BO 4.0 AD SSO configuration getting VSJ authentication was not performed for this request

We've written our own web app. I am trying to log into BO 4.0 using secWinAD.

I'm getting;

com.crystaldecisions.sdk.exception.SDKException$ExceptionWrapper: A java.lang.Exception occurred; original exception message VSJ authentication was not performed for this request

cause:java.lang.Exception: VSJ authentication was not performed for this request

detail:A java.lang.Exception occurred; original exception message VSJ authentication was not performed for this request VSJ authentication was not performed for this request

          at com.businessobjects.sdk.credential.internal.VintelaCredMgr.<init>(VintelaCredMgr.java:53)

Here's the code:

ISSOCredMgr credExtractor = VintelaCredMgrFactory.getFactory().makeVintelaCredMgr(request);

GSSCredential creds = credExtractor.GetCredential();

GSSManager manager = credExtractor.GetManager();

String host = request.getParameter("host");

ISessionMgr sessionMgr = CrystalEnterprise.getSessionMgr();

request.getSession().setAttribute(ENTERPISE_SESSION, sessionMgr.logon(creds, manager, host, SECWINAD));

response.sendRedirect("/myapp/");

It is failing on the ISSOCredMgr. BTW, there is 100% NO CODE on how to do this anywhere except my OTHER thread. Who is doing BO 4.0 AD SSO?! Do a google search on ISSOCredMgr or VintelaCredMgrFactory. Apparently I'm the only one. I was told this was the way to do it for 4.0 on the forum so please tell me if something is wrong.

We followed this doc for the configuraiton;

http://scn.sap.com/docs/DOC-26314

We put the properties files (global, appname.properties) in the WEB-INF\config\custom dir. All the -D options are there, etc.

Where do the properties files go and what are they to be named for an app called 'appname'?

BTW, our AD SSO configuration works for BILaunchPad so we have our Tomcat -D options and BILaunchpad properties files correct. Our app is running in the same Tomcat instance.

Thanks in advance.