BO on top of BW - Security

Hi Guys,
Have a requirement where in BO system is on top of BW, ie BO WebI reports need to be generated from BEx queries.
The case is like there are different User types (Mfg, Mktng, Finance, HR). So, if an HR guy from one particular country (say Germany) logs into BO, he should only be able to see HR reports (not others like Mktng, Mfg, Finance).
And, after executing the report he should be displayed the result for his country (Germany, here) only.
For performing above functionality, Please help me out in finding the right way. Is CMC the right option. If yes, Please let me know some solution for it.
Your reply 'd be of utmost help.
Many Thanks!!
RG

Hi Ingo,
we're facing similiar problems and my basis admin tells me that he already expand the ABAP memory alocation using 70% of the physical memory, also we have Enhancement Package 1 installed, but we're still facing the same error message.
FYI, the BO server uses 8 GB of RAM and 8 core processor, the SAP BW server uses 16 GB of RAM and 8 core processor. We want to analyze 3 years of daily data from highest hierarchi down to the details. We have 3 hierarchies :
1. Sales : sales organization - sales office - distribution channel - customer group - sold to party
2. Material : material group 1 - material group 2 - material group 3 - material
3. Time : year - guarter - month - day
so far we are able to query only 1 week of data using webi and that generates 900+ webi report pages. the total rows of whole data is roughly 12 million rows. any suggestions?
Thx

Similar Messages

Virus Barrier X4 question and a Top 10 Network/Security question

I am currently running Norton AV/Mac. It runs fine, no problems, no slow down, am happy! However, I know that there are some very experienced Mac users who are very down on Norton AV as far as causing problems/hogging resources/slowing things down...again, I don't have any problem, but I am still a newbie. I see however that one of the top 10 Network/Security downloads is Virus Barrier X4. If I want to run an AV program, could someone shed some light on wht this would be a better application? Also the number 1 download in this category is Mac Scan. I am confused, Forget virus's, I thought there was no Spyware/Malware? Why would so many people make this such a popular download..Curious! Thanks, Bill

Bostonfan49,
Spyware is a self-inflicted injury.
To prevent drive-bys, remember to uncheck the Open "safe" files after downloading box in the Safari>Preferences>General tab and make sure that you're blocking pop-up windows.
Configure your firewall correctly (turn off ALL unused services) and stealth it.
Don't use P2P (Limewire and the like) or visit "dodgy" (unknown, copyright infringing, skanky, pr0n, etc.) Web sites.
Never, ever install any program or give any installer your admin password unless you are certain that you know and trust the source.
Create a separate administrator account for installing software and updates and make your normal user account an ordinary, nonadminstrative user.
OS X is not immune to spyware: The spyware would still have to be coded to run in OS X. Requiring an administrator account and click-the-"Yes"-box user permission to install and run didn't prevent KaZaa (and its bundled nasties) from being downloaded and installed by millions, so this OS X "barrier" to malware is subject to the same vulnerability. That said, I'm not aware of much of anything in the way of spyware for Macs.
-Wayne

I cant get online with my lap top using airport secure router my lap top is running windows vista anyone know what i need to do?

I connected airport express and made it a secure network works fine with my IMAC desk top and copy machine but cant seem to get on line with my DELL laptop running windows vista does anyone know what i can do ? I put in my passpharse code but it says windows cant connect

So, when you are in the window that provides the Equivalent Network Password, you are saying that your WPA Password and the WPA Pre-Shared Key values are the same? That is, you are already using a 64-hex character password? (see image below)

Other web browsers and security issues?

Since even an Apple KB article recognizes the need for an additional browser and because of Safari's limitations and problems, I'm going to try switching to another browser (most likely OmniWeb and am looking at Firefox, Shira and Opera also though perhaps not as a primary browser) but I'm wondering about their ability to keep on top of any security issues for Mac? (and how do you keep up with security updates?)
Though perhaps unfounded, at least with Safari, I feel that Apple has a vested interest in keeping on top of security issues (for Safari and Java) and I can readily find out about security updates via software updater.

