Friday, 27 June 2014

Top 50 Interview Questions with answers for obiee 11g


Q1.What is a bridge table ?
Answer:- If you want to connect two tables where there is no relation ship you can use a thrid bridge table for connecting them which will have common columns in both tables, this is used in BMM Layer.

Q2.What are the Key Configuration Files in OBIEE?
Answer:- NQSConfig.ini, NQSCluster.ini, odbc.ini, instanceconfig.xml

Q3.How Time based triggered report can be generated
Using Scheduler - ibots

Q4.What is ibot
Ibot is an scheduling agent, used to schedule reports to be sent across various devices such as email, pager, mobile, other devices etc

Q5.What r diff types of joins that are possible in OBIEE RPD
Complex Join – to use multiple conditions, such A.ROW_WID = B.ROW_WID AND / OR A.A_WID = B.B_WID like that
Natural Join / Equi Join

Q6.Difference between a session and repo variable
Session variables are similar to dynamic repository variables in that they obtain their values from initialization blocks. Unlike dynamic repository variables, however, the initialization of session variables is not scheduled. When a user begins a session, the Oracle BI Server creates new instances of session variables and initializes them.
A repository variable has a single value at any point in time. Repository variables can be used instead of literals or constants in Expression Builder in the Administration Tool. The Oracle BI Server substitutes the value of the repository variable for the variable itself in the metadata.
Unlike a repository variable, there are as many instances of a session variable as there are active sessions on the Oracle BI Server. Each instance of a session variable could be initialized to a different value.
(or)
Session variables can have different values for each user, repository variables have the same value for everyone.
There are two types of session variables:
•           System session variables: out of the box variables like USER
•           Non-system session variables: user-defined variables, can have different values for each user and are typically used to customize user experience , for example you could have a SALES_REGION variable to show only data relevant to the user's region.
Repository variables also have 2 subtypes:
•           Static repository variable: Fixed value that can only be changed with the admin tool, can be used to replace hardcoded values like database schemas and user names in connection pools.
•           Dynamic repository variable: These hold values that apply to any user, for instance currency exchange rates.
Both System variables and dynamic repository variables get their values from initialization blocks that can contain SQL.

Q7.What is task scheme and In production... if users are running the report.. but not getting the data... what could be the reason and list all the checks step by step.. How u will resolve the problem
whether the issue is specific to this user / general. If general, then you might want to check the joins, referential integrity between tables. If specific, then you may have to check his security authorization, business model filters, session variable initialization / any query timing limitations, number of connection pool parameters etc

Q8.How can i have two different columns from two different tables or subject areas
Using confirmed dimensions, you can fetch multiple metrics across various facts, but the join should be of the same grain / same level of data detail.

Q9.How can u use saved filters and where  will you save the filters
Shared Folders/XYZ Folder/ It contains two folders
a.Prompts – saved filters will be stored here.
b. Reports

Q10.Have you worked in dashboard.. when u run a dashboard... how will u stop the dashboard report run automatically
By clicking on the cancel button, you can stop a specific report placed on the dashboard

Q11.What is a surrogate key
A surrogate key is an artificially generated key, usually a number. A surrogate key, in the level aggregate table, simplifies this join and removes unnecessary columns (level primary key) from the fact table, resulting in a smaller-sized fact table. Adding surrogate keys to the dimension (level) aggregate tables can simplify joins to the fact tables and might improve query performance. Additionally, a surrogate key makes sure that each aggregate table has a unique identifier.

Q12.Couple of table names in Oracle GL,AR..ect
Talk in detail using below material.. this talks of entire flow as to which table is used for what
AR
To be in the position where you need to handle and process a payment in Receivables, you need to have a buyer/payer (most times this is a customer but there are exceptions). Customer records are stored in the HZ_CUST_ACCOUNTS and HZ_PARTIES tables.  Each customer needs to have a site (a location/address of business) for which information is stored in HZ_CUST_ACCT_SITES_ALL and HZ_PARTY_SITES_ALL.
When a customer purchases goods or services from your company, an invoice is generated for the customer.  These invoice transactions are recorded in RA_CUSTOMER_TRX_ALL (invoice headers) and RA_CUSTOMER_TRX_LINES_ALL (invoice lines).
When the customer makes a payment, this generates new transactions.  These are recorded in AR_CASH_RECEIPTS_ALL and AR_CASH_RECEIPT_HISTORY.  If there is adjustment to an invoice, this is recorded in AR_ADJUSTMENTS.
Sometimes payments are received in batches, where a single payment is for multiple invoices.  These batch payments have records in AR_BATCHES.
The AR_PAYMENT_SCHEDULE table holds one record per payment.  Therefore, for payments that pay an invoice in full, there will only be one record related to that invoice.  However, if payments for an invoice are broken up into a payment plan, or if a partial payment is received for an invoice, additional records will be generated in this table for each payment.

