Analysis for office 2.8 – Insecure Connection
Hello everyone!! This is my first blog post on SAP Portal. Here, let me discuss on the most common feedback we are facing post upgrade of Analysis office 2.8 version – The “Insecure Connection” warning message, every time users open Analysis for office report.
Yes, we have got lot of users feedback on what is this insecure connection and why it is not removed. I know, lot of us are still facing similar questions. Let’s discuss on this bit more on how to resolve this in a quick time using multiple possible Approaches. Here is the warning message…
Cause: In Analysis for Office 2.8, SAP has introduced the additional warning message to the end user to warn if user is agreed to use connection insecurely. If user clicks to continue then only the related connection will be used, otherwise, it will not refresh any data.
There are potential 2 ways this warning message can be dealt with.
Quick change for individual user
This approach is done using the settings provided in the graphical interface of Analysis for office settings. So individual user need to go to the setting and change the setting based on the requirement.
Below are the steps to follow to implement this quick change:
Step 1. Open AO report, go to File->Analysis
Step 2. Go to Technical configuration and select Settings option
Step 3. Find AllowInsecureConnections. In dropdown there will be 3 options
- Prompt: Default settings which prompts for the insecure connection. You can continue or cancel based on your choice
- No: It will prohibit insecure connection, user will not be able to continue with the warning msg.
- Yes: It allows insecure connection. User will not get any warning.
Step 5. Proceed and restart AO.
Next time onwards the Insecure Connection prompt will not be appearing.
Change in AO_App.config file
This approach is very useful when IT team pushes the Analysis for Office packaged file to the users system, because user will not have to do anything in system. This will automatically remove the warning message without doing any changes in user’s system. Also, this can be done by individual also if user has the right to change the config file.
Below are the steps to follow to change the AO_App.Config file
Step 2. Search for AllowInsecureConnections, if it is not modified, by default below text will be there without any value <AllowInsecureConnections />
Step 3. As mentioned in earlier approach there can be 3 values (Yes, No, Prompt), based on the requirement modify the line to <AllowInsecureConnections Value=”Yes” /> which will not prompt the warning.
Step 5. Restart Analysis for Office, The warning msg will not pop-up.
For the packaged file, save the packaged file with the changed AO_App.config file and Push it to user’s system.
This “Insecure Connection” provides users the flexibility to choose if they are willing to continue with the “Insecure Connection”. However, if the organization agrees with removing the warning, it would be better to communicate to users on the solution or it should be fixed in the package before the Analysis for Office 2.8 is pushed to the end user.
I am looking forward to read your comments in the comment section below and in case you have questions, you can post them directly in Q&A: https://answers.sap.com/tags/01200615320800002846.
BI Reporting and Visualization
I know my business customers will be very happy to get rid of that warning. Actually so will I.
what needs to be done to secure the connection?
With regards to the SNC message - we have prevented our users from connecting insecurely and therefore do not let them change the warning message - why would you want users to use an insecure connection?
The better solution is to setup AFO in technical settings to replace connections with SAPUILandscape SNC connection details. This works if you have setup SNC connections to your BW Landscape in the SAP Logon.
I have set this up for both direct BW connections as well as BICs connections through BO
Thanks for your view that rather suppressing the message, we should make sure that we are connecting securely. Do you mean, it is possible by ticking the option you mentioned?
What you want to do is to get AFO to use the SNC connections from the SAPLandscape.xml. You need to ensure you select the following options:
AllowInsecureConnections = No
EnablewarningforFailedSNC = ✔
If using AFO 2.8 or prior then for BW direct connections:
UseSapUILandscapeComAPI = ✔
If using BO BICs connection ensure the systems details on the BICs connection match the SAPLanscape.xml details
What the above will do is get AFO to match the BW system name in the sapaox file or the BO Bics connection to the BW system in the SAPLanscape.xml and replace the connection details with the snc enabled connection in the SAPLandscape.xml.
Also ensure that your VPN or firewall rule settings enables traffic on port 4800(secure) and disable port 3300 (insecure)
Let me know if you need anymore help.
I am totally with you that allowing insecure connections is not the correct way.
Better way is to ensure that AfO accepts the connections as secure, if the are.
Currently have a customer who accesses AfO-Workbooks via SAP-GUI in the
BW-System directly, means not via BO-Server or any OLAP-Connection.
They already do have SNC in use and SSO normally works fine. So I am thinking,
that the SNC maybe needs to be setup differently for AfO or the SCN quality level
is maybe not high enough. At least AfO does not accept it in all cases.
So can you further explain what you mean or what need to be done to achieve
what you have written here:
"The better solution is to setup AFO in technical settings to replace connections
with SAPUILandscape SNC connection details. This works if you have setup SNC
connections to your BW Landscape in the SAP Logon."
Thank you, that would help a lot!
I have replied above.
Let me know if you need further info
After the update we have for particular colleagues the message "Couldn't establish a secure connection". This cannot be solved with the proposed solution to enable the item AllowInsecureConnections with selection Yes.
How can this be solved please =)? Thanks a lot for your suppor.t
You can remove that prompt by going to the Start menu and Run the Analysis for Office as an Administrator. Then go to the technical configuration and search for the "EnableWarningforFailedSnc" and unselect the checkbox. After that restart your Analysis and you should not see that prompt again! 🙂
well this is working fine - but how to provide that setting with the file configuration? My users access AFO in an citrix environment and they don´t have admin rights there.
Is there also a parameter in the ao_user_config file (or any other file)?
Yes, there is a way to configure this through the ao_app.config file (not ao_user_config which you mentioned).
You'll have to change the parameter below to False.
<!--default of 'EnableWarningForFailedSnc': value="True" -->
After (The bold font needs to be added):
<!--default of 'EnableWarningForFailedSnc': value="True" -->
<EnableWarningForFailedSnc value="False" />