Most of the other Mac browsers have their adherents. They are all good browsers (I have 7 browsers installed to test various web sites and for change-of-pace usage). They all have their strengths and they all have their weaknesses. Only iCab and OmniWeb are still shareware, the rest are now or always have been free (Opera just recently stopped charging for its browser).
I have settled on Firefox as my alternate browser and I use it maybe just a tad more than Safari, but I do switch back and forth between them. The Mozilla foundation is good at getting security updates out when needed. Firefox has a button on the toolbar to check for updates. One nice thing about Firefox is that you can install free extensions which enhance the features available. I have one to supplement tab features, one to control iTunes from Firefox's status bar, one to help me format messages in discussion forums, and one to block ads.
I prefer OmniWeb for doing intensive research because of the way it handles tabs in its sidebar, showing me which ones I've looked at and which ones I haven't, and giving me great flexibility in rearranging tabs, which are viewable as thumbnails or text names (I have had up to a hundred or so tabs open in OmniWeb.
Shiira is good and its fast. I have not checked for updates for a while, but the last time I updated there was still a problem with Shiira kicking you out of logged-in sites when you moved from page to page with in web site. This may have been fixed by now - they were aware of the problem back then.
Camino is a native OS X cousin of Firefox and is also fast, but is not updated as often.
I would stay away from Mozilla or Netscape unless you need all the additional modules they have and which take up hard disk space. Firefox and Camino represent the browser module of Mozilla/Netscape. Mozilla and Netscape have modules for email, irc chat, newsgroups, and for creating and editing web pages. Netscape is a branded and slightly customized version of Mozilla and is not updated as often.
Opera is a nice browser and some use it as their main browser, but I have not seen anything that really stands out for me, but that does not mean it is not worth a look.
I would stay away from abandonware Internet Explorer.
As for checking for updates, several of them, as with many Mac programs, now have a menu item that allows you to check for updates. Most of them also announce their updates on both VersionTracker and MacUpdate.
Happy Exploring.

Outlook Security Alert - "the name on the security certificate is invalid or does not match the name of the site"

Due to our company changing names, we recently moved to a new domain. All users were at first getting a certificate error when opening Outlook "the name on the security certificate is invalid or does not match the name of the site." After our network
admin made some changes, nobody receives this error anymore except one user. The URL at the top of the security alert is the old domain, mail.olddomain.com. I checked the users Exchange Proxy Settings in Outlook, everything is showing the URL's of the new
domain so I'm not sure where this is coming from. I'm assuming it has to be something on her local machine since she is the only one who still gets the error.
Thanks in advance for any help.
Exchange server 2008
Outlook 2010

Hi,
Please follow all above suggestions to confirm whether the issue happens in OWA. And run Test E-mail AutoConfiguration in Outlook to check whether there is any URL settings using the old domain.
If the issue doesn’t happen in OWA and your URL configurations are all same as others and set correctly, please create a new Outlook profile to have a try.
Thanks,
Winnie Liang
TechNet Community Support

Document Security settings - conflicting information

A PDF has been created in a process where Security is applied by itext sharp; and all values should be set to Allowed.
When I check File > Properties > Security Tab (in adober reader 8 ) I can see:
1) At the bottom a 'Document Restrictions Summary' section, but not all my values are "Allowed". So possibly something isn't right with the itext sharp process. However what is more confusing and the purpose of this post is that I can also see....
2) At the top the Document Security section and a Show Details button. Selecting this brings up the Document Security dialog with another list of settings - some of which are a contradiction of those shown in the Summary list (point 1 above) e.g. Document Assembly is Not Allowed in 1) above, but is shown as Allowed in the separate Document Security dialog?????
I can't find any information on the difference between these two sections and which Value is correct.
I'm not sure if this is the correct forum, I've also posted this in the adobe reader group.
Any help appreciated.
ej.

