not exist
in the BIAR
file.

To import nodes from one cluster to another
There are a number of situations that may require you to re-point existing
nodes to different clusters. For example, if you want to add a node to a
Production deployment, and want to make the change as smooth as possible,
you may want to create the node on a Test deployment, and then re-point it
to the Production deployment. Direct migration of nodes between deployments
is not supported in BusinessObjects Enterprise XI 3.x, in favor of a more
secure method involving import and export of server configuration settings.
In BusinessObjects Enterprise XI 3.x, server configuration information is
stored in the CMS database, so instead of moving the node between
deployments, you import the server configuration settings from one
deployment to the other. You need to first import the node's configuration
information to the destination node. You can then re-point the node (Server
Intelligence Agent) to the destination cluster.
Note:
If you are importing nodes from one cluster to another, the Import Wizard
does not import configuration templates from BIAR files.
To re-point a node on a Test deployment so that the node joins the cluster
on the Production deployment:
1. On the Test deployment, start the Import Wizard and export the server
configuration settings to a BIAR file. For information on importing nodes
to a BIAR file, see To back up server configuration settings to a BIAR file.
2. On the Test deployment, stop the Server Intelligence Agent .
3. On the Production deployment , use the Import Wizard to import the node
from the BIAR file.
a. Start the Import Wizard.
b. Select the BIAR file that contains the node as the source environment.
c. On the "Select objects to import" screen, select Import node(s) from
a different cluster , and click Next.
d. On the "Import scenario" screen, select what you want the Import
Wizard to do if it finds any objects on the destination environment with
the same unique identifier.
e. On the "Incremental import" screen, select whether you want the Import
Wizard to overwrite any objects or object rights that already exist on
the destination environment.

f. On the "Nodes" screen, select the node that you want to import, and
click Next.
g. On the "Ready to Import" screen, click Finish.
h. On the "Import Progress" screen, click Done.
4. If you are not re-pointing all of the nodes that are on the Test deployment,
then reconfigure the Test deployment's node that you are re-pointing:
• If you are re-pointing a node on a Windows deployment, follow these
steps.
a. On the Test deployment, start the CCM.
b. Right-click the node that you imported to the Production environment,
and select Properties > Startup.
A list of local and remote CMS Servers is displayed.
c. Click Remove, to remove the link to the CMSs that you are not
re-pointing.
d. Click OK.
• If you are re-pointing a node on a UNIX deployment, run the server
config.sh script to remove the link to the CMSs that you are not
re-pointing.
5. If the node that you've imported contains a CMS:
• On Windows, perform the following steps.
a. On the Test deployment, start the CCM.
b. Right-click the Server Intelligence Agent for the node that you are
re-pointing, and select Properties > Configuration.
c. Click Select a Data Source.
d. Type the DSN for the Production database, and click OK.
• On Unix, run the cmsdbsetup.sh script to change the node's data
source to the Production database.
6. On the Test deployment, start the re-pointed Server Intelligence Agent.
Related Topics
• To back up server configuration settings to a BIAR file on page 218

Federation
Federation is an important cross-site replication tool for working with multiple
BusinessObjects Enterprise deployments in a global environment.
Content can be created and managed from one BusinessObjects Enterprise
deployment and replicated to other BusinessObjects Enterprise deployments
across geographical sites on a recurring schedule. You can complete both
one-way replication and two-way replication jobs.
The benefits of Federation include the ability to:
• Reduce network traffic
• Create and manage content from a single site
• Increase performance for end users
When you replicate content using Federation, you can:
• Simplify administration needs for multiple deployments
• Provide a consistent rights policy across multiple offices for global
organizations
• Obtain information faster and process reports at remote sites where data
resides
• Save time by retrieving local and dispersed data faster
• Synchronize content from multiple deployments without writing custom
code
Federation is a flexible feature that allows you to have separate security
models, life cycles, testing, and deployment times, as well as different
business owners and administrators. For example, you can delegate
administration features that restrict the sales application administrator from
changing a human resources application.
You can replicate a variety of objects with Federation, as described in the
following table.
Working with Federation
4 Federation

Additional notesObject types you can replicateCategory
All objects are supported,
although not at the individ-
ual level.
Business View Manager, DataCon-
nection, LOVs, Data Foundation,
etc.
Business
Views
Full client add-in and tem-
plates are supported.
Crystal reports, Web Intelligence,
Full Client and Xcelsius
Reports
Excel, PDF, Powerpoint, Flash,
Word, text, rich text and Shockwave
Flash files
Third-Party
Objects
users, groups, Inboxes, Favorites
and Personal Category
Users
Folders, Events, Categories, Calen-
dars, Custom Roles, Hyperlinks,
Shortcuts, Programs, Profiles, MyIn-
foView, Object Packages, Agnostic
Business In-
telligence
Platform
Universe, Connections and Uni-
verse Overload
Universe
The following scenarios highlight two examples of how your organization
can use Federation.
Scenario 1: Retail (centralized design)
ACME store wants to send a monthly sales report to the different store
locations using the one-way replication method. The administrator at the
Origin site creates a report, which administrators at each Destination site
replicate and run against that store's database.
Tip:
Localized instances can be sent back to the Origin site that maintain each
object's replicated info. For example, it will apply the appropriate logo,
database connection information and so on.
Scenario 2: Remote Schedule (distributed access)
The data is at the Origin site. Pending Replication Jobs are sent to the Origin
site to run. Completed Replication Jobs are then sent back to the Destination
sites for viewing. For example, the data for a report may not be available on
the Destination site, but the user can set the reports to run on the Origin site
before the completed report is sent back to the Destination site.
4Working with Federation
Federation

Federation terms
Federation, a new feature in the BusinessObjects Enterprise, is an important
cross-site replication tool for working with BusinessObjects Enterprise objects
in a global environment. The following list of terms introduces words and
phrases that relate to Federation and may assist with its navigation and use.
BI application
The logical grouping of related Business Intelligence (BI) content with a
specific purpose and audience. A BI application is not an object. One
BusinessObjects Enterprise deployment can host multiple BI applications,
each of which can have a separate security model, life cycle, testing and
deployment timeline, as well as separate business owners and administrators.
Destination site
A BusinessObjects Enterprise system that pulls replicated BusinessObjects
Enterprise content from an Origin site.
Local
The local system where a user or administrator is connected. For example,
the administrator of a Destination site is considered “local” to the Destination
site.
Locally run completed instances
Instances that are processed on the Destination site and then sent back to
the Origin site.
4 Federation terms

Multiple Origin sites
More than one site can serve as an Origin site. For example, multiple
development centers generally have multiple Origin sites. However, there
can only be one Origin site per replication.
One-way replication
Objects are only replicated in one direction, from the Origin site to the
Destination site. Any updates made at a Destination site remain at that
Destination site.
Origin site
The BusinessObjects Enterprise system where the content originates.
Remote
A system that is not local to a user. For example, the Origin site is considered
“remote” to users and administrators of the Destination site.
Remote Connection
An object that contains information used to connect to a BusinessObjects
Enterprise deployment, including username and password, CMS name,
WebService URI and clean-up options.
Remote Scheduling
Schedule requests that are sent from the Destination site to the Origin site.
Reports on Destination sites can be scheduled remotely, which sends the
Federation terms

report instance back to the Origin site for processing. Then the completed
instance is returned to the Destination site.
Replication
The process of copying content from one BusinessObjects Enterprise system
to another.
Replication Job
An object that contains information about replication scheduling, which content
to replicate, and any special conditions that should be performed when
replicating content.
Replication List
A list of the objects to be replicated. A Replication List refers to other content
such as users, groups, reports, and so on, in the BusinessObjects Enterprise
deployment to be replicated together.
Replication Object
An object that is replicated from an Origin site to a Destination site. All
replicated objects on a Destination site will be flagged with a replication icon,
as shown here: If there is a conflict, objects will be flagged with a conflict
icon, as shown here:
Replication package
Created during the transfer, the replication package contains objects from a
Replication Job. It can contain all the objects defined in the Replication List,
as in the case of a rapidly changing environment or initial Replication. Or it
can contain a subset of the Replication List if the objects change infrequently
4 Federation terms

compared to the schedule of the Replication Job. The replication package
is implemented as a BI Application Resource (BIAR) file.
Replication refresh
All objects in a Replication List are refreshed regardless of the last modified
version.
Two-way replication
Acts the same as one-way replication, but two-way replication also sends
changes in both directions. Updates to the Origin site are replicated to each
Destination site. Updates and new objects on a Destination site are sent to
the Origin site.
Managing Replication Lists
A Replication List refers to other content such as users, groups, reports, and
so on in the BusinessObjects Enterprise deployment to be replicated together.
Replication Lists can be accessed from the CMC.
Content that can be replicated are listed in the following table.

Supported objectsCategory
Objects that include Business Views, DataConnection,
LOVs, Data Foundation, and more.
Note:
All objects are supported, although not at the individual
level.
Repository objects
Crystal Reports, Web Intelligence and Full Client, and
Xcelsius.
Note:
Full Client Addin and Templates are supported.
Reports
Excel, PDFs, Powerpoint, Flash, Word, text files, rich text
files, Shockwave Flash files
Third-party objects
Users, groups, Inboxes, Favorites, personal CategoryUsers
Folders, events, categories, calendars, custom roles, hy-
perlinks, shortcuts, programs, profiles, MyInfoView, object
packages, agnostic
Business Intelli-
gence Platform
Universes, connections, universe overloadUniverses
Note:
To ensure changes are made on both sites to the following objects, create
Business Views, Business Elements, Data Foundations, Data Connections,
List of Values, and Universe Overloads on the Origin site and then replicate
them to the Destination site. However, if you create these objects on the
Destination site and then replicate them to the Origin site, they will not function
on the Origin site.
Creating Replication Lists
Replication Lists are located in a separate folder than Federation in the CMC.
To organize a Replication List, you may create folders and subfolders within
the Replication List folder.
To create a Replication List folder
1. Go to the Replication Lists area of the CMC.
4 Managing Replication Lists

2. Click Replication Lists.
3. Click Manage.
4. Click New, and then click Folder.
A Create Folder dialog box opens.
5. Enter a folder name and select OK.
You can now create a Replication Lists object by selecting the folder you
want it listed in.
To create a Replication List
2. Click desired Replication Lists folder where you would like to save your
new Replication List .
3. Click Manage.
4. Click New, and then click Create New Replication List.
The New Replication List dialog box opens.
5. Enter the Title and Description of the Replication List.
For advanced options, expand the Replication List Properties link.
Note:
This allows you to specify which dependencies to automatically bring
over. The default is all. If you deselect these options, you must manually
select an object's dependent objects so they will work correctly on the
Destination site.
6. Select the desired options as described in the table.
• Replicate all object dependencies
Note:
• This is the default option. Dependencies include the following
objects and their related dependencies: relationships:
DataConnection, Universe: Web Intelligence Universe, User Group:
User, Universe: Universe, CustomRole: Object, Profile: Prinicipal,
and User: Favorites folder.
• This option only brings dependencies supported by Federation.
• Include personal folders for selected users
• Include personal categories for selected users

• Include universes for selected reports
• Include members of selected user groups
• Include universes required by selected universes
• Include inboxes for selected users
• Include user groups for selected universes
• Include access levels set on selected objects
• Include documents for selected categories
• Include supported dependencies for selected Flash objects
• Include profiles for selected users and user groups
• Include connections used by selected universes
Note:
Objects in BusinessObjects Enterprise may be dependent on other objects.
For example: a Web Intelligence document is dependent on the underlying
universe for its structure, content, and so on. These dependencies are
replicated automatically when an object is replicated to another
BusinessObjects Enterprise system.
7. Select Next.
A New Replication List dialog box opens.
8. Select the desired objects to add to your Replication List, which must
contain at least one object.
• Add or remove options using the arrow buttons
• Or click Replicate all:Repository Objects to replicate all Business
View, Business Elements, Data Foundation, Data Connection, List of
Values, and repository objects, including report images and functions

DefinitionDependency object op-
tions
Replicates any universe that selected report ob-
jects depend on.
Note:
If you replicate a universe from the Origin site to
the Destination site, it will not remove any rela-
tionships it sent to “Destination only reports”.
Therefore, you may want to create “Destination
only reports” from replicated universes.
universe for selected re-
ports
Brings the user groups that selected users are
members of.
Note:
If you replicate a user group from the Origin site
to the Destination site, it will not remove its
memberships to “Destination only users”.
Therefore, you may want to add “Destination
only users” to a replicated group.
user groups that contain
selected users
Replicates any universe that depend on other
universes.
universes required by se-
lected universes
Replicates any profiles associated with selected
users or groups.
profiles for selected users
and user groups
Replicates any access levels used on any of the
selected objects.
access levels set on se-
lected objects
Replicates any universe connection objects used
by selected objects.
Note:
If you replicate a universe connection from the
Origin site to the Destination site, it will not re-
move any relationships it replicated to “Destina-
tion only universes”. Therefore, you may want
to create “Destination only universes” that use
replicated universe connections.
connections used by se-
lected universes
Replicates any Crystal reports, hyperlinks, Web
Intelligence reports or universes that the Flash
object depends on.
supported dependencies
for selected Flash objects

DefinitionDependency object op-
tions
Replicates any documents, including Word, Ex-
cel, PDF, and so on that are included in selected
categories.
Note:
If you replicate a category from the Origin site to
the Destination site, it will not remove any rela-
tionships it may have replicated to “Destination
only documents”. Therefore, you may want to
add “Destination only documents” to replicated
categories.
documents for selected
categories
Replicates a selected user's Inbox and its con-
tent.
inboxes for selected users
Replicates a selected user's personal folders
and their content.
personal folders for select-
ed users
Replicates users within a selected group.members of selected user
groups
Replicates a selected user's personal categories.personal categories for
selected users
Replicates the user groups associated with a
universe's overloads.
user groups for selected
universes
Note:
It is not possible to replicate top level folders, which are located under
the “Available Objects” folder.
For example, if you replicate a Web Intelligence report but do not select
the universe it uses, replication will not work on the Destination site unless
the universe was already replicated there. However, enable “Include
Universes” for selected reports, and Federation brings the universe(s)
that the report depends on.
Note:
If you add a Web Intelligence report to the Replication List and enable
the universe dependency and the universe connection dependency, both
the universe and report rely on the universe connection and are brought
over by Federation.

Modifying Replication Lists
Once you create a Replication List, you can modify its properties or objects.
To modify properties in a Replication List
2. Select a Replication List.
3. On the Manage menu, click Properties.
The Properties dialog box opens.
4. Modify the title and description fields as desired.
Tip:
You can also modify the other areas of a selected Replication List while
the Properties dialog box is open.
5. Click Replication List Properties to modify dependency options.
Note:
Some objects may be dependent on other objects and may not function
correctly when replicated unless those other objects exist on the
Destination site as well. If you check any of the supported dependency
options, Federation replicates these objects even if they are not added
to the Replication List. For more information, see Creating Replication
Lists on page 240.
To modify objects in a Replication List
2. Select a Replication List to modify its objects.
3. On the Actions menu, click Manage Replication List.
The Manage Replication List dialog box opens with a list of currently
added objects.
4. Add or remove objects as desired.

Tip:
You can also modify the other areas of a selected Replication List while
the Manage Replication List dialog box is open.
Managing Remote Connections
Remote Connection objects contain the information needed to connect to a
remote BusinessObjects Enterprise deployment.
Note:
The Remote Connection is always treated as the Origin site. The
BusinessObjects Enterprise deployment where you create the Remote
Connection object is always treated as the Destination site.
To view a Remote Connection
• Go to the Federation area of the CMC.
• Click Remote Connections to view a list of remote connection objects
grouped by folder
• Or click All Remote Connections to view a flat list of all Remote
Connection objects
Creating Remote Connections
A Remote Connection in Federation will connect to a remote BusinessObjects
Enterprise deployment. To establish a connection to the Origin site where
the content to be replicated is located, you must first create a Remote
Connection on the Destination site.
To organize your Remote Connections, you may create folders and
subfolders.
To create a Remote Connection folder
1. Go to the Federation area of the CMC.
2. Click Remote Connections.
3. Click Manage.
4. Click New, and then click Folder.
4 Managing Remote Connections

A Create Folder dialog box opens.
5. Enter a folder name and click OK.
You can now create a Remote Connection by selecting the folder you
want it listed in.
To create a new Remote Connection
To connect to a remote BusinessObjects Enterprise deployment, you must
create a Remote Connection in Federation.
2. Click Remote Connections folder.
3. Click Manage.
4. Click New, and then click New Remote Connection.
The New Remote Connection dialog box opens.
5. Enter a title, description and related fields as required:
Note:
All fields are mandatory, except for “Description” and “Limit the number
of cleanup objects”.
DescriptionField
Name of the Remote Connection object.Title
Description of the Remote Connection object.
(Optional)
Description
URL to Federation Web Services, which is au
tomatically deployed on your Java application
server. You can use any Federation Web Ser
vices in BusinessObjects Enterprise whether
they are the Origin or Destination site, or anoth
er deployment. Use this format: http://applica
tion_yourserver_ma
chine_name:port/dswsbobje Example:
http://mymachine.mydomain.com:8080/dsws
bobje
Remote System Web Ser-
vice URI
Managing Remote Connections

DescriptionField
The name of the CMS you want to connect to
that is accessible through Federation Web
Services. This will be treated as the CMS for
the Origin site. This is the format:
CMS_Name:port (port optional if it is 6400)
Example: mymachine:6400
Remote System CMS
The user name that will be used to connect to
the Origin site.
Note:
Ensure the account you are using has viewing
rights of the Replication List on the Origin site.
User Name
The password of the user account to connect
to the Origin site.
Password
The type of account authentication to connect
to the Origin site. Options are: Enterprise, NT,
AD or LDAP.
Authentication
How often Replication Jobs that use this Re-
mote Connection object should perform an ob-
ject cleanup. Enter only positive whole num-
bers. The unit is hours. Default = 24. For more
information, see Managing Object Cleanup on
page 263.
Cleanup Frequency (in
hours)
The number of objects a Replication Job cleans
up. For more information, see Managing Object
Cleanup on page 263. (Optional)
Limit the number of
cleanup objects to
6. Click OK.
Modifying Remote Connections
Once you create a Remote Connection in Federation you can modify its
properties and security options.
4 Managing Remote Connections

To modify a Remote Connection:
2. Click Remote Connections.
3. Select the Remote Connection folder and then select the Remote
Connection object you want to modify.
4. On the Manage menu, click Properties.
The Remote Connections Properties dialog box opens. You can modify
a variety of properties, including the:
• Title
• Description
• Remote System Web Service URI
• Remote System CMS
• User Name
• Password
• Cleanup Frequency (in hours)
• Limit the number of cleanup objects to:
• Authentication
5. Select your changes.
Managing Replication Jobs
A Replication Job is a type of object that runs on a schedule and is used to
replicate content between two BusinessObjects Enterprise deployments in
Federation. Each Replication Job must have one Remote Connection, and
one Replication List associated with it.
To view a list of your Replication Jobs:
2. Select the Remote Connection folder to view a list of Remote
Connections.
• Select a Remote Connection object to view a list of Replication Jobs
• Or click All Replication Jobs to view a list of all Replication Jobs

Creating a Replication Job
A Replication Job is an object that is used to replicate content between two
BusinessObjects Enterprise deployments in Federation, which runs on a
schedule. Each Replication Job must have only one Remote Connection,
and one Replication List associated with it.
Note:
Replicated objects on a Destination site will be flagged with a replication icon
as shown here: If there is a conflict, an object will be flagged with a
conflict icon as shown here:
To create a Replication Job
3. Select a Remote Connection to contain the new Replication Job.
Caution:
The CMC must be able to connect to Web Services in the Remote
Connection URI to proceed further using the wizard.
4. Click Manage.
5. Click New, and then click New Replication Job.
A New Replication Job dialog box appears.
6. Enter the Title and Description of the Replication Job.
7. Select Next.
A list of available Replication Lists on the Origin site appears.
8. Select the desired Replication List to use with your Replication Job.
9. Click Next.
10. Select configuration options as described in table.
4 Managing Replication Jobs

DescriptionOption
Forces the Replication Job to delete any
replicated objects on the Destination site,
where the originating object on the Origin
site was removed. For more information,
see Managing Object Cleanup on
page 263.
Note:
Object Cleanup will not delete objects
replicated using dependencies or objects
selected on the Replication List.
1) Enable object clean-up on des-
tination
Specifies that an object only replicates
from the Origin site to the Destination
site. Any changes made after replication
to the object on the Origin site are repli-
cated to the Destination site, but
changes made on the Destination site
are not replicated back to the Origin site.
2a) One-way replication
Specifies that objects are replicated in
both directions; from the Origin site to
the Destination site, and from the Desti-
nation site to the Origin site. Changes
made to these objects after replication
at one site are then automatically repli-
cated to the other site.
2b) Two-way replication
Specifies that when a conflict is detected
between an object on the Origin site and
its replicated version on the Destination
site, the version on the Origin site takes
priority.
3a) Origin site wins
Specifies that no action is taken to re-
solve any detected conflicts. For more
information, see Managing conflict detec-
tion and resolution on page 269.
3b) No automatic conflict resolu-
tion

DescriptionOption
Specifies that when a conflict is detected
between an object on the Origin site and
its replicated version on the Destination
site, that the version on the Destination
site takes priority.
3c) Destination site wins (only
available with two-way replication)
Specifies that the Replication Job acts
normally.
4a) Normal replication
Replicates all content from the Origin
site to the Destination site whether it has
changed or not. You can replicate the
entire Replication list or only a portion of
it.
4b) Refresh from origin
Replicates all content from the Destina-
tion site to the Origin site whether it has
changed or not. You can replicate the
entire Replication list or only a portion of
it.
4c) Refresh from destination (only
available with two-way replication)
Replicates the entire Replication List.
Note:
This is the most complete option but
takes the longest to perform.
5a) Replicate all objects (only vis-
ible with two-way replication)

DescriptionOption
Replicates pending remote instances
from the Destination site to the Origin
site, and forces completed instances
from the Origin site to the Destination
site. For more information, see Remote
scheduling and locally run instances on
page 278.
5b) Replicate remote schedules
(only visible with two-way replica-
tion)
Replicates all objects that aren't in-
stances [locally run or reports that are
checked for remote scheduling]. This
includes users, groups, folders, reports,
and so on.
5c) Replicate document templates
Replicates completed instances only
from the Destination site to the Origin
site. For more information, see Remote
scheduling and locally run instances on
page 278.
5d) Replicate locally run complet-
ed instances
11. Click OK.
Scheduling a Replication Job
Once you create a Replication Job, you may schedule it to run once or on a
recurring basis. You may also schedule multiple Replication Jobs on one
Destination site from one Origin site.
Note:
If you schedule multiple Replication Jobs on one Destination site, only one
Replication Job can connect to the Origin site at a time. All other Replication
Jobs that try to connect will be moved to a pending state and remain pending
until they are able to automatically connect to the Origin site.
To schedule a Replication Job:
2. Select the Replication Job you want to schedule.
3. Click Actions.
4. Click Schedules.

5. Select the desired scheduling options.
Modifying a Replication Job
Once you create a Replication Job in Federation, you can modify its
properties, scheduling, instances, user rights, and the Replication List it uses.
To modify a Replication Job
3. Select the Remote Connection object that contains the Replication Job
you want to modify.
4. Select the Replication Job you want to modify.
5. On the Manage menu, click Manage object properties.
6. View and edit the Properties, Schedule, History, Replication List, and
User Security, as desired.
DescriptionSections
Modify the name, description and other general properties
and options of the Replication Job.
Properties
Set the Replication Job to run on a recurring schedule.Schedule
View and administer all instances of the Replication Job.History
Change the selected Replication List.Replication List
Set rights on the Replication Job.User Security
Viewing a log after a Replication Job
Every time you run a Replication Job, Federation automatically produces a
log file, which is created on the Destination site. The log files use XML 1.1
standards and require a web browser that supports XML 1.1.
To view a Replication Log:

1. Click the Federation area of the CMC.
2. Click All Replication Jobs folder.
3. Select the desired Replication Job from list.
4. Click Properties.
The Replication Job Properties page opens.
5. Click History.
6. Click the Instance time of the log file to view successful Replication Jobs,
or click Failed status to view a log file of failed Replication Jobs.
7. Select desired instance to view the log file.
The log file is outputted in XML format and uses an XSL form to format
the information into an HTML page for viewing.
You can access the XML log from the computer that is running the Server
Intelligence Agent that contains the Adaptive Job Server. You can find
the log file at:
• Windows:<InstallDir>BusinessObjects Enterprise
12.0Logging
• Unix:<InstallDir> /bobje/logging
Example: Accessing a log file
If you are a Windows user and installed BusinessObjects Enterprise to the
default location, go to: C:Program FilesBusiness
ObjectsBusinessObjects Enterprise 12.0Logging
If you want to access the XSL file directly, go to:
• Windows:<InstallDir> common4.0javalib
• Unix:<InstallDir>/bobje/java/lib
If you are a Windows user and installed BusinessObjects Enterprise to
the default location, go to: C:Program FilesBusiness
Objectscommon4.0javalib
The name of the XSL file is: replicationLog.xsl
The log file is displayed in the language of the user's Product Local that
the Replication Job is running under.

Note:
If the language is not installed on the Origin site, its entries default to
English. This may result in a log file that contains entries in two languages.
Managing security rights
Security is important when working in any BusinessObjects Enterprise
deployment. However, because Federation replicates content between
separate deployments and requires collaboration with other administrators,
it is necessary to understand how security performs before you begin using
Federation.
Administrators in separate deployments must coordinate with each other
before enabling Federation. Once content is replicated, administrators can
change, modify, and administer content. For these security reasons, it is
important that you maintain communication with other administrators.
The following chapter discusses the following features to accomplish certain
tasks:
• Rights required on the Origin site
• Rights required on the Destination site
• Rights required on Federation specific objects
• Scenarios that occur in Federation
Tip:
It is recommended that you read this chapter prior to starting Federation.
Rights required on the Origin site
This section describes the actions to the Origin site and the required rights
of the user account connecting to the Origin Central Management Server
(CMS). This is the account you enter in the Remote Connection object on
the Destination site.
Note:
This section only describes the required rights on the Origin Site. For
Destination site rights, refer to the following section.
4 Managing security rights

One-way replication
Action: To perform replication only from the Origin site to the Destination
site. Minimum rights required:
• “View” and “Replicate” rights on all objects to replicate
• “View” right on the Replication List
Note:
“View” and “Replicate” rights are required on all objects being replicated,
including objects that are automatically replicated by dependency calculations.
Two-way replication
Action: To perform replication from the Origin site to the Destination site, and
from the Destination site to the Origin site. Minimum rights required:
• “View” and “Replicate” rights on all objects to replicate
• “View” right on the Replication List
• “Modify Rights” on user objects to replicate any password changes
Scheduling
Action: To allow remote scheduling to occur on the Origin site from the
Destination site. Minimum rights required:
• “Schedule right for all objects that will be remotely scheduled”
Rights required on the Destination site
This section describes actions to the Destination site and the required rights
of the user account that is running the Replication Job. This is the account
of the user who created the Replication Job.
Note:
Like other schedulable objects, you can schedule the Replication Job on
behalf of someone else.
All Objects
Action: To replicate objects regardless of one-way or two-way replication.
Minimum rights required:
• “View”, “Add”,“ Edit”, “Modify Rights” on all objects

• “Modify User Password” rights in addition to above, for user objects.
First Replication
Action: The first time the Replication Job is run. This scenario is different
than the following scenarios as no objects exist on the Destination site yet.
Therefore, the user account the Replication Job is running under must have
specific rights at all the top level folders and default objects that will have
content added to them. Minimum rights required:
• “View”, “Add”,“ Edit”, “Modify Rights” on all top level folders.
Federation specific objects
This section details scenarios that are specific to Federation that you may
encounter.
Object Cleanup
Object Cleanup only occurs on the Destination site.
Action: To delete objects on the Destination site. Minimum rights required:
• “Delete” rights for the account that the Replication Job is running under
on all objects that may be potentially deleted
Enabling two-way replication, with no modifications on the Origin site
In certain circumstances you may choose two-way replication but do not
want some objects on the Origin site modified, even if they are changed on
the Destination site. Reasons for this include: if the object is special and
should only be changed by users on the Origin site; or if you want to enable
Remote Scheduling but do not want changes propagated back.
To safeguard against undesired changes being sent to the Origin site:
• Deny “Edit” rights of the user account used to connect in the Remote
Connection Object
Note:
For Remote Scheduling, you may create a job that only handles objects for
Remote Scheduling. However, in this case ancestor objects are still replicated,
including the report, the folder containing the report, and the parent folder
4 Managing security rights

of that folder. Any changes made on the Destination site are sent back to
the Origin site, and changes made on the Origin site are sent to the
Destination site.
Disabling cleanup for certain objects
When certain objects are replicated from the Origin site, you may not want
to delete them from the Destination site if they are deleted on the Origin site.
You can safeguard this through rights. For instance, choose this option when
users on the Destination site start are using an object independently of users
on the Origin site.
Example: In a replicated universe where users on the Destination site create
their own local reports using this universe, you may not want to lose the
universe on the Destination site if it is deleted from the Origin site.
To disable clean up on certain objects:
• Deny “Delete” rights of the user account the Replication Job is running
under on the objects you wish to keep.
Replicating security on an object
To keep security rights for an object, you must replicate both the object and
its user or group at the same time. If not, they must already exist on the site
you are replicating to and have identical unique identifiers (CUIDs) on each
site.
If an object is replicated and the user or group is not replicated, or does not
already exist on the site you are replicating to, their rights will be dropped.
Example:
Group A and Group B have rights assigned on Object A. Group A has
“View” rights and Group B has “Deny View” rights. If the Replication Job
replicates only Group A and Object A, then on the Destination site, Object
A will only have the “View” rights for Group A associated with it.
Note:
When you replicate an object, there is a potential security risk if you do not
replicate all groups with explicit rights on the object. The previous example
highlights a potential risk. If User A belongs to both Group A and Group B,

the user will not have permission to view Object A on the Origin site. However,
User A will be replicated to the Destination site because he belongs to both
groups. Once there, because Group B was not replicated, User A will have
the right to view Object A on the Destination site, but can't view Object A on
the Origin site.
Objects that reference other objects that are not included in a Replication
Job, or those not already on the Destination site, are displayed in its log file,
which shows the object referenced the unreplicated object and dropped its
reference.
Security on an object for a particular user or group is only replicated from
the Origin site to the Destination site. You may set security on replicated
objects on the Destination site, but those settings will not be replicated to
the Origin site.
Replicating security on an object using access levels
Similar to the previous section, rights must be defined by access levels to
remain. The object, user or group, and access level must be replicated at
the same time, or they must already exist on the site you are replicating to.
Objects that assign explicit rights to a user or group that are not included in
the Replication Job, or not already on the Destination site, are displayed in
its log file, which shows the object had rights assigned that were not replicated
and those rights were dropped.
In addition, you can choose to automatically replicate “Access Levels” that
are used on a imported object. This option is available on the Replication
List.
Note:
Default access levels are not replicated, but references will be maintained.
Replicating third-party users and groups
In Federation you can replicate third-party users and groups, specifically NT,
Active Directory (AD) and LDAP users and groups.
4 Replicating third-party users and groups

Tip:
Read this section if you plan to replicate these types of users and groups or
their personal content, such as favorite folders or Inboxes.
Mapping users and groups
First: map the users and groups on the Origin site for Federation to replicate
them properly. Second: replicate the mapped users and groups to the
Destination site.
Note:
Do not map groups and users separately on the Destination site. If you do,
they will have different unique identifiers (CUIDs) on the Destination and
Origin sites, and Federation will not be able to match the user or groups.
Example:
The administrator maps Group A with User A on the Origin and Destination
sites. Both Group A and User A have different unique identifiers on the
Origin and Destination sites. During replication, Federation cannot match
them and Group A or User A are not replicated due to an alias conflict.
Note:
• The destination site should be set up to use NT, AD or LDAP
authentication before you attempt to replicate third-party users and groups.
• After replicating an AD or LDAP group for the first time, users in this group
are not be able to log on until the AD/LDAP Group Graph has been
refreshed. This occurs automatically approximately every 15 minutes. To
refresh AD/LDAP Group Graph manually, go to the "Authentication" page
of the CMC, double-click Windows AD or LDAP, and then click Update.
• Be careful when replicating third-party groups. When you add new users
to the group in the directory server, they will be able to log on to both
sites. This security issue of NT, AD or LDAP authentication is independent
of Federation.
If you log on to the Destination and Origin sites separately, or the group
membership is updated on both sites using the update button on the CMC
authentication page, a user account is created on both sites. It will have
different CUIDs and Federation won't be able to replicate them properly.
Note:
It is important to create the account on one site and then replicate it to
the other.
Replicating third-party users and groups

Replicating universes and universe
connections
When using Federation to replicate Universes between BusinessObjects
Enterprise deployments, it is important to take the time to plan what the
desired results should be. A Universe object will not function without an
underlying Universe Connection; a Universe object must have a relationship
to an existing, functioning Universe Connection in order to work properly.
Universe Connection objects contain information required to connect to a
reporting database. In order to function properly, the information they contain
needs to be valid and allow a database connection to be established.
To ensure that dependent Universe Connections are replicated with the
Universes, when you create or modify the replication list that contains the
Universes always choose the Include connections used by selected
universes and Include universes required by selected universes options.
The following two examples demonstrate the process of replicating Universes
and their related Universe Connections.
Note:
• If you are using Two-Way replication and replicate a Universe from the
Origin without its Universe Connection to the Destination, in subsequent
replications the Origin's Universe may have its relationship to the Universe
Connection on the Origin overwritten or removed. To avoid, always
replicate the Universe Connections with the Universes.
• If a Universe's relationship with its Universe Connection has been
overwritten or removed, open the Universe in Universe Designer, and
under File > Parameters, modify the connection information.
Example:
When replicating Universes and Universe Connections, you must ensure
that the connectivity environment on the Origin matches the connectivity
environment on the Destination.
For example, if the Universe Connection uses an ODBC connection called
“TestODBC”, then there needs to be an ODBC connection called
“TestODBC” on the Destination environment that works. The ODBC
connection can resolve to the same database or to a different database.
4 Replicating universes and universe connections

To ensure that Universes using this connection do not encounter connectivity
issues, the schema's of the databases must be the same.
Example:
If you want the replicated Universe on the Destination to use a different
database then what the Universe on the Origin uses, replicate the Universe
Connection, but have the Destination connectivity information on the
machine point to the desired database.
For example, if the Universe Connection on the Origin is using an ODBC
connection called “Test” pointing to “DatabaseA”, have an ODBC connection
on the Destination also called “Test” but pointing to “DatabaseB”.
Managing Object Cleanup
In Federation, you should perform Object Cleanup throughout the lifecycle
of your replication process, to make sure all objects that you delete from the
Origin site are also deleted from each Destination site.
Object Cleanup involves two elements: a Remote Connection and a
Replication Job. A Remote Connection object defines general cleanup
options, and a Replication Job performs the clean up when the appropriate
interval passes.
How to use Object Cleanup
Separate Replication Jobs that use the same Remote Connection work
together during Object Cleanup. This means that your Replication Job will
clean up objects within its Replication List, as well as objects within other
Replication Lists that use the same Remote Connection. A remote connection
is only considered the same if the parent of the Replication Job is the same
remote connection object.
Example:
Replication Jobs A and B replicate Object A and Object B. They both
replicate from the same Origin site and use the same Remote Connection.

If the Origin site deletes Object B , Replication Job A will see that Object
B was deleted. Even though Replication Job B is the one replicating it,
Object B will also be removed from the Destination site. When Replication
Job B executes it won't need to run an Object Cleanup.
Note:
Only objects on the Destination site are deleted during Object Cleanup. If
you remove an object from the Origin site that is part of a replication, the
object will be removed from the Destination site. However, if an object is
removed from the Destination site, it will not be removed from the Origin site
during Object Cleanup, even if the replication job is in two-way replication
mode.
Objects that are deleted or removed from the Replication List are not deleted
from Destination site. To properly remove an object that is specified explicitly
on a Replication List, you should delete it on both the Destination site and
the Origin site. Objects that are replicated via dependency calculations are
not deleted.
Object Cleanup limits
In the Remote Connection object, you can define the number of objects a
Replication Job will clean up at one time. Federation automatically tracks
where the clean up job ends. This way, the next time you run a Replication
Job, it starts the next clean up job at that point.
Tip:
To complete a Replication Job faster, limit the number of objects for cleanup.
Example:
Replication Jobs A and B are replicating Object A and Object B. Both objects
are replicated from the same Origin site and use the same Remote
Connection.
If the Origin site deletes Object B and the object limit is set to 1, the next
time Replication Job A runs, it will only check if Object A has been deleted.
This way, the Object B is not checked and will not be deleted.
4 Managing Object Cleanup

Next, Replication Job B runs and starts the object cleanup at the point
where Replication Job A ended. It will check if Object B has been deleted
and remove it from the Destination site. You can find this option on the
Remote Connection object's property “Limit the number of clean up objects
to:”
Note:
If you do not select this option, all Replication Jobs that use this Remote
Connection will check all objects for potential clean up.
Object Cleanup frequency
You can set the how often a Replication Job performs object cleanup in the
Remote Connection “Cleanup Frequency” field.
Note:
You must enter a positive whole number, which represents the number of
hours to wait between object cleanup processing.
Example:
Replication Jobs A and B replicate Object A and Object B. Both objects are
replicated from the same Origin site and use the same Remote Connection.
If Object B is deleted from the Origin site + the Object Limit is set to 1 + the
Cleanup Frequency is set to 150 hours + Replication Job A runs next, it
will check if Object A has been deleted. Because the Object limit is set to
1,Object B will not be checked or deleted.
The next cleanup occurs 150 hours after Replication Job A did the initial
check. Although Replication Jobs A and B may execute many times before
the 150 hour limit, neither will attempt to run an Object Cleanup. After 150
hours, the next Replication Job will execute and attempt cleanup. Then it
will determine that Object B was deleted, and then delete it.
Enabling and disabling options
Each Replication Job can participate in Object Cleanup. Use “Enable Object
Cleanup on destination” option on a Replication Job to instruct it whether to
run an Object Cleanup. In some cases, you may have high priority Replication

Jobs you do not want to participate in Object Cleanup, so you can execute
them as quickly as possible. To do this, disable Object Cleanup.
Replication types and mode options
Depending on your selection of Replication Type and Replication Mode, you
may create one of four different Replication Job options: one-way replication,
two-way replication, refresh from origin, or refresh from destination.
One-way replication
With one-way replication, you can only replicate content in one direction,
from the Origin site to a Destination site. Any changes you make to objects
on the Origin site in the Replication List are sent to the Destination site.
However, changes you make to objects on a Destination site are not sent
back to the Origin site.
One-way replication is ideal for deployments with one central BusinessObjects
Enterprise deployment where objects are created, modified and administered.
Other BusinessObjects Enterprise deployments use the content of the central
deployment.
To create one-way replication, select the following options:
• Replication Type = One-way replication
• Replication Mode = Normal replication
Two-way replication
With two-way replication, you can replicate content in both directions between
the Origin and Destination sites. Any changes made to objects on the Origin
site are sent to Destination sites, and changes made on a Destination site
are sent to the Origin site during replication.
Note:
To perform remote scheduling and to send locally run instances back to the
Origin site, you must select two-way replication mode.
If you have multiple BusinessObjects Enterprise deployments where content
is created, modified, administered and used at both locations, two-way
4 Replication types and mode options

replication is the most efficient option. It also helps synchronize the
deployments.
To create two-way replication, select the following options:
• Replication Type = Two-way replication
• Replication Mode = Normal replication
For more information, see Remote scheduling and locally run instances on
page 278.
Refresh from Origin or Refresh from Destination
When you replicate content in one-way or two-way replication modes, the
objects on the Replication list are replicated to a Destination site. However,
not all of the objects may replicate each time the Replication Job executes.
Federation has an optimization engine designed to help finish your replication
jobs faster. It uses a combination of the object's version and time stamp to
determine if the object was modified since the last replication. This check is
done on objects specifically selected in the Replication List and any objects
replicated during dependency checking.
However, in some cases the optimization engine may miss objects, which
won't be replicated. That's why “Refresh from origin” and “Refresh from
destination” force the Replication Job to replicate content, and their
dependencies, regardless of the timestamps.
"Refresh from origin" only sends content from the Origin to the Destination
sites. "Refresh from destination" only sends content from the Destination
sites to the Origin site.
Example:
The following three examples highlight scenarios using “Refresh from Origin”
and “Refresh from Destination” where certain objects will be missed due
to the optimization.
Scenario 1:The addition of the objects that contain other objects into an
area that is being replicated.
Folder A is replicated from the Origin site to the Destination site. It now
exists on both sites. A user moves or copies Folder B with Report B, into
Replication types and mode options

Folder A on the Origin site. During the next replication, Federation will see
that Folder B's timestamp has changed and will replicate it to the Destination
site. However, Report B's timestamp does not change. Therefore, it will be
missed by a regular one-way or two-way Replication Job.
To ensure Folder B's content is properly replicated, a Replication Job with
“Refresh from Origin” should be used once. After this, the regular one-way
or two-way Replication Job will replicate it properly. If this example is
reversed and Folder B is moved or copied on the Destination site, then use
“Refresh from Destination”.
Scenario 2: The addition of new objects using Import Wizard or the BIAR
command line.
When you add objects to an area that is being replicated using Import
Wizard or BIAR command line, the object may not be picked up by a regular
one-way or two-way Replication Job. This occurs because the internal
clocks on the source and destination systems may be out of sync when
using the Import Wizard or BIAR command line.
Note:
After importing new objects into an area that is being replicated on the Origin
site, it is recommended that you execute a “Refresh from Origin” Replication
Job. After importing new objects into an area that is being replicated on the
Destination site, it is recommended that you execute a “Refresh from
Destination” Replication Job.
Scenario 3: In between scheduled replication times.
If you add objects to an area that is being replicated and can't wait until the
next scheduled replication time, you can use “Refresh from Origin” and
“Refresh from Destination” Replication Jobs. By selecting the area where
objects have been added, you may replicate content quickly.
Note:
This scenario can be costly for large Replication lists, so it is recommended
that you do not use this option often. For example, it is not necessary to
create replication jobs to refresh from the Origin to Destination mode on an
hourly schedule. These modes should be used in “run now” or infrequent
schedules.
4 Replication types and mode options

Note:
In some cases, you cannot use conflict resolution, including: “Refresh from
origin”: destination site option wins is blocked, or “Refresh from destination”:
origin wins option is blocked.
Managing conflict detection and
resolution
In Federation, a conflict occurs when the properties of an object are changed
on both the Origin site and Destination site. Both top level and nested
properties of an object are checked for conflicts.
Example: Two types of object conflicts
1. If Frank modifies the report file on the Origin site, and Simon modifies
the replicated version on the Destination site.
2. If Abdul modifies the name of a report on the Origin site, and Maria
modifies the name of the replicated report on the Destination site.
Some instances do not create a conflict. For example, if Lily modifies the
name of a report on the Origin site, and Malik modifies the description of the
replicated version on the Destination site, the changes merge together.
One-way replication conflict resolution
In one-way replication, you have two choices for conflict resolution:
• “Origin site takes precedence”
• “No automatic conflict resolution”
Origin site takes precedence
If a conflict occurs during one-way replication, the Origin site object takes
precedence. Any changes to objects on a Destination site are overwritten
by the Origin site's information.
Managing conflict detection and resolution

Example:
Frank changes the name of a report to Report A. Simon changes the name
of the replicated version on the Destination site to Report B. After the next
replication job runs, the replicated version on the Destination site will revert
to Report A.
Because the conflict is automatically resolved, it is not generated in the log
file and does not appear in the conflicting object list.
No automatic conflict resolution
If a conflict occurs and you select “No automatic conflict resolution”, the
conflict is not resolved, a log file is not generated, and it does not appear in
the conflicting object list.
The administrator can access a list of all replicated objects that are in conflict
in the Federation area of the CMC. Objects in conflict are grouped together
by the Remote Connection they used to connect to the Origin site with. To
access these lists, go to the Replication Errors folder in the Federation area
of the CMC, and select the desired Remote Connection. All replicated objects
on a Destination site will be flagged with a replication icon, as shown here:
If there is a conflict, objects will be flagged with a conflict icon, as shown
in this example: . A warning message also appears in the “Properties”
page.
Note:
The list is updated when a Replication Job that uses a Remote Connection
is completed. It contains all objects in conflict for all of the Replication Jobs
that use its specific Remote Connection.
Note:
Any user with access to the CMC and the Replication Job instances can
access the XML log outputted in the logfile directory. A Destination site
object's icon is flagged to indicate a conflict. During processing, a conflict
log is created.
Abdul modifies Report A on the Origin site. Maria modifies the replicated
version on the Destination site. The next time the replication job runs, the
report will be in conflict as it has changed on both sites and it will not be
resolved.
4 Managing conflict detection and resolution

The Destination report is maintained and changes to the Origin's report are
not replicated. Subsequent replication jobs will behave the same way until
the conflict is resolved. Any changes on the Origin site are not replicated
until the conflict is manually resolved.
Note:
In this case, the entire object is not replicated. Other changes that may not
be in conflict are not brought over.
To manually resolve a conflict, you have three options:
1. Create a Replication Job that replicates only the objects in conflict. It must
use the same Remote Connection object and Replication List.
To keep the Origin site changes, create a Replication Job. Then set
Replication Mode to“Refresh from Origin”, and set Automatic Conflict
Resolution to “Origin site takes precedence”.
To keep the Destination site changes, create a Replication Job with
Replication Type = “Two-way replication”, Replication Mode = “Refresh
from Destination”, and Automatic Conflict Resolution = “Destination site
takes precedence”
Note:
In Replication Mode, set “Refresh from Origin ” or “Refresh from
Destination”, to select only the objects in conflict on the Replication List.
This way, other objects are not replicated. Next, schedule the Replication
Job to run and it will replicate the selected objects and resolve the conflict
as specified.
2. Create a Replication Job that replicates only the objects in conflict. It will
need to use the same Remote Connection object. However unlike option
1, you may create a new Replication List on the Origin site. Use only the
objects in conflict and create a new Replication Job which will use this
focused Replication List.
To keep the Origin site changes, set the Automatic Conflict Resolution
to “Origin site takes precedence”.
To keep the Destination site changes, set Automatic Conflict Resolution
to “Destination site takes precedence” and the Replication Type to
“Two-way replication”.
3. For one-way replication jobs, you may only delete the object on the
Destination site. The next time the Replication Job executes, it replicates
the object from the Origin site to the Destination site.

Note:
Be careful when deleting an object because other objects that depend
on it may be removed, stop working, or lose security. Options 1 and 2
are recommended.
Two-way replication conflict resolution
In two-way replication conflict, you have three choices for conflict detection:
• “Origin site takes precedence”
• “Destination site takes precedence”
• “No automatic conflict resolution”
Origin site takes precedence
If a conflict occurs, the Origin site will take precedence and overwrite any
changes to the Destination site.
Example:
Lily modifies the name of a report to Report A. Malik modifies the name of
the replicated version on the Destination site to Report B. After the next
replication job runs, the replicated version on the Destination site will revert
to Report A.
This will not generate a conflict in the log file, and it will not appear in the
conflicting object list because the conflict was resolved according to the
user's instructions on the Origin site.
Destination site takes precedence
If a conflict occurs, the Destination site keeps its changes and overwrites
them to the Origin site.
Example:
Kamal modifies the name of a report to Report A. Peter modifies the name
of the replicated version on the Destination site to Report B. When the
replication job runs, a conflict is detected. The name of the Destination
report remains as Report B.

In two-way replication, changes are also sent back to the Origin site. In this
scenario, the Origin site is updated and its report name is changed to Report
B. This does not generate a conflict in the log file and it will not appear in
the conflicting object list because the conflict was resolved according to
the user's instructions.
No automatic conflict resolution
When “No automatic conflict resolution” is selected, a conflict will not be
resolved. The conflict will be noted in a log file for the administrator, who can
manually resolve it.
Note:
• An object's icon is flagged to indicate that a conflict exists.
• Although changes are replicated to both Origin and Destination sites in
two-way replication, only the Destination site's versions will be flagged
with a conflict icon.
Note:
Any user with access to the CMC and the Replication Job instances can
access the XML log outputted in the logfile directory. A Destination site
object's icon is flagged to indicate a conflict. During processing, a conflict
log is created.
The administrator can access a list of all replicated objects that are in conflict
in the Federation area of the CMC. Objects in conflict are grouped together
by the Remote Connection they used to connect to the Origin site with. To
access these lists, go to CMC > Federation > Replication Errors > Remote
Connection.
Note:
The list is updated when a Replication Job that uses a Remote Connection
is completed. It contains all objects in conflict for all of the Replication Jobs
that use its specific Remote Connection. All replicated objects on a
Destination site will be flagged with a replication icon, as shown here: If
there is a conflict, objects will be flagged with a conflict icon as shown here:

Example:
Michael modifies Report A on the Origin site. Damien modifies the replicated
version on the Destination site. When the next replication job runs, the
report is in conflict as it has changed on both sites and will not be resolved.
The Destination report is kept and changes to the Origin's report are not
replicated. Subsequent replication jobs behave the same way until the
conflict is resolved. Any changes on the Origin site will not get replicated
until the conflict is manually resolved by the administrator or delegated
administrator.
Note:
In this case, the entire object is not replicated. Other changes that are not in
conflict are not brought over.
To manually resolve a conflict, you have three options:
1. Create a Replication Job that replicates only the objects in conflict. It must
use the same Remote Connection object and Replication List.
To keep the Origin site changes, create a Replication Job. Then set the
Replication Mode to “Refresh from Origin” and set Automatic Conflict
Resolution to“ Origin site takes precedence”.
To keep the Destination site changes, create a Replication Job and set
Replication Type to “Two-way replication”, set Replication Mode to
“Refresh from Destination”, and set Automatic Conflict Resolution to
“Destination site takes precedence”.
Note:
In Replication Mode, set “Refresh from Origin” or “Refresh from
Destination”, to select only the objects in conflict on the Replication List.
This way, other objects are not replicated. Next, schedule the Replication
Job to run and it will replicate the selected objects and resolve the conflict
as specified.
2. Create a Replication Job that replicates only the objects in conflict. It will
need to use the same Remote Connection object. However unlike option
1, you may create a new Replication List on the Origin site. Use only the
objects in conflict and create a new Replication Job which will use this
focused Replication List.
To keep the Origin site changes, set the Automatic Conflict Resolution
to: “Origin site takes precedence”.

To keep the Destination site changes, set Automatic Conflict Resolution
to: “Destination site takes precedence” and the Replication Type to:
“Two-way replication”.
3. Delete the object on the site you don't want it to be located.
Note:
Be careful when deleting an object because other objects that depend on it
may be removed, stop working, or lose security. Options 1 and 2 are
recommended.
To keep the Destination site changes, you can delete the object on the Origin
site. The next time the Replication Job executes, it replicates the object from
the Destination site to the Origin site.
Note:
Be careful when deleting a Origin site's copy as other Destination sites that
replicate that object may execute their replication job before the copy has
been replicated back. This will cause the other Destination sites to delete
their copy, which will be unavailable until the copy is returned.
To maintain the Origin site changes, you may delete the object on the
Destination site.
Using Web Services in Federation
Federation uses Web Services to send objects and their changes between
the Origin and Destination sites. Federation-specific Web Services are
automatically installed and deployed in your BusinessObjects Enterprise
installation. However, you may want to modify properties or customize
deployments in Web Services to improve functionality, as described in this
section.
Tip:
To improve file management and functionality, it is recommended that you
enable file caching in Federation.
Session variable
If you are transferring a large number of content files in one Replication Job,
you may want to increase the session timeout period of the Federation Web
Services.

