SlideShare a Scribd company logo
Document:
                      “Implementing Security in
      Oracle Hyperion Essbase using Shared Service”


Description:
This document provides an overview of security model of Hyperion Essbase
using Shared Service. It also focuses on cell level security using Essbase filters
and common administrative activities associated to user/group
administrations.




History:
Version                Description          Author                      Publish Date
                       Change
0.1                    Initial Draft        Gaurav Shrivastava          30-Mar-2011
0.1                    Review I             Amit Sharma                 1st April




       ©Business Intelligence Solution Providers | learnhyperion.wordpress.com     1
.




Table of contents
    1)    Introduction
    2)    Launching Shared Service
    3)    Converting Security Mode
    4)    Benefits of externalizing the security:
    5)    Working with Shared Service
              a) Creating Group
              b) Creating User
    6)    Add new Role
    7)    How to create user through maxl?
    8)    Refresh Security from Shared Services
    9)    Apply Provision
    10)   Creating Filter
              a) Read Write Filter
              b) Read Filter
              c) Meta Data Read Filter
              d) Read and No_access Filter
              e) Read Write and No_access
              f) Metadata Read and write filter
              g) Filter on member Combination
              h) Filter on member Combination Separately
    11)   Administration Option
    12)   Configuring User Directories
    13)   Recover Native Directory
    14)   Configure Auditing
    15)   Assign Access Control
    16)    Understanding Roles
              a) Shared Service Roles
              b) Essbase Roles




.




          ©Business Intelligence Solution Providers | learnhyperion.wordpress.com   2
Introduction
   Shared service is a common system for managing user and group access to all oracle Hyperion
products, including Essbase. The database organization, application organization and managing
metadata can perform through shared services. Shared service has folder structure for Hyperion
products, all application, database, artifacts and user directory information. Folder views enable the
administrator to migrate an entire folder structure or a portion of a folder structure easily using Shared
Services. You can perform migration through shared service.

Launching Shared Service
You can launch shared services through below URL.
http://<server>:28080/interop/
Click Launch Application




Pass the credential ….




  This is the shared service console by you can manage all Hyperion products. You can perform all
administration tasks through this console such as user creation, user deletion, assigning roles managing

        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com                  3
groups etc. All application manages through folder structure and allow administrator to migrate an
entire folder structure or a portion of a folder structure easily using Shared Services.




Shared Services integrates the products to provide these functionalities:
   1. User provisioning
   2. External authentication definition
   3. Task flow management

The Shared Services server components:
    1. Databases (relational and OpenLDAP)
    2. Web application server
    3. User Management Console

Converting Security Mode: The default Essbase security mode is 'internal security' model. In this
model, we see Essbase creating users, managing their passwords, and their access all within the Essbase
product. Essbase uses Essbase.sec file to store security information locally in Essbase. It is therefore
possible to have an Essbase server not manage roles and access via Shared Services, but that option is
becoming increasingly uncommon. Its main use is for legacy Essbase servers to 'migrate' users from
their legacy versions into the System 11 world of Shared Services.
Alternatively we can externalize the security and let Shared Service manage the security for Essbase.

Benefits of externalizing the security:
            1) Backup/Restore Security: Provisioning information from Shared Services can be easily
               exported to XML using the utility that is packaged with Shared Services. This file
               contains all information about the LDAP users, groups, and provisioning. This same file
               could be used to import the provisioning in the event of a disaster recovery, file
               corruption or server upgrade
            2) Automatic Refresh / Synchronization: SHAREDSERVICESREFRESHINTERVAL setting in
               the Essbase.cfg file can establish an interval for periodic refreshes from Shared Services
               to Essbase. This setting is in number of minutes. To refresh every 30 minutes, the setting
               would be SHAREDSERVICESREFRESHINTERVAL 30
            3) Limited Admin Activities: Essbase Administration tasks confined to creation of Filters,
               Calculations, Load Rules, and Substitution Variables continue to be performed in the
               Essbase.

        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com                 4
4) Reduced Administration: User/Group administration can be pushed to LDAP from
                Essbase ‘internal security’ Thus, when a new user is to be added he or she will
                automatically get the proper Essbase security simply through the corporate security
                administrator establishing the user's id in the appropriate LDAP group.

Right click on security and select externalize users.




Click for conformation




Don’t change default conversion settings click ok.




