Essbase server access role - delete DB allowed?

Good morning everyone.
We have provisioned a group in Planning with the Essbase server access role which grants read level access to Essbase databases.
We have checked that a user assigned to this group can actually access Essbase DBs to execute calcscripts and report scripts and that it does not have permission to open the DB outline --but it apparently still has permission to delete a database (as seen in the following image: https://c69ee7db-a-62cb3a1a-s-sites.googlegroups.com/site/ktratsites/Home/delete_Essb_DB.png )
As you can guess, we have not tried whether this user could actually delete an Essbase database.
Can anyone confirm whether a user given the Essbase Server Access role could really delete an Essbase DB?
IMHO, this should not be possible.
Thanks a lot.
Best regards,
G.S.Feliu

It will show the option to delete but if you select it then it should display "Insufficient privilege for this operation"
Cheers
John
http://john-goodwin.blogspot.com/

Similar Messages

Shared Services and Essbase Server Access Question

Hi,
It seems that we have to assign Essbase Server access at the individual username level and that groups don't work when it comes to Essbase Server Access. Is this correct or are we doing something wrong and groups do work with Essbase Server access? We are on 11.1.1.3 Essbase/Planning/Shared Services.
Thanks

You can provision Essbase Server Access via groups but it must be the very first thing provisioned and pushed to Essbase. Then after that, provision your groups with other accesses such as Planning, Reports etc....

Adding Essbase Server access to Planning Application group

Hi All,
How we can add Essbase server access to Planning Application group in Shared services ? Pls. advice

You can't provision access against any application group.
However, you can create and use native user groups or use external user groups and provision those groups to have acccess to Essbase and Planning.
See this post for an example of how I like to set up groups in Shared Services for Planning:
http://camerons-blog-for-essbase-hackers.blogspot.com/2009/08/planning-security-wrong-way-and-right.html
The top level group I refer to in the post is where I typically grant Essbase Server Access.
Regards,
Cameron Lackpour

Non-admin user cannot access Essbase server level variables

Version 11.1.1.3
Essbase Substitution variables are created at server level. Users are getting error in FR report that uses the Subsitution Variable -- Essbase Error(1051085): You do not have sufficient access to get this substitution variable. Also, users cannot access Substitution variable in SmartView. However, users can access variables created at database level. Users are provisioned as "Server Access" to Essbase and filter access to ASO application "MGTRPTG", where MGTRPTG is an ASO essbase application for reporting. We tried the same provisioning in two other environments and it seems to be working fine.
User is type "Essbase and Planning" provisioned with essbase "server access", application mgtrptg "filter", Reporting and Analysis "analyst", "dynamic viewer" and "Explorer". In addition, it is given a filter "REP_DME_GALB" which restricts 2 dimensions (Division and Geography).
Steps taken to resolve:
1. Existing users were deprovisioned and reprovisioned with no effect.
2. Created brand new identically provisioned users in Prod and QA. QA user can access the server level var and Prod user cannot
3. Created a brand new server level variable in Prod and this cannot be accessed.
4. All services have already been restarted several times.
5. SR has been opened.
Temporary workaround:
By creating a duplicate of the same set of variables at the database level, the reports work. This can only be a temporary workaround as the client cannot be expected to maintain two sets of substitution variables since there are 3 applications using these server level variables.
Thank you for any ideas!
Jennifer

You have stumbled on a defect which is resolved in the Hyperion Planning 9.3.1 patch 6 and above. If you have your planning preferences set to indent members it will cause forms which have page selections to show as invalid in SmartView.
You can either patch Planning or turn off the preference. The patches are available from http://metalink3.oracle.com and require account which has been associated with your client ID.
P.S. Usually it's not a good practice to use the admin id.
Regards,
-John
Edited by: Jbooth on Nov 3, 2008 2:12 PM

Missing Essbase Server Roles

Hi,
Essbase 11.1.2.2 installed with Shared Services for security.
Looking at the help documentation I am told that I should have Administrator, Create / Delete Application, Server Access and Provisioning Manager as Essbase Server Roles. When I go into role and query these back I find all but 'Provisioning Manager' under ESB product code.
However, when I look in groups and provision, I cannot find these roles to provision.
I have;
Essbase Studio Server 11.1.2 Servers / Essbase Studio Server2
EssbaseCluster-1 / Essbase Applications VARIOUS
Foundation / Shared Services
Reporting and Analysis / Reporting and Analysis
But I do not find any of the server based roles under these headings, am I looking in the wrong place OR have these been superceded in 11.1.2 and the help documentation not updated - can anyone point me at their equivalents if so??
thanks,
Robert.