>When I check ...in adober reader 8
>1) At the bottom a 'Document Restrictions Summary' section, but not all my values are "Allowed".
This is normal in Reader, because its functions are limited. It's
confusing, but it says "disabled" for things it can't do as well as
those things which are forbidden. To actually confirm the settings use
Acrobat instead.
Aandi Inston

Best Approach for Security in WebCenter Portal Application

Hi,
We are analyzing a right approach for webcenter portal security on an application . We found that we can do all Roles and Security in Page Hierarchy which in turn stores the security details in Jazn-data.xml . Is this the right approach for defining the roles and security for a webcenter portal application .
What is the importance of Configuring WS_security in webcenter Portal Application and do we need to define this WS_Security even after defining them in page hierarchy. Could you please guide us on this .
Thank you,
Sashank P

Hi Shashank,
First sorry for late reply,
WS_Security, can you please explain what do you mean by WS_Security, from the term i could not infer which part you are talking about.
Let me tell you about the Webcenter security -
This is the heirarchy , the Fusion middelware forms the base with webcenter at the top.\
Webcenter Security
|
ADF Security
|
Fustion Midddleware Security (OPSS)
Now you are goin to apply security to your Webcenter and ADF layers.
Lets come back to the question .
Any webcenter portal, you have to use the Jazn-Data.xml file to secure all the content whether its the navigation /pages /admin pages/taskflows etc.
Its pretty much easy to use , let me know if you have any difficulty on that.
Page hierarchy -> Yes you have an option to set your security for pages alone, here you have addition fine grain permisions (update/delete/personalise etc).
If you need those fine grain permissions you can use this.
To Conclude i would say use jazn-data for taskflows/components/admin page protection etc.
Use Page heirarchy's fine grain permission to pages and navigation model's visible attribute to show/hide navigation based on user's roles.
Let me know if this helps

How to keep Allways JFrame on top of JApplet?

I have Japplet runs on the client side. after pressing buton on the applet
a jframe pops up. but if i click on the japplet it hides under japplet.
Any ways to keep this jframe on the top ? if i use jframe.keep always on the top will thought security exception. I know applets have some security issue to access local OS resources or permission. just need to know any possibitly to achive this somehow?
thnx

I don't think this is possible. Others feel free to correct me. Perhaps try signing the applet or setting the permissions in the policy file.
You can use a JInternalFrame to keep the frame within the JApplet.

Security: "Save As"

Can I prevent a recipient from using a pdf file to create their own file by doing the "Save As" command?

Use ctrl-D to get to the document properties and then select the security tab. You have two types of security options. One requires a password to even open the file. The second uses a password to set restrictions on copying, printing, etc. Be aware that this security works reasonably for most users, but there are work arounds that defeat your desired result.
Your best protection may be a legal one in which you specifically copyright the information in the file, possibly on top of the security settings. People may copy the information, but then you have a legal alternative to use to get compensation -- though not a simple process and may not be worth the trouble. The most secure step is to use digital rights management. However, even DRM is not perfect and often annoys folks because they can't even transfer the file to another computer in some cases (at least this is the case for music files).

Cross-dimension or dimension-combined security

Hi gurus!
I must implement "cross-dimension" security in a planning application. I've defined some dimensions, and it's critical to implement security on some of them. Now, I can create security filters, but I need to restrict combinations of two dimensions. For example:
Let's say I have 2 dimensions: Entity and Activity, and 2 users: user1 and user2
-Entity has 2 members: Entity1 and Entity2
-Activity has 2 members: Activity1 and Activity2
-user1 can read/write data for Entity1 - Activity1 and Entity2-Activity2
-user2 can read/write data for Entity1 - Activity2 and Entity2-Activity1
In this case, user1 and user2 must hace read/write access to Entity1, Entity2, Activity1 and Activity2. So user1 will be able to write on Entity1-Activity2, and he should not be able to do that!
I'm using Hyperion 11.1.2.1.
How can I resolve this problem? Any ideas?
Thanks in advance!