Success message of convert security mode
        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com            5
Working with Shared Service

Creating Group
Right click on “Groups” and select “New”




Give group name and insert description about group then click next.




Select group members……
Assign group member….click next…..




       ©Business Intelligence Solution Providers | learnhyperion.wordpress.com   6
Assign user members for this new group……
Click finish




Success message




For validating new group go to the group native directory……




Creating User
Open shared service expend user directories then native directory.
Right click on user and click new




Insert user information and click next




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com   7
Assign user to the group. Click finish




Success message




User created successfully, open user native directory for validation.




Add new Role
These are the available roles in shared services. You also can add new role through shared services.




Right click and click new role.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com                  8
How to create user through Maxl?
You can create new user through Maxl script by following command.




Provide access rights to new user by following command.




 Verify that access rights correctly assign to the user. When you login with the same user it will show
only “Bisp” application.




       ©Business Intelligence Solution Providers | learnhyperion.wordpress.com                 9
Refresh Security from Shared Services
When you make changes in to shared service you have to refresh shared service security. Open Essbase
Right click on security select “Refresh security from shared services”.




If you made changes for current user select current user else select refresh security for all users.
Click ok…




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com                        10
Conform and click yes…




Success massage




Apply Provision
Through shared service you can apply provision to particular user. Right click on user




Select desired roles from the available roles and save the changes.[List of roles are given in appendix]




You can validate that “ram1” can access only “Bisp” and “Sample” application.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com                    11
1) Create user “Tom” through shared services Right click on user and assign the role to “Tom”.




Now log off from the existing user and login through new user “Tom”.




You can verify through right click on “Bisp” application and find that “Tom” is not administrator so that
some options are disable.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com                  12
Open users you can view the existing users but when you click on “Tom” or any other user only those
rights will enable for which “Tom” has access rights.




Creating Filter [Cell Level Security]
 You create filter through Maxl script and assign access right to any user. You can also create filter for
the specific condition. The task flow will be first create filter, assign access rights to the user then login
with the user and check filter is working.

1.Read Write Filter
Open Maxl script and write script for creating filter for give Read Write access.
Click ok….




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com                      13
Press enter…




Command for granting access right to the user “ORG”.
Click on Execute button……..




You can verify that user “ORG” has access rights to write on “Budget” through lock and send method.




       ©Business Intelligence Solution Providers | learnhyperion.wordpress.com                14
Data is loaded successfully.

Again load data in actual field through lock and send method.




When you update data in actual field and then try to lock it Essbase throw the below error.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com               15
2. Read Filter
Read only filter for the specify area. This filter is to restrict user for write in to database but user can
read “New York”. You have to write Maxl script to create filter and grant filter to the user.




Connect to “BispBD” database and try to update or write on “New York” data through lock and send
method. Essbase will throw the below message.




  3.      Meta Data Read Filter
This filter is to restrict user to access all cube data. User can access data for which he has access rights.
Through Maxl Script you can apply filter for metadata read only. Create new maxl script write command
for metadata read shown below then grant filter to any user.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com                     16
Login by user “ORG”




You can verify that “ORG” user should not access data other then “New York”.




3. Read and No_access Filter
Filter on user define attributes.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com   17
UDAs in outline of cube




Execute the Maxl script and see the impact on excel login through the user.




    4. Read Write and No_access
Create filter for providing read, write and no_access to the user “ORG”.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com   18
Verification of read access




Verification of write access




Database is modified.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com   19
Verification of no_access




5. Metadata Read and write filter
Filter for assign metadata.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com   20
Assigning filter to the user through console Double click on user “ORG”…..




This is the user information select “App/Db Access” tab.




Open application databases then assign filter to the user and click apply.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com   21
Login with ORG user and then try to access market. Only “East” data is visual to the user.




User also has update write, So update any value through lock and send method.




To verify that data get updated or not “Retrieve” and check updated cell.



        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com              22
6. Filter on member Combination
 You can also create filters on various combination of members. This is the filter for giving read access to
the user only for combination of product “100-10” and “New York”.




Below Maxl script for creating filter and assign to the user.




You can see in to outline the alias for “100-10” is cola.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com                    23
Login with “ORG” user and see the impact of filter on cube.