Hi John,
Under the cluster I get a node for each Essbase database, and under each I get Application Manager, Calc, Database Manager, Filter, Provisioning Manager, Read, Start / Stop Application and Write.
What I am looking for is the 'developer' level settings to allow various levels of Essbase security 'above' the application level.
thanks again for your input,
Robert.

Installation of Client Access role fails on Windows Server 2008 R2 (Execution of: "$error.Clear(); Install-ExchangeCertificate -services "IIS, POP, IMAP")

Hello
I am trying to install Exchange Server 2010 beta 1 onto a Windows Server 2008 R2 (build 7000) machine which has also been set up as a domain controller.
However when attempting to install the Client Access role, setup fails with the error below.
Does anyone know of a way to get around this please?
I have already searched for this error and not found any similar threads.
Also every time I press the code button on this forum it crashes the browser and I keep losing the message! (IE8 from within Server R2). Also the message box is very small, will not expand and keeps jumping to the top.
Thanks
Robin
[code]
Summary: 4 item(s). 1 succeeded, 1 failed.
Elapsed time: 00:00:01
Preparing Setup
Completed
Elapsed Time: 00:00:00
Client Access Role
Failed
Error:
The execution of: "$error.Clear(); Install-ExchangeCertificate -services "IIS, POP, IMAP" -DomainController $RoleDomainController", generated the following error: "Could not grant Network Service access to the certificate with thumbprint 2F320F5D5B5C6873E54C8AB57F604D8AFA31D18C because a cryptographic exception was thrown.".
Could not grant Network Service access to the certificate with thumbprint 2F320F5D5B5C6873E54C8AB57F604D8AFA31D18C because a cryptographic exception was thrown.
Access is denied.
Elapsed Time: 00:00:01
Mailbox Role
Cancelled
Finalizing Setup
Cancelled
[/code]
Robin Wilson

Hello
Thanks for all the replies.
I have since wiped the system and installed everything again and it all worked this time so not sure what was wrong last time. I did try to uninstall all Exchange components and then uninstall IIS and Application server, reboot and re-install but I received the same error still when it came to installing the client access role.
Walter: I just attempted the standard installation which should have used the default self-signed certificate. Everything was a fresh install done at the same time on a freshly formatted PC.
For info last time when it failed to work:
- Installed Windows Server 2008 R2
- Installed Domain Controller role using dcpromo. I set the forest and domain as Windows Server 2008 R2
- Added a forest trust between main domain and test Exchange domain (set up as ex2010.local)
- Installed IIS and Application Server role
- Installed Hyper-v role
- Installed Desktop Experience feature
- Installed Exchange and recieved the error
When it worked I set up the forest and domain in Windows Server 2008 mode (i.e. not R2), installed Exchange first and then set up the forest trust and then Hyper-v. It did say it failed to configure dns which was probably because it started trying to do automatic updates half way through the dcpromo! DNS seems to work ok though.
I did notice this time that Hyper-v gave a warning about the virtual network adapter not being set up correctly and the local network did not work correctly although I could access the internet. Not sure if this could have been related to the cause of the problem previously. For now I have disabled the virtual network until I get time to try and get it working and so the mail will work in the meantime.
I also noticed that Hyper-v added an extra 443 ssl binding to the default website so as it had 2 bindings on port 443 it refused to start. After deleting one it worked.
I decided to install Exchange onto a domain controller as it is only a test and I wouldn't do it in a live environment. I am also short of test machines! It didn't give me any warnings about this actually, I think previous versions warn you that it is not recommended.
Andreas and Chinthaka: I did not know about the requirement to run the domain at 2003 mode. The main domain is running in 2008 mode with Exchange 2007 so I assume this is just a temporary beta related requirement. It does seem to be working (second attempt) so far in a 2008 mode domain although I haven't had a chance to fully test it yet.
Thanks
Robin
P.S. Sorry it's taken me a while to reply!
Robin Wilson

Error installing RD Web Access role service on Windows 2012 R2 server

I'm attempting to install the RD Web Access role service to test a VDI deployment but the installation keeps failing. I get the following error:
Exception of type 'Microsoft.RemoteDesktopService.Common.RDManagementException'
was thrown.
As anyone else come across this error? Any help would be appreciated.
Thank you.
Martin.