GL
GL_INTERFACE
This table holds financial transactions   (journals) transferred from other Oracle Applications modules and external   systems.
GL_JE_BATCHES
This table identifies a “batch” of   journals that are related and processed together. Each batch contains one or   more journals.
GL_JE_HEADER
Each journal has one journal header   and one record this table
GL_JE_LINES
Each journal has one or more journal   lines and are tied together by the journal header
Some other important supporting tables in the GL data model include:
GL_CODE_COMBINATIONS
This is the Accounting Flexfield table   and it stores the chart of accounts values, and so the table contains the   valid GL account combinations allowed in the system, along with other   relevant information about the accounts.
GL_LEDGERS
This table stores all the Ledgers and   Ledger Sets in the Oracle GL system
GL_PERIODS
This   table stores information   about the accounting periods defined in the Oracle GL system. Each row contains   information such as, start date, end date of the period, the period type, the   fiscal year, and the period number.



Q13.What is a request variable and in a table how can i get the distinct record from the table... and If I say 'distinct all'.. what data will u get



So exactly what is a request variable?  Well, put succinctly:
   A request variable is a variable that is used to temporarily override the value of a session variable.
And, with a little more precision, a request variable is:
   A variable that is defined within the Presentation Services;
   A variable whose scope (page or dashboard) is that of the associated dashboard prompt that defines the request variable and its value;
   A variable whose name should not match that of a repository variable or a security system session variable; and
   A variable that overrides the value of the corresponding session variable (should it exist) for the purpose of BI Server request parsing and physical SQL construction for all requests that are issued from dashboard pages that fall within the scope of the variable’s definition.
Note, using a request variable does not change the actual value of a session variable – neither temporarily nor permanently.  It simply appears to change the value for certain purposes during the execution of a request.

Q14.When u run optimization and suppose u get some number....so how u know that the number is too bad or too good....

Well, this is situation dependent.. Only way is to check with source numbers

Q15.What is explain plan
From the BI side, you can basically use 2 types of hints
The Index hint instructs the optimizer to scan a specified index rather than a table.
·         The Leading hint forces the optimizer to build the join order of a query with a specified table.
Importantly, the Explain Plan contains the following information regarding your query.
■Ordering of the tables referenced
■Access method for each table
■Join method for each join operation
■Data operations, such as filter, sort or aggregation
And in addition:
■Optimization (Cost and Cardinality)
■Partitioning
■Parallel Execution


Q16.What are aggregations and if we have to do it on physical layer side then how u do it
You can use the Aggregate Persistence Wizard to create the SQL file that will be used to create aggregate tables and map them into the metadata.
Do not use aggregate persistence against tables with active Virtual Private Database (VPD) security filters. There is a possibility that the aggregate information might be persisted without the VPD filter, posing a security risk.

The Aggregate Persistence Wizard is a nifty utility for creating, modelling and populating aggregate tables available in OBIEE 10g and 11g. This utility is especially useful to quickly build a single aggregation layer upon federated heterogeneous physical sources.  OBIEE will create, model and populate aggregate dimensions and facts based upon the intelligence you have built into the RPD. This avoids re-writing the same logic into your ETL
Q17.What kind of sources can be connected to OBIee ?
ANS: OBIee can be plugged on Relational Databases, Cubes or Flat files, with the following constraints :
The sources must be modeled as star schemas or snowflakes schemas in order to have  an efficient and safe behavior.
In case of multiple sources directly in OBIee used together, be aware that OBIee will conduct the needed joins itself, and OBIee is not a database.
Q18.Is it possible to create a report based on two subject areas  (example : Sales and Supply chain) ?
ANS: Theoretically, yes. In practice, the two subject area must come from the same business model in the repository, which is quite useless. Then, we can consider the two following alternatives :
Create an analysis with “combine request”: one subrequest by subject area. Note that it’s tricky to implement for standard users.
Set up a transverse subject area, that will gather tables from both business topics.
Q19.How to get real physical SQL sent by OBIee to the database
ANS: First of all, check the value of your session variable LOGLEVEL.
5 is fine.
Then, go into Administration -> Manage sessions.
Find your query (at the bottom of the list), and click on “View log”.
If you hit the cache, you will see “cache hit on query”. Otherwise, you will see the physical SQL below the logical SQL.
Q20.How to configure an OBIee environment ?
ANS: In OBIee 11g, main configuration items are managed in Enterprise Manager (web interface).
However, some configurations are still located in configuration files, like NQSConfig.ini, NQSCluster.ini, odbc.ini, and instanceconfig.xml.