The property is located in the dsws.properties file:
<App Server Installation
Directory>dswsbobjeWeb-Infclasses
For example:
C:Program FilesBusiness
ObjectsTomcat55webappsdswsbobjeWEB-INFclasses
To activate session variable, enter:
session.timeout = x
Where “x ”is the desired time, “x” is measured in seconds. If not specified,
the default value is 1200 seconds or 20 minutes.
File caching
File caching allows Web Services to handle very large attachments without
buffering them in memory. If it is not enabled during large transfer sizes, all
of the Java's Virtual Machine memory can be utilized and replication may
fail.
Note:
File caching decreases performance as the Web Services process to files
instead of memory. You may use a combination of both options and send
large transfers to a file and smaller ones into memory.
To enable file caching, modify the Axis2.xml located at:
Directory>dswsbobjeWeb-Infconf
For example:
C:Program FilesBusiness
ObjectsTomcat55webappsdswsbobjeWEB-INFconf
Enter the following:
<parameter name="cacheAttachments" locked="false">true</parameter>
<parameter name="attachmentDIR" locked="false">temp
directory</parameter>
4 Using Web Services in Federation

<parameter name="sizeThreshold" locked="false">4000</parameter>
Note:
Threshold size is measured in bytes.
Custom deployment
Federation Web Services may deploy automatically and require the
“federation”, “biplatform”, and “session” services to activate. To disable
Federation or any other Web Services, modify the corresponding Web
Services service.xml file.
BusinessObjects Enterprise Web Services are located in:
Directory>dswsbobjeWEB-INFservices
Example:
C:Program FilesBusiness ObjectsTomcat55webappsdsws
bobjeWEB-INFservices
To deactivate Web Services:
• add “activate” property in the service name tag of the service.xml file
and set it to false
• restart your Java application server
For example, to disable Federation:
services.xml file is located in:
C:Program FilesBusiness ObjectsTomcat55webappsdsws
bobjeWEB-INFservicesfederatorMETA-INF
Change service name from:
<service name="Federator">
To:
<service name="Federator" activate="false">

Remote scheduling and locally run
instances
This section details Remote Scheduling, Locally Run Instances and Instance
Share. These features allow reports to run where the data resides and send
completed instances to the appropriate locations.
Remote scheduling
Using Federation, you can schedule a report on the Destination site and then
process it on the Origin site. The completed instance will be returned to the
Destination site.
To enable Remote Scheduling, schedule a report as normal and enable the
option “Run at origin site”. To enable this option, click Schedule >
Scheduling Server Group > Run at origin site. After the scheduled
instances are created, they are placed in the pending stage.
During Remote Scheduling, information submitted on the Destination site is
disregarded and the report instance remains in the pending stage.
When the next Replication Job that manages the report is enabled for remote
scheduling, it copies the instance to the Origin site for processing. The
instance remains in a pending state until the scheduler processes it.
Meanwhile, the Replication Job that sent it will return any previously
completed instances and object changes.
Once the instance has processed on the Origin site, it reverts to a completed
state. When the next Replication Job that manages the report is enabled for
remote scheduling runs, it uses the completed instance to update the copy
on the Destination site. Once updated, the instance on the Destination site
is complete.
Note:
A Replication Job has to run twice in order to bring back one completed
instance.
Example:
1. Tom schedules Report A for Remote Scheduling.
4 Remote scheduling and locally run instances

2. Report A is created on the Destination site and is in the pending state.
3. Replication Job A runs. First: it replicates changes from the Origin site
to Destination site (including previously completed instances). Second:
it copies the instance in the pending state to the Origin site, as well as
changes to be replicated from the Destination site to the Origin site.
4. At the Origin site, the scheduler picks up the instance in the pending
state and sends it to the appropriate job server for processing. The
instance is then processed and placed in the completed state on the
Origin site.
5. Replication Job A runs again. When it replicates content from the Origin
site to the Destination site, the completed instance Report A is picked
up and changes are applied to the Destination's version.
6. Once this task is done, the Destination's version is complete.
Remote Scheduling only works with a two-way Replication Job. You must
enable “Replicate remote schedules”. This option is located on the Replication
Job Properties page in the “Replication Filters” area. In some scenarios, you
may want to replicate remotely scheduled jobs more frequently than other
objects on your Replication List. To do this, create two Replication Jobs.
Enable one job with “Replicate remote schedules” for a Replication Job that
is only focusing on Remote Scheduling. Enable the other job with “Replicate
document templates” or “Replicate all objects (no filter)”.
Note:
When you enable Remote Scheduling, completed and failed instances appear
on both the Origin and Destination site.
If a user on the Destination site schedules a report for Remote Scheduling
and the user does not exist on the Origin site, the instance will fail on the
Origin site. The owner of the failed instance will be the user account of the
Remote Connection object used to connect to the Origin.
A Replication Job may only be configured for Remote Scheduling, but it
always replicates the ancestor objects of the report instance. This means
that if there are any changes between replications, it replicates the actual
report, reports folder, and so on. If you do not want these changes on the
Destination site to be replicated to the Origin site, see Managing security
rights on page 256.
Remote scheduling and locally run instances

Locally run instances
Locally Run Instances are instances of a report that are processed from
reports on the Destination site. With Federation, you can replicate the
completed instances from the Destination site to the Origin site.
To enable a Replication Job to replicate completed and failed instances from
the Destination site to the Origin site, click Replication Job Properties >
Replication Filters > Replicate locally run completed instances.
In some cases, you may want a Replication Job to only replicate locally run
instances. To do this, enable “Replicate locally run completed instances”.
Note:
When you enable Locally Run Instances on a Replication Job, both completed
and failed instances are replicated to the Origin site. This means that there
will be copies on both the Origin and Destination sites.
Pending instances are never replicated.
If the owner of a locally run instance does not exist on the Origin site, then
the owner will be the user account used to connect in the Remote Connection
object.
Instance share
When you enable Remote Scheduling and Locally Run Instances in a
Replication Job, instance share may occur if one Origin site with multiple
Destination sites are replicating the same report.
Example:
Report A originates on the Origin Site, while Destination sites A and B are
replicating it. Instance share occurs at both Destination sites:
• Enabled Replication Jobs with “Replicate remote schedules” and/or
“Replicate locally run completed instances” Replicate Report A with the
same Replication Job as above
• Schedule Report A on the Destination site to “run at origin” and/or to run
locally
4 Remote scheduling and locally run instances

If both Destination sites A and B replicate Report A and their corresponding
Replication Jobs are replicating remote schedules and/or replicating locally
run instances, then any instances that were processed at Destination site
A and/or at the Origin site on behalf of Destination site A will be shared with
Destination site B.
Similarly, any instances processed at Destination site B and/or processed
at the Origin site will also be shared with Destination site A. Finally, the
Origin site and Destination sites A and B will have an identical set of
instances.
Instance share is ideal in many cases. For example, when users from other
sites need to access information from their sister deployments. In this case,
to prevent instances from being viewed by users at the local site, ensure the
proper security rights are set. For example, in a report object, apply the rights
so users can see only the instances they own.
Note:
All objects follow the BusinessObjects Enterprise security rules. To ensure
that users and groups can only view applicable instances, it is recommended
that you set rights so that the users can only view instances that they own.
For example, in a report object, apply the rights so users can see only the
instances they own. For more information, see Managing security rights on
page 256.
Importing and promoting replicated
content
In some cases, you may choose to import or promote replicated content from
one BusinessObjects Enterprise system to another. This section discusses
these features in Federation.
Importing replicated content
If you use the Import Wizard to import content from one BusinessObjects
Enterprise deployment to another, the Import Wizard does not import any of
the replication-specific information associated with replicated objects that
Importing and promoting replicated content

are being imported. This means that after the import, the object acts as if it
was never replicated. This is specific to replicated objects on a Destination
site and is described in the following scenario.
Example:
BusinessObjects Enterprise System A is a Destination Site in a Federation
process. Report A, a replicated report on System A, is imported from System
A to BusinessObjects Enterprise System B using the Import Wizard.
Outcome: When Report A is copied to System B, it doesn't contain any
replicated information. Report A will no longer be flagged with a replication
icon. If the object was in conflict on System A, it will not be in conflict on
System B. Essentially it is treated as an object that originated from System
B.
Note:
The CUID may or may not be the same, depending on the import choices you
select in the Import Wizard.
Importing replicated content and continuing
replication
After you've imported replicated content, you may want to include the imported
objects in a Federation process. There are two scenarios: treat the system
that the imported objects reside on as an Origin site, or treat the system as
a Destination site. To treat this system as an Origin site, proceed with
Federation as normal.
To treat the system as a Destination site and replicate the imported objects
from the Origin site, you must:
• Ensure the CUID of the objects are preserved when you use the Import
Wizard.
• Ensure the first Replication Job either has conflict resolution set to “Origin
wins” or “Destination wins”.
Tip:
Instead of importing the object using Import Wizard from one Destination
site to another, it is more efficient and highly recommended to only use
Federation to replicate the object.
4 Importing and promoting replicated content

Example:
Report A was created on BusinessObjects Enterprise System A. System
X used Federation to replicate Report A from System A to System X. The
Import Wizard then imported Report A from System X to System Y.
Plan: System Y wants to set up Federation to System A, and keep Report
A as part of Replication. System Y is the Destination and System A is the
Origin.
Action: When importing Report A from System X to System Y, the CUID of
Report A must be preserved. In addition, when the first Replication Job
executes, it will try to replicate Report A. Because the object already exists
on System Y, replication will produce a conflict. To specify which version
to use, you must set the Conflict Resolution mode to either “Origin wins”
or “Destination wins”.
Note:
In this example, it is recommended that instead of importing the object using
Import Wizard from one Destination site to another, only use Federation to
replicate the object. Report A will replicate from System A to System Y and it
is unnecessary to use Import Wizard to import from System X to System Y.
Promoting content from a test environment
In any organization, testing is often done before placing anything into a
production environment. It is normal to test Federation between
BusinessObjects Enterprise systems in a development or testing environment
prior to setting Federation up on your production machines. Once you create
your Origin site and Destination sites and content in a testing environment,
you can promote this set up to your Production machines using the following
steps:
1. Use the Import Wizard to promote your content from your Origin site in
the testing environment to the machine in Production that will act as your
Origin site.
Note:
The Replication List object is not selectable when using the Import Wizard.
2. Create the Replication List on the Origin site in the production environment
and include the desired content.
Importing and promoting replicated content

3. Choose from these two following options:
• A) Create a Remote Connection object and the appropriate Replication
Jobs on the production machine(s) in production that will act as your
Destination site(s).
• B) Use the Import Wizard to import the Remote Connection and
Replication Jobs from the Destination site in Dev/QA to the production
machines that will act as Destination site(s). Then edit the imported
Remote Connections to point to the machine in production that will
act as the Origin site.
Re-pointing a destination site
Currently, once an object is replicated from an Origin site, it must always be
replicated from that Origin site and can't be replicated from another
BusinessObjects Enterprise system. Even if the Remote Connection object
is edited to point to a new BusinessObjects Enterprise system, any attempt
to replicate an object that was replicated from a different BusinessObjects
Enterprise system than the remote Connection object will fail to replicate.
To replicate an object from a different Origin site, delete it from the Destination
site first.
Note:
Once you copy a replicated object, the CUID of the copy is changed and the
copy will not contain any replication information.
Best practices
With Federation, it is possible to optimize the performance of a Replication
Job if you follow the configuration steps described in this section.
If there a large number of objects in a single Replication Job, you can take
additional steps to ensure success when you run the Replication Job.
Typically, you should be able to replicate up to 32,000 objects in each
Replication Job. However, some deployments may need to make
configurations with smaller or larger replication sizes. If you experience
problems, refer to Troubleshooting error messages on page 290.
Note:
It is recommended that you read Using Web Services in Federation on page
275 before you begin the following steps.
4 Best practices

1) Obtain a dedicated Web Services provider
In Federation, replicated content is sent via Web Services. In a default
installation of BusinessObjects Enterprise, all Web Services utilize the same
web service provider. This means that larger Replication Jobs may tie up
the web service provider longer and slow down its response to other web
service requests as well as any applications it serves.
If you plan to replicate a large number of objects at once, or run several
Replication Jobs in sequence, you may consider deploying Federation Web
Services on its own Java Application server using your own web services
provider.
To do this, use the BusinessObjects Installer and install BusinessObjects
Enterprise Web Services. You must have a Java Application Server already
running. If you do not, install the entire Web Tier Components option, which
will install the BusinessObjects Web Services and Tomcat. To do this, launch
Installer on the desired machine, select “Custom Install” and select either
the “Web Tier Components” option or “BusinessObjects Web Services”.
Note:
• You must input an existing CMS, for example the hostname, port, and
administrator password.
• You will need to use this new Web Services provider's URI in your Remote
Connection's URI field.
2) Increase the Java Application Server's available memory
Increase the available memory of your Java Application Server if your single
Replication Job replicates many objects, or if you are sharing the Application
Server with other applications.
If you deployed BusinessObjects Enterprise and Tomcat, the default available
memory is 1 GB. To increase the available memory for Tomcat:
In Windows:
1. Open the Tomcat Configuration. Click Start > Programs > Tomcat >
Tomcat Configuration.
2. Select Java.
3. In the Java Options text box, locate -Xmx1024M
4. Increase the -Xmx1024M to the desired size.
Best practices

Example:
To increase the memory to 2 GB, enter: -Xmx2048M
In Unix:
1. In the <BOE_Install_Dir>/setup/, open env.sh with your preferred
text editor. Increase the -Xmx1024m parameter to the desired size.
2. Locate the following lines
# if [ -d "$BOBJEDIR"/tomcat ]; then
# set the JAVA_OPTS for Tomcat
JAVA_OPTS="-Dbobj.enterprise.home=${BOBJEDIR}enterprise120
-Djava.awt.headless=true"
if [ "$SOFTWARE" = "AIX" -o "$SOFTWARE" =
"SunOS" -o "$SOFTWARE" = "Linux" -o "$SOFTWARE" = "HP-UX"
];
then
JAVA_OPTS="$JAVA_OPTS -Xmx1024m -XX:MaxPermSize=256m"
fi
export JAVA_OPTS
# fi
3. Increase the -Xmx1024m parameter to the desired size.
Example:
To increase the memory to 2 GB, enter: -Xmx2048m
Tip:
For other Java application servers, refer to your Java application server's
documentation to increase the available memory.
3) Reduce the size of the BIAR files being created.
Federation uses Web Services to replicate content between the Origin site
and Destination site. Objects are grouped together and compressed into
BIAR files for more efficient transportation.
When replicating a large number of objects, configure your Java Application
Server to create smaller BIAR files. Federation will package and compress
objects across multiple smaller BIAR files so the number of objects you want
to replicate will not be limited.
4 Best practices

To reduce the size of the BIAR files created, add the following Java
parameters to your java application server:
Dbobj.biar.suggestSplit
and
Dbobj.biar.forceSplit
bobj.biar.suggestSplit suggests an appropriate size of the BIAR file,
which it will try to meet. Suggested new value is 90MB.
bobj.biar.forceSplit will force a BIAR file to stop at a given size.
Suggested new value is 100 MB.
Note:
You do not need to change the default BIAR file size settings unless your
application server is running out of memory and its maximum heap size (see
Current release limitations on page 288) cannot be increased any further.
For Tomcat Windows:
1. Open the Tomcat Configuration tool. Click Start > Programs > Tomcat
> Tomcat Configuration.
2. Select Java.
3. Under the Java Options text box, add the following lines at the end:
-Dbobj.biar.suggestSplit=90
-Dbobj.biar.forceSplit=100
For Tomcat Unix/Linux:
1. Open the env.sh with your preferred text editor. It is located in <BOE_In
stall_Dir>/setup/
2. Locate the following lines:
# if [ -d "$BOBJEDIR"/tomcat ]; then
# set the JAVA_OPTS for tomcat
JAVA_OPTS="-Dbobj.enterprise.home=${BOBJEDIR}enterprise120 -
Djava.awt.headless=true"
if [ "$SOFTWARE" = "AIX" -o "$SOFTWARE" = "SunOS" -o "$SOFTWARE"
= "Linux" -o "$SOFTWARE" = "HP-UX" ]; then
JAVA_OPTS="$JAVA_OPTS -Xmx1024m -XX:MaxPermSize=256m"
fi
export JAVA_OPTS
# fi
Add the desired BIAR file size parameters.
Best practices

Example: JAVA_OPTS="$JAVA_OPTS -Xmx1024m -XX:MaxPermSize=256m
-Dbobj.biar.suggestSplit=90 -Dbobj.biar.forceSplit=100"
For other Java Application servers, consult your documentation to add Java
system properties.
4) Increase the Socket Timeout.
The Adaptive Job Server is responsible for running the Replication Job.
During the execution of the Replication Job, the Adaptive Job Server
establishes a connection to the Origin site. When receiving large amounts
of information from the Origin site, it is important that the Socket which the
Adaptive Job Server is using to receive information does not timeout.
The default value is 90 minutes. You can increase the Socket Timeout if you
need to.
To increase the Socket Timeout on the Adaptive Job Server:
1. Open the Central Management Console (CMC)
2. Navigate to the Server section and select Adaptive Job Server.
3. Click Properties.
4. Add “Command Line Parameters” to the end of the following:
• Windows:-javaArgs Xmx1000m,Xincgc,server,Dbobj.federa
tion.WSTimeout=<timeout in minutes>
• Unix: -javaArgs Xmx512m,Dbobj.federation.WSTimeout=<timeout
in minutes>
Current release limitations
Federation is a very flexible tool, however certain limitations may effect its
performance during production. This section highlights areas that you can
modify to optimize your Federation operations.
• Maximum number of objects
Each Replication Job replicates objects between BusinessObjects
Enterprise deployments. It is recommended that the maximum number
of objects you replicate in a single Replication Job is 100,000. While a
Replication Job may function with more than 100,000 objects, Federation
only supports replicating up to 100,000 objects.
• Rights
4 Best practices

In Federation, rights are only replicated from the Origin site to the
Destination site. It is recommended that user rights common to both
deployments are set on the Origin site and replicated to the Destination
sites using two-way replication. User rights on a specific site will be
administered as usual in a BusinessObjects Enterprise deployment on
the site where the user resides.
• Business Views and associated objects
BusinessObjects Enterprise may store Business Views, Business
Elements, Data Foundations, Data Connections and List of Values (LOVs).
These objects are used to enhance the functionality of Crystal reports.
If these objects are first created on the Destination site and then replicated
to the Origin site using two-way replication, they may not work properly
and their data may not appear in Crystal Reports.
It is recommended that you create the Business Views, Business
Elements, Data Foundations, Data Connections and LOVs on the Origin
site and then replicate them to the Destination site. Make updates to the
objects on the Destination site or the Origin site (rights permitting) and
the changes will replicate back and forth properly.
• Universe overloads
BusinessObjects Enterprise may store universe overloads. If universe
overloads are created on the Destination site and then replicated to the
Origin site using two-way replication, they may not work properly.
To resolve this, first create the universe overloads on the Origin site and
replicate them to the Destination site. Second, set any security on the
universe overloads on the Origin site and replicate them to the Destination
site.
• Object cleanup
Object cleanup deletes objects that have been deleted on the other site.
Object cleanup is currently only done from the Origin site to the Destination
site. For more information, see Managing Object Cleanup on page 263.
• Federation log files
Federation log files are written to XML files that use XML 1.1 standards.
To view the log files with a browser, the browser must support XML 1.1.
Best practices

Troubleshooting error messages
This section contains error messages you may encounter in rare
circumstances while using Federation. These messages will appear in the
Replication Jobs logs or in the functionality area of a report.
1) Invalid GUID
Error example: ERROR 2008-01-10T00:31:08.234Z The GUID
ASXOOFyvy0FJnRcD0dZNTZg (found in property SI_PARENT_CUID on
object number 1285) is not a valid GUID.
This error means that you are replicating an object whose parent is not being
replicated with it, and which does not already exist on the Destination site.
For example, an object is being replicated but not the folder that contains it.
The parent object may not be replicated because the account replicating the
objects does not have sufficient rights on the parent object.
2) Crystal reports showing no data on the Origin site
This error may occur if the Crystal report is using a Business View, Business
Element, Data Foundation, Data Connection or List Of Values (LOVs) that
was originally created on the Destination site and then replicated to the Origin
site. For more details, see Current release limitations on page 288.
3) Universe overloads are not applied correctly
This error may occur if the report is using a universe which contains a
universe overload that was created on the Destination site and replicated to
the Origin site. For more details, see Current release limitations on page 288.
4) Java out of memory
Error example: java.lang.OutOfMemoryError.
This may occur if your Java Application Server has run out of memory while
processing a Replication Job. Your Replication Job may be too big or your
Java Application Server may not have enough memory.
Either increase the available memory of your Java Application Server by
moving Federation Web Services to a dedicated machine, or reduce the
4 Best practices

amount of objects being replicated in one Replication Job. For more details,
see Best practices on page 284.
5) Socket timeout
Error example: Error communicating with origin site. Read timed
out.
The information being sent from the Origin site to the Adaptive Job Server
on the Destination site is longer than the allotted timeout. Increase the socket
timeout on the Adaptive Job Server, or reduce the number of objects you
are replicating in your Replication Job.
6) Query Limit
Error example: SDK error occurred at the destination site. Not a
valid query. (FWB 00025) …...Query string is larger than query
length limit.
This error may appear if you are replicating too many objects at one time
and Federation submits a query that is too large for the CMS to handle.
Objects from the Origin site will be committed to the Destination site. However,
any changes that need to be committed to the Origin site will not be
committed. Conflicts are resolved as specified, however manual resolution
conflict flags on the object will not be set. Objects committed on the
Destination site will continue to work properly.
To resolve this issue, reduce the number of objects you are replicating in
one Replication Job. For more details, see Best practices on page 284.
7) Replication Job Times Out
Error example: Object could not be scheduled within the specified
time interval.
You may receive this message if your Replication Job times out while it waits
for another Replication Job to finish. This may occur if you have multiple
Replication Jobs connecting to the same Origin site at the same time. The
failed Replication Job will try to run again at its next scheduled time.
To resolve this issue, schedule the failed Replication Job at a time that doesn't
conflict with other Replication Jobs that connect to the same Origin site.
Best practices

8) Replication Limit
Error example: SDK error occurred at the destination site.
Database access error. …. Internal Query Processor Error: The
query processor ran out of stack space during query
optimization. Error executing query in ExecWithDeadlockHandling.
You may receive this message if you exceed the number of supported objects
that can be replicated at one time. To resolve this issue, reduce the number
of objects you are replicating in your Replication Job and run the job again.
9) Object dropped
Error example: Error encountered while checking security rights,
or Error encountered while packing object.
This message may display if an object is dropped from the replication
package. This can occur when Federation queries an object that needs
replication, but before it checks for rights and the packs the object.
10) Adaptive Processing Server
Error example: An error occurred in Job Processing Server.
This error can occur when too many classes are loaded by Federation and
there is not enough memory to process the replication job.
To resolve this issue, you need to perform both of the following steps:
1. In the command-line arguments of the Adaptive Processing Server, add
the following line: -javaArgs "XX:MaxPermSize=256m".
2. Add the following parameters to the Java Application server that you are
connecting to for Federation, to reduce the size of the BIAR files that you
are using:
• -Dbobj.biar.suggestSplit=100m
• -Dbobj.biar.forceSplit=100m
11) Object Manager Space
Error example: Could not build push package. Input/Output
exception occurred: "No space left on device."
4 Best practices

This occurs when the temporary directory that Federation uses doesn't have
enough disk space. To resolve this issue, either create extra space in the
temporary directory, or use a different location for the temporary directory.
To specify a different location for the temporary directory on the origin site,
add the following line to the Java Application Server's configuration files:
-Dbobj.tmp.dir=<TempDir>.
To specify a different location for the temporary directory on the destination
site, add the following line to the Adaptive Processing Server's command-line
arguments: -javaArgs “-Dbobj.tmp.dir=<TempDir>”.
In the above examples, <TempDir> is the location of the temporary directory
that you want to use.
12) Universe Error
Error example: An internal error occurred while calling processD
PCommands API.
This occurs when a Universe that has been replicated has an invalid or
missing Universe-to-Universe Connection relationship. To resolve this issue,
run the replication job with the Refresh from Origin option selected, and
verify that they Universe Connection is replicated.
Alternatively, you can open the Universe in Universe Designer, edit the
Universe's connection, and re-commit the Universe.
Best practices

4 Best practices

Understanding communication between
BusinessObjects Enterprise components
If your BusinessObjects Enterprise system is deployed entirely on the same
subnet, there is no need to perform any special configuration of your firewalls.
However, you might choose to deploy some Business Objects components
on different subnets separated by one or more firewalls.
It is important to understand the communication between BusinessObjects
Enterprise servers, rich clients, and the web application server hosting the
BusinessObjects Enterprise SDK before configuring your BusinessObjects
Enterprise system to work with firewalls.
Related Topics
• Configuring BusinessObjects Enterprise for firewalls on page 309
• Examples of typical firewall scenarios on page 313
Overview of BusinessObjects Enterprise servers and
communication ports
It is important to understand BusinessObjects Enterprise servers and their
communication ports if the BusinessObjects Enterprise system is deployed
with firewalls.
Each BusinessObjects Enterprise server binds to a Request Port
A BusinessObjects Enterprise server, such as the Input File Repository
Server, binds to a Request Port when it starts. Other BusinessObjects
Enterprise components including BusinessObjects Enterprise servers,
Business Objects rich clients, and the Business Objects SDK hosted in the
web application server can use this Request Port to communicate with the
server.
A server will select its Request Port number dynamically unless it is configured
with a specific port number. A specific Request Port number must be
configured for servers that communicate with other BusinessObjects
Enterprise components across a firewall.
Working with Firewalls
5 Understanding communication between BusinessObjects Enterprise components

Each BusinessObjects Enterprise server registers with the CMS
BusinessObjects Enterprise servers register with the CMS when they start.
When a server registers, the CMS records:
• The hostname (or IP address) of the server's host machine.
• The server's Request Port number.
The Central Management Server (CMS) uses two ports
The CMS uses two ports: the Request Port and the Name Server Port. The
Request Port is selected dynamically by default. The Name Server Port is
6400 by default.
Other BusinessObjects Enterprise servers will initially contact the CMS on
its Name Server port. The CMS will respond to this initial contact by returning
the value of its Request Port. The Business Objects servers will use this
Request Port for subsequent communication with the CMS.
The Central Management Server (CMS) provides a directory of
registered servers
The CMS provides a directory of the BusinessObjects Enterprise servers
that have registered with it. Other BusinessObjects Enterprise components
such as BusinessObjects Enterprise servers, Business Objects rich clients,
and the Business Objects SDK hosted in the web application server can
contact the CMS and request a reference to a particular server. A server's
reference contains the server's Request Port number and the host name (or
IP address) of the server's host machine.
BusinessObjects Enterprise components might reside on a different subnet
than the server they are using. The host name (or IP address) contained in
the server reference must be routable from the component's machine.
Note:
The reference to a BusinessObjects Enterprise server will contain the server
machine's host name by default. (If a machine has more than one hostname,
the primary hostname is chose). You can configure a server so that its
reference contains the IP address instead.
5Working with Firewalls
Understanding communication between BusinessObjects Enterprise components

Related Topics
• Communication between BusinessObjects Enterprise components on
page 299
Server Intelligence Agents (SIA) communicate with the Central
Management Server (CMS)
Your deployment will not work if the Server Intelligence Agent (SIA) and
Central Management Server (CMS) cannot communicate with each other.
Ensure that your firewall ports are configured to allow communication between
the SIA and the CMS.
Job server child processes communicate with the data tier and
the CMS
Most job servers create a child process to handle a task such as generating
a report. The job server will create one or more child processes. Each child
process has its own Request Port.
By default, a job server will dynamically select a Request Port for each child
process. You can specify a range of port numbers that the job server can
select from.
All child processes communicate with the CMS. If this communication crosses
a firewall, you must:
• Specify the range of port numbers that the job server can select from.
Note that the port range should be large enough to allow the maximum
number of child process as specified by -maxJobs.
• Open the specified port range on the firewall.
Many child processes communicate with the data tier. For example, a child
process might connect to a reporting database, extract data, and calculate
values for a report. If the job server child process communicates with the
data tier across a firewall, you must must:
• Open a communicate path on the firewall from any port on the job server
machine to the database listen port on the database server machine.

Related Topics
• Job servers on page 663
Communication between BusinessObjects Enterprise
components
BusinessObjects Enterprise components, such as browser clients, rich clients,
servers, and the BusinessObjects Enterprise SDK hosted in the web
application server, communicate with each other across the network during
typical workflows. You must understand these workflows to deploy Business
Objects products across different subnets that are separated by a firewall.
Requirements for communication between BusinessObjects
Enterprise components
Deployments of BusinessObjects Enterprise must conform to these general
requirements.
1. Every BusinessObjects Enterprise server must be able to initiate
communication with every other BusinessObjects Enterprise server on
that server's Request Port.
2. The CMS uses two ports. Every BusinessObjects Enterprise server,
BusinessObjects Enterprise rich client, and the web application server
that hosts the BusinessObjects Enterprise SDK must be able to initiate
communication with the Central Management Server (CMS) on both of
its ports.
3. Every job server child process must be able to initiate communication
with the CMS on both of its ports.
4. Rich clients must be able to initiate communication with the Request Port
of the Input and Output File Repository Servers
5. If Desktop Intelligence and Web Intelligence rich clients use Auditing,
they must be able to initiate communication with the Request Port of the
Adaptive Processing Servers that hosts the Client Auditing Proxy Service.
6. In general, the web application server that hosts the BusinessObjects
Enterprise SDK must be able to initiate communication with the Request
Port of every BusinessObjects Enterprise server.

Note:
The web application server only needs to communicate with
BusinessObjects Enterprise servers that are used in the deployment. For
example, if Crystal Reports is not being used, the web application server
does not need to communicate with the Crystal Reports Processing
Servers.
7. Job Servers use the port numbers that are specified with the -re
questJSChildPorts <port range> command. If no numbers are
specified in the command line, the servers use random port numbers. To
allow a job server to communicate with an FTP or mail server on another
machine either open all of the ports in the range specified by -re
questJSChildPorts on your firewall, or add the job server child process
as an exception for your firewall.
8. The CMS must be able to initiate communication with the CMS database
listen port.
9. The Connection Server, most Job Server child process, and every
Processing Server must be able to initiate communication with the
reporting database listen port. Each database vendor uses a different
listen port. For example, MySQL uses 3306 by default.
Related Topics
• BusinessObjects Enterprise port requirements on page 300
BusinessObjects Enterprise port requirements
This section lists the communication ports used by BusinessObjects
Enterprise servers, BusinessObjects Enterprise rich clients, the web
application server hosting the BusinessObjects Enterprise SDK, and
third-party software applications. If you deploy BusinessObjects Enterprise
with firewalls, you can use this information to open the minimum number of
ports in those firewalls.
Port Requirements for Business Objects Applications
This table lists the servers and port numbers used by BusinessObjects
Enterprise applications.

Server Port RequirementsAssociated Servers
Client
Applica-
tion
Product
CMS Name Server Port
(6400 by default)
CMS Request Port
Input FRS Request Port
Output FRS Request Port
RAS Request Port
Crystal Reports Cache Serv-
er Request Port
Crystal Reports Page Server
Request Port
Web Intelligence Processing
Server Request Port
CMS
Input FRS
Output FRS
Report Application
Server (RAS)
Crystal Reports Cache
Server
Crystal Reports Page
Server
Web Intelligence Pro-
cessing Server
Crystal
Reports
Designer
Crystal
Reports

Client
Applica-
tion
Product
(6400 by default)
CMS Request Port
RAS Request Port
Web Intelligence Processing
Server Request Port
Adaptive Processing Server
Request Port
Crystal Reports Cache Serv-
er Request Port
CMS
Input FRS
Output FRS
Report Application
Server (RAS)
Web Intelligence Pro-
cessing Server
Adaptive Processing
Server
Crystal Reports Cache
Server
Live Of-
fice
Live Of-
fice web
applica-
tion
HTTP port (80 by default)
web application server
that hosts the Live Of-
fice web application
Live Of-
fice
Live Of-
fice Rich
Client
(6400 by default)
CMS Request Port
CMS
Input FRS
Web Intel-
ligence
Rich
Client
Business
Objects
Enter-
prise

Client
Applica-
tion
Product
(6400 by default)
CMS Request Port
CMS
Input FRS
Output FRS
Desktop
Intelli-
gence
Business
Objects
Enter-
prise
(6400 by default)
CMS Request Port
Connection Server port
CMS
Input FRS
Connection Server
Universe
Designer
Business
Objects
Enter-
prise
(6400 by default)
CMS Request Port
CMS
Input FRS
Business
View
Manager
Business
Objects
Enter-
prise

Client
Applica-
tion
Product
The following ports must be
open to allow CCM to man-
age remote BusinessObjects
Enterprise servers:
(6400 by default)
CMS Request Port
The following ports must be
open to allow CCM to man-
age remote SIA processes:
Microsoft Directory Services
(TCP port 445)
NetBIOS Session Service
(TCP port 139)
NetBIOS Datagram Service
(UDP port 138)
NetBIOS Name Service
(UDP port 137)
DNS (TCP/UDP port 53)
(Note that some ports listed
above may not be required.
Consult your Windows admin-
istrator).
CMS
Server Intelligence
Agent (SIA)
Central
Configura-
tion Man-
ager
(CCM)
Business
Objects
Enter-
prise

Client
Applica-
tion
Product
SIA Request Port (6410 by
default)
(6400 by default)
CMS Request Port
Request Port for each server
that is managed by the SIA
Every Business Ob-
jects server including
the CMS
Server In-
telligence
Agent
(SIA
)
Business
Objects
Enter-
prise
(6400 by default)
CMS Request Port
CMS
Input FRS
Output FRS
Import
Wizard
Business
Objects
Enter-
prise
(6400 by default)
CMS Request Port
CMS
Input FRS
Output FRS
Publish-
ing Wiz-
ard
Business
Objects
Enter-
prise
(6400 by default)
CMS Request Port
CMS
Input FRS
Report
Conver-
sion Tool
Business
Objects
Enter-
prise

Client
Applica-
tion
Product
(6400 by default)
CMS Request Port
Request Port for each server
that is required.
All Business Objects
Enterprise servers re-
quired by the de-
ployed products.
For example, commu-
nication with the Crys-
tal Reports Cache
Server Request Port
is required only if
Crystal Reports is de-
ployed and used.
Business
Objects
Enter-
prise
SDKhost-
ed in the
web appli-
cation
server
Business
Objects
Enter-
prise
(6400 by default)
CMS Request Port
MDAS port
CMS
Multidimensional
Analysis Server
(MDAS)
Input FRS
Output FRS
OLAPVoyager
Note:
To configure the Report Application Server in a firewalled environment, you
must implement the following steps:
1. Open the incoming RAS request port; this port is identified by the -re
questport server command line switch.
2. Open all outgoing ports:
By default, the RAS server picks a dynamic outgoing port. If you want to
limit the outgoing ports, update the following registry keys with your
specified range of ports, and enable these ports and the RAS request
port.

For Windows, specify the range of ports in the following registry keys:
• HKEY_LOCAL_MACHINESOFTWAREBusiness ObjectsSuite
12.0CERRequestPortLower
• HKEY_LOCAL_MACHINESOFTWAREBusiness ObjectsSuite
12.0CERRequestPortUpper
For UNIX, specify the range of ports in the following file:
<INSTALLDIR>/bobje/data/.bobj/registry/software/business
objects/suite 12.0/cer/.registry
• "RequestPortLower"=dword:0
"RequestPortUpper"=dword:10000
Port Requirements for Third-Party Applications
This table lists third-party software used by Business Objects products. It
includes specific examples from some software vendors, but different vendors
will have different port requirements.
Description
Third-party appli-
cation port require-
ment
Business Ob-
jects compo-
nent that uses
the third-party
product
Third-party
application
MySQL is installed
with Business Objects
Enterprise. The CMS
is the only server that
communicates with the
CMS database.
Database server
listen port
For example,
MySQL uses port
3306.
Central Manage-
ment Server
(CMS)
CMS
Database

Description
Third-party appli-
ment
Business Ob-
jects compo-
nent that uses
the third-party
product
Third-party
application
These servers retrieve
information from the
reporting database.
Database server
listen port
For example,
MySQL uses port
3306.
Connection
Server
Every Job Serv-
er child process
Every Process-
ing Server
Reporting
Database
The HTTPS port is only
required if secure HTTP
communication is used.
HTTP port and
HTTPS port.
For example, on
Tomcat the default
HTTP port is 8080
and the default
HTTPS port is 443.
Live Office Rich
Client
All Business Ob-
jects portals in-
cluding InfoView
and CMC
webapplica-
tion server
The Job Servers use
the FTP ports to allow
send to FTP.
FTP In (port 21)
FTP Out (port 22)
Every Job Serv-
er
FTP server
The Job Servers use
the SMTP port to allow
send to email .
SMTP (port 25)
Every Job Serv-
er
Email serv-
er

Description
Third-party appli-
ment
Business Ob-
jects compo-
nent that uses
the third-party
product
Third-party
application
(Unix only) The Job
Servers use these
ports to allow send to
disk .
rexec out (port 512)
(Unix only) rsh out
(port 514)
Every Job Serv-
er
Unix
servers to
which the
Job Servers
can send
content
User credentials are
stored in the third-party
authentication server.
The CMS, BusinessOb-
jects Enterprise SDK,
and the Rich clients
listed here need to
communicate with the
third-party authentica-
tion sever when a user
logs on.
Connection port for
third-party authenti-
cation.
For example, the
connection server
for the Oracle
LDAP server is de-
fined by the user in
the file ldap.ora.
CMS
web application
server that hosts
the BusinessOb-
jects Enterprise
SDK
every Rich
Client, except
Live Office and
Desktop Intelli-
gence in three-
tier "Zabo" mode
Authentica-
tion Server
Configuring BusinessObjects Enterprise
for firewalls
This section gives step-by-step instructions for configuring your
BusinessObjects Enterprise system to work in a firewalled environment.
Configuring BusinessObjects Enterprise for firewalls

To configure the system for firewalls
1. Determine which BusinessObjects Enterprise servers must communicate
across a firewall. See Communication between BusinessObjects
Enterprise components on page 299.
2. Configure the Request Port for each BusinessObjects Enterprise server
that must communicate across a firewall. See Configuring port numbers
on page 166.
3. Configure a port range for any Job Server children that must communicate
across a firewall. See Job servers on page 663.
4. Configure the firewall to allow communication to the Request Ports on
the BusinessObjects Enterprise servers that you configured in the previous
step. See Specifying the firewall rules on page 310.
5. (Optional) Configure the hosts file on each machine that hosts a
BusinessObjects Enterprise server that must communicate across a
firewall. See Configure the hosts file for firewalls that use NAT on page 312.
Specifying the firewall rules
You must configure the firewall to allow the necessary traffic between
Business Objects components. Consult your firewall documentation for details
of how to specify these rules.
Specify one inbound access rule for each communication path that crosses
the firewall. You might not need to specify an access rule for every Business
Objects server behind the firewall.
Use the port number you specify in the server Port text box. Remember that
each server on a machine must use a unique port number. Some Business
Objects servers use more than one port.
Note:
If BusinessObjects Enterprise is deployed across firewalls that use NAT,
every BusinessObjects Enterprise server on all machines needs a unique
Request Port number. That is, no two servers in the entire deployment can
share the same Request Port.
5 Configuring BusinessObjects Enterprise for firewalls

Note:
You do not need to specify any outbound access rules. BusinessObjects
Enterprise servers do not initiate communication to the web application
server, or to any client applications.
Example:
This example shows the inbound access rules for a firewall between the
web application server and the BusinesObjects Enterprise servers. In this
case you would open two ports for the CMS, one port for the Input File
Repository Server (FRS), and one port for the Output FRS. The Request
Port numbers are the port numbers you specify in the Port text box in the
CMC configuration page for a server.
ActionPort
Destination
Computer
Port
Source Com-
puter
Allow6400CMSAny
web application
server
Allow
<Request
Port number>
CMSAny
web application
server
Allow
<Request
Port number>
Input FRSAny
web application
server
Allow
<Request
Port number>
Output FRSAny
web application
server
RejectAnyCMSAnyAny
RejectAny
Other Busi-
nessObjects
Enterprise
servers
AnyAny
Configuring BusinessObjects Enterprise for firewalls

Related Topics
• Communication between BusinessObjects Enterprise components on
page 299
Configure the hosts file for firewalls that use NAT
This step is required only if the BusinessObjects Enterprise servers must
communicate across a firewall on which "Network Address Translation "
("NAT") is enabled. This step allows the client machines to map a server's
hostname to a routable IP address.
This step is required in addition to the steps described in To configure the
system for firewalls on page 310.
Note:
BusinessObjects Enterprise can be deployed on machines that use Domain
Name System (DNS). In this case, the server machine host names can be
mapped to externally routable IP address on the DNS server, instead of in
each machine's hosts file.
Understanding Network Address Translation
A firewall is deployed to protect an internal network from unauthorized access.
Firewalls that use "NAT" will map the IP addresses from the internal network
to a different address that is used by the external network. This "address
translation" improves security by hiding the internal IP addresses from the
external network.
BusinessObjects Enterprise components such as servers, rich clients, and
the web application server hosting the BusinessObjects Enterprise SDK will
use a server reference to contact a server. The server reference contains
the hostname of the server's machine. This hostname must be routable from
the BusinessObjects Enterprise component's machine. This means the hosts
file on the BusinessObjects Enterprise component's machine must map the
server machine's hostname to the server machine's external IP address.
The server machine's external IP address is routable from external side of
the firewall, whereas the internal IP address is not.
The procedure for configuring the hosts file is different for Windows and
UNIX.
5 Configuring BusinessObjects Enterprise for firewalls

To configure the hosts file on Windows
1. Locate every machine that runs a BusinessObjects Enterprise component
that must communicate across a firewall on which "Network Address
Translation " ("NAT") is enabled.
2. On each machine located in the previous step, open the hosts file using
a text editor like Notepad. The hosts file is located at WINNTsys
tem32driversetchosts.
3. Follow the instructions in the hosts file to add an entry for each machine
behind the firewall that is running a BusinessObjects Enterprise server
or servers. Map the server machine's hostname or fully qualified domain
name to its external IP address.
4. Save the hosts file.
To configure the hosts file on UNIX
Note:
Your UNIX operating system must be configured to first consult the "hosts"
file to resolve domain names before consulting DNS. Consult your UNIX
systems documentation for details.
1. Locate every machine that runs a BusinessObjects Enterprise component
that must communicate across a firewall on which "Network Address
Translation " ("NAT") is enabled.
2. Open the "hosts" file using an editor like vi. The hosts file is located in
the following directory etc
3. Follow the instructions in the hosts file to add an entry for each machine
behind the firewall that is running a BusinessObjects Enterprise server
or servers. Map the server machine's hostname or fully qualified domain
name to its external IP address.
4. Save the hosts file.
Examples of typical firewall scenarios
This section provides examples of typical firewall deployment scenarios.

Example - Application tier deployed on a separate
network
This example shows how to configure a firewall and BusinessObjects
Enterprise to work together in a deployment where the firewall separates the
web application server from other BusinessObjects Enterprise servers.
In this example, BusinessObjects Enterprise components are deployed
across these machines:
• Machine boe_1 hosts the web application server and the BusinessObjects
Enterprise SDK.
• Machine boe_2 hosts the Intelligence tier servers, including the Central
Management Server, the Input File Repository Server, the Output File
Repository Server, and the Event server.
• Machine boe_3 hosts the Processing tier servers, including the Crystal
Reports Job Server, the Program Job Server, the Destination Job Server,
the List of Values Job Server, the Web Intelligence Job Server, the Web
Intelligence Report Server, the Report Application Server, and the Crystal
Figure 5-1: Application tier deployed on a separate network
5 Examples of typical firewall scenarios

To configure an application tier deployed on a separate network
The following steps explain how to configure this example.
1. These communication requirements apply to this example:
• The web application server that hosts the BusinessObjects Enterprise
SDK must be able to initiate communication with the CMS on both of
its ports.
• The web application server that hosts the BusinessObjects Enterprise
SDK must be able to initiate communication with every
• The browser must have access to the http or the https Request Port
on the Web Application Server.
2. The web application server must communicate with all Business Objects
Enterprise servers on machine boe_2 and boe_3. Configure the port
numbers for each server on these machines. Note that you can use any
free port between 1,025 and 65,535.
The port numbers chosen for this example are listed in the table:
Port NumberServer
6411Central Management Server
6415Input File Repository Server
6420Output File Repository Server
6425Event server
6435Crystal Reports Job Server
6440Program Job Server
6445Destination Job Server
6450List of Values Job Server
6455Web Intelligence Job Server
6460Web Intelligence Report Server

Port NumberServer
6465Report Application Server
6470Crystal Reports Page Server
3. Configure the firewalls Firewall_1 and Firewall_2 to allow communication
to the fixed ports on the BusinessObjects Enterprise servers and the web
application server that you configured in the previous step. Note that port
6400 is the default port number for the CMS Name Server Port and did
not need to be explicitly configured.
In this example we are opening the HTTP Port for the Tomcat Application
server.
Table 5-5: Configuration for Firewall_1
ActionPort
Destination
Computer
Port
Allow8080boe_1Any
Configuration for firewall_2
ActionPort
Destination
Computer
Port
Source Com-
puter
Allow6400boe_2Anyboe_1

ActionPort
Destination
Computer
Port
Source Com-
puter
4. This firewall is not NAT-enabled, and so we do not have to configure the
hosts file
Related Topics
• Configuring port numbers on page 166
Example - Rich client and database tier separated
from BusinessObjects Enterprise servers by a firewall
This example shows how to configure a firewall and BusinessObjects
Enterprise to work together in a deployment scenario where:
• One firewall separates a rich client from BusinessObjects Enterprise
servers.
• One firewall separates BusinessObjects Enterprise servers from the
database tier.
In this example, BusinessObjects Enterprise components are deployed
across these machines:

• Machine boe_1 hosts the Publishing Wizard. Publishing Wizard is a
BusinessObjects Enterprise rich client.
• Machine boe_2 hosts the Intelligence tier servers, including the Central
Management Server, the Input File Repository Server, the Output File
Repository Server, and the Event server.
• Machine boe_3 hosts the Processing tier servers, including: Crystal
Reports Job Server, Program Job Server, Destination Job Server, List of
Values Job Server, Web Intelligence Job Server, Web Intelligence Report
Server, Report Application Server, and the Crystal Reports Page Server.
• Machine Databases hosts the CMS database and the reporting database.
Note that you can deploy both databases on the same database server,
or you can deploy each database on its own database server. In this
example, both the CMS database and the reporting database are deployed
on the same database server. The database server listen port is 3306,
which is the default listen port for MySql server.
Figure 5-2: Rich client and database tier deployed on separate networks
To configure tiers separated from BusinessObjects Enterprise
servers by a firewall
The following steps explain how to configure this example.
1. Apply the following communication requirements to this example:
• The Publishing Wizard must be able to initiate communication with
the CMS on both of its ports.

• The Publishing Wizard must be able to initiate communication with
• The Connection Server, every Job Server child process, and every
Processing Server must have access to the listen port on the reporting
database server.
• The CMS must have access to the database listen port on the CMS
database server.
2. Configure a specific port for the CMS, the Input FRS, and the Output
FRS. Note that you can use any free port between 1,025 and 65,535.
The port numbers chosen for this example are listed in the table:
Port NumberServer
6411Central Management Server
6415Input File Repository Server
6416Output File Repository Server
3. We do not need to configure a port range for the Job Server children
because the firewall between the job servers and the database servers
will be configured to allow any port to initiate communication.
4. Configure Firewall_1 to allow communication to the fixed ports on
the BusinessObjects Enterprise servers that you configured in the previous
step. Note that port 6400 is the default port number for the CMS Name
Server Port and did not need to be explicitly configured in the previous
step.
ActionPort
Destination
Computer
Port
Allow6400boe_2Any
Allow6411boe_2Any
Allow6415boe_2Any
Allow6416boe_2Any

Configure Firewall_2 to allow communication to the database server
listen port. The CMS (on boe_2) must have access to the CMS database
and the Job Servers (on boe_3) must have access to the reporting
database. Note that we did not have configure a port range for job server
child processes because their communication with the CMS did not cross
a firewall.
ActionPort
Destination
Computer
Port
Source Com-
puter
Allow3306DatabasesAnyboe_2
Allow3306DatabasesAnyboe_3
5. This firewall is not NAT-enabled, and so we do not have to configure the
hosts file
Related Topics
• Configuring BusinessObjects Enterprise for firewalls on page 309

Working with Web
Application Container
Servers
6

Adding or removing services to WACS
To add a CMC service to a WACS
After you install WACS, a Central Management Console (CMC) service is
automatically added to your deployment. There is no need to add a CMC to
a WACS unless you create a new WACS without a CMC service, or if you
remove a CMC service from a WACS.
To add a CMC service to a WACS, WACS must be installed on the machine.
A CMC service can only be added to a WACS that isn't already hosting a
CMC.
Adding a CMC service to a WACS requires that you stop the WACS.
Therefore, you must have at least one additional CMC hosted on a WACS
in your deployment that provides a CMC service while you are stopping and
adding a web service to the other WACS.
2. Double-click the WACS that you want to add the CMC service to, and
view the properties of the server to ensure that a CMC service is not
already present.
3. Click Cancel to return to the "Servers" screen.
4. To stop the WACS that you want to add a CMC service to, right-click the
server and click Stop Server.
If you are trying to stop the WACS that is currently serving the CMC to
you, a warning message appears. Don't proceed unless you have at least
one additional running CMC service on another WACS in your deployment.
If you do, click OK, log on to another WACS, and start this procedure
from the beginning.
5. Right-click the WACS and click Select Services.
The "Select Services" screen appears.
6. On the "Available services" list, select Central Management Console
Service, click > to add it to the server, and click OK.
7. To start the WACS, right-click the server and click Start Server.
The CMC service is added to the Web Application Container Server. The
default settings and properties for the CMC are applied.
Working with Web Application Container Servers
6 Adding or removing services to WACS

To remove a CMC service from a WACS
When you remove a CMC service from a WACS, you must ensure that you
don't remove the last CMC from your deployment. You need to have at least
one additional CMC service running on a WACS in your deployment before
you attempt to remove a CMC service.
You cannot delete the last service from a WACS. Therefore, if you are
removing a CMC service from a WACS, you must ensure that the server is
hosting another service.
If you want to remove the last service from a WACS, delete the WACS itself.
2. Double-click the WACS that you want to remove the CMC from, and view
the properties of the server to ensure that a CMC service is present.
3. Click Cancel to return to the "Servers" screen.
4. To stop the WACS, right-click the server and click Stop Server.
If you are trying to stop the WACS that is currently serving the CMC to
you, a warning message appears. Don't proceed unless you have at least
one additional running CMC service on another WACS in your deployment.
If you do, click OK, log on to another WACS, and start this procedure
from the beginning.
5. Right-click the server and click Select Services.
6. On the "Services" list, select Central Management Console Service,
click < to remove it from the server, and click OK.
Web Application Container Server
(WACS)
Web Application Container Servers (WACS) provide a platform for hosting
BusinessObjects Enterprise web applications. For example, a Central
Management Console (CMC) can be hosted on a WACS.
WACS simplifies system administration by removing several manual
workflows that were previously required for configuring application servers
6Working with Web Application Container Servers

and deploying web applications, and by providing a simplified, consistent
administrative interface.
applications, whether manually or by using wdeploy.
Note:
Business Objects does not support hosting Web Services SDK and QaaWS
(DSWS) or Business Process BI (BPBIWS) web services on WACS in this
release. Features or applications using web services, such as Live Office or
Federation, are also not supported on WACS. Deploying web services to a
WACS in a production deployment is not recommended. However, if you
want to test unsupported procedures such as adding or removing web
services from WACS and configuring single sign-on for Web Services SDK
and QaaWS, see the Web Application Container Server (WACS): Supported
and Unsupported Features for BusinessObjects Enterprise XI 3.1 on the
Business Objects customer support site: http://technicalsupport.businessob
jects.com .
Before you start with WACS, it may be helpful to keep these concepts in
mind:
• Central Management Console (CMC)
The Central Management Console (CMC) is a web-based tool to perform
day-to-day administrative tasks, including user management, content
management, and server management. It also allows you to publish,
organize, and set security levels for all of your BusinessObjects Enterprise
content.
• CMC service
A CMC hosted on a WACS.
• Configuration template
A configuration template stores a list of settings for BusinessObjects
Enterprise services. Configuration templates allow you to easily configure
multiple instances of servers. There is one configuration template for each
service type.
• Connector
WACS provides services through HTTP, HTTP through Proxy, and
HTTPS. Each of these is treated as a connector in WACS. There are
three connectors.
6 Web Application Container Server (WACS)

• Server
In BusinessObjects Enterprise, a server is a running process that can
host one or more service.
• Service
A service is an item that provides business functionality from within a
server.
• WACS service
A service that provides web application hosting services.
Related Topics
• Common Tasks on page 326
Do I need WACS?
If you plan to use a supported Java application server to deploy
BusinessObjects Enterprise web applications, or if you are installing
BusinessObjects Enterprise on a UNIX system, you do not need to install
and use WACS.
What are the advantages of using WACS?
Using WACS to host the CMC provides you with a number of advantages:
• WACS requires a minimum effort to install, maintain, and configure.
• All hosted applications are predeployed on WACS, so that no additional
manual steps are required.
• WACS is supported by Business Objects.
• WACS removes the need for Java application server administration and
maintenance skills.
• WACS provides an administrative interface that is consistent with other
Business Objects servers.

Common Tasks
TopicDescriptionTask
• Adding or removing
additional WACS to
your deployment on
page 329
• Cloning a Web Appli-
cation Container
Server on page 333
You can improve the per-
formance of the CMC by
installing WACS on multi-
ple machines.
How can I improve the
performance of the Cen-
tral Management Console
(CMC)?
Adding or removing addi-
tional WACS to your de-
ployment on page 329
Create additional WACS
in your deployment, so
that in the event of a
hardware or software
failure on one server, an-
other server can continue
servicing requests.
availability of my web-
tier?
Adding or removing addi-
tional WACS to your de-
ployment on page 329
Create a second,
stopped, WACS, and use
this WACS to define a
configuration template. In
the event that the primary
WACS becomes miscon-
figured, either use the
second WACS until you
configure the first server,
or apply the configuration
template to the first serv-
er.
How can I create an envi-
ronment where I can
easily recover from a
misconfigured CMC?
• Configuring
HTTPS/SSL on
page 334
• Using WACS with
firewalls on page 350
Configure HTTPS on
WACS.
security of communica-
tion between clients and
WACS?

• Configuring
HTTPS/SSL on
page 334
• Using WACS with
• Configuring servers
for SSL on page 206
Configure SSL communi-
cation between WACS
and other BusinessOb-
jects Enterprise servers
in your deployment.
security of communica-
tion between WACS and
other Business Objects
servers in my deploy-
ment?
To configure WACS to
support HTTPS with a re-
verse proxy on page 350
You can use WACS with
HTTPS and a reverse
proxy if you create two
WACS and configure
both servers with HTTPS.
Use the first WACS for
communication inside
your internal network,
and the other WACS for
communication with an
external network through
a reverse proxy.
Can I use WACS with
HTTPS and a reverse
proxy?
• Using WACS with
other web servers on
page 348
• Using WACS with a
load balancer on
page 349
• Using WACS with a
reverse proxy on
page 349
• Using WACS with
WACS can be deployed
in an IT environment with
existing web servers,
hardware load balancers,
reverse proxies, and fire-
walls.
How does WACS fit in my
IT environment?
Using WACS with a load
balancer on page 349
You can use WACS in a
deployment that uses a
hardware load balancer.
WACS itself cannot be
used as a load balancer.
Can I use WACS in a de-
ployment with a load bal-
ancer?

Using WACS with a re-
verse proxy on page 349
You can use WACS in a
deployment that uses a
reverse proxy. WACS it-
self cannot be used as a
reverse proxy.
Can I use WACS in a de-
ployment with a reverse
proxy?

• To view server errors
on page 352
• To view system met-
rics on page 353
If you need to determine
the reasons for/causes of
the poor performance of
your WACS, you can
view the log files and
view the system metrics.
How can I troubleshoot
my WACS servers?
• To resolve HTTP
port conflicts on
page 355
• To change memory
settings on page 356
• To change the num-
ber of concurrent re-
quests on page 357
• To restore system
defaults on page 358
There are a number of
reasons why you might
not be able to connect to
WACS. Check to see if:
• The HTTP, HTTP
through proxy, and
HTTPS ports that you
specified for the
WACS have been
taken by other applica-
tions.
• The WACS has
enough memory allo-
cated to it.
• The WACS allows
enough concurrent
requests.
• If necessary, restore
the system defaults
for the WACS.
I don't get any pages
served to me on a partic-
ular port. What is wrong?
Core Server Settings on
page 1030
The “Server Properties
Appendix” of this guide
contains a list of WACS
properties.
Where can I find a list of
WACS properties?
Adding or removing additional WACS to
your deployment
Adding additional WACS to your deployment can give you a number of
Adding or removing additional WACS to your deployment

advantages:
• Faster recovery from a misconfigured server.
• Improved server availability.
• Better load balancing.
• Better overall performance.
There are three ways to add additional WACS to your deployment:
• Installing WACS on a machine.
• Creating a new WACS.
• Cloning a WACS.
Note:
You can deploy more than one WACS on the same machine so that if the
primary WACS in your deployment is misconfigured, you can use a secondary
WACS to recover your system. However, it is not recommended that you
run more than one WACS on a single machine at the same time, due to high
resource utilization.
Installing WACS
Installing WACS on separate machines can provide your deployment with
better performance, better load balancing, and higher server availability. If
your deployment contains two or more WACS on separate machines, CMC
availability won't be affected by hardware or software failures on a specific
machine, because the other WACS will continue to provide a CMC service.
You can install a Web Application Container Server by using the
BusinessObjects Enterprise installation program. There are two ways that
you can install WACS:
• In a New installation, if you choose to not install a new or configure a
pre-existing Java application server, a WACS is automatically installed.
If you select a Java application server in a New installation, WACS is not
installed.
• In a Custom or Expand installation, you can choose to install WACS on
the "Select Features" screen by expanding Server Components and
selecting Web Application Container Server.
6 Adding or removing additional WACS to your deployment

If you install WACS, the installation program automatically creates a server
called <NODE>.WebApplicationContainerServer, where <NODE> is the name
of your node. A CMC is then deployed to that server. No manual steps are
required to deploy or configure the CMC. The system is ready to use.
When you install WACS, the installation program prompts you to provide an
HTTP port number for WACS. Ensure that you specify a port number that is
not used. The default port number is 6405. If you plan to allow users to
connect to the WACS from outside a firewall, you must ensure that the
server's HTTP port is open on the firewall.
WACS is supported only on Windows operating systems.
For more information on installing WACS, see the BusinessObjects Enterprise
XI 3.1 Installation Guide for Windows.
For information on installing WACS when you're upgrading from
BusinessObjects Enterprise XI or XI Release 2, see the BusinessObjects
Enterprise XI Upgrade Guide.
Note:
The web applications that WACS hosts are automatically deployed when
you install WACS or when you apply updates or hot-fixes to WACS or to
WACS-hosted web applications. It takes several minutes for the web
applications to deploy. The WACS will be in the “Initializing” state until the
web application deployment is complete. Users will not be able to access
web applications hosted on WACS until the web applications are fully
deployed. You can view the server state of the WACS through the Central
Configuration Manager (CCM).
This delay only occurs when starting WACS the first time after installing
WACS or applying updates to it. This delay does not occur for subsequent
WACS restarts.
Web applications cannot be manually deployed to a WACS server. You
cannot use wdeploy to deploy web applications to WACS.

Adding a new Web Application Container Server
Note:
2. Select Manage > New > New Server.
The "Create New Server" screen appears.
3. From the Service Category list, select Core Services.
4. From the Select Service list, select Central Management Console
Service, and click Next.
5. On the next "Create New Server" screen, click Next.
Note:
Business Objects does not support hosting Web Services SDK and
QaaWS (DSWS) or Business Process BI (BPBIWS) web services on
WACS. Features or applications using web services, such as Live Office
or Federation, are not supported on WACS.
Deploying web services to a WACS in a production deployment is not
recommended. However, if you want to test unsupported procedures
such as adding or removing web services from WACS and configuring
single sign-on for Web Services SDK and QaaWS, see the Web
Application Container Server (WACS): Supported and Unsupported
Features for BusinessObjects Enterprise XI 3.1 on the Business Objects
customer support site: http://technicalsupport.businessobjects.com.
6. On the next "Create Server Screen", select a node to add the server to,
type a server name, server port, and description for the server, and click
Create.
Note:
Only those nodes that have WACS installed will appear in the Node list.
7. On the "Servers" screen, double-click the newly created WACS.
6 Adding or removing additional WACS to your deployment

The "Properties" screen appears.
8. In the "Common Settings" pane, ensure that the Automatically start this
server when the Server Intelligence Agent starts checkbox is
unchecked, and click Save & Close.
A new WACS is created. The default settings and properties are applied to
the server.
Cloning a Web Application Container Server
As an alternative to adding a new WACS to your deployment, you can also
clone a WACS, either to the same machine or to another machine. While
adding a new WACS creates a server with the default settings, cloning a
WACS applies the settings of the source WACS to the new WACS.
Servers can only be cloned to machines that already have WACS installed.
Note:
2. Select the WACS that you want to clone, right-click and select Clone
Server.
The "Clone Server" screen displays a list of nodes in your deployment
that you can clone the WACS to. Only those nodes that have WACS
installed appear in the Clone to Node list.
3. On the "Clone Server" screen, type a new server name, select the node
that you want to clone the server to, and click OK.
A new WACS is created. The new server contains the same services as the
server that it is cloned from. The destination server and services that it hosts
have the same settings as the server it was cloned from, with the exception
of the server name.

