locked
Login required when printing (ProClarity Professional) RRS feed

  • Question

  • Hi. When I print a view with ProClarity Professional I'm asked for credentials again. This doesn't happen with ProClarity Standard.

     

    Does anybody know why?

     

    Thanks!

    Friday, February 15, 2008 11:02 AM

Answers

  • Hi Daniel,

     

    Are you running SSAS over HTTP?  Also, what version of ProClarity professional are you running?

     

    Friday, February 15, 2008 4:06 PM
  • Daniel, thanks for the additional information.  When ProClarity professional goes to print it spins up another instance of the PageCtrl function which makes an additional connection to the cube.  Basically if you're required to enter an extra set of credentials to initially connect to the cube you might see another prompt when printing because a second connection is being made.  I noticed you have a couple of threads open and Raul has a couple of threads open as well dealing with prompts for credentials in ProClarity standard and professional.  Can you provide some additional information on how your environment is setup and how users are authenticating to the msdmpump.dll?

    • Is the olap directory in IIS set to only basic authentication? 
    • Do you have users that connect from the internet and from within the local intranet?  Do the remote and local users see the extra prompt for credentials when printing?
    • Are there any proxy servers configured in IE?  If present, what happens when the proxy is bypassed?
    • Is the URL for PAS added to the local intranet or trusted sites in Internet Explorer, and is the user authentication for the Local Intranet zone set to automatic logon?

    Thanks,

     

    Sean

    Tuesday, February 19, 2008 10:21 PM

All replies

  • Hi Daniel,

     

    Are you running SSAS over HTTP?  Also, what version of ProClarity professional are you running?

     

    Friday, February 15, 2008 4:06 PM
  • Yes, I'm running SSAS over HTTP and I use ProClarity Professional 6.3.2211.127.

     

    Regards

    Monday, February 18, 2008 8:26 AM
  • Daniel, thanks for the additional information.  When ProClarity professional goes to print it spins up another instance of the PageCtrl function which makes an additional connection to the cube.  Basically if you're required to enter an extra set of credentials to initially connect to the cube you might see another prompt when printing because a second connection is being made.  I noticed you have a couple of threads open and Raul has a couple of threads open as well dealing with prompts for credentials in ProClarity standard and professional.  Can you provide some additional information on how your environment is setup and how users are authenticating to the msdmpump.dll?

    • Is the olap directory in IIS set to only basic authentication? 
    • Do you have users that connect from the internet and from within the local intranet?  Do the remote and local users see the extra prompt for credentials when printing?
    • Are there any proxy servers configured in IE?  If present, what happens when the proxy is bypassed?
    • Is the URL for PAS added to the local intranet or trusted sites in Internet Explorer, and is the user authentication for the Local Intranet zone set to automatic logon?

    Thanks,

     

    Sean

    Tuesday, February 19, 2008 10:21 PM
  • Hi Sean. Here is the information required:

     

    1. PAS directory is set to basic and integrated authentication.

    2. Users only connect from local intranet. They see the the extra prompt when printing.

    3. I guess there is a proxy server, but I'm not sure. I'll find it out.

    4. PAS URL is not added to local intranet or trusted sites.

     

    Thanks!

     

    Wednesday, February 20, 2008 12:03 PM
  • Hi. Let me describe the problem more accurately:

     

    Users enter to a login web page. They introduce user name and password and press "Enter" button. Those credentials are searched in a table with 4 fields: USER_PAS, PASS_PAS, USER_WINDOWS and PASS_WINDOWS.

     

    This authentication mechanism has 2 purposes: first, users do not have to introduce their windows user and password (windows password is really difficult to introduce because it usually includes numbers, capital letters and other characters). Second, several users can introduce the same user.

     

    The application translates the credentials introduced at login web page into windows credentials (using the matching table mentioned above), and this information is passed to PAS web page.

     

    The problem is that if users are asked again for credentials when they print they have to introduce windows credentials, and these are different to the previous ones!!!

     

    I hope this information helps you to help me  :-)

     

    Thanks!

    Wednesday, February 20, 2008 3:43 PM
  •  

    Hi Daniel,  Thanks for the additional info - that helps to paint a better picture of your authentication environment.  My understanding is the PAS views are all pointing to the HTTP access virtual directory cubes via “http://MyMachine/olap/msmdpump.dll”.  If this is not correct please let me know.

     

    When you launch a view in professional, the PAS server is removed from the picture as a direct connection is established between the professional client and the OLAP server.  Without completely understanding your application, when you go to print from the professional client a new connection is made to the cube.  This new connection is usually transparent however if the correct credentials are not sent with the print request, or the data source is prompting for credentials, a login prompt will appear to authenticate for cube data retrieval.

     

    ·         Do the users see an extra prompt from ProClarity when they bypass the authentication application and make a connection from their workstation directly to PAS using only windows credentials and from there to professional and attempt to print?

    ·         The extra prompt is only appearing from the Professional client and not when printing from standard, is this right?

    ·         If you are using SSAS over HTTP, what is the directory security set to for the website containing msdmpump.dll?

    ·         Does the extra login prompt happen when printing to both network and local printers?

    ·         What is the reasoning behind using SSAS over HTTP?  If a direct connection to SSAS is used in the views, does this problem occur?  If all users are on the local intranet have you considered SSO with Kerberos?

     

    -Sean

    Wednesday, February 20, 2008 5:01 PM
  • Hi Sean.

     

    First of all, PAS machine and SSAS machine are the same machine. I have seen in Books table that ServerName field for all views is http://observatorio.centro-operaciones.com/pas/, and msmdpump.dll is in that directory.

     

    1. I don't know why (I'm working on it) users cannot bypass the autentication application.

    2. Extra prompt only appears from the professional client.

    3. msmdpump.dll is in PAS directory. PAS has basic authentication and integrated authentication.

