SAP Knowledge Base Article

Symptom

l This setting should be considered a Best Practice for all multi domain and multiple forest environments l Mapping a group from another domain is successful but fails to authenticate a user from this domain, and the following error message appears: l "The Active Directory Authentication plug in could not authenticate at this time. Please try again. If the problem persists, please contact your system administrator? l Unable to map groups from 1 or more domains l Unable to map groups from 1 or more AD forests in XI 3.1 l Intermittent problems with active directory l Users are not showing proper group membership (view user groups shows only everyone or less than the total groups the user belongs to in AD) l Any suspected DNS issues with the AD plugin l CMS logs show errors binding to a domain controller (s)

Reproducing the Issue

Issue can occur in ce8 - BI 4.x when Active Directory authentication is being used.

 

Cause

l The Central Management Server (CMS) is not able to bind to the domain controller without using using FQDN. l The CMS has 2 options for domain resolution, via hostname (default), or FQDN (using this solution)

More Information

l This boolean key determines whether the Active Directory (AD) Authentication plug in binds to servers (both Global Catalogs and Domain Controllers) by using the FQDN (Fully Qualified Domain Name) or the "short" netbios name.

l For example, if set to 'True', it might bind to a GC using the name "vanaddc02.crystald.net". If 'False' though, it would bind using the short name "vanaddc02". This is necessary as some valid AD environments will result in slow DNS queries if the FQDN is not used.

Resolution

WARNING: The following resolution involves editing the registry. Using the Registry Editor incorrectly can cause serious problems that may require you to reinstall the Microsoft Windows operating system.

Use the Registry Editor at your own risk. It is strongly recommended that you make a backup copy of the registry files before you edit the registry. For information on how to edit the registry key, view the 'Changing Keys And Values' online Help topic in the Registry Editor (Regedit.exe).

Refer to Note 1323322 for more information.

 

1. Create the following registry String Value on the CMS machine:

XIR2

HKEY_LOCAL_MACHINE\SOFTWARE\Business Objects\Suite 11.5\Enterprise\Auth Plugins\secWinAD\UseFQDNForDirectoryServers

XIR3

HKEY_LOCAL_MACHINE\SOFTWARE\Business Objects\Suite 12.0\Enterprise\Auth Plugins\secWinAD\UseFQDNForDirectoryServers

64-bit - HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Business Objects\Suite 12.0\Enterprise\Auth Plugins\secWinAD\UseFQDNForDirectoryServers

2. Set it's value to 'True' then restart the CMS/SIA for the change to take effect.

XI4

HKEY_LOCAL_MACHINE\SOFTWARE\SAP BusinessObjects\Suite XI 4.0\Enterprise\Auth Plugins\secWinAD\UseFQDNForDirectoryServers

2. Set it's value to 'True' then restart the CMS/SIA for the change to take effect.

To NOTE:

l This key does not exist by default. If it is not set, the AD Authentication plugin assumes a value of 'false' (0). l To ensure your key is working ensure you see something similar to the following in the CMS trace logs:

¡ WINAD: ADRegistry::ReadKeys() -- Reading secWinAD/UseFQDNForDirectoryServers ¡ WINAD: ADRegistry::ToBoolean() -- Parsed True as true.

    1199995 - Error: "The Active Directory Authentication plug in could not authenticate at this time" (FQDN registry key)

Version   11     Validity: 04.12.2013 - active   Language   English

Keywords

multiple domain, transitive domain , 4096226, second domain, non default domain, non-default use fqdn registry key AD windows active directory

Header Data

Product

Released On 04.12.2013 00:37:16

Release Status Released to Customer

Component BI-BIP-AUT Authentication, ActiveDirectory, LDAP, SSO, Vintela

Priority Normal

Category Problem

Product Product Version

SAP BusinessObjects Business Intelligence platform BOBJ ENTERPRISE XI R2

SAP BusinessObjects Business Intelligence platform 4.0

SAP BusinessObjects Business Intelligence platform 4.0, feature

SAP BusinessObjects Enterprise XI 3.0

SAP BusinessObjects Enterprise XI 3.1