Note:
If you cloned a WACS to the same machine, you may have port conflicts
with the WACS that was used for cloning. If this occurs, you must change
the port numbers on the newly cloned WACS instance.
Related Topics
• To resolve HTTP port conflicts on page 355
Deleting WACS servers from your deployment
You can only delete a WACS if the server isn't currently serving the CMC to
you. If you want to delete a WACS from your deployment, you must log on
to a CMC from another WACS or a Java application server. You cannot
delete a WACS that is currently serving the CMC to you.
2. Stop the server that you want to delete by right-clicking the server and
clicking Stop Server.
3. Right-click the server and select Delete.
4. When prompted for confirmation, click OK.
Configuring HTTPS/SSL
You can use the Secure Sockets Layer (SSL) protocol and HTTP for network
communication between clients and WACS in your BusinessObjects
Enterprise deployment. SSL/HTTPS encrypts network traffic and provides
improved security.
There are two types of SSL:
• SSL used between Business Objects servers, including WACS and other
BusinessObjects Enterprise servers in your deployment. This is known
as CorbaSSL. For more information on using SSL between the Business
Objects servers in your deployment, see the “Understanding
communication between BusinessObjects Enterprise components” section
of the “Working with Firewalls” chapter of the BusinessObjects Enterprise
• HTTP over SSL, which occurs between WACS and clients (for example,
browsers) that communicate with WACS.
6 Configuring HTTPS/SSL

Note:
If you are deploying WACS in a deployment with a proxy or reverse proxy,
and want to use SSL to secure the network communication in your
deployment, you must create two WACS. For more information, see Using
WACS with a reverse proxy.
To configure HTTPS/SSL on a WACS, you must:
• Generate or obtain a PKCS12 certificate store or JKS keystore which
contains your certificates and private keys. You can use Microsoft's
Internet Information Service (IIS) and Microsoft Management Console
(MMC) to generate a PCKS12 file, or use openssl or the Java keytool
command line tool to generate a keystore file.
• If you want only certain clients to connect to a WACS, then you must
generate a certificate trust list file.
• When you have a certificate store and, if necessary, a certificate trust list
file, copy the files to the WACS machine.
• Configure HTTPS on the WACS.
Related Topics
• Using WACS with a reverse proxy on page 349
To generate a PKCS12 certificate file store
There are many ways of generating a PKCS12 certificate file stores or Java
keystores, and tools that you can use. The method that you use depends on
the tools that you have access to and are familiar with.
This example demonstrates how to generate a PKCS12 file using Microsoft's
Internet Information Services (IIS) and the Microsoft Management Console
(MMC).
1. Log on to the machine that hosts WACS as an administrator.
2. In IIS, request a certificate from Certificate Authority. For information on
doing this, see the IIS help documentation.
3. Start the MMC by clicking Start > Run, typing mmc.exe, and clicking OK.
4. Add Certificates Snap-in to the MMC:

a. From File menu, click Add/Remove Snap-in.
b. Click Add.
c. On the "Add Standalone Snap-in" dialog, select Certificates, and click
Add.
d. Select Computer account, and click Next.
e. Select Local Computer, and click Finish.
f. Click Close, and click OK.
The Certificates Snap-In is added to the MMC.
5. In the MMC, expand Certificates, and select the certificate that you want
to use.
6. On the Action menu, select All Tasks > Export.
The "Certificate Export Wizard" starts.
7. Click Next.
8. Select Yes, export the private key, and click Next.
9. Select Personal Information Exchange - PKCS #12 (.PFX), and click
Next.
10. Enter the password you used when you created the certificate and click
Next. You must specify this password in the Private Key Access
Password field when you configure HTTPS for the WACS.
A PKCS12 certificate file store is created.
To generate a Certificate Trust List
1. Log on to the machine that hosts WACS as an administrator.
2. Start the Microsoft Management Console (MMC).
3. Add the Internet Information Services Snap-in:
a. From the File menu, select Add/Remove Snap-in, and click Add.
b. In the "Add Standalone Snap-in" dialog, select Internet Information
Services (IIS) Manager, and click Add.
c. Click Close, and click OK.
The IIS snap-in is added to the MMC.
4. In the left pane of the MMC, find the web site for which you want to create
the Certificate Trust List.
5. Right-click the web site, and select Properties.

6. Click the Directory Security tab, and under "Secure Communications",
click Edit.
7. Click Enable certificate trust list, and click New.
The "Certificate Trust List Wizard" starts.
8. Click Next.
9. Click Add from Store or Add from File, select the certificate that you
want to add to the Certificate Trust List, click OK, and click Next.
10. Type a name and description for the Certificate Trust List, and click Next.
11. Click Finish, and then click OK.
The Certificate Trust List is displayed in the Current CTL field.
12. Select the Certificate Trust List and click Edit.
The "Certificate Trust List Wizard" starts.
13. Click Next.
14. On the Current CTL certificates list, select the Trust List, and click View
Certificates.
15. Click the Details tab, and click Copy to File.
The "Certificate Export Wizard" starts.
16. Click Next.
17. Select Yes, export the private key, and click Next.
18. Select Personal Information Exchange - PKCS #12 (.PFX), and click
Next.
19. Enter the password you used when you created the certificate and click
Next. You must specify this password in the Certificate Trust List Private
Key Access Password field when you configure HTTPS for the WACS.
To configure HTTPS/SSL
Before you configure HTTPS/SSL on your WACS, ensure that you've already
created a PCKS12 file or JKS keystore, and that you've copied or moved
the file to the machine that is hosting the WACS.
2. Double-click the WACS the server for which you want to enable HTTPS.
3. In the "HTTPS Configuration" section, check the Enable HTTPS checkbox.

4. In the Bind to Hostname or IP Address field, specify the IP address for
which the certificates were issued and to which WACS will bind.
HTTPS services will be provided through IP address that you specify.
5. In the HTTPS Port field, specify a port number for WACS to provide
HTTPS service. You must ensure that this port is free. If you plan to allow
users to connect to the WACS from outside a firewall, you must also
ensure that this port is open on the firewall.
6. If you are configuring SSL with a reverse proxy, specify the proxy server's
hostname and port in the Proxy Hostname and Proxy Port fields.
7. On the Protocol list, select a protocol. The available options are:
• SSL
SSL is the Secure Sockets Layer protocol, which is a protocol for
encrypting network traffic.
• TLS
TLS is the Transport Layer Security protocol, and is a newer, enhanced
protocol. The differences between SSL and TLS are minor, but include
stronger encryption algorithms in TLS.

8. Under the Certificate Store Type field, specify the file type for the
certificate. The available options are:
• PKCS12
Select PKCS12 if you are more comfortable working with Microsoft
tools.
• JKS
Select JKS if you are more comfortable working with Java tools.
9. In the Certificate Store File Location field, specify the path where you
copied or moved the certificate file store or Java keystore file.
10. In the Private Key Access Password field, specify the password.
PKCS12 certificate stores and JKS keystores have private keys that are
password protected, to prevent unauthorized access. You must specify
the password for accessing the private keys, so that WACS can access
the private keys.
11. It is recommended that you either use a certificate file store or keystore
that either contains a single certificate, or where the certificate that you
want to use is listed first. However, if you are using a certificate file store
or keystore that contains more than one certificate, and that certificate is
not the first one in the filestore, in the Certificate Alias field, you must
specify the alias for the certificate.
12. If you want the WACS to only accept HTTPS requests from certain clients,
enable client authentication.
Client authentication doesn't authenticate users. It ensures that WACS
only serves HTTPS requests to certain clients.
a. Check Enable Client Authentication.
b. In the Certificate Trust List File Location, specify the location of the
PCKS12 file or JKS keystore that contains the trust list file.
Note:
The Certificate Trust List type must be the same as the Certificate
Store type.
c. In the Certificate Trust List Private Key Access Password field,
type the password that protects the access to the private keys in the
Certificate Trust List file.

Note:
If you enable client authentication, and a browser or web service consumer
is not authenticated, the HTTPS connection is rejected.
14. Go to the "Metrics" screen, and ensure that HTTPS connector appears
under List of Running WACS Connectors. If HTTPS does not appear,
then ensure that the HTTPS connector is configured correctly.
Supported authentication methods
WACS supports the following authentication methods:
• Enterprise
• LDAP
• AD Kerberos
WACS does not support the following authentication methods:
• NT
• AD NTLM
• LDAP with Single sign-on
• AD Kerberos Single sign-on
Configuring AD Kerberos for WACS
To configure AD Kerberos authentication for WACS, you must first configure
your machine to support AD. You must perform the following steps.
• Enabling the Windows AD security plug-in.
• Mapping users and groups.
• Setting up a service account.
• Setting up constrained delegation.
• Enabling Kerberos authentication in the Windows AD plug-in for WACS.
• Creating configuration files.
After you've setup the machine that is hosting WACS to use AD Kerberos
authentication, you must perform additional configuration steps through the
6 Supported authentication methods

Related Topics
• Using AD users and groups on page 489
• Windows AD security plug-in on page 488
• Mapping AD accounts on page 489
• Setting up a service account on page 497
• Setting up constrained delegation on page 500
• Configuring the servers on page 501
• Enabling Kerberos authentication in the Windows AD plug-in for WACS
on page 341
• Creating configuration files on page 342
• Configuring WACS for AD Kerberos on page 345
Enabling Kerberos authentication in the Windows
AD plug-in for WACS
In order to support Kerberos, you have to configure the Windows AD security
plug-in in the CMC to use Kerberos authentication. This includes:
• Ensuring Windows AD authentication is enabled.
• Entering the AD Administrator account.
Note:
This account requires read access to Active Directory only; it does not
require any other rights.
•
• Entering the service principal name (SPN) for the service account.
Prerequisites
Before you configure the Windows AD security plug-in for Kerberos, you
must have completed the following tasks:
• Granting the service account rights on page 502
• Configuring the servers to use the service account on page 503

To configure the Windows AD security plug-in for Kerberos
1. Go to the Authentication management area of the CMC.
2. Double-click Windows AD.
3. Ensure that the Windows Active Directory Authentication is enabled
check box is selected.
4. Under Authentication Options, select Use Kerberos authentication.
5. In the Service principal name field, enter the account and domain of the
service account or the SPN mapping to the service account.
Use the following format, where svcacct is the name of the service
account or SPN you created earlier, and DNS.COM is your fully qualified
domain in uppercase. For example, the Service Account would be
svcacct@DNS.COM and the SPN would be
BOBJCentralMS/some_name@DOMAIN.COM.
Note:
• If you plan to allow users from other domains than the default domain
to log on, you must provide the SPN you mapped earlier.
• The service account is case sensitive. The case of the account you
enter here must match with what is set up in your Active Directory
Domain.
• This must be the same account that you use to run the
BusinessObjects Enterprise servers or the SPN that maps to this
account.
Creating configuration files
The general process of configuring Kerberos on your application server
involves these steps:
• Creating the Kerberos configuration file.
• Creating the JAAS login configuration file.
Note:
• The default Active Directory domain must be in uppercase DNS format.
6 Configuring AD Kerberos for WACS

• You don't need to download and install MIT Kerberos for Windows. You
also no longer require a keytab for your service account.
To create the Kerberos configuration file
Follow these steps to create the Kerberos configuration file.
1. Create the file krb5.ini, if it does not exist, and store it under C:WINNT
for Windows.
Note:
You can store this file in a different location. However if you do, you need
to specify its location in the Krb5.ini File Location field on the "Properties"
page for the WACS server, in the CMC.
2. Add the following required information in the Kerberos configuration file:
[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_kdc = true
dns_lookup_realm = true
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
[domain_realm]
.domain.com = DOMAIN.COM
domain.com = DOMAIN.COM
.domain2.com = DOMAIN2.COM
domain2.com = DOMAIN2.COM
[realms]
DOMAIN.COM = {
default_domain = DOMAIN.COM
kdc = HOSTNAME.DOMAIN.COM
}
DOMAIN2.COM = {
default_domain = DOMAIN2.COM
kdc = HOSTNAME.DOMAIN2.COM
}
[capaths]
DOMAIN2.COM = {
DOMAIN.COM =
}
Note:
• DNS.COM is the DNS name of your domain which must be entered in
uppercase in FQDN format.
• kdc is the Host name of the Domain Controller.

• You can add multiple domain entries to the [realms] section if your
users log in from multiple domains. To see a sample of this file with
multiple domain entries, see Sample Krb5.ini files on page 344.
• In a multiple domain configuration, under [libdefaults] the de
fault_realm value may be any of the desired domains. The best
practice is to use the domain with the greatest number of users that
will be authenticating with their AD accounts.
To create the JAAS login configuration file
1. Create a file called bscLogin.conf if it does not exist, and store it in the
default location: C:WINNT.
Note:
You can store this file in a different location. However if you do, you will
need to specify its location in the bscLogin.conf File Location field on
the "Properties" page for the WACS server, in the CMC.
2. Add the following code to your JAAS bscLogin.conf configuration file:
com.businessobjects.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required;
};
Sample Krb5.ini files
Sample multiple domain Krb5.ini file
The following is a sample file with multiple domains:
[domain_realm]
domain03.com = DOMAIN03.com
.child1.domain03.com = CHILD1.DOMAIN03.COM
child1.domain03.com = CHILD1.DOMAIN03.com
.child2.domain03.com = CHILD2.DOMAIN03.COM
child2.domain03.com = CHILD2.DOMAIN03.com
domain04.com = DOMAIN04.com
[libdefaults]
default_realm = DOMAIN03.COM

[realms]
DOMAIN03.COM = {
admin_server = testvmw2k07
kdc = testvmw2k07
default_domain = domain03.com
}
CHILD1.DOMAIN03.COM = {
kdc = testvmw2k08
default_domain = child1.domain03.com
}
CHILD2.DOMAIN03.COM = {
kdc = testvmw2k09
default_domain = child2.domain03.com
}
DOMAIN04.COM = {
kdc = testvmw2k011
default_domain = domain04.com
}
Sample single domain Krb5.ini file
Following is a sample krb5.ini file with a single domain.
[libdefaults]
default_realm = ABCD.MFROOT.ORG
[realms]
ABCD.MFROOT.ORG = {
kdc = ABCDIR20.ABCD.MFROOT.ORG
default_domain = ABCD.MFROOT.ORG
}
Configuring WACS for AD Kerberos
After you've configured the machine that is hosting WACS for AD Kerberos
authentication, you must configure the WACS itself, through the Central
Management Console (CMC).

To configure WACS for AD Kerberos
2. Double-click the WACS that you want to configure AD for.
3. In the Krb5.ini File Location field, specify the path to the krb5.ini
configuration file.
4. In the bscLogin.conf File Location field, specify the path to the bscLo
gin.conf configuration file.
6. Restart the WACS.
Troubleshooting Kerberos
These steps may help you if you encounter problems when configuring
Kerberos:
• Enabling logging
• Testing your Kerberos configuration
To enable Kerberos logging
1. Start the Central Configuration Manager (CCM), and click the Manage
Servers icon .
2. Specify the logon credentials.
3. On the "Manage Servers" screen, stop the WACS.
4.
Click the Web Tier Configuration icon .
Note:
The Web Tier Configuration icon is only enabled when you select a
WACS that is stopped.
The "Web Tier Configuration" screen appears.

5. Under Command Line Parameters, copy the following text to the end
of the parameters:
“-Dcrystal.enterprise.trace.configuration=verbose
-Djcsi.kerberos.debug=true”
6. Click OK.
7. On the "Manage Servers" screen, start the WACS.
To test your Kerberos configuration
• Run the following command to test your Kerberos configuration, where
servact is the service account and domain under which the CMS is
running, and password is the password associated with the service
account.
<Install Directory>Business Objectsjavasdkbinkinit.exe
servact@TESTM03.COM Password
For example:
C:Program FilesBusiness Objectsjavasdkbinkinit.exe
If you still have a problem, ensure that the case you entered for your
domain and service principal name match exactly with what is set in Active
Directory.
Mapped AD user unable to log on to BusinessObjects Enterprise
on WACS
The following two issues may occur, despite the fact that the users have
been mapped to BusinessObjects Enterprise:
• Logon failure due to different AD UPN and SAM names on page 347
• Pre-authentication error on page 348
Logon failure due to different AD UPN and SAM names
A user's Active Directory ID has successfully been mapped to
BusinessObjects Enterprise. Despite this fact, they are unable to successfully

log on to CMC with AD authentication and Kerberos in the following format:
DOMAINABC123
This problem can happen when the user is set up in Active Directory with a
UPN and SAM name that are not the same, either in case or otherwise.
Following are two examples which may cause a problem:
• The UPN is abc123@company.com but the SAM name is
DOMAINABC123.
• The UPN is jsmith@company but the SAM name is DOMAINjohnsmith.
There are two ways to address this problem:
• Have users log in using the UPN name rather than the SAM name.
• Ensure the SAM account name and the UPN name are the same.
Pre-authentication error
A user who has previously been able to log on, can no longer log on
successfully. The user will receive this error: Account Information Not
Recognized. The WACS logs reveal the following error: "Pre-authentica
tion information was invalid (24)"
This can occur because the Kerberos user database didn't get a change
made to UPN in AD. This may mean that the Kerberos user database and
the AD information are out of sync.
To resolve this problem, reset the user's password in AD. This will ensure
the changes are propagated correctly.
WACS and your IT environment
This section describes how to configure WACS in a complex environment.
Using WACS with other web servers
When a Web Application Container Server (WACS) is installed, it works as
an application server and a web server without requiring any extra
configuration. You can configure supported web servers like Internet
Information Services (IIS) and Apache to perform URL forwarding to the
WACS server.
6 WACS and your IT environment

Note:
Request forwarding from IIS by using an ISAPI filter to WACS is not
supported.
WACS does not support a deployment scenario where a web server hosts
static content and WACS hosts dynamic content. Static and dynamic content
must always reside on WACS.
Using WACS with a load balancer
To use WACS in a deployment with a hardware load balancer, you must
configure the load balancer so that it uses either IP routing or active cookies.
This way, once a user's session is established on one WACS, all subsequent
requests by the same user are sent to the same WACS.
WACS is not supported with hardware load balancers using passive cookies.
If your hardware load balancer forwards SSL-encrypted HTTPS requests to
your WACS, then you must configure HTTPS on the WACS, and install SSL
certificates on every WACS.
If your hardware load balancer decrypts HTTPS traffic and forwards decrypted
HTTP requests to your WACS, then no additional WACS configuration is
required.
Related Topics
• Configuring HTTPS/SSL on page 334
Using WACS with a reverse proxy
You can use WACS in a deployment with a forward or reverse proxy server.
You cannot use WACS itself as a proxy server.
To configure WACS to support HTTP with a reverse proxy
To use WACS in a deployment with a reverse proxy, configure your WACS
so that the HTTP Port is used for communication inside a firewall (for example
on a secure network), and the HTTP through Proxy port is used for
communication from outside the firewall (for example, the internet).

2. Double-click the WACS that you want to configure.
3. In the "Configuration of HTTP through Proxy" section:
a. Check Enable HTTP through Proxy.
b. Specify the HTTP port of the WACS to be used for communication
through the proxy.
c. Specify the Proxy Hostname and Proxy Port of the proxy server.
To configure WACS to support HTTPS with a reverse proxy
Some load balancers and reverse proxy servers can be configured to decrypt
HTTPS traffic and then forward the decrypted traffic to your application
servers. In this case, you can configure WACS to use HTTP or HTTP through
proxy.
If your load balancer or reverse proxy forwards HTTPS traffic, and you want
to configure HTTPS with a reverse proxy, create two WACS. Configure one
WACS for HTTPS for external traffic through the reverse proxy, and the other
WACS to communicate with clients on your internal network through HTTPS.
Using WACS with firewalls
Deploying WACS in an IT environment with firewalls is supported.
By default, WACS bind to all IP addresses on the machine that it is installed
on. If you plan to use a firewall between clients and your WACS, you must
6 WACS and your IT environment

force WACS to bind to a specific IP address for HTTP or HTTP through
proxy. To do this, uncheck Bind to All IP Addresses, and then specify a
Hostname or IP address to bind to.
If you plan to use a firewall between a WACS server and the other Business
Objects servers in your deployment, see the “Working with Firewalls” chapter
Configuring WACS on a multihomed machine
A multihomed machine is one that has multiple network addresses. By default,
a Web Application Container Server instances binds its HTTP port to all IP
addresses. If you want to bind WACS to a specific Network Interface Card
(NIC), for example, when you want to bind the HTTP port of the WACS to
one NIC and bind the request port to another NIC:
3. In the "Configuration of HTTP through Proxy" section of the "Web
Application Container Service" pane, uncheck Bind to all IP addresses,
and type an IP address for the WACS to bind to.
4. In the "HTTPS Configuration" section, uncheck Bind to all IP addresses,
and type an IP address or hostname for the WACS to bind to.
5. Under "Common Settings", deselect Auto assign, and then specify the
Hostname or IP Address of the NIC that's used for communication
between WACS and the other Business Objects servers in your
deployment.
7. Restart the WACS.

Troubleshooting
To view server errors
The log file is located in the <InstallDir>/Logging directory, where <In
stallDir> is the directory where BusinessObjects Enterprise is installed.
The name of the log file is in the format <servername>_<datestart
ed>_<timestarted>_<processId>.log, where <servername> is the name
of the WACS, <datestarted> is the date that the WACS was started,
<timestarted> is the time it was started, and <processId> is the server's
process ID.
Note:
All errors are written to the log file. No error messages are written to the
Windows Event Viewer.
To change the logging level
You can change the logging severity through the CMC. The levels of severity
are:
DescriptionLogging Level
Logs all WACS activity. This option logs the most amount
of information. It is not recommended to select DEBUG
in a production environment.
DEBUG
Logs general information. Selecting INFO also logs
WARN, ERROR, and FATAL messages to the log file.
INFO
Logs a message when the application encounters a
problem. Selecting WARN also logs ERROR and FATAL
messages to the log file.
WARN
Logs a message when a service encounters an error or
is not available. Selecting ERROR also logs FATAL
messages to the log file.
ERROR
6 Troubleshooting

DescriptionLogging Level
Logs a message when an event occurs that results in the
failure of the server or service that it provides.
FATAL
Retrieves the logging level that is specified in the WACS
command line. By default, this value is ERROR.
AUTO
To change the logging level of a WACS:
2. Double-click the server.
Stopping the server is not required.
3. On the Log Level list, select a logging severity level, and click OK.
4. On the "Servers" screen, restart the WACS.
To view system metrics
You can view the system metrics of a WACS from the Central Management
Console (CMC).
2. Right-click the WACS, and click Metrics.
A list of system metrics appears. For a descriptions of the metrics that are
on the list, see WACS metrics.
Related Topics
• WACS metrics on page 353
WACS metrics
The following table describes the metrics that appear on the "Metrics" screen.
Troubleshooting

DescriptionMetric
The total memory used by WACS, in
mega bytes.
"Total Memory (MB)"
A list of all running connectors."List Running WACS Connectors"
Whether there are any failed connectors.
If true, at least one connector failed. If
false, all connectors are running.
WACS Connector(s) Failed at Start-
up
To view the state of a WACS
To view the state of a WACS, go to the "Servers" area of the CMC. The
Servers List includes a State column that provides the state for each server
in the list.
WACS has a new server state called “Started with Errors”. A WACS that is
in this state is running, but has at least one misconfigured HTTP, HTTP
through Proxy, or HTTPS connector.
If a WACS status is “Started with Errors”, go to the "Metrics" page and view
the "Running WACS Connector" metric. If an enabled connector does not
appear in the list, the connector has not been configured properly.
Resolving port conflicts
If you cannot get any pages when you try to access the CMC through a
particular port, ensure that another application has not taken over the HTTP,
HTTP through proxy, or HTTPS ports that you have specified for WACS.
There are two ways to determine if there are port conflicts with your WACS.
If you have more than one WACS in your deployment, log on to the CMC
and check the Running WACS Connectors and WACS Startup Errors metrics.
If the HTTP, HTTP through Proxy, or HTTP connectors do not appear in the
Running WACS Connectors list, these connectors are not able to start due
to a port conflict.
6 Troubleshooting

If your deployment has only one WACS, or If you are not able to access the
CMC through any WACS, use a utility such as netstat to determine if another
application has taken a WACS port.
To resolve HTTP port conflicts
1. Start the Central Configuration Manager (CCM), and click the Manage
Servers icon .
4.
Note:
5. In the HTTP Port field, specify a free HTTP port to be used by the Web
Application Container Server, and click OK.
Troubleshooting

To resolve HTTP through proxy or HTTPS port conflicts
If you cannot access a WACS through the HTTP through proxy or HTTPS
ports, but you can still connect to the Central Management Console (CMC)
through the HTTP port, change the port numbers through the CMC.
2. To stop the WACS that you want to configure, right-click the server and
click Stop Server.
4. In the "Configuration of HTTP through Proxy" section, specify a new HTTP
port.
5. To change the HTTPS port, in the "HTTPS Configuration" section, type
a new value in the HTTPS Port field.
To change memory settings
To improve the server performance of a WACS, you can change the amount
of memory that is allocated to the server through the Central Configuration
Manager (CCM).
1.
Start the CCM, and click the Manage Servers icon .
2. Specify the logon credentials for the CMC.
4.
Note:
6 Troubleshooting

5. Under "Command Line Parameters", specify a new memory value by
editing the command line:
a. Find the -Xmx option. This option normally has a value specified.
For example “-Xmx1g”. This setting allocates one giga byte of memory
to the server.
b. Specify a new value for the parameter.
• To specify a value in mega bytes, use “m”. For example,
“-Xmx640m” allocates 640 mega bytes of memory to the WACS.
• To specify a value in giga bytes, use “g”. For example, “-Xmx2g”
allocates two giga bytes of memory to the WACS.
c. Click OK.
To change the number of concurrent requests
The default number of concurrent HTTP requests that WACS is configured
to handle is 150. This should be acceptable for most deployment scenarios.
To improve the performance of WACS, you can increase the maximum
number of concurrent HTTP requests. Although increasing the number of
concurrent requests can improve performance, setting this value too high
can hurt performance. The ideal setting depends on your hardware, software,
and IT requirements.
2. To stop the WACS that you want to configure, right-click the server and
click Stop Server.
4. In the Maximum Concurrent Requests field, type the desired number
of concurrent requests, and click Save & Close.
Troubleshooting

To restore system defaults
If you've misconfigured a WACS, you can restore the system defaults through
the Central Configuration Manager (CCM).
1.
Start the CCM, and click the Manage Servers icon .
4.
Note:
5. Click Restore System Defaults.
6. If necessary, specify a free HTTP port, and click OK.
To prevent users from connecting to WACS through
HTTP
In certain cases, you may want to only allow users from the local machine
to connect to a WACS through HTTP or HTTPS. For example, although you
cannot close the HTTP port, you may want to configure your WACS so that
it only accepts HTTP requests from the clients located on the same machine
as the WACS. In this way, you can perform maintenance or configuration
tasks on the WACS through a browser from the same machine as the WACS,
while preventing other users from accessing the server.
2. Double-click the WACS that you want to modify.
3. Uncheck Bind to all IP Addresses.
4. In the Bind to Hostname or IP address field, type 127.0.0.1, and click
OK.
6 Troubleshooting

The WACS that is configured this way only accepts connections from the
local machine.
WACS properties
For a complete list of the general, HTTP, HTTP through Proxy, and HTTPS
configuration properties that can be configured for WACS, see the “Core
Server Settings” section of the “Server Properties Appendix”.
Related Topics
• Core Server Settings on page 1030
WACS properties

6 WACS properties

Modifying Default Security
Behavior
7

BusinessObjects Enterprise and reverse
proxy servers
This section explains how to configure BusinessObjects Enterprise and
reverse proxy servers to work together.
Introduction to reverse proxy servers
BusinessObjects Enterprise can be deployed in an environment with one or
more reverse proxy servers. A reverse proxy server is typically deployed in
front of the web application servers in order to hide them behind a single IP
address. This configuration routes all Internet traffic that is addressed to
private web application servers through the reverse proxy server, hiding
private IP addresses.
Because the reverse proxy server translates the public URLs to internal
URLs, it must be configured with the URLs of the BusinessObjects Enterprise
web applications that are deployed on the internal network.
The following diagram shows a typical deployment with a reverse proxy
server. LiveOffice is a typical web services consumer application. InfoView
and CMC are typical applications used from a browser.
Modifying Default Security Behavior
7 BusinessObjects Enterprise and reverse proxy servers

Supported reverse proxy servers
BusinessObjects Enterprise supports reverse proxy servers that can adjust
the value of the path attribute in Set-Cookie headers. For example:
• IBM Tivoli Access Manager WebSEAL 6 (WebSEAL 6)
• Apache 2.2
In addition BusinessObjects Enterprise supports the Microsoft ISA 2006 as
a reverse proxy server.
Understanding how BusinessObjects Enterprise web
applications are deployed
BusinessObjects Enterprise web applications are deployed on a web
application server. If the web application server is located behind a reverse
proxy server, the reverse proxy server should be configured with the context
paths of the BusinessObjects Enterprise WAR files. To expose all of the
BusinessObjects Enterprise functionality, configure a context path for every
BusinessObjects Enterprise WAR file that is installed.
Note:
If some WAR files are installed but their context paths are not configured in
the reverse proxy server, some parts of CMC and InfoView may not be
functional.
The following table gives an example of typical WAR files that are used by
common BusinessObjects Enterprise web applications. For a complete list
of WAR files, refer to the Installation and Configuration guide.
In the following table, "X" indicates a WAR file that is required for an
application to function. "xx" indicates a WAR file that is used by an application.
If the WAR file indicated by "xx" is not available, some functionality in the
application will not be available. For example, if the path to CrystalRe
ports.war is not configured in the reverse proxy server, Crystal Reports
functionality will not be available in CMC and InfoView.
7Modifying Default Security Behavior
BusinessObjects Enterprise and reverse proxy servers

Web In-
telli-
gence
Desktop
Intelli-
gence
Crystal
Reports
In
foView
CMC
XXxxxxAnalyticalReporting.war
XCmcApp.war
XCmcAppActions.war
XxxxxCrystalReports.war
XInfoViewApp.war
XInfoViewAppActions.war
XXXOpenDocument.war
XXXXXPlatformServices.war
Configuring reverse proxy servers for
BusinessObjects Enterprise web
applications
The reverse proxy server must be configured to map incoming URL requests
to the correct web application in deployments where BusinessObjects
Enterprise web applications are deployed behind a reverse proxy server.
7 Configuring reverse proxy servers for BusinessObjects Enterprise web applications

This section contains specific configuration examples for some of the
supported reverse proxy servers. Refer to the vendor documentation for your
reverse proxy server for more information.
To configure the reverse proxy server
1. Ensure the reverse proxy server is set up correctly according to the
vendor's instructions and the deployment's network topology.
2. Determine which BusinessObjects Enterprise web applications are
deployed and which WAR files are required.
3. Configure the reverse proxy server for each BusinessObjects Enterprise
web application. Note that the rules are specified differently on each type
of reverse proxy server.
4. Perform any special configuration that is required. Some Business Objects
web applications require special configuration when deployed on certain
web application servers.
Related Topics
• Detailed instructions for configuring reverse proxy servers for
BusinessObjects Enterprise on page 365
• To configure Apache 2.2 reverse proxy server for BusinessObjects
• To configure WebSEAL 6.0 reverse proxy server for BusinessObjects
• Special configuration for BusinessObjects Enterprise in reverse proxy
deployments on page 373
Detailed instructions for configuring reverse proxy
servers for BusinessObjects Enterprise
This section contains information to help you successfully set up your reverse
proxy server.
Configuring reverse proxy servers for BusinessObjects Enterprise web applications

Ensure all required WAR files have been configured
BusinessObjects Enterprise web applications are deployed in WAR files on
a web application server. Different BusinessObjects Enterprise web
applications require different WAR files. Ensure you configure a directive on
your reverse proxy server for every WAR file that is required for your
deployment.
Declare longer context path strings first
On the reverse proxy server, the directives for InfoViewAppActions must
exist before the directives for InfoViewApp. The directives for CmcAppActions
must exist before the directives for CmcApp.
Deploy the applications and actions in the same parent folder
The web applications CmcApp and CmcAppActions must be deployed under
the same parent folder. The web applications InfoViewApp and InfoViewAp
pActions must be deployed under the same parent folder.
InfoView and CMC applications can be renamed
You can rename the InfoView.war file and the CMC.war file in the ProxyPass
and ProxyPassReverseCookiePath directives. You cannot change the name
of any other BusinessObjects Enterprise WAR files.
Use the '/' character consistently
Define the context paths in the reverse proxy server in the same way as they
are entered in a browser URL. For example, if the directive contains a '/' at
the end of the mirror path on the reverse proxy server, enter '/' at the end of
the browser URL.
Ensure the '/' character is used consistently in the source and destination
URL in the directive of the reverse proxy server. If the '/' character is added

at the end of the source URL, it must also be added to the end of the
destination URL.
Related Topics
• Understanding how BusinessObjects Enterprise web applications are
deployed on page 363
To configure Apache 2.2 reverse proxy server for
Apache 2.2 to work together.
1. Ensure that BusinessObjects Enterprise and Apache 2.2 are installed on
separate machines.
2. Ensure that Apache 2.2 is installed and configured as a reverse proxy
server as described in the vendor documentation.
3. Configure the ProxyPass for every web application that is deployed behind
the reverse proxy server.
4. Configure the ProxyPassReverseCookiePath for every web application
that is deployed behind the reverse proxy server.
Example:
This example uses boe-deploy-server.domain.com for the web application
server domain and XIR3 for the mirror path. Replace these values with the
appropriate values for your deployment.
ProxyPass /XIR3/CmcAppActions http://boe-deploy-server.do
main.com:port/CmcAppActions
ProxyPassReverseCookiePath /CmcAppActions /XIR3/CmcAppActions
ProxyPass /XIR3/CmcApp http://boe-deploy-server.do
main.com:port/CmcApp
ProxyPassReverseCookiePath /CmcApp /XIR3/CmcApp
ProxyPass /XIR3/InfoViewAppActions http://boe-deploy-server.do
main.com:port/InfoViewAppActions
ProxyPassReverseCookiePath /InfoViewAppActions /XIR3/InfoViewAp
pActions
ProxyPass /XIR3/InfoViewApp http://boe-deploy-server.do
main.com:port/InfoViewApp
ProxyPassReverseCookiePath /InfoViewApp /XIR3/InfoViewApp
ProxyPass /XIR3/PlatformServices http://boe-deploy-server.do

main.com:port/PlatformServices
ProxyPassReverseCookiePath /PlatformServices /XIR3/Platform
Services
ProxyPass /XIR3/AnalyticalReporting http://boe-deploy-serv
er.domain.com:port/AnalyticalReporting
ProxyPassReverseCookiePath /AnalyticalReporting /XIR3/Analyt
icalReporting
ProxyPass /XIR3/CrystalReports http://boe-deploy-server.do
main.com:port/CrystalReports
ProxyPassReverseCookiePath /CrystalReports /XIR3/CrystalReports
ProxyPass /XIR3/OpenDocument http://boe-deploy-server.do
main.com:port/OpenDocument
ProxyPassReverseCookiePath /OpenDocument /XIR3/OpenDocument
ProxyPass /XIR3/PerformanceManagement http://boe-deploy-serv
er.domain.com:port/PerformanceManagement
ProxyPassReverseCookiePath /PerformanceManagement /XIR3/Per
formanceManagement
To configure WebSEAL 6.0 reverse proxy server for
WebSeal 6.0 to work together.
The recommended configuration method is to create a single standard
junction that maps all of the BusinessObjects web applications hosted on an
internal web application server or web server to a single mount point.
1. Ensure that BusinessObjects Enterprise and WebSEAL 6.0 are installed
on separate machines.
It is possible but not recommended to deploy BusinessObjects Enterprise
and WebSEAL 6.0 on the same machine. Refer to the WebSEAL 6.0
vendor documentation for instructions on configuring this deployment
scenario.
2. Ensure that WebSeal 6.0 is installed and configured as described in the
vendor documentation.
3. Launch the WebSeal pdadmin command line utility. Log in to a secure
domain such as sec_master as a user with administration authorization.
4. Enter the following command at the padmin sec_master prompt:
server task <instance_name-webseald-host_name> create -t <type>
-h <host_name> -p <port> <junction_point>

Where:
• <instance_name-webseald-host_name> specifies the full server
name of the installed WebSEAL instance. Use this full server name
in the same format as displayed in the output of the server list
command.
• <type> specifies the type of junction. Use tcp if the junction maps to
an internal HTTP port. Use ssl if the junction maps to an internal
HTTPS port.
• <host_name> specifies the DNS host name or IP address of the internal
server that will receive the requests.
• <port> specifies the TCP port of the internal server that will receive
the requests.
• <junction_point> specifies the directory in the WebSEAL protected
object space where the document space of the internal server is
mounted.
Example:
server task default-webseald-webseal.rp.businessobjects.com
create -t tcp -h 10.50.130.123 -p 8080 /hr
To configure Microsoft ISA 2006 for BusinessObjects
Enterprise
This section explains how to configure BusinessObjects Enterprise and ISA
2006 to work together.
The recommended configuration method is to create a single standard
junction that maps all of the BusinessObjects web applications hosted on an
internal web application server or web server to a single mount point.
Depending on your web application server, there are additional configuration
required on the application server for it to work with ISA 2006.
1. Ensure that BusinessObjects Enterprise and ISA 2006 are installed on
separate machines.
It is possible but not recommended to deploy BusinessObjects Enterprise
and ISA 2006 on the same machine. Refer to the ISA 2006 documentation
for instructions on configuring this deployment scenario.

2. Ensure that ISA 2006 is installed and configured as described in the
vendor documentation.
3. Launch the ISA Server Management utility.
4. Use the navigation panel to launch a new publishing rule
a. Go to
Arrays > MachineName > Firewall Policy > New > Web Site
Publishing Rule
Remember:
Replace MachineName with the name of the machine on which ISA
2006 is installed.
b. Type a rule name in Web publishing rule name and click Next
c. Select Allow as the rule action and click Next.
d. Select Publish a single Web site or load balancer as the publishing
type and click Next.
e. Select a connection type between the ISA Server and the published
Web site and click Next.
For example, select Use non-secured connections to connect the
published Web server or server farm.
f. Type the internal name of the Web site you are publishing (e.g machine
name hosting BusinessObjects Enterprise) in Internal site name and
click Next.
Note:
If the machine hosting ISA 2006 cannot connect to the target server
select Use a computer name or IP address to connect to the
published serverand type the name or IP address in the field provided.
g. In "Public Name Details" select the domain name (e.g.Any domain
name) and specify any internal publishing details (e.g. /*). Click Next.
You now need to create a new web listener to monitor for incoming
Web requests.
5. Click New to launch the New Web Listener Definition Wizard.
a. Type a name in Web Listener name and click Next.
b. Select a connection type between the ISA Server and the published
Web site and click Next.
For example, select Do not require SSL secured connections with
clients.
c. In "Web Listener IP Addresses" select the following and click Next.

• Internal
• External
• Local Host
• All Networks
ISA Server is now configured to only publish over HTTP.
d. Select an "Authentication Setting" option and click Next and then
Finish.
The new listener is now configured for the web publishing rule.
6. Click Next in "User Sets" then Finish.
7. Click Apply to save all the settings for the web publishing rule and update
the ISA 2006 configuration
You now have to update the properties of the web publishing rule to map
paths for the BusinessObjects web applications.
8. In the navigation panel, right-click the Firewall Policy you configured and
select Properties.
9. Select the "Paths" tab and click Add to map routes to BusinessObjects
web applications.
Use the mapping in the table below for the CMC and Java InfoView
ToFrom
/Product/AnalyticalReporting/*/AnalyticalReporting/*
/Product/CmcApp/*/CmcApp/*
/Product/CmcAppActions/*/CmcAppActions/*
/Product/CrystalReports/*/CrystalReports/*
/Product/InfoViewApp/*/InfoViewApp/*
/Product/InfoViewAppActions/*/InfoViewAppActions/*
/Product/OpenDocument/*/OpenDocument/*
/Product/PerformanceManagement/*/PerformanceManage-
ment/*

ToFrom
/Product/PlatformServices/*/PlatformServices/*
Product/BusinessProcessBI/*/BusinessProcessBI/*
/Product/dswsbobje/*/dswsbobje/*
Use the mapping in the table below for .NET InfoView
ToFrom
/Product/Analyticalreporting/*/Analyticalreporting/*
/Product/CrystalReports/*/CrystalReports/*
/Product/crystalreportviewers12/*/crystalreportviewers12/*
/Product/InfoViewApp/*/InfoViewApp/*
/Product/InfoViewAppActions/*/InfoViewAppActions/*
/Product/OpenDocument/*/OpenDocument/*
/Product/PlatformServices/*/PlatformServices/*
10. Under "Public Name" tab, select Request for the following websites
and click Add.
11. In the "Public Name" dialog type your ISA 2006 server name and click
OK.
12. Click Apply to save all the settings for the web publishing rule and update
the ISA 2006 configuration
13. Verify the connections by accessing the following URL:
http://<ISA Server host Name>:<web listener port
number>/<External path of the application>
For Example: http://myISAserver:80/Product/InfoViewApp
Note:
You may have to refresh the browser several times.
You need to modify the HTTP policy for the rule have just configured to
ensure that you will be able to logon on to the CMC. Right-click the rule you
created in the ISA Server Management utility and select Configure HTTP.
You must now deselect Verify Normalization in the "URL Protection" area.

To remotely access BusinessObjects Enterprise you need to create an access
rule.
Related Topics
• Enabling the root path for session cookies for ISA 2006 on page 376
• Using WACS with a reverse proxy on page 349
Special configuration for BusinessObjects
Enterprise in reverse proxy deployments
Some BusinessObjects Enterprise products need additional configuration to
function correctly in reverse proxy deployments. This section explains how
to perform the additional configuration.
Enabling reverse proxy for Developer Suite Web
Services
This section describes the required procedures to enable reverse proxies
for Developer Suite Web Services.
To enable reverse proxy on Tomcat
To enable reverse proxy on the Tomcat web application server, you must
modify the server.xml file. Required modifications include setting proxyPort
as the reverse proxy server listen port and adding a new proxyName. This
section explains the procedure.
1. Stop Tomcat.
2. Open the server.xmlfor Tomcat.
On Windows, server.xml is located at <CATALINA_HOME>conf. The
default value of <CATALINA_HOME> is C:Program FilesBusiness
ObjectsTomcat55.
On UNIX server.xml is located at <CATALINA_HOME>/conf. The default
value of <CATALINA_HOME> is <INSTALLDIR>/bobje/tomcat55
Special configuration for BusinessObjects Enterprise in reverse proxy deployments

3. Locate this section in the server.xml file:



4. Uncomment the Connector element by removing .
5. Modify the value of proxyPort to be the reverse proxy server listen port.
6. Add a new proxyName attribute to the Connector’s attribute list. The value
of the proxyName must be the proxy server name which should be
resolvable to the correct IP address by Tomcat.
Example:


pareThreads="75"
enableLookups="false"
proxyName="my_reverse_proxy_server.domain.com"
proxyPort="ReverseProxyServerPort"
disableUploadTimeout="true" />
Where my_reverse_proxy_server.domain.com and ReverseProxy
ServerPort should be substituted by the correct reverse proxy server
name and its listen port.
7. Save and close the server.xml file.
8. Restart Tomcat.
9. Ensure the reverse proxy server maps its virtual path to the correct Tomcat
connector port. In the above example, the port is 8082.
7 Special configuration for BusinessObjects Enterprise in reverse proxy deployments

The following example shows a sample configuration for Apache HTTP
Server 2.2 to reverse proxy Business Objects Web Services deployed
on Tomcat:
ProxyPass /XI3.0/dswsbobje http://internalServer:8082/dsws
bobje
ProxyPassReverseCookiePath /dswsbobje /XI3.0/dswsbobje
To enable Webservices, the proxy name and port number have to be
identified for the connector.
Enabling reverse proxy for Developer Suite Web Services on
web application servers other than Tomcat
The following procedure requires that BusinessObjects Enterprise web
applications are successfully configured against your chosen web application
server. Note that the wsresources are case-sensitive.
1. Stop the web application server.
2. Specify the external URL of the Web Services in the dsws.properties
file.
This file is located in dswsbobje web application. For example if your
external is URL is http://my_reverse_proxy_server.do
main.com/XI3.0/dswsbobje/, update the following properties in the
dsws.properties file:
• wsresource1=ReportEngine|reportengine web service
alone|http://my_reverse_proxy_server.domain.com/XI3.0/dsws
bobje/services/ReportEngine
• wsresource2=BICatalog|bicatalog web service
bobje/services/BICatatog
• wsresource3=Publish|publish web service
bobje/services/Publish
• wsresource4=QueryService|query web service
bobje/services/QueryService

• wsresource5=BIPlatform|BIPlatform web service|http://my_re
verse_proxy_server.domain.com/XI3.0/dswsbobje/services/BI
Platform
• wsresource6=LiveOffice|Live Office web ser
vice|http://my_reverse_proxy_server.domain.com/XI3.0/dsws
bobje/services/LiveOffice
3. Save and close the dsws.properties file.
4. Restart the web application server.
5. Ensure the reverse proxy server maps its virtual path to the correct web
application server connector port. The following example shows a sample
configuration for Apache HTTP Server 2.2 to reverse proxy Business
Objects Web Services deployed on the web application server of your
choice:
ProxyPass /XI3.0/dswsbobje http://internalServer:<listening
port> /dswsbobje
ProxyPassReverseCookiePath /dswsbobje /XI3.0/dswsbobje
Where <listening port> is the listening port of your web application
server.
Enabling the root path for session cookies for ISA
2006
This section describes how to configure specific web application servers to
enable the root path for session cookies to work with ISA 2006 as the reverse
proxy server.
To configure Tomcat 5.5
To configure the root path for session cookies to work with ISA 2006 as the
reverse proxy server, add the following to the <Connector> element in
server.xml:
emptySessionPath="true"
1. Stop Tomcat

2. Open the server.xml which is located in:
<CATALINA_HOME>conf
3. Locate the following section in the server.xml file:



4. Uncomment the Connector element by removing .
5. To configure the root path for session cookies to work with ISA 2006 as
the reverse proxy server, add the following to the <Connector> element
in server.xml:
emptySessionPath="true"
6. Modify the value of proxyPort to be the reverse proxy server listen port.
7. Add a new proxyName attribute to the Connector's attribute list. The value
must be the proxy server name which should be resolvable to the correct
IP address by Tomcat.
For example:


maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" emptySessionPath="true"
proxyName="my_reverse_proxy_server.domain.com"
proxyPort="ReverseProxyServerPort"
disableUploadTimeout="true" />
9. Restart Tomcat.

Ensure the reverse proxy server maps its virtual path to the correct Tomcat
connector port. In the above example, the port is 8082.
To configure Sun Java 8.2
You need to modify the sun-web.xml for every BusinessObjects Enterprise
web application.
1. Go to <SUN_WEBAPP_DOMAIN>generatedxmlj2ee-mod
ules<WAR_FILE>WEB-INF
2. Open sun-web.xml
3. After the <context-root> container add the following:
<session-config>
<cookie-properties>
<property name="cookiePath" value="/" />
</cookie-properties>
</session-config>
<property name="reuseSessionID" value="true"/>
4. Save and close sun-web.xml.
5. Repeat steps1-4 for every web application.
To configure Oracle Application Server 10gR3
You need to modify the global-web-application.xml or orion-web.xml
for every BusinessObjects Enterprise web application's deployment directory.
1. Go to <ORACLE_HOME>j2eehomeconfig
2. Open global-web-application.xml or orion-web.xml.
3. Add the following line to the <orion-web-app> container:
<session-tracking cookie-path="/" />
4. Save and close the configuration file.
5. Logon to the Oracle Admin Console:
a. Go to OC4J:home > Administration > Server Properties .
b. Select Options under "Command Line Options".

c. Click Add another Row and type the following:
Doracle.useSessionIDFromCookie=true
6. Restart the Oracle server.
To configure WebSphere Community Edition 2.0
1. Open the WebSphere Community Edition 2.0 Admin Console.
2. In the left navigation panel find "Server" and select Web Server.
3. Select the connectors and click Edit.
4. Select the emptySessionPath checkbox and click Save.
5. Type your ISA server name inProxyName.
6. Type the ISA listerner port number in ProxyPort.
7. Stop and then restart the connector.
Enabling reverse proxy for BusinessObjects Live
Office
To enable BusinessObjects Live Office’s View Object in Web Browser feature
for reverse proxies, adjust the default viewer URL. This can be done in the
Central Management Console (CMC) or through Live Office options.
Note:
This section assumes reverse proxies for Business Objects Java InfoView
and Business Objects Web Services have been successfully enabled.
Related Topics
• Enabling reverse proxy for Developer Suite Web Services on page 373
To adjust the default viewer URL using the CMC
1. Log on to the CMC.
2. Navigate to the Applications page and click CMC.
3. Select Processing Extensions from the Actions menu.
4. In the URL field, set the correct default viewer URL and click Set URL.
For example:

http://ReverseProxyServer:ReverseProxyServerPort/ProxiedIn
foView/opendoc/openDocument.jsp?sIDType=CUID&iDocID=%SI_CUID%
Where ReverseProxyServer and ReverseProxyServerPort are the
correct reverse proxy server name and its listen port. ProxiedInfoView
is the correct virtual path for Java InfoView.
To adjust the default view URL using Live Office options
1. On the LiveOffice menu click Options and then click the Enterprise tab.
2. Select Specify the URL to view the report in repository and type the
correct URL in the adjacent field. For example:
http://ReverseProxyServer:ReverseProxyServerPort/ProxiedIn
foView/opendoc/openDocument.jsp
Where ReverseProxyServer and ReverseProxyServerPort are the
correct reverse proxy server name and its listen port. ProxiedInfoView
is the correct virtual path for Java InfoView.
Enabling reverse proxy for Business Process BI Web
Services
To enable reverse proxies for Business Process BI Web Services, you must
adjust the default viewer URL and enable reverse proxy on the web
application server.
Related Topics
• To adjust the default viewer URL using the CMC on page 379
• Enabling reverse proxy for Developer Suite Web Services on page 373
Enabling reverse proxy for Business Process BI on web
application servers other than Tomcat
Note:
The following procedure requires that BusinessObjects Enterprise web
applications are successfully configured for your chosen web application
server. Note that the wsresources are case-sensitive.

1. Stop the web application server.
2. Ensure the reverse proxy server maps its virtual path to the correct web
application server connector port. The following example shows a sample
configuration for Apache HTTP Server 2.2 to reverse proxy
BusinessObjects web services deployed on the web application server
of your choice:
ProxyPass /BusinessProcessBI http://internalServer:<listening
port>/BusinessProcessBI
ProxyPassReverseCookiePath /BusinessProcessBI
http://internalServer:<listening port>/BusinessProcess
BI
Where <listening port> is the listening port of your web application
server.

Improving performance
It is good practice to regularly assess the performance of your system and
make changes to account for future growth and potential problem areas.
First, you need to assess the current performance of your system. You can
assess your system's performance by talking to your users and delegated
administrators, and by studying your system metrics. When you have an
idea of potential problem areas, you can compare your system's performance
to expected service thresholds.
After you identify performance issues, you can take steps to account for them
by scaling your system or adjusting your configuration settings.
• Assessing your system's performance on page 384
• Performance risks and solutions on page 398
Note:
This section is for improving the performance of an existing deployment. For
information about If you haven't deployed your system yet, see the
BusinessObjects Enterprise Deployment Planning guide.
Assessing your system's performance
Before you change your settings to enhance performance, you need to
determine how well your system is currently performing. BusinessObjects
Enterprise provides server metrics that allow you to monitor and assess your
current processing problem areas.
To effectively assess your system's performance, you need to:
• Assess user needs.
Get qualitative feedback from your users. See Assessing user needs on
page 385.
• Analyze server metrics.
Check the server and system logs. For detailed instructions, see Analyzing
server metrics on page 386.
• Evaluate the performance of each server component.
Improving Performance
8 Improving performance

Compare the current system usage to recommended service thresholds.
Determine the required number of processors, services, and machines.
For more information, see Evaluating your system's performance on
page 395.
Assessing user needs
Talk to your users and delegated administrators. They can help you determine
which areas of your system are currently experiencing performance issues,
if any. They can also let you know where to anticipate higher system traffic
in the future. And there may be areas of the system that are not being used
at all.
For example, if your organization is hiring new people in the finance
department, the usage of financial reports will probably increase. If the
financial reports are Web Intelligence documents, you may need to add a
Web Intelligence Processing Server to handle the extra processing load. Or
if you're planning to switch from Web Intelligence documents to Crystal
reports, you may not need a Web Intelligence Processing Server at all.
It is good practice to conduct a company-wide survey concerning
BusinessObjects Enterprise usage in order to capture all of the current
problems and future changes. Ask your users about current performance
concerns, their average daily usage, and their anticipated future usage:
• What types of tasks are they performing and how often?
• Have they noticed slow performance when performing particular tasks?
• What types of objects do they use most often?
• Have they noticed slow performance when using particular types of
objects?
• Do they anticipate increasing or decreasing their use of the system in the
near future?
• Are they hiring new people?
• Do they plan to use BusinessObjects Enterprise to perform more tasks
in the future?
In particular, talk to publishers and determine what their Publishing needs
are. Some publishers require additional capacity for high-volume publications
8Improving Performance

that deliver personalized instances to many destinations and recipients. For
example, a publisher at an insurance company may run a billing publication
that generates thousands of personalized report instances for customers.
This scenario requires a deployment that can handle the high processing
load.
It is good practice to regularly re-assess your organization's needs. Follow
the steps you used when planning your deployment. For detailed instructions,
see the BusinessObjects Enterprise Deployment Planning Guide.
When you have a sense of the organization's performance issues, you can
verify them by viewing the current system metrics.
Analyzing server metrics
After you assess user needs, you can verify your users' current performance
concerns by monitoring system activity. Server metrics may also reveal other
areas where high server traffic may be an issue.
The CMC allows you to view server metrics over the Web. These metrics
include general information about each machine, along with details that are
specific to the type of server. The CMC also allows you to view system
metrics, which include information about your product version, your CMS,
and your current system activity.
Tip:
For an example of how to use server metrics in your own web applications,
see the "View Server Summary" sample on the BusinessObjects Enterprise
Admin Launchpad.
• Viewing current server metrics on page 386
• Viewing system metrics on page 393
Viewing current server metrics
The Servers management area of the CMC displays server metrics that
provide statistics and information about each BusinessObjects Enterprise
server. The general information displayed for each server includes information
about the machine that the server is running on—its name, operating system,
8 Assessing your system's performance

total hard disk space, free hard disk space, total RAM, number of CPUs, and
local time. The general information also includes the time the server started
and the version number of the server.
To view server metrics
2. Click the server whose metrics you want to view.
4. In the Properties dialog box, click Metrics in the navigation list.
The Metrics tab displays additional, server-specific information for some
servers. The Metrics tab is only for viewing information about the servers.
For information about changing server settings, see To change a server's
properties on page 405.
Additional server metrics
Input and Output File Repository Servers
For each File Repository Server, the Metrics tab provides the following metrics
for:
• data sent and data written
• the number of active files and active client connections
• the total available hard disk space
For information about changing these settings, see Setting root directories
and idle times of the File Repository Servers on page 182.
For the CMS, the Metrics tab provides the following additional metrics:
• the number of jobs that are failed, pending, running, completed, or waiting
• the number of licenses
• CMS system database information
For information about configuring the Central Management Server, see
Configuring server settings on page 155.