This is a Service Manager forum and it looks like you wanted to post in a general Windows Server forum. Try posting this here: http://social.technet.microsoft.com/Forums/systemcenter/en-US/home?forum=winservergen
You should also post more details on the services that you are installing.
- Get on the floor, do that dinosaur

"mail" server access info and messages deleted

Earlier today through an errant instruction, the server access info for Mail 4.6 was inadvertently deleted. This process also deleted all the messages viewable in
Mail's mailboxes: In/Sent/Trash !
From Time Machine, I restored the server access information and the deleted messages!
All of the restored messages now appear as nnnn.emix (as expected) in Home/Mail/POP email address/INBOX.mbox/messages. Similarly for Sent Messages & Deleted Messages.
However, only new messages since restore appear in Mail!!! The restored messages do not appear (although they appear as nnnn.emix in Finder)!
What am I missing here?

WOOPS!
My statement above about seeing current messages in Mail is only "partially correct." I find that if I close out Mail... then reopen the program, the messages that were there have disappeared... and, they've similarly disappeared from the nnnn.emix files in Finder!
So... something is clearly amiss!

Conceptual problem: 2 roles, 1 for access and 1 for allowed activities

Hello,
in SAP BW 3.5, I'd like to have separate role for
- access to something (queries, inforarea, etc.)
- authorization to perform an action (01 Create, 02 Change, 03 Display, Execute, etc.)
The driver being that all users will have at least 2 roles, one telling what they can access and one telling what they are allowed to do.
So far, S_RS_COMP is not that useful because it combines these 2 concepts.
Any idea, how I may be able to do it?
Thks in advance!

Dear "Smurf",
As you state yourself, there is no obvious solution. Maybe a clarification of what you want to realize could help. Could it be that your distiction between "access" and "authorization for an action" is a bit fuzzy? What I want to say is that to grant access at least means to give authorization "03 Display".
What you could is to make a distinction between "datamodel access" (S_RS_COMP + RSINFOAREA, ...), "reporting access" (role with report menu) and "content access" (role with content based authorization objects). Maybe this idea helps.
Greetings,
Stefan

Financial Reporting Studio not allowing to connect to Essbase server

Hi All,
I have installed 11.1.2.2 HFR studio (32 bit installed via workspace) on my machine and After logging in the Studio,
when I try to create the Essbase connection in it, it throws me following error:
"Failed to Connect to server"
"Error connecting to database connection connection_name: Error: Error getting CSS support information for driver [com.hyperion.ap.aps.Driver]"
Any idea to solve this.
I tried following , but this is also not helping:
-- Run the batch script HRRunAnt.cmd in the directory "D:\Oracle\Middleware\EPMSystem11R1\products\FinancialReportingStudio\products\financialreporting\install\bin"
after installation
Warm Regards,
Amit Porwal

Hello Celvin,
Thanks a lot for your reply to this post.
Actually, We have foundation on One machine and Essbase on different machine.
So we have installed (R&A) FR on machine where we have Foundation installed.
Also my Essbase machine is having Two instances of Essbase running on it, one on 1423 port and other on 1424 port.
My Environments:
MACHINE 1: Foundation + FR (FR Studio throwing error while creating essbase connection to MACHINE 2, but works opk with VM Machine)
MACHINE 2: Essbase (Two instances, one on 1423, other on 1424 port)
VM Machine: Essbase + foundation + FR on same machine (FR Studio works fine here)
Now, as per the suggested links,
2nd option-->)
we were not having the "admaps.jar" file on Foundation MACHINE 1
. so I copied this file from my other working environment (VM Machine), but I am getting error: "Failed to connect to server" when I try to create an Essbase connection on FR Studio installed on same Foundation Machine 1 to any ESSBASE instance of MACHINE 2.
So, I thought to try the below 1st option as well.
1st option-->)
I tried to set the registry values on foundation machine (FR installed), but very strang, we are not having any Folder in
"HKEY_LOCAL_MACHINE\Software\Hyperion Solutions\FinancialReporting0\HyS9FRReports"
I really Don't know how?
We have configued All the WEB in Single Managed Server on WEBLOGIC.
Also, My working environment is on a 64 bit Vritual Machine from which I copied the "admaps.jar" file to my non-working MACHINE 1.
Also using the FR Studio on this non-working MACHINE 1
, I am NOT able to connect to the Essbase server of VM environment (only one Essbase instance on 1423), also not able to any connect to any of the Essbase instance on port 1423/1424 of MACHINE 2 as well.
Any other idea to get this resolved.?
Again thanks for your time to this post.
Warm Regards,
Amit Porwal