7. Filter on member Combination Separately
You can also write filer on the separate bases as shown in below Maxl script.




You can access complete data which has either “Cola” or “New York”.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com   24
Administration Option




       ©Business Intelligence Solution Providers | learnhyperion.wordpress.com   25
©Business Intelligence Solution Providers | learnhyperion.wordpress.com   26
Configuring User Directories
You can configure user directory if it is required.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com   27
Native directory is already configure though there is option to edit provider configuration.




Make changes and click finish.




Recover Native Directory
You also can recover native directory if something goes wrong.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com                28
Click on start recovery




Native directory recovered successfully.




This is the Log information of native dirctory.




You can change or configure native directory password.




Panel for changing password.




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com   29
Configure Auditing




       ©Business Intelligence Solution Providers | learnhyperion.wordpress.com   30
©Business Intelligence Solution Providers | learnhyperion.wordpress.com   31
Assign Access Control to Essbase Cube
Open shared service expend application group expend essbase server node Right click on application
and select “Assign Access Control”.




Select user from the available user then click next.




Select database




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com           32
Apply filter and calculation script




Select at least one user and click on Right check mark to validate settings.




Save the changes




        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com   33
Understanding Roles
Shared Services Roles
Administrator: is the power user. He can invoke shared services and perform administration tasks for all
Hyperion products. Shared service components are
Administrator Provides control over all products that integrate with Shared Services. It enables more
control over security than any other Hyperion product roles. Administrators can perform all
administrative tasks in User Management Console and can provision themselves. This role grants broad
access to all applications registered with Shared Services. The Administrator role is, by default, assigned
to the admin Native Directory user, which is the only user available after you deploy Shared Services.




Directory Manager: Creates and manages users and groups within Native Directory.
Do not assign to Directory Managers the Provisioning Manager role because combining these roles
allows Directory Managers to provision themselves. The recommended practice is to grant one user the
Directory Manager role and another user the Provisioning Manager role.
LCM Manager Runs the Artifact Life-Cycle Management utility to promote artifacts or data across
product environments and operating systems. LCM utility also use for migrate application on the same
environment or different environment.

Project Manager Users who are assigned the Project Manager role can create and manage projects
within Shared Services


        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com                   34
Create Integrations Creates Shared Services data integrations (the process of moving data between
applications) using a wizard. For Oracle's Enterprise Performance Management Architect, creates and
executes data synchronizations.
Run Integrations Views and runs Shared Services data integrations. For Performance Management
Architect, executes data synchronizations.
Dimension Editor Creates and manages import profiles for dimension creation. Also, creates and
manages dimensions manually within the Performance Management Architect user interface or the
Classic Application Administration option. Required to access Classic Application Administration options
for Financial Management and Planning using Web navigation.

Application Creator Creates and deploys Performance Management Architect applications. Users with
this role can create applications, but can change only the dimensions to which they have access
permissions. Required, in addition to the Dimension Editor role, for Financial Management and planning
users to be able to Navigate to their product’s Classic Application Administration options. When a user
with Application Creator role deploys an application from Performance Management Architect, that
user automatically becomes the application administrator and provisioning manager for that
application. The Application Creator can create all applications.

Analytic Services Application Creator: The Analytic Services Application Creator can create Generic
Performance Management Architect applications.
Financial Management Application Creator: The Financial Management Application Creator can create
Consolidation applications and Performance Management Architect Generic applications. To create
applications, the user must also be a member of the Application Creators group specified in Financial
Management Configuration Utility.

Planning Application Creator: The Planning Application Creator can create Planning applications and
Performance Management Architect Generic applications.

Essbase Roles
Power Roles
Administrator Grants full access to administer the server, applications and databases
Application Manager Creates deletes and modifies databases, and application settings within the
assigned application. Includes Database Manager Permissions for the databases within the assigned
application
Create/Delete Application Creates and deletes applications and databases within applications. Includes
Manager Permissions for the applications and databases created by this user
Database Manager Manages the databases, database objects, locks and sessions within the assigned
application Load/Unload Application Start and stops an application or databases.