Connection Server
For the Connection Server, the Metrics tab lists additional information about
the types of datasources the Connection Server currently uses. Listed network
layers and associated databases have been set as active datasources in
the global configuration file of the Connection Server.
For more information about configuring the Connection Server, see the Data
Access Guide.
Job Servers
The Metrics tabs of these servers lists the following metrics:
• the location of its temporary files
• the processing mode
• the current number of jobs that are being processed
• the total number of requests received
• the total number of failed job creations
• the types of default destinations currently enabled
For information about changing these settings, see Configuring the processing
tier for enhanced performance on page 404.
Note:
This applies to all types of Job Servers, including Crystal Reports Job Servers,
Program Job Servers, Destination Job Servers, List of Values Job Servers,
Desktop Intelligence Job Servers, and Web Intelligence Job Servers.
For each Cache Server, the Metrics tab provides the following metrics:
• the number of bytes transferred
• the number of current connections
• the current cache size
• the number of requests served
• the cache hit rate
• the number of requests that are queued

The Metrics tab also displays the current values for the following settings,
which can be changed on the Properties tab:
• the number of minutes before an idle job is closed
• whether or not the database is accessed whenever a viewer's file (object)
is refreshed
• the location of the cache files
• the maximum cache size
• the number of minutes between refreshes from the database
The Metrics tab also provides a table that lists the Processing Servers that
the Cache Server has connections to, along with the number of connections
made to each Processing Server.
For information about changing these settings, see Modifying Cache Server
performance settings on page 404.
Desktop Intelligence Cache Server
For each Desktop Intelligence Cache Server, the Metrics tab provides the
following metrics:
• the current cache size
• the number of bytes transferred
• the cache hit rate
• the number of requests that are queued
• the maximum cache size
• the location of the cache files
• the number of minutes before an idle job is closed
• the number of minutes between refreshes from the database

• whether or not the database is accessed whenever a viewer's file (object)
is refreshed
• the number of documents to keep in the cache when the cache is full
• whether or not to share report data between clients
The Metrics tab also provides a table that lists the processing servers that
the Desktop Intelligence Cache Server has connections to, along with the
number of connections made to each server.
For information about changing these settings, see Modifying Cache Server
performance settings on page 404.
Note:
This server processes information only for Desktop Intelligence documents.
Event Server
For the Event Server, the Metrics tab displays statistics for each file that the
server is monitoring, including the file name and the last time the event
occurred.
For information about changing these settings, see Modifying the polling time
of the Event Server on page 403.
Desktop Intelligence Processing Server
For the Desktop Intelligence Processing Server, the Metrics tab provides the
following metrics:
• the current number of open processing threads running
• the total number of requests served
• the total bytes transferred
• the number of requests queued
• the maximum number of child processes
• the number of failed requests

• the location of temporary files
• idle connection timeout
• the maximum number of simultaneous report jobs
• the maximum number of operations allowed before resetting a report job
• whether a viewer refresh always hits the database
• whether or not report jobs are shared
• the number of minutes before an idle report job is closed
• the number of preloaded report jobs
• whether or not to share report data between clients
• the oldest processed data given to a client
For information about these settings, see Desktop Intelligence Server Settings
on page 1065.
Note:
This server processes information only for Desktop Intelligence documents.
Crystal Reports Processing Server
For the Crystal Reports Processing Server, the Metrics tab provides the
following metrics:
• the number of requests queued
• the number of failed requests
• the total bytes transferred
• the number of minutes before an idle connection is closed
• the location of temporary files
• the maximum number of simultaneous report jobs

• the minutes before a report job is closed
• the oldest processed data given to a client
• whether a viewer refresh always hits the database
• the maximum number of child processes
For information about changing these settings, see Crystal Reports Server
Settings on page 1045.
Note:
This server processes information only for Crystal Reports objects.
For the Web Intelligence Processing Server, the Metrics tab provides the
number of current requests and the total number of requests.
• the maximum number of connections
• the number of minutes before an idle connection is closed
• whether or not to enable document caching
• whether or not to enable real-time caching
• the number of minutes allowed for document caching
• the size of the document cache
• whether or not to enable list of values caching
• the batch size for lists of values
• the maximum size allowable for custom sorting a list of values
• the size of the universe cache
• the percentage of documents to keep in the cache when the cache is full
• the maximum number of minutes allowed for scanning the document
cache
• the maximum number of downloaded documents to cache
• the maximum size of binary and character files

For information about these settings, see Web Intelligence Server Settings
on page 1056.
Note:
This server processes information only for Web Intelligence documents.
The Metrics tab of the Report Application Server (RAS) shows the number
of reports that are open, and the number of reports that have been opened.
It also shows the number of open connections, along with the number of
open connections that have been created.
For information about these settings, see Crystal Reports Server Settings
on page 1045.
Viewing system metrics
The Settings management area of the CMC displays system metrics that
provide general information about your BusinessObjects Enterprise
installation. The "Properties" section includes information about the product
version and build. It also lists the data source, database name, and database
user name of the CMS database. The "View global system metrics" section
lists current account activity, along with statistics about current and processed
jobs. The "Cluster" section lists the name of the CMS you are connected to,
the name of the CMS cluster, and the names of other cluster members.
To view system metrics
1. Go to the Settings management area of the CMC.
2. Click the arrows to expand and view the settings for the Properties, View
global system metrics, and Cluster sections.
• For information about licenses and account activity, see Managing
Licenses on page 451.
• For information about CMS clusters, see Clustering Central
Management Servers on page 211.

Logging server activity
BusinessObjects Enterprise allows you to log specific information about
BusinessObjects Enterprise web activity. For details on locating and
customizing the web activity logs, see Auditing web activity on page 447.
• In addition, each of the BusinessObjects Enterprise servers is designed
to log messages to your operating system's standard system log.
• On Windows NT/2000, BusinessObjects Enterprise logs to the Event
Log service. You can view the results with the Event Viewer (in the
Application Log).
• On UNIX, BusinessObjects Enterprise logs to the syslog daemon as
a User application. Each server prepends its name and PID to any
messages that it logs.
Each server also logs assert messages to the logging directory of your
product installation. The programmatic information logged to these files is
typically useful only to Business Objects support staff for advanced debugging
purposes. The location of these log files depends upon your operating system:
• On Windows, the default logging directory is C:Program FilesBusi
ness ObjectsBusinessObjects Enterprise 12.0Logging
• On UNIX, the default logging directory INSTALL_ROOT/bobje/logging
directory of your installation.
The important point to note is that these log files are cleaned up automatically,
so there will never be more than approximately 1 MB of logged data per
server.
Note:
To enable logging to function on UNIX machines that are hosting
BusinessObjects Enterprise servers, you must set up and configure system
logging so that all messages logged to the “user” facility of “info” level or
higher are recorded. Setup procedures vary from system to system. Consult
your operating system documentation for specific instructions.

Evaluating your system's performance
After you collect enough anecdotal and statistical information about your
BusinessObjects Enterprise deployment, you can begin to isolate problem
areas.
Use the server metrics to verify the user feedback. Do the server metrics
confirm your users' performance concerns? If not, the performance issue
may be caused by something besides your BusinessObjects Enterprise
configuration, such as your network speed, the structure of the database, or
the complexity of your report design.
Then compare the current usage to the recommended service thresholds.
By comparing these numbers, you can rate each server's performance and
create a list of minor, moderate, and major performance risks.
To evaluate your system's performance
1. Make a list of all server components in your deployment.
2. For each server component, compare the information you received from
your users to the server metrics in the Central Management Console.
Note:
For information, see Analyzing server metrics on page 386.
3. Compare the server's current traffic metrics to the recommended service
thresholds. Pay particular attention to the number of simultaneous requests
and user connections.
For information about thresholds and estimates, see the BusinessObjects
Enterprise Deployment Planning Guide.
4. Sort the server components into the following categories:
A server component is considered
a minor risk if a low percentage of
your users report performance
problems and the server metrics do
not reflect the same problems.
Minor performance risk

a moderate risk if the server metrics
show that the current usage is close
to the limit of the recommended
service thresholds. You may also
want to flag a server component as
a moderate risk if a high percentage
of users report performance issues,
or if you expect an increase in us-
age that will cause the current us-
age numbers to meet the service
thresholds.
Moderate performance risk
a major performance risk if the
server metrics show that current
usage significantly exceeds the
minimum service thresholds. You
may also want to flag a server
component as a major risk if you
expect a substantial increase in
usage that will cause the usage
numbers to exceed the service
thresholds.
Major performance risk
5. After you isolate the key problem areas and the severity of the
performance issues, proceed to the next section: Performance risks and
solutions on page 398.
Resolving performance issues
After you assess your system and determine the potential trouble areas, you
can develop a strategy for resolving performance issues. The appropriate
solution for each server depends on the level of performance risk and the
type of server.
8 Resolving performance issues

Note:
For more information about evaluating your system's performance, see
Evaluating your system's performance on page 395.
• For minor or moderate performance issues, users encounter occasional
performance issues or your system approaches the limits of the
recommended service thresholds. You may be able to resolve these
issues by fine-tuning your system configuration.
For more information, see Configuring the intelligence tier for enhanced
performance on page 403 and Configuring the processing tier for enhanced
performance on page 404.
• For major performance issues, your server traffic significantly exceeds
the recommended service thresholds. You should consider expanding
the system by adding servers to account for the problem areas.
For more information about scaling considerations, see Scaling your
system on page 406. For installation instructions, see the BusinessObjects
Enterprise Installation Guide.
For example, when you install a default deployment of Business Objects
Enterprise, one Web Intelligence Processing Server is installed by default.
This deployment will easily meet your needs if you have under 20 concurrent
active users accessing the Web Intelligence Processing Server by working
with xCelsius or Web Intelligence documents. If you have 20 to 30 users
accessing the Web Intelligence Processing Server, you may encounter some
performance issues because you are reaching the limits of the recommended
service threshold. To account for some of these problems, you can tweak
the Web Intelligence Processing Server settings. (For details, see Web
Intelligence Server Settings on page 1056.) However, if your traffic is
significantly higher than the service threshold (such as 50 concurrent active
users using the Web Intelligence Report Server) then you need to scale your
system to include more instances of the Web Intelligence Processing Server
service.
The following table provides a quick reference for troubleshooting
performance for each type of server component:

Performance risks and solutions
SolutionsPerformance riskServer type
• Because the CMS
manages the entire
system, problems
that appear to be
CMS issues may be
caused by the server
components man-
aged by the CMS. It
is good practice to
check the perfor-
mance of all other
services before
adding new CMS
services. For other
information about
advanced CMS con-
figuration, see Serv-
er management
overview on
page 122.
• Minor/moderateCMS
• Install additional
CMS services. For
information, see In-
creasing overall sys-
tem capacity on
page 407.
• Major

• Change how often
the Event Server
checks for file
events. For more in-
formation, see Modi-
fying the polling time
of the Event Server
on page 403.
• Minor/moderateEvent Server
• It is unlikely that you
will encounter major
performance issues
with the Event Serv-
er. However, it is
good practice to in-
stall one Event Serv-
er for each CMS. For
information about in-
stalling additional
Event Servers, see
Scaling your system
on page 406.
• Major
• You can resolve
many issues by
changing Cache
Server properties
such as the maxi-
mum cache size and
the number of min-
utes between
database refreshes.
For more informa-
tion, see Modifying
Cache Server perfor-
mance settings on
page 404.
• Minor/moderateCache Server

• If your system ex-
ceeds 400 simultane-
ous requests, install
an additional Cache
Server. See Scaling
your system on
page 406.
• Major
• If the number of si-
multaneous jobs
does not exceed the
recommended
threshold of 20 jobs,
check the Maximum
Jobs Allowed setting.
For more informa-
tion, see Core Server
Settingsonpage1030.
• Minor/moderateJob Servers
• If the Job Server is
running more than
20 simultaneous jobs
on average, install
another Job Server
service. See Scaling
your system on
page 406.
• Major
• If the number of con-
current active users
does not exceed 25,
try changing the set-
tings. See Desktop
Intelligence Server
Settingsonpage1065.
• Minor/moderateDesktop Intelligence
Processing Server

exceeds 25, install
addition servers. See
Scaling your system
on page 406.
• Major
does not exceed 25,
try changing the set-
tings. See Web Intel-
ligence Server Set-
tings on page 1056.
• Minor/moderateWeb Intelligence Pro-
cessing Server
exceeds 25, install
addition servers. See
Increasing scheduled
reporting capacity on
page 407.
• Major
• To adjust the Report
Application Server's
settings for connec-
tion idle time and the
maximum number of
simultaneous
threads, see Crystal
Reports Server Set-
tings on page 1045.
• Minor/moderateReport Application
Server

• If your users run
more than 200 simul-
taneous requests, in-
stall additional Re-
port Application
Servers. For more
information, see In-
creasing on-demand
viewing capacity for
Crystal reports on
page 409.
• Major
• You can change how
a Crystal Reports
Processing Server
handles data and us-
er connections by
fine-tuning its set-
tings. See Crystal
Reports Server Set-
tings on page 1045.
• Minor/moderateCrystal Reports Process-
ing Server
• If the Crystal Reports
Processing Server is
handling more than
400 simultaneous
viewing sessions, in-
stall more processing
servers. For more in-
formation, see In-
creasing on-demand
viewing capacity for
Crystal reports on
page 409.
• Major

Configuring the intelligence tier for enhanced performance
This section provides instructions for configuring settings for components
from the intelligence tier. You can adjust the settings to account for minor
and moderate performance issues.
Note:
For more information about the intelligence tier, see Configuring server
Configuring the intelligence tier includes:
• Configuring the CMS on page 403
• Modifying the polling time of the Event Server on page 403
• Configuring the File Repository Servers on page 404
• Modifying Cache Server performance settings on page 404
Configuring the CMS
Because the CMS manages the entire system, problems that appear to be
CMS issues are often caused by the server components managed by the
CMS. It is good practice to check the performance of all other services before
changing the CMS settings or adding and clustering new CMS services.
Settings for the CMS are already discussed in great detail in the “Managing
and Configuring Servers” chapter. A list of CMS properties can be found in
the “Core Server Settings” section of the “Server Properties Appendix”.
Related Topics
• Configuring server settings on page 155
• Clustering Central Management Servers on page 211
Modifying the polling time of the Event Server
The Properties tab of the Event Server allows you to change the frequency
with which the Event Server checks for file events. This "Event Poll Interval"
setting determines the number of seconds that the server waits between
polls. The minimum value is 1 (one). It is important to note that, the lower
the value, the more resources the server requires.

To modify the polling time
2. Select the Event Server whose settings you want to change.
4. On the Properties tab, provide a new value for the Event Poll Interval
field.
Note:
The value that you type must be 1 or greater.
Configuring the File Repository Servers
The Properties tabs of the Input and Output File Repository Servers allow
you to set the maximum idle time. For more information, see Setting root
directories and idle times of the File Repository Servers on page 182. For a
full list of Input and Output File Repository Server settings, see Core Server
Settings on page 1030.
Modifying Cache Server performance settings
The Properties tab of the Cache Server allows you to set the location of the
cache files, the maximum cache size, the maximum number of simultaneous
processing threads, the number of minutes before an idle job is closed, and
the number of minutes between refreshes from the database.
To modify Cache Server performance settings
2. Select the Cache Server whose settings you want to change.
4. Make your changes on the Properties tab.
Configuring the processing tier for enhanced performance
This section provides instructions for configuring settings for components
from the processing tier.

Note:
For more information about the processing tier, see Configuring server
Configuring the processing tier includes modifying the performance settings
for the following server types:
• Job Servers.
For a list of Job Server properties, see “Core Server Settings”.
By default, job servers run jobs as independent processes rather than as
threads. This method allows for more efficient processing of large, complex
reports.
• Desktop Intelligence Report Servers and Desktop Intelligence Processing
Servers.
• Web Intelligence Report Servers and Web Intelligence Processing Servers.
• Report Application Servers and Crystal Reports Processing Servers.
Note:
The RAS must have been installed and configured in order to use the
List of Values Job Server.
Related Topics
• Desktop Intelligence Server Settings on page 1065
• Web Intelligence Server Settings on page 1056
• Crystal Reports Server Settings on page 1045
To change a server's properties
2. Select the server whose settings you want to change.
4. Make the changes you want, then click Save or Save & Close.
Note:
Not all changes occur immediately. If a setting cannot change immediately,
the Properties dialog box display both the current setting (in red text) and
the desired setting. When you return to the Servers management area,

the server will be marked as Stale. When you restart the server, it will
use the desired settings from the Properties dialog box and the Stale flag
is removed from the server.
Scaling your system
The BusinessObjects Enterprise architecture allows for a multitude of server
configurations, ranging from stand-alone, single-machine environments, to
large-scale deployments supporting global organizations.
For information about adding and deleting servers from your BusinessObjects
Enterprise installation, see Adding, cloning, and deleting servers on page 145
This section provides information about system scalability and the
BusinessObjects Enterprise servers that are responsible for particular aspects
of your system. Each subsection focuses on one aspect of your system's
capacity, discusses the relevant components, and provides a number of
ways in which you might modify your configuration accordingly.
Before modifying these aspects of your system, it is strongly recommended
that you contact your Business Objects sales representative and request
information about the BusinessObjects Enterprise Sizing Guide. A Business
Objects Services consultant can then assess your reporting environment
and assist in determining the configuration that will best integrate with your
current environment.
General scalability considerations include the following:
• Increasing overall system capacity on page 407
• Increasing scheduled reporting capacity on page 407
• Increasing on-demand viewing capacity for Crystal reports on page 409
• Increasing prompting capacity on page 410
• Enhancing custom web applications on page 410
• Improving web response speeds on page 411
• Getting the most from existing resources on page 412

Increasing overall system capacity
As the number of report objects and users on your system increases, you
can increase the overall system capacity by clustering two (or more) Central
Management Servers (CMS). You can install multiple CMS services/daemons
on the same machine. However, to provide server redundancy and
fault-tolerance, you should ideally install each cluster member on its own
machine.
CMS clusters can improve overall system performance because every
BusinessObjects Enterprise request results, at some point, in a server
component querying the CMS for information that is stored in the CMS
database. When you cluster two CMS machines, you instruct the new CMS
to share in the task of maintaining and querying the CMS database.
For more information, see Clustering Central Management Servers on
page 211.
Increasing scheduled reporting capacity
Increasing Crystal reports processing capacity
All Crystal reports that are scheduled are eventually processed by a Job
Server. You can expand BusinessObjects Enterprise by running individual
Report Job Servers on multiple machines, or by running multiple Report Job
Servers on a single multi-processor machine.
If the majority of your reports are scheduled to run on a regular basis, there
are several strategies you can adopt to maximize your system's processing
capacity:
• Install the Job Server in close proximity to (but not on the same machine
as) the database server against which the reports run. Ensure also that
the File Repository Servers are readily accessible to all Job Server (so
they can read report objects from the Input FRS and write report instances
to the Output FRS quickly). Depending upon your network configuration,
these strategies may improve the processing speed of the Job Server,
because there is less distance for data to travel over your corporate
network.
• Verify the efficiency of your reports. When designing reports in Crystal
Reports, there are a number of ways in which you can improve the
performance of the report itself, by modifying record selection formulas,
using the database server's resources to group data, incorporating

parameter fields, and so on. For more information, see the "Designing
Optimized Web Reports" section in the Crystal Reports User's Guide
(version 8.5 and later).
• Use event-based scheduling to create dependencies between large or
complex reports. For instance, if you run several very complex reports
on a regular, nightly basis, you can use Schedule events to ensure that
the reports are processed sequentially. This is a useful way of minimizing
the processing load that your database server is subject to at any given
point in time.
• If some reports are much larger or more complex than others, consider
distributing the processing load through the use of server groups. For
instance, you might create two server groups, each containing one or
more Job Servers. Then, when you schedule recurrent reports, you can
specify that it be processed by a particular server group to ensure that
especially large reports are distributed evenly across resources.
• Increase the hardware resources that are available to a Job Server. If the
Job Server is currently running on a machine along with other
BusinessObjects Enterprise components, consider moving the Job Server
to a dedicated machine. If the new machine has multiple CPUs, you can
install multiple Job Servers on the same machine (typically no more than
one service/daemon per CPU).
Increasing Web Intelligence document processing capacity
All Web Intelligence documents that are scheduled are eventually processed
by a Web Intelligence Job Server and Web Intelligence Processing Server.
You can expand BusinessObjects Enterprise by running individual Web
Intelligence Processing Servers on multiple machines, or by running multiple
Web Intelligence Processing Servers on a single multi-processor machine.
When running multiple Web Intelligence Processing Servers, you don't need
to duplicate the Web Intelligence Job Server. One Web Intelligence Job
Server can be used to drive multiple Web Intelligence Processing Servers.
However, if you are working with server groups, a Web Intelligence Job
Server must exist in the same group as the Web Intelligence Processing
Servers.
Note:
When deciding whether to increase the number Web Intelligence Processing
Servers, keep in mind that Web Intelligence Processing Server processes

both scheduling and viewing requests, whereas requests for Crystal reports
are processed by three separate servers, the Report Job Server, the Crystal
Reports Cache Server and Crystal Reports Processing Server.
Increasing on-demand viewing capacity for Crystal reports
When you provide many users with View On Demand access to reports, you
allow each user to view live report data by refreshing reports against your
database server. For most requests, the Crystal Reports Processing Server
retrieves the data and performs the report processing, and the Crystal Reports
Cache Server stores recently viewed report pages for possible reuse.
However, if users use the Advanced DHTML viewer, the Report Application
Server (RAS) processes the request.
If your reporting requirements demand that users have continual access to
the latest data, you can increase capacity in the following ways:
• Increase the maximum allowed size of the cache. For details, see
Modifying Cache Server performance settings on page 404.
• Verify the efficiency of your reports. When designing reports in Crystal
Reports, there are a number of ways in which you can improve the
performance of the report itself, by modifying record selection formulas,
using the database server's resources to group data, incorporating
parameter fields, and so on. For more information, see the "Designing
Optimized Web Reports" section in the Crystal Reports User's Guide
(version 8.5 and later).
• Increase the number of Crystal Reports Processing Servers that service
requests on behalf of Cache Servers. You can do this by installing
additional Processing Servers on multiple machines. However, do not
install more than one Processing Server per machine; the Processing
Server automatically creates new server instances based on demand.
• Increase the number of Crystal Reports Processing Servers, Cache
Servers, and Report Application Servers on the system, and then distribute
the processing load through the use of server groups. For instance, you
might create two server groups, each containing one or more Cache
Server/Processing Server pairs along with one or more Report Application
Servers. You can then specify individual reports that should always be
processed by a particular server group.

Increasing prompting capacity
When reports use a list of values, the RAS processes on-demand
list-of-values objects for the report when the report is being viewed. Scheduled
list-of-values objects are processed by the List of Values Job Server without
using RAS.
To avoid contention with other applications that use the RAS, you can add
a RAS server that will be dedicated to processing list-of-value objects. In
CMC you can then create a RAS server group and assign the dedicated
RAS to the RAS server group. In Business View Manager, you then assign
the list-of-values objects to be processed by the RAS server group.
Delegating XSL transformation to Internet Explorer
If your users access InfoView via the Internet Explorer 6.0 browser, you can
instruct the Web Intelligence Processing Server to delegate the transformation
of XML to XSL to the browser. This substantially decreases the load on the
server, primarily during document display, but also during display of the portal
itself.
By default, the XSL transformation delegation is not activated.
To delegate XSL transformation to the browser for document display
1. On the application server, set the CLIENT_XSLT variable in
webiviewer.properties, located in the WEB-INFclasses subfolder of the
application server as follows:
CLIENT_XSLT=Y
2. Restart the application server.
Enhancing custom web applications
If you are developing your own custom desktops or administrative tools with
the BusinessObjects Enterprise Software Development Kit (SDK), be sure
to review the libraries and APIs. You can now, for instance, incorporate
complete security and scheduling options into your own web applications.
You can also modify server settings from within your own code in order to
further integrate BusinessObjects Enterprise with your existing intranet tools
and overall reporting environment.
To improve the scalability of your system, consider distributing administrative
efforts by developing web applications for delegated content administration.
You can grant select users the ability to manage particular BusinessObjects

Enterprise folders, content, users, and groups on behalf of their team,
department, or regional office.
In addition, be sure to check the developer documentation available on your
BusinessObjects Enterprise product CD for performance tips and other
scalability considerations. The query optimization section in particular provides
some preliminary steps to ensuring that custom applications make efficient
use of the query language.
Improving web response speeds
Because all user interaction with BusinessObjects Enterprise occurs over
the Web, you may need to investigate a number of areas to determine exactly
where you can improve web response speeds. These are some common
aspects of your deployment that you should consider before deciding how
to expand BusinessObjects Enterprise:
• Assess your web server's ability to serve the number of users who connect
regularly to BusinessObjects Enterprise. Use the administrative tools
provided with your web server software (or with your operating system)
to determine how well your web server performs. If the web server is
indeed limiting web response speeds, consider increasing the web server's
hardware.
• If web response speeds are slowed only by report viewing activities, see
Increasing scheduled reporting capacity on page 407 and Increasing
on-demand viewing capacity for Crystal reports on page 409.
• Take into account the number of users who regularly access your system.
If you are running a large deployment, ensure that you have set up a
CMS cluster. For details, see Increasing overall system capacity on
page 407.
If you find that a single application server inadequately services the number
of scripting requests made by users who access your system on a regular
basis, increase the hardware resources that are available to the application
server. If the application server is currently running on the web server, or on
a single machine with other BusinessObjects Enterprise components,
consider moving the application server to a dedicated machine.
Note:
BusinessObjects Enterprise does not support the session-replication
functionality provided by some Java web application servers.

Getting the most from existing resources
One of the most effective ways to improve the performance and scalability
of your system is to ensure that you get the most from the resources that
you allocate to BusinessObjects Enterprise.
• Optimizing network speed and database efficiency on page 412
• Using the appropriate processing server on page 412
• Optimizing BusinessObjects Enterprise for report viewing on page 413
Optimizing network speed and database efficiency
When thinking about the overall performance and scalability of
BusinessObjects Enterprise, don't forget that BusinessObjects Enterprise
depends upon your existing IT infrastructure. BusinessObjects Enterprise
uses your network for communication between servers and for communication
between BusinessObjects Enterprise and client machines on your network.
Make sure that your network has the bandwidth and speed necessary to
provide BusinessObjects Enterprise users with acceptable levels of
performance. Consult your network administrator for more information.
BusinessObjects Enterprise processes reports against your database servers.
If your databases are not optimized for the reports you need to run, then the
performance of BusinessObjects Enterprise may suffer. Consult your
database administrator for more information.
Using the appropriate processing server
When users view a report using the Advanced DHTML viewer, the report is
processed by the Report Application Server rather than the Crystal Reports
Processing Server and Cache Server. The Report Application Server is
optimized for report modification. For simple report viewing you can achieve
better system performance if users select the DHTML viewer, the Active X
viewer, or the Java viewer. These report viewers process reports against
the Crystal Reports Processing Server.
If the ability to modify reports is not needed at your site, you can disable the
Advanced DHTML viewer for all users of BusinessObjects Enterprise.

Disabling the Advanced DHTML Viewer
1. In the Central Management Console, go to the Applications management
area.
2. Select Web Desktop, then choose Properties from the Manage menu.
3. In the Viewers area, clear the option labeled Allow users to use the
Advanced DHTML Viewer.
4. Click Update.
Optimizing BusinessObjects Enterprise for report viewing
BusinessObjects Enterprise allows you to enable data sharing, which permits
different users accessing the same report object to use the same data when
viewing a report on demand or when refreshing a report. Enabling data
sharing reduces the number of database calls, thereby reducing the time
needed to provide report pages to subsequent users of the same report while
greatly improving overall system performance under load. However, to get
full value from data sharing, you must permit data to be reused for some
period of time. This means that some users may see "old" data when they
view a report on demand, or refresh a report instance that they are viewing.
For details on data sharing options for reports, see the BusinessObjects
Enterprise Administrator's Guide. For more information on configuring
BusinessObjects Enterprise to optimize report viewing in your system, see
the planning section in the BusinessObjects Enterprise Installation Guide.
Improving Publishing performance
As an administrator, you may be required to perform deployment configuration
and troubleshooting tasks on behalf of publishers to optimize Publishing
performance. This section contains general deployment recommendations
and specific server configuration tips. For troubleshooting information related
to publication design, see the “Recommendations and Troubleshooting for
Publications” chapter in the BusinessObjects Enterprise Publisher's Guide.

General deployment recommendations
Recommendations for disk usage
Follow these disk usage recommendations to improve Publishing
performance:
• Ensure your server machines and peripheral devices have the speed and
capability to handle high-volume publications.
• Use multiple striped disks.
• Move the Output File Repository Server (FRS) to a dedicated clustered
node with striped disks.
• Physically separate the Input FRS and Output FRS.
• Provide the Input FRS and Output FRS with separate disk controllers.
Recommendations for server machines
Follow these recommendations for your server machines:
• In Windows, to reduce the time required to create files, use the fsutil
behavior set disable8dot3 command to disable the creation of 8.3 short
file names. You must restart your computer for this setting to take effect.
For more information, see the article available at http://support.mi
crosoft.com/kb/121007.
• Ensure that the CPU, RAM, and hard disk on the CMS database machine
is powerful enough for high-volume scenarios.
Configuring servers in the CMC to optimize
Publishing performance
In general, you can do the following to optimize server performance for
Publishing:
• In the "Servers" area of the CMC, disable unnecessary servers. For
example, if you are running a Crystal reports publication only, you can
disable Desktop Intelligence and Web Intelligence servers. However,
before you do this, ensure that the servers that you want to disable are
not being used by other users in the system.
8 Improving Publishing performance

• For Job Servers that are used in Publishing, ensure that Maximum
Concurrent Jobs is set to five per CPU. To do this, in the "Servers" area,
select the Job Server and click Manage > Properties.
Consider changing the level of detail logged by the Adaptive Processing
Server.
Note:
Increasing the level of detail in log files may affect server performance.
The default (and recommended) setting for the level of detail in log files is
ERROR. However, you or your publisher may want to increase the level of
detail in Adaptive Processing Server log files to better track the progress of
publication jobs. To do this, in the "Servers" area, select the Adaptive
Processing Server and click Manage > Properties. On the "Log level" list,
select INFO. INFO gives you more details such as the following:
• The publication has been delivered successfully to a recipient.
• A batch of recipients has been processed successfully.
• Post-processing publication extensions have been initialized.
Configure the Adaptive Processing Server to handle more jobs.
The following recommendations can improve the performance of the Adaptive
Processing Server:
• If several publications are running concurrently, create multiple instances
of the Adaptive Processing Server. In general, it is recommended that
you have one Adaptive Processing Server instance for every three
concurrent publications.
• Increase the heap size for the Adaptive Processing Server. To do this,
click Manage > Properties, and add the following to the command-line
parameter: -Xmx1024M.
• Run the Publishing Service and Publishing Post-Processing Service on
different instances of the Adaptive Processing Server.
If your publisher wants to enable auditing and clean-up, configure auditing
for the CMS so that it logs all details.
For high-volume publications, it is recommended that the publisher enable
clean-up to delete unnecessary files generated by the publication job and
conserve server space. To do this, during the publication design process,
the publisher will deselect the default Enterprise location as a destination.

If auditing has been enabled for Publishing, you must configure the CMS to
support this scenario so that the details of the deleted files are still recorded.
In the "Servers" area, select the CMS and click Manage > Properties. In
the dialog box that appears, click Audit Events on the navigation list. Ensure
Auditing is Enabled and Object Deleted are selected.
Ensure that the email settings are configured properly for the Destination
Job Server.
Publications that are intended for email destinations may fail because email
has not been configured properly as a destination for the Destination Job
Server. In the "Servers" area of the CMC, double-click the Destination Job
Server. In the "Properties" dialog box, click Destination on the navigation
list to ensure the following:
• Email has been added as a destination.
• The values in the Domain Name, Host, and Port fields are correct.
• The To field contains %SI_EMAIL_ADDRESS%.
Increase the number of concurrent jobs that the Destination Job Server
can process.
If publications are intended for the default Enterprise location or an
unmanaged disk destination, and you use striped disks for the Output FRS,
it is recommended that you set the maximum number of concurrent jobs as
the number of disks multiplied by five.
If the publisher uses Crystal report dynamic recipient sources, ensure the
Report Application Server (RAS) is configured correctly.
The RAS must be configured to read at least the same number of database
records as the number of recipients in the dynamic recipient source. For
instance, to process a dynamic recipient source with data for 100,000
recipients, the RAS must be set to read more than 100,000 database records.
To check this setting, in the "Servers" area of the CMC, select the RAS and
go to Manage > Properties. In the Number of database records to read
when previewing or refreshing a report field, ensure the number is correct
or enter a new number.

Resolving “Out of memory” errors
If the publisher receives the error message java.lang.OutOfMemoryError:
unable to create new native thread when a high-volume publication
is run, it is because the Adaptive Processing Server and Publishing Service
have insufficient stack memory to handle the number of Publishing threads
that are generated. This error can occur if stack memory is designated as
Java heap space.
You can set a thread limit for the Adaptive Processing Server. In the "Servers"
area of the CMC, select the Adaptive Processing Server and go to Manage
> Properties. In the Command Line Parameters field, enter the following
command line parameter:
-Dcom.businessobjects.publisher.threadpool.size=threadlimitnumber
Replace threadlimitnumber with the thread limit number that you want.
If the publisher receives the error message java.lang.OutOfMemoryError:
Java heap space when you run a high-volume publication, it is because
the Adaptive Processing Server has insufficient heap space. In the "Servers"
area of the CMC, select the Adaptive Processing Server and go to Manage
> Properties. In the Command Line Parameters field, change the number
in the command-line parameter -Xmx256m to a larger number (for example,
-Xmx1024m).
Note:
In some cases, you may have to create more instances of the Adaptive
Processing Server to resolve “Out of memory” errors.

Biar Command Line Tool
The BIAR Engine Command Line Tool helps administrators and delegated
administrators to promote content between Development, Quality Assurance,
and Production BusinessObjects Enterprise XI 3.0 environments. The tool
gives you the ability to use scripting to automate the import and export of
objects.
The BIAR Command Line Tool only supports migrating objects from one XI
3.x system to another. You cannot use the tool to import objects from
BusinessObjects, Crystal Enterprise, or earlier version of BusinessObjects
Enterprise. You must use the Import Wizard to import content from previous
versions of BusinessObjects to XI 3.x.
The Biar Engine Command Line tool is called biarengine.jar. On a windows
environment, this file is located at Install DirectoryBusiness Ob
jectscommon4.0javalib. On UNIX, the file is located at Install Di
rectory/bobje/java/lib/.
InstallEntSdkWrapper.jar, the command-line tool for importing BIAR files
in BusinessObjects Enterprise XI Release 2, is not supported with
BusinessObjects Enterprise XI 3.x. You must use biarengine.jar when
importing content from BIAR files in BusinessObjects Enterprise XI 3.x.
Note:
• You must have a Java Runtime Environment installed. For supported a
list of supported JREs, please see the BusinessObjects Enterprise
supported platform document guide online on our support web site:
http://support.businessobjects.com/documentation/supported_platforms.
• To use the BIAR Command Line Tool, you must have the Administrator
account credentials for the XI 3.x environment that you are importing
content to or from. You can also use a Delegated administrator account.
For more information on using delegated administration to import content,
see the BusinessObjects Enterprise XI 3.x Import Wizard Guide.
The BIAR Command Line Tool imports the following types of objects:
BIAR Command Line Tool
9 Biar Command Line Tool

PDFs
PowerPoint Presentations
Profiles
Programs
Prompt Groups
Publications
Query as a Webservice
Reports
Report Instances
Rich Text Format Documents
Server Groups
Shortcuts
Text Files
Universes
User Groups
Voyager Connections
Voyager Workspaces
Web Intelligence Documents
WinAD Users
WinNT Users
Word Documents
Xcelcius Documents
XcelciusDMTTemplates
Agnostic Documents
Analytic Objects
BI Modeler Objects
Business Views
Calendars
Categories
Client Actions
Custom Roles
Dashboards
Desktop Intelligence Documents
Discussions
Encyclopedias
Enterprise Users
Events
Excel Spreadsheets
Flash Files
Folders
FullClientAddins
FullClientTemplates
Hyperlinks
LDAP Users
LOVs
Object Packages
Overloads
9BIAR Command Line Tool
Biar Command Line Tool

Importing relationships
The BIAR Command Line Tool only keeps the relationships between imported
objects intact if both objects are imported together, or if one of the objects
already exists on the destination. For example, if you have a Web Intelligence
Report that uses a Universe, and you import the Report without also importing
the Universe, the relationship between the two is dropped. The Report will
not run on the destination.
Importing users and groups
If you are importing groups and users into a XI 3.0 environment, and a group
already exists on the destination, the group membership on the destination
is overwritten with the group membership that was exported from the biar
file. This means if the group on the destination has additional users that are
not contained in the group in the BIAR file group, they will not be part of the
group after the import occurs.
Importing rights
The BIAR Engine Command Line Tool only imports rights on an object if the
user/group is either exported with the object or already exists on the
destination.
If the user/group and object already exist on the destination, the Tool
overwrites the rights set on the object for this user/group on the destination
with the imported rights.
However, if an object already exists on the destination and a user/group has
rights specified on that object on the destination, but no rights for this
user/group are specified on the object in the BIAR file, the Tool does not
remove the existing rights for the user/group.
This means that rights that exist on a destination object can be overwritten,
but never removed.
Using Multiple BIAR files
When using the BIAR Engine Command Line Tool to export content, the
content is placed in a BIAR file. The location and name of the BIAR file is
determined by exportBiarLocation parameter. When you export content
that exceeds the amount of information that can be stored in a single BIAR
file, the Tool splits the information and stores it in multiple BIAR files. The
9 Biar Command Line Tool

files use the name that you specify, and will have numbers added to the end
of the file name.
For example, if you set exportBiarLocation= C:Archive.biar, and you
export more content than can fit in a single BIAR file, the Tool creates the
files Archive.biar, Archive1.biar, Archive2.biar, and so on. The Tool
creates the files in the directory C: .
Note:
If you want to import content that is stored in multiple BIAR files, you must
ensure that all of the BIAR files are located in the same directory.
The Biar Engine Command Line Tool's
Properties File
The Biar Engine Command Line Tool requires a properties files that contains
the parameters that tell the BIAR Engine what actions to take, what
BusinessObjects Enterprise system to connect to and so on.
The file must have a .properties file extension. For example: Myproper
ties.properties
ExampleDescriptionAllowed ValuesParameter
Action=exportXML
Specifies whether the
Tool imports content
from a BIAR file to a
BusinessObjects En-
terprise system, or
exports the content
from a deployment to
a BIAR file.
Mandatory.
exportXML, im
portXML
Action
The Biar Engine Command Line Tool's Properties File

exportBiarLoca
tion=C:/BiarExport
File.biar
Specifies where the
Tool saves the export-
ed BIAR file.
Mandatory if ac
tion=exportXML.
Free form text. Must
include a .biar ex-
tension.
exportBiarLoca
tion
importBiarLoca
tion=C:/BiarImport
File.biar
Specifies where the
BIAR file that is to be
import is located.
BIAR files are split if
the contents are too
large to fit into one
BIAR file.
You can enter any of
the BIAR file parti-
tions, but you must
ensure all of the parti-
tions are in the same
directory
Mandatory if ac
tion=importXML.
Free form text. Must
include a .biar ex-
tension.
importBiarLoca
tion
userName=Adminis
trator
The username of the
an administrative ac-
count that the tool
should use to con-
nect to the Central
Management Server
(CMS). This can be
the username of a
DelegatedAdministra-
tor account.
Mandatory.
Free form text.userName
9 The Biar Engine Command Line Tool's Properties File

password=password
The password for the
administrative ac-
count .
Mandatory.
Free form text.password
authentication=secEn
terprise
The authentication
type that Tool uses.
Optional. If you don't
specify an authentica-
tion type, the default
is secEnterprise.
secEnterprise,
secWinAd, secLdap
authentication
CMS=mycms:6400
The name of the
CMS that you want
to connect to.
Mandatory.
Free form text.CMS

exportDependen
cies=false
Specifies whether to
import all dependen-
cies of an object.
This should be used
with care as it im-
ports all the objects
that are associated
with any selected ob-
jects. This can in-
crease the size of a
BIAR file quite dra-
matically.
specify a value, the
default is False.
Only used if ac
tion=exportXML.
True, False
exportDependen
cies

includeSecurity=false
Specifies whether the
Tool exports and im-
ports security associ-
ated with the objects
and users that you
select. If you want to
maintain security it is
important to set in
cludeSecurity to
true when exporting
and importing con-
tent.
Note:
If you are using Ac-
cess Levels, you must
explictly export these
objects.
specify a value for
this parameter, the
default is True.
True, FalseincludeSecurity

exportQuery=select
* from ci_Infoobjects
where si_name =
'Xtreme Employees'
and si_kind = 'Webi'
The queries the Tool
should execute to
gather the desired
objects for exporta-
tion.
You can use as
many queries as you
like in a single proper-
ties file, but the
queries must be
named “export-
Query1”, “export-
Query2”, and so on.
Mandatory if ac
tion=exportXML.
Free form text, must
use the CMS query
language format.
exportQuery
exportQueriesTo
tal=5
Specifies how many
export queries the
tool executes. If you
have x export queries
and want to execute
them all, you must
set this parameter to
x.
provide a value for
this parameter, the
default value is 1.
Only used if ac
tion=exportXML.
Positive whole num-
bers.
exportQueriesTo
tal

Note:
To comment lines out, use the # character. For example:
action=importXML
#exportLocation=C:/mybiar.biar
importLocation=C:/mybiar.biar
This is an example of a properties file that imports content from a BIAR file.
#This file imports a biar, note this line is a comment
importBiarLocation=C:/CR.biar
action=importXML
userName=Administrator
password=
CMS=vanmsung01:6400
authentication=secEnterprise
This is an example of a properties file that exports a WebIntelligence report
named “Xtreme Employees” to a BIAR file:
#This file exports a single report
# Remember to include indexed properties with your query!
# The more indexed properties, the better!
exportBiarLocation=C:/CR.biar
action=importXML
userName=Administrator
password=
CMS=vanmsung01:6400
authentication=secEnterprise
exportDependencies=false
exportQuery= select * from ci_Infoobjects where si_name =
'Xtreme Employees' and si_kind = 'Webi'
To use the BIAR Command Line Tool
1. Open a command line window.
2. In the command line window, navigate to the directory where the tool is
located.
For example, Install DirectoryBusiness Objectscommon4.0ja
valib .
3. Execute the biarengine.jar.
For example, java -jar biarengine.jar <properties file>
To use the BIAR Command Line Tool

The BIAR Engine Command Line Tool either exports content from
BusinessObjects Enterprise deployment to a BIAR file, or imports the
content from a BIAR file to a BusinessObjects Enterprise deployment,
depending on the action parameter in the properties file.
9 To use the BIAR Command Line Tool

This section details the ways in which BusinessObjects Enterprise addresses
enterprise security concerns, thereby providing administrators and system
architects with answers to typical questions regarding security.
• Authentication and authorization on page 433
• Security plug-ins on page 440
• Active trust relationship on page 443
• Sessions and session tracking on page 445
• Environment protection on page 446
• Auditing web activity on page 447
Security overview
The BusinessObjects Enterprise architecture addresses the many security
concerns that affect today's businesses and organizations. The current
release supports features such as distributed security, single sign-on,
resource access security, granular object rights, and third-party Windows
NT, LDAP, and Windows AD authentication in order to protect against
unauthorized access.
Because BusinessObjects Enterprise provides the framework for an
increasing number of components from the Enterprise family of Business
Objects products, this section details the security features and related
functionality to show how the framework itself enforces and maintains security.
As such, this section does not provide explicit procedural details; instead, it
focuses on conceptual information and provides links to key procedures.
• Authentication and authorization on page 433
• Security plug-ins on page 440
• Active trust relationship on page 443
• Sessions and session tracking on page 445
• Environment protection on page 446
Security Concepts
10 Security overview

• Auditing web activity on page 447
• For key procedures that show how to modify the default accounts,
passwords, and other security settings, see BusinessObjects Enterprise
• For procedures that show how to set up authentication for Enterprise
users, see BusinessObjects Enterprise Administrator's Guide. For the
basic information on how to set up third-party authentication to work with
BusinessObjects Enterprise, see the following sections:
• Using NT Authentication on page 456
• Using LDAP authentication on page 467
• Using AD authentication on page 486
Authentication is the process of verifying the identity of a user who attempts
to access the system, and authorization is the process of verifying that the
user has been granted sufficient rights to perform the requested action upon
the specified object.
This section describes the authentication and authorization processes in
order to provide a general idea of how system security works within
BusinessObjects Enterprise. Each of the components and key terms is
discussed in greater detail later in this section. The detailed information on
how to implement these different methods of authentication is discussed in
the following section:
The current release supports these methods of authentication:
• Enterprise authentication
• Windows NT authentication
• LDAP authentication
• Windows AD authentication
• Trusted Authentication
If you want to use any of the third-party methods of authentication or Trusted
Authentication, you will need to configure them before you use them.
10Security Concepts

Because BusinessObjects Enterprise is fully customizable, the authentication
and authorization processes may vary from system to system. This section
uses InfoView as a model and describes its default behavior. If you are
developing your own BusinessObjects Enterprise end-user or administrative
applications using the BusinessObjects Enterprise Software Development
Kit (SDK), you can customize the system's behavior to meet your needs. For
complete details, see the developer documentation available on your product
CD.
Note:
Although a user can configure Windows NT authentication for BOE and
custom applications through the CMC, the CMC and InfoView themselves
do not support Windows NT authentication. The CMC and InfoView do not
support Windows AD authentication with NTLM.
The only methods of authentication that the CMC and InfoView support are
Windows AD with Kerberos, LDAP, Enterprise, and Trusted Authentication.
Related Topics
• Using AD authentication on page 486
Primary authentication
Primary authentication occurs when a user first attempts to access the
system. One of two things can happen during primary authentication:
• If single sign-on is not configured, the user provides their credentials,
such as their user name, password and authentication type.
These details are entered by the users on the logon screen.
• If a method of single sign-on is configured, the credentials for the users
are silently propagated.
These details are extracted using other methods such as Kerberos,
SiteMinder.
• The authentication type may be Enterprise, Windows NT, LDAP, or
Windows AD authentication, depending upon which type(s) you have
enabled and set up in the Authentication management area of the Central
Security Concepts
10 Authentication and authorization

Management Console (CMC). The user's web browser sends the
information by HTTP to your web server, which routes the information to
the CMS or the appropriate BusinessObjects Enterprise server.
The web application server passes the user's information through a
server-side script. Internally, this script communicates with the SDK and,
ultimately, the appropriate security plug-in to authenticate the user against
the user database.
For instance, if the user is logging on to InfoView and specifies Enterprise
authentication, the SDK ensures that the BusinessObjects Enterprise security
plug-in performs the authentication. The Central Management Server (CMS)
uses the BusinessObjects Enterprise security plug-in to verify the user name
and password against the system database. Alternatively, if the user specifies
LDAP or Windows AD authentication, the SDK uses the corresponding
security plug-in to authenticate the user.
If the security plug-in reports a successful match of credentials, the CMS
grants the user an active system identity and the following actions are
performed:
• The CMS creates an enterprise session for the user. While the session
is active, this session consumes one user license on the system.
• The CMS generates and encodes a logon token and sends it to the web
application server.
• The web application server stores the user's information in memory in a
session variable. While active, this session stores information that allows
BusinessObjects Enterprise to respond to the user's requests.
Note:
The session variable does not contain the user's password.
• The web application server keeps the logon token in a cookie on the
client's browser. This is only used for failover purposes, such as when
you have a clustered CMS or when InfoView is clustered for session
affinity.
Note:
It is possible to disable the logon token, However, if you disable the logon
token, you will disable failover.
Each of these steps contributes to the distributed security of BusinessObjects
Enterprise, because each step consists of storing information that is used
10Security Concepts

for secondary identification and authorization purposes. This is the model
used in InfoView. However, if you are developing your own client application
and you prefer not to store session state on the web application server, you
can design your application such that it avoids using session variables.
Note:
The third-party Windows NT, LDAP, and Windows AD security plug-ins work
only once you have mapped groups from the external user database to
BusinessObjects Enterprise. For procedural details, see the following
sections:
• Using AD authentication with NTLM on page 519
Note:
In a single sign-on situation, BusinessObjects Enterprise retrieves users'
credentials and group information directly from Windows AD or SiteMinder.
Hence, users are not prompted for their credentials.
Single sign-on support
The term single sign-on is used to describe different scenarios. At its most
basic level, it refers to a situation where a user can access two or more
applications or systems while providing their log-on credentials only once,
thus making it easier for users to interact with the system.
Single sign-on to the InfoView and the CMC can be provided by
BusinessObjects Enterprise, or by different authentication tools depending
on your application server type and operating system.
These methods of single sign-on are available if you are using a Java
application server on Windows:
• Windows AD with Kerberos
• Windows AD with SiteMinder.
These methods of single sign-on are available if you are using IIS on
Windows:
• Windows AD with Kerberos.
Security Concepts

• Windows AD with NTLM
• Windows AD with SiteMinder.
These methods of single sign-on support is available on Windows or Unix,
with either any supported web application server for the platform.
• LDAP with SiteMinder.
• Trusted Authentication.
Note:
Windows AD with Kerberos is supported if the Java application is on UNIX.
However, the BusinessObjects Enterprise services need to run on a Windows
server.
The following table describes the methods of single sign-on support for the
InfoView and CMC that are available.
10Security Concepts

NotesOptionsCMS
Server
Authen-
tica-
tion
Mode
Windows AD authentication to the
InfoView and CMC is available
out of the box.
Windows AD with
Kerberos only.
Win-
dows
only
Win-
dows
AD
LDAP authentication to the In-
foView and CMC is available out
of the box. SSO to the InfoView
and CMC requires SiteMinder.
Supported LDAP di-
rectory servers, with
SiteMinder only.
Anysup-
ported
platform
LDAP
Enterprise authentication to the
InfoView and CMC is available
out of the box. SSO with enter-
prise authentication to the In-
foView and CMC requires Trusted
Authentication.
Trusted Authentica-
tion
Anysup-
ported
platform
Enter-
prise
Note:
Single sign-on using Windows NT authentication is not supported for the
InfoView or the CMC.
Within the context of BusinessObjects Enterprise, we distinguish the following
levels of single sign-on:
• Single sign-on to BusinessObjects Enterprise on page 438
• Single sign-on to database on page 439
• End-to-end single sign-on on page 440
Single sign-on to BusinessObjects Enterprise
Single sign-on to BusinessObjects Enterprise means that once users have
logged on to the operating system (for Windows) or SiteMinder protected
resources (for LDAP), they can access BusinessObjects Enterprise
applications that support SSO without having to provide their credentials
again. When a user logs on, a security context for that user is created. This
Security Concepts

context can be propagated to BusinessObjects Enterprise in order to perform
SSO - resulting in the user being logged on as a BusinessObjects Enterprise
user that corresponds to the user.
The term “anonymous single sign-on” also refers to single sign-on to
BusinessObjects Enterprise, but it specifically refers to the single sign-on
functionality for the Guest user account. When the Guest user account is
enabled, which it is by default, anyone can log on to BusinessObjects
Enterprise as Guest and will have access to BusinessObjects Enterprise.
For more information, see the Managing Accounts and Groups chapter of
the BusinessObjects Enterprise Administrator's Guide.
For information on configuring single sign-on to BusinessObjects Enterprise
with LDAP authentication, see Configuring LDAP authentication on page 472
.
Single sign-on to database
Once users are logged on to BusinessObjects Enterprise, single sign-on to
the database enables them to perform actions that require database access,
in particular, viewing and refreshing reports, without having to provide their
logon credentials again. Single sign-on to the database can be combined
with single sign-on to BusinessObjects Enterprise, to provide users with even
easier access to the resources they need. See End-to-end single sign-on on
page 440.
In BusinessObjects Enterprise XI, single sign-on to the database is supported
through Windows AD using Kerberos. You may want to use single sign-on
to the database rather than end-to-end single sign-on, if you don't want the
account for IIS to be trusted for delegation.
See these sections for information on configuring single sign-on to the
database with BusinessObjects Enterprise:
• Using AD authentication with Kerberos on page 496
• Configuring Kerberos and single sign-on to the database for Java
application servers on page 540
• Configuring Kerberos and single sign-on for Java InfoView on page 520.
10Security Concepts

End-to-end single sign-on
End-to-end single sign-on refers to a configuration where users have both
single sign-on access to BusinessObjects Enterprise at the front-end, and
single sign-on access to the databases at the back-end. Thus, users need
to provide their logon credentials only once, when they log on to the operating
system, to have access to BusinessObjects Enterprise and to be able to
perform actions that require database access, such as viewing reports.
In BusinessObjects Enterprise XI end-to-end single sign-on is supported
through Windows AD and Kerberos.
Related Topics
Security plug-ins
Security plug-ins expand and customize the ways in which BusinessObjects
Enterprise authenticates users. BusinessObjects Enterprise currently ships
with the system default BusinessObjects Enterprise security plug-in together
with the Windows NT, LDAP, and Windows AD security plug-ins.
Security plug-ins facilitate account creation and management by allowing
you to map user accounts and groups from third-party systems into
BusinessObjects Enterprise. You can map third-party user accounts or groups
to existing BusinessObjects Enterprise user accounts or groups, or you can
create new Enterprise user accounts or groups that correspond to each
mapped entry in the external system.
The security plug-ins dynamically maintain third-party user and group listings.
Once you map a Windows NT, LDAP, or Windows AD group into
BusinessObjects Enterprise, all users who belong to that group can
successfully log on to BusinessObjects Enterprise. When you make
subsequent changes to the third-party group membership, you do not need
to update or refresh the listing in BusinessObjects Enterprise. For instance,
if you map a Windows NT group to BusinessObjects Enterprise, and then
you add a new NT user to the NT group, the security plug-in dynamically
creates an alias for that new user when he or she first logs on to
BusinessObjects Enterprise with valid NT credentials.
Security Concepts

Moreover, security plug-ins enable you to assign rights to users and groups
in a consistent manner, because the mapped users and groups are treated
as if they were Enterprise accounts. For example, you might map some user
accounts or groups from Windows NT, and some from an LDAP directory
server. Then, when you need to assign rights or create new, custom groups
within BusinessObjects Enterprise, you make all of your settings in the CMC.
Each security plug-in acts as an authentication provider that verifies user
credentials against the appropriate user database. When users log on to
BusinessObjects Enterprise, they choose from the available authentication
types that you have enabled and set up in the Authorization management
area of the CMC: Enterprise (the system default), Windows NT, LDAP, or
Windows AD.
Note:
The Windows NT and Windows AD security plug-ins cannot authenticate
users if the BusinessObjects Enterprise server components are running on
UNIX.
BusinessObjects Enterprise security plug-in
The BusinessObjects Enterprise security plug-in (secEnterprise.dll) is
installed and enabled by default when you install BusinessObjects Enterprise.
This plug-in allows you to create and maintain user accounts and groups
within BusinessObjects Enterprise; it also enables the system to verify all
logon requests that specify Enterprise authentication. In this case, user
names and passwords are authenticated against the BusinessObjects
Enterprise user list, and users are allowed or disallowed access to the system
based solely on that information. For details on setting up Enterprise users
and groups, see the BusinessObjects Enterprise Administrator's Guide.
Default accounts
When you first install BusinessObjects Enterprise, this plug-in sets up two
default Enterprise accounts: Administrator and Guest. Neither account has
a default password.
Single sign-on
The BusinessObjects Enterprise authentication provider supports anonymous
single sign-on for the Guest account. Thus, when users connect to
BusinessObjects Enterprise without specifying a user name and password,
10Security Concepts

the system logs them on automatically under the Guest account. If you assign
a secure password to the Guest account, or if you disable the Guest account
entirely, you disable this default behavior. For details, see the
Processing extensions
BusinessObjects Enterprise offers you the ability to further secure your
reporting environment through the use of customized processing extensions.
A processing extension is a dynamically loaded library of code that applies
business logic to particular BusinessObjects Enterprise view or schedule
requests before they are processed by the system.
Through its support for processing extensions, the BusinessObjects
Enterprise administration SDK essentially exposes a "handle" that allows
developers to intercept the request. Developers can then append selection
formulas to the request before the report is processed.
A typical example is a report-processing extension that enforces row-level
security. This type of security restricts data access by row within one or more
database tables. The developer writes a dynamically loaded library that
intercepts view or schedule requests for a report (before the requests are
processed by a Job Server, Processing Server, or Report Application Server).
The developer's code first determines the user who owns the processing
job; then it looks up the user's data-access privileges in a third-party system.
The code then generates and appends a record selection formula to the
report in order to limit the data returned from the database. In this case, the
processing extension serves as a way to incorporate customized row-level
security into the BusinessObjects Enterprise environment.
Tip:
In BusinessObjects Enterprise XI, you can also set and enforce row-level
security through the use of Business Views. For more information, see the
Business Views Administrator's Guide.
By enabling processing extensions, you configure the appropriate
BusinessObjects Enterprise server components to dynamically load your
processing extensions at runtime. Included in the SDK is a fully documented
API that developers can use to write processing extensions. For more
information, see the developer documentation available on your product
distribution.
Security Concepts

Note:
In the current release, processing extensions can be applied only to Crystal
report (.rpt) objects.
Active trust relationship
In a networked environment, a trust relationship between two domains is
generally a connection that allows one domain accurately to recognize users
who have been authenticated by the other domain. While maintaining security,
the trust relationship allows users to access resources in multiple domains
without repeatedly having to provide their credentials.
Within the BusinessObjects Enterprise environment, the active trust
relationship works similarly to provide each user with seamless access to
resources across the system. Once the user has been authenticated and
granted an active session, all other BusinessObjects Enterprise components
can process the user's requests and actions without prompting for credentials.
As such, the active trust relationship provides the basis for BusinessObjects
Enterprise's distributed security.
Logon tokens
A logon token is an encoded string that defines its own usage attributes and
contains a user's session information. The logon token's usage attributes
are specified when the logon token is generated. These attributes allow
restrictions to be placed upon the logon token to reduce the chance of the
logon token being used by malicious users. The current logon token usage
attributes are:
• Number of minutes
This attribute restricts the lifetime of the logon token.
• Number of logons
This attribute restricts the number of times that the logon token can be
used to log on to BusinessObjects Enterprise.
Both attributes hinder malicious users from gaining unauthorized access to
BusinessObjects Enterprise with logon tokens retrieved from legitimate users.
10Security Concepts
Active trust relationship

Note:
Storing a logon token in a cookie is a potential security risk if the network
between the browser and application or web server is insecure – for example
if the connection is made over a public network and is not using SSL or
Trusted Authentication. It is good practice to use Secure Sockets Layer (SSL)
to reduce security risk between the browser and application or web server.
When the logon cookie has been disabled, and the web server or web
browser times out, the user is presented with the logon screen. When the
cookie is enabled, and the server or browser times out, the user is seamlessly
logged back onto the system. However, because state information is tied to
the web session, the user's state is lost. For example, if the user had a
navigation tree expanded and a particular item selected, the tree is reset.
For BusinessObjects Enterprise, the default is to have logon tokens enabled
in the web client, however, you can disable logon tokens for InfoView. When
you disable the logon tokens in the client, the user session will be limited by
the web server or web browser timeout. When that session expires, the user
will be required to log in again to BusinessObjects Enterprise.
Ticket mechanism for distributed security
Enterprise systems dedicated to serving a large number of users typically
require some form of distributed security. An enterprise system may require
distributed security to support features such the transfer of trust (the ability
to allow another component to act on behalf of the user)
BusinessObjects Enterprise addresses distributed security by implementing
a ticket mechanism (one that is similar to the Kerberos ticket mechanism).
The CMS grants tickets that authorize components to perform actions on
behalf of a particular user. In BusinessObjects Enterprise, the ticket is referred
to as the logon token.
This logon token is most commonly used over the Web. When a user is first
authenticated by BusinessObjects Enterprise, he or she receives a logon
token from the CMS. The user's web browser caches this logon token. When
the user makes a new request, other BusinessObjects Enterprise components
can read the logon token from the user's web browser.
Security Concepts
10 Active trust relationship