    4. There are no local printers.

    5. How can I use a direct connection to SSAS? What is "SSO with kerberos"?

     

    Thanks for your help. Best regards

     

    Monday, February 25, 2008 9:12 AM
  • Additional information regarding item 1: users can bypass the authentication application only if the site is added to trusted sites list.

     

    Regards.

    Monday, February 25, 2008 3:51 PM
  • If your views are using SSAS over HTTP then the connection string for the view would point to something like ‘http://MyMachine/olap/msmdpump.dll’.  You can check the view properties by looking in the PAS database bookelements table, or from the professional client Analytics Server>Manage Books, then right click on a view>properties>Connection Info tab, Server field. 

     

    The only thing I can think of that’s causing all of the authentication issues in your environment is the custom app you have deployed for tying separate logins to domain accounts.  Printing from ProClarity professional will spin up another instance of the PageCtrl function which will initiate another connection to the cube.  That additional connection to the cube is probably why you’re seeing the extra login prompt.  The exact reason as to why this is happening, most likely, lies somewhere between ProClarity and the underlying authentication structure which is a custom application.

     

    The most common authentication structure that companies use is SSO (Sing Sign On) using Kerberos.  When configured this allows a user to connect to the PAS website, SSAS cubes, etc using their Active Directory windows credentials which they entered when logging onto the workstation.  This allows a user to access everything without having to re-enter their credentials.  Kerberos configuration comes into play when your OLAP cubes are separated from ProClarity and the credentials have to be passed from one server to another without prompting for credentials.

     

    The complexity of your authentication environment makes the problem difficult to identify and troubleshoot on a medium such as the forums.  I’d recommend opening a support case however any custom authentication implementations would not be support by Microsoft so we’d most likely need to bypass that application.  I would suggest focusing your troubleshooting efforts on the custom application you’re using for authentication… try removing it from the picture and see if the same problems occur.

     

    Hope this helps
    Monday, February 25, 2008 4:34 PM
  • Hi Sean. Thanks for your your effort.

     

    First of all, login application is out of the picture because I have loaded http://observatorio.centro-operaciones.com/pas/ES/src/Proclarity.asp, I have introduced the credentials and when I have printed I have been asked for credentials again.

     

    Concerning to "msmdpump.dll" file, I have copied that file to "C:\Inetpub\wwwroot\PAS" directory and I have not done anything else. Is there anything else to do? Maybe I have to configure aditional parameters in other file o files?

     

    I have set http://observatorio.centro-operaciones.com/pas/msmdpump.dll as ServerName in BookElements table for all records (views). After that I'm asked for credentials when I open a view and I cannot open it after introducing the credentials.

     

    At the moment we are not using SSO. Perhaps I have to configure Kerberos, but I don't know how to do this.

     

    Could you help me?

    Friday, February 29, 2008 8:53 AM
  • If the SSAS cubes and PAS are on the same machine you shouldn't need to configure Kerberos to delegate the credentials.  If the bookelements table has the ServerName field for views as http://MyMachine/... as the server then that definitely indicates it's configured for SSAS over HTTP however generally the file msmdpump.dll is included at the end of the URL: http://www.microsoft.com/technet/prodtechnol/sql/2005/httpasws.mspx

     

    A couple of things to try - if your SSAS cubes are on the server 'observatorio' what happens if you change the server name of a view to that?  So instead of 'http://observatorio.centro-operaciones.com/pas/msmdpump.dll' have just 'observatorio' and see if that works.  That should connect directly to SSAS instead of SSAS over HTTP.  Is this possible to test?  I am curious to know if you see an extra login prompt when printing when the ServerName field of a view is not configured for an http connection.  Another option is from the professional client to click File>Open Cube, then for the Server change that to the actual server name instead of the web address.

     

    hth

    Tuesday, March 4, 2008 2:31 PM
  • Hello Daniel,

     

    In regards to the inquiry about configuring the msmdpump.dll; there is more the configuration than merely copying the pump file to a virtual directory.  The setup instructions are here:

     

    http://www.microsoft.com/technet/prodtechnol/sql/2005/httpasws.mspx

     

    I suggest walking through those guidelines to ensure you've comleted every step and then test again.  Also, it sounds as if your users are accessing your briefing books from outside the firewall.  If this is correct, you may be able to connect by following all three steps listed below (given that the msmdpump.dll is configured correctly).  


    1) Enable HTTP Connectivity for the OLAP Server.
    http://www.microsoft.com/technet/prodtechnol/sql/2005/httpssas.mspx

    2) Update existing briefing books, using ProClarity's Update Connection
    Information Wizard, to show the following:

    SERVERNAME = http://ServerName.com/olap/msmdpump.dll and LOCAL SERVER NAME =
    blank value

    3) Create Servermaps within the ProClarity_PAS database (ProClarity_PAS is the
    default database name) / ServerMaps table.

    LOCAL SERVER NAME = OLAP Machine Name
    and
    SERVER NAME = http://ServerName.com/olap/msmdpump.dll

     

    However, being that you're running a custom security application I cannot speculate as to how your app will handle the pump / extranet configuration.  You might look into hiring a Microsoft Consultant to assist with the custom application.  ProClarity support will ask you to back out any and all customizations / security implementations, and test the http pump with the out-of-the-box ProClarity installation using only the supported Microsoft authentication methods (Basic or Integrated for PAS).  If everything works as expected upon doing so you can focus your efforts within your custom security application. 

     

    Hope this helps. Please post any further inquiries to the forum and we'll see if we can assist.

     

    Thanks,

    Amanda

     

    Tuesday, May 20, 2008 3:57 PM