Interactive Roles
Calc: - Calculates, updates and reads data values based on the assigned scope, using any assigned
calculations and filter
Write: -Updates and reads data values based on the assigned scope, using any assigned filter
Filter: - Accesses specific data and meta data according to the restrictions of a filter

View Roles
Read: - Read data values
Server Access: - Accesses any database that has a default access other than none

        ©Business Intelligence Solution Providers | learnhyperion.wordpress.com                 35
©Business Intelligence Solution Providers | learnhyperion.wordpress.com   36

More Related Content

PPTX
03. data forms in hyperion planning
PDF
Hyperion LCM Utility
DOCX
Security of hyperion planning
DOCX
Calculation commands in essbase
PDF
Data options with hyperion planning and essbase
PPT
Hyperion LCM Utility
PDF
Essbase aso a quick reference guide part i
DOCX
Optimization in essbase
03. data forms in hyperion planning
Hyperion LCM Utility
Security of hyperion planning
Calculation commands in essbase
Data options with hyperion planning and essbase
Hyperion LCM Utility
Essbase aso a quick reference guide part i
Optimization in essbase

What's hot (20)

DOC
Planning learn step by step
PDF
SAP HANA SPS09 - Backup and Recovery
PPT
Oracle Hyperion Planning Best Practices
PDF
Essbase log files
DOC
Essbase beginner's guide olap fundamental chapter 1
DOCX
Backend roles for sap bpc
PDF
Fiori and S/4 authorizations: What are the biggest challenges, and where do t...
PDF
Basics of fdmee
PPTX
Sap abap
PDF
Sap bi step by step procedure for data archiving by adk and reloading archive...
PPTX
OPEN TEXT ADMINISTRATION
PPTX
Dimensionality & Dimensions of Hyperion Planning
DOC
Scenario on business transaction events
PDF
Essbase ASO and BSO tuning
PDF
How to free up memory in SAP HANA
PPTX
Microsoft Dynamics AX 2012 - Development Introduction Training - Part 2/3
PPTX
SAP BADI Implementation Learning for Functional Consultant
PDF
Finit solutions getting the most out of hfm process management and phased sub...
DOC
Hyperion essbase basics
PDF
Oracle Self Service HR Document
Planning learn step by step
SAP HANA SPS09 - Backup and Recovery
Oracle Hyperion Planning Best Practices
Essbase log files
Essbase beginner's guide olap fundamental chapter 1
Backend roles for sap bpc
Fiori and S/4 authorizations: What are the biggest challenges, and where do t...
Basics of fdmee
Sap abap
Sap bi step by step procedure for data archiving by adk and reloading archive...
OPEN TEXT ADMINISTRATION
Dimensionality & Dimensions of Hyperion Planning
Scenario on business transaction events
Essbase ASO and BSO tuning
How to free up memory in SAP HANA
Microsoft Dynamics AX 2012 - Development Introduction Training - Part 2/3
SAP BADI Implementation Learning for Functional Consultant
Finit solutions getting the most out of hfm process management and phased sub...
Hyperion essbase basics
Oracle Self Service HR Document
Ad

Viewers also liked (20)

PDF
Alimentos mayores
PDF
Sager CATÁLOGO HOSTELERÍA
PPT
Russian Revolution
PDF
Introducing Google Nexus 5
PPTX
EFFLE TOWER Vs WORLD .ppt
PPTX
Cenário econômico Africano
DOCX
stare decisis
DOCX
Automobile cruise control
PDF
Exámenes (casos especiales)
PPTX
Nework diag presentan 013
PPTX
Las Cruzadas
PPTX
Gincana tabela periódica
PPTX
Putrefaction pp
PPTX
Website monetization
DOCX
Praktek Kalorimeter Fisika Dasar
PDF
Picking the Right Node.js Framework for Your Use Case
PPTX
Palestra de Associativismo - Comitê Gestor da LGMPE de Cambará
PPTX
Krishnamraju.g
PDF
Catalogo portaprecios
Alimentos mayores
Sager CATÁLOGO HOSTELERÍA
Russian Revolution
Introducing Google Nexus 5
EFFLE TOWER Vs WORLD .ppt
Cenário econômico Africano
stare decisis
Automobile cruise control
Exámenes (casos especiales)
Nework diag presentan 013
Las Cruzadas
Gincana tabela periódica
Putrefaction pp
Website monetization
Praktek Kalorimeter Fisika Dasar
Picking the Right Node.js Framework for Your Use Case
Palestra de Associativismo - Comitê Gestor da LGMPE de Cambará
Krishnamraju.g
Catalogo portaprecios
Ad

Similar to Essbase security implementation (20)