Sessions and session tracking
In general, a session is a client-server connection that enables the exchange
of information between the two computers. A session's state is a set of data
that describes the session's attributes, its configuration, or its content. When
you establish a client-server connection over the Web, the nature of HTTP
limits the duration of each session to a single page of information; thus, your
web browser retains the state of each session in memory only for as long
as any single Web page is displayed. As soon as you move from one web
page to another, the state of the first session is discarded and replaced with
the state of the next session. Consequently, Web sites and Web applications
must somehow store the state of one session if they need to reuse its
information in another.
BusinessObjects Enterprise uses two common methods to store session
state:
• Cookies—A cookie is a small text file that stores session state on the
client side: the user's web browser caches the cookie for later use. The
BusinessObjects Enterprise logon token is an example of this method.
• Session variables—A session variable is a portion of memory that stores
session state on the server side. When BusinessObjects Enterprise grants
a user an active identity on the system, information such as the user's
authentication type is stored in a session variable. So long as the session
is maintained, the system neither has to prompt the user for the information
a second time nor has to repeat any task that is necessary for the
completion of the next request.
For Java deployments, the session is used to handle .jsp requests; for
.NET deployments, the session is used to handle .aspx requests.
Note:
Ideally, the system should preserve the session variable while the user is
active on the system. And, to ensure security and to minimize resource
usage, the system should destroy the session variable as soon as the user
has finished working on the system. However, because the interaction
between a web browser and a web server can be stateless, it can be difficult
to know when users leave the system, if they do not log off explicitly. To
address this issue, BusinessObjects Enterprise implements session tracking.
Related Topics
• CMS session tracking on page 446
10Security Concepts
Sessions and session tracking

CMS session tracking
The CMS implements a simple tracking algorithm. When a user logs on, the
user is granted a CMS session, which the CMS preserves until the user logs
off, or until the web application server session variable is released.
The web application server session is designed to notify the CMS on a
recurring basis that it is still active, so the CMS session is retained so long
as the web application server session exists. If the web application server
session fails to communicate with the CMS for a ten-minute time period, the
CMS destroys the CMS session. This handles scenarios where client-side
components shut down irregularly.
Environment protection
Environment protection refers to the security of the overall environment in
which client and server components communicate. Although the Internet and
web-based systems are increasingly popular due to their flexibility and range
of functionality, they operate in an environment that can be difficult to secure.
When you deploy BusinessObjects Enterprise, environment protection is
divided into two areas of communication:
• Web browser to web server on page 446
• Web server to BusinessObjects Enterprise on page 447
Web browser to web server
When data is transmitted between the web browser and the web server,
some degree of security is usually required. Relevant security measures
usually involve two general tasks:
• Ensuring that the communication of data is secure.
• Ensuring that only valid users retrieve information from the web server.
Note:
These tasks are typically handled by web servers through various security
mechanisms, including the Secure Sockets Layer (SSL) protocol, Windows
NT Challenge/Response authentication, and other such mechanisms. It is
Security Concepts
10 Environment protection

good practice to use Secure Sockets Layer (SSL) to reduce security risk
between the browser and application or web server. For procedural
information, see Configuring servers for SSL on page 206.
You must secure communication between the web browser and the web
server independently of BusinessObjects Enterprise. For details on securing
client connections, refer to your web server documentation.
Web server to BusinessObjects Enterprise
Firewalls are commonly used to secure the area of communication between
the web server and the rest of the corporate intranet (including
BusinessObjects Enterprise). BusinessObjects Enterprise supports firewalls
that use IP filtering or static network address translation (NAT). Supported
environments can involve multiple firewalls, web servers, or application
servers.
For complete details on BusinessObjects Enterprise and firewall interaction,
see Understanding communication between BusinessObjects Enterprise
components on page 296.
Auditing web activity
BusinessObjects Enterprise provides insight into your system by recording
web activity and allowing you to inspect and to monitor the details. The web
application server allows you to select the web attributes—such as time,
date, IP address, port number, and so on—that you want to record. The
auditing data is logged to disk and stored in comma-delimited text files, so
you can easily report off the data or import it into other applications.
Protection against malicious logon attempts
No matter how secure a system is, there is often at least one location that
is vulnerable to attack: the location where users connect to the system. It is
nearly impossible to protect this location completely, because the process
of simply guessing a valid user name and password remains a viable way
to attempt to "crack" the system.
10Security Concepts

BusinessObjects Enterprise implements several techniques to reduce the
probability of a malicious user achieving access to the system. The various
restrictions listed below apply only to Enterprise accounts—that is, the
restrictions do not apply to accounts that you have mapped to an external
user database (Windows NT, LDAP, or Windows AD). Generally, however,
your external system will enable you to place similar restrictions on the
external accounts.
• Password restrictions on page 448
• Logon restrictions on page 448
• User restrictions on page 449
• Guest account restrictions on page 449
Password restrictions
Password restrictions ensure that Enterprise users create passwords that
are relatively complex. You can enable the following options:
• Enforce mixed-case passwords
This option ensures that passwords contain at least two of the following
character classes: upper case letters, lower case letters, numbers, or
punctuation.
• Must contain at least N characters
By enforcing a minimum complexity for passwords, you decrease a
malicious user's chances of simply guessing a valid user's password.
Logon restrictions
Logon restrictions serve primarily to prevent dictionary attacks (a method
whereby a malicious user obtains a valid user name and attempts to learn
the corresponding password by trying every word in a dictionary). With the
speed of modern hardware, malicious programs can guess millions of
passwords per minute. To prevent dictionary attacks, BusinessObjects
Enterprise has an internal mechanism that enforces a time delay (0.5–1.0
Security Concepts
10 Auditing web activity

second) between logon attempts. In addition, BusinessObjects Enterprise
provides several customizable options that you can use to reduce the risk
of a dictionary attack:
• Disable accounts after N failed attempts to log on
• Reset failed logon count after N minute(s)
• Re-enable account after N minute(s)
User restrictions
User restrictions ensure that Enterprise users create new passwords on a
regular basis. You can enable the following options:
• Must change password every N day(s)
• Cannot reuse the N most recent password(s)
• Must wait N minute(s) to change password
These options are useful in a number of ways. Firstly, any malicious user
attempting a dictionary attack will have to recommence every time passwords
change. And, because password changes are based on each user's first
logon time, the malicious user cannot easily determine when any particular
password will change. Additionally, even if a malicious user does guess or
otherwise obtain another user's credentials, they are valid only for a limited
time.
Guest account restrictions
The BusinessObjects Enterprise authentication provider supports anonymous
single sign-on for the Guest account. Thus, when users connect to
BusinessObjects Enterprise without specifying a user name and password,
the system logs them on automatically under the Guest account. If you assign
a secure password to the Guest account, or if you disable the Guest account
entirely, you disable this default behavior. For details, see the
BusinessObjects Enterprise Administrators' Guide.
10Security Concepts

Security Concepts
10 Auditing web activity

Overview
This section shows you how to use the CMC to manage license information
for your BusinessObjects Enterprise deployment. It includes information on:
• Adding a license key on page 452
• Viewing current account activity on page 453
Managing license information
The License Keys area identifies the number of concurrent, named, and
processor licenses associated with each key.
To view license information
1. Go to the License Keys management area of the CMC.
2. Select a license key.
The details associated with the key appear in the Licensing Information
area. To purchase additional license keys:
• Contact your Business Objects sales representative.
• Contact your regional office. For details, go to:
http://www.businessobjects.com/company/contact_us/
Adding a license key
Note:
If you are upgrading from a trial version of the product, be sure to delete the
Evaluation key prior to adding any new license keys or product activation
keycodes.
To add a license key
1. Go to the License Keys management area of the CMC.
2. Type the key in the Add Key field.
Managing Licenses
11 Overview

Note:
Key codes are case-sensitive.
3. Click Add.
The key is added to the list.
Viewing current account activity
To view current account activity
1. Go to the Settings management area of the CMC.
2. Click View global system metrics.
This section displays current license usage, along with additional job
metrics.
11Managing Licenses
Viewing current account activity

Managing Licenses
11 To view current account activity

Configuring Third-Party
Authentication
12

This section provides detailed instructions for configuring BusinessObjects
Enterprise to work with third-party authentication options.
Using NT Authentication
This section provides a general description of how NT authentication works
with BusinessObjects Enterprise. It then introduces the administration tools
that allow you to manage and configure NT user accounts to BusinessObjects
Enterprise.
Related Topics
• Using NT user accounts and groups on page 456
• Windows NT security plug-in on page 456
• NT user account and group administration on page 457
• Mapping NT user accounts and groups on page 458
Using NT user accounts and groups
BusinessObjects Enterprise supports NT authentication with the Windows
NT security plug-in, which is included by default when the product is installed
on Windows. Support for NT authentication means that users or groups
created with NT, Windows 2000 and Windows 2003 can be used to
authenticate with BusinessObjects Enterprise. This allows you to map
previously created NT user accounts and groups, instead of setting up each
user and group within BusinessObjects Enterprise.
Windows NT security plug-in
The Windows NT security plug-in (secWindowsNT.dll) allows you to map
user accounts and groups from your Windows NT user database to
BusinessObjects Enterprise; it also enables BusinessObjects Enterprise to
verify all logon requests that specify Windows NT Authentication. Users are
authenticated against the Windows NT user database, and have their
membership in a mapped NT group verified before the CMS grants them an
active BusinessObjects Enterprise session.
Configuring Third-Party Authentication
12 Using NT Authentication

This plug-in is compatible with NT 4 and Windows 2000 Active Directory
user databases (when Windows 2000 Active Directory is configured in
non-native mode only). If a Windows 2000 Active Directory user database
is configured in native mode and contains universal groups that span several
domains, you must use the Windows AD security plug-in. For information on
mapping Windows NT users and groups to BusinessObjects Enterprise, see
Mapping NT user accounts and groups on page 458. For information on the
Windows AD security plug-in, see Windows AD security plug-in on page 488.
Once you have mapped your NT users and groups, all Windows-based
BusinessObjects Enterprise client tools support NT authentication, while
Java-based tools do not. You can also create your own applications that
support NT authentication. For more information, see the developer
documentation available on your product CD.
Note:
The Windows NT security plug-in cannot authenticate users under the
following conditions:
• If the BusinessObjects Enterprise server components are running on
UNIX.
• If your system uses the BusinessObjects Enterprise Java SDK.
Note:
The CMC and other Java-based applications do not support NT
authentication.
NT user account and group administration
Setting up and maintaining NT authentication involves these tasks:
• Mapping NT groups from the CMC on page 458
• Unmapping NT groups on page 461
• Viewing mapped NT users and groups on page 462
12Configuring Third-Party Authentication

Mapping NT user accounts and groups
To simplify administration, BusinessObjects Enterprise supports user
accounts and groups that are created using Windows NT. However, before
users can use their NT user name and password to log on to BusinessObjects
Enterprise, their NT user account needs to be mapped to BusinessObjects
Enterprise. When you map an NT account, you can choose to create a new
BusinessObjects Enterprise account or link to an existing BusinessObjects
Enterprise account.
You can map NT accounts to BusinessObjects Enterprise through the CMC.
Note:
NT accounts refer to Windows NT, 2000 and 2003 accounts.
Mapping NT groups from the CMC
To simplify administration, BusinessObjects Enterprise supports user
accounts and groups that are created using Windows NT. However, before
users can use their NT user name and password to log on to BusinessObjects
Enterprise, their NT user account needs to be mapped to BusinessObjects
Enterprise. When you map an NT account, you can choose to create a new
BusinessObjects Enterprise account or link to an existing BusinessObjects
Enterprise account.
Note:
• When you map a NT group to BusinessObjects Enterprise, all the users
from the group are mapped. If you want to exclude specific users from
having access to BusinessObjects Enterprise, you can change the specific
user's access after the group has been mapped.
• Before starting this procedure, ensure you have the NT domain and group
information.
To map NT groups using BusinessObjects Enterprise
2. Double-click Windows NT.
3. Ensure that the NT Authentication is enabled check box is selected.
4. If you will be using single sign-on, select the Single Sign On is enabled
check box.

Note:
If you select this option, you must also configure the IIS for single sign-on.
For details, see Setting up NT single sign-on on page 464. Failing to
configure IIS could compromise your system security if the account that
IIS runs under belongs to a mapped group, because users who use one
of the web applications would automatically have the same access
privileges as the IIS machine account.
5. To change the Default NT domain, click the domain name. Complete the
Default NT Domain field.
Note:
By typing the default NT Domain Name, users do not have to specify the
NT Domain Name when they log on to BusinessObjects Enterprise via
NT authentication. Also, you don't have to specify the NT domain name
when you map groups.
6. In the Mapped NT Member Groups area, enter the NT domaingroup in
the Add NT Group (NT DomainGroup) field.
Note:
If you want to map a local NT group, you must type NTmachine
namegroupname.
7. Click Add.
The group is added to the list.
8. Select how aliases are mapped to BusinessObjects Enterprise accounts.
a. In "New Alias Options", select how new aliases are mapped to
Enterprise accounts. Select one of the following choices:
• Assign each added NT alias to an account with the same name
Use this option when you know users have an existing Enterprise
account with the same name; that is, NT aliases will be assigned
to existing users (auto alias creation is turned on). Users who do
not have an existing Enterprise account, or who do not have the
same name in their Enterprise and NT account, are added as new
users.
• Create a new account for every added NT alias
Use this option when you want to create a new account for each
user.

b. In "Alias Update Options", select how to manage alias updates for the
• Create new aliases when the Alias Update occurs
Use this option to automatically create a new alias for every NT
user mapped to BusinessObjects Enterprise. New NT accounts
are added for users without BusinessObjects Enterprise accounts,
or for all users if you selected the Create a new account for every
added NT alias option.
• Create new aliases only when the user logs on
Use this option when the NT directory you are mapping contains
many users, but only a few of them will use BusinessObjects
Enterprise. BusinessObjects Enterprise does not automatically
create aliases and Enterprise accounts for all users. Instead, it
creates aliases (and accounts, if required) only for users who log
on to BusinessObjects Enterprise.
c. In "New User Options" specify how new users are created by selecting
one of the following choices:
• New users are created as named users.
New user accounts are configured to use named user licenses.
Named user licenses are associated with specific users and allow
people to access the system based on their user name and
password. This provides named users with access to the system
regardless of how many other people are connected. You must
have a named user license available for each user account created
using this option
• New users are created as concurrent users.
New user accounts are configured to use concurrent user licenses.
Concurrent licenses specify the number of people who can connect
to BusinessObjects Enterprise at the same time. This type of
licensing is very flexible because a small concurrent license can
support a large user base. For example, depending on how often
and how long users access BusinessObjects Enterprise, a 100
user concurrent license could support 250, 500, or 700 users.
9. Click Update.

Unmapping NT groups
Similar to mapping, it is possible to unmap groups using the administrative
tool in Windows NT/2000, or BusinessObjects Enterprise.
To unmap NT users and groups using Windows NT
1. From the Administrative Tools program group, click User Manager.
2. Select the group containing the users you want to unmap.
3. From the User menu, click Properties.
4. Select the user(s) or group(s), and click Remove.
5. Click OK.
The user or group will no longer be able to access BusinessObjects
Enterprise.
Note:
If you remove a user from an NT group, the NT alias for that user is also
removed from BusinessObjects Enterprise. If the removed alias is the
only one the user has, the user and its Favorites, Inbox and all other
personal content are also removed from BusinessObjects Enterprise.
To unmap NT users and groups using Windows 2000 or 2003
1. From the Administrative Tools program group, click Computer
Management.
2. Under System Tools, select Local Users and Groups.
3. Click the Groups folder.
4. Select the group containing the users you want to unmap.
5. From the Action menu, click Properties.
6. Select the user(s) or group(s), and click Remove.
7. Click OK or Apply (and then Close) to complete the process.
The user or group will no longer be able to access BusinessObjects
Enterprise.
Note:
If you remove a user from a Windows 2000 or Windows 2003 group, the
NT alias for that user is also removed from BusinessObjects Enterprise.
If the removed alias is the only one the user has, the user and its

Favorites, Inbox and all other personal content are also removed from
To unmap NT groups using BusinessObjects Enterprise
3. In the Mapped NT Member Groups area, select the NT group you would
like to remove.
4. Click Delete.
5. Click Update.
The users in this group will not be able to access BusinessObjects
Enterprise.
Tip:
To deny NT Authentication for all groups, clear the "NT Authentication is
enabled" check box and click Update.
Note:
If you unmap an NT group from BusinessObjects Enterprise, the NT alias
for all the users in the group will also be removed from BusinessObjects
Enterprise. If the removed alias is the only one for these user, the users
and their Favorites, Inbox and all other personal content are also removed
from BusinessObjects Enterprise.
Viewing mapped NT users and groups
There are two methods to view mapped users and groups in BusinessObjects
Enterprise.
Note:
When you view group membership, the information is cached. If you add
more users to the mapped group, they will appear when the cache expires
(10 minutes, by default) or when the CMS restarts.
To view users and groups that have been added using Windows NT/2000, 2003
or BusinessObjects Enterprise
1. Go to the Users management area of the CMC.
2. Select the appropriate group.

3. Click OK to the message which states that accessing the user list may
take several seconds.
4. Click Refresh, then click OK.
To view groups that have been added using BusinessObjects Enterprise
2. Double click Windows NT.
The "Mapped NT Member Groups" area displays the groups that have
been mapped to BusinessObjects Enterprise.
Note:
You can view the groups and users by selecting the appropriate group
from the Users management area.
Adding an NT account to a mapped NT group
When you have added a new account in NT, and the NT group to which the
account belongs to is already mapped to BusinessObjects Enterprise, there
are three ways you can get the new NT account into BusinessObjects
Enterprise. Choose the method that works best for your situation:
• When the new NT user logs on to BusinessObjects Enterprise and selects
NT authentication, the system will add the user to BusinessObjects
Enterprise. This is the simplest method and it doesn't require any extra
steps, but the user won't be added until he or she logs on to
• You can add the new user to BusinessObjects Enterprise and select
Windows NT authentication. The user is added and is automatically
assigned a Windows NT alias. For more information on aliases, see
Security Concepts on page 431.
• You can go to the Windows NT tab in the Authentication management
area and select the option to add all new aliases and create all new users,
and then click Update. In this case all NT users will be added to
BusinessObjects Enterprise. For details, see Mapping NT user accounts
and groups on page 458. However, if the NT group contains many users
who don't require access to BusinessObjects Enterprise, you may want
to add the user individually instead.

Creating a new NT group account
• If you create a new NT group account, and the group account does not
belong to a group account that is mapped to BusinessObjects Enterprise,
add it to BusinessObjects Enterprise. For more information, see Mapping
NT user accounts and groups on page 458.
• If you create a new NT group account, and the account belongs to a group
account that is mapped to BusinessObjects Enterprise, refresh the group
list. For more information, see Viewing mapped NT users and groups on
page 462.
Disabling an NT user account
If you disable an NT user account (using Windows Administrative Tools),
the user will not be able to log on to BusinessObjects Enterprise using the
mapped NT account. However, if the user also has an account that uses
Enterprise authentication, the user can still access BusinessObjects
Enterprise using that account.
Setting up NT single sign-on
You can configure BusinessObjects Enterprise to allow users to use various
BusinessObjects Enterprise applications without being prompted to log on.
Users need only to enter their NT user name and password information once
at the beginning of the NT session. For instance, if you have set up NT single
sign-on, when you launch InfoView, NT authentication occurs in the
background. You are not required to enter any additional information.
Note:
This feature is available if you are using a Microsoft Internet Information
Server (IIS) and the users are using Internet Explorer as their web browser.
For specific version compatibility, refer to the BusinessObjects Enterprise
supported platform document (PAR) on our support web site: http://sup
port.businessobjects.com/documentation/supported_platforms.
BusinessObjects Enterprise provides its own form of "anonymous single
sign-on," which uses Enterprise authentication, as opposed to Windows NT
authentication. Design your own web applications accordingly (or modify
InfoView) if you want to use NT single sign-on. Refer to the tutorial in the
developer documentation for an example on creating a web application that
uses single sign-on.

Setting up NT single sign-on to BusinessObjects Enterprise includes these
tasks:
• Modifying the web.config file for NT single sign-on on page 466
• Enabling InfoView NT single sign-on from the CMC on page 465
Enabling InfoView NT single sign-on from the CMC
To enable the Windows NT plug-in for single sign-on from the CMC
3. Select the Single Sign On is enabled check box.
Note:
If you select this option, you must also configure the IIS for single sign-on.
For details, see Modifying the web.config file for NT single sign-on on
page 466. Failing to configure IIS could compromise your system security
if the account that IIS runs under belongs to a mapped group, because
when users access one of the web applications they would automatically
have the same access privileges as the IIS machine account.
4. Click Update.
Note:
For NT single sign-on to function correctly, make sure you complete all
tasks listed in Setting up NT single sign-on on page 464.
To modify the security setting on IIS
1. From the Windows Administrative Tools program group, click Computer
Management.
2. Expand Services and Applications.
3. Expand Internet Information Services.
4. Click on the web site that runs InfoView, and then select Properties.
5. Click on the Directory Security tab.
6. In the Anonymous access and authentication control area of the page,
click Edit.
7. Deselect the Anonymous access and Basic authentication check
boxes.
8. Ensure that the Integrated Windows authentication check box is
selected.

9. Click OK.
10. Click OK.
11. Restart your IIS server.
Modifying the web.config file for NT single sign-on
To configure InfoView for single sign-on, you must modify its associated
web.config file in the InfoViewApp directory.
To modify the web.config file for NT single sign-on
1. Open the appropriate web.config file from this location:
C:Program FilesBusiness ObjectsBusinessObjects Enterprise
12.0 Web ContentInfoViewAppInfoViewApp
Note:
The path mentioned is the default location. Modify your path accordingly
if you changed the default location.
2. Locate the following line in the <system.web> block:
<Authentication mode="None" />
3. Replace "None" with "Windows".
<Authentication mode="Windows" />
4. Add the following line:
<identity impersonate="true" />
5. Find the following string:
<add key="cmsDefault" value="" />
6. Enter the CMS machine in the cmsDefault value field.
<add key=" ssoEnabled" value="false" />
8. Change the ssoEnabled value from false to true.

<add key="authenticationDefault" value="secEnterprise" />
10. Ensure the value for authenticationDefault is set to secWindowsNT.
12. Restart IIS.
Using LDAP authentication
This section provides a general description of how LDAP authentication
works with BusinessObjects Enterprise. It then introduces the administration
tools that allow you to manage and configure LDAP accounts to
Related Topics
• Managing LDAP accounts on page 467
• Configuring LDAP authentication on page 472
• Mapping LDAP groups on page 479
• Unmapping LDAP groups on page 481
• Viewing mapped LDAP users and groups on page 481
• Changing LDAP connection parameters and member groups on page 482
• Managing multiple LDAP hosts on page 476
• Troubleshooting LDAP accounts on page 486
Managing LDAP accounts
To use LDAP authentication, you need to first ensure that you have your
respective LDAP directory set up. For more information about LDAP, refer
to your LDAP documentation. For more information on the LDAP security
plug-in, see LDAP security plug-in on page 468.
Note:
When you install BusinessObjects Enterprise, the LDAP authentication plug-in
is installed automatically, but not enabled by default.

Related Topics
• Configuring LDAP authentication on page 472
• Mapping LDAP groups on page 479
• Unmapping LDAP groups on page 481
• Viewing mapped LDAP users and groups on page 481
• Changing LDAP connection parameters and member groups on page 482
• Managing multiple LDAP hosts on page 476
• Troubleshooting LDAP accounts on page 486
LDAP security plug-in
The LDAP security plug-in (secLDAP.dll) allows you to map user accounts
and groups from your LDAP directory server to BusinessObjects Enterprise;
it also enables the system to verify all logon requests that specify LDAP
authentication. Users are authenticated against the LDAP directory server,
and have their membership in a mapped LDAP group verified before the
CMS grants them an active BusinessObjects Enterprise session. User lists
and group memberships are dynamically maintained by BusinessObjects
Enterprise. You can specify that BusinessObjects Enterprise use a Secure
Sockets Layer (SSL) connection to communicate to the LDAP directory server
for additional security.
LDAP authentication for BusinessObjects Enterprise is similar to NT and AD
authentication in that you can map groups and set up authentication,
authorization, and alias creation. Also as with NT or AD authentication, you
can create new Enterprise accounts for existing LDAP users, and can assign
LDAP aliases to existing users if the user names match the Enterprise user
names. In addition, you can do the following:
• Map users and groups from the LDAP directory service.
• Map LDAP against AD. There are a number of restrictions if you configure
LDAP against AD. For details, see Mapping LDAP against AD on page 470.
• Specify multiple host names and their ports.
• Configure LDAP with SiteMinder.
For information on mapping your LDAP users and groups to BusinessObjects
Enterprise, see Managing LDAP accounts on page 467.
12 Using LDAP authentication

Once you have mapped your LDAP users and groups, all of the
BusinessObjects Enterprise client tools support LDAP authentication. You
can also create your own applications that support LDAP authentication.
More about LDAP
Lightweight Directory Access Protocol (LDAP), a common,
application-independent directory, enables users to share information among
various applications. Based on an open standard, LDAP provides a means
for accessing and updating information in a directory.
LDAP is based on the X.500 standard, which uses a directory access protocol
(DAP) to communicate between a directory client and a directory server.
LDAP is an alternative to DAP because it uses fewer resources and simplifies
and omits some X.500 operations and features.
The directory structure within LDAP has entries arranged in a specific schema.
Each entry is identified by its corresponding distinguished name (DN) or
common name (CN). Other common attributes include the organizational
unit name (OU), and the organization name (O). For example, a member
group may be located in a directory tree as follows: cn=BusinessObjects
Enterprise Users, ou=Enterprise Users A, o=Research. Refer to your LDAP
documentation for more information.
Because LDAP is application-independent, any client with the proper
authorization can access its directories. LDAP offers you the ability to set up
users to log on to BusinessObjects Enterprise through LDAP authentication.
It also enables users to be authorized when attempting to access objects in
BusinessObjects Enterprise. As long as you have an LDAP server (or servers)
running, and use LDAP in your existing networked computer systems, you
can use LDAP authentication (along with Enterprise, NT, and Windows AD
authentication).
If desired, the LDAP security plug-in provided with BusinessObjects Enterprise
can communicate with your LDAP server using an SSL connection
established using either server authentication or mutual authentication. With
server authentication, the LDAP server has a security certificate which
BusinessObjects Enterprise uses to verify that it trusts the server, while the
LDAP server allows connections from anonymous clients. With mutual
authentication, both the LDAP server and BusinessObjects Enterprise have
security certificates, and the LDAP server must also verify the client certificate
before a connection can be established.

The LDAP security plug-in provided with BusinessObjects Enterprise can be
configured to communicate with your LDAP server via SSL, but always
performs basic authentication when verifying users' credentials. Before
deploying LDAP authentication in conjunction with BusinessObjects
Enterprise, ensure that you are familiar with the differences between these
LDAP types. For details, see RFC2251, which is currently available at
http://www.faqs.org/rfcs/rfc2251.html
Mapping LDAP against AD
If you configure LDAP against AD, note the following restrictions:
• If you configure LDAP against AD, you will be able to map your users but
you will not be able to configure AD single sign-on or single sign-on to
the database. However, LDAP single sign-on methods like SiteMinder
and trusted authentication will still be available.
• Users who are only members of default groups from AD will not be able
to log in successfully. Users must also be a member of another explicitly
created group in AD and, in addition, this group must be mapped. An
example of such a group is the "domain users" group.
• If a mapped domain local group contains a user from a different domain
in the forest, the user from a different domain in the forest will not be able
to log in successfully.
• Users from a universal group from a domain different than the DC specified
as the LDAP host will not be able to log in successfully.
• You cannot use the LDAP plug-in to map users and groups from AD
forests outside the forest where BusinessObjects Enterprise is installed.
• You cannot map in the Domain Users group in AD.
• You cannot map a machine local group.
• If you are using the Global Catalog Domain Controller, there are additional
considerations when mapping LDAP against AD:

ConsiderationsSituation
You can map in:
• universal groups on a child domain,
• groups on the same domain that con-
tains universal groups from a child do-
main, and
• universal groups on a cross domain.
You cannot map in:
• global groups on a child domain,
• local groups on a child domain,
• groups on the same domain that contain
a global group from the child domain, and
• cross-domain global groups.
Generally, if the group is a universal group,
it will support users from cross or child
domains. Other groups will not be mapped
if they contain users from cross or child
domains. Within the domain you are
pointing to, you can map domain local,
global, and universal groups.
Multiple domains when
pointing to the Global Cata-
log Domain Controller
To map in universal groups, you must point
to the Global Catalog Domain Controller.
You should also use port number 3268 in-
stead of the default 389.
Mapping in universal groups
• If you are using multiple domains but not pointing to the Global Catalog
Domain Controller, then you cannot map in any type of groups from cross
or child domains. You can map in all types of groups only from the specific
domain you are pointing to.

Configuring LDAP authentication
To simplify administration, BusinessObjects Enterprise supports LDAP
authentication for user and group accounts. Before users can use their LDAP
user name and password to log on to BusinessObjects Enterprise, you need
to map their LDAP account to BusinessObjects Enterprise. When you map
an LDAP account, you can choose to create a new BusinessObjects
Enterprise account or link to an existing BusinessObjects Enterprise account.
Before setting up and enabling LDAP authentication, ensure that you have
your LDAP directory set up. For more information, refer to your LDAP
documentation.
Configuring LDAP authentication includes the following steps:
• Configuring the LDAP host on page 472.
• Configuring LDAP Server or Mutual Authentication and the SSL settings
on page 477.
• Configuring the LDAP plug-in for SiteMinder on page 483.
Note:
If you configure LDAP against AD, you will be able to map your users but
you will not be able to configure AD single sign-on or single sign-on to the
database. However, LDAP single sign-on methods like SiteMinder and trusted
authentication will still be available.
Configuring the LDAP host
To configure the LDAP host
1. Go to the Authentication management area of the CMC, and then
double-click LDAP.
Note:
To get to the Authentication management area, choose Authentication
from the navigation list.
2. Enter the name and port number of your LDAP hosts in the Add LDAP
host (hostname:port) field (for example, "myserver:123"), click Add,
and then click OK.

Tip:
Repeat this step to add more than one LDAP host of the same server
type if you want to add hosts that can act as failover servers. If you want
to remove a host, highlight the host name and click Delete. For more
information on multiple hosts, refer to Managing multiple LDAP hosts on
page 476.
3. Select your server type from the LDAP Server Type list.
Note:
If you are Mapping LDAP to AD, select Microsoft Active Directory
Application Server for your server type.
4. If you want to view or change any of the LDAP Server Attribute Mappings
or the LDAP Default Search Attributes, click Show Attribute Mappings.
By default, each supported server type's server attribute mappings and
search attributes are already set.
5. Click Next.
6. In the Base LDAP Distinguished Name field, type the distinguished
name (for example, o=SomeBase) for your LDAP server, and then click
Next.
7. In the LDAP Server Credentials area, specify the distinguished name and
password for a user account that has read access to the directory.
Note:
Administrator credentials are not required.
Note:
If your LDAP Server allows anonymous binding, leave this area
blank—BusinessObjects Enterprise servers and clients will bind to the
primary host via anonymous logon.
8. If you have configured referrals on your LDAP host, enter the
authentication information in the LDAP Referral Credentials area, and
then enter the number of referral hops in the Maximum Referral Hops
field.
Note:
The "LDAP Referral Credentials" area must be configured if all of the
following apply:

• The primary host has been configured to refer to another directory
server that handles queries for entries under a specified base.
• The host being referred to has been configured to not allow anonymous
binding.
• A group from the host being referred to will be mapped to
Note:
• Although groups can be mapped from multiple hosts, only one set of
referral credentials can be set. Therefore if you have multiple referral
hosts, you must create a user account on each host that uses the
same distinguished name and password.
• If "Maximum Referral Hops" is set to zero, no referrals will be followed.
9. Click Next.
10. Choose the type of Secure Sockets Layer (SSL) authentication used, and
then click Next.
These are your choices:
• Basic (no SSL)
• Server Authentication
• Mutual Authentication
Note:
See Configuring LDAP Server or Mutual Authentication and the SSL
settings on page 477 for further information.
11. Choose a method of LDAP single sign-on authentication, and then click
Next.
These are your choices:
• Basic (No SSO)
• SiteMinder
Note:
If you select SiteMinder, see Configuring the LDAP plug-in for
SiteMinder on page 483.
12. Select how aliases are mapped to BusinessObjects Enterprise accounts.

• Assign each added LDAP alias to an account with the same
name
account with the same name; that is, LDAP aliases will be assigned
same name in their Enterprise and LDAP account, are added as
new users.
• Create a new account for every added LDAP alias
user.
Use this option to automatically create a new alias for every LDAP
user mapped to BusinessObjects Enterprise. New LDAP accounts
or for all users if you selected the Create a new account for every
added LDAP alias option.
Use this option when the LDAP directory you are mapping contains

using this option
13. Click Finish.
Managing multiple LDAP hosts
Using LDAP and BusinessObjects Enterprise, you can add fault tolerance
to your system by adding multiple LDAP hosts. BusinessObjects Enterprise
uses the first host that you add as the primary LDAP host. Subsequent hosts
are treated as failover hosts.
The primary LDAP host and all failover hosts must be configured in exactly
the same way, and each LDAP host must refer to all additional hosts from
which you wish to map groups. For more information about LDAP hosts and
referrals, see your LDAP documentation.
To add multiple LDAP Hosts, enter all hosts when you configure LDAP using
the LDAP configuration wizard (see Configuring LDAP authentication on
page 472 for details.) Or if you have already configured LDAP, go to the
Authentication management area of the Central Management Console and
click the LDAP tab. In the LDAP Server Configuration Summary area, click
the name of the LDAP host to open the page that enables you to add or
delete hosts.
Note:
• Make sure that you add the primary host first, followed by the remaining
failover hosts.
• If you use failover LDAP hosts, you cannot use the highest level of SSL
security (that is, you cannot select "Accept server certificate if it comes
from a trusted Certificate Authority and the CN attribute of the certificate

matches the DNS hostname of the server.") For more information, see
Configuring LDAP authentication on page 472.
Configuring LDAP Server or Mutual Authentication and the SSL settings
This section describes the CMC related information for configuring SSL with
LDAP Server and Mutual Authentication. It assumes that you have completed
the first 10 applicable steps in Configuring the LDAP host on page 472, and
that you selected either of these for your SSL authentication choice:
• Server Authentication
• Mutual Authentication
You can do this configuration after you complete all the steps in Configuring
the LDAP host on page 472. For additional information or for information on
configuring the LDAP host server, refer to http://www.techsupport.busines
sobjects.com/ or your LDAP vendor documentation.
To configure LDAP Server or Mutual Authentication
1. Choose what level of SSL security you want to use from the available
options:
Note:
Java applications will ignore the first and last setting and will accept the
server certificate only if it comes from a trusted Certificate Authority.
• Always accept server certificate
This is the lowest security option. Before BusinessObjects Enterprise
can establish an SSL connection with the LDAP host (to authenticate
LDAP users and groups), it must receive a security certificate from
the LDAP host. BusinessObjects Enterprise does not verify the
certificate it receives.
• Accept server certificate if it comes from a trusted Certificate
Authority
This is a medium security option. Before BusinessObjects Enterprise
LDAP users and groups), it must receive and verify a security certificate
sent to it by the LDAP host. To verify the certificate, BusinessObjects
Enterprise must find the Certificate Authority that issued the certificate
in its certificate database.

• Accept server certificate if it comes from a trusted Certificate
Authority and the CN attribute of the certificate matches the DNS
hostname of the server
This is the highest security option. Before BusinessObjects Enterprise
LDAP users and groups), it must receive and verify a security certificate
sent to it by the LDAP host. To verify the certificate, BusinessObjects
Enterprise must find the Certificate Authority that issued the certificate
in its certificate database. It must also be able to confirm that the CN
attribute on the server certificate exactly matches the host name of
the LDAP host as you typed it in the "Add LDAP host" field in the first
step of the wizard. That is, if you entered the LDAP host name as
ABALONE.rd.crystald.net:389, using CN =ABALONE:389 in the
certificate would not work.
The host name on the server security certificate is the name of the
primary LDAP host. Therefore if you select this option you cannot use
a failover LDAP host.
2. In the SSL host box, type the host name of each machine, and then click
Add.
Note:
You must next add the host name of each machine in your
BusinessObjects Enterprise system that uses the BusinessObjects
Enterprise SDK. (This includes the machine running your Central
Management Server and the machine running your WCA.)
3. Specify the SSL settings for each SSL host that has been added to the
list, and specify the default settings that will be used for each host that is
not on the list.
Note:
The default settings will be used for any setting (for any host) where you
leave the "Use default value" box checked or for any machine whose
name you do not explicitly add to the list of SSL hosts.
To specify the default settings:
a. Select default from the SSL list.
b. Clear the Use default value boxes.
c. Type your values for the "Path to the certificate and key database
files" and the "Password for the key database".

d. If you're specifying settings for Mutual authentication, you can also
enter a value in the "Nickname for the client certificate in the cert7.db"
field.
To select settings for another host, select its name in the list on the left.
Then type the appropriate values in the boxes on the right.
4. Click Next.
5. Choose a method of LDAP single sign-on authentication from these
choices:
• Basic (No SSO)
• SiteMinder
Note:
For further details on configuring SiteMinder, see Configuring the LDAP
plug-in for SiteMinder on page 483.
6. Choose how new LDAP users and aliases are created.
7. Click Finish.
Mapping LDAP groups
Once you have configured LDAP authentication using the LDAP configuration
wizard, you can map LDAP groups to Enterprise groups. See Configuring
LDAP authentication on page 472.
Note:
If you have configured LDAP against AD, this procedure will map your AD
groups.
To map LDAP groups using BusinessObjects Enterprise
2. Double-click LDAP.
If LDAP authorization is configured, the LDAP summary page appears.
3. In the "Mapped LDAP Member Groups" area, specify your LDAP group
(either by common name or distinguished name) in the Add LDAP group
(by cn or dn) field; click Add.

You can add more than one LDAP group by repeating this step. To remove
a group, highlight the LDAP group and click Delete.
4. New Alias Options allow you to specify how LDAP aliases are mapped
to Enterprise accounts. Select either:
• Assign each added LDAP alias to an account with the same name
account with the same name; that is, LDAP aliases will be assigned
to existing users (auto alias creation is turned on). Users who do not
have an existing Enterprise account, or who do not have the same
name in their Enterprise and LDAP account, are added as new LDAP
users.
or
• Create a new account for every added LDAP alias
Use this option when you want to create a new account for each user.
5. Update Options allow you to specify if LDAP aliases are automatically
created for all new users. Select either:
• New aliases will be added and new users will be created
Use this option to automatically create a new alias for every LDAP
user mapped to BusinessObjects Enterprise. New LDAP accounts are
added for users without BusinessObjects Enterprise accounts, or for
all users if you selected the "Create a new account for every added
LDAP alias" option and clicked Update.
or
• No new aliases will be added and new users will not be created
Use this option when the LDAP directory you are mapping contains
Enterprise. BusinessObjects Enterprise does not automatically create
aliases and Enterprise accounts for all users. Instead, it creates aliases
(and accounts, if required) only for users who log on to
6. New User Options allow you to specify properties of the new Enterprise
accounts that are created to map to LDAP accounts. Select either:
• New users are created as named users

New user accounts are configured to use named user licenses. Named
user licenses are associated with specific users and allow people to
access the system based on their user name and password. This
provides named users with access to the system regardless of how
many other people are connected. You must have a named user
license available for each user account created using this option.
or
• New users are created as concurrent users
to BusinessObjects Enterprise at the same time. This type of licensing
is very flexible because a small concurrent license can support a large
user base. For example, depending on how often and how long users
access BusinessObjects Enterprise, a 100 user concurrent license
could support 250, 500, or 700 users.
7. Click Update.
Viewing mapped LDAP users and groups
You can view your LDAP mapped groups in BusinessObjects Enterprise by
clicking the LDAP tab (located in the Authentication management area). If
LDAP authorization is configured, the Mapped LDAP Member Groups area
displays the LDAP groups that have been mapped to BusinessObjects
Enterprise.
Unmapping LDAP groups
Similar to mapping, it is possible to unmap groups using BusinessObjects
Enterprise.
To unmap LDAP groups using BusinessObjects Enterprise
If LDAP authorization is configured, the LDAP summary page will appear.

3. In the "Mapped LDAP Member Groups" area, select the LDAP group you
would like to remove.
4. Click Delete, and then click Update.
The users in this group will not be able to access BusinessObjects
Enterprise.
Tip:
To deny LDAP Authentication for all groups, clear the "LDAP
Authentication is enabled" check box and click Update.
Note:
The only exceptions to this occur when a user has an alias to an Enterprise
account. To restrict access, disable or delete the user's Enterprise
account.
Changing LDAP connection parameters and member groups
After you have configured LDAP authentication using the LDAP configuration
wizard, you can change LDAP connection parameters and member groups
using the LDAP Server Configuration Summary Page.
For information on configuring LDAP authentication using the LDAP
configuration wizard, see Configuring LDAP authentication on page 472.
To change connection settings
If LDAP authorization is configured, the LDAP Server Configuration
Summary page appears. On this page you can change any of the
connection parameter areas or fields. You can also modify the Mapped
LDAP Member Groups area.
3. Delete currently mapped groups that will no longer be accessible under
the new connection settings, then click Update.
4. Change your connection settings, then click Update.
5. Change your Alias and New User options, then click Update.
6. Map your new LDAP member groups, then click Update.

LDAP and SiteMinder Workflow
To use SiteMinder and LDAP with BusinessObjects Enterprise, you need to
make configuration changes in two places:
• In the LDAP plug-in the CMC.
• In the web.xml file for your web application server.
Configuring the LDAP plug-in for SiteMinder
This section explains how to configure the CMC to use LDAP with SiteMinder.
SiteMinder is a third-party user access and authentication tool that you can
use with the LDAP security plug-in to create single sign-on to BusinessObjects
Enterprise. This section assumes that you have completed Configuring the
LDAP host on page 472 and chosen SiteMinder for your method of LDAP
single sign-on authentication.
Note:
Please ensure that the SiteMinder Administrator has enabled support for 4.x
Agents. This must be done regardless of what supported version of
SiteMinder you are using. For more information about SiteMinder and how
to install it, refer to the SiteMinder documentation.
To configure LDAP for single sign-on with SiteMinder
1. Open the Please configure your SiteMinder settings screen using one
of the following methods:
• Select SiteMinder on the "Please choose a method of LDAP single
sign-on authentication" screen in the LDAP configuration wizard.
• Select the "Single Sign On Type" link on the LDAP authentication
screen which is available if you have already configured LDAP and
are now adding SSO.
2. In the Policy Server Host box, type the name of each policy server, and
then click Add.
3. For each Policy Server Host, specify the Accounting, Authentication
and Authorization port numbers.
4. Enter the name of the Agent Name and the Shared Secret. Enter the
shared secret again.

Note:
Please ensure that the SiteMinder Administrator has enabled support for
4.x Agents. This must be done regardless of what supported version of
SiteMinder you are using. For more information about SiteMinder and
how to install it, refer to the SiteMinder documentation.
5. Click Next.
6. Proceed with configuring the LDAP options.
Modifying web.xml for LDAP and SiteMinder
To enable LDAP and SiteMinder
1. Open the configuration file for InfoView on the machine hosting the web
application server.
• For Java application server open the web.xml for Java InfoView. This
file is located in the following directory:
<INSTALLDIR>Business ObjectsBusinessObjects Enterprise
12.0warfilesWebAppsInfoViewAppWEB-INF.
• For IIS open the NET InfoView web.config file. This file is located
in the following directory:
<INSTALLDIR>Business Objects BusinessObjects Enterprise
12.0Web ContentInfoViewAppInfoViewApp
If you are using the version of Tomcat installed with BusinessObjects
Enterprise, the file is located by default in:
<Deployed Location>InfoViewAppWEB-INF
Note:
If you are using any other supported web application server, consult the
documentation for your web application server to determine the
appropriate path to substitute.
2. Locate the following string in the file:
<param-name>cms.default</param-name>
3. Enter the CMS name and port in the cms.default<param-value> field.
Use the format servername:portnumber.

<param-name>authentication.default</param-name>
5. Set the <param-value> for the authentication.default to secLDAP.
<param-value>secEnterprise</param-value>
<param-name>sso.enabled</param-name>
7. Change the <param-value> for sso.enabled from false to true.
<param-value>true</param-value>
<param-name>siteminder.enabled</param-name>
9. Change the <param-value> for siteminder.enabled from false to true.
<param-name>siteminder.authentication</param-name>
11. Set the <param-value> for siteminder.authentication to secLDAP.
<param-value>secLDAP</param-value>
13. Restart your web application server.
Troubleshooting SiteMinder single sign-on
If you are using SiteMinder with IIS, you may receive an error message in
the Central Management Console regarding the failure of single sign-on. If
you encounter this message, you may need to manually create two registry
keys for SiteMinder:
• Create the following key, set its type to REG_DWORD, and set its value to
1:

HKEY_LOCAL_MACHINESOFTWAREBusiness ObjectsSuite
12.0EnterpriseAdmin
PluginsCrystalEnterprise.CMSAdminEnableSiteMinderSingleSignOn
• Create a second key, set its type to REG_SZ, and set its value to the
authentication type that you want to use for SiteMinder single sign-on
(secLDAP or secWinAD):
HKEY_LOCAL_MACHINESOFTWAREBusiness ObjectsSuite
12.0EnterpriseAdmin
PluginsCrystalEnterprise.CMSAdminSiteMinderAuthentication
Ensure that the SiteMinder Administrator has enabled support for 4.x
Agents. This must be done regardless of what supported version of
SiteMinder you are using.
Troubleshooting LDAP accounts
Creating a new LDAP user account
• If you create a new LDAP user account, and the account does not belong
to a group account that is mapped to BusinessObjects Enterprise, either
map the group to BusinessObjects Enterprise, or add the new LDAP user
account to a group that is already mapped to BusinessObjects Enterprise.
For more information, see Configuring LDAP authentication on page 472.
• If you create a new LDAP user account, and the account belongs to a
group account that is mapped to BusinessObjects Enterprise, refresh the
user list. For more information, see Viewing mapped LDAP users and
groups on page 481.
Using AD authentication
This section provides a general description of how Windows Active Directory
(AD) authentication works with BusinessObjects Enterprise. It then introduces
the administration tools that allow you to manage and configure AD accounts
to BusinessObjects Enterprise.
12 Using AD authentication

Basic Windows AD authentication workflow
To use AD authentication with BusinessObjects Enterprise you must follow
the following workflow:
1. Enable the Windows AD security plug-in and map in users and groups.
2. Choose an authentication method:
3. Set up single sign on to BusinessObjects Enterprise applications. This
optional step can be facilitated via the following methods:
• Windows AD with SiteMinder
Support requirements
To facilitate Windows AD authentication on BusinessObjects Enterprise, you
should remember the following support requirements.
• The CMS must always be installed on a supported Windows platform.
• Although Windows 2000, 2003 and 2008 are supported platforms for both
Kerberos and NTLM authentication, certain BusinessObjects Enterprise
applications may only use particular authentication methods. For example,
Java applications such as Java InfoView and CMC only support Kerberos,
while .NET/COM applications such as .NET InfoView and Import Wizard
support both Kerberos and NTLM.
Users from external forests can only authenticate on BusinessObjects
Enterprise in the following scenarios:
• Windows 2000: support is only available for NTLM when using . NET/COM
applications such as .NET InfoView and Import Wizard) support. For Java
applications such as Java InfoView and CMC support is only available
for Kerberos.
• Windows 2003 and 2008: Java applications such as Java InfoView and
CMC only support Kerberos, while .NET/COM applications such as .NET
InfoView and Import Wizard support both Kerberos and NTLM.
Related Topics

• Using AD with SiteMinder on page 551
• Windows AD security plug-in on page 488
• Using AD users and groups on page 489
Windows AD security plug-in
Windows AD security plug-in enables you to map user accounts and groups
from your Microsoft Active Directory (AD) 2000, 2003, and 2008 user
database to BusinessObjects Enterprise. It also enables BusinessObjects
Enterprise to verify all logon requests that specify Windows AD Authentication.
Users are authenticated against the Windows AD user database, and have
their membership in a mapped AD group verified before the Central
Management Server grants them an active BusinessObjects Enterprise
session.
The AD security plug-in enables you to use these authentication methods:
• NTLM
• Kerberos
• SiteMinder
The AD security plug-in is compatible with both Microsoft Active Directory
2000, 2003, and 2008 domains running in either native mode or mixed mode.
Once you have mapped your AD users and groups, all of the BusinessObjects
Enterprise client tools support AD authentication. You can also create your
own applications that support AD authentication. For more information, see
the developer documentation available on the collaterals disk of your
product distribution.
• AD authentication only works if the CMS is run on Windows. For single
sign on to database to work, the reporting servers must also run on
Windows. Otherwise all other servers and services can run on all
supported platforms.
• The Windows AD plug-in for BusinessObjects Enterprise supports domains
within multiple forests.

Using AD users and groups
BusinessObjects Enterprise supports Active Directory (AD) authentication
with the Windows security plug-in, which is included by default when the
product is installed on Windows. Support for AD authentication means that
users and groups created in Microsoft Active Directory 2000, 2003, and 2008
can be used to authenticate with BusinessObjects Enterprise. This allows
you, the administrator, to map previously created user accounts and groups,
instead of setting up each user and group within BusinessObjects Enterprise.
Note:
AD authentication only works if the CMS is run on Windows. For single sign
on to database to work, the reporting servers must also run on Windows.
The following procedures describe the required steps for setting up Window
AD authentication for BusinessObjects Enterprise using either the Kerberos
or NTLM protocols.
Mapping AD accounts
To simplify administration, BusinessObjects Enterprise supports Windows
AD authentication for user and group accounts. However, before users can
use their AD user name and password to log on to BusinessObjects
Enterprise, their Windows AD user account needs to be mapped to
BusinessObjects Enterprise. When you map an Windows AD account, you
can choose to create a new BusinessObjects Enterprise account or link to
an existing BusinessObjects Enterprise account.
To map AD users and groups and configure the Windows AD security plug-in
Regardless of which protocol is used, you must complete the following steps
to allow AD users to authenticate.
1. Go to the "Authentication" management area of the CMC.
3. Ensure that Enable Windows Active Directory (AD) box is selected.
4. In the Windows AD Configuration Summary area, click the link beside
AD Administration Name.

Note:
Before the Windows AD plug-in is configured, this link will appear as two
double quotes. After the configuration has been saved, the link with be
populated with the AD Administration names.
5. Enter the name and password of an enabled domain user account.
BusinessObjects Enterprise will use this account to query information
from AD.
Administration credentials can use one of the following formats:
• NT name (DomainNameUserName)
• UPN (user@DNS_domain_name)
BusinessObjects Enterprise never modifies, adds or deletes content from
AD. It only reads information, therefore only the appropriate rights are
required.
Note:
AD authentication will not continue if the AD account used to read the AD
directory becomes invalid (for example, if the account's password is
changed or expires or the account is disabled).
6. Complete the Default AD Domain field.
Note:
• Groups from the default domain can be mapped without specifying
the domain name prefix.
• If you enter the Default AD Domain name, users from the default
domain do not have to specify the AD domain name when they log on
to BusinessObjects Enterprise via AD authentication.
7. In the "Mapped AD Member Groups" area, enter the AD domaingroup
in the Add AD Group (DomainGroup) field.
Groups can be mapped using one of the following formats:
• Security Account Manager account name (SAM), also referred to as
NT name (DomainNameGroupName)
• DN (cn=GroupName, ......, dc=DomainName, dc=com)
Note:
If you want to map a local group, you can use only the NT name format
(ServerNameGroupName). Windows AD does not support local users.

This means that local users who belong to a mapped local group will not
be mapped to BusinessObjects Enterprise. Therefore, they will not be
able to access BusinessObjects Enterprise.
8. Click Add.
The group is added to the list.
You can skip over the configuration of the "Authentication Options",
"Synchronization of Credentials" and "SiteMinder Options". For specific
information on how to configure Windows AD with Kerberos, NTLM, or
SiteMinder see Using AD authentication with Kerberos on page 496,Using
AD authentication with NTLM on page 519, or Using AD with SiteMinder
on page 551.
9. In the "AD Alias Options" area specify how new aliases are added and
updated to BusinessObjects Enterprise.
• Assign each new AD alias to an existing User Account with
the same name
account with the same name; that is, AD aliases will be assigned
same name in their Enterprise and AD account, are added as new
users.
• Create a new user account for each new AD alias
user.
Use this option to automatically create a new alias for every AD
user mapped to BusinessObjects Enterprise. New AD accounts
or for all users if you selected the "Create a new account for each
new AD alias" option and clicked Update

Use this option when the AD directory you are mapping contains
using this option
10. To configure how to schedule AD alias updates, click Schedule AD Alias
Updates.
a. In the "Schedule" dialog box, select a recurrence from the Run object
drop-down list.
b. Set any of the other schedule options and parameters as required.
c. Click Schedule.
When the alias update occurs, the group graph is also updated.
11. In the "Attribute Binding Options" area you can select the following optional
settings:
• Import Full Name and Email Address

If selected, the AD user account full names and descriptions are
imported and stored with the user object in BusinessObjects Enterprise.
• Give AD attribute binding priority over LDAP attribute binding
If selected, AD attributes take priority in scenarios where both Windows
AD and LDAP are enabled.
12. You can configure AD group graph updates in the "AD Group Graph
Options" area.
a. Click Schedule AD Group Graph Updates.
The "Schedule" dialog box appears.
b. Select a recurrence from the Run object drop-down list.
c. Set any of the other schedule options and parameters as required.
d. Click Schedule.
The system will schedule the update and run it according to the schedule
information you specified. You can view the next scheduled update for
the AD group accounts under the " AD Group Graph Options".
13. Use the settings in the "On-demand AD Update" area to specify what
should be updated. You can select from one of the following options:
• Update AD Group Graph now
Select this option if you want to update the group graph. The update
will occur only after you click Update.
Note:
This option affects any scheduled group graph updates. The next
scheduled group graph update is listed under " AD Group Graph
Options".
• Update AD Group Graph and Aliases now
Select this option if you want to update the group graph and user
aliases. The updates will occur only after you click Update.
Note:
This option affects any scheduled group graph or updates. The next
scheduled updates are listed under "AD Group Graph Options" and
"AD Alias Options".
• Do not update AD Group Graph and Aliases now

If you click Update, neither the group graph nor the user aliases will
be updated.
Note:
This option affects any scheduled group graph or updates. The next
scheduled updates are listed under "AD Group Graph Options" and
"AD Alias Options".
14. Click Update.
15. Click OK.
Scheduling AD updates
BusinessObjects Enterprise enables administrators to schedule updates for
AD group graphs or user aliases. This feature is available for AD
authentication with either Kerberos or NTLM. The CMC also enables you to
view the time and date when the last update was performed.
When scheduling an update, you can choose from the recurrence patterns
summarized in the following table:
DescriptionRecurrence pattern
The update will be run every hour. You specify at
what time it will start, as well as a start and end
date.
Hourly
The update will be run every day or run every
number of specified days. You can specify at what
time it will run, as well as a start and end date.
Daily
The update will be run every week. It can be run
once a week or several times a week. You can
specify on which days and at what time it will run,
as well as and a start and end date.
Weekly
The update will be run every month or every several
months. You can what time it will run, as well as a
start and end date.
Monthly

DescriptionRecurrence pattern
The update will run on a specific day in the month.
You can specify on which day of the month, what
time it will run, as well as a start and end date.
Nth Day of Month
The update will run on the first Monday of each
month. You can specify what time it will run, as well
as and a start and end date.
1st Monday of Month
The update will run on the last day of each month.
You can specify what time it will run, as well as and
a start and end date.
Last Day of Month
The update will run on a specified day of a specified
week of the month. You can specify what time it will
run, as well as and a start and end date.
X Day of Nth Week of the
Month
The update will be run on the dates specified in a
calendar that has previously been created.
Calendar
Scheduling group graph updates
BusinessObjects Enterprise relies on Active Directory (AD) for user and
group information. To minimize the volume of queries sent to AD, the AD
plug-in caches information about groups and how they relate to each other
and their user membership. The group graph is recreated every fifteen
minutes when no specific schedule is defined.
You can use the CMC to configure the recurrence of the group graph refresh.
This should be scheduled to reflect how frequently you will be changing
groups and group membership information.
Scheduling AD user alias updates
User objects can be aliased to a Windows Active Directory (AD) account,
allowing users to use their AD credentials to log on to BusinessObjects
Enterprise. Updates to AD accounts are propagated to BusinessObjects
Enterprise by the AD plug-in. Accounts created, deleted, or disabled in AD
will be correspondingly created, deleted, or disabled in BusinessObjects
Enterprise.