Q21.In a troubleshooting perspective, how can I see log files ?
ANS: Old method in 10g version consisted in opening log files on the server.
Now, in 11g, log information is consultable in Enterprise Manager.
Q22What is query repository tool?
ANS:   It is utility of Seibel/OBIEE Admin tool
Allows you to examine the repository metadata tool
For example: search for objects based on name, type.
Examine relationship between metadata objects like which column in the presentation layer maps to which table in physical layer
Q23. What is JDK and why do we need it?
ANS:  Java Development Kit (JDK), A software package that contains the minimal set of tools needed to write, compile, debug, and run Java applets.
Oracle doesn’t recommend Opaque Views because of performance considerations, so why/when do we use them?
An opaque view is a physical layer table that consists of select statement. an opaque view should be used only if there is no other solution.
Can you migrate the presentation layer to a different server?
No we have to migrate the whole web & RPD files
Q24.How do you identify what are the dimension tables and how do you decide them during the Business/Data modeling?
ANS: Dimension tables contain descriptions that data analysts use as they query the database. For example, the Store table contains store names and addresses; the Product table contains product packaging information; and the Period table contains month, quarter, and year values. Every table contains a primary key that consists of one or more columns; each row in a table is uniquely identified by its primary-key value or values

 Q25.Why do we have multiple LTS in BMM layer? What is the purpose?
ANS: To improve the performance and query response time.
Q26.What is the full form of RPD?
ANS: There is no full form for RPD as such, it is just a repository file (Rapidfile Database)

Q27.How do i disable cache for only 2 particular tables?
ANS: In the physical layer, right click on the table there we will have the option which says cacheable
Q28.How do you split a table in the RPD given the condition?
ANS: (The condition given was Broker and customer in the same table) Split Broker and customer.
We need to make an alias table in the physical layer.
 Q29.What type of protocol did you use in SAS?
ANS: TCP/IP
 Q30.What is logging level? Where can you set logging levels?
ANS: You can enable logging level for individual users; you cannot configure a logging level for a group.Set the logging level based on the amount of logging you want to do. In normal operations, logging is generally disabled (the logging level is set to 0). If you decide to enable logging, choose a logging level of 1 or 2. These two levels are designed for use by Siebel Analytics Server administrators.
Set Logging Level:
1. In the Administration Tool, select Manage > Security.
2. The Security Manager dialog box appears.
3. Double-click the user’s user ID.
4. The User dialog box appears.
5. Set the logging level by clicking the Up or Down arrows next to the Logging Level field

Q31.What is variable in OBIEE?
ANS: You can use variables in a repository to streamline administrative tasks and modify metadata content dynamically to adjust to a changing data environment. The Administration Tool includes a Variable Manager for defining variables
Q32.What is system variable and non-system variable?
ANS: System variables:
System variables are session variables that the Siebel Analytics Server and Siebel Analytics Web use for specific purposes. System variables have reserved names, which cannot be used for other kinds of variables (such as static or dynamic repository variables, or for non-system session variables). When using these variables in the Web, preface their names with NQ_SESSION. For example, to filter a column on the value of the variable LOGLEVEL set the filter to the Variable NQ_SESSION.LOGLEVEL.
Non-system variables:
A common use for non-system session variables is setting user filters. For example, you could define a non-system variable called SalesRegion that would be initialized to the name of the user’s sales region. You could then set a security filter for all members of a group that would allow them to see only data pertinent to their region.
When using these variables in the Web, preface their names with NQ_SESSION. For example, to filter a column on the value of the variable SalesRegion set the filter to the Variable NQ_SESSION.SalesRegion.
Q33. What are different types of variables? Explain each.
ANS: There are two classes of variables:
1. Repository variables
2. Session variables
Repository variables:
A repository variable has a single value at any point in time. There are two types of repository variables:
Static: This value persists, and does not change until a Siebel Analytics Server administrator decides to change it.
Dynamic: The values are refreshed by data returned from queries. When defining a dynamic repository variable, you will create an initialization block or use a preexisting one that contains a SQL query. You will also set up a schedule that the Siebel Analytics Server will follow to execute the query and periodically refresh the value of the variable.
Session Variables:
Session variables are created and assigned a value when each user logs on. There are two types of session variables:
1.system
2.non-system.