While the limitation you are describing is not an issue for Essbase (cell level security with cross-dimension context), it IS for Planning. So yes, you can do what you describe in Essbase, but not in Planning.
Planning uses an additional layer of security on top of Essbase security filters, and when you think about it, it makes sense. Security in Hyperion Planning is dynamic. It changes when an admin updates the open/close periods in a Scenario, and it changes during workflow operations.
When an Essbase security filter changes, the user must LOG OUT and log back in for it to take effect. So you can see why Planning needs this additional layer of security (stored in the relational repository). We coudn't ask users to log out and log back into the app every time they promoted a planning unit. And it would not be efficient to recreate the Essbase security filters every time approvals changed.
The functionality you're describing is in the product roadmap. The Planning product managers have talked about this during the last two Kscope conferences. It's just not here yet.
Hope this helps,
- Jake

Quick question about SAP Security analyst responsibilities

This question was posted on another site and I was asked by the moderator to cross-post it here:
On another discussion forum, the topic of the SAP Certification program came up. In the discussion thread, there was some debate about the subject areas tested on the exam for SAP security, so I am putting the question to you.
At your current workplace, which of the following, if any, are responsibilities/ expected competencies of your experienced SAP Security analysts:
Encryption
Single Sign-on configuration/ maintenance
Network topology (SAP router and web dispatcher)
Operating system (SAP gateway)
Database security
J2EE
To categorize the responses, it would be helpful to know if you consider yours is a relatively large SAP support organization or not.
Thanks in advance for your responses and comments.
Regards,
Gretchen Lindquist

Hi Gretchen,
I am a consultant so have a slightly different perspective than an end user.
A typical client security engagement for me will involve 3 or 4 out of those competency areas and on top of that: secure communications & secure application (what I know and love as roles & users, some of our friends will refer to that as secure coding). In general, security administrators at my clients focus on roles & users and their competencies are only in those area. That is the same for small (<500 users) and large organisations (>20k users)
In my opinion this is one of the problems with our industry and in particular with individuals who consider themselves SAP Security professional. It is no secret that the wider security industry often views SAP Security practitioners as a bit limited in skills due to the lack of understanding of infosec basics.
SAP security is not just roles & users, SoD's & SU53's. They are an important part of securing SAP but only a few of the components. As you have pointed out in the competency areas SAP Security is about the environment in which the SAP system resides and operates and our need is to ensure the C,I,A over those systems that support business processes.
As an employer I expect a SAP Security professional to have understanding of all of those competencies (and a few more). In the same way that GRC is much more than a tool provided by SAP, SAP security is a holistic subject that by necessity covers multiple subject areas.
Regarding expectations of a security analyst, I expect them to be able to understand the wider security environment around their system and to be comfortable talking about things like comms security, SSO, secure programming (the basics), OS, network topology and DB security (the basics). Most importantly they should know how they work together to form the security environment and where the dependencies or touch points are between them. It's not unreasonable for basis and technical teams to perform much of the work in these areas but that is not to say that "out of sight is out of mind".
I don't hide my views on the inadequacy of the certification process in it's previous incarnations. SAP is doing great work to improve this which is a positive step. What is critical is that a demonstration of competency (e.g. certification) in SAP Security covers the whole subject (or as much as practical).
If people want to break the topic down then that's great but resulting certifications should be pointed out as what they are e.g. Certification in role & user administration.
I hope there is something in there to provoke thought & discussion!
Regards
Alex
Edited for clarity by: Alex Ayers on Feb 9, 2012 9:49 AM

Adobe Reader 8 - Document Security - conflicting information

A PDF has been created in a process where Security is applied by itext sharp; and all values should be set to Allowed.
When I check File > Properties > Security Tab (in adober reader 8) I can see:
1) At the bottom a 'Document Restrictions Summary' section, but not all my values are "Allowed". So possibly something isn't right with the itext sharp process. However what is more confusing and the purpose of this post is that I can also see....
2) At the top the Document Security section and a Show Details button. Selecting this brings up the Document Security dialog with another list of settings - some of which are a contradiction of those shown in the Summary list (point 1 above) e.g. Document Assembly is Not Allowed in 1) above, but is shown as Allowed in the separate Document Security dialog?????
I can't find any information on the difference between these two sections and which Value is correct.
Any help appreciated.
ej.