If you do not schedule AD alias updates, updates will only occur when:
• A user logs on: the AD alias will be updated.
• An administrator selects the Update AD Group Graph and Aliases now
option from the "On-demand AD Update" area of the CMC.
Note:
No AD passwords are stored in the user alias.
Configuring manual AD authentication
Using AD authentication with Kerberos
This section provides information on how to set up BusinessObjects
Enterprise to use AD and Kerberos authentication. It includes instructions
on setting up service accounts and granting appropriate rights to configure
Kerberos with your application server.
• Configuring Kerberos for your application server on page 496
• General workflow for configuring Kerberos on page 504
• Configuring Kerberos for .NET InfoView and IIS on page 515
Configuring Kerberos for your application server
This section contains the tasks related to configuring Kerberos for use with
these the following application servers:
• Tomcat
• WebSphere
• WebLogic
• Oracle Application Server
• IIS
Tomcat, WebSphere, WebLogic, and Oracle Application Server.
Note:
SAP Web Application Server with AD with Kerberos is not supported.
This section contains this information:
• Two type of workflows.

The general workflow that you must follow regardless of the web
application server you are using.
•
• The workflow specific to your web application server. This second
workflow is necessary because the implementation of Java
Authentication and Authorization Service (JAAS) varies between
different application servers.
• The procedural details for each step in the workflow.
• Two samples of Krb5.ini files (for Java application servers).
• Troubleshooting information.
Setting up a service account
To configure BusinessObjects Enterprise for Kerberos and Windows AD
authentication, you require a service account. You can either create a new
domain account or use an existing domain account. The service account will
be used to run the BusinessObjects Enterprise servers.
After you set up the service account, you will need to grant the account
appropriate rights, see Granting the service account rights on page 502.
How you create this account varies slightly depending on what version of
Active Directory Domain you are using:
• If you are using a Windows 2000 Domain, see Setting up a service account
on a Windows 2000 Domain on page 498.
• If you are using a Windows 2003 or 2008 Domain, see Setting up a service
account on a Windows 2003 or 2008 Domain on page 499.
• If you are using a Windows 2003 or 2008 Domain, you also have the
option of setting up constrained delegation. See Setting up constrained
delegation on page 500 for more information.
Note:
If you are setting up SSO2DB, the service account must be a domain account
that has been trusted for delegation.
Note:
In a forest with multiple domains you can create this service account in the
domain BusinessObjects Enterprise is installed on. All domains that trust the
domain you have created the service account in will be able to authenticate.

Setting up a service account on a Windows 2000 Domain
To set up the service account on a Windows 2000 Domain
1. Create an account on the domain controller or use an existing account.
For detailed instructions, refer to http://msdn.microsoft.com/
2. Right-click the user account, then select Properties.
3. Click the Account tab.
4. Select the Use DES encryption types for this account option.
Note:
If you need to set up SSO2DB, you must also select the Account is
trusted for delegation option.
To run the SPN utility on Windows 2000
1. Download the utility from this location to your Domain controller:
http://www.microsoft.com/windows2000/techinfo/reskit/tools/ex
isting/setspn-o.asp
Note:
The SETSPN utility is a program that allows you to manage the Service
Principal Name (SPN) for service accounts in Active Directory.
2. Open a command prompt and enter this command:
SETSPN.exe –A <ServiceClass>/<DomainName> <Serviceaccount>
Replace <ServiceClass> with any desired name. For example, BOBJ
CentralMS. (For clustered CMSs, use a generic name; do not use the
host name of a CMS machine.) Replace <DomainName> with the domain
name of the service account. For example, domain.com. Replace <Ser
viceAccount> with the domain user account that you've configured.
Note:
• The name of your service account is case-sensitive.
• The SPN must be unique in the forest in which it is registered. One
way to check is to use Windows support tool Ldp.exe to search for
the SPN.

3. Verify that you receive a message similar to this one:
Registering ServicePrincipalNames for CN=Ser
viceCMS,CN=Users,DC=DOMAIN,DC=COM BOBJCentralMS/domain.com
Updated object
Setting up a service account on a Windows 2003 or 2008 Domain
To set up the service account on a Windows 2003 or 2008 Domain
Note:
With a Windows 2003 or 2008 Domain, RC4 is the default encryption type
and should be used. You will need BusinessObjects Enterprise to be running
with JDK 1.5 or higher. (It ships with BusinessObjects Enterprise and is
installed by default.) If you want to use a lower JDK, you must check "Use
DES encryption".
Note:
If you are using WebLogic 9.2 (which does not work with RC4), you must
check "Use DES encryption". You also need the WebLogic's MP2 patch for
WebLogic 9.2.
1. Create a new account on the domain controller or use an existing account.
For detailed instructions, refer to http://msdn.microsoft.com/
2. Open a command prompt and enter this command:
Replace <ServiceClass> with any desired name. For example, BOBJ
CentralMS. (For clustered CMSs, use a generic name; do not use the
host name of a CMS machine.) Replace <DomainName> with the domain
name of the service account. For example, domain.com. Replace <Ser
viceAccount> with the domain user account that you've configured.
Note:
• The name of your service account is case-sensitive.
• The SPN must be unique in the forest in which it is registered. One
way to check is to use Windows support tool Ldp.exe to search for
the SPN.
3. Verify that you receive a message similar to this one:

Registering ServicePrincipalNames for
CN=ServiceCMS,CN=Users,DC=DOMAIN,DC=COM
BOBJCentralMS/domain.com Updated object
4. If you are using SSO2DB, open the account properties, click the
Delegation tab and select Trust this user for delegation to any service
(Kerberos only).
Note:
You will not see the Delegation tab until after you have entered the
SETSPN command.
5. Click OK.
Setting up constrained delegation
If your company has a policy against trusting a specific service account for
delegation to any service, and you are using Active Directory on Windows
2003 or 2008, you may set up constrained delegation. Setting up constrained
delegation is done after you create the service account. Constrained
delegation allows you to limit what services an account or computer can
delegate to, rather than allowing an authorized user to delegate to all services.
You can set up constrained delegation for Java applications by using a
service account.
This method allows you to limit the amount of delegation permitted.
Constrained delegation for a service account allows you to do further limit
delegation to a specific service for a specific user on a specific computer.
Because constrained delegation for a service account is more restrictive, it
is considered a more secure option.
Note:
• Constrained delegation is supported only on Active Directory 2003 and
2008.
• The account needs to be trusted for delegation only if you plan to use
SSO2DB.
To set up constrained delegation for a service account
1. Create an SPN for the CMS server.

Type the following command:
• Replace <ServiceClass> with any desired name. For example,
BOBJCentralMS. For clustered CMSs do not use the hostname of a
CMS machine; use a generic name.
• Replace <DomainName> with the domain name of the service account.
For example, domain.com.
• Replace <ServiceAccount> with the name of the service account
you just created.
2. Open Active Directory Users and Computers.
3. Select the Users folder.
4. Select the service account user.
5. Right-click, then select Properties.
6. Click the Delegation tab.
7. Select Trust this user for delegation to specified services only.
8. Ensure Use Kerberos only is selected.
9. Click Add.
10. Click Users and Computers.
11. Enter the <ServiceAccount> you specified in step 2, then click OK.
12. Select the <ServiceClass> name that you've chosen from the list of
services, then click OK.
13. Click OK.
Configuring the servers
Configuring the BusinessObjects Enterprise servers includes these steps:
• Adding the Service Account to the servers’ Local Administrators group
on page 502

Granting the service account rights
In order to support AD and Kerberos, you must grant the service account
the right to act as part of the operating system. This must be done on each
machine running a Server Intelligence Agent (SIA) with the following servers:
• CMS
• Crystal Reports Processing Server (required only for SSO2DB)
• Report Application Server (required only for SSO2DB)
• Web Intelligence Processing Server (required only for SSO2DB)
Note:
If you're using SSO2DB, you require a service account that has been trusted
for delegation. See Setting up a service account on page 497.
To grant the service account rights
1. Click Start > Control Panel > Administrative Tools > Local Security
Policy.
2. Expand Local Policies, then click User Rights Assignment.
3. Double-click Act as part of the operating system.
4. Click Add.
5. Enter the name of the service account you created, then click OK.
6. Ensure that the Local Policy Setting check box is selected, and click
OK.
7. Repeat the above steps on each machine running a BusinessObjects
Enterprise server.
Note:
It is important that the Effective Right ends up being checked after Act
as part of the operating system is selected. Typically, you will need to
restart the server for this to occur. If, after restarting the server, this option
is still not on, your Local Policy settings are being overridden by your
Domain Policy settings.
Adding the Service Account to the servers’ Local Administrators group
In order to support Kerberos, the service account must be part of the local
Administrators group for each server that has a SIA with one of the following
services deployed:

• CMS
Note:
for delegation. See Setting up a service account on page 497. You must also
have administrative rights on the server.
To add an account to the Administrator's group
1. On the desired machine, right-click My Computer and click Manage.
2. Go to System Tools > Local Users and Groups > Groups.
3. Right-click Administrators, then click Add to Group.
4. Click Add and type the logon name of the service account.
5. Click Check Names to ensure that the account resolves.
6. Click OK, then click OK again.
7. Repeat these steps for each Business Objects server that has to be
configured.
Configuring the servers to use the service account
To support Kerberos single sign-on, you must configure the SIA that contains
the following servers to log on as the service account:
• CMS server
Note:
for delegation. See Setting up a service account on page 497.

To configure a server
Note:
You need to perform the following steps for any Server Intelligence Agent
that is running services used in the previous steps for configuring the service
account.
1. In the Central Configuration Manager (CCM), stop the Server Intelligence
Agent (SIA).
Note:
When you stop the SIA, all services managed by the SIA are stopped.
2. Double-click the SIA to view its properties.
3. On the Properties tab, in the Log On As area, deselect the System
Account check box.
4. Provide the user name and password for the service account you created
earlier, click Apply, then click OK.
Note:
For information about creating the service account, see Setting up a
service account on page 497.
5. Restart the SIA.
6. If necessary, repeat steps 1 through 5 for each SIA that is running a
service that has to be configured.
General workflow for configuring Kerberos
This section outlines the process of setting up BusinessObjects Enterprise
to use AD with Kerberos authentication.
Setting up Kerberos includes these steps:
• Enabling Kerberos authentication in the Windows AD plug-in on page 506

Workflow for configuring Tomcat for Kerberos
If you are using Tomcat, and you want to use Kerberos, you must complete
these steps, in addition to the General workflow for configuring Kerberos on
page 504.
• To create the Kerberos configuration file for Tomcat, WebLogic or Oracle
Application Server on page 508
• To create the JAAS login configuration file for Tomcat or WebLogic on
page 510
• To modify the Java options for Kerberos on Tomcat on page 512
Workflow for configuring WebSphere for Kerberos
If you are using WebSphere, and you want to use Kerberos, you must
complete these steps, in addition to the General workflow for configuring
Kerberos on page 504.
• Configuring Kerberos and single sign-on for Java InfoView on page 520
• To create the JAAS login configuration file for WebSphere on page 511
• To modify the Java options for Kerberos on WebSphere on page 514
Workflow for configuring WebLogic for Kerberos
If you are using WebLogic, and you want to use Kerberos, you must complete
page 504.
• To create the JAAS login configuration file for Tomcat or WebLogic on
page 510
• To modify the Java options for Kerberos on WebLogic on page 513
Workflow for configuring Oracle for Kerberos
If you are using Oracle, and you want to use Kerberos, you must complete
page 504.
• To create the JAAS login configuration file for Oracle Application Server
on page 511

• To modify the Java options for Kerberos on Oracle Application Server on
page 513
Workflow for configuring IIS for Kerberos
Configuring AD and Kerberos for .NET InfoView includes these steps:
Enabling Kerberos authentication in the Windows AD plug-in
In order to support Kerberos, you have to configure the Windows AD security
plug-in in the CMC to use Kerberos authentication. This includes:
• Ensuring Windows AD authentication is enabled.
• Entering the AD Administrator account.
Note:
This account requires read access to Active Directory only; it does not
require any other rights.
• Enabling Kerberos authentication and single sign-on, if single sign-on is
desired.
Note:
If you enable single sign-on in the CMC, you also must configure it in the
web.xml or web.config file for InfoView.
• Entering the service principal name (SPN) for the service account.
Related Topics
• Configuring Kerberos and single sign-on for Java InfoView on page 520
• Configuring Kerberos and single sign-on for .NET InfoView on page 542
Prerequisites
Before you configure the Windows AD security plug-in for Kerberos, you
must have completed the following tasks:

To configure the Windows AD security plug-in for Kerberos
You should review the steps outlined in the following section:To map AD
users and groups and configure the Windows AD security plug-in on page 489
3. Ensure that the Windows Active Directory Authentication is enabled
check box is selected.
4. Under Authentication Options, select Use Kerberos authentication.
5. If you want to configure single sign-on to a database, select the Cache
Security context (required for SSO to database) check box.
6. In the Service principal name field, enter the SPN mapped to the service
account.
Note:
When manually logging on to Java InfoView, users from other domains
must append the domain name in upper case after their user name. For
example: user@CHILD.PARENTDOMAIN.COM.
7. If you want to configure single sign-on, select Enable Single Sign On
for selected authentication mode.
Note:
If you selected to enable single sign on, you will need to configure either
the InfoView web.xml or the web.config file.
Related Topics
• Single sign-on with Windows AD on page 519
Configuring Kerberos for your Java application server
The specific process of configuring Kerberos for a Java application server
varies slightly depending on which Java application server is used. However,
the general process of configuring Kerberos on your application server
involves these steps:
• Creating the Kerberos configuration file.
• Creating the JAAS login configuration file.

• Modifying the Java Options.
• Restarting your Java application server.
Note:
• SAP Web Application Server and Java AD with Kerberos is not supported.
• The default Active Directory domain must be in uppercase DNS format.
• You don't need to download and install MIT Kerberos for Windows. You
also no longer require a key tab for your service account.
To create the Kerberos configuration file for Tomcat, WebLogic or Oracle
Application Server
Follow these steps to create the Kerberos configuration file if you’re using
Tomcat, Oracle Application Server or WebLogic.
for Windows.
Note:
• If the application server is installed on UNIX, you should use the
following directories:
Solaris: /etc/krb5/krb5.conf
Linux: /etc/krb5.conf
• You can store this file in a different location, however if you do, you
will need to specify its location in your java options. See Modifying
your Java options for Kerberos on page 512. For more information on
krb5.ini go to http://docs.sun.com/app/docs/doc/816-
0219/6m6njqb94?a=view.
[libdefaults]
[domain_realm]
[realms]
DOMAIN.COM = {

}
DOMAIN2.COM = {
}
[capaths]
DOMAIN2.COM = {
DOMAIN.COM =
}
Note:
• DNS.COM is the DNS name of your domain which must be entered in
uppercase in FQDN format.
• kdc is the Host name of the Domain Controller.
• You can add multiple domain entries to the [realms] section if your
users log in from multiple domains. To see a sample of this file with
multiple domain entries, see Sample Krb5.ini files on page 511.
• In a multiple domain configuration, under [libdefaults] the de
fault_realm value may be any of the desired domains. The best
practice is to use the domain with the greatest number of users that
will be authenticating with their AD accounts. If no UPN suffix is
supplied during at log on, it defaults to the value of default_realm.
This value should be consistent with default domain setting in CMC.
To create the Kerberos configuration file for WebSphere
for Windows.
Note:
• You can store this file in a different location, however if you do, you
will need to specify its location in your java options. See Modifying
your Java options for Kerberos on page 512.
• To see sample krb5.ini files, see Sample Krb5.ini files on page 511.
[libdefaults]

[domain_realm]
[realms]
DOMAIN.COM = {
}
DOMAIN2.COM = {
}
[capaths]
DOMAIN2.COM = {
DOMAIN.COM =
}
Note:
• If you are using DES encryption, change rc4-hmac to des-cbc-crc.
• DOMAIN.COM is the DNS name of your domain which must be entered
in uppercase in FQDN format.
• hostname is the Host name of the Domain Controller.
• [capath] defines the trust between domains that are in another AD
forest. In the example above DOMAIN2.COM is a domain in an external
forest and has direct two way transitive trust to DOMAIN.COM.
To create the JAAS login configuration file for Tomcat or WebLogic
default location: C:WINNT.
Note:
You can store this file in a different location. However, if you do, you will
need to specify its location in your java options. See Modifying your Java
options for Kerberos on page 512.
com.sun.security.auth.module.Krb5LoginModule required;
};

To create the JAAS login configuration file for Oracle Application Server
1. Locate the jazn-data.xml file.
Note:
This default location for this file is C:OraHome_1j2eehomeconfig. If
you installed Oracle Application Server in a different location, find the file
specific to your installation.
2. Add the following content to the file between the <jazn-loginconfig>
tags:
<application>
<name>com.businessobjects.security.jgss.initiate</name>
<login-modules>
<login-module>
<class>com.sun.security.auth.module.Krb5LoginModule</class>
<control-flag>required</control-flag>
</login-module>
</login-modules>
</application>
To create the JAAS login configuration file for WebSphere
default location: C:WINNT
com.ibm.security.auth.module.Krb5LoginModule required;
};
Sample Krb5.ini files
Sample multiple domain Krb5.ini file
The following is a sample file with multiple domains:
[domain_realm]
; trust relationship: childtest4<->bobjtest3<->bobjtest<-
>bobjtest2
[libdefaults]
default_realm = BOBJTEST.COM

[realms]
BOBJTEST.COM = {
kdc = VANPGVMBOBJ01.bobjtest.com
}
BOBJTEST2.COM = {
kdc = VANPGVMBOBJ05.bobjtest2.com
}
BOBJTEST3.COM = {
}
CHILDTEST4.BOBJTEST3.COM = {
kdc = vanpgvmbobj08.childtest4.bobjtest3.com
}
[capaths]
; for clients in bobjtest3 to login bobjtest2
BOBJTEST3.COM = {
BOBJTEST2.COM = BOBJTEST.COM
}
; for clients in childtest4 to login bobjtest2
CHILDTEST4.BOBJTEST3.COM = {
BOBJTEST2.COM = BOBJTEST.COM
BOBJTEST2.COM = BOBJTEST3.COM
}
Sample single domain Krb5.ini file
Following is a sample krb5.ini file with a single domain.
[realms]
BOBJTEST2.COM = {
}
Modifying your Java options for Kerberos
You need to configure specific Java options depending on the application
server you are using:
• To modify the Java options for Kerberos on Tomcat on page 512
• To modify the Java options for Kerberos on WebLogic on page 513
• To modify the Java options for Kerberos on Oracle Application Server on
page 513
• To modify the Java options for Kerberos on WebSphere on page 514
To modify the Java options for Kerberos on Tomcat
1. From the Start menu, select Programs >Tomcat > Tomcat
Configuration.

2. Click the Java tab.
3. Add the following options:
-Djava.security.auth.login.config=C:XXXXbscLogin.conf
-Djava.security.krb5.conf=C:XXXXkrb5.ini
Replace XXXX with the location you stored the file.
4. Close the Tomcat configuration file.
5. Restart Tomcat.
To modify the Java options for Kerberos on WebLogic
If you are using Kerberos with WebLogic, your Java options need to be
modified to specify the location of the Kerberos configuration file and the
Kerberos login module.
1. Stop the domain of WebLogic that runs your BusinessObjects Enterprise
applications.
2. Open the script that starts the domain of WebLogic that runs your
BusinessObjects Enterprise applications (startWeblogic.cmd for
Windows, startWebLogic.sh for UNIX).
3. Add the following information to the Java_Options section of the file:
set JAVA_OPTIONS=-Djava.security.auth.login.con
fig=C:/XXXX/bscLogin.conf -Djava.securi
ty.krb5.conf=C:/XXX/krb5.ini
4. Restart the domain of WebLogic that runs your BusinessObjects Enterprise
applications.
To modify the Java options for Kerberos on Oracle Application Server
If you are using Kerberos with Oracle Application Server, the Java options
need to be modified to specify the location of the Kerberos configuration file.
1. Log on to the administration console of your Oracle Application Server.
2. Click the name of the OC4J instance that runs your BusinessObjects
Enterprise applications.
3. Select Server Properties.
4. Scroll down to the Multiple VM Configuration section.

5. In the Command Line Options section, append the following at the end
of the Java Options text field: -Djava.securi
ty.krb5.conf=C:/XXXX/krb5.ini replacing XXXX with the location
where you stored the file.
6. Restart your OC4J instance.
To modify the Java options for Kerberos on WebSphere
1. Log into the administrative console for WebSphere.
For IBM WebSphere 5.1, type http://servername:9090/admin. For
IBM WebSphere 6.0, type http://servername:9060/ibm/console
2. Expand Server, click Application Servers, and then click the name of the
application server you created to use with BusinessObjects Enterprise.
3. Go to the JVM page.
If you are using WebSphere 5.1, follow these steps to get to the JVM
page.
a. On the server page, scroll down until you see Process Definition in
the Additional Properties column.
b. Click Process Definition.
c. Scroll down and click Java Virtual Machine.
If you are using WebSphere 6.0, follow these steps to get to the JVM
page.
a. On the server page, select Java and Process Management.
b. Select Process Definition.
c. Select Java Virtual Machine.
4. Click Generic JVM arguments then type the location of your Krb5.ini
and the location of your bscLogin.conf file.
-Djava.security.auth.login.config=C:XXXXbscLogin.conf
-Djava.security.krb5.conf=C:XXXXkrb5.ini
5. Click Apply, and then click Save.
6. Stop and restart the server.

Configuring Kerberos for .NET InfoView and IIS
Additional configuration steps are required for authentication to
BusinessObjects Enterprise .NET InfoView with Windows AD. Once these
steps have been implemented, users will be able to enter their AD username
and password to logon to .NET InfoView via Kerberos authentication.
Note:
If you wish to allow users to logon to Java Applications as well, please see
the section on Configuring Kerberos for your Java Applications server.
To configure Kerberos for .NET InfoView and IIS
The steps below must be implemented after you have performed all of the
following:
• Mapped AD users and groups
• Configured the Windows AD security plug-in for Kerberos authentication
• Set up a service account
• Configured Kerberos for you application server
1. Open the web.config file for .NET InfoView.
The file is by default installed in the following directory:<INSTALLDIR>
Business ObjectsBusinessObjects Enterprise 12.0Web
ContentInfoViewAppInfoViewApp.
2. Modify the web.config file settings:
• To set Windows AD as default authentication option for InfoView,
modify the <add key="authentication.default" value="secEn
terprise"/> section to <add key="authentication.default"
value="secWinAD"/>
• If you want the user to select an authentication option before logging
on to InfoView, modify the <add key="authentication.visible"
value="false"/> section to <add key="authentication.visible"
value="true"/>.
3. Save and close the web.config file.
4. Restart IIS.
Users will now be able to use their AD usernames and passwords to
logon to .NET InfoView via Kerberos authentication.

Users should now be able to logon to .NET InfoView with their AD username
and password via Kerberos authentication.
Note:
Users in the same forest will need to logon with either DOMAINusername
or username@DOMAIN.COM. Users in External Forests will need to logon
with username@DOMAIN.COM.
Related Topics
• To map AD users and groups and configure the Windows AD security
plug-in on page 489
Server cache expiry
When the system is using AD and Kerberos single sign-on, it uses the cache
expiry for certain BusinessObjects Enterprise servers to determine whether
a logon ticket is still valid. This applies to the CMS, Crystal Reports
Processing Server, Report Application Server, and Web Intelligence
Processing Server.
The CMS uses the cache expiry as follows:
• If the CMS cache expiry is greater than that of the ticket, the system
renews the ticket until the CMS cache expiry is reached.
• If the CMS cache expiry is less than that of the ticket, the ticket will expire
when the CMS cache expiry is reached.
• If the CMS cache expiry is zero, the system will use the globally set ticket
expiry.
The other servers use either their cache expiry or the ticket expiry, whichever
has the lowest value. Regardless of whether the cache expiry for the server
is greater or less than that of the ticket, the ticket will expire when the lowest
expiry value is reached.
The system comes configured with default values for the server cache expiry.
To change the default values for the cache expiry, see Modifying the default
cache expiry value on page 517.

Note:
If you are running multiple instances of a server, you can control the cache
expiry for each instance individually.
Modifying the default cache expiry value
To change the default cache expiry value
2. Click the link for the server.
4. Change the Single Sign-On Expiry value, then click Save.
Troubleshooting Kerberos
These steps may help you if you encounter problems when configuring
Kerberos:
• Enabling logging
• Testing your Java SDK Kerberos configuration
To enable logging
1. From the Start menu, select Programs >Tomcat > Tomcat
Configuration
2. Click the Java tab.
3. Add the following options:
-Dcrystal.enterprise.trace.configuration=verbose
-sun.security.krb5.debug=true
This will create a log file in the following location:
C:Documents and Settings<user name>.businessob
jectsjce_verbose.log
To test your Java Kerberos configuration
• Run the following command to test your Kerberos configuration, where
servact is the service account and domain under which the CMS is
running, and password is the password associated with the service
account.
<Install Directory>Business Objectsjavasdkbinkinit.exe

For example:
C:Program FilesBusiness Objectsjavasdkbinkinit.exe
If you still have a problem, ensure that the case you entered for your
domain and service principal name match exactly with what is set in Active
Directory.
Mapped AD user unable to log on to CMC or InfoView
The following two issues may occur, despite the fact that the users have
been mapped to BusinessObjects Enterprise:
• Logon failure due to different AD UPN and SAM names on page 518
• Pre-authentication error on page 518
Logon failure due to different AD UPN and SAM names
A user's Active Directory ID has successfully been mapped to
BusinessObjects Enterprise. Despite this fact, they are unable to successfully
log on to CMC or InfoView with Java AD authentication and Kerberos in the
following format: DOMAINABC123
This problem can happen when the user is set up in Active Directory with a
UPN and SAM name that are not the same, either in case or otherwise.
Following are two examples which may cause a problem:
• The UPN is abc123@company.com but the SAM name is
DOMAINABC123.
• The UPN is jsmith@company but the SAM name is DOMAINjohnsmith.
There are two ways to address this problem:
• Have users log in using the UPN name rather than the SAM name.
• Ensure the SAM account name and the UPN name are the same.
Pre-authentication error
A user who has previously been able to log on, can no longer log on
successfully. The user will receive this error: Account Information Not
Recognized. The Tomcat error logs reveal the following error: "Pre-authen
tication information was invalid (24)"

This can occur because the Kerberos user database didn't get a change
made to UPN in AD. This may mean that the Kerberos user database and
the AD information are out of sync.
To resolve this problem, reset the user's password in AD. This will ensure
the changes are propagated correctly.
Note:
This problem is not an issue with J2SE 5.0.
Using AD authentication with NTLM
This section provides information on how to setup manual NTLM
authentication to BusinessObjects Enterprise .NET InfoView with Windows
AD. Once these steps have been implemented, users will be able to enter
their AD username and password to logon to .NET InfoView as well as other
BusinessObjects Enterprise Windows applications
Note:
With NTLM Authentication, users can use their AD credentials to authenticate
to .NET InfoView, .NET Applications, and Windows BusinessObjects
Enterprise thick client applications such as Crystal Reports or Import Wizard.
However users will not be able to use their AD credentials to authenticate
to Java applications such Central Management Console (CMC) and Web
Services. If your users need to authenticate to both .NET and Java
applications, you must use Kerberos authentication.
Configuring AD single sign on
Single sign-on with Windows AD
The Windows AD security plug-in supports single sign-on, thereby allowing
authenticated AD users to log on to BusinessObjects Enterprise without
explicitly entering their credentials. The single sign-on requirements depend
upon the way in which users access BusinessObjects Enterprise: either via
a thick client, or over the Web. In both scenarios, the security plug-in obtains

the security context for the user from the authentication provider, and grants
the user an active BusinessObjects Enterprise session if the user is a member
of a mapped AD group.
To obtain AD single sign-on functionality from a thick-client application (such
as the Publishing Wizard), the user must be running a Windows operating
system, and the application must use the BusinessObjects Enterprise SDK.
In this scenario, the Windows AD security plug-in queries the operating
system for the current user's credentials when the client is launched.
Configuring Kerberos and single sign-on for Java InfoView
The following procedure explains how to enable Kerberos single sign-on for
Java InfoView.
Note:
If you plan to use single sign-on to Java InfoView in a reverse proxy
environment, read Configuring reverse proxy servers for BusinessObjects
Enterprise web applications on page 364 before proceeding.
Before you configure single sign-on for Java InfoView, you must complete
configuration prerequisites: these prerequisites are the steps from the General
workflow for configuring Kerberos on page 504 and the steps that apply
specifically to your type of Java application server.
Also, ensure that single sign-on is enabled in the Authentication settings in
the CMC. For details, go to Enabling Kerberos authentication in the Windows
AD plug-in on page 506.
See these sections for the configuration steps that apply specifically to your
Java application server:
• Workflow for configuring Tomcat for Kerberos on page 505
• Workflow for configuring WebSphere for Kerberos on page 505
• Workflow for configuring WebLogic for Kerberos on page 505
• Workflow for configuring Oracle for Kerberos on page 505
Workflow for configuring Kerberos single sign-on to Java InfoView
To configure Kerberos single sign-on for Java InfoView, complete the six
steps in the following table.

To create a service account with delegation to be used for Vintela single sign-on
for Java on page 522
Step
1
To create an SPN for your web application server on page 523
Step
2
To reset the service account password on page 523
Step
3
To create and place a keytab file on page 524
Step
4
To enable Vintela single sign-on for Java in the web.xml file on page 524
Step
5
Setting up multiple SPNs on page 530
Step
6
To increase the header size limit of your Java application server on page 531
Step
7
The following sections describe how to complete each of these steps.
In addition to the steps you must complete, you may also want to change
either of these configurable items available with Vintela single sign-on for
Java:
• The level of error logging recorded.
• The text users receive if their authentication with Vintela single sign-on
for Java fails.
For details, see Modifying the Vintela logon error page on page 535 and
Controlling logging with Vintela single sign-on for Java on page 532.

The final section, Alternate URL to access InfoView on page 535, explains
why there is an alternate page provided and lists the URL for this page.
To create a service account with delegation to be used for Vintela
single sign-on for Java
To set up user authentication for a service, you must register the service as
a user in AD on the Domain Controller.
1. To register the service, on the Domain Controller, open the Active
Directory Users and Computers snap in.
2. Click the Users folder to display a list of users and on the Action menu,
click New and then click User.
3. Enter a name and logon name for the new service, and then click Next.
4. On the next screen, enter a password for the service.
Ensure that the User must change password at next logon option is
not selected.
5. Click Next and then click Finish.
6. Right-click the user you have entered in the User folder list, and then click
Properties.
7. Click the Account tab and then select Account is trusted for delegation
and Password never expires.
This prevents the service account from expiring, which would cause
Kerberos errors.
Note:
• If AD is deployed in a Windows 2003 Domain, the Account is trusted
for delegation option is not available until a Service Principal Name
has been created and mapped to this account. If you do not see this
option, complete the steps in the next section, then open the user
account in the AD Users and Computers snap in and select the
Delegation tab.
• This service account cannot currently be set up with Microsoft's
constrained delegation.
8. If your Domain Controller is running in a lower Domain Functional Level
(lower than Windows 2003 Domain), view the Account properties for the
user you created in step 2, and select Use DES encryption types for
this account.

Note:
In Windows 2003 and 2008, Domain Functional Level RC4 is used by
default.
9. Click OK.
To create an SPN for your web application server
Note:
Make sure that the SPN you are creating does not already exist and is
mapped to another account. If so, you must remove this SPN with the setspn
utility or delete the account that the SPN is mapping to.
1. Launch a command prompt and navigate to your Support Tools folder.
2. Execute the following command:
ktpass -princ HTTP/<myurl>@<REALM> -mapuser <user>
where
• <myurl> is the URL that your users type in their web browser to access
InfoView. For example, if the URL is http://examplemachine.example
domain.com:8080/InfoViewApp/ then <myurl> must be: examplema
chine.exampledomain.com.
• <REALM> is the Active Directory realm in which the server is located.
(For example, EXAMPLE.COM).
• <user> is the logon name of the user account you created above.
To reset the service account password
To prevent Kerberos integrity-check failures, you should reset the password
of the user account you created in step 1.
1. On the Domain Controller with Active Directory installed, on the Start
menu click Programs > Administrative Tools > Active Directory Users
and Computers.
2. Right-click the user account you created previously and click Reset
Password.
3. Enter and confirm the same password that you entered previously.
4. Ensure that User must change password at next logon is not selected
and click OK.

To create and place a keytab file
You can configure the Kerberos filter to use either a password or a keytab
file. A keytab file is the recommended method because it is more secure. A
keytab file allows the Kerberos filter to be configured without exposing the
password of the user account on the web application machine.
1. Run ktpass with the following arguments at command prompt:
ktpass -out keytab_filename -princ HTTP/host@REALM -pass
user_password -kvno 255
-ptype KRB5_NT_PRINCIPAL -crypto encryption_type
where
• keytab_filename is the name of the keytab file we want to generate.
(host.keytab, for example).
• HTTP/host@REALM is the SPN created in To create an SPN for your
web application server on page 523 (for example,
HTTP/myurl.mydomain.com@MYDOMAIN.COM).
• user_password is the password of the user used in the Map a Service
Principle Name (SPN) section.
• encryption_type is the type of encryption associated with the service
account you created in To create a service account with delegation
to be used for Vintela single sign-on for Java on page 522. If you are
using DES encryption, use DES-CBC-MD5. If you are using RC4
encryption, use RC4-HMAC-NT.
2. Copy the generated keytab file onto the java application machine and
place in your chosen location.
Note:
• The keytab is usually found in the same folder as your ktpass support
tool unless you specified a different location.
• Typically the keytab is stored in C:/WINNT or C:/Windows.
To enable Vintela single sign-on for Java in the web.xml file
This procedure can be used for both InfoView and OpenDocument.
Note:
If you are using WebLogic as your application server, read Special
considerations for WebLogic on page 528 before proceeding.

1. Open the web.xml file for InfoView or OpenDocument from its deployed
location on your web application server.
The InfoView web.xml file is stored in the following location on Windows:
<INSTALLDIR>Business ObjectsBusinessObjects Enterprise
12.0warfilesWebAppsInfoViewAppWEB-INF.
The OpenDocument web.xml file is stored here: <INSTALLDIR>Business
ObjectsBusinessObjects Enterprise 12.0warfilesWebAppsOpen
DocumentWEB-INF.
Note:
• If you are using the version of Tomcat installed with BusinessObjects
Enterprise on Windows, and you did not modify the default installation
location, replace <INSTALLDIR> with C:Program Files
• If you are using any other supported web application server, consult
the documentation for your web application server to determine the
appropriate path.
2. Find the following parameters and make the appropriate changes:
New <param-value>Original <param-value><param-name>
your CMS name and
port number
your CMS name and port
number
cms.default (for the
InfoView web.xml file
only)
default CMSdefault CMS
opendoc.cms.default
(for the OpenDocu-
ment web.xml file on-
ly)
SecWinADSecEnterpriseauthentication.default
falsetruesiteminder.enabled
truefalsevintela.enabled
falsefalsesso.enabled

3. Find the following section in the web.xml file:

4. Remove the comment start tag that immediately follows this comment as
well as its corresponding end tag.
5. Find the following section in the web.xml file:

6. Remove the comment start tag that immediately follows this comment as
well as its corresponding end tag.
7. For the OpenDocument web.xml add the following to the uncommented
section:
<filter-mapping>
<filter-name>authFilter</filter-name>
<url-pattern>/opendoc/logonTrustedAuth.do</url-pattern>
</filter-mapping>
8. Find the following parameters and make the appropriate changes:
Default realm for AD.
This should be the
same value you set
when you configured
the default_realm in
your krb5.ini file.
The value must be in
upper case.
YOUR_REALMidm.realm

The SPN you created
in To create an SPN for
your web application
server on page 523 . It
must follow the format:
HTTP/url where url
is the URL your users
will use to access In-
foView.
YOUR_PRINCIPALidm.princ
falsefalseidm.allowNTLM
true, unless you plan to
use SSL
trueidm.allowUnsec ured
9. Add the idm.keytab parameter. In the Vintela section of the web.xml file
add the following lines.
Note:
• Place it after the idm.princ parameter and values.
<init-param>
<param-name>idm.keytab</param-name>
<param-value>PATH_TO_YOUR_KEYTAB_FILE</param-value>
</init-param>
Where Path_To_Your_Keytab_File is the directory path to the location
of your keytab file. For example, C:WINNThost.keytab
• Only add the above parameter if you have chosen to use a keytab file.
If you have chosen to use a password do not add this parameter.
10. Save and close the file, then restart your web application server.
Note:
If you are using WebLogic, go to To modify the web.xml in the war
package on page 529.

Special considerations for WebLogic
If you are using WebLogic as your application server, you may not find the
commented section in the Vintela xml properties that is mentioned in To
enable Vintela single sign-on for Java in the web.xml file on page 524. This
is because WebLogic Builder, which is used in preparing the war files for
deployment, removes the commented portions of the web.xml file.
Therefore, you must add the following xml to the web.xml file before
proceeding with Step 5.
<filter>
<filter-class>com.businessobjects.sdk.credential.Wrappe
dResponse
AuthFilter</filter-class>
<init-param>
<param-name>idm.realm</param-name>
<param-value>YOUR_REALM</param-value>
</init-param>
<init-param>
<param-name>idm.princ</param-name>
<param-value>YOUR_PRINCIPAL</param-value>
</init-param>
<init-param>
<param-name>idm.allowUnsecured</param-name>
</init-param>
<init-param>
<param-name>idm.allowNTLM</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>idm.logger.name</param-name>
<param-value>simple</param-value>
<description>The unique name for this logger.</description>
</init-param>
<init-param>
<param-name>idm.logger.props</param-name>
<param-value>error-log.properties</param-value>
<description>Configures logging from the
specified file.</description>
</init-param>

For InfoView include the following:
<init-param>
<param-name>error.page</param-name>
<param-value>/InfoView/logon/vintelaError.jsp
</param-value>
<description>The URL of the page to show if an error
occurs during authentication.</description>
</init-param>
</filter>
<filter-mapping>
<url-pattern>/InfoView/logon/logon.do</url-pattern>
</filter-mapping>
For OpenDocument include the following:
<init-param>
<param-name>error.page</param-name>
<param-value>/opendoc/vintelaError.jsp
</param-value>
<description>The URL of the page to show if an error
occurs during authentication.</description>
</init-param>
</filter>
<filter-mapping>
<url-pattern>/opendoc/logonVintela.do/url-pattern>
</filter-mapping>
<filter-mapping>
<url-pattern>/opendoc/logonTrustedAuth.do</url-pattern>
</filter-mapping>
Return to To enable Vintela single sign-on for Java in the web.xml file on
page 524 and complete the steps there.
To modify the web.xml in the war package
Note:
Whenever you restart WebLogic, the web.xml will be overwritten and you
will lose the above section. To avoid this issue, you can modify the web.xml
in the actual war package for InfoView or OpenDocument. The InfoViewApp
war file is used as an example in the following steps.
1. Locate the InfoViewApp.war file.

On Windows, the file is located at <INSTALLDIR>Business Ob
jectsBusinessObjects Enterprise 12.0javaapplications. If
you did not modify the default installation location, replace <INSTALLDIR>
with C:Program Files.
2. Create a folder called WEB-INF and place the modified web.xml file in this
folder.
Note:
You must configure the web.xml file with the steps described in To enable
Vintela single sign-on for Java in the web.xml file on page 524 first.
3. Open a command window.
4. Change directories to the folder containing the InfoViewApp.war.
5. Execute the following command:
<INSTALLDIR>javasdkbin –uf InfoViewApp.war
WEB-INF/web.xml
If you did not modify the default installation location, replace <INSTALLDIR>
with C:Program FilesBusiness Objects.
6. Return to To enable Vintela single sign-on for Java in the web.xml file on
page 524 and complete the tasks outlined there.
Setting up multiple SPNs
This step is optional. If you want to use single sign-on to InfoView with various
URLs, you need to complete this step. For example, you need to perform
these steps if you want your users to access an application server from a
load-balanced URL, but you want administrators to access the application
server directly.
Note:
This section assumes you have already completed steps 2 and 3. For a
complete list of steps, see Workflow for configuring Kerberos single sign-on
to Java InfoView on page 520.

For each additional URL that you want to enable single sign-on to InfoView
for, you need to add additional SPN mappings to the service account you
created in step 1. Run the following command:
setspn -A HTTP/<myurl>@<REALM> -mapuser <user>
where
• <myurl> is the URL that your users will access InfoView with. For example,
if the URL is
http://examplemachine.exampledomain.com:8080/InfoViewApp/ then
myurl must be: examplemachine.exampledomain.com.
• <REALM> is the Active Directory realm in which the server is located. (For
example, EXAMPLE.COM).
• <user> is the logon name of the user account you created in Step 1.
To increase the header size limit of your Java application server
Active Directory creates a Kerberos token which is used in the authentication
process. This token is stored in the HTTP header. Your Java application
server will have a default HTTP header size. To avoid failures, ensure that
it has a minimum default size of 16384 bytes. (Some deployments may
require a larger size. For more information, see Microsoft's sizing guidelines
on their support site (http://support.microsoft.com/kb/327825).)
1. On the server with Tomcat installed, open the server.xml file.
On Windows, this file is located at <TomcatINSTALLDIR>/conf
Enterprise on Windows, and you did not modify the default
installation location, replace <TomcatINSTALLDIR> with C:Program
FilesBusiness ObjectsTomcat
appropriate path.
2. Find the corresponding <Connector …> tag for the port number you have
configured.
If you are using the default port of 8080, find the <Connector …> tag with
port=“8080” in it.

For example:
<Connector URIEncoding="UTF-8" acceptCount="100"
connectionTimeout="20000" debug="0"
disableUploadTimeout="true" enableLookups="false"
maxSpareThreads="75" maxThreads="150"
minSpareThreads="25" port="8080" redirectPort="8443"
/>
3. Add the following value within the <Connector …> tag:
maxHttpHeaderSize="16384"
For example:
<Connector URIEncoding="UTF-8" acceptCount="100"
connectionTimeout="20000" debug="0"
disableUploadTimeout="true" enableLookups="false"
maxSpareThreads="75" maxThreads="150"
maxHttpHeaderSize="16384" minSpareThreads="25" port="8080"
redirectPort="8443" />
5. Restart Tomcat.
Note:
For other Java application servers, consult your Java application server’s
documentation.
Controlling logging with Vintela single sign-on for Java
Vintela single sign-on for Java uses Apache log4j logging. The name of the
log file and the level of logging recorded are controlled by these:
• The settings related to Vintela logging in the web.xml for InfoView.
• The setting in the log4j properties file.
For more efficient problem determination, you may want to use the log files
that are used to capture error or warning messages.
The table which follows summarizes what you can control about error logging
with Vintela in the web.xml file for InfoView:

Use of parameter<param-name>
The name of the log file is specified in the
<param-value> for this parameter. This
must be a unique name not in used by
any other implementation of log4j logging
on your web application.
idm.logger.name
The <param-value> for this parameter can
be set to three things: "" (blank), "BASIC"
or "AnythingElse".
• If the <param-value> for idm.log
ger.props is set to "" (blank), no log-
ging will be performed.
ger.props is set to "BASIC", basic
errors will be logged and errors will be
sent to the standard output.
ger.props is set to anything other than
"" or "BASIC" , Vintela will look for a
properties file that matches the value
you set. Vintela will look for this proper-
ties file in the WEB-INF directory for
InfoView. For example, if you specify
BOE for your <param-value>, Vintela
will look in the WEBINF directory for
Infoview for the BOE.properties file.
idm.logger.props
What to specify in your log4j properties file
If you specify that you want to use a properties file in the <param-value> for
idm.logger.props in the web.xml file for InfoView, you must also create
the properties file you specified in the WEB-INF directory for InfoView. These
are the basic requirements:
• Defining which logger to use.

• Defining what level of logging to perform in this properties file.
For details on the syntax to use in the file and details on the of valid options
of an Apache log4j properties file, see the following URL:
http://logging.apache.org/log4j/1.2/apidocs/index.html
To change the level of logging provided with Vintela single sign-on
for Java
1. Open the web.xml file for InfoView from its deployed location on your web
application server.
This is where the InfoView web.xml file is on Windows:
<INSTALLDIR>businessobjectsenterprise120desktoplaunchWEB-
INF
Enterprise on Windows, and you did not modify the default installation
location, replace <INSTALLDIR> with C:Program FilesBusiness
ObjectsTomcatwebapps
appropriate path.
2. If you want to have the output from error logging written to a file, find this
string:
<param-name>idm.logger.name</param-name>
3. In the <param-value> for idm.logger.name, enter the name for your log
file.
4. If you want to use a properties file to define the logger used and level of
logging recorded, find this string:
<param-name>idm.logger.props</param-name>
5. In the <param-value> for idm.logger.props, enter the name for your
properties file.

Note:
If you set this value to anything other than “” (blank) or “BASIC”, you must
also define the logger used and define level of logging in the properties
file you specify. For details, on the logging parameters available, see the
table in the section Controlling logging with Vintela single sign-on for Java
on page 532.
6. Save and close your file.
Alternate URL to access InfoView
A second URL is available to access InfoView. This URL is provided for the
administrator or a user to access InfoView, without single sign-on, after single
sign-on has been enabled.
• This is the default URL used to access InfoView:
http://hostname:8080/InfoViewApp/logon.jsp
• This is the URL you should use if you want to access InfoView without
single sign-on, after single sign-on has been enabled:
http://hostname:8080/InfoViewApp/logonNoSso.jsp
Modifying the Vintela logon error page
When authentication using Vintela single-sign-on for Java fails, Internet
Explorer will attempt NTLM authentication. This will happen each time another
logon attempt is made until the browser session ends, even if the underlying
cause of failure has been resolved. To reduce the number of support calls
received by an administrator, an error page will be displayed for the user.
This error page informs users of this behavior and instructs them to close
their browser so that the next attempt can be successful, provided the
underlying cause of the problem has been resolved.
To customize the text displayed on the Vintela error page
1. Open the file vintelaError.jsp file found in this location:
<INSTALLDIR>businessobjectsenterprise120desktoplaunchIn
foViewlogon

If you installed Tomcat with your installation, and did not modify the default
location, you can replace INSTALLDIR with this:
C:Program FilesBusiness ObjectsTomcatwebapps
If you modified the default location for Tomcat, or used another supported
Java application server, substitute the path applicable for deployment.
2. Change the text of the message as required.
A second URL is available to access InfoView. This URL is provided for
the administrator or a user to access InfoView, without single sign-on,
after single sign-on has been enabled.
• This is the default URL used to access InfoView:
http://HostName:portnumber/businessobjects/enter
prise120/desktoplaunch/InfoView/logon/logon.do
• This is the URL you should use if you want to access InfoView without
single sign-on, after single sign-on has been enabled:
http://HostName:portnumber/businessobjects/enter
prise120/desktoplaunch/InfoView/logon/logonForm.do
Configuring Internet browsers
To support Kerberos single sign-on, you must configure BusinessObjects
Enterprise clients. This involves configuring the Internet Explorer (IE) browser
on the client machines.
Note:
You can automate this through a registry key or use the following steps.
To configure Internet Explorer on the client machines
1. On the client machine open and IE browser window.
2. Enable integrated Windows authentication.
a. On the Tools menu click Internet Options.
b. Click the Advanced tab.

c. Scroll to Security, select Enable Integrated Windows
Authentication, and then click Apply.
3. Add the Java Application machine or the URL to the trusted sites. You
can enter the full domain name of the site.
a. On the Tools menu click Internet Options.
b. Click the Security tab.
c. Click Sites and then click Advanced.
d. Type the web site for IIS and click Add.
e. Click OK until the Internet Options dialog box closes.
4. Close and reopen the Internet Explorer browser window for these changes
to take effect.
5. Repeat all of these steps on each BusinessObjects Enterprise client
machine.
To configure Firefox on the client machines
1. Modify network.negotiate-auth.delegation-uris
a. On the client machine open a Firefox browser window.
b. Type about:config in the URL address field. A list of configurable
properties appears.
c. Double-click network.negotiate-auth.delegation-uris to edit the
property.
d. Enter the URL that you will use to access InfoView. For example if
your InfoView URL is http://machine.domain.com:8080/InfoViewApp,
then you will need to enter http://machine.domain.com
Note:
To add more than one URL, separate them with a comma. For
example: http://machine.domain.com,machine2.domain.com .
e. Click OK.
2. Modify network.negotiate-auth.trusted-uris
a. On the client machine open a Firefox browser window.
b. Type about:config in the URL address field. A list of configurable
properties appears.
c. Double-click network.negotiate-auth.trusted-uris to edit the property.
d. Enter the URL that you will use to access InfoView. For example if
your InfoView URL is http://machine.domain.com:8080/InfoViewApp,
then you will need to enter http://machine.domain.com

Note:
To add more than one URL, separate them with a comma. For
example: http://machine.domain.com,machine2.domain.com .
e. Click OK.
3. Close and reopen the Firefox browser window for these changes to take
effect.
4. Repeat all of these steps on each BusinessObjects Enterprise client
machine.
Modifying the web.config file for InfoView AD single sign-on
If you want to have AD single sign-on for InfoView, you must modify the
web.config file for the following reasons:
• To change the authentication mode used.
• To allow impersonation.
• To enable single sign-on.
• To specify the authentication default.
These changes are in addition to changing how IIS is configured.
Note:
The values in web.config file are case-sensitive.
To modify web.config for AD single sign-on
1. Open the web.config file from this location:
12.0Web Content InfoViewAppInfoViewApp
Note:
2. Find the following line in the <system.web> block:
<authentication mode="Windows" />

6. Enter the CMS machine in the cmsDefault value field.
<add key=" ssoEnabled" value="false" />
8. Change the ssoEnabled value from false to true.
<add key="authenticationDefault" value="secWinAD" />
10. Ensure the value for authenticationDefault is set to secWinAD.
12. Restart IIS.
Note:
For AD single sign-on to function correctly, make sure you complete all tasks
listed in Configuring Kerberos and single sign-on for .NET InfoView on
page 542.
Modifying the web.config file for impersonation and Windows authentication
If you want to use AD authentication, you must modify the web.config file to
change the authentication mode used and allow impersonation. This is in
addition to changing how IIS is configured.
Modify either of the following web.config files based on what application you
want to configure.
• To configure both the CMC and InfoView, configure the web.config file
in the Web Content directory.
To configure only InfoView, configure the web.config file in the InfoView
directory.
Note:
The values in web.config file are case-sensitive.

To modify web.config for basic AD authentication
1. Open the appropriate Web.config file from either of the following
locations:
• C:Program FilesBusiness ObjectsBusinessObjects
Enterprise 12.0Web Content
• C:Program FilesBusiness ObjectsBusinessObjects
Enterprise 12.0Web ContentInfoViewAppInfoViewApp
Note:
2. Find the following line in the <system.web> block:
<authentication mode="None" />
6. Restart IIS.
Configuring Kerberos and single sign-on to the database for
Java application servers
Single sign-on to the database is supported for deployments that meet all
these requirements:
• The deployment of BusinessObjects Enterprise is on a Java web
application server.
• The Java web application server has been configured with AD with
Kerberos.
• The database to which single sign-on is required is a supported version
of SQL Server or Oracle.
• The groups or users that need access to the database must have been
granted permissions within SQL Server or Oracle.

• The Cache Security context check box (which is required for single sign-on
to the database) in the AD Authentication page of the CMC is checked.
The final step is to modify the krb5.ini file to support single sign-on to the
database for Java.
Note:
These instructions explain how to configure single sign-on to the database
for Java application servers. If you want to configure end-to-end single sign-on
to the database for Java application servers, you must also perform the
configuration steps required for Vintela single sign-on for Java. For details,
see Configuring Kerberos and single sign-on for Java InfoView on page 520.
Note:
If you want to configure single sign-on to a database, ensure that you have
set the cache security context. For detailed instructions, go to Enabling
Kerberos authentication in the Windows AD plug-in on page 506.
To enable single sign-on to the database for Java application servers
1. Open the krb5.ini file that is being used for your deployment of
The default location for this file is the WINNT directory on your web
application server.
Note:
If you cannot find the file in the WINNT directory, check this Java argument
for the location of the file:
-Djava.security.auth.login.config
This variable is specified when AD with Kerberos is configured on your
Java web application server.
2. Go to the [libdefaults] section of the file.
3. Enter this string prior to the start of the [realms] section of the file:
forwardable = true

Configuring Kerberos and single sign-on for .NET InfoView
This section described the steps required to configure single sign-on and
AD authentication using Kerberos for BusinessObjects Enterprise .NET
InfoView.
Before implementing these steps, make sure the manual authentication to
.NET InfoView with Kerberos is working correctly. AD users must be able to
provide their AD username and password to logon to .NET InfoView, and
Kerberos has been enabled in the CMC.
Related Topics
• Enabling Kerberos authentication in the Windows AD plug-in on page 506
To enable single sign-on in the CMC
3. Select Enable Single Sign On for selected authentication mode in
the "Authentication Options" area.
4. Click Update..
Modifying web.config for impersonation and Windows authentication
To enable impersonal and Windows authentication, you need to modify the
Web.config files for the two applications listed in the table below.
Default locationApplication
<INSTALLDIR>Business ObjectsBusinessObjects
Enterprise 12.0Web ContentInfoViewAppIn-
foViewApp
InfoViewApp
Enterprise 12.0Web ContentInfoViewAppPlatform-
Services
PlatformSer-
vices
To modify web.config for impersonation and Windows authentication
1. Open the Web.config file for InfoView.

2. Locate the following line under <system.web>:
3. Modify the line as shown below:
5. Edit the strings as indicated in the table below:
What to editString
Enter the CMS machine name in the
cmsDefault value field.
<add key="cmsDefault" val
ue="" />
Change "false" to "true"<add key=" ssoEnabled"
value="false" />
Ensure value is set to "secWinAD"<add key="authenticationDe
fault" value="secWinAD" />
6. Save and close the Web.config file.
7. Open the Web.config file for PlatformServices.
8. Edit the lines under <system.web> as indicated in the table below:
What to editLine
Change "None" to "Windows"<Authentication mode="None"
/>
Ensure this line is set to "true"<identity impersonate="true"
/>
10. Restart IIS.
Tip:
You can also restart IIS after you finish configuring IIS to use Integrated
Windows Authentication.

To configure clients on IIS for Integrated Windows Authentication
To support single sign-on you need to configure the BusinessObjects Clients
on IIS to use Integrated Windows Authentication. Implement the steps below
to configure the clients for Windows authentication.
1. In the "Internet Information Services" window for IIS, expand the tree on
the left and to InfoViewApp under Default Web Site.
2. Right-click InfoViewApp and select Properties.
3. Click Edit in the "Directory Security" tab.
4. Unselect Anonymous Access if it is selected
5. Select Integrated Windows Authentication and click OK.
6. Click OK to finish.
7. Repeat steps 1-6 for PlatformServices.
8. Restart IIS.
To configure the IIS host to be trusted for delegation
You must ensure that either the machine hosting IIS must be trusted for
delegation, or the account IIS is running under must be trusted for delegation.
Implement the steps below to configure the machine hosting IIS for
delegation. For instructions on how to set the account IIS is running under
please refer to your Windows AD documentation.
1. Open the "Active Directory Users and Computers" snap in.
2. Expand the tree to the domain of the machine hosting IIS.
3. Double click Computers.
4. Right-click the machine hosting IIS and select Properties
5. Select the "Delegation" tab.
6. Select Trust this computer for delegation to any service (Kerberos
only) and click OK.
To configure the Internet Explorer browser
You need to configure the Internet Explorer browser on a BusinessObjects
Enterprise client machine to support end-to-end single sign-on. This
implementation includes the following tasks:
• Configuring client machines for integrated Windows authentication
• Adding IIS to the local intranet sites

Tip:
You can automate the following steps through a registry key. For more details,
refer to your Windows documentation.
1. On the client machine, open an Internet Explorer browser.
2. Enable integrated windows authentication.
a. Go to Tools > Internet Options.
b. Select the "Advanced" tab.
c. Navigate to the "Security" settings.
d. Select Enable integrated windows authentication and click Apply.
3. Add IIS to the list of local intranet sites.
b. Go to Security > Local intranet > Sites > Advanced."Security" tab.
c. Type in the web site for IIS, and click Add.
For example: http://iismachine.domain.com
d. Click OK twice to close the Internet Options dialog box.
4. Close the Internet Explorer browser, and then open it again for the
changes to take effect.
5. Repeat steps 1-4 for every client machine.
Configuring Kerberos and single sign-on to the database for IIS
The setup single sign-on to the database, you need to configure IIS and
BusinessObjects Enterprise to allow a users credentials to be propagated
to the database. By implementing the steps in this section, users can have
their AD account credentials authenticated against the underlying database.
Before implementing end-to-end single sign-on, you must first complete the
steps to set up single sign-on to .NET InfoView using Kerberos authentication.
In addition, the following actions must be performed to setup single sign-on
to the database:
1. The BusinessObjects Enterprise service account must be trusted for
delegation.
2. Reporting Services must be running under the BusinessObjects Enterprise
service account. The machines hosting the Reporting Services must have
the BusinessObjects Enterprise service account as part of the local
Administrators group. The local security policy for the account must be
set to “Act as part of the OS”.