 Q34.What is the cache management? Name all of them and their uses. For Event polling table do you need the table in your physical layer?
ANS: Monitoring and managing the cashe is cache management.There are three ways to do that.
Disable caching for the system.(NSQconfig INI file), Cache persistence time for specified physical tables and Setting event polling table.
Disable caching for the system.(INI NQ config file :
You can disable caching for the whole system by setting the ENABLE parameter to NO in the NQSConfig.INI file and restarting the Siebel Analytics Server. Disabling caching stops all new cache entries and stops any new queries from using the existing cache. Disabling caching allows you to enable it at a later time without losing any entries already stored in the cache.
Cache persistence time for specified physical tables:
You can specify a cacheable attribute for each physical table; that is, if queries involving the specified table can be added to the cache to answer future queries. To enable caching for a particular physical table, select the table in the Physical layer of the Administration Tool and select the option Make table cacheable in the General tab of the Physical Table properties dialog box. You can also use the Cache Persistence Time settings to specify how long the entries for this table should persist in the query cache. This is useful for OLTP data sources and other data sources that are updated frequently, potentially down to every few seconds.
Setting event polling table:
Siebel Analytics Server event polling tables store information about updates in the underlying databases. An application (such as an application that loads data into a data mart) could be configured to add rows to an event polling table each time a database table is updated. The Analytics server polls this table at set intervals and invalidates any cache entries corresponding to the updated tables.
For event polling table ,It is a standalone table and doesn’t require to be joined with other tables in the physical layer.
 Q35.What is Authentication? How many types of authentication.
ANS: Authentication is the process, by which a system verifies, through the use of a user ID and password, that a user has the necessary permissions and authorizations to log in and access data. The Siebel Analytics Server authenticates each connection request it receives.
Operating system authentication
External table authentication
Database authentication
LDAP authentication
Q36.What is object level security?
ANS: There are two types of object level security:
1.      Report Level
2.      Web Level
Repository level: In presentation layer we can set Repository level security by giving permission or deny permission to users/groups to see particular table or column.
Web level: this provides security for objects stored in the OBIEE web catalog, such as dashboards, dashboards pages, folder, and reports you can only view the objects for which you are authorized. For example, a mid-level manager may not be granted access to a dashboard containing summary information for an entire department.
Q37.What is data level security?
ANS: This controls the type an amount of data that you can see in a report. When multiple users run the same report the results that are returned to each depend on their access rights and roles in the organization. For example a sales vice president sees results for all regions, while a sales representative for a particular region sees only data for that region.
Q38. What is the difference between Data Level Security and Object Level Security?
ANS: Data level security controls the type and amount of data that you can see in reports. Object level security provides security for objects stored in the OBIEE web catalog, like dashboards, dashboards pages, folder, and reports.
 Q39.How is security set up in OBIEE?  How many methods of security can be set up in OBIEE…?
ANS: Authentication is process of confirming whether the user is a valid user or not. Is he part of this company? Is he an employee of our external suppliers?
Authorization is process of giving access to different pieces of the OBIEE. One user “UserA” can access dashboards, can create iBots, can schedule reports and can do administrative tasks. Another user “UserB” can see only part of what “UserA” has access to and “UserB” has access to some other tabs of the dashboard that “UserA” does not.
This layer of separating who can access what is done as part of Authorization.

Q40. How does OBIEE handle Authentication?
It’s very flexible and can be integrated to one of your existing technologies like LDAP, Oracle EBS, AD, and Oracle Database. So, do the same username have to exist in OBIEE security layer as part of RPD development? Yes, by default, OBIEE stores list of usernames and passwords and checks incoming credentials against it.
Heard about External Table Authentication? Where does this come into play?
Instead of storing usernames and passwords directly in the RPD, these are stored in the database for better management purposes. This also helps in RPD migration and deployment across multiple environments.
Q41.How is Authorization handled in OBIEE?
ANS: Authorization is done as part of security in Presentation Services.
Q42.Does OBIEE have two layers of security?
ANS: Yes, first at the RPD level and second at the presentation services level.
Q43.What kind of privileges can be granted from presentation services level?
ANS: Access to iBots, certain tabs in the dashboard, delivers, alerts, schedule reports etc etc..
Q44.Why OBIEE security is different compared to other BI tools?
ANS: Because it’s very flexible and can integrate into any existing security architecture an organization has built and reduces the need for one more layer of administration..
Did Oracle OBIEE do a good job of communicating and convincing the user community regarding the security architecture?
Probably not… I understand the complexity behind this and the mere flexibility of the tool makes this even difficult.

Q45.What is the default location of a repository file?
[InstalledDirectory]OracleBIserverRepository
 Q46.What’s XMLA and where is it used for in OBIEE context
ANS: The Provider Services tool that comes with Essbase is used to provide the interface, with Oracle BI Server talking to Essbase through its XMLA interface. (Need to find the answer still)
XML for Analysis (abbreviated as XMLA) is an industry standard for data access in analytical systems, such as OLAP and Data Mining. XMLA is based on other industry standards such as XML, SOAP and HTTP.
 Q47.Can you change the location of your RPD file in your OBIEE Configuration? If Yes, Where would you mention the new location of this RPD file for Bi Server?
ANS: Read the NQSConfig file “Repository Section”. You will easily find the answer. The answer for this is “It cant be changed”.
The repository location can be changed, this must be done when clustering the BI Server. The parameters in the NQSCONFIG.INI file are
REPOSITORY_PUBLISHING_DIRECTORY =
REQUIRE_PUBLISHING_DIRECTORY = YES;

Q48.What kind of joins would you perform in the physical layer of the repository file when opened with Administration tool?
ANS: We cannot have outer joins in Physicla layer. We can outer joins in BMM layer.  In BMM layer – complex join can be full inner join or full outer join or whatever your criteria was,but in physical layer – physical join is always an inner join.
Q49.What are the minimum services needed to load a repository file onto memory and view a dashboard which has reports that have been refreshed on a scheduled basis?
ANS: Oracle BI Java Host, Oracle BI Presentation Server, and Oracle BI Server
Q50.What is Level Based Metrics.How will you create it?
Answer:- Leval-base matrics means, having a measure pinned at a certain level of the dimension. Monthly Total Sales or Quarterly Sales are the examples.
To create a level based measure, create a new logical column based on the original measure (like Sales in the example above). Drag and drop the new logical column to the appropriate level in the Dimension hierarchy (in the above example you will drag and drop it to Month in Time Dimension.