I just need to clarify this.
So if I see the Document Assembly not allowed in the Reader, and if I can assemble the document in the Acrobat, what does it mean?
I am submitting a government grant application, and they specify saying we have to submit the document with a setting that allow document assembly, commenting, editing, etc. This is to allow reviewers to be able to comment on and assemble applications.
Should I be worried when I see in Reader that Document Assembly is Not Allowed? Or is this OK, as far as Document Assembly is allowed in Acrobat?
Thank you,

How do I restrict content provider edit rights to a single region on a page

We have a 2-level security requirement for Portal pages that are accessed by "the general public" - users that do not log into Portal. I'll call this population "The Public".
Top Level Edit Security
Web-masters need to edit all content on any page in any page group.
Sub-Level Edit Security
Content providers need to be restricted to editing HTML content within a single region on all pages within a single page group. They will use the RTE (FCKeditor) to edit the content of the restricted region.
One idea I tried was creating a nav page as a portlet and placing the portlet on the page. This seemed satisfied all the requirements. The drawback is having to create a new nav page for each page created. Since the content and pages are mostly static this does not seem, to me, to be a big deal.
I next tried Item level Security, created a group (publicusers) that included PUBLIC and ContentProvider users and granted "view" to the "publicusers" group . I found that "The Public" can see the entire page, except for the Text Item Type that is under Item Level Security. Only by turning off Item Level Security can "The Public" see Text Item Type. (This action seems to be supported in the documentation as well.)
Any other ideas on how to implement multi-level content security on pages within a page group? There will be at least 18 page groups, each with a unique content provider. The content provider can not edit content outside of their designated page group.
Thx.
--Don

I would recommend creating pages for each "chunk" of content that needs specific security. Set the security at the page level.
Then, publish those pages as portlets, and stick those portlets in the regions that need "per group" edit rights. For each portlet, display the Edit link. Users who have rights to edit the portlet's source page will see the edit link, and can edit that content "in place".
Does this help?
-John

How to connect to Xbox Live with the Actiontek GT704-WGB wireless router

If the title got you here, then you are probably a Verizon DSL customer who is trying to connect your Xbox to Xbox Live with the Actiontek GT704-WGB wireless router and are getting nothing but errors saying, "your NAT is set too high", or, "Your MTU setting is too low", etc. Well, after many calls to Xbox support, Actiontek support, and Verizon support, I finally came up with the solution myself.
All that is needed is a little techie know-how about router settings and you'll do just fine! However, if you are uncomfortable with doing it yourself (and it is really really easy to do!) then you can call Verizon support and have a tech support rep remotely conntect to your PC and make the changes for you: however, you have to speak with someone in advanced tech support and to do that you have to agree to a 1 year support contract to the tune of $14.95 per month in order for them to do it! Scam??? You be the judge!
So, here are the steps to take to get it working and by the way, YOU CAN NOT GET THE XBOX TO CONNECT TO THIS ROUTER WIRELESSLY!! YOU MUST CONNECT YOUR XBOX TO THE ROUTER WITH AN ETHERNET CABLE IN ORDER FOR THIS TO WORK!!! If you don't heed this warning, you will unfortunatly go through all the steps below, only to find that you get the same errors but, ethernet is faster than wireless so it's better!....right?.....right? (hears crickets chirping)....right? Oh well, I tried! Also, you must have your Xbox on in order to change the router settings (which you'll see why later) Anyway, here's the steps:
1) On your PC, open a browser window and type in the address bar: 192.168.1.1 and press enter.
2) You will then see the interface on which you will make changes to the router's settings. If at any time you are prompted for a username and password (which should happen right after you press enter) the defaults are: username: admin password: password. If you have changed these, enter what you changed them to.
3)Click on the icon on the top labelled "Advanced Setup"
4)In the left section, click "WAN IP Address"
5)At the warning screen, click "yes"
6)Scroll down until you see "MTU setting" and enter 1370. NOTElease don't be tempted to either enter 1500 or leaving it at 1500 (which is the default) because you might know that 1500 is the maximum at which this can be set which is TOO HIGH AND WILL NOT WORK! Trust me and enter 1370 and then click on "apply"
7)Click on the top icon labelled "Security"
8)In the left column, click on "applications". This is where we are going to open the 3 ports that Xbox Live uses to communicate with your Xbox.
9)In the drop down box labelled "PC Name" select "Xbox 360". This is why you had to have your console on and connected cuz if you didn't, it would not show up on the drop down list!
10)Under "category" click on the bubble next to "user"
11)Click on "New" which is one of the blue buttons near the bottom.
12)As for the rule name, I entered "Xbox" but you can put whatever you want but I'd use that so you know it's the ports you opened for the console.
13)For protocol, select TCP. (Yes you will also open the same ports for UDP but for some reason if you select TCP.UDP instead of doing them seperatly it doesn't work.....I dunno why!?
14)For all 3 "Port start", "Port End", and "Port Map Start" put the # 80.
15)Click "apply"
16)Now, select UDP and put the same port # 80 and again click "apply"
17)Repeat steps 13 through 16 except with the numbers 3074 and 53, clicking apply after each one. What you should have now on the bottom are a list of all the ports you opened, one TCP and one UDP for each number totalling 6 entries.
18)Click "back" to return to the Applications screen.
19)If you have to, select Xbox 360 for PC name, and click the bubble next to "user" and you'll now see the entry called "Xbox" or whatever you called it.
20)Click that entry to highlight it and then click the blue "add" button to the left and then click "apply" at the bottom.
21)Close the browser screen and turn off your PC and Xbox and any other hardware connected to the router.
22)Turn the router off and unplug it and wait about 5 minutes. It can take this long for any residual current in the router to dissapate and for the NAT table to clear itself.
23)Turn on the router and wait for the internet light to come on green meaning the router has booted and has an internet connection.
24)Turn on the Xbox AND ONLY THE XBOX!
25)There is no need to go into network setting as when the Xbox is connected by ethernet, it automatically configures and connects intself. You can, however go into network settings and perform a connection test but this to is not necessary.
You now should be able to connect to Xbox Live! If not, you've done something wrong and must either go through all the steps again or let Verizon do it for you (for a fee that is).

