• You must use the JRockit 1.6 instead of the standard JDK 1.6
• When you create the Keytab File, you must use KTPASS command line (like Linux) setting Key Version Number (kvno option) to 0. For Windows Server 2003 the ktpass command is in the Windows Server 2003 Support Tools.
• Redeploy the application Analyticts application following the Support Note 1286864.1.
  One other way you can manually deploy the weblogic.xml and web.xml files.

Configure OBIEE to use Jrockit

• In the file setDomainEnv.cmd (located in the %MW_HOME%\user_projects\domains\bifoundation_domain\bin directory) adding the following line:
  set JAVA_VENDOR=Oracle
• Restart the applications
   

Configure Active directory as User Store

• Login in the Weblogic Console in
• Click Lock & Edit
• Go in Security Realm->"myrealm"->Providers->Authentication
• Crate a new Authenticator Provider

• For the new provider

• Edit the DefaultAuthenticator

• Click Activate Changes
   
• Restart Weblogic and verify your configuration: in Secutity Realm->"myrealm"->"User and Gorups" you can see AD users an groups
• Reset the OBIEE System User using a new domain user:
  - Create a new AD user (Ex: AdBiSystemUser)
  - Login in 'Enterprise manager    
  - Go inWeblogic Domain-> bifoundation_domain->(left mouse button) Security->Application Roles    
  - In "Application Stripe to Search" select "odi" and click the "play" button
     - Click BiSystem role   
     - Click "Add User"
     - Add the newly created user
     - Click “Ok”
  
  

• Login into Weblogic Admin Console
• Go in Security Realm->"myrealm"->"Roles and Policies"->"Realm roles"
• Select "Global Roels"->"Admin" and click "View Roles Condition"
• Click “Add Condition”->”User” and add the Add the newly created user  
• Restart all
  
  

Configure Windows SSO with Kerberos

• Create new AD account to use as Kerberos Principal (Ex:.obieessouser)
• Modify the account properties:
  - Set "Use DES Encryption types for this account"
  - "Do not require Kerberos pre-authentication" must be unchecked
• Create the Service Principal Names (SPN) associate to this account:
  The SPN must be the following:
  HTTP/<Fully qualified name of OBIEE server>
  HTTP/<Hostname of OBIEE server>

• The SPN must be created with setspn command in a Domain Server.
  For example:
  setspn.exe -A HTTP/OBIEE2003.anfa.com obissouser
  setspn.exe -A HTTP/OBIEE2003 obissouser

[libdefaults]
default_realm = <Your Kerberos realm – remember all caps> 
default_tkt_enctypes = des-cbc-crc
default_tgs_enctypes = des-cbc-crc
ticket_lifetime = 600

[realms]
<Your Kerberos realm – remember all caps> = {
kdc = <IP address of the KDC/AD server>
admin_server = <host name of the KDC/AD server>
default_domain = <Windows domain name in caps>
}

[domain_realm]
.<DNS domain name suffix, starting with .> = <Your Kerberos realm – remember all caps>

[appdefaults]
autologin = true
forward = true
forwardable = true
encrypt = true

• Create the  keytab file in the %MW_HOME%/user_projects\domains\bifoundation_domain directory

ktpass.exe -princ <account-name>@<REALM-NAME> -mapuser <account-name> 
-pass <account-password> -crypto DES-CBC-CRC -ptype KRB5_NT_PRINCIPAL 
-out %MW_HOME%\user_projects\domains\bifoundation_domain\<Keytab file> -kvno 0

    - Verify the configuration with the kinit command(see the Oracle Whitepaper):

kinit.exe -k -t %MW_HOME%\user_projects\domains\bifoundation_domain\<Keytab File> 
<account-name>

com.sun.security.jgss.krb5.accept {    
    com.sun.security.auth.module.Krb5LoginModule required       
    principal="<Service principal account>@<Kerberos realm>"
    keyTab=<Name of the keytab file we created, relative to Weblogic domain directory>
    useKeyTab=true
    storeKey=true
    debug=true;
};