PDF
Essbase security-implementation
PPT
Controlling accesst 1 aug
PDF
Security and Auditing in HFM
PDF
Essbase administration
PDF
Automating Security Management in PBCS!
PDF
Essbase administration
PDF
Essbase installation 11.1.1.3 chapter
PDF
Security Guide for Oracle Fusion - E10543
PDF
Advanced persistent threats
PDF
Epm fm-1111x-provisioning-whitepape-133674
PDF
Who will guard the guards
PDF
Stay Two Steps Ahead of Your Auditor
PDF
Fusion apps security_con8714_pdf_8714_0001
PPTX
Is Your E-Business Suite Data Visible After An M&A Event?
PDF
Xi3 ds administrators_guide_en
PDF
Grc 300 Sap Sccess Control Implementation And Configuration Participant Handb...
PPT
Hyperion Planning Security
PPTX
Delegation
PDF
SAP Business One Basics Administration Refresher Training by AGS
PDF
The Works 2019 - Breakout Session: Security Clearance
Essbase security-implementation
Controlling accesst 1 aug
Security and Auditing in HFM
Essbase administration
Automating Security Management in PBCS!
Essbase administration
Essbase installation 11.1.1.3 chapter
Security Guide for Oracle Fusion - E10543
Advanced persistent threats
Epm fm-1111x-provisioning-whitepape-133674
Who will guard the guards
Stay Two Steps Ahead of Your Auditor
Fusion apps security_con8714_pdf_8714_0001
Is Your E-Business Suite Data Visible After An M&A Event?
Xi3 ds administrators_guide_en
Grc 300 Sap Sccess Control Implementation And Configuration Participant Handb...
Hyperion Planning Security
Delegation
SAP Business One Basics Administration Refresher Training by AGS
The Works 2019 - Breakout Session: Security Clearance

More from Amit Sharma (20)

PDF
Oracle enteprise pbcs drivers and assumptions
PDF
Oracle EPBCS Driver
PDF
Oracle Sales Quotation Planning
PDF
Oracle strategic workforce planning cloud hcmswp converted
PDF
FDMEE script examples
PDF
Oracle PBCS creating standard application
PPT
Hfm rule custom consolidation
PPT
Hfm calculating RoA
PPT
Adding metadata using smartview
PPT
Hyperion planning weekly distribution
PPT
Hyperion planning scheduling data import
PPT
Hyperion planning new features
TXT
Microsoft dynamics crm videos
PDF
Oracle apex-hands-on-guide lab#1
PDF
Oracle apex hands on lab#2
PDF
Security and-data-access-document
PDF
Sales force managing-data
PDF
Salesforce interview-preparation-toolkit-formula-and-validation-rules-in-sale...
PDF
Sales force certification-lab-ii
PDF
Sales force certification-lab
Oracle enteprise pbcs drivers and assumptions
Oracle EPBCS Driver
Oracle Sales Quotation Planning
Oracle strategic workforce planning cloud hcmswp converted
FDMEE script examples
Oracle PBCS creating standard application
Hfm rule custom consolidation
Hfm calculating RoA
Adding metadata using smartview
Hyperion planning weekly distribution
Hyperion planning scheduling data import
Hyperion planning new features
Microsoft dynamics crm videos
Oracle apex-hands-on-guide lab#1
Oracle apex hands on lab#2
Security and-data-access-document
Sales force managing-data
Salesforce interview-preparation-toolkit-formula-and-validation-rules-in-sale...
Sales force certification-lab-ii
Sales force certification-lab

Recently uploaded (20)