I followed jtktlw's instructions to the letter. Problem was I had already enabled UPnP before doing so. Afterward I disabled UPnP and rebooted....no change. I reset the MTU to 1500...boom, it works. Seems for me all I needed was to open the right ports to get it to work.

Creation of new entity on ADEP content server fails

Hi.
I get the following error when trying to persist a new instance of an entity into the content (experience?) server:
Create Item Failed, RepositoryException: {Code}-LCC-REP-FCT-002, {Message}-Access denied
The new instance is defined in a Flex GUI and connected to the content Server through Data Services. The error occurs when I try to develop the simple app shown in
Session #9: Using Model Driven Development with Persistence in the ADEP Content Repository (http://www.youtube.com/watthech?v=rNnLC8fADlc).
I have loaded the sdk, samples and cmis packages. RDS and Unsecured RDS are enabled on the server. The Deployment Handler is set to content on the Flex GUI.
I think it fails becuase the app does give appropriate security creditials to the server, but don't know how to do so (as commented by Hodmi on the YouTube page).
Would appreciate any help to make progress as I am keen to see what ADEP can do.
Regards
Jamal

Jamal-
Check out this link: http://learn.adobe.com/wiki/display/ADEPSamples/Model-driven+Development
In the Run the Application section, the step I've copied below will solve your issue. I actually did not change the permissions on the "content" node (step 4), but selected my application node under content, and that also worked.
Have fun with ADEP!
-Matt
PS-Thanks to Gary for pointing me in the right direction for this answer.
To create node or delete node when running the application, you can use anonymous user but you need to configure the ACL for the user according to the following steps:
Open http://<server_name>:<server_port>.
Enter admin/admin as user name/password, click Sign In.
Click Content Explorer in the right side panel.
Click the node “content” in the left tree.
In the top bar, click Security > Access Control Editor.
Click the check box next to ACL, then click Set selected policies.
Click New ACE, and then click Browse, select user, and click Search Now, select anonymous, and click select.
In Privileges list, select jcr:all.
Click the Green arrow, and then click OK
Note: If you want to add authentication for the application, the login page should be needed, and you can refer to the detailed sample code to learn how to add authentication to such applications.

BO on top of BW - Security

Similar Messages

Maybe you are looking for