 Q51.What are Global Filter and how thery differ From Column Filter?
Answer:-
Column filter- Simply a filter applied on a column which we can use to restrict our column values while pulling the data or in charts to see the related content.
Global filter- This filter will have impact on across the application.
Q52.What is a materialized view?
ANS: Materialized view is a physical object and replica of the one or more master objects.It will refresh in an intervals.


Q53.Have you ever tried with de-normalized Database to build reports? If yes, How to handle?
ANS: Building reports on de-normalized data is not a best practice it leads to performance issues but we can build the reports. These are reports can’t be used for business analysis because the data will fluctuate non regular intervals.

Saturday, 10 May 2014

Introduction to Security in Oracle Business Intelligence


Overview of Security in Oracle Business Intelligence

Oracle Business Intelligence 11g is tightly integrated with the Oracle Fusion Middleware Security architecture and delegates core security functionality to components of that architecture. Specifically, any Oracle Business Intelligence installation makes use of the following types of security providers:
  • An authentication provider that knows how to access information about the users and groups accessible to Oracle Business Intelligence and is responsible for authenticating users.
  • policy store provider that provides access to Application Roles and Application Policies, which forms a core part of the security policy and determines what users can and cannot see and do in Oracle Business Intelligence.
  • credential store provider that is responsible for storing and providing access to credentials required by Oracle Business Intelligence.
By default, an Oracle Business Intelligence installation is configured with an authentication provider that uses the Oracle WebLogic Server embedded LDAP server for user and group information. The Oracle Business Intelligence default policy store provider and credential store provider store Credentials, Application Roles and Application Policies in files in the domain.
After installing Oracle Business Intelligence you can reconfigure the domain to use alternative security providers, if desired. For example, you might want to reconfigure your installation to use an Oracle Internet Directory, Oracle Virtual Directory, Microsoft Active Directory, or another LDAP server for authentication. You might also decide to reconfigure your installation to use Oracle Internet Directory, rather than files, to store Credentials, Application Roles, and Application Policies.

 About Authentication

Each Oracle Business Intelligence 11g installation has an associated Oracle WebLogic Server domain. Oracle Business Intelligence delegates user authentication to the first authentication provider configured for that domain.
The default authentication provider accesses user and group information stored in the LDAP server embedded in the Oracle Business Intelligence's Oracle WebLogic Server domain. The Oracle WebLogic Server Administration Console can be used to create and manage users and groups in the embedded LDAP server.
You might choose to configure an authentication provider for an alternative directory. In this case, Oracle WebLogic Server Administration Console enables you to view the users and groups in your directory. However, you need to continue to use the appropriate tools to make any modifications to the directory. For example, if you reconfigure Oracle Business Intelligence to use OID, you can view users and groups in Oracle WebLogic Server Administration Console but you must manage them in OID Console.


 About Authorization

After a user has been authenticated, the next critical aspect of security is ensuring that the user can do and see what they are authorized to do and see. Authorization for Oracle Business Intelligence release 11g is controlled by a security policy defined in terms of applications roles.

About Application Roles

Instead of defining the security policy in terms of users in groups in a directory server, Oracle Business Intelligence uses a role-based access control model. Security is defined in terms of Application Roles that are mapped to directory server groups and users. For example, the Application Roles BIAdministrator, BIConsumer, and BIAuthor are installed out-of-the-box.
Application Roles represent a functional role that a User has, which gives that User the privileges required to perform that role. For example, having the Sales Analyst Application Role might grant a User access to view, edit and create reports on a company's sales pipeline.
This indirection between Application Roles and directory server users and groups allows the administrator for Oracle Business Intelligence to define the Application Roles and policies without creating additional users or groups in the corporate LDAP server. Instead, the administrator defines Application Roles that meet the authorization requirements and maps those roles to pre-existing users and groups in the corporate LDAP server.
In addition, the indirection afforded by Application Roles allows the artifacts of a business intelligence system to be easily moved between development, test and production environments. No change to the security policy is needed and all that is required is to map the Application Roles to the users and groups available in the target environment.

The Figure 1-1 shows an example using the default set of Users, Groups, Application Roles.

Figure 1-1 Example Users, Groups, Application Roles, and Permissions
This diagram is described in surrounding text.
Figure 1-1 shows the following:
  • The Group named 'BIConsumers' contains User1, User2, and User3. Users in the Group 'BIConsumers' are assigned the Application Role 'BIConsumer', which enables the users to view reports.
  • The Group named 'BIAuthors' contains User4 and User5. Users in the Group 'BIAuthors' are assigned the Application Role 'BIAuthors', which enables the users to create reports.
  • The Group named 'BIAdministrators' contains User6 and User7. Users in the Group 'BIAdministrators' are assigned the Application Role 'BIAdministrator', which enables the users to manage responsibilities.