PDF
GDG Cloud Iasi [PUBLIC] Florian Blaga - Unveiling the Evolution of Cybersecur...
PDF
KodekX | Application Modernization Development
PPTX
Understanding_Digital_Forensics_Presentation.pptx
PDF
Spectral efficient network and resource selection model in 5G networks
PPTX
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
PDF
NewMind AI Weekly Chronicles - August'25 Week I
PPTX
Cloud computing and distributed systems.
PDF
Mobile App Security Testing_ A Comprehensive Guide.pdf
PDF
Review of recent advances in non-invasive hemoglobin estimation
PPTX
breach-and-attack-simulation-cybersecurity-india-chennai-defenderrabbit-2025....
PDF
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
PDF
Shreyas Phanse Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
PDF
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
PDF
Approach and Philosophy of On baking technology
PPTX
MYSQL Presentation for SQL database connectivity
PPT
“AI and Expert System Decision Support & Business Intelligence Systems”
PDF
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
PDF
Electronic commerce courselecture one. Pdf
PDF
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
GDG Cloud Iasi [PUBLIC] Florian Blaga - Unveiling the Evolution of Cybersecur...
KodekX | Application Modernization Development
Understanding_Digital_Forensics_Presentation.pptx
Spectral efficient network and resource selection model in 5G networks
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
NewMind AI Weekly Chronicles - August'25 Week I
Cloud computing and distributed systems.
Mobile App Security Testing_ A Comprehensive Guide.pdf
Review of recent advances in non-invasive hemoglobin estimation
breach-and-attack-simulation-cybersecurity-india-chennai-defenderrabbit-2025....
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Shreyas Phanse Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Approach and Philosophy of On baking technology
MYSQL Presentation for SQL database connectivity
“AI and Expert System Decision Support & Business Intelligence Systems”
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
Electronic commerce courselecture one. Pdf
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
Build a system with the filesystem maintained by OSTree @ COSCUP 2025

