Access privileges lost in business rules

Hello everyone,
I noticed that my security for business rules have disappeared. Only my native admin account is able to see the groups that have access to BR through the EAS console. When I logon with my account or the main hyperion admin account (MSAD) I don't see the groups. I ran the sync utility and stopped and restarted the services but with no success.
Last Friday I copied over a production planning app into our dev environment and it seems that screwed up the business rules security.
Console version is 9.3.1.3
Does anyone have an idea on what is going on?

I think it will be more of an issue when you migrated the business rules 2 weeks ago, did you check the security after you migrated them, it can get lost on a migration.
Cheers
John
http://john-goodwin.blogspot.com/

Similar Messages

Hyperion Business Rules Error

Good day!
I have an error every time I validate the business rules in essbase.
This is the error when I validate the Business rules :
Unable to run or validate this rule (VSHI1_CopyData) against the following location: Essbase/vincentp.misnet.com.ph/VSHI1/IncStmt for user admin.
I have checked the hbrserver log and this is what I found:
2008-10-24 14:01:58,067 WARN [ACTIVE] ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.core.AccessControlManagerServer - Error authenticating user in UserServerManager.
2008-10-24 14:01:58,130 WARN [ACTIVE] ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.core.UserManagerServer - Error authenticating user in UserServerManager.
2008-10-24 14:04:20,674 WARN [ACTIVE] ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.core.AccessControlManagerServer - Error authenticating user in UserServerManager.
2008-10-24 14:04:20,674 WARN [ACTIVE] ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.core.UserManagerServer - Error authenticating user in UserServerManager.
2008-10-24 14:05:08,938 WARN [ACTIVE] ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.core.AccessControlManagerServer - Error authenticating user in UserServerManager.
2008-10-24 14:05:08,938 WARN [ACTIVE] ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.core.UserManagerServer - Error authenticating user in UserServerManager.
2008-10-24 14:07:04,358 WARN [ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.core.AccessControlManagerServer - Error authenticating user in UserServerManager.
2008-10-24 14:07:04,358 WARN [ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.core.UserManagerServer - Error authenticating user in UserServerManager.
2008-12-05 17:17:08,672 WARN Thread-16 com.hyperion.hbr.db.DBConnectionManager - Removed bad connection from Connection Pool: vincentp.misnet.com.ph14331cp_tools
2008-12-05 17:17:09,047 WARN Thread-16 com.hyperion.hbr.db.DBConnectionManager - Removed bad connection from Connection Pool: vincentp.misnet.com.ph14331cp_tools
2008-12-15 10:45:42,502 WARN [ACTIVE] ExecuteThread: '5' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.security.HbrSecurityAPI - Exception occured: 25:1065:Identity: admingroup, is invalid.
2008-12-15 10:45:42,502 WARN [ACTIVE] ExecuteThread: '5' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.security.HbrSecurityAPI - Error retrieving group by identity
2008-12-15 10:45:42,518 WARN [ACTIVE] ExecuteThread: '5' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.core.AccessControlManagerServer - Unable to run or validate this rule (VSHI1_CopyData) against the following location: Essbase/vincentp.misnet.com.ph/VSHI1_1/IncStmt for user admin.
2008-12-15 10:46:41,152 WARN [ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.security.HbrSecurityAPI - Exception occured: 25:1065:Identity: admingroup, is invalid.
2008-12-15 10:46:41,152 WARN [ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.security.HbrSecurityAPI - Error retrieving group by identity
2008-12-15 10:46:41,152 WARN [ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.core.AccessControlManagerServer - Unable to run or validate this rule (VSHI1_CopyData) against the following location: Essbase/vincentp.misnet.com.ph/VSHI1/IncStmt for user admin.
2008-12-15 10:47:34,815 WARN [ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.security.HbrSecurityAPI - Exception occured: 25:1065:Identity: admingroup, is invalid.
2008-12-15 10:47:34,830 WARN [ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.security.HbrSecurityAPI - Error retrieving group by identity
2008-12-15 10:47:41,599 WARN [ACTIVE] ExecuteThread: '5' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.core.AccessControlManagerServer - Unable to run or validate this rule (VSHI1_CopyData) against the following location: Essbase/vincentp.misnet.com.ph/VSHI1/IncStmt for user admin.
2008-12-15 11:01:05,637 WARN [ACTIVE] ExecuteThread: '5' for queue: 'weblogic.kernel.Default (self-tuning)' com.hyperion.hbr.core.AccessControlManagerServer - Unable to run or validate this rule (VSHI1_CopyData) against the following location: Essbase/vincentp.misnet.com.ph/VSHI1/IncStmt for user admin.
Sorry for the long log message.
I am using the admin user. Is there a possibility that the admin has no privilege for the business rule? (Which is unusual because it should have all the privileges).
Can anyone tell me how to fix this issue?
Thanks in advance.

