BI publisher security mged by OBIEE can't access role (500 internal error)

Question

Hello all,
I have set the BI Publisher security model to BI Server, after creating apropriate groups in the admin tool as described by the documentation. I restarted all the services. Now I have an admin user that can log in, but when trying to access the roles and authorizations page to grant access to folders, I get the following error :
500 Internal Server Error
Servlet error: An exception occurred. The current application deployment descriptors do not allow for including it in this response. Please consult the application log for details.
The log file says the following. In french, "table non résolue" simply means table unresolved (you guessed? ;) )
07/07/06 12:46:45.281 xmlpserver: Servlet error
oracle.apps.xdo.security.ValidateException: java.io.IOException: prepare query failed[nQSError: 27004] Table non résolue : "SA System".
     at oracle.apps.xdo.security.SasValidator.getAllRoles(SasValidator.java:254)
     at oracle.apps.xdo.servlet.ui.admin.security.SecurityAdminUtil.getAllRoles(SecurityAdminUtil.java:353)
     at oracle.apps.xdo.servlet.ui.admin.security.RoleHomeServlet.getRoles(RoleHomeServlet.java:367)
     at oracle.apps.xdo.servlet.ui.admin.security.RoleHomeServlet.renderBody(RoleHomeServlet.java:259)
     at oracle.apps.xdo.servlet.ui.admin.security.RoleHomeServlet.doPost(RoleHomeServlet.java:101)
     at oracle.apps.xdo.servlet.ui.admin.security.RoleHomeServlet.doGet(RoleHomeServlet.java:59)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:743)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:856)
     at com.evermind[Oracle Containers for J2EE 10g (10.1.3.1.0) ].server.http.ResourceFilterChain.doFilter(ResourceFilterChain.java:64)
     at oracle.apps.xdo.servlet.security.SecurityFilter.doFilter(SecurityFilter.java:60)
     at com.evermind[Oracle Containers for J2EE 10g (10.1.3.1.0) ].server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:621)
     at com.evermind[Oracle Containers for J2EE 10g (10.1.3.1.0) ].server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:368)
     at com.evermind[Oracle Containers for J2EE 10g (10.1.3.1.0) ].server.http.HttpRequestHandler.doProcessRequest(HttpRequestHandler.java:866)
     at com.evermind[Oracle Containers for J2EE 10g (10.1.3.1.0) ].server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:448)
     at com.evermind[Oracle Containers for J2EE 10g (10.1.3.1.0) ].server.http.HttpRequestHandler.serveOneRequest(HttpRequestHandler.java:216)
     at com.evermind[Oracle Containers for J2EE 10g (10.1.3.1.0) ].server.http.HttpRequestHandler.run(HttpRequestHandler.java:117)
     at com.evermind[Oracle Containers for J2EE 10g (10.1.3.1.0) ].server.http.HttpRequestHandler.run(HttpRequestHandler.java:110)
     at oracle.oc4j.network.ServerSocketReadHandler$SafeRunnable.run(ServerSocketReadHandler.java:260)
     at oracle.oc4j.network.ServerSocketAcceptHandler.procClientSocket(ServerSocketAcceptHandler.java:239)
     at oracle.oc4j.network.ServerSocketAcceptHandler.access$700(ServerSocketAcceptHandler.java:34)
     at oracle.oc4j.network.ServerSocketAcceptHandler$AcceptHandlerHorse.run(ServerSocketAcceptHandler.java:880)
     at com.evermind[Oracle Containers for J2EE 10g (10.1.3.1.0) ].util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:303)
     at java.lang.Thread.run(Thread.java:595)
The SA System seems to be a subject area dedicated to users management. But this is where I get lost. I have no idea of whet to do to get things working. Most probably I have to give some more privileges to somebody... but which? to who? where???
any help much appreciated!!!
thanks in advance.

Answer 1

You need to setup SA System in order for BI EE security to work with BI Publisher. Setting this up will fix the error that you are listing below. Couple of options for you.
1. Log an SR on supportweb to get sample RPD and table structure for the SA System
2. check the 7.8.x documentation. It had a better description of the SA System than the 10.1.3.2 documentation does.
3. I can email you an RPD and table structure that I have used.
The only thing BIP needs in SA system is user name, group name and user to group assignment. This is needed for two screens in BIP (Roles and Permissions and JDBC connections). It's a bit annoying to have to set this up, but two good things to note. If you setup SA System, then you have additional options for delivery of iBots (that's what SA System is really designed for). The other is that BIP's dependence on SA System is going away in a future release. So this will get easier soon.
Bryan