Unable to login into Essbase server

Hi all,
I have installed Shared services and Essbase, I did "Externalize Users" in Essbase. It happened successfully. My understanding on this Externalize user is
"Essbase runs in Shared Services mode and in this mode Essbase create, Edit User permission becomes obsolete. You must be an Essbase administrator to manage users, and you must additionally be a Shared Services administrator to manage users from Shared Services"
Is this correct please validate. If this is correct, then if you change the password in shared services and sync the native directory in shared services, Essbase should work with new password but this is not happening when i try to connect the Essbase server it is throwing the below error.
"Error: 1051293: Login fails due to invalid login credentials"
Is there any other activity that has to be done in this process. I dont have clear idea on this Externalize users can any one explain.
Can any one help me in this urgent issue.
Regards,
Ramachandran J

Hi All,
Thanks for the reply. I have few more doubts.
At the time of configuring the Shared services the default login will be admin and password. But when i configure the Essbase with Shared services in Configuration Utility i had given the different user name as "essadmin".
So i have followed the following steps to do Externalize users in Essbase:-
1. Just created the same "essadmin" user in shared services
2. Done externalize users in Administration services first inside Essbase console, while doing that i have given my own password.
3. Then went into the specific Essbase server and right clicked security and externalized users there, here also while doing that i have given my own password.
By doing this step externalize users worked successfully and i can sink the user with shared services.
Can you let me know whether the above steps are correct or any other procedure is available??
And i have one more doubt....
Once externalize users has been done, all the essbase sample database and Analytic services got migrated to Shared services. Then i have created new planning application which reflected in both essbase and shared services.
Then i loged into shared services and created a new user, then granted only one specific sample application and planning application to that user and sinc with database and also i loged into planning application and refreshed database.
Then i logged into essbase with the newely created username and password... but i noticed that there is no Essbase server available with the new user login. So i added the same essbase server with "external authentation" ticked.
Once this is done all the availble application appeared in his login, Here it has Not restricted only to the applicaiton which i have given access to that user, it is showing all the application and also allowing to edit the application.
I just want to restrict a particular application to one particular user to edit the outline in essbase and this has to be acheived by giving access restriction in shared services.... now i am unable to acheive the same. Can any one help me in doing so???
Regards,
Ramachandran J

Essbase Server Hangs Intermittently - Urgent pls Help

Essbase Version - 9.3.3
Shared Services - 9.3.3
Enviroment - Windows Server 2003
We are in the process of migrating the users from Domain A to Domain B
There are around 15000 users across the board, out of which I assume there are around 250 users accessing the Hyperion Application.
Since the Domain Migration was started, We encountered Essbase Server freezes Intermittently.
Essbase Server goes down for about 10-15 Minutes and automatically comes back. No Error Msg in the Essbase Log.
Active Directory Migration was put on Hold because business had to complete their Month end Activities.
While we were working to find the RCA and identified that few users who were migrated from Domain A to Domain B appeared to be on Both the Domain and we figured out that it might be one of the reason for Essbase Server Hangs.
We had a Plan to Run the Update native Directory Utility to clear the Stale Data
Post Performing the Action our system was stable and didn't had system Hangs.
we also changed the shared services Cache refresh Interval to 24 Hrs in CSS.xml File ( Just to Make sure the Refresh happens Overnight)
Since the Active Directory Team had resumed their Migration Activies, we started Experiencing the System Hangs Issues again. server goes down for 5-10 min and comes back up
Please Input your Valuable Thoughts, Would Really Appreciate your Help.
Thanks in Advance.