I think you have to give access even to the admin user to validate/run a business rule
try giving access to that rule and then validate

Upgrade Business rules with Calc Manager

Hello Gurus,
Recently performed an upgrade from 11.1.1.3 to 11.1.2.2 by replicating the Database to a new database machine.
I had Business rules in 11.1.1.3 and did not perform any steps to migrate the rules to Calculation manager in 11.1.2.2
The doubt I have is,
1. Are the business rules automatically upgraded when performing upgrade by EPM system configurator (since the database is replicated)
2. If so, how do I see the business rules in 11.1.2.2 environment? How can I use migrate feature option.
Thanks
HyperionEPM.

From 11.1.2.2 documentation:
Upgrade Wizard
If your application used Oracle Hyperion Business Rules, the Upgrade Wizard automatically converts Business Rules business rules to Oracle Hyperion Calculation Manager business rules. Release 11.1.2.2 supports onlyBusiness Rules business rules as the calculation module.
Notes:
•Classic application administration is now called Oracle Hyperion Planning application administration (versus Oracle Hyperion EPM Architect application administration).
•The Upgrade Wizard automatically upgrades applications having Oracle Hyperion Business Rules business rules, converting them to Calculation Manager business rules. However, the Upgrade Wizard does not automatically convert Release 11.1.2.1 applications having Oracle Hyperion Calculation Manager business rules. For those upgrade instructions, see the Oracle Enterprise Performance Management System Installation and Configuration Guide.
Business Rules Maintenance Release and Upgrade Installation PrerequisitesIf you are using Business Rules, you must migrate to Calculation Manager rules in Release 11.1.2.2. Before migrating business rules, you must perform prerequisite tasks. Note that these tasks are required if you are applying the maintenance release or if you are upgrading.
To prepare to migrate Business Rules, perform the following tasks in your current Business Rules environment before installing Release 11.1.2.2:
1.in Business Rules, within the Rule Editor, remove the associated outline (that is, the design time location) from each business rule. After you do this, the Associated Outline drop-down list should display the text, Select Outline.
2.On the Locations tab of the Rule Editor, ensure that each business rule has a valid launch location, which must be an absolute location. Although “All Locations” is valid in Business Rules, when you migrate business rules, you must provide the details of a specific launch location (that is, the application type---Planning or Essbase, the server name, the application name, and the database or plan type). If you want a business rule to be valid for multiple launch locations, you must provide the details for each location. The locations must be in different applications; you cannot migrate the same business rule to different plan types in the same application within Calculation Manager.
If the rule is a part of a sequence, then the launch location of the rule within the sequence must be one of the launch locations listed in the Locations tab of the rule.
3.On the Access Privileges tab of the Rule Editor, ensure that each business rule has security defined for a specific location or locations and not “All Locations.” If multiple locations are defined for a business rule on its Locations tab, you must add security for each location individually.
4.Do not modify rules in Calculation Manager until migration is completed.
5.If you are using Business Rules with Planning, as a precaution, create a backup of the rules: Use Administration Services to export the rules to XML in Business Rules format. If you are upgrading from 11.1.1.3 or 11.1.1.4, also export the rules to Calculation Manager format. EPM System Configurator exports the rules during database configuration for use during application upgrade.
6.If you are an Essbase-only Business Rules user, you must export business rules. To export the Essbase rule from Business Rules:
a.From Administration Services Console, right-click the Business Rules node and select Export.
b.Export the rules in Business Rules format and then select all of the Essbase rules in the repository. If you are upgrading from 11.1.1.3 or 11.1.1.4, also export the rules to Calculation Manager format.
c.Specify the location to save the XML file, and then click OK. If you are upgrading, the location should be a shared drive that is accessible from the upgraded environment.
Make a note of the location. You import the file later in the process.
Migrating Business Rules to Calculation Manager for use with Planning
If you applied the maintenance release to move from Planning Release 11.1.2.0 or 11.1.2.1 to Release 11.1.2.2, and you were using Business Rules rules, you must migrate the rules to Calculation Manager rules.
Before you migrate, ensure that user directories and native users with the same SID are available when you upgrade Shared Services.
Ensure that the Planning applications are upgraded to the current release and are available in Calculation Manager under SYSTEM View.
To migrate Business Rules rules to Calculation Manager rules:
1.In Calculation Manager, select the migrated Planning application, and then select Migrate.
The data that was exported during database configuration with EPM System Configurator is imported to Calculation Manager.
2.Repeat for each Planning application.
3.Deploy the rules from Calculation Manager to Planning. See the Oracle Hyperion Calculation Manager Designer's Guide.
After migrating business rules and rules security, if any of the rules had multiple launch locations and you migrated to more than one location, Calculation Manager creates a rule for the first migration, and shortcuts for all subsequent migrations. If the rule had rule-level variables, for the shortcuts that are created in the application in the new environment , its variables are moved to the Plan level. In this scenario, test rules in your environment to ensure that they work as expected.
If you still have problems, raise an SR and we can get on a call to figure out why the rules are not coming over.
-Sree