3. Cache security context must be enabled. See To configure the Windows
AD security plug-in for Kerberos on page 507 for more details.
4. Configure IIS for access to the AD Domain Controller in order to perform
queries.
Related Topics
• Configuring Kerberos and single sign-on for .NET InfoView on page 542
Configuring IIS for AD domain access
To support database single sign-on, you will have to set the Aspnet_wp.exe
worker process to run as an account that has privileges connect to the
Domain Controller. You can use any of the following choices:
• Run IIS worker process under a machine domain account. This way the
password will automatically be generated and will not be subject to expiry
restrictions. The password will not be exposed or subject to modification.
• Run IIS worker process under Network Service account or under as user
domain account. By using a user domain account, you can control the
rights of the account, however, the password can be exposed and
modified. The password may also expire, and therefore cause errors.
The approach you use depends your system security management
requirements. For complete information about security risks associated with
system or user domain accounts, refer to your Microsoft documentation.
To configure IIS 5 for AD domain access
If IIS 5 is already running under a Domain account, System account or
Network Service account, you can skip these steps.
1. Open the machine.cong file.
This file can be found at the following location: C:WinntMi
crosoft.NETFrameworkversionCONFIG, where version represents
the software version number.
2. Locate the processModel Attributes section in the file.
3. Set the parameter values indicated in the following table: .

Value to setParameter
“Password”userName
“AutoGenerate”Password
Configuring the Aspnet_wp.exe account to run as a machine domain
account will cause all ASP.NET web applications on the web server to
run as privileged system accounts. For security reasons, make sure that
the account which IIS runs under does not belong to a mapped group.
If the machine name for the web server is different from the name that is
used to access it, add an SPN for HTTP access on the web server machine:
setspn -A HTTP/serverhost.domainname.com serverhost
For example, if you access the machine via www.domainname.com but the
machine name is web.domainname.com, you will have to add an a SPN for
HTTP access on the web server machine.
To configure IIS 6 for AD domain access
IIS 6 should be running by default under the Network Service account which
has sufficient rights for AD domain access..
1. To open the Internet Information Services (IIS) Manager go to: Start >
Settings > Control Panel > Administrative Tools.
2. Go to local computer > Application Pools
3. Right-click DefaultAppPool and select Properties.
If BusinessObjects Enterprise is not installed in the default Application
Pool, you should use the pool in which it is installed.
4. Select the "Identity" tab. Ensure that Network Services is selected and
not any of the Local accounts.
Note:
You can alternatively use "Configurable" and run the Application Pool
under a domain account.
5. Click OK.
6. Restart IIS if you modified any of the Application Pool settings.

Configuring NTLM and single sign-on for .NET InfoView
This section described the steps required to configure single sign-on and
AD authentication using NTLM forBusinessObjects Enterprise .NET InfoView.
Before implementing these steps, make sure the manual authentication to
.NET InfoView with NTLM is working correctly. AD users must be able to
provide their AD username and password to logon to .NET InfoView, and
Kerberos has been enabled in the CMC.
Related Topics
3. Select Enable Single Sign On for selected authentication mode in
the "Authentication Options" area.
4. Click Update..
Modifying web.config for impersonation and Windows authentication
To enable impersonal and Windows authentication, you need to modify the
Web.config files for the two applications listed in the table below.
Default locationApplication
Enterprise 12.0Web ContentInfoViewAppIn-
foViewApp
InfoViewApp
Enterprise 12.0Web ContentInfoViewAppPlatform-
Services
PlatformSer-
vices
To modify web.config for impersonation and Windows authentication
1. Open the Web.config file for InfoView.

3. Modify the line as shown below:
5. Edit the strings as indicated in the table below:
What to editString
Enter the CMS machine name in the
cmsDefault value field.
<add key="cmsDefault" val
ue="" />
Change "false" to "true"<add key=" ssoEnabled"
value="false" />
Ensure valueis set to "secWinAD"<add key="authenticationDe
fault" value="secWinAD" />
7. Open the Web.config file for PlatformServices.
8. Edit the lines under <system.web> as indicated in the table below:
What to editLine
Change "None" to "Windows"<Authentication mode="None"
/>
Ensure this line is set to "true"<identity impersonate="true"
/>
10. Restart IIS.
Tip:
You can also restart IIS after you finish configuring IIS to use Integrated
Windows Authentication.

To configure clients on IIS for Integrated Windows Authentication
To support single sign-on you need to configure the BusinessObjects Clients
on IIS to use Integrated Windows Authentication. Implement the steps below
to configure the clients for Windows authentication.
1. In the "Internet Information Services" window for IIS, expand the tree on
the left and to InfoViewApp under Default Web Site.
2. Right-click InfoViewApp and select Properties.
3. Click Edit in the "Directory Security" tab.
4. Unselect Anonymous Access if it is selected.
5. Select Integrated Windows Authentication and click OK.
6. Click OK to finish.
7. Repeat steps 1-6 for PlatformServices.
8. Restart IIS.
To configure the Internet Explorer browser
You need to configure the Internet Explorer browser on a BusinessObjects
Enterprise client machine to support end-to-end single sign-on. This
implementation includes the following tasks:
• Configuring client machines for integrated Windows authentication
• Adding IIS to the local intranet sites
Tip:
You can automate the following steps through a registry key. For more details,
refer to your Windows documentation.
1. On the client machine, open an Internet Explorer browser.
2. Enable integrated windows authentication.
b. Select the "Advanced" tab.
c. Navigate to the "Security" settings.
d. Select Enable integrated windows authentication and click Apply.
3. Add IIS to the list of local intranet sites.
b. Go to Security > Local intranet > Sites > Advanced.
c. Type in the web site for IIS, and click Add.
For example: http://iismachine.domain.com

d. Click OK twice to close the Internet Options dialog box.
4. Close the Internet Explorer browser, and then open it again for the
changes to take effect.
5. Repeat steps 1-4 for every client machine.
Using AD with SiteMinder
This section provides information on different methods offered by
BusinessObjects Enterprise that can be used for authentication with Windows
Active Directory (AD) and SiteMinder for IIS and Java. Information on
administering and configuring AD accounts is also included.
You can use SiteMinder with NTLM or Kerberos. For more information about
NTLM, see Using AD authentication with NTLM on page 519. For more
information about Kerberos, see Using AD authentication with Kerberos on
page 496.
AD and SiteMinder workflow
The workflow for configuring BusinessObjects Enterprise to use IIS with AD
and SiteMinder, involves these steps:
• Configuring the Windows AD plug-in for SiteMinder on page 552
• Modifying the web.xml for Java AD and SiteMinder on page 553
Configuring AD and SiteMinder workflow
This section explains how to use AD and SiteMinder. SiteMinder is a
third-party user access and authentication tool that you can use with the AD
security plug-in to create single sign-on to BusinessObjects Enterprise. This
section assumes that you have completed Mapping AD accounts on page 489.
There are two things you must do to enable AD single sign-on with SiteMinder:
• Configure the AD plug-in for single sign-on with SiteMinder
• Modify either the Web.xml file to use Java and SiteMinder or the
Web.config file to use .NET and SiteMinder

Note:
Please ensure that the SiteMinder Administrator has enabled support for 4.x
Agents. This must be done regardless of which supported version of
SiteMinder you are using. For more information about SiteMinder and how
to install it, refer to the SiteMinder documentation.
Configuring the Windows AD plug-in for SiteMinder
To configure the AD plug-in for single sign-on with SiteMinder
1. From the CMC, click Authentication.
3. Scroll down to the SiteMinder options area of the page.
4. Click Disabled.
The Windows AD SiteMinder configuration page will appear.
5. If you have not configured the Windows AD plug-in, you will receive a
warning and will be asked if you wish to continue. Click OK.
The AD SiteMinder configuration page appears.
6. Click Use SiteMinder Single Sign On.
7. In the Policy Server Host box, type the name of each policy server, and
click Add.
8. For each Policy Server Host, specify the Accounting, Authentication
and Authorization port numbers.
9. Enter the name of the Agent Name and the Shared Secret. Enter the
Shared Secret again.
Note:
Please ensure that the SiteMinder Administrator has enabled support for
4.x Agents. This must be done regardless of which supported version of
SiteMinder you are using. For more information about SiteMinder and
how to install it, refer to the SiteMinder documentation.
10. Click Update.

Modifying the web.xml for Java AD and SiteMinder
To enable Java AD SiteMinder
1. Open the web.xml file for InfoView, from its deployed location on your
<DeployedLocation>Business ObjectsBusinessObjects Enter
prise 12.0warfiles
warfiles|WebApssInfoViewAppWEB-INF
Note:
Enterprise, replace <DeployedLocation> with C:ProgramFilesBusi
ness Objectstomcat55webapps. If you are using any other supported
web application server, consult the documentation for your web application
server to determine the appropriate path to substitute.
2. Find the following string in the file:
3. Enter the CMS name and port number in the cms.default <param-value>
field.
5. Set the <param-value> for the authentication.default to secWinAD.
<param-value>secWinAD</param-value>

11. Set the <param-value> for siteminder.authentication to secWinAD.
Modifying the web.xml for Java AD Single sign-on to InfoView
To enable Java AD single sign-on
<DeployedLocation>InfoViewAppWEB-INF
Note:
field.

Modifying the web.xml file for Java AD and SiteMinder
To enable the Java AD client for SiteMinder
Note:
field.

11. Set the <param-value> for siteminder.authentication to secWinAD.
Modifying web.config for .NET InfoView and SiteMinder
To enable .NET InfoView client for SiteMinder
1. Open the web.config file for InfoView, from its deployed location for IIS.

Note:
3. Enter the CMS name in the cmsDefault value field.
<add key="authenticationDefault" value="secEnterprise" />
5. Set the value for the authenticationDefault to secWinAD.
<add key="ssoEnabled" value="false" />
7. Change the value for ssoEnabled from false to true.
<add key="siteminderEnabled" value="true" />
9. Ensure the value for siteminderEnabled is set to true.
<add key="siteminderAuthentication" value="secLDAP" />
11. Set the value for sitemindeAuthentication to secWinAD.
13. Restart IIS.
Disabling SiteMinder for Java clients
If you want to prevent SiteMinder from being configured, or to disable it after
it has been configured in the CMC, modify the web.xml file for InfoView.

To modify web.xml to disable SiteMinder
1. Open the web.xml file for InfoView on your web application server.
Note:
3. Change the <param-value> from true to false.
Disabling SiteMinder for .NET clients
If you want to prevent SiteMinder from being configured, or to disable it after
it has been configured in the CMC for .NET, modify the web.config file for
InfoView.
To modify web.config to disable SiteMinder for .NET clients
1. Open the web.config file for InfoView on your web application server.
Note:

3. Change the value from true to false.
4. Repeat steps 1-3 for the web.config file for PlatformServices:
12.0Web ContentInfoViewAppPlatformServices
6. Restart IIS.
Troubleshooting single sign-on
This section contains some of the common configuration errors which can
single sign-on not to function properly.
• Disabled single sign-on
• Security context problem
• Duplicate ssoEnabled tags
Disabled single sign-on
Despite the fact that single sign-on has been configured in the web.config
files, users receive the following error:
The administrator has disabled Single Sign-On logons for this
authentication plugin. Please log on using your username and
password.
This problem occurs when single sign-on configuration is missing from the
CMC but present in all the other required locations.
1. Go to the Authentication area of the CMC.
3. In the Authentication Options area of the page, select "Enable Single
Sign On for selected authentication mode."
4. Restart the IIS.

Security context issues
After single sign-on has been set up, when the users attempt to access
InfoView, they receive the following error:
An error has occurred propagating the security context between
the security server and the client. Please contact your system
administrator.
This can be caused because the impersonation setting has been set
incorrectly or the setting is missing from the web.config file.
To resolve security context issues
1. Open the web.config file at this location:
12.0Web ContentInfoViewApp
Note:
2. Make sure both of these lines exist in the file.
<authentication mode="Windows"/>
If either line is missing, add it. If either has a different setting, change it
to match the required setting.
3. Save and close the file
4. Repeat steps 1-3 for the web.config file for PlatformServices:
12.0Web ContentInfoViewAppPlatformServices
5. Restart IIS.
Duplicate ssoEnabled tags
Single sign-on has been configured in the web.config files, but the InfoView
Log on screen appears with a blank user name and password, and with
Windows AD authentication selected. After you click Log on, you are logged
on successfully. No error message is displayed.
This can occur if you have multiple contradictory values set for the key
ssoEnabled in the web.config file. Consider the following sample where the

ssoEnabled is set twice: the first time it is set to true, the second time it is
set to false.
<add key="cmsDefault" value="ABCADEI01" />
<add key="ssoEnabled" value="true" />
<add key="authenticationDefault" value="secWinAD" />
<add key="cmsVisible" value="true" />
.

<add key="siteminderAuthentication" value="secLDAP" />

<add key="ssoEnabled" value="false" />
To remove the duplicate tag
1. Open the web.config file from the following location:
Note:
2. Search for the following throughout the file:
ssoEnabled
3. If you find multiple occurrences, ensure the first one has the setting you
want, then delete the duplicate tags.
5. Restart IIS.
Enabling Trusted Authentication
Users prefer to log on to the system once, without needing to provide
passwords several times during a session. Trusted Authentication provides
a Java single sign-on solution for integrating your BusinessObjects Enterprise
authentication solution with third-party authentication solutions. Applications
that have established trust with the Central Management Server can use
Trusted Authentication to allow users to log on without providing their
passwords. To enable Trusted Authentication, you must configure both the
server, through the CMC, and the client, in the web.xml file.

If you are using Business Process BI Web Service, you also must configure
the BusinessProcessBI.properties file. See for details.
Note:
• Before you are able to use Trusted Authentication, you must have either
created Enterprise users, or mapped the third-party users that will need
to sign on to BusinessObjects Enterprise.
• The SSO URL for Java InfoView is: http://hostname:portnumber/In
foViewApp/logon/logon.do
• The SSO URL for .NET InfoView is http://hostname:portnumber/In
foViewApp/logon/logon.aspx
Related Topics
• Configuring the server for Trusted Authentication on page 562
• Configuring Trusted Authentication for the client on page 563
• Configuring Trusted Authentication for Business Process BI on page 570
Configuring the server for Trusted Authentication
To configure the server to use Trusted Authentication
1. Log on to the Central Management Console with administrative rights.
3. Click the Enterprise tab.
4. Scroll down until you see Trusted Authentication.
5. Click Trusted Authentication is enabled.
6. Enter a string in the Shared Secret field.
Note:
The shared secret is used by the client and the CMS to establish trust.
You must also configure the client after you finish the Trusted
Authentication configuration for the server. See Configuring Trusted
Authentication for the client on page 563 for details.
7. To specify the number of days that your shared secret will be valid, specify
a value for the Shared Secret Validity Period field.
8. Specify a timeout value for your trusted authentication requests.
12 Enabling Trusted Authentication

Note:
The timeout value is the maximum amount of time, in milliseconds, that
the clock on the client and clock and the CMS can differ. If you enter 0,
the amount of time the two clock times can differ is unlimited. It is not
recommended you set this value to 0 as this may increase your
vulnerability to replay attacks.
9. Click Update.
Configuring Trusted Authentication for the client
To configure Trusted Authentication for the client
The following procedure can be used for both the InfoView and
OpenDocument web applications.
1. Open the web.xml file for InfoView or OpenDocument from the deployed
location on your web application server.
The deployed location for InfoView on Windows is:
prise
12.0warfilesWebAppsInfoViewAppWEB-INF
The deployed location for OpenDocument is:
prise
12.0warfilesWebAppsOpenDocumentWEB-INF
Steps 2-14 use InfoView as the web application.
Note:
If you have InfoView deployed in a .NET environment, the web.config
is located in the following directory:
prise

2. Find this string in the file:
field.
Use the format servername:portnumber
7. Change the <param-value> for siteminder.enabled from true to false.
<param-name>trusted.auth.user.retrieval</param-name>
9. Specify how you want to retrieve the user name.
Enter the <param-value> from the table that corresponds with the user
retrieval method you want to use.

How the User name will be re-
trieved
<param-value>
The user name will be retrieved
from a call to getRemoteUser() on
the HttpServletRequest object for
the current request in a servlet or
JSP.
Note:
For .NET, ensure that the following
properties have been set on your
InfoViewApp directory: :
• In IIS manager, disable the
"anonymous access" check box.
• In IIS manager, enable the
"Windows Integrated Authentica-
tion" check box.
REMOTE_USER
The user name is retrieved from the
contents of a specified HTTP
header.
Note:
You must define which http header
you want to use to retrieve the user
name. You define the http header to
use is defined in the trust
ed.auth.user.param in the
web.xml file for InfoView.
HTTP_HEADER

trieved
<param-value>
contents of contents of a specified
parameter of the request URL.
Note:
You must define which query string
parameter you want to use to retrieve
the user name. You define query
string parameter to use in the
trusted.auth.user.param in the
QUERY_STRING
contents of contents of a specified
cookie.
Note:
You must define which cookie you
want to use to retrieve the user name.
You define the cookie to use in the
trusted.auth.user.param in the
COOKIE
contents of a specified session
variable.
Note:
You must define which web session
variable want to use to retrieve the
user name. You define the web ses-
sion variable to use in the trust
ed.auth.user.param in the
WEB_SESSION

trieved
<param-value>
The user name is retrieved from a
call to getUserPrincipal().get
Name() on the HttpServletRe
quest object for the current re-
quest in a servlet or JSP.
USER_PRINCIPAL
Note:
• There are various mechanisms that populate the user name. Configure
or set up your web application server so that your user names are
exposed before you use these user retrieval name methods. See
http://java.sun.com/j2ee/1.4/docs/api/javax/servlet/http/HttpServletRequest.html
for further information.
• Some web application servers require that you have the environment
variable REMOTE_USER set to true on your web application server.
See the documentation specific to your web application server for
details on whether this is required. If it is required, ensure the
environment variable is set to true if you are using this method of user
name retrieval.
10. If you selected HTTP header, URL query string, cookie or web session,
find this string:
<param-name>trusted.auth.user.param</param-name>
Note:
This step is not required if your retrieval method is USER_PRINCIPAL
or REMOTE_USER.
11. Enter the variable name to use to retrieve the user name in the
<param-value> for trusted.auth.user.param
• If you are using the HTTP header as your method of retrieving the
user name, enter the name for the HTTP header variable.
• If you are using a URL query string parameter as your method of
retrieving the user name, enter the name for the parameter.

• If you are using a cookie as your method of retrieving the user name,
enter the name for the cookie.
• If you are using a web session variable as your method of retrieving
the user name, enter the name for the web session variable.
Note:
This step is not required if your retrieval method is USER_PRINCIPAL
or REMOTE_USER.
12. Decide how you want to retrieve the shared secret.
To retrieve the shared secret from a file:
a. Create a file called TrustedPrincipal.conf.
b. Store the file in the platform specific directory of Business Objects.
This table specified the location where the TrustedPrincipal.conf file
should be stored, based on your platform.
Location of TrustedPrinci-
pal.conf
Platform
C:Program FilesBusiness Ob-
jectsBusinessObjects Enterprise
12.0win32_x86
Windows, default installation
<INSTALLDIR> BusinessOb
jects Enterprise
12.0win32_x86
Note:
Replace INSTALLDIR with your
installation directory.
Windows, modified default install
directory
<INSTALLDIR>/ bobje/enter-
prise120/aix_rs6000/
AIX

Location of TrustedPrinci-
pal.conf
Platform
prise120/solaris_sparc/
Solaris
prise120/hpux_pa-risc
HP_UX
prise120/linux_x86/
Linux
c. Define the string you want to use for the shared secret.
Enter the following in the file, where String is the shared secret string
you want to use.
SharedSecret=String
d. Save and close this file.
To retrieve the shared secret from a session variable:
a. Find this string in the web.xml file:
<param-name>trusted.auth.shared.secret</param-name>
b. Enter the session variable name from which to retrieve the shared
secret in the </param-value> for trusted.auth.shared.secret.
Note:
Business Process BI Web Services does not support retrieving the shared
secret from a session variable.

Configuring Trusted Authentication for Business
Process BI
If you are using Business Process BI and you are using Trusted
Authentication, you must configure the BusinessProcessBI.properties file in
addition to configuring the CMC and the web.xml.
To configure Trusted Authentication for Business Process BI
1. Open the BusinessProcessBI.properties file from the following location
on your web application server:
For Windows:
<DeployedLocation>BusinessProcessBIWEB-INFclasses
For Unix:
<DeployedLocation>/BusinessProcessBI/WEB-INF/classes/
Note:
ness ObjectsTomcat55webapps on Windows, or the Tomcat directory
on Unix. If you are using any other supported web application server,
consult the documentation for your web application server to determine
the appropriate path to substitute.
2. Find this line:
bisecurity.trustedAuthentication.enabled = false
3. Change the value false to true.

This section provides an overview of the auditing functionality in
BusinessObjects Enterprise. It also describes how to configure the auditing
database, how to select actions to audit, and how to create a custom auditing
report.
How does auditing work?
Auditing allows you to keep a record of significant events on BusinessObjects
Enterprise servers (for a list of auditable events see the Reference list of
auditable events on page 581 ). These records give you a picture of what
information is being accessed, how it's being accessed, and who is looking
at it.
For the purposes of this chapter, auditor refers to any system responsible
for recording or storing information on any auditable event. Auditee refers
to any system responsible for performing an event that is audited. There are
some circumstances where a single system can be both an auditor and
auditee. The Central Management Server (CMS) acts as the system auditor,
while each BusinessObjects Enterprise server that controls events that you
can monitor acts as an auditee.
While the audit database can exist as part of the system database, it is
recommended that it be kept separate, to minimize the impact on system
performance due to the constantly growing size of the database. If you
choose, you can use different database software for the CMS system
database and the auditing database, and you can maintain these databases
on separate servers. Once established, an auditing database is generally
only appended to.
As the auditor, the CMS is responsible for collecting events and writing them
to the auditing database. When an audited event is triggered, the server
responsible will generate a record and store it in a local temporary file. At
regular intervals the CMS communicates with the auditee servers to request
copies of records from their local temporary files. When the CMS receives
these records, it writes the data to the auditing database.
The CMS also controls the synchronization of auditing events that occur on
different machines. Each auditee provides a time stamp for the auditing
events that it records. To ensure that the time stamps of events on different
servers are consistent, the CMS periodically broadcasts its system time to
the auditees. The auditees then compare this time to their internal clocks. If
Managing Auditing
13 How does auditing work?

differences exist, they make a correction to the time they record for
subsequent auditing events.
Depending on the type of client being audited, the system will use one of the
following workflows to record the events.
• Server auditing: This includes any automated operations that take place
on a server.
1. An auditable event is performed by the server.
2. The CMS-Auditee writes events in a temp file.
3. CMS-Auditor polls CMS-Auditee periodically (every five minutes by
default ), and requests a batch of auditing events, (up to 200 by default
).
4. The CMS-Auditee retrieves the temp files.
5. The CMS-Auditee transmits the events to the CMS-Auditor.
6. CMS-Auditor writes events to the auditing database, and the
CMS-Auditee then deletes the events from temp files.
• Client logon auditing for clients connecting through CORBA: This includes
applications such as Desktop Intelligence or Web Intelligence Rich Client.
13Managing Auditing

1. The client connects to CMS-Auditee. The client provides its IP address
and machine name, which the auditee then verifies.
Note:
A port should be opened in the firewall between the client CMS.
2. The CMS-Auditee writes events in a temp file.
3. CMS-Auditor polls CMS-Auditee periodically (every five minutes by
default ), and requests a batch of auditing events, (up to 200 by default
).
5. The CMS-Auditee transmits the events to the CMS-Auditor.
6. CMS-Auditor writes events to the auditing database, and the
CMS-Auditee then deletes the events from temp files.
• Client logon auditing for clients connecting through HTTP: This includes
online applications such as InfoView, Central Management Console,
Desktop Intelligence ZABO client, Web Intelligence Rich Client, etc.
1. The browser connects to the web application server.
2. The web application server returns main logon page.
3. The logon data is submitted to the web application server.
4. BusinessObjects SDK Enterprise submits logon request to the CMS
auditee, along with the IP address and name of the browser machine.
Enterprise SDK connects to CMS-Auditee, authentication is performed.
Managing Auditing

5. The CMS-auditee writes events in a temp file.
6. CMS-Auditor polls CMS-auditee periodically (every five minutes by
default ) and requests a batch of auditing events (up to 200 by default).
8. CMS-Auditee sends events to the CMS-Auditor.
9. CMS-Auditor writes events to the auditing database. CMS-Auditee
deletes events from the temp files.
• Non-Logon auditing for clients connecting through CORBA: This workflow
applies to auditing Desktop Intelligence client and Web Intelligence Rich
Client events when connecting through CORBA.
1. The user performs an operation that may be audited.
2. The client contacts the CMS to check if the operation needs to be
audited.
3. The CMS informs the desktop client the operation requires auditing.
4. The client performs the operation.
5. The client sends the event information to the Client Auditing Proxy
Service (CAPS), hosted in an Adaptive Processing Server.
Note:
A port in the firewall should be opened between each client and each
Adaptive Processing Server.
6. CAPS writes events in a temp file.
7. CMS-Auditor polls the CAPS periodically (every five minutes by default
) and requests a batch of auditing events (200 by default).
8. CAPS reads the temp file.
9. CAPS sends the event information to the CMS-Auditor.
13Managing Auditing

10. CMS-Auditor writes the event information to the auditing database.
CAPS deletes the events from the temp file.
• Non-login auditing for clients connecting through HTTP: This workflow
applies to auditing Desktop Intelligence ZABO client and Web Intelligence
Rich Client events (except for logon events) when connecting through
HTTP.
1. The user initiates a potentially auditable event. The client application
contacts the web application server.
2. The web application server contacts the CMS and checks to see if the
event is configured to be audited.
Note:
While the diagram shows the Auditor CMS being contacted, any CMS
in the cluster can be contacted for this information.
3. The CMS returns the audit configuration information to the web
application server, which passes this information back to the Client
application.
4. If the event is configured to be audited, the client sends the event
information to the web application server, which passes it to the Client
Auditing Proxy Service (CAPS), hosted in an Adaptive Processing
Server (APS).
5. CAPS writes events in a temp file.
Managing Auditing

6. The CMS-Auditor polls the CAPS periodically (every five minutes by
default ) and requests a batch of auditing events (200 by default).
7. CAPS reads the temp file.
8. CAPS sends the event information to the CMS-Auditor.
9. CMS-Auditor writes the event information to the auditing database.
CAPS deletes the events from the temp file.
Auditing consistency
Once the data is in the auditing database, you can run the auditing reports
against the database or design custom reports to suit your business needs.
Note:
If you wish to remove a server from your BOE deployment, you should first
disable that server but keep it running and connected to your network until
all the events in the temporary files have had a chance to post to the auditing
database (the location of the temporary files is determined by the Auditing
Temporary Directory setting on the CMC settings for that server). This may
take several hours.
In most cases, where Auditing is properly installed, configured, secure, and
correct versions of all client applications are used, Auditing will properly and
consistently record all indicated system events. It is important to keep in
mind, however, that certain system and environment conditions can adversely
affect auditing.
There is always a delay between the time an event occurs and its final transfer
to the Auditor database. While this delay is configurable, any of the following
conditions may increase the delay beyond the configured limit.
• Unavailability of the CMS or auditing database.
• Loss of network connectivity.
• An auditee has generated more events then the CMS-Auditor is configured
to retrieve in a single batch. See the links at the bottom of this page for
instructions on increasing batch size.
As a system administrator you should work to avoid any of the following
conditions, which could result in incomplete auditing records:
• A drive where auditing data is stored reaches maximum capacity - you
should ensure that auditee servers always have plenty of disk space
• An auditee server is improperly removed from the network before it can
transmit all audit events - you should ensure that when removing a server
13Managing Auditing

from the network, sufficient time is allowed for audit events to post to the
auditing database
• Deletion of auditee temporary files
• Hardware or disc failure
• Physical destruction of an auditee or auditor host machine
There are also some conditions where audit events may be prevented from
reaching the CMS-Auditor. These can include:
• Users with older client versions that don't support auditing.
• Transmission of auditing information may be blocked by improperly
configured firewalls.
Related Topics
• Optimizing system performance while auditing on page 605
Configuring auditing
If you set up auditing when you installed BusinessObjects Enterprise, your
auditing database is already configured and has established a connection
with the Central Management Server (CMS). If you did not set up auditing
when you installed, you must configure all your Server Intelligence Agent
(SIA) to connect to an auditing database.
To be able to audit an event in BusinessObjects Enterprise, you will need to
configure the following components:
• Determine which server controls the event (see Reference list of auditable
events on page 581).
• You must enable auditing of that action in the Servers management area
of the Central Management Console (CMC). For step by step instructions,
see Enabling auditing of user and system events on page 597.
• If it is a client-generated event, you must also enable auditing from the
Applications area of the CMC. For step-by-step instructions, see Enabling
auditing of user and system events on page 597
As the auditee, the BusinessObjects Enterprise server will then begin to
trigger these auditing events in a local log file.
You can use any database server supported for the CMS system database
for your auditing database. For a complete list of supported database software
and version requirements see the BusinessObjects Enterprise supported
Managing Auditing
13 Configuring auditing

platform document guide online on our support web site: http://support.busi
nessobjects.com/documentation/supported_platforms.
If you plan to use MySQL for your auditing database, you will require version
3.51.12 of the MySQL Connector/ODBC (MyODBC) driver. If you do not
already have this installed, you can download it from the following location:
http://dev.mysql.com/downloads/connector/odbc/3.51.html.
It is recommended that you develop a back-up strategy for your auditing
database. If necessary, contact your database administrator for more
information.
If you have several servers of one type that you want to configure auditing
on, you can use the configuration template to configure them identically. See
the Working with Configuration Templates for more details.
Note:
• BusinessObjects Enterprise XI 3.1 will only audit events from client
applications for 3.0 or higher; events from previous client versions will
not be recorded. If you wish to audit events from all client applications
they must be updated to BusinessObjects Enterprise XI 3.0 versions
minimum.
• The CMS acts as both an auditor and auditee when you configure it to
audit an action that the CMS itself controls.
• If you have a CMS cluster, every CMS in the cluster must be connected
to the same auditing database, using the same connection method and
the same connection name. Note that connection names are case
sensitive.
• In a CMS cluster, the cluster will nominate one CMS to act as system
auditor. If the machine that is running this CMS fails, another CMS from
the cluster will take over and begin acting as auditor.
• The auditing database connections for all CMS servers should be identical
(Database Host, DNS name, user ID and password should all be the
same). If any of the connection details change then all nodes that host a
CMS must be updated with this new information (through the Central
Configuration Manager), or they will not be able to connect to the Auditing
database.
• In order to ensure the highest degree of fault tolerance, it is recommended
that you have more than one Adaptive Processing Server, each hosting
a Client Auditing Proxy Service.
• Only one auditing database can be maintained for a cluster, and auditing
reports cannot retrieve information across multiple auditing databases.
13Managing Auditing

Related Topics
• Clustering Central Management Servers on page 211
• Working with configuration templates on page 156
Configuring auditing for servers on Windows
You will only need to configure your Windows servers if you did not install
auditing when you installed BusinessObjects Enterprise. If you installed
auditing, the servers will already be configured properly.
1. Open the CCM.
2. Stop the SIA.
3. Click Specify Auditing Data Source.
You will be prompted to select a database driver.
4. Specify whether you want to connect to the database through ODBC or
through one of the native drivers.
5. Click OK.
6. The next step depends upon the connection type you selected:
• If you selected ODBC, the Windows Select Data Source dialog box
appears. Select the ODBC data source that you want to use as the
auditing database and click OK (or click New to configure a new Data
Source Name). Use a System DSN, and not a User DSN or File DSN.
By default, the server is configured to run under the System account,
which only recognizes System DSNs. When prompted, provide your
database credentials and click OK.
• If you selected a native driver, you are prompted for your database
Server Name, your Login ID, and your Password. Provide this
information and then click OK.
7. Click OK.
8. Start the Server Intelligence Agent. When the CMS starts it will populate
the database with the required auditing tables.
Note:
You can also configure the auditing database using the Properties option for
the SIA. Stop the agent, select Properties, and then go to the Configuration
tab. Select Write server auditing information to specified data source
and click Specify.
Managing Auditing

To configure the auditing database on UNIX
1. Use ccm.sh to stop the CMS.
2. Run cmsdbsetup.sh.
3. Choose the selectaudit option, and then supply the requested
information about your database server.
4. Run serverconfig.sh.
5. Choose the Modify a server option.
6. Select the CMS, and enable auditing. Enter the port number of the CMS
when prompted (the default value is 6400).
Use ccm.sh to start the CMS. When the CMS starts, it will create the auditing
database.
Which events can I audit?
You can audit the events of individual users of BusinessObjects Enterprise
as they log in and out of the system, access data, or create file-based events.
You can also monitor system events like the success or failure of scheduled
objects. For each event, BusinessObjects Enterprise records the time of the
event, the name and user group of the user who initiated the event, the server
where it was performed, and a variety of other parameters more fully
documented in Reference list of auditable events on page 581.
Reference list of auditable events
This section contains the list of the auditable events you can enable in
BusinessObjects Enterprise. It is organized according to the types of events
that you can audit, to help you find the server where you enable auditing of
these events.
If you are going to audit Publications you need to be aware of the following.
As part of the publication process, BusinessObjects Enterprise creates
temporary instance files for all recipients. If these events are being audited
BusinessObjects Enterprise needs to maintain these instances, since they
record details of the operation needed for the auditing process. This means
13Managing Auditing

the Clean up instance after scheduling option for Publishing will be ignored
if these events are set as auditable.
Note:
• The following list of events is intended only to help you configure your
system for auditing. It does not contain information on what event details
are captured on these events.
• The list of auditable events for Desktop Intelligence and Web Intelligence
Rich Client only apply when the client is actively logged in to
BusinessObjects Enterprise. If the client is being use in an offline mode
then events will not be recorded.
User events enabled on servers
The following table shows which server-based events can be audited and
which server can be used to activate them.
BusinessObjects
Enterprise Server
BusinessObjects
Enterprise Service
EventCategory
CMSCMS
Object Created
Objects
Object Deleted
Object Modified
Object Rights Modified
Unresponsive Scheduling
Managing Auditing

BusinessObjects
Enterprise Server
BusinessObjects
Enterprise Service
EventCategory
Crystal Reports
Cache Server
Crystal Reports
Cache Service
Report Viewing Succeeded
Crystal re-
ports
Report Viewing Failed
Destination Job
Server
Destination Job
Service
Scheduling Succeeded
Scheduling Failed
Scheduling Failed But Will Be Reat-
tempted
Destination Delivery Succeeded
Destination delivery Failed
13Managing Auditing

BusinessObjects
Enterprise Server
BusinessObjects
Enterprise Service
EventCategory
Web Intelligence
Cache Server
Web Intelligence
Cache Service
Document Retrieved
• A user has saved a Web Intelli-
gence document within Busines-
sObjects Enterprise.
Web Intelli-
gence
Universe Selected
• A user has selected a universe
as they create a new Web Intelli-
gence document, or as they edit
an existing Web Intelligence doc-
ument.
Document Refreshed
• User manually refreshes a Web
Intelligence document, or opens
a Web Intelligence document that
is set to "refresh on open", or
schedules a Web Intelligence
document.
List Of Values Retrieved
• A list of values is retrieved from
the database to populate a pick-
list associated with a prompt used
to filter the data in a document.
Document Edited
• User enters "Edit document"
mode for an existing Web Intelli-
gence document.
Managing Auditing

BusinessObjects
Enterprise Server
BusinessObjects
Enterprise Service
EventCategory
Format Applied
• User applies a formatting change
to an existing Web Intelligence
document in a query panel.
SQL Generated
• This is triggered when a new Web
Intelligence document is created.
It then builds an SQL query for
the document, but it its not submit-
ted to the database.
Drilled out of scope
• User drills past the scope of the
data currently in memory, and
triggers a call to the database for
more data.
Prompt Selected
• User enters or selects a value for
a report prompt.
Document Saved
• User opens an existing Web Intel-
ligence document.
13Managing Auditing

BusinessObjects
Enterprise Server
BusinessObjects
Enterprise Service
EventCategory
Adaptive Job Serv-
er
Publishing Service
Web Intelli-
gence
scheduling
andpublish-
ing
Scheduling Failed
tempted
Destination Delivery Failed
Desktop Intelli-
gence Job Server
Desktop Intelli-
gence Job Service
Desktop In-
telligence
scheduling
and delivery
Scheduling Failed
tempted
Document Retrieved
• User opens an existing Desktop
Document Refreshed
• User manually refreshes a Desk-
top Intelligence document, or
opens a Desktop Intelligence
document that is set to "refresh
on open", or schedules a Desktop
Prompt Selected
a report prompt.
Managing Auditing

BusinessObjects
Enterprise Server
BusinessObjects
Enterprise Service
EventCategory
Desktop Intelli-
gence Cache Serv-
er
Desktop Intelli-
gence Cache Ser-
vice
Document Retrieved
• User opens an existing Desktop
Desktop In-
telligence
documents
Document Refreshed
• User manually refreshes a Desk-
top Intelligence document, or
opens a Desktop Intelligence
document that is set to "refresh
on open", or schedules a Desktop
List of values Retrieved
• A list of values is retrieved from
the database to populate a pick-
list associated with a prompt used
to filter the data in a document.
Page Retrieved
• Server renders the pages of a
Desktop Intelligence document in
response to a user request to
display all or part of a document.
Prompt Selected
a report prompt.
13Managing Auditing

BusinessObjects
Enterprise Server
BusinessObjects
Enterprise Service
EventCategory
Publishing Job
Server
Publishing Job
service
A job has been:
• successfully scheduled
Publication
Scheduling • unsuccessfully scheduled
• unsuccessfully scheduled but will
be reattempted
Adaptive Job Serv-
er
Replication Service
Replication
Scheduling Failed
tempted
CMSCMS
An access level has been created
Access lev-
els
Custom access level modified
An access level has been deleted
CMSCMS
Concurrent Logon
Users
Named User Logon
User Logon Failed
Password Changed
User Logoff
Managing Auditing

BusinessObjects
Enterprise Server
BusinessObjects
Enterprise Service
EventCategory
Destination Job
Server
Destination Job
Service
(A user has successfully sent an ob-
ject to a destination)
Send an
object to
destination
(An object has failed to be sent to a
destination)
tempted
Event ServerEvent Service
File Event Registered
• Event is created, and registered
with system
File-based
events
File Event Updated
• The name, description, or file-
name of an event is modified
File Event Unregistered
• Event is removed from system
File Event Triggered
• An event is triggered within the
system
13Managing Auditing

User events enabled for clients
The following table lists tells you which client-based events can be audited.
Client events are set on the Applications section of the CMC. No modification
of the client applications themselves is necessary.
Managing Auditing

EventsClient
Document Retrieved
• User opens an existing Web Intelligence document.
Web Intelli-
gence Rich
Client events
Universe Selected
• A user has selected a universe as they create a new
Web Intelligence document, or as they edit an existing
Web Intelligence document.
Document Refreshed
• User manually refreshes a Web Intelligence document,
or opens a Web Intelligence document that is set to
"refresh on open".
List of Values Retrieved
• A list of values is retrieved from the database to popu-
late a picklist associated with a prompt used to filter
the data in a document.
Document Edited
• User enters "Edit document" mode for an existing Web
Format Applied
• User applies a formatting change to an existing Web
Intelligence document in a query panel.
SQL Generated
• Server builds an SQL query for a Web Intelligence
document (query is not submitted to DB).
13Managing Auditing

EventsClient
Drilled out of scope
• User drills past the scope of the data currently in
memory, and triggers a call to the database for more
data.
Prompt Selected
• User enters or selects a value for a report prompt.
Document Saved
• A user has saved a Web Intelligence document within
Managing Auditing

EventsClient
Start Desktop Application (Three Tier)
Desktop Intelli-
gence client
events
Document Retrieved
• User opens an existing Desktop Intelligence document.
Document Refreshed
• User manually refreshes a Desktop Intelligence docu-
ment, or opens a Web Intelligence document that is
set to "refresh on open", or schedules a Web Intelli-
gence document.
Prompt Selected
• User enters or selects a value for a report prompt.
List of Values Retrieved
• A list of values is retrieved from the database to popu-
late a picklist associated with a prompt used to filter
the data in a document.
Universe List Retrieved
Universe Selected
• A user has selected a universe as they create a new
Desktop Intelligence document, or as they edit an ex-
isting Desktop Intelligence document.
13Managing Auditing

EventsClient
Document Edited
• User enters "Edit document" mode for an existing Web
Send to Users
Document Saved
Managing Auditing

System events
BusinessOb-
jects Enter-
prise Server
Event
Job Servers
A job has been run successfully. For exam-
ple, a scheduled Crystal report or publication
has run successfully.
Scheduled
objects
A job has failed to run. For example, a
scheduled Crystal report or publication has
failed to run.
Tip:
To auditing every failure of a scheduled Crystal
report, a scheduled program, or a scheduled
List of Values, enable auditing of "A job has
failed to run" on the Job Server, and "Commu-
nication with a running instance is lost." on the
Central Management Server.
A job failed but will try to run again.
Communication with a running instance is
lost. For example, a scheduled Crystal report
has failed to run because communication
with the instance was lost, and the scheduled
time for running the report expired.
Note:
You do not need to enable this option to audit-
ing every failure of a scheduled Web Intelli-
gence document.
13Managing Auditing

Auditing and Publishing
You can audit actions related to Publishing with the sample report for
Publishing that is included in BusinessObjects Enterprise. If you want to audit
actions related to Publishing, keep these considerations in mind:
• You must configure auditing for every server used in the Publishing
process. This includes destination servers, report job servers, and the
publication job server.
• Publications intended for many recipients can generate many events that
are recorded by the auditing database. Some of these events are related
to the publication object, while other events are child events related to
publication instances. The auditing database must have sufficient capacity
to handle high-volume Publishing scenarios, or be configured to archive
past actions.
• We recommend you turn on the Object Deleted event for all Central
Management Servers.
Auditing information for publication destinations
The following table summarizes the information that an auditing report
provides for each type of publication destination.
Managing Auditing

Information provided in the auditing reportDestination
type
• Publication name
• Publication location in the CMS
• File size
• Delivery type (in this case, Publishing)
• Reason for failure (if failure occurs)
• Publication instance ID
• Recipient name
• Document scope (for personalization)
All destination
types
• Domain name
• SMTP server
• Port
• From, To, and CC addresses
• Attachment file name
Email
• FTP host name
• Port
• FTP user name
• File path
FTP server
• File pathLocal disk
• Recipients' user namesInfoView inbox
• Printer name
• Name and path for each document printed
• Number of copies
Note:
This feature is available for Crystal reports only.
Printer
Enabling auditing of user and system
events
13Managing Auditing
Enabling auditing of user and system events

After you determine which BusinessObjects Enterprise server controls the
event, you must enable auditing on the server from the Servers management
area of the Central Management Console (CMC).
If you have multiple BusinessObjects Enterprise servers of a given type, be
sure to enable identical auditing events on every server. This ensures you
collect information on all user or system events in your BusinessObjects
Enterprise system. For example, if you are interested in the total number of
concurrent user logons, enable auditing of concurrent user logons on each
of your Central Management Servers. If you enable auditing on only one
Central Management Server, you will only collect auditing information about
events that occur on that server.
In some special cases you may wish to enable auditing on only one server
of a given type. For example, if you are interested in the success or failure
of only one kind of scheduled report and you have configured your system
so that these reports are processed on one particular Job Server, it is not
necessary to enable auditing on every Job Server in your system. You only
need to enable auditing on the Job Server where the reports are processed.
Note:
You must configure the auditing database before you can collect data on
auditing events. See Configuring auditing on page 578 for information on how
to configure the auditing database.
When you are configuring auditing on you system, you can use the
Configuration Template option to apply settings across multiple servers of
the same type. One of the advantages to this method is that it allows you to
apply changes to all your auditee servers of a particular type from a single
location. See Working with configuration templates on page 156.
Note:
For auditing Desktop Intelligence client and Web Intelligence Rich Client
events, you must also configure the these applications in the CMC.
To enable auditing events on servers
1. Go to the Servers area of CMC.
2. Click the server that controls the action that you wish to audit.
(See the Reference list of auditable events on page 581 to find the correct
server.)
Managing Auditing
13 Enabling auditing of user and system events

3. Click Actions > Audit Events .
The "Audit Events" options will be displayed.
4. If you are using a temporary file directory other than the default, enter the
path to the directory in Auditing Temporary Directory.
5. In Events per file enter the maximum number of audit events you want
stored in the temporary file.
Note:
If this number of events is exceeded, then these events will be split over
multiple files. See Optimizing system performance while auditing on
page 605.
6. Click Auditing is enabled .
7. Under the "Select Events to Audit"section, select the auditing events that
you wish to record.
Tip:
To audit every failure of a scheduled Crystal report, a scheduled program,
or a scheduled List of Values, enable auditing of "Scheduling Failed" on the
Job Server the Central Management Server.
Note:
• We recommend that you turn on the Object Deleted auditing event on
all CMS servers if you are enabling auditing.
• In some cases you may also want to select the Disable Auto Reconnect
to System and Auditing Databases (on the CMS "Properties" page in
CMC). In the event of a power failure, or other service disruption, this
allows administrators to check the integrity of the auditing database before
resuming operations. No auditing events will be lost, as they will continue
to reside in the temporary files on the appropriate servers until
reconnection with the CMS can be established.
• Ensure that your auditing log file is located on a hard drive that has
sufficient space to store the temporary files. (See Optimizing system
performance while auditing on page 605 for information on adjusting the
size of temporary files.)
• Which events can I audit? on page 581
• Using sample auditing reports on page 603
13Managing Auditing
Enabling auditing of user and system events

To enable auditing events for client applications
In order to audit client events, your BusinessObjects Enterprise deployment
must have the following in place.
• You will need at least one Adaptive Processing Server with Client Auditing
Proxy Service and auditing enabled on this server.
• For clients connecting through CORBA, you must open a port in the
firewall between the client and the Adaptive Processing Server machines.
• For client connection through HTTP (Desktop Intelligence ZABO client,
Web Intelligence Rich Client, InfoView, etc.), you must open a port in the
firewall between the Web Application Server and the Adaptive Processing
Server machines.
• Auditing must be enabled on the Cache and Job servers for Desktop
Intelligence or Web Intelligence (or both).
1. Go to the Applications area of the CMC.
2. Click the application that controls the action you wish to audit.
3. Click Actions > Audit Events.
The "Audit events" screen is displayed.
4. Click Auditing Status .
5. Under the Check events you want to audit section, select the auditing
events that you wish to record.
6. Click Update.
Auditing Configuration Template
The configuration template allows you to easily modify the settings on several
servers. The settings you enter for the template can be applied to all the
selected servers in your deployment.
By default the configuration template will be configured with the auditing
settings specified during your BusinessObjects Enterprise installation (the
install default is to have auditing disabled). You can modify the template at
any time by accessing the Auditing settings for any Auditee server in your
deployment.
There are two ways to see the current settings of the configuration template.
The simplest way is to view the Auditing settings on one of the servers you
Managing Auditing
13 Auditing Configuration Template

know uses the template. The settings will appear (grayed out) on that page.
Alternatively you can set one of the Auditee servers to use the template, and
save that change. The configuration template's settings will then be visible
on the Auditing settings page.
Configuration templates can also be used for functions other than auditing.
For more details, see Working with configuration templates on page 156.
To set the Configuration template
1. Go to the servers area of the CMC
2. Double click one of the servers you wish to configure using the
configuration template.
3. Click Auditing Events.
The "Auditing Configuration" page is displayed.
4. If Use Configuration Template is already set, uncheck it.
5. Configure the Auditing settings according to your preferences.
Note:
The Auditing events are not part of the Configuration Template.
6. Click Set Configuration Template .
The settings on this page will be applied to all the servers that have Use
configuration template set for Auditing. The applies to all server types.
You can apply the Configuration Template to any auditee server by accessing
its Auditing settings and clicking Use configuration template.
Note:
• Once you have set the configuration template, we recommend that you
uncheck Set Configuraton Template and set Use Configuration
Template on the server you used to configure the template. This prevents
users for accidentally modifying the template by changing the settings for
that server.
• If you uncheck Use Configuration Templateon a server, all the Auditing
settings will remain in their current state until you enter new information.
The server will not revert to its original settings.
13Managing Auditing
Auditing Configuration Template

Configuring the universe connection
The auditing reports use the Activity universe. Before you can view these
reports, you must configure the universe connection. If you installed auditing
when you set up and configured your BusinessObjects Enterprise, this
connection will already be configured.
If you did not install auditing when you set up BusinessObjects Enterprise,
you will need to configure this connection before you view auditing reports.
This involves two steps: first you must create a data source for your auditing
database (unless you have a native connection you plan to use), next you
must specify this data source for your universe connection.
Note:
For Windows systems you may need to create an ODBC system DSN to
point to your audit database.
To configure the Activity universe connection
Note:
This will configure the Activity universe that the sample reports are designed
to run against. If you are using custom reports you will need to connect to
the universe that those reports are designed for.
1. Start the Designer application and logon to your CMS.
2. Close the "Quick Design Wizard" if it opens.
3. Click File > Import.
The "Import Universe" window opens.
4. Select Browse and choose the root folder, then click OK.
A list of universes is displayed.
5. Select the "Activity" universe and click OK, then click OK again.
A message is displayed, saying that the universe was successfully
imported.
6. Click OK.
7. From the menu bar, click File > Parameters.
The "Universe Parameters" window opens.
8. Click New to start the New Connection Wizard, then click Next.
Managing Auditing
13 Configuring the universe connection

9. Type in any name into the Connection Name field and select the Data
Access Driver for your connection. Specify your user name, password,
and data source, alias, or service name. Click Next twice, then click
Finish.
10. Click File > Save to save the connection you have created.
11. Click File > Export.
The "Export Universe" window opens.
12. In the Domain field, select the location you imported the Activity universe
from and click OK.
A message is displayed, saying that the universe was successfully
exported.
13. Click OK and exit the "Designer" application.
Using sample auditing reports
BusinessObjects Enterprise includes two sets of sample auditing reports:
• One set was created using Crystal Reports.
• One set was created using Web Intelligence.
Both sets of reports are available in the sample folder on your product
distribution in the file auditing.biar.
These sample reports are published to the Auditor folder when you install
BusinessObjects Enterprise with a product keycode which authorizes you
to use Auditor. The Crystal Reports auditing reports are available as object
packages with the report sections as individual documents. The Web
Intelligence auditing reports are available as Web Intelligence documents
with the report sections as tabs within the documents. Both sets of reports
are based on the Activity universe.
Note:
You can also deploy the auditing reports to another cluster. To do this, use
the Import Wizard to deploy the auditing.biar to the CMS on the node where
you want the reports. For further details, see the Import Wizard help.
Note:
Current auditing reports are designed to run from a single auditing database.
If you configured the auditing database when you installed BusinessObjects
Enterprise, you must enable the auditing of the user and server actions. For
13Managing Auditing
Using sample auditing reports

information on how to enable auditing on servers, see Enabling auditing of
user and system events on page 597.
If you did not configure the database when you installed BusinessObjects
Enterprise, before you use the reports, you must do the following:
• Configure the auditing database before you use the sample reports.
For information on how to configure the auditing database, see Configuring
auditing on page 578
• Enable the auditing of the user and server actions needed to provide data
for the sample reports.
For information on how to enable auditing on servers, see Enabling
auditing of user and system events on page 597
• Configure the universe connection used for the sample reports.
For procedural details, see Configuring the universe connection on
page 602.
After you enable auditing of the user and server actions, the auditing database
will then begin to be populated with the auditing data you specified.
Note:
If you have recently enabled auditing, the sample auditing reports may contain
little or no data the first time you view them.
Controlling synchronization of auditing
actions
The CMS controls the synchronization of auditing actions that occur on
different machines. The CMS periodically broadcasts its system time to the
auditees in UTC (Coordinated Universal Time). The auditees compare this
time to their internal clocks, and then make the appropriate correction to the
time stamp (in UTC) they record for subsequent auditing actions. This
correction affects only the time stamp that the auditee records in its auditing
log file. The auditee does not adjust the system time of the machine on which
it is running.
By default, the CMS broadcasts its system time every 60 minutes. You can
change the interval using the CMS command-line option:
Managing Auditing
13 Controlling synchronization of auditing actions

-AuditeeTimeSyncInterval minutes
You can turn off this option by setting minutes to zero. For more information
on the CMS, see the Server Command Lines chapter in the BusinessObjects
Enterprise Administrator's Guide.
This built-in method of time synchronization will be accurate enough for most
applications. For more accurate and robust time synchronization, configure
the auditee and auditor machines to use an Network Time Protocol (NTP)
client, and then turn off internal synchronization by setting:
-AuditeeTimeSyncInterval 0
Tip:
If you have a CMS cluster, apply the same command-line options to each
server. Only one CMS in the cluster acts as the auditor. However, if this CMS
fails, another CMS takes over auditing. This CMS will apply its own
command-line options. If these options are different from those of the original
auditor, auditing behavior may not be what you expect.
Optimizing system performance while
auditing
Enabling auditing can effect on the performance of BusinessObjects
Enterprise. However, you can optimize system performance by fine-tuning
these options:
• AuditInterval minutes , where minutes is between 1 and 15. (The
default value is 5.) The CMS requests auditing records from each audited
server every auditing interval.
• auditMaxEventsPerFile number (number has a default value of 500
and must be greater than 0). The maximum number of records that an
audited server will store in a single auditing temp file. When this maximum
value is exceeded, the server opens a new temp file.
Note:
Temp files remain on the audited server until all records have been requested
by the CMS.
Changing each of these options has a different impact on system
performance. For example, increasing the auditing interval reduces frequency
with which the CMS writes events to the auditing database. Decreasing the
13Managing Auditing
Optimizing system performance while auditing

audit interval increases the rate at which records are moved from the auditing
temporary files on the audited servers to the auditing database, thereby
decreasing the length of time that it takes these records to get transferred
to the central auditing database. Increasing the maximum number of auditing
events stored in each auditing log file reduces the number of file open and
close operations performed by audited servers.
You can use these options to optimize auditing performance to meet your
needs. For example, if you frequently need up-to-date information about
audited events, you can choose a short auditing interval and a large
temporary file size. In this case, all auditing records are quickly transferred
to the auditing database, and you can always report accurately on the latest
audited events. However, choosing these options may have an impact on
the performance of BusinessObjects Enterprise.
Alternatively, you may only need to review auditing results periodically
(weekly, for example). In this case you can choose to increase the auditing
interval, and to decrease the number of auditing records in each batch.
Choosing these options minimizes the impact that auditing has on the
performance of BusinessObjects Enterprise. However, depending upon
activity levels in your system, these options can create a backlog of records
stored in auditing temporary files. This backlog is cleared at times of low
system activity (such as overnight, or over a weekend), but means that at
times your auditing reports may not contain records of the most recent audited
events.
Managing Auditing
13 Optimizing system performance while auditing

Using auditing reports
If you are an administrator who wants to view reports from the auditing
database, you have these choices:
• You can use the auditing reports that are included with BusinessObjects
Enterprise.
• You can modify the auditing reports that are included with BusinessObjects
Enterprise.
• You can create your own auditing reports.
Why are reports important?
Auditor includes reports that can answer questions you may have about your
BusinessObjects Enterprise deployment. Each report contains one or more
report sections that focus on a very specific area.
Auditing Reports
14 Using auditing reports

Table 14-1: Questons Auditing can answer
ReportQuestionCategory
Average Number of
Users Logged In
How many users are on my sys-
tem?
User Information
Average Session Dura-
tion
What is the average session dura-
tion?
tion per User
tion per user?
IP Addresses Access-
ing My Cluster
From where are users logging into
my system?
Jobs per User
How many jobs were processed per
user?
Last Login for User
When was the last time a specific
user used the system?
Most Active Users
Who is using the system the most?
(by refresh or by login)
Number of User Ses-
sions
Number of logged in sessions
Number of Users in the
System
How many users have used the
system?
Password Modifications
Whose passwords have been
modified?
Users Who Logged Off
Incorrectly
Who does not log out correctly?
14Auditing Reports

Average Refresh Time
What is the average time for docu-
ments to refresh?
Document Info-
mation
Document Information
Detail
Document Usage Analysis
Document Scheduling
and Viewing Status
How often have documents been
scheduled and viewed?
Least Accessed Docu-
ments
What are the 10 least viewed, edit-
ed, and refreshed documents?
Most Accessed Docu-
ments
What are the 10 most viewed, edit-
ed, and refreshed documents?
Most Popular Actions
per Document
What are the most popular actions
per document?
Operations on Docu-
ments
How often has an operation been
performed on a document?
Publishing Auditing
How often have documents been
published?
tion per Cluster
tion per cluster?
System Informa-
tion
Job Services on the
System
How many Job Services do I have?
Job SummaryHow many jobs are there?
Jobs per Job Service
Type
How many jobs were processed per
Job Service?
Services in the Cluster
How many audited servers do I
have?
Auditing Reports