Hi,
Thanks for your prompt response.
As mentioned, AD team have the filters on place, There is no issues with the User Access and there was no change in password after migrating the Domain.
I have checked the Display Session through Maxl and there is No heavy sessions.
As Stated earlier, we are unable to identify the cause regarding the System Freeze. All users access the application all of sudden essbase server hangs and it doesn't allow user to retrieve the data, nor allow him to access any application within Essbase and Planning.
After 5-10 Min, server automatically comes back.
Can you tell me if there is a way to track the system Hangs through Essbase Log without getting the any inputs from the users.
Assuming if the users sessions are heavy what makes the server hang and automatically resumes without intervention.
Shared Services Security Log display the following Error, Can you tell me if you had come across any such errors before.
com.hyperion.css.spi.impl.msad.MSADCacheUpdater.updateUserCache(Ljavax.naming.directory.DirContext;Lcom.hyperion.css.common.CSSNodeImpl;Ljava.lang.String;Ljava.lang.String;Lcom.hyperion.css.datastructures.ProviderCacheMap;Ljava.util.Map;)V(Unknown Source) - Ignoring User. Error getting User for User Cache:[LDAP: error code 32 - 0000208D: NameErr: DSID-031522C9, problem 2001 (NO_OBJECT), data 0, best match of:
'OU=USMigrate,OU=Add_Audit,OU=Users,OU=Accounts,OU=RAC-IOC,DC=us,DC=ricoh,DC=ds'
Error Code: -1
com.hyperion.css.common.configuration.CSSConfigurationException: Unable to load certificate from keystore or unable to locate keystore: SAP.keystore Error Code: 9
NestedException:
com.hyperion.css.common.configuration.CSSConfigurationException: No certificates present for SAP Authentication to take place Error Code: 9
at com.hyperion.css.SAPSecurity.loadKeyStoreWithSAPCertificate(Ljava.util.ResourceBundle;Ljava.security.KeyStore;Ljava.lang.ClassLoader;)Ljava.security.KeyStore;(Unknown Source)
Please advise.
Thanks in Advance.

BizTalk Published Web Service unable to consume, Token-Based Server access validation error

Hi, We have developed a BizTalk application and we have published as web service, but when we are trying to consume the application we are getting the an error and its logged
in event log.
While deploying we have allowed Anonymous user access for the web services as well.
Following are the errror details -
"Login failed for user 'IIS APPPOOL\ASP.NET v4.0 Classic'. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors. [CLIENT: <local machine>]"
I tried to change it other App pool as well. It seems an issue with permissions related to BizTalk user's/Group,
Please suggest which app pool should we select or should we give permissions to App Pools.

The User of App Pool should be part of "BizTalk Isolated Host Users Group".
In your case user is "IIS APPPOOL\ASP.NET v4.0 Classic", so either you add this user to BizTalk Isolated Host Users
Group or create a new App Pool with new user. I would suggest to go for new user specific to BizTalk.
This permission is required because IIS(App Pool(w3wp.exe)) will be publishing new messages to BizTalk Databases. So they should have required permissions to do that and in BizTalk we have a default group for the same, as suggested by Shankycheil.
BizTalk Isolated Host Users
The default name of the first Isolated BizTalk Host Group created by Configuration Manager. Isolated BizTalk hosts not running on BizTalk Server, such as HTTP and SOAP.
Use one BizTalk Isolated Host Group for each Isolated Host in your environment.
Contains service accounts for the BizTalk Isolated host instance in the host that the Isolated BizTalk Host Group is designated for.
BTS_HOST_USERS SQL Server Database Role in the following databases:
BizTalkMgmtDb
BizTalkMsgBoxDb
BizTalkRuleEngineDb
BizTalkDTADb
BAMPrimaryImport
Thanks,
Prashant
Please mark this post accordingly if it answers your query or is helpful.

I have 2 emai accounts which worked perfectly on iphone 4 but on iphone 5 my msn account wont let me reply to emails sent to that account, it leaves the message in my outbox saying recipient was rejected by the server because it does not allow relaying

I have 2 email accounts which both worked perfectly well on my ipone 4 but since going over to iphone 5 my msn account will not allow me to reply to any emails. It places a message on my screen stating a copy has been placed in your Outbox. The recipient @.com was rejected by the server because it does not allow relaying. Any ideas on how I can sort this. Would it be worth deleting my MSN account ant putting re-inputting the