Oracle EPM 11.1.1: Business Rules issue

Hi All,
I have installed Oracle EPM 11.1.1 and I have created a planning application. However when I logon to Analytical Administration console and try to create a business rule I am facing the following issue:
1. When I try to select Planning Application out I get the following errors:
Error connecting to Essbase server <Server name>/<Application Name>.
Detail:Could not log in to Planning Server
2. As a work around I have set the Essbase outline and the rule is getting validated from AAS. This rule has been attached to a form and should be executed when I do a submit. However the rule is not running from the form. I tried running the rule from Planning web and again I am getting an error.
I checked the access rights for the Business Rule from shared services and the admin user (which I am using) has Provision and Administrator rights. Is it a configuration issue or is there something that I am missing here.
Thanks in advance,
Amol

NewUser2 wrote:
Try to add a description to the Business Rule. There is a bug associated with it and you can find out in the Planning Readme. We had the same issue and got resolved by adding a description to the BR. Hope this will work for you.But the problem is he can't even create a business rule so how can he add a description to something he can't create?
Cheers
John
http://john-goodwin.blogspot.com/

How do I FIX members in a Business Rule to those set in outline security?

Let's say..
- I've granted write access to one user a branch of members in one dimension.
- I include a Level 0 selection of that dimension in a data form in the Page view, which correctly allows input only to those members for that user.
How can my BR fix only on those bottom level members appearing in the dataform?
J

Hi,
one possibility is to create RTPs in your Business Rule, insert these (global variables) in your fix statement, connect the Business Rule to your dataform and check in business rule properties tab the boxes for "Run on Save", "Use Members on Data Form" and "Hide Prompt".
Then your users can only select members in pages for that they have access rights and the business rule calculates the selected member combination.
Kind regards
André

Business Rules Access Privileges Strange Issue

Hello,
i know it's weird but it seems that planning has problems with Access Privileges on Business Rules.
This morning i found that some Privileges were missing (groups disappeared from Access Privileges tab on BR). When i try to fix this (adding it again), i have to repeat the operation more than one time to make it works.
What it could be? Sync problem with repository? ...i had no errors on message panel.
I run Hyperion Planning 9.3.1.1.8 on windows environment.
thank u,
daniele

Hi,
I would of recycled the services first to see if it was a communication issue.
Cheers
John
http://john-goodwin.blogspot.com/