Essbase security implementation

  • 1. Document: “Implementing Security in Oracle Hyperion Essbase using Shared Service” Description: This document provides an overview of security model of Hyperion Essbase using Shared Service. It also focuses on cell level security using Essbase filters and common administrative activities associated to user/group administrations. History: Version Description Author Publish Date Change 0.1 Initial Draft Gaurav Shrivastava 30-Mar-2011 0.1 Review I Amit Sharma 1st April ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 1
  • 2. . Table of contents 1) Introduction 2) Launching Shared Service 3) Converting Security Mode 4) Benefits of externalizing the security: 5) Working with Shared Service a) Creating Group b) Creating User 6) Add new Role 7) How to create user through maxl? 8) Refresh Security from Shared Services 9) Apply Provision 10) Creating Filter a) Read Write Filter b) Read Filter c) Meta Data Read Filter d) Read and No_access Filter e) Read Write and No_access f) Metadata Read and write filter g) Filter on member Combination h) Filter on member Combination Separately 11) Administration Option 12) Configuring User Directories 13) Recover Native Directory 14) Configure Auditing 15) Assign Access Control 16) Understanding Roles a) Shared Service Roles b) Essbase Roles . ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 2
  • 3. Introduction Shared service is a common system for managing user and group access to all oracle Hyperion products, including Essbase. The database organization, application organization and managing metadata can perform through shared services. Shared service has folder structure for Hyperion products, all application, database, artifacts and user directory information. Folder views enable the administrator to migrate an entire folder structure or a portion of a folder structure easily using Shared Services. You can perform migration through shared service. Launching Shared Service You can launch shared services through below URL. http://<server>:28080/interop/ Click Launch Application Pass the credential …. This is the shared service console by you can manage all Hyperion products. You can perform all administration tasks through this console such as user creation, user deletion, assigning roles managing ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 3
  • 4. groups etc. All application manages through folder structure and allow administrator to migrate an entire folder structure or a portion of a folder structure easily using Shared Services. Shared Services integrates the products to provide these functionalities: 1. User provisioning 2. External authentication definition 3. Task flow management The Shared Services server components: 1. Databases (relational and OpenLDAP) 2. Web application server 3. User Management Console Converting Security Mode: The default Essbase security mode is 'internal security' model. In this model, we see Essbase creating users, managing their passwords, and their access all within the Essbase product. Essbase uses Essbase.sec file to store security information locally in Essbase. It is therefore possible to have an Essbase server not manage roles and access via Shared Services, but that option is becoming increasingly uncommon. Its main use is for legacy Essbase servers to 'migrate' users from their legacy versions into the System 11 world of Shared Services. Alternatively we can externalize the security and let Shared Service manage the security for Essbase. Benefits of externalizing the security: 1) Backup/Restore Security: Provisioning information from Shared Services can be easily exported to XML using the utility that is packaged with Shared Services. This file contains all information about the LDAP users, groups, and provisioning. This same file could be used to import the provisioning in the event of a disaster recovery, file corruption or server upgrade 2) Automatic Refresh / Synchronization: SHAREDSERVICESREFRESHINTERVAL setting in the Essbase.cfg file can establish an interval for periodic refreshes from Shared Services to Essbase. This setting is in number of minutes. To refresh every 30 minutes, the setting would be SHAREDSERVICESREFRESHINTERVAL 30 3) Limited Admin Activities: Essbase Administration tasks confined to creation of Filters, Calculations, Load Rules, and Substitution Variables continue to be performed in the Essbase. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 4
  • 5. 4) Reduced Administration: User/Group administration can be pushed to LDAP from Essbase ‘internal security’ Thus, when a new user is to be added he or she will automatically get the proper Essbase security simply through the corporate security administrator establishing the user's id in the appropriate LDAP group. Right click on security and select externalize users. Click for conformation Don’t change default conversion settings click ok. Success message of convert security mode ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 5
  • 6. Working with Shared Service Creating Group Right click on “Groups” and select “New” Give group name and insert description about group then click next. Select group members…… Assign group member….click next….. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 6
  • 7. Assign user members for this new group…… Click finish Success message For validating new group go to the group native directory…… Creating User Open shared service expend user directories then native directory. Right click on user and click new Insert user information and click next ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 7
  • 8. Assign user to the group. Click finish Success message User created successfully, open user native directory for validation. Add new Role These are the available roles in shared services. You also can add new role through shared services. Right click and click new role. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 8
  • 9. How to create user through Maxl? You can create new user through Maxl script by following command. Provide access rights to new user by following command. Verify that access rights correctly assign to the user. When you login with the same user it will show only “Bisp” application. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 9
  • 10. Refresh Security from Shared Services When you make changes in to shared service you have to refresh shared service security. Open Essbase Right click on security select “Refresh security from shared services”. If you made changes for current user select current user else select refresh security for all users. Click ok… ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 10
  • 11. Conform and click yes… Success massage Apply Provision Through shared service you can apply provision to particular user. Right click on user Select desired roles from the available roles and save the changes.[List of roles are given in appendix] You can validate that “ram1” can access only “Bisp” and “Sample” application. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 11
  • 12. 1) Create user “Tom” through shared services Right click on user and assign the role to “Tom”. Now log off from the existing user and login through new user “Tom”. You can verify through right click on “Bisp” application and find that “Tom” is not administrator so that some options are disable. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 12
  • 13. Open users you can view the existing users but when you click on “Tom” or any other user only those rights will enable for which “Tom” has access rights. Creating Filter [Cell Level Security] You create filter through Maxl script and assign access right to any user. You can also create filter for the specific condition. The task flow will be first create filter, assign access rights to the user then login with the user and check filter is working. 1.Read Write Filter Open Maxl script and write script for creating filter for give Read Write access. Click ok…. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 13
  • 14. Press enter… Command for granting access right to the user “ORG”. Click on Execute button…….. You can verify that user “ORG” has access rights to write on “Budget” through lock and send method. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 14
  • 15. Data is loaded successfully. Again load data in actual field through lock and send method. When you update data in actual field and then try to lock it Essbase throw the below error. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 15
