WebI Rich Client throws "[error.openSapBwBrowsingSessionFailed]" Exception when trying to open BICS connection

Dear experts

We face a strange issue that we were not able to solve by ourselves. When we want to create a new report based on a BICS connection we receive the following exception:

com.businessobjects.sdk.core.server.CommunicationException$UnexpectedServerException: [[error.openSapBwBrowsingSessionFailed] 0] <<?xml version="1.0" encoding="UTF-8" standalone="yes"?><ConnectionString>

   <Properties>

      <Initial Catalog>*</Initial Catalog>

      <Language>en_US</Language>

      <Data Source>*</Data Source>

      <Cube Type>Query</Cube Type>

      <User ID />

      <SaveLanguage>true</SaveLanguage>

      <Password />

      <Initial Cube>*</Initial Cube>

      <TargetProvider>SAPNETWEAVER7X</TargetProvider>

      <Authentication Mode>2</Authentication Mode>

      <NetworkLayer>SAPBW_BICS</NetworkLayer>

   </Properties>

   <ExtendedProperties>

      <SapLoginMode>0</SapLoginMode>

      <JCO_ASHOST>*</JCO_ASHOST>

      <JCO_R3NAME>*</JCO_R3NAME>

      <JCO_CLIENT>001</JCO_CLIENT>

      <JCO_LANG>DE</JCO_LANG>

      <JCO_SYSNR>00</JCO_SYSNR>

   </ExtendedProperties>

</ConnectionString>>

This is a very generic error and we didn’t find a solution for this problem. Funny thing is that we only face this problem in Rich Client. If we create a new report in the browser (WebI applet mode) selecting a connection works fine. I am not sure if it has something to do with our SSO setup. I think it shouldn’t since it works with WebI. But we also have a test installation of BI 4.2 SP2 without SSO. There it works without problems. So maybe a SSO problem anyway?

It also does not make any difference if we change the authentication type to pre-defined. It seems to be a communication error between our client system and the bo server. I also came across other threads where the problem was the DSL bridge not being active on the APS. But I checked ours and we have both STS and DSL bridge on the same APS.

We are on BI 4.1 SP3 P2. Thanks for your help.

regards

Lars

** EDIT **

I found another useful information within the tracelog of the DSL APS. The Error is the following:

STS: user *** doesn't have any alias for SAP system ***

Exception raised from SecurityTokenService.getSAPAssertionTicket

Seems like the STS configuration is causing the problem.

** EDIT 2 **

After renewing the certificate the STS message changes to:

STS: found SAP user BWD~001/***

But still the same error [[error.openSapBwBrowsingSessionFailed] 0]