How to Migrate Business rules along with access privileges

Hi All,
I migrated business rules from prod to dev using lcm. The business rules got migrated correctly, but the access privileges did not. I tried exporting from EAS and import. Even then the access privileges were not migrated.How do we migrate business rules along with access privileges? Quick help is much appreciated.
We are on hyp. planning 11.1.1.3. and we use classic planning applications.
Thanks
Lakshmi

If they are native users/groups then it may be down to the ID for the users/groups being different across environments, this has always been a problem with business rules, with planning applications then there is the updateusers utility to sync up the ID with shared services.
Cheers
John
http://john-goodwin.blogspot.com/

Business rule access privilege

Hi,
Please help me to understand; how to assign user privilege for Business rule.
I mean should i assign users for Planning, essbase and Planning?
Edited by: Kumar 1 on Nov 22, 2010 3:51 AM

In shared services provision user1 with a role for the planning application, if you are on 9.3 (which I think you are) you might also need to provision a hbr role e.g http://download.oracle.com/docs/cd/E10530_01/doc/epm.931/html_cas_help/apgs03.html
Then in EAS edit the rule and go to access permissions and provision user1 :- http://download.oracle.com/docs/cd/E10530_01/doc/epm.931/html_hbradmin/ch03.html
Cheers
John
http://john-goodwin.blogspot.com/

Business Rule access issue

Hi,
I have newly set up few business rules in 9.3.1. I have two issues here.
1. No users listed :In Access Privileges tab,when I click on 'Add' to assign access to a user on this BR, there is only one user i.e admin(Internal) and no other users listed. But in Groups, there are groups listed and I have assigned access to those groups on this BR.
2. Users can not view BRs in planning web : Although I have assigned access to available groups, the users in those groups can not see this business rule in planning web.
Note : Even though I login to planning web as admin, I can not see BRs.
Any help would be greatly appreciated.
Thanks
Ashok

If you have not already it is worth going through the following doc in Oracle Support - "Troubleshooting Hyperion Business Rules Issues [ID 763345.1]"
Cheers
John
http://john-goodwin.blogspot.com/

Updating Business Rule access and security

Hi All,
We have recently load balanced the planning servers, as a part of this currently we have to update "Location" and "Acces Privileges" tabs to reflect "All Locations".
There are hundreds of business rules for us across all servers. I was hoping if there is an automated or maxl way of updating access for business rules rather than manually pulling all the groups in each business rule.
any thoughts on this.
Thank you
Arun

Hi john,
Thanks .It works fine....
I have another question.
I have some calculationscripts along with this business rule.I m not able to find out a option to launch a calculation script from the planning application.
I m logging in as User1(Planner).
do I need to add security for calculation script?
I didn't get any option to add security to calculation scripts in eas?
Plz help
Thanks

Not able to access the web based RuleAuthor of Oracle Business Rules

Hi ,
I have Installed Oracle SOA Suite (11g) version from here .
I have followed the steps in the Installation guide .
I was able to install it successfully. At present I need to Work on the oracle Business Rules.
As per the documentation I have tried to access the Rules author at the following URL
http://localhost:7001/ruleauthor/
But I was not able to access it.
Please let me know if I need to install any other component to access Rule Author. please let me know if you need any more information.
Thanks in advance for your time,
Raja Kumar

Back up all data.
Launch the Keychain Access application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Keychain Access in the icon grid.
Select the login keychain from the list on the left side of the Keychain Access window. If your default keychain has a different name, select that.
If the lock icon in the top left corner of the window shows that the keychain is locked, click to unlock it. You'll be prompted for the keychain password, which is the same as your login password, unless you've changed it.
Right-click or control-click the login entry in the list. From the menu that pops up, select Change Settings for Keychain "login". In the sheet that opens, uncheck both boxes, if not already unchecked.
From the menu bar, select
Keychain Access ▹ Preferences ▹ First Aid
If the box marked Keep login keychain unlocked is not checked, check it.
Select
Keychain Access ▹ Keychain First Aid
from the menu bar and repair the keychain. Quit Keychain Access.

