KB19068: How to setup warehouse authentication against SAP BW data source?

INTRODUCTION
Starting with Strategy 8.1.2, it is possible to use SAP user credentials to log into a Strategy project connected to a SAP BI OLAP cube source. 
 
This is achieved by importing SAP BI users and SAP BI roles into Strategy as users and groups, respectively. Once the users and groups are imported, privileges can then be granted in the same way as for any Strategy user or group.
 
However, as in LDAP user management, imported SAP BI users are granted group privileges at runtime. This means when a user attempts to perform a task that requires a privilege, it is at this time that the group membership is checked and privileges are granted. This can be seen in the User Editor where a Strategy user (linked with a SAP user) is not shown as member of the group nor do they list any privileges they inherit from its Strategy groups (linked to SAP roles).
Note: SAP users and roles are imported into Strategy when a user logs in to a Strategy project with their SAP username and password.
 
PREREQUISITES
The following are a set of authorizations required for this feature:

• DISPLAY authorization for S_USER_GRP authentication object
  
• RFC authorization for S_AUTH_TOOL_2 function group
  
• RFC authorization for SU_USER function group
  
• Authorizations outlined in KB16131(KB5700-80x-3188): Minimum Set of Authorizations to connect MicroStratetgy to SAP BW.
  

Steps to import SAP BI users and roles into Strategy as users and groups:

1. Establish a connection between Strategy and the SAP BI. Refer to the following Strategy Knowledge Base technical notes for more information:
    
   
2. KB11063: How to set up SAP connectivity with the MicroStrategy Intelligence Server 9.x on Windows, using JCo 2.x connector files.
   KB38435: How to setup SAP BW connectivity with MicroStrategy Intelligence Server 9.4.x - 10.x running on Windows, using JCo 3.x connectors.
   

 
As a result of performing this step, users will have a database instance connected to an SAP BI OLAP cube source.
 
As a result of establishing all the above, when a SAP user logs into a Strategy project, that user is shown under the Warehouse Users group as seen below:
 

 
Now that these users and groups are created in Strategy, they can be granted additional privileges within Strategy.
 

• Define the SAP database instance as the authentication database. To use SAP user credentials to log in to a Strategy project, the SAP BI cube source must be defined as an authentication database for the project. This SAP BI source will serve as a storage location for users and their respective credentials. Steps on how to set this up are below:
   
  
• In Strategy Developer, log in to a project source with a project connected to a SAP BW cube source.
• From the Folder List, right-click a project and select Project Configuration. The Project Configuration Editor opens.
• From the Categories list, expand Database instances > Authentication > Metadata. From the Authentication database instance drop-down list, select the database instance that connects to the SAP BW cube source as seen below:
  
  

• Click OK to save your changes and close the Project Configuration Editor.
• Grant SAP BW users access to Strategy Developer and Web. For an SAP BW user to log in to a Strategy project, they must have the Use Developeror Web user privilege to the Public/Guest group. However, these permissions are only to log into the project and not to access the project. Additional permissions can be granted at a later time. Steps on how to grant the minimum privileges are shown below:
   
  
• In Strategy Developer, log in to a project source using an account with administrative privileges.
• Create a security role with only Use Developer and Web user privileges selected. For details on how to create a security role, refer to the following Strategy Knowledge Base technical note:
  KB18040: How to create a security role in MicroStrategy Developer10.x
  
• It is time to assign the security role created in the above step. Under the Folder List, expand Administration, and then expand User Manager.
• Right-click the Public/Guest group, and select Edit. The Group Editor opens.
• Select the Project Access tab.
• In the Security Role Selection line at the top, click the drop-down list for the project connected to an SAP BI OLAP cube source, and select Use Developer and Web user + Inherited Access as seen below:
  

• Click OK to save the changes and close the Group Editor.
• Select the SAP BI user and role import options. SAP BI users and roles are imported into Strategy when a user logs in to a Strategy project with their SAP BI user name and password. Different options are available to the user to import SAP BI users and roles as seen in the Strategy Intelligence Server Configuration Editor below:
  

• Import users: A user with the same SAP BI user name is created in Strategy. This user is created within the Warehouse Users group.
• Search for groups: The Strategy groups assigned to a Strategy user are synchronized with the SAP roles assigned to the SAP user. This means that if SAP roles have been added or removed for an SAP user, the associated Strategy user is added or removed from the Strategy groups that represent the SAP roles.
• Import groups: All SAP roles (that the SAP user is a member of) are imported as groups in Strategy. These groups are created within the Warehouse Users group and only have inherited privileges of the Warehouse Users group.
• Define the project source to use database authentication to authenticate users based on SAP BI user credentials. Defining database authentication for a project source makes database authentication available for the projects within the project source. Following are the steps to define the project source to use database authentication depending on whether users are logging in to Strategy projects through Strategy Developer or Web:
   
  IN Strategy DEVELOPER:
   
  
• In Strategy Developer, log in to a project source using an account with administrative privileges.
• Right-click the project source and select Modify Project Source. The Project Source Manager opens.
• Select the Advanced tab.In the Authentication mode area, select Use login id and password entered by the user for Warehouse (database authentication) as seen below:
  

• Click OK to save the changes.
•  
  IN Strategy WEB:
   
  
• From the Windows Start menu, point to Programs, then Strategy, then Web, and then select Web Administrator. The Administrator Page for Strategy Web opens in a web browser.
• On the left side of the page, in the Intelligence Servers list, click Default Properties. The Default Server Properties page opens.
• In the Login area, to the left of the Database Authentication login mode, select the Enabled check box.
• To enable database authentication as the default mode of authentication used to log in to Strategy project, select the Default option.
• At the bottom of the page, click Save to save the changes.