Most Popular ActionsWhat are the most popular actions?
Impact Analysis
Peak Usage
How many users are accessing my
system daily and when is the most
popular time?
Refresh and Edit Activi-
ty
Are my users editing reports or only
refreshing them?
Rights Modification
What objects have had their rights
changed?
Total Users Logged In
by Day
How many users are on my sys-
tem?
User Activity
What is my users activity by month,
week, day?
User Activity per Ses-
sion
What do the users do?
Auditing report names
This section contains the following:
• the list of the report names
• the report sections included with the reports
• the report prompts
Note:
Folder path prompts will not automatically include objects/documents in
subfolders below the selected folder. For example, selecting the folder
toplevel will show results for all documents in the toplevel folder, but not
for any objects/documents in the toplevel/sublevel folder. To see
objects/documents in all subfolders, enter toplevel%.
14Auditing Reports

Average Number of Users Logged In
The average number of sessions and users logging in over a given period
of time.
Report promptsReport sections
Select a start and end date.
Average Number of Sessions
Users Logged In
Average Number of Users Logged In
Average Refresh Time
The average refresh time per document, user, or cluster over the specified
time period.
Enter a folder path and document type,
select a start and end date.
Average Refresh Time by Document
Average Refresh Time by User
Average Refresh Time by Server
Average Session Duration
The average duration of user sessions, broken down by year, quarter, month,
week, day, or hour.
Enter User name, select a start and
end date.
Year
Quarter
Month
Week
Auditing Reports

Day
Hour
Average Session Duration per Cluster
The average duration of sessions for a cluster of servers, by year, month,
week, or day.
Average Session Duration in Minutes
per Year
per Month
per Week
per Day
Average Session Duration per User
The average duration of specific users' sessions, by year, month or week.
over the Year
per Month per User
per Week per User
14Auditing Reports

Cluster Nodes
The names of all servers in the audit cluster.
NoneServers in the Cluster
Document Information Detail
Provides details of actions performed on a given document.
Enter document name and folder path,
select a start and end date.
Document Information
Document Scheduling and Viewing Status
The status of document jobs and views over a specified period of time.
Enter folder path, select start and end
date.
Scheduleing Status
Crystal Reports Viewing Status
Web Intelligence Viewing Status
Desktop Intelligence Viewing Status
IP Addresses Accessing My auditing Clusters
The IP addresses or machine names of clients accessing the audit cluster.
Auditing Reports

Select start and end date.
IP Addresses Accessing My auditing
Clusters by IP - Day
Clusters by IP - Month
Clusters by Name - Day
Clusters by Name - Month
Number of jobs per server type, kind, or specific server.
None
Jobs per Job Server Kind- Summary
Jobs per Job Server Kind
Job Services on System
Number of job services on the system, and the duration of any jobs in seconds
(optional).
None
Job Services
Job Services and Duration of Jobs
(sec)
14Auditing Reports

Job Summary
Number of jobs on the system by status, or number of successfully completed
or failed jobs over a given period.
Enter folder path, select start and end
date.
Jobs per Status
Successful Jobs
Failed Jobs
Jobs per User
A summary of the number of jobs and their durations a user has initiated
over a given period of time.
Jobs per User - Summary
Jobs per User
Job Duration per User
Job Failures per User
Last Login for User
Last date and time to the second that a given user logged in to the system.
Enter User name, select start and end
date.
Last Login for User
Auditing Reports

Least Accessed Documents
Identifies the least popular documents by times read, edited or refreshed
over a given period.
Note:
Documents that are never accessed it will not generate any events and not
show up as part of this report.
Select document type and enter folder
path, select start and end date.
Least Accessed Documents - By times
Read
Least Accessed Documents - By Edits
Least Accessed Documents - By Re-
freshes
Most Accessed Documents
Most used documents based on times read, edited or refreshed over a given
period.
None
Most Accessed Documents - By times
Read
Most Accessed Documents - By Edits
Most Accessed Documents - By Re-
freshes
Most Active Users
A list of the system's most active users over a given period of time.
14Auditing Reports

Most Active Users by Logins
Most Active Users by Refreshes
Most Popular Actions
Quantity of the most popular actions during a given time period
Report PromptsReport Sections
Most Popular Actions per Year
Most Popular Actions per Quarter
Most Popular Actions per Month
Most Popular Actions per Week
Most Popular Actions per Day
Most Popular Actions per Document
Auantity of the most popular actions for a specified document during a given
time period or by specified user.
Auditing Reports

Select document name and enter folder
path, select start and end date.
Most Popular Actions per Document-
By User
By Session
By Action
By Month
Number of User Sessions
Total number of user sessions for a cluster organized per year, month, week,
and day.
by Month
by Week
by Day
Number of Users in the System
The number of users in the system at the time the report is run.
None
Number of Users in the System - Active
Users
14Auditing Reports

Operation on Documents
The types of operations performed on specified documents, by time, type,
user and document, or user.
Note:
Only document types that have generated auditing events will appear in the
Document Type prompt dropdown.
Enter user name, Document type and
folder path, select operation and start
and end date.
Operation on Documents - By Time
Operation on Documents - By Opera-
tion Type
Operation on Documents - By User and
Document
Operation on Documents - By User
Password Modifications
A summary of password modification operations over a specified period of
time.
Password Modifications - By Month
Password Modifications - By Week
Password Modifications - By Details
Peak Usage
Charts the peaks of user logins, session logins or number of actions
performed over a given period of time.
Auditing Reports

Users Login Peaks
Session Login Peaks
Number of Action Peaks
Publishing auditing
Publication activity for a specific document over a given period of time.
Enter publication name, select start and
end date.
Publishing Auditing
Refresh and Edit Activity
Number of edit and refresh actions per document trace, per cluster, and per
selected user over a given period.
Select user name, document name and
folder path, select start and end date.
Refresh and Edit Activities of Web In-
telligence Documents
Rights Modification
A summary of security activities for a specified folder over a given period of
time.
Select folder path, select start and end
date.
Rights Modification - By User
Rights Modification - By Object
14Auditing Reports

Services in the Cluster
None.Services in the Cluster
Total Users Logged In by Day
A summary of the number of users or sessions logged in over a given time
period, broken down by day.
Total Users Logged In by Day -Total
Number of Logged In Users
Total Users Logged In by Day - Total
Number of Logged in Sessions
User Activity
Number of users using the system per month, week, or day within a given
time period.
User Activity by Month
User Activity by Week
User Activity by Day
User Activity per Session
Analyses user activity for the whole content of the audit database per cluster,
session, action, or date.
Auditing Reports

Enter user name, select start and end
date.
User Activity per Session Per Cluster
User Activity per Session Per Session
User Activity per Session Per Action
Name
User Activity per Session Per Date
Users Who Logged Off Incorrectly
Of the users who logged in during a given period, which ones failed to log
off correctly.
Statistics
Users Who Logged Off Incorrectly
Viewing sample auditing reports
To view sample auditing reports
1. Log on to InfoView.
2. Click Public Folders.
3. Click Auditing Reports.
4. Click the language folder of your choice.
A list of sample auditing reports is displayed.
5. Open the report you want to view.
• To open a Web Intelligence auditing report, click on the report you
want to view.
14Auditing Reports
Viewing sample auditing reports

• To open a Crystal Reports auditing report, open the object package,
and then open the report you want to view.
Creating custom auditing reports
This section contains information to help you understand the auditing
database, the Activity universe and the information it records about auditing
actions. With this information, you can use Crystal Reports, Web Intelligence
or Desktop Intelligence to create custom auditing reports of user and system
actions.
Auditing database schema reference
The auditing database contains six tables:
• Audit_Event on page 624
• Audit_Detail on page 625
• Server_Process on page 626
• Detail_Type tables on page 628
• Event_Type on page 627
• Application_Type on page 628
The following diagram shows the schema of the auditing database.
Audit_Event
The Audit_Event table stores one record per action that is audited and
contains general information about each auditing event.
Auditing Reports
14 Creating custom auditing reports

DescriptionField
Server and service ID. Combined with the Event_ID to form
the primary key for the Audit_Event table.
Server_CUID
A unique ID generated by the server to identify the auditing
event. Combined with Server_CUID to form the primary
key for the Audit_Event table.
Event_ID
Name of user who performed the action.User_Name
Time for start of action in UTC (Coordinated Universal Time)
to the nearest millisecond. The time stamp is created by the
server recording the action in its log file, and includes any
correction necessary to synchronize with CMS time. You
may want to correct this time to your local time zone when
creating auditing reports.
Start_Times
tamp
Duration, in seconds, of the action that is audited.Duration
Number that uniquely identifies the type of action the entry
represents. Foreign key for the Event_Type table.
Event_Type_ID
Info Object CUID of object associated with the action. This
number uniquely identifies an object such as a document,
folder or user.
Object_CUID
Identifies the program that initiates the action, such as Web
Intelligence, Desktop Intelligence, Crystal Reports, or Voy-
ager.
Object_Type
Field reserved for error codes.Error_Code
Audit_Detail
The Audit_Detail table records more details about each auditing action
recorded in the Audit_Event table. For example, when a user logon fails,
the reasons for that failure are recorded as auditing details.
14Auditing Reports

There may be more than one record in this table for each auditing action
recorded in the Audit_Event table.
DescriptionField
Combination of the Server and Service CUID responsible
for the event. Combined with the Event_ID and the
Detail_ID to form the primary key for the Audit_De
tailtable.
Server_CUID
A unique ID generated by the server to identify the audit-
ing event. Combined with Server_CUID and the De
tail_ID to form the primary key for the Audit_Detail
table.
Event_ID
The Detail_ID field is used to number the individual
details associated with each auditing action (i.e. if there
are two details associated with a particular auditing ac-
tion, the first will have a Detail_ID of 1, and the second
will have a Detail_ID of 2).
Detail_ID
Number that uniquely identifies the type of detail about
the auditing action that the entry represents. Foreign key
for the Detail_Type table.
Detail_Type_ID
Information about the auditing detail being recorded. For
example, if the Detail_Type_Description were
"universe name", the detail text would contain the name
of that universe.
Detail_Text
Server_Process
The Server_Process table contains information about the servers and
services running within your BusinessObjects Enterprise system which can
generate auditing events.
Auditing Reports
14 Auditing database schema reference

DescriptionField
Combination of the Server and Service
CUID of the server InfoObject that cre-
ated the event. Primary key for the
Server_Process table.
Server_CUID
Machine name of the server that pro-
duced the action. That is, the host
name.
Server_Name
A unique ID that identifies the type of
application that generated the auditing
action. Foreign key to the Applica
tion_Type table.
Application_Type_ID
Name of the server and service that
initiated the action. The names are the
same as those displayed in the CMC.
The default name is host
name.servertype.
Server_FullName
Version of BusinessObjects Enterprise
on server that produced the action.
Server_Version
Event_Type
The Event_Type table contains a static list of the kinds of events that can
be audited in your BusinessObjects Enterprise system. This table provides
information roughly equivalent to that provided by AuditIDs and AuditStrings
in Crystal Enterprise
DescriptionField
Number that uniquely identifies the type
of auditing event that the entry repre-
sents.
Event_Type_ID
14Auditing Reports

DescriptionField
Description of the type of auditing
event.
Event_Type_Description
Application_Type
The Application_Type table contains a static list of the applications that
can produce auditing events.
DescriptionField Name
A unique ID that identifies the type of
application that generated the auditing
action.
Application_Type_ID
The description of the application gen-
erating the auditing event.
Application_Type_Description
Detail_Type tables
The Detail_Type table contains a static list of the standard details that can
be recorded about audited events. For example, a user logon can fail for a
number of different reasons. These reasons are listed as entries in the De
tail_Type table.
The information in the Detail_Type table is equivalent to the information
that was recorded in variable AuditStrings in Crystal Enterprise 10.
DescriptionField
Number that uniquely identifies the type of
auditing detail that the entry represents.
Detail_Type_ID
Auditing Reports
14 Auditing database schema reference

DescriptionField
The description of the type of auditing detail
generated by the auditing event.
Detail_Type_Description
Event and Detail reference tables
The following tables list the Event_Type_ID and Event_Type_Description
of all events that can be audited in your system. For your convenience, these
events are ordered according to the service that generates each type of
event.
The following table shows and example event.
Detail Text
Detail Descrip-
tion
De-
tail
ID
Event Description
Event
ID
AdminUser Groups42
Concurrent user lo-
gon succeeded.
65537
1234Session ID45
Concurrent user lo-
gon succeeded.
65537
123.456.101.100
IP address report-
ed by client
60
Concurrent user lo-
gon succeeded.
65537
host.domain.com
Hostname report-
ed by client
61
Concurrent user lo-
gon succeeded.
65537
123.456.101.100
IP address re-
solved by server
62
Concurrent user lo-
gon succeeded.
65537
host.domain.com
Hostname re-
solved by server
63
Concurrent user lo-
gon succeeded.
65537
14Auditing Reports

Detail Text
Detail Descrip-
tion
De-
tail
ID
Event Description
Event
ID
juser
Concurrent user
account
89
Concurrent user lo-
gon succeeded.
65537
The following tables list the Event_Type_ID code for the event, the
description, and any details that will be associated with that event followed
by their Detail_ID codes in parenthesis.
CMS auditing events
Event Details (Detail_ID)Event_Type_DescriptionEvent_Type_ ID
• Concurrent User Count (89)
• Hostname reported by client (61)
• Hostname resolved by server (63)
• IP address reported by client (60)
• IP Address resolved by server (62)
• Session ID (45)
• User Groups (42)
Concurrent user logon suc-
ceeded.
65537
• IP address resolved by server (62)
• Session ID (45)
Named user logon succeed-
ed.
65538
• Session ID (45)
User logged off.65540
• Session ID (45)
User password has been
changed.
65541
Auditing Reports
14 Event and Detail reference tables

• Enterprise Error Text (46 )
• IP address resolved by server (62)
• Logon using token (64)
User logon failed.65539
• Object CUID (92)
• Object Folder Path (43)
• Object instance (90)
• Object Name (3)
• Object Type (50)
• Parent Document CUID (91)
• Session ID (45)
Note:
This auditing string will not be recorded when
a new user account is created, even though
a new folder is created for each new user.
Object created.65542
• Object Name (3)
• Session ID (45)
Object deleted.65543
14Auditing Reports

• Object Name (3)
• Session ID (45)
Object modified.65544
Unresponsive scheduling.65545
• Object Name (3)
• Session ID (45)
Object Rights Modified65544
Cache service auditing events
• Object Name (3)
• Report Data Type (51)
Report Viewing Succeeded.196609
• Enterprise Error Text (46)
• Object Name (3)
Report Viewing Failed.196610
Auditing Reports

Job service auditing events
For scheduled objects (by clients or servers), the auditing messages give
you information about the status of scheduled actions. For example, the
auditing messages can tell you if a scheduled report ran successfully.
For the Destination Job service, the auditing messages give you information
on whether an object was sent to a destination, as requested by a user.
• Object Name (3)
• Universe name (2)
Job successful.327681
• Object Name (3)
Job failed.327682
• Object Name (3)
• Template Document (91)
• Universe Name (2)
Note:
For more information on scheduling jobs,
see the BusinessObjects Enterprise Ad-
ministrator's Guide.
Job failed. Job will be retried
by the CMS.
327683
14Auditing Reports

• Destination Delivery Type (66)
• Destination Type (65)
• Document Scope (81)
• Document size (9)
• Domain (71)
• File Name (68)
• From Address (73)
• Host Name (70)
• Object Name (3)
• Port (72)
• Publication Instance ID (82)
• Recipient Name (80)
• Template Document CUID (91)
• To Address (74)
• User Name (69)
Destination Delivery Succeed-
ed
327687
Auditing Reports

• Destination Delivery Type (66)
• Destination Type (65)
• Document Scope (81)
• Domain (71)
• Error Message (76)
• File Name (68)
• From Address (73)
• Host Name (70)
• Object Name (3)
• Port (72)
• Publication Instance ID (82)
• Recipient Name (80)
• Template Document CUID (91)
• To Address (74)
• User Name (69)
Destination Delivery Failed327688
Event service auditing events
• Event filename (41)
• Event ID (40)
Event registered262145
• Event Filename (41)
• Event ID (40)
Event unregistered262146
• Event ID (40)
Event updated262147
14Auditing Reports

• Event ID (40)
Event triggered262148
Report Application service auditing events
The Report Application service (RAS) is used to create reports using custom
applications developed with the RAS SDK. All of the following codes will be
generated by custom applications. Consult your RAS SDK documentation
for additional details.
Auditing Reports

• Object Name (3)
Report was opened for viewing
and/or modification
Note:
In a few cases, this
Event_Type_ID may be generat-
ed when the report opens but
cannot be viewed. This may oc-
cur when:
• There are problems with the
database setup for the report.
For example, you may see
this message when the
database driver for the report
is not present on the client
machine
• A processing extension asso-
ciated with the report aborts
viewing, or fails.
• The report used Business
Views and the user did not
have permissions to refresh
the underlying data connec-
tions.
• The machine running the RAS
ran out of space in its tempo-
rary directory.
458753
Report was saved to the CMS.458754
Report was created and saved to
the CMS
458755
Report could not be opened.458756
Report could not be saved to the
CMS.
458757
14Auditing Reports

Report could not be created in
the CMS.
458758
Web Intelligence and Desktop Intelligence auditing events
Note:
• The list of auditable events for Desktop Intelligence and Web Intelligence
Rich Client only apply when the client is actively logged in to
BusinessObjects Enterprise. If the client is being use in an offline mode
then events will not be recorded.
• If a document is imported to the Web Intelligence Rich Client and worked
on as a local document, all auditing events regarding that document will
be reported as Web Intelligence client events and contain the details
(name, CUID etc.) of the locally saved version of that document, not the
repository version. Repository events will be reported by the Web
Intelligence Processing Server, and client events will be reported by the
Adaptive Processing Server with Client Auditing Proxy Service enabled.
• Number of elements (7)
• Session ID (45)
List of Universes Retrieved6
• Description (14)
• Document name (8)
• Object Name (3)
• Options Refreshed (17)
• Overwrite (18)
• Session ID (45)
Document Saved9
Auditing Reports

• Object Name (3)
• Session ID (45)
Document Retrieved11
• Session ID (45)
• Universe Name (2)
Universe Selected13
• Document Name (8)
• Number of lines (6)
• Object Name (3)
• Session ID (45)
• SQL value (19)
Document refreshed
Note:
This event will also occur
when a user creates a docu-
ment
19
• Object Name (3)
• Session ID (45)
List of Values Retrieved21
• Session ID (45)
Document Edited22
14Auditing Reports

• Report name (22)
• Session ID (45)
Apply format28
• Document type (21)
• Object Name (3)
• Session ID (45)
Get page40
• Object Name (3)
• Session ID (45)
• SQL value (19)
SQL Generated41
• Object Name (3)
• Session ID (45)
• SQL value (19)
Drill out of scope42
Auditing Reports

• Object Name (3)
• Prompt Named
• Prompt value
• Session ID (45)
Prompt Selected43
sendtousers50
• Object Name (3)
startdesktopapp
Note:
Desktop Intelligence only.
51
Voyager auditing events
Event Details (Detail_ID)
Event_Type_Descrip
tion
Event _Type_ID
• Object Name (3)
MDAS Session Creation12500
• Object Name (3)
MDAS Session Closed12501
• Object Name (3)
MDAS Cube Connection
Opened
12502
14Auditing Reports

Event Details (Detail_ID)
Event_Type_Descrip
tion
Event _Type_ID
• Object Name (3)
MDAS Cube Connection
Closed
12503
• Object Name (3)
MDAS Connection Fail-
ure
12504
Client events
Description
Event_Type_De
scription
Event_Type_
ID
Triggered by a Desktop Intelligence application sending
an object to a user.
sendtousers50
Triggered by the startup of Desktop Intelligence.startdesktopapp51
Detail Codes reference table
DescriptionDetail_DescriptionDetail_ID
Universe name2
Object Name3
Number of lines6
Number of elements7
Document name8
Document size9
Description14
Auditing Reports

Category name15
Keywords16
Options Refreshed17
Overwrite18
SQL value19
Document type21
Report name22
Prompt Named23
Prompt value24
Data Provider Name30
Page Range31
Event ID40
Event Filename41
User Groups42
Object Folder Path43
Object Category Path44
Session ID45
Enterprise Error Text46
ODBC SQLSTATE47
ODBC Error Text48
BOE UserID49
14Auditing Reports

Object Type50
Report Data Type51
Triggered during thick-client (CORBA) lo-
gon. Records the IP adress reported by
the client.
IP address reported by
client
60
Triggered during thick-client (CORBA) lo-
gon. Records the host machine name re-
ported by the client.
Hostname reported by
client
61
Triggered during thin and thick client lo-
gon. Records the IP address of the client
as reported by the server. This is more
reliable than "IP address reported by
client", but servers may not be able to
correctly resolve IP addresses on some
networks.
IP address resolved by
server
62
Triggered during thin and thick client lo-
gon. Records the host machine name of
the client as reported by the server. This
is more reliable than "hostname reported
by client", but servers may not be able to
correctly resolve client host names on
some networks.
Hostname resolved by
server
63
Logon using token64
Indicates intended destination of job
(printer, folder, email, etc.).
Destination Type65
Indicates if job was a scheduled operation
or user initiated.
Destination Delivery
Type
66
Records the directory the object or in-
stance is transferred to. Triggered only if
a job is communicated using FTP.
Directory67
Auditing Reports

Records the file name of the object or in-
stance. Triggered only if a job is communi-
cated using FTP ro email.
File Name68
Records the name of the user who request-
ed the event. Triggered only by user-initi-
ated delivery of an object.
User Name69
Records the name of the host machine of
the intended recipient of the object or in-
stance. Triggered by only if a job is pub-
lished by email or FTP.
Host Name70
Records the email domain it is sent to.
Triggered by only if a job is published by
email.
Domain71
Records the port used in the file transfer.
Triggered only if a job is communicated
using FTP or email.
Port72
Triggered only by email delivery of object.From Address73
Triggered only by email delivery of object.To Address74
Triggered only by email delivery of object.CC Address75
Records any error messages generated
by the failure of a job.
Error Message76
Records the name of the intended recipi-
ent (if provided by the job).
Recipient Name80
Document Scope81
Records a unique instance ID for that
event.
Publication Instance ID82
Concurrent User Count89
14Auditing Reports

Object instance90
Parent Document CUID91
Object CUID92
Right added93
Right removed94
Right modified95
Number of Copies
Printed
100
MDAS General Failure12500
MDAS Credential Fail-
ure
12501
Application_Type table reference
Applica
tion_Type_ID
PM Rules Service0
Dashboard Analytics Service1
Client Auditing Proxy Service2
Auditing Service3
Scheduling Host Service4
Crystal Reports Scheduling Service5
Crystal Reports Cache Service6
Auditing Reports

Applica
tion_Type_ID
Central Management Service7
Connection Service8
Crystal Reports Viewing and Modification Service9
Dashboard Service10
Desktop Intelligence Scheduling Service11
Desktop Intelligence Cache Service12
Desktop Intelligence Processing Service13
Destination Delivery Scheduling Service14
Destination Configuration Service15
PM Visualization Cache Service16
PM Visualization Processing Service17
Event Service18
Sets Profiler Service19
Input Filestore Service20
Scheduling Host Service21
List Of Values Scheduling Service22
PM Metric Aggregation Service23
Output Filestore Service24
Crystal Reports Processing Service25
Predictive Analytic Service26
14Auditing Reports

Applica
tion_Type_ID
Program Scheduling Service27
Publication Scheduling Service28
Publishing Post Processing Service29
Publishing Service30
Replication Service31
PM Repository Management Service32
Single Sign-On Service33
Sets Query Service34
Process Analysis Service35
Web Intelligence Scheduling and Publishing Service36
Web Intelligence Processing Service37
Desktop Intelligence38
Search Service39
Multi-Dimensional Analysis Service40
Web Intelligence41
Auditing Reports

This section lists the command-line options that control the behavior of each
• Command lines overview on page 650
• Standard options for all servers on page 651
• Central Management Server on page 654
• Crystal Reports Processing Server and Crystal Reports Cache Server
on page 660
• Report Application Server on page 666
• Input and Output File Repository Servers on page 672
• Event Server on page 675
• Web Intelligence Processing Server on page 670
Command lines overview
When you start or configure a server through the Central Management
Console (CMC) or the Central Configuration Manager (CCM), the server is
started (or restarted) with a default command line that includes a typical set
of options and values. In the majority of cases, you need not modify the
default command lines directly. Moreover, you can manipulate the most
common settings through the various server configuration screens in the
CMC and the CCM. For reference, this section provides a full listing of the
command-line options supported by each server. You can modify each
server's command line directly if you need to further customize the behavior
of BusinessObjects Enterprise.
Throughout this section, values provided in square brackets [ ] are optional.
To view or modify a server's command line
The procedure for viewing or modifying a server's command line depends
upon your operating system:
Server Command Lines
15 Command lines overview

1. On Windows, use the CCM to stop the server. Then open the server's
Properties to modify the command line. Start the server again when you
have finished.
2. On UNIX, run ccm.sh to stop the server. Then edit ccm.config to modify
the server's command line. Start the server again when you have finished.
Note:
On UNIX, each server's command line is actually passed as an argument
to the crystalrestart.sh script. This script launches the server and monitors
it in case an automatic restart is required. For more information, see the
UNIX Tools chapter of the BusinessObjects Enterprise Administrator's
Guide.
• Standard options for all servers on page 651
• Central Management Server on page 654
• Crystal Reports Processing Server and Crystal Reports Cache Server
on page 660
• Report Application Server on page 666
• Input and Output File Repository Servers on page 672
• Event Server on page 675
Standard options for all servers
These command-line options apply to all of the BusinessObjects Enterprise
servers, unless otherwise indicated. See the remainder of this section for
options specific to each type of server.
15Server Command Lines

BehaviorValid ArgumentsOption
Specify the friendly
name of the server. The
server registers this
name with the Central
Management Server
(CMS), and the name is
displayed in the CMC.
The default friendly
name is host
name.servertype
Note:
• Do not modify -name
for a CMS.
• If you modify -name
for an Input or Output
File Repository Serv-
er, you must include
"Input." or "Output."
as the prefix to the
value you type for
string (for example,
-name Input.Serv
er01 or -name Out
put.UK).
string-name
15 Standard options for all servers

In previous versions,
this setting was used to
specify the CMS that the
server should register
with. Note that you can
no longer use the -ns
option on the server
command line to config-
ure which CMS a server
should register with.
This is now handled au-
tomatically by the Server
Intelligence Agent.
cmsname[:port]-ns
Specify the port that the
server listens on. The
server registers this port
with the CMS. If unspec-
ified, the server chooses
any free port > 1024.
Note:
This port is used for differ-
ent purposes by different
servers. Before changing,
see the section on
changing the default
server port numbers in
the BusinessObjects En-
terprise Administrator's
Guide.
port-requestPort
Server restarts if it exits
with an unusual exit
code.
-restart

UNIX only. Run the
daemon in the fore-
ground. When passing
the server's command
line to the crystal
restart.sh script, you
must use this option
(see ccm.config). If
you run the server's
command line directly,
do not use this option,
because the foreground
process blocks the shell
until the server exits.
-fg
UNIX signal handling
On UNIX, the BusinessObjects Enterprise daemons handle the following
signals:
• SIGTERM results in a graceful server shutdown (exit code = 0).
• SIGSEGV, SIGBUS, SIGSYS, SIGFPE, and SIGILL result in a rapid shutdown
(exit code = 1).
This section provides the command-line options that are specific to the CMS.
The default path to the server on Windows is:
12.0win32_x86CMS.exe
15 Central Management Server

The default path to the server on UNIX is:
INSTALL_ROOT/bobje/enterprise120/platform/boe_cmsd
For a list of standard command-line options, see Standard options for all
Specifies the number of
working threads that the
CMS initializes and us-
es. The value can be
between 12 and 150,
and is set to 50 by de-
fault.
number-threads
Cause the CMS to
delete the system
database and recreate
it with only the default
system objects.
-reinitializedb
Force the CMS to quit
after processing the
-reinitializedb op-
tion.
-quit

Specify the number of
threads the CMS cre-
ates to receive client re-
quests. A client may be
another Business Ob-
jects server, the Report
Publishing Wizard,
Crystal Reports, or a
custom client application
that you have created.
The default value is 5.
Normally you will not
need to increase this
value, unless you create
a custom application
with many clients.
number-receiverPool
Specify the maximum
number of objects that
the CMS stores in its
memory cache. Increas-
ing the number of ob-
jects reduces the num-
ber of database calls re-
quired and greatly im-
proves CMS perfor-
mance. However, plac-
ing too many objects in
memory may result in
the CMS having too little
memory remaining to
process queries. The
upper limit is 100000.
number-maxobjectsincache

CMS worker threads
sending requests to the
database. Each thread
has a connection to the
database, so you must
be careful not to exceed
your database capacity.
In most cases, the maxi-
mum value you should
set is 10.
number-ndbqthreads
If your cluster includes
more than eight CMS
cluster members, ensure
that the command-line for
each CMS includes this
option. Specify the num-
ber of CMS services in
your cluster. This option
ensures that the cluster
can sustain heavy load.
number-oobthreads
Specify interval at which
the CMS requests audit
information from audited
servers. The default val-
ue is 5 minutes. (Maxi-
mum value is 15 min-
utes, and minimum val-
ue is 1 minute.).
minutes-AuditInterval

Specify the maximum
number of audit records
that the CMS requests
from each audited serv-
er, per audit interval.
The default value is 200
records. (Maximum val-
ue is 500, and minimum
value is 50.)
number-AuditBatchSize
Specify the maximum
number of records in the
audit log file. The default
value is 500. If the num-
ber specified by -audit
MaxEventsPerFile is
exceeded, the server
opens a new log file.
number
-auditMaxEventsPer
File

Specify the interval be-
tween time synchroniza-
tion events. The CMS
broadcasts its system
time to audited servers
at the interval specified
by -AuditeeTimeSync
Interval. The audited
servers compare their
internal clocks to the
CMS time, and then ad-
just the timestamps they
give to all subsequent
audit records so that the
time of these records
synchronizes with the
CMS time. The default
interval is 60 minutes.
(Maximum value is 1
day, or 1440 minutes.
Minimum value is 15
minutes. Setting the in-
terval to 0 turns off time
synchronization.)
minutes
-AuditeeTimeSyncIn
terval
You can now use the command line to perform tasks in the CCM on Windows.
The default path on Windows is:
12.0win32_x86ccm.exe
For a complete list of the commands available for the ccm.exe, run ccm.exe
-help, or see the table in ccm.sh on page 678.

Crystal Reports Processing Server and
The Crystal Reports Processing Server and the Crystal Reports Cache Server
are controlled in much the same way from the command line. The
command-line options determine whether the server starts as a Processing
Server, a Cache Server, or both. Options that apply only to one server type
are noted below.
The default paths to the servers on Windows are:
12.0win32_x86cacheserver.exe
12.0win32_x86pageserver.exe
The default paths to the servers on UNIX are:
INSTALL_ROOT/bobje/enterprise120/platform/boe_cachesd
INSTALL_ROOT/bobje/enterprise120/platform/boe_pagesd
Enable Cache Server
functionality.
-cache
15 Crystal Reports Processing Server and Crystal Reports Cache Server

Specify the cache direc-
tory for a Cache Server
and the temp directory
for the Processing Serv-
er. The directories creat-
ed are abso
lutepath/cache and
absolutepath/temp
absolutepath-dir
Delete the cache directo-
ry every time the server
starts and stops.
-deleteCache
Specify the temp directo-
ry for the Processing
Server. This option
overrides -dir.
absolutepath-psdir
Share cached pages for
the specified number of
minutes.
minutes-refresh
Crystal Reports Processing Server and Crystal Reports Cache Server

Limit the number of
database records that
are returned from the
database. The default
limit is 20000 records. If
a user views an on-de-
mand report containing
more than 20000
records, an error mes-
sage indicates that the
report contains too
many database records.
To increase the en-
forced limit, increase
number accordingly; to
disable the limit, replace
number with 0 (zero).
number-maxDBResultRecords
Disable automatic
database disconnection
for the Processing Serv-
er. By default the Pro-
cessing Server will auto-
matically disconnect
from the reporting
database after retrieving
data, to free up
database licenses. This
may affect performance
if your site uses many
reports with on-demand
subreports, or group-by-
on-server.
-noautomaticdbdiscon
nect
15 Crystal Reports Processing Server and Crystal Reports Cache Server

Specify the default direc-
tory for processing ex-
tensions. For details,
see the BusinessOb-
jects Enterprise Adminis-
trator's Guide.
absolutepath
-report_Proces
sExtPath
On the Cache Server,
specifies the maximum
number of audit actions
recorded in the audit log
file. The default value is
500. If this maximum
number of records is
will open a new log file.
number
-auditMaxEventsPer
File
Job servers
This section provides the command-line options that are specific to the job
servers, which include Job Servers, Program Job Servers, Destination Job
Server, and List of Values Job Server.
12.0win32_x86JobServer.exe
The default paths to the server on UNIX are:
INSTALL_ROOT/bobje/enterprise11/platform/boe_reportjobsd
INSTALL_ROOT/bobje/enterprise11/platform/boe_programjobsd
Job servers

Specify the data directo-
ry for the Job Server.
absolutepath-dir
Specify the processing
library to load:
• procReport or
• procProgram
Loading procReport
starts the Job Server
as a Report Job
Server. Loading
procProgram starts
the Job Server as a
Program Job Server.
This option is used in
conjunction with -ob
jectType.
processinglibrary-lib
15 Job servers

The program ID of the
processing library,
which determines the
class of object support-
ed by the Job Server:
• CrystalEnter
prise.Report or
• CrystalEnter
prise.Program
Used with -lib to
specify whether the
Job Server becomes
a Report Job Server
or a Program Job
Server.
progID-objectType
Set the maximum num-
ber of concurrent jobs
that the server will han-
dle. The default is five.
number-maxJobs
Specify the range of
ports that child process-
es should use in a fire-
wall environment. For
example, 6800-6805
limits child processes to
six ports.
Note:
For this option to take
effect, you must also
specify the -request
Port setting.
lowerbound-upper
bound
-requestJSChildPorts
Job servers

see the BusinessOb-
trator's Guide.
absolutepath
-report_Proces
sExtPath
Specify the maximum
MaxEventsPerFile is
number
-auditMaxEventsPer
File
This section provides the command-line options that are specific to the Report
Application Server.
C:Program FilesCommon FilesBusiness Objects3.0 bincrys
talras.exe
INSTALL_ROOT/bobje/enterprise120/platform/ras/boe_crystalrasd
15 Report Application Server

Specify the port number
for receiving TCP/IP re-
quests when running in
stand-alone mode (out-
side of BusinessObjects
Enterprise).
port-ipport
see the BusinessOb-
trator's Guide.
absolutepath
-report_Proces
sExtPath

mask-ProcessAffinityMask
15 Report Application Server

Use a mask to specify
exactly which CPUs that
RAS will use when it
runs on a multi-proces-
sor machine.
The mask is in the for-
mat 0xffffffff, where
each f represents a
processor, and the list
of processors reads
from right to left (that is,
the last f represents
the first processor). For
each f, substitute either
0 (use of CPU not per-
mitted) or 1 (use of CPU
is permitted).
For example, if you run
the RAS on a 4 proces-
sor machine and want it
to use the 3rd and 4th
processor, use the mask
0x1100. To use the 2nd
and 3rd processor, use
0x0110.
Note:
• RAS uses the first
permitted processors
in the string, up to the
maximum specified by
your license. If you
have a two processor
license, 0x1110 has
the same effect as
0x0110.

The default value of
the mask is -1, which
has the same mean-
ing as 0x1111.
•
Specify the maximum
MaxEventsPerFile is
number
-auditMaxEventsPer
File
This section provides the command-line options that are specific to the Web
Intelligence Processing Server.
12.0win32_x86WIProcessingServer.exe
INSTALL_ROOT/bobje/enterprise120/platform/ras/boe_crystalrasd
15 Web Intelligence Processing Server

minutes before the
server will timeout.
minutes
-ConnectionTimeout
Minutes
Specify the maximum
number of simultaneous
connections that the
server allows at one
time.
number-MaxConnections
Enables caching of Web
Intelligence documents
when the document is
being viewed.
-DocExpressEnable
Enables real time
caching of Web Intelli-
gence documents.
-DocExpressRealTime
CachingEnable
Specify the amount of
time (in minutes) that
content is stored in
cache.
minutes
-DocExpressCache
DurationMinutes
Specify the size of the
document cache.
kilobytes
-DocExpressMaxCache
SizeKB
Enables the caching per
user sessions of lists of
values
-EnableListOfValues
Cache

Specify the maximum
number of values that
can be returned per list
of values batch.
number
-ListOfValuesBatch
Size
universes to be cached.
number
-UniverseMaxCache
Size
Specify the maximum
number of Web Intelli-
gence documents that
can be stored in cache.
number-WIDMaxCacheSize
This section provides the command-line options that are specific to the Input
and Output File Repository Servers.
The default paths to the servers on Windows are:
12.0win32_x86inputfileserver.exe
12.0win32_x86outputfileserver.exe
The default paths to the program that provides both servers on UNIX are:
INSTALL_ROOT/bobje/enterprise120/platform/boe_inputfilesd
INSTALL_ROOT/bobje/enterprise120/platform/boe_outputfilesd
15 Input and Output File Repository Servers

Set the root directory for
the various subfolders
and files that are man-
aged by the server. File
paths used to refer to
files in the File Reposito-
ry Server are interpreted
relative to this root direc-
tory.
Note:
All Input File Repository
Servers must share the
same root directory, and
all Output File Repository
Servers must share the
same root directory (oth-
erwise there is a risk of
having inconsistent in-
stances). Additionally, the
input root directory must
not be the same as the
output root directory. It is
recommended that you
replicate the root directo-
ries using a RAID array
or an alternative hard-
ware solution.
absolutepath-rootDir

Set the location of the
temporary directory that
the FRS uses to transfer
files. Use this command
line option if you want to
control the location of
the FRS temporary direc-
tory, or if the default
temporary directory
name generated by the
FRS exceeds the file
system path limit (which
will prevent the FRS
from starting).
Note:
Do not specify an exist-
ing directory for this op-
tion. The specified direc-
tory will be emptied
when the FRS starts,
and removed when the
FRS shuts down. If you
use an existing directo-
ry, it will be emptied and
removed.
absolutepath-tempDir
minutes after which an
idle session is cleaned
up.
minutes-maxidle
15 Input and Output File Repository Servers

Event Server
This section provides the command-line options that are specific to the Event
Server.
12.0win32_x86EventServer.exe
INSTALL_ROOT/bobje/enterprise120/platform/boe_eventsd
Specify the frequency
(in seconds) with which
the server checks for
File events.
seconds-poll
Specify the frequency
(in minutes) with which
the server cleans up lis-
tener proxies. The value
represents the amount
of time it takes to per-
form two cleanups. For
example, if you specify
a value of 10, the prox-
ies will be cleaned up
every 5 minutes.
minutes-cleanup
Event Server

Specify the maximum
MaxEventsPerFile is
number
-auditMaxEventsPer
File
15 Event Server

This section details each of the administrative tools and scripts that are
included with the UNIX distribution of BusinessObjects Enterprise. This
section is provided primarily for reference purposes. Concepts and
configuration procedures are discussed in more detail throughout this guide.
Script utilities
This section describes the administrative scripts that assist you in working
with BusinessObjects Enterprise on UNIX. The remainder of this help
discusses the concepts behind each of the tasks that you can perform with
these scripts. This reference section provides you the main command-line
options and their arguments.
ccm.sh
The ccm.sh script is installed to the bobje directory of your installation. This
script provides you with a command-line version of the CCM. This section
lists the command-line options and provides some examples.
Note:
• Arguments in square brackets [ ] are optional.
• If you are unsure of a Server Intelligence Agent's fully qualified name,
look at the Command properties in the ccm.config file, and use the value
that appears after the -nodename option.
• Arguments denoted by other authentication information are
provided in the second table.
DescriptionValid ArgumentsCCM Option
Display command-line
help.
n/a-help
UNIX Tools
16 Script utilities

Start each Server Intel-
ligence Agent as a pro-
cess. Use the short
form of the SIA name.
all or sianame-start
Stop each Server Intel-
ligence Agent by termi-
nating its Process ID.
Use the short form of
the SIA name.
all or sianame-stop
Stop each Server Intel-
ligence Agent by termi-
nating its Process ID;
then each SIA is start-
ed. Use the short form
of the SIA name.
all or sianame-restart
Start a server as a pro-
cess.
<fully qualified
server name>[other
authentication in-
formation]
-managedstart
Stop a server by termi-
nating its Process ID.
<fully qualified
server name>[other
authentication in-
formation]
-managedstop
Stop a server by termi-
nating its Process ID;
then start the server.
<fully qualified
server name>[other
authentication in-
formation]
-managedrestart
16UNIX Tools
Script utilities

Stops the server imme-
diately without complet-
ing current processing
requests.
<fully qualified
server name>[other
authentication in-
formation]
-managedforcetermi
nate
Enable a started server
so that it registers with
the system and starts
listening on the appro-
priate port. Use the ful-
ly qualified form of the
server name.
<fully qualified
server name>[oth-
er authentication
information]
-enable
Disable a server so
that it stops responding
to BusinessObjects
Enterprise requests but
remains started as a
process. Use the fully
qualified form of the
server name.
<fully qualified
server name>[oth-
er authentication
information]
-disable
UNIX Tools
16 Script utilities

Reports the server's
current status (enabled
or disabled). The CMS
must be running before
you can use this op-
tion.
[other authentica-
tion information]
-display
Update objects migrat-
ed from a previous ver-
sion of BusinessOb-
jects Enterprise into
your current CMS sys-
tem database. Use this
option after running
cmsdbsetup.sh.
[other authentica-
tion information]
-updateobjects
The following table describes the options that make up the argument denoted
by [other authentication information].
DescriptionValid argumentsAuthentication Option
Specify the CMS that
you want to log on to. If
not specified, the CCM
defaults to the local ma-
chine and the default
port (6400).
cmsname:port#-cms
16UNIX Tools
Script utilities

DescriptionValid argumentsAuthentication Option
Specify an account that
provides administrative
rights to BusinessOb-
jects Enterprise. If not
specified, the default
Administrator account is
attempted.
username-username
Specify the correspond-
ing password. If not
specified, a blank pass-
word is attempted.
Note:
To specify the -pass
word argument, you must
also specify the -user
name argument.
password-password
Specify the appropriate
authentication type for
the administrative ac-
count. If not specified,
secEnterprise is attempt-
ed.
secEnterprise, se
cLDAP
-authentication
The CCM reads the launch strings and other configuration values from the
ccm.config file. For details, see ccm.config on page 683.
UNIX Tools
16 Script utilities

Examples
These two commands start and enable all Server Intelligence Agents. The
Central Management Server (CMS) is started on the local machine and the
default port (6400):
ccm.sh -start all
ccm.sh -enable all
These two commands start and enable all the Server Intelligence Agents.
The CMS is started on port 6701, rather than on the default port:
ccm.sh -start all
ccm.sh -enable all -cms MACHINE01:6701
These two commands start and enable all the Server Intelligence Agents
with a specified administrative account named SysAdmin:
ccm.sh -start all
ccm.sh -enable all -cms MACHINE01:6701 -username SysAdmin -
password 35%bC5@5 -authentication LDAP
This single command logs on with a specified administrative account to
disable a Job Server that is running on a second machine:
ccm.sh -disable MACHINE02.businessobjects.com.reportserver -
cms MACHINE01:6701 -username SysAdmin -password 35%bC5@5 -au
thentication secLDAP
ccm.config
This configuration file defines the launch strings and other values that are
used by the CCM when you run its commands. This file is maintained by the
CCM itself, and by the other BusinessObjects Enterprise script utilities. You
typically edit this file only when you need to modify a Server Intelligence
Agent's command line. For details, see Command lines overview on page 650.
16UNIX Tools
Script utilities

cmsdbsetup.sh
The cmsdbsetup.sh script is installed to the bobje directory of your
installation. The script provides a text-based program that enables you to
configure the CMS database, CMS clusters, and to set up the audit database.
You can add a CMS to a cluster by selecting a new data source for its CMS
database. You can also delete and recreate (re-initialize) a CMS database,
copy data from another data source, or change the existing cluster name.
Note:
Before running this script, back up your current CMS database. Also be sure
to see Clustering Central Management Servers on page 211 for additional
information about CMS clusters and configuring the CMS database.
The script will prompt you for the name of your Server Intelligence Agent
(SIA). To check the name of your SIA, view the Command properties of the
SIA. The SIA's current name appears after the -nodename option.
For more information about configuring the CMS database or setting up the
auditing database, see Managing Auditing on page 571.
configpatch.sh
The configpatch.sh script is installed to the bobje/enterprise/generic
directory of your installation. Use the configpatch.sh script when installing
patches that require updates to system configuration values. After installing
the patch, run configpatch.shwith the appropriate .cffile name as an
argument. The readme.txt file that accompanies BusinessObjects Enterprise
patches tells you when to run configpatch.sh, and the name of the .cf
file to use.
serverconfig.sh
The serverconfig.sh script is installed to the bobje directory of your
installation. This script provides a text-based program that enables you to
view server information and to add and delete servers from your installation.
UNIX Tools
16 Script utilities

This script adds, deletes, modifies, and lists information from the ccm.config
file.
When you modify a server using serverconfig.sh, you can change the
location of its temporary files. For the Central Management Server, you can
change its port number or enable auditing. For the Input File Repository
Server or the Output File Repository Server, you can enter the root directory.
To add/delete/modify/list UNIX servers
1. Go to the bobje directory of your installation.
2. Issue the following command:
./serverconfig.sh
The script prompts you with a list of options:
• 1 - Add a Server Intelligence Agent
• 2 - Delete a Server Intelligence Agent
• 3 - Modify a Server Intelligence Agent
• 4 - List all Server Intelligence Agent in the config file
3. Type the number that corresponds to the action you want to perform.
4. If you are adding, deleting, or modifying a server, provide the script with
any additional information that it requests.
Tip:
The script will prompt you for the name of your CMS. By default, the CMS
name is hostname.cms. That is, the default name of a CMS installed on
a machine called MACHINE01 is MACHINE01.cms. However, in this
script you can enter hostname to check the name of your CMS (or any
other server), view the contents of ccm.config, and look for the server's
launch string. The server's current name appears after the -name option.
5. Once you have added or modified a server, use the CCM to ensure that
the server is both started and enabled.
For more information about working with servers, see Server management
16UNIX Tools
Script utilities

uninstallBOBJE.sh
The uninstallBOBJE.sh script is installed to the bobje directory of your
installation. This script deletes all of the files installed during your original
installation of BusinessObjects Enterprise by running the scripts in the bob
je/uninstall directory. Do not run the scripts in the uninstall directory
yourself: each of these scripts removes only the files associated with a single
BusinessObjects Enterprise component, which may leave your
BusinessObjects Enterprise system in an indeterminate state.
Before running this script, you must disable and stop all of the
Note:
• The uninstallBOBJE.sh script will not remove files created during the
installation process, or files created by the system or by users after
installation. To remove these files, after running installBOBJE.sh,
perform an rm -rf command on the bobje directory.
• If you performed the "system" installation type, you will also need to delete
the run control scripts from the appropriate /etc/rc# directories.
Script templates
These scripts are provided primarily as templates upon which you can base
your own automation scripts.
startservers
The startservers script is installed to the bobje directory of your installation.
This script can be used as a template for your own scripts: it is provided as
an example to show how you could set up your own script that starts the
BusinessObjects Enterprise servers by running a series of CCM commands.
For details on writing CCM commands for your servers, see ccm.sh on
page 678.
UNIX Tools
16 Script templates

stopservers
The stopservers script is installed to the bobje directory of your installation.
This script can be used as a template for your own scripts: it is provided as
an example to show how you could set up your own script that stops the
BusinessObjects Enterprise servers by running a series of CCM commands.
For details on writing CCM commands for your servers, see ccm.sh on
page 678.
silentinstall.sh
The silentinstall.sh script is installed to the bobje directory of your
installation. Once you have set up BusinessObjects Enterprise on one
machine, you can use this template to create your own scripts that install
BusinessObjects Enterprise automatically on other machines. Essentially,
once you have edited the silentinstall.sh template accordingly, it defines
the required environment variables, runs the installation and setup scripts,
and sets up BusinessObjects Enterprise according to your specifications,
without requiring any further input.
The silent installation is particularly useful when you need to perform multiple
installations and do not want to interrupt people who are currently working
on machines in your system. You can also use the silent installation script
in your own scripts. For example, if your organization uses scripts to install
software on machines, you can add the silent BusinessObjects Enterprise
installation command to your scripts.
For information about script parameters, see the comments in the
silentinstall.sh script.
Note:
• Because the silentinstall.sh file is installed with BusinessObjects
Enterprise, you cannot install silently the first time you install
• The silent installation is not recommended if you need to perform custom
installations. The installation options are simplified and do not allow for
the same level of customization provided in the BusinessObjects
Enterprise install script.
16UNIX Tools
Script templates

Scripts used by BusinessObjects
Enterprise
These secondary scripts are often run in the background when you run the
main BusinessObjects Enterprise script utilities. You need not run these
scripts yourself.
bobjerestart.sh
This script is run internally by the CCM when it starts the BusinessObjects
Enterprise server components. If a server process ends abruptly without
returning its normal exit code, this script automatically restarts a new server
process in its place. Do not run this script yourself.
env.sh
The env.sh script is installed to the bobje directory of your installation. This
script sets up the BusinessObjects Enterprise environment variables that
are required by some of the other scripts. BusinessObjects Enterprise scripts
run env.sh as required. When you install BusinessObjects Enterprise on
UNIX, you must configure your Java application server to source this script
on startup. See the BusinessObjects Enterprise Installation Guide for more
details.
env-locale.sh
The env-locale.sh script is used for converting the script language strings
between different types of encoding (for example, UTF8 or EUC or Shift-JIS).
This script is run by env.sh as needed.
UNIX Tools
16 Scripts used by BusinessObjects Enterprise

initlaunch.sh
The initlaunch.sh script runs env.sh to set up the BusinessObjects
Enterprise environment variables, and then runs any command that you have
added as a command-line argument for the script. This script is intended
primarily for use as a debugging tool by Business Objects SA.
patchlevel.sh
The patchlevel.sh is installed to the bobje/enterprise/generic directory
of your installation. This script reports on the patch level of your UNIX
distribution. This script is intended primarily for use by Business Objects SA
support staff.
DescriptionValid ArgumentsOption
List all the installed
patches.
n/alist
Query the operating
system for the presence
of a particular patch by
numeric ID.
patch #query
Check that all the
patches listed in
textfile are installed
on your operating sys-
tem.
textfilecheck
16UNIX Tools
Scripts used by BusinessObjects Enterprise

postinstall.sh
The postinstall.sh script is installed to the bobje directory of your
installation. This script runs automatically at the end of the installation script
and launches the setup.sh script. You need not run this script yourself.
setup.sh
The setup.sh script is installed to the bobje directory of your installation.
This script provides a text-based program that allows you to set up your
BusinessObjects Enterprise installation. This script is run automatically when
you install BusinessObjects Enterprise. It prompts you for the information
that is required in order to set up BusinessObjects Enterprise for the first
time.
For complete details on responding to the setup script when you install
BusinessObjects Enterprise, see the BusinessObjects Enterprise Installation
Guide.
setupinit.sh
The setupinit.sh script is installed to the bobje directory of your installation
when you perform a system installation. This script copies the run control
scripts to your rc# directories for automated startup. When you run a system
installation you are directed to run this script after the setup.sh script
completes.
Note:
You must have root privileges to run this script.
UNIX Tools
16 Scripts used by BusinessObjects Enterprise

Working with the Central
Management Console
17

Overview
This section provides a general description of system administration as it
relates to BusinessObjects Enterprise. It then introduces the administration
tools that allow you to manage and configure BusinessObjects Enterprise,
and it shows how to make some common changes to the system's default
security settings.
Using the CMC
The Central Management Console (CMC) is a web-based tool which offers
a single interface through which you can perform almost every day-to-day
administrative task, including user management, content management, and
server management.
Any user with valid credentials to BusinessObjects Enterprise can log on to
the CMC and set his or her preferences. However, users who are not
members of the Administrators group cannot perform any of the available
management tasks unless they have been granted rights to do so.
Working with the Central Management Console
17 Overview

Related Topics
• How rights work in BusinessObjects Enterprise on page 700
Logging on to the CMC
There are two ways to access the CMC: type the name of the machine you
are accessing directly into your browser, or select BusinessObjects
Enterprise Central Management Console from the program group on the
Windows Start menu.
When you have finished using the CMC, end the session by logging off. The
Log Out button is located in the upper-right corner of the console.
To log on to the CMC from your browser
1. Type the appropriate URL:
• Go to the following page: http://webserver:8080/CmcApp/
Replace webserver with the name of the web server machine. If you
changed this default virtual directory on the web server, you will need to
type your URL accordingly. If necessary, change the default port number
to the number you provided when you installed BusinessObjects
Enterprise.
Tip:
On Windows, you can click Start > Programs > BusinessObjects XI
3.1 > BusinessObjects Enterprise > BusinessObjects Enterprise
Central Management Console.
If your CMC is hosted on a Web Application Container Server (WACS),
you can click Start > Programs > BusinessObjects XI 3.1 >
BusinessObjects Enterprise > Central Management Console on
WACS.
2. Type the name of your Central Management Server (CMS) in the System
field.
3. Type your user name and password.
If you're using LDAP or Windows NT authentication, you may log on using
an account that has been mapped to the BusinessObjects Enterprise
Administrators group.
17Working with the Central Management Console
Using the CMC

Note:
If this is the first time an administrator from your organization is accessing
the CMC, type Administrator as the user name. This default Enterprise
account does not have a password until you create one.
4. Select Enterprise in the Authentication Type list.
Windows AD, Windows NT and LDAP authentication also appear in the
list; however, third-party user accounts and groups must be mapped to
BusinessObjects Enterprise before you can use these types of
authentication.
5. Click Log On.
The CMC Home page appears.
Related Topics
• Setting the Administrator password on page 697
Navigating within the CMC
Because the CMC is a web-based application, you can navigate through it
in a number of ways:
• Click the links on the Home page or tabs on the left of your screen to go
to specific management areas.
• Select the same management areas from the Navigation list.
Note:
When you are navigating among objects that have many child objects, there
may be too many children to display in the tree view. When this happens,
you can use the paginated object listing to navigate to the child objects with
which you are concerned.
Setting CMC preferences
The "Preferences" area of the CMC allows you to customize your
administrative view of BusinessObjects Enterprise.
17 Using the CMC

To set the console preference
1. Log on to the CMC and click Preferences in the upper-right corner of the
CMC.
2. Set the preference as required.
The Web Intelligence, Desktop Intelligence, Crystal Reports, Dashboard
and Analytics, and Change Password preferences work exactly the way
they do in InfoView, though they affect the behavior of objects in the CMC
as well. For a full explanation of those settings, refer to “Setting
Preferences” in the BusinessObjects Enterprise InfoView User's Guide.
3. Click OK.
Related Topics
• CMC Preference options on page 695
CMC Preference options
ExplanationCMC Preference option
This list sets the default language options
for BusinessObjects Enterprise. See the
BusinessObjects Enterprise Deployment
and Configuration Guide for more informa-
tion.
Product Locale
This list sets the default formatting options
for date, time, and numbers in the CMC.
Preferred Viewing Locale
17Working with the Central Management Console
Using the CMC

ExplanationCMC Preference option
This option limits the number of objects
listed on any page or tab in the CMC.
Note:
This setting does not limit the number of
objects displayed, simply the number dis-
played per page.
Maximum number of objects
per page
If you are managing BusinessObjects
Enterprise remotely, use this list to specify
your time zone. BusinessObjects Enter-
prise synchronizes scheduling patterns
and events appropriately. For instance, if
you select Eastern Time (US & Canada),
and you schedule a report to run at 5:00
a.m. every day on a server that is located
in San Francisco, then the server will run
the report at 2:00 a.m. Pacific Time.
Time Zone
This setting controls whether you are
prompted for confirmation when you close
a dialog box without saving your work by
clicking Cancel or by clicking the close
button in the top right-hand corner. You
have the following options:
• On: The prompt behavior is enabled.
• Off: The prompt behavior is disabled.
• Default: The prompt behavior is deter-
mined by settings configured in the
web.xml file that is located in C:Pro-
gram FilesBusiness ObjectsTom-
cat55webappsCmcAppWEB-INF.
Prompt for Unsaved Data
17 Using the CMC

Making initial security settings
Before you publish content or provide users with access to BusinessObjects
Enterprise, the default system settings should be changed. This section
provides procedures for setting the Administrator password, disabling a user
account, and modifying the default security level.
Related Topics
• How rights work in BusinessObjects Enterprise on page 700
Setting the Administrator password
As part of the installation, BusinessObjects Enterprise creates an
Administrator account and a Guest account that do not have passwords.
Use the following procedure to create a secure password for the Administrator
account.
Note:
Do not create a password for the Guest account if you plan to use the
anonymous single sign-on or the Sign Up features av

Xi3 1 bip-admin_en

More Related Content

What's hot (20)

Viewers also liked (9)

Similar to Xi3 1 bip-admin_en (20)

Recently uploaded (20)

Xi3 1 bip-admin_en