Access to Business Rules in AAS

We have System 9.2.0.1 and when my user logs into AAS, they cannot view the Business Rules section. what is the proper access to grant in Shared Services for them to see the Business Rules?
Thanks

Ok I did not realize that there is an extra step to allow the user to see the Business rules once you provision them. I needed to log into AAS as an Admin, go to Business Rules Section, go to Administration Folder and right click and pick Refresh Users List. This apparently refreshes the list of users able to access Business Rules in AAS after they have been provisioned. Another solution is of course to stop and start the AAS service which is not practical to do during a workday.

Unable to provision Business Rules access for users

Hi all,
Our analytic server is properly configured in Shared Services : we can correctly create users, provision Essbase access for those users, change password, etc...
An application business rules is visible in the left pane of shared services, but we are not able to provision Business rules access for users.
When we try to provision access for a user, we have only access to the Analytic properties.
What's going wrong ?

It sounds like the user you login to HSS with hasn't been assigned with "Provisioning Mgr" rights to business rules.
Get the HSS admin user to grant you these rights and you should then be able to provision users to use Business RUles.
Gee

Unable to access Business Rules Facts after refreshing XML Facts

I have created a business rule using an xml schema to generate the XML Facts. Then I created a Decision Function to call a Ruleset to process the information in the XML Facts. This decision function has input and ouput parameters from the XML Facts.
The decision function is used inside a BPEL Process, by defining the Dictionary has the created business, defined the Service has de Decision Service. After this configuration I'm able to define the Input Facts and Output Facts from and to a variable in the bpel process. Using the Decision Fact Map window I define the input and output to the exposed Business Rule Facts. This works just fine. The BPEL runs and the Rules are correctly used.
When I change my xml schema to add more elements and complex types I use the "Reload XML Facts From Updated Schemas" option available in the bussiness rule. After this operation I will no longer have access to the Bussiness Rule Facts in the Decision Fact Map window. So I'm no longer able to call the decision function.
Yet the business rule has no problems and i have tested using a fuction to call the Decision Function.
Is this a bug or a feature?
I'm using Oracle 11g with the SOA Composite Editor 11.1.1.0.0.52.19.

Problem solved. There was an element in the xml schema that had nillable = true. Because of this the XML Fact for that element would no longer be available in the BPEL Process. Removing the nillable and generating the XML Facts again solved the missing variable problem.

Error accessing Business Rules from EAS

Hi,
I am using EPM System 11 and trying to access Business Rules via Essbase Adminstration Services Console (EAS). When I open up the Business Rules node from Enterprise View, and select Repository View > Rules, a list of all the Business Rules is displayed. However, when I try to click on one to open it in the editor, I received an error message from EAS the reads:
Business Rules Error. Error creating DBUserGrpObjLinkTable. Cannot continue.
When I click Get Detail, it just displays Detail: null. This occurs when trying to open any of the Business Rules. In the past I have had no problem creating, editing, and launching business rules from EAS.
I am still able to successfully launch the Business Rules I have already created and assigned to my Planning application FROM the Planning Web Application, but I am not able to edit them or create any new ones in EAS. Does anyone know what has happened to cause this error? It appears as if something happen to the one of the tables in the relational database that was configured during the installation of the EPM system? I can provide more detail if necessary. Thank you.

I have restarted the services and that did not solve the problem. This may be a stupid question, but I'm not exactly sure who I would contact at Oracle about this problem. Can someone tell me where I should look for this?
Also, I have a bit more information from the logs that may be helpful in solving this. Here is an excerpt from the hbrserver.log:
2009-12-09 03:28:10,656 WARN main com.hyperion.hbr.core.AccessControlManagerServer - HBR repository is not configured. HBR will not be available.
2009-12-15 10:25:02,656 FATAL http-10080-Processor4 com.hyperion.hbr.core.AccessControlManagerServer - Error creating DBUserGrpObjLinkTable. Cannot continue.
It appears that the HBR repository is not configured? I am confused because Business Rules were working fine just last week, and I'm not sure what has changed. Also, I can still successfully run Business Rules from Planning. Any ideas on how to fix the repository? Thanks.

Access privileges lost in business rules

Similar Messages

Maybe you are looking for