  • 16. 2. Read Filter Read only filter for the specify area. This filter is to restrict user for write in to database but user can read “New York”. You have to write Maxl script to create filter and grant filter to the user. Connect to “BispBD” database and try to update or write on “New York” data through lock and send method. Essbase will throw the below message. 3. Meta Data Read Filter This filter is to restrict user to access all cube data. User can access data for which he has access rights. Through Maxl Script you can apply filter for metadata read only. Create new maxl script write command for metadata read shown below then grant filter to any user. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 16
  • 17. Login by user “ORG” You can verify that “ORG” user should not access data other then “New York”. 3. Read and No_access Filter Filter on user define attributes. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 17
  • 18. UDAs in outline of cube Execute the Maxl script and see the impact on excel login through the user. 4. Read Write and No_access Create filter for providing read, write and no_access to the user “ORG”. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 18
  • 19. Verification of read access Verification of write access Database is modified. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 19
  • 20. Verification of no_access 5. Metadata Read and write filter Filter for assign metadata. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 20
  • 21. Assigning filter to the user through console Double click on user “ORG”….. This is the user information select “App/Db Access” tab. Open application databases then assign filter to the user and click apply. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 21
  • 22. Login with ORG user and then try to access market. Only “East” data is visual to the user. User also has update write, So update any value through lock and send method. To verify that data get updated or not “Retrieve” and check updated cell. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 22
  • 23. 6. Filter on member Combination You can also create filters on various combination of members. This is the filter for giving read access to the user only for combination of product “100-10” and “New York”. Below Maxl script for creating filter and assign to the user. You can see in to outline the alias for “100-10” is cola. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 23
  • 24. Login with “ORG” user and see the impact of filter on cube. 7. Filter on member Combination Separately You can also write filer on the separate bases as shown in below Maxl script. You can access complete data which has either “Cola” or “New York”. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 24
  • 25. Administration Option ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 25
  • 26. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 26
  • 27. Configuring User Directories You can configure user directory if it is required. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 27
  • 28. Native directory is already configure though there is option to edit provider configuration. Make changes and click finish. Recover Native Directory You also can recover native directory if something goes wrong. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 28
  • 29. Click on start recovery Native directory recovered successfully. This is the Log information of native dirctory. You can change or configure native directory password. Panel for changing password. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 29
  • 30. Configure Auditing ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 30
  • 31. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 31
  • 32. Assign Access Control to Essbase Cube Open shared service expend application group expend essbase server node Right click on application and select “Assign Access Control”. Select user from the available user then click next. Select database ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 32
  • 33. Apply filter and calculation script Select at least one user and click on Right check mark to validate settings. Save the changes ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 33
  • 34. Understanding Roles Shared Services Roles Administrator: is the power user. He can invoke shared services and perform administration tasks for all Hyperion products. Shared service components are Administrator Provides control over all products that integrate with Shared Services. It enables more control over security than any other Hyperion product roles. Administrators can perform all administrative tasks in User Management Console and can provision themselves. This role grants broad access to all applications registered with Shared Services. The Administrator role is, by default, assigned to the admin Native Directory user, which is the only user available after you deploy Shared Services. Directory Manager: Creates and manages users and groups within Native Directory. Do not assign to Directory Managers the Provisioning Manager role because combining these roles allows Directory Managers to provision themselves. The recommended practice is to grant one user the Directory Manager role and another user the Provisioning Manager role. LCM Manager Runs the Artifact Life-Cycle Management utility to promote artifacts or data across product environments and operating systems. LCM utility also use for migrate application on the same environment or different environment. Project Manager Users who are assigned the Project Manager role can create and manage projects within Shared Services ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 34
  • 35. Create Integrations Creates Shared Services data integrations (the process of moving data between applications) using a wizard. For Oracle's Enterprise Performance Management Architect, creates and executes data synchronizations. Run Integrations Views and runs Shared Services data integrations. For Performance Management Architect, executes data synchronizations. Dimension Editor Creates and manages import profiles for dimension creation. Also, creates and manages dimensions manually within the Performance Management Architect user interface or the Classic Application Administration option. Required to access Classic Application Administration options for Financial Management and Planning using Web navigation. Application Creator Creates and deploys Performance Management Architect applications. Users with this role can create applications, but can change only the dimensions to which they have access permissions. Required, in addition to the Dimension Editor role, for Financial Management and planning users to be able to Navigate to their product’s Classic Application Administration options. When a user with Application Creator role deploys an application from Performance Management Architect, that user automatically becomes the application administrator and provisioning manager for that application. The Application Creator can create all applications. Analytic Services Application Creator: The Analytic Services Application Creator can create Generic Performance Management Architect applications. Financial Management Application Creator: The Financial Management Application Creator can create Consolidation applications and Performance Management Architect Generic applications. To create applications, the user must also be a member of the Application Creators group specified in Financial Management Configuration Utility. Planning Application Creator: The Planning Application Creator can create Planning applications and Performance Management Architect Generic applications. Essbase Roles Power Roles Administrator Grants full access to administer the server, applications and databases Application Manager Creates deletes and modifies databases, and application settings within the assigned application. Includes Database Manager Permissions for the databases within the assigned application Create/Delete Application Creates and deletes applications and databases within applications. Includes Manager Permissions for the applications and databases created by this user Database Manager Manages the databases, database objects, locks and sessions within the assigned application Load/Unload Application Start and stops an application or databases. Interactive Roles Calc: - Calculates, updates and reads data values based on the assigned scope, using any assigned calculations and filter Write: -Updates and reads data values based on the assigned scope, using any assigned filter Filter: - Accesses specific data and meta data according to the restrictions of a filter View Roles Read: - Read data values Server Access: - Accesses any database that has a default access other than none ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 35
  • 36. ©Business Intelligence Solution Providers | learnhyperion.wordpress.com 36