About the Security Policy

In Oracle Business Intelligence release 11g, the security policy definition is split across the following components:
  • Presentation Catalog – This defines the catalog objects and Oracle BI Presentation Services functionality that the Users with specific Application Roles can access. Access to functionality is defined in the Managing Privileges page in terms of Presentation Catalog privileges and access to presentation catalog objects is defined in the Permission dialog.
  • Repository – This defines which Application Roles and users have access to which items of metadata within the repository. The Oracle BI Administration Tool is used to define this security policy.
  • Policy Store – This defines which Oracle BI Server, BI Publisher, and Real Time Decisions functionality can be accessed by given users or users with given Application Roles. In the default Oracle Business Intelligence configuration, the policy store is managed using Oracle Enterprise Manager Fusion Middleware Control. For more information about the policy store, see Oracle Fusion Middleware Security Guide.


 About the Users, Groups, and Application Roles Installed Out-Of-The-Box

When you install Oracle Business Intelligence, you get a number of preconfigured Users, Groups, and Application Roles that you can use to deploy Oracle Business Intelligence (for more information.

 What tools do I use to configure security in Oracle Business Intelligence?

To configure security in Oracle Business Intelligence, you use the following tools:
  • "Oracle WebLogic Server Administration Console"
  • "Oracle Fusion Middleware Control"
  • "Oracle BI Administration Tool"
  • "Administration Page in Oracle BI Presentation Catalog"

The figure below summarizes the tools used to configure security in a default installation Oracle Business Intelligence using the embedded WebLogic LDAP Server.

Figure 1-2 Summary of Tools for Configuring Security in a Default Installation
This diagram is described in surrounding text.

 Oracle WebLogic Server Administration Console

You use Oracle WebLogic Server Administration Console to manage the embedded directory server that is used to authenticate Users and Groups.
The example screen shot below shows the Users and Groups\Users page in Oracle WebLogic Server Administration Console displaying a list of Users in Oracle Business Intelligence.
This screenshot is described in surrounding text.
Note: If you use Oracle Internet Directory as the Authentication Provider instead of the default the embedded WebLogic LDAP Server, then you use OID Console to manage Users and Groups.

Oracle Fusion Middleware Control

You use Oracle Fusion Middleware Control to create and manage the Application Roles and Application Policies that control access to Oracle Business Intelligence resources.
The example screen shot below shows the Application Roles page in Oracle Fusion Middleware Control displaying the default Application Roles named BIAdministrator, BIAuthor, and BIConsumer.
This screenshot is described in surrounding text.

1.6.3 Oracle BI Administration Tool

You use the Oracle BI Administration Tool to configure privileges in the metadata repository (that is, the RPD file).
The screenshot below shows the Security Manager dialog, which enables you to manage Users and Application Roles.
This screenshot is described in surrounding text.

 Administration Page in Oracle BI Presentation Catalog

You use the Administration Page in Oracle BI Presentation Catalog to configure privileges for Users.
The screenshot below shows the Manage Privileges dialog, which enables you to manage privileges and associated Application Roles.
This screenshot is described in surrounding text.

 Example: Looking at the Installed Users, Groups, and Application Roles

This example takes a closer look at the installed Users, Groups, and Application Roles using the Oracle Business Intelligence tools. Follow the steps in this section to learn how to use the Oracle Business Intelligence tools to configure security options.

 About Using Oracle WebLogic Server Administration Console

To display installed objects in Oracle WebLogic Server Administration Console:
  1. Log in to Oracle WebLogic Server Administration Console.
  2. In the Domain Structure tab at the left-hand side, select the Security Realms link.
  3. In the list of Realms, select the realm that you are configuring.
    For example, myrealm.
  4. Use the tabs and options on the Settings for <Realm name> dialog to configure Users and Groups.
    For example, display the Users and Groups tab to edit Users and Groups. In the example screenshot below, you can see the installed Groups named BIAdministrators, BIAuthors, and BIConsumers.
    This screenshot is described in surrounding text.

 About using Oracle Enterprise Manager Fusion Middleware Control

To display installed objects in Oracle Enterprise Manager - Fusion Middleware Control:
  1. Log in to Oracle Enterprise Manager - Fusion Middleware Control.
  2. From the Home page, select the Business Intelligence link.
  3. Select the coreapplication link.
  4. Display the Security tab.
  5. Select the Configure and Manage Application Roles link.
    In the example screenshot below, you can see the installed Application Roles BIAdministrator, BIAuthor, and BIConsumer.
    This screenshot is described in surrounding text.

 About Using Oracle BI Administration Tool

To display installed objects in Oracle BI Administration Tool:
  1. Log in to BI Administration Tool.
    Note: If you log in to BI Administration Tool in online mode, then you can view all users from the WebLogic Server. If you log in to BI Administration Tool in offline mode, then you can only view users that are stored in the catalog.
  2. Choose Manage, then Identity to display the Security Manager dialog.
    In the example screenshot below you can see the installed Application Roles BIAdministrator, BIAuthor, and BIConsumer.
    This screenshot is described in surrounding text.
    If you double-click the Application Role named 'Sales Admin' to display the Application Role <Name> dialog, then click Permissions, you can use the Object Permissions tab to set Read and Write permissions for that Application Role on objects and folders in the catalog.
    This screenshot is described in surrounding text.
  3. Close Security Manager.
  4. In the Presentation pane, expand the Paint folder, then right-click Markets to display the Presentation Table <Table name> dialog.
  5. Click Permissions to display the Permissions <Table name> dialog.
    In the example screenshot below, you can see the installed Application Roles BIAdministrator, BIAuthor, and BIConsumer, and the radio buttons Read, Read/Write, No Access, and Default that are used to set the permissions for the Application Roles.
    This screenshot is described in surrounding text.

About Using Administration Page in Oracle BI Presentation Catalog

To display installed objects in Administration Page in Oracle BI Presentation Catalog:
  1. Log in to BI EE with Administrator privileges.
  2. Select the Administration link to display the Administration page.
  3. Select the Manage Privileges link.
    In the example screenshot below, you can see the installed Application Roles BIAdministrator, BIAuthor, and BIConsumer listed against each of the privileges that they have been assigned.
    This screenshot is described in surrounding text.
  4. Select the BIAuthor link in the 'Access to Conditions' row, to display the Privilege <Privilege name> dialog.
    This screenshot is described in surrounding text.
  5. Click the Add users/roles icon (+) to display the Add Application Roles, Catalog Groups, and Users dialog.
    In the example screenshot below you can see the installed Application Roles BIAdministrator, BIAuthor, and BIConsumer, which can be assigned to this privilege.
    This screenshot is described in surrounding text.


 Comparing the Oracle Business Intelligence 10g and 11g Security Models

The release 10g and release 11g security models differ in the following ways:
  • Defining users and groups - In Oracle Business Intelligence release 10g users and groups could be defined within a repository file using Oracle BI Administration Tool. In Oracle Business Intelligence release 11g users and groups can no longer be defined within a repository. The Oracle Business Intelligence Enterprise Edition Upgrade Assistant migrates users and groups from a release 10g repository into the embedded LDAP server in a release 11g installation.
  • Defining security policies – In Oracle Business Intelligence release 10g security policies in the web catalog and repository could be defined to reference groups within a directory. In Oracle Business Intelligence release 11g a level of indirection is introduced whereby security policies are defined in terms of Application Roles, which are in turn are mapped to users and groups in a directory. This indirection allows an Oracle Business Intelligence release 11g system to be deployed without changes to the corporate directory and eases movement of artifacts between development, test and production environments.
  • Use of the Administrator user – In an Oracle Business Intelligence release 10g installation, a special user named Administrator has full administrative permissions and is also used to establish trust between processes within that installation. In Oracle Business Intelligence release 11g there is no special significance to the name Administrator and there can be one or more users who are authorized to undertake different sets of administrative functions. In Oracle Business Intelligence release 11g the identity used to establish trust between processes in an installation is configurable and independent.
  • Repository encryption – in Oracle Business Intelligence release 10g certain sensitive elements within a repository are encrypted. In Oracle Business Intelligence release 11g the entire repository is encrypted using a key derived from a user supplied password.
    Caution:
    A release 11g repository can only be opened with the password. There is no mechanism for recovering a lost password.
The following aspects of the Oracle Business Intelligence release 10g security model remain in release 11g:
  • Oracle BI Server Initialization Blocks – Oracle BI Server in release 11g continues to support the use of initialization blocks for authentication and authorization. In release 10g Oracle BI Server falls back to use initialization blocks if a matching user cannot be found in the repository. In release 11g Oracle Business Intelligence falls back to use initialization blocks if the user cannot be authenticated by the installation's configured authentication provider.
  • Presentation Catalog Groups – Oracle Business Intelligence release 11g continues to support the definition of catalog groups within the Presentation Catalog. These groups are only visible within Oracle BI Presentation Services. Oracle recommends that Oracle BI Presentation Catalog groups be used for backward compatibility only and that Application Roles be used instead for new installations.
  • SA System Subject Area – Oracle Business Intelligence release 11g supports the use of SA System Subject Area, in combination with Oracle BI Server initialization blocks, to access user, group and profile information stored in database tables.


Terminology

The following terms are used throughout this guide:
Application Policy
Oracle Business Intelligence permissions are granted by its Application Roles. In the default security configuration, each role conveys a predefined set of permissions. An Application Policy is a collection of Java EE and JAAS policies that are applicable to a specific application. The Application Policy is the mechanism that defines the permissions each Application Role grants. Permission grants are managed in the Application Policy corresponding to an Application Role.
Application Role
Represents a role a user has when using Oracle Business Intelligence. Is also the container used by Oracle Business Intelligence to grant permissions to members of a role. Application roles are managed in the policy store provider.
Authentication
The process of verifying identity by confirming the credentials presented during logon.
Authentication Provider
A security provider used to access user and group information and is responsible for authenticating users. Oracle Business Intelligence default authentication provider is Oracle WebLogic Server embedded directory server and is named DefaultAuthenticator.
Authorization
The process of granting an authenticated user access to a resource in accordance to their assigned privileges.
Catalog Groups
A catalog group is defined locally in Oracle BI Presentation Services and is used to grant privileges in the Oracle Business Intelligence user interface in addition to granting Oracle BI Presentation Catalog permissions.
Credential Store
An Oracle Business Intelligence credential store is a file used to securely store system credentials used by the software components. This file is automatically replicated across all machines in the installation.
Credential Store Provider
The credential store is used to store and manage credentials securely that are used internally between Oracle Business Intelligence components. For example, SSL certificates are stored here.
Encryption
A process that enables confidential communication by converting plaintext information (data) to unreadable text which can be read only with the use of a key. Secure Sockets Layer (SSL) enables secure communication over TCP/IP networks, such as web applications communicating through the Internet.
Globally Unique Identifier (GUID)
A GUID is typically a 32-character hexadecimal string that is system-generated to form a unique identifier for an object. In Oracle Business Intelligence a GUID is used to refer to individual users and groups.
Impersonation
Impersonation is a feature used by Oracle Business Intelligence components to establish a session on behalf of a user without employing the user's password. For example, impersonation is used when Oracle BI Scheduler executes an Agent.
Oracle WebLogic Server Domain
A logically related group of Oracle WebLogic Server resources that includes an instance known as the Administration Server. Domain resources are configured and managed in the Oracle WebLogic Server Administration Console. During installation an Oracle WebLogic Server domain is created and Oracle Business Intelligence is installed into that domain.
Identity Store
An identity store contains user name, password, and group membership information. In Oracle Business Intelligence, the identity store is typically a directory server and is what an authentication provider accesses during the authentication process. For example, when a user name and password combination is entered at log in, the authentication provider searches the identity store to verify the credentials provided. Oracle Business Intelligence can be reconfigured to use alternative identity stores. For a complete list, see System Requirements and Supported Platforms for Oracle Fusion Middleware 11gR1. For more information, see System Requirements and Certification.
Policy Store Provider
The policy store is the repository of system and application-specific policies. It holds the mapping definitions between the default Oracle Business Intelligence Application Roles, permissions, users and groups all configured as part of installation. Oracle Business Intelligence permissions are granted by mapping users and groups from the identity store to Application Roles and permission grants located in the policy store.
Policy Store
Contains the definition of Application Roles, Application Policies, and the members mapped (users, groups, and applications roles) to Application Roles. The default policy store is a file that is automatically replicated across all machines in an Oracle Business Intelligence installation. A policy store can be file-based or LDAP-based.
Presentation Catalog Permissions
These rights grant Presentation Services object level access. They are stored in the Presentation Catalog and managed by Oracle BI Presentation Server.
Presentation Catalog Privileges
These rights grant access to Presentation Catalog features. They are stored in the Presentation Catalog and managed by Oracle BI Presentation Server. These privileges are either granted or denied.
Secure Sockets Layer (SSL)
Provides secure communication links. Depending upon the options selected, SSL might provide a combination of encryption, authentication, and repudiation. For HTTP based links the secured protocol is known as HTTPS.
Security Policy
The security policy defines the collective group of access rights to Oracle Business Intelligence resources that an individual user or a particular Application Role have been granted. Where the access rights are controlled is determined by which Oracle Business Intelligence component is responsible for managing the resource being requested. A user's security policy is the combination of permission and privilege grants governed by the following elements:
  • Presentation Catalog: defines which catalog objects and Oracle BI Presentation Services functionality can be accessed by users. Access to this functionality is managed in Oracle Business Intelligence user interface. These permissions and privileges can be granted to individual users or by membership in corresponding Application Roles.
  • Repository File: defines access to the specified metadata within the repository file. Access to this functionality is managed in Oracle BI Administration Tool. These permissions and privileges can be granted to individual users or by membership in corresponding Application Roles.
  • Policy Store: defines which Oracle Business Intelligence, Oracle BI Publisher, and Real Time Decisions functionality can be accessed. Access to this functionality is managed in Oracle Enterprise Manager Fusion Middleware Control. These permissions and privileges can be granted to individual users or by membership in corresponding Application Roles.
Security Realm
During installation an Oracle WebLogic Server domain is created and Oracle Business Intelligence is installed into that domain. Security for an Oracle WebLogic Server domain is managed in its security realm. A security realm acts as a scoping mechanism. Each security realm consists of a set of configured security providers, users, groups, security roles, and security policies. Only one security realm can be active for the domain. Oracle Business Intelligence authentication is performed by the authentication provider configured for the default security realm for the WebLogic Server domain in which it is installed. Oracle WebLogic Server Administration Console is the administration tool for managing an Oracle WebLogic Server domain.
Single Sign-On
A method of authorization enabling a user to authenticate once and gain access to multiple software application during a single browser session.
Users and Groups
user is an entity that can be authenticated. A user can be a person, such as an application user, or a software entity, such as a client application. Every user is given a unique identifier within in the identity store.
Groups are organized collections of users that have something in common. A group is a static identifier that is assigned by a system administrator. Users organized into groups facilitate efficient security management. There are two types of groups: an LDAP group and a catalog group. A catalog group is used to support the existing user base in Presentation Services to grant privileges in the Oracle Business Intelligence user interface. Using catalog groups is not considered a best practice and is available for backward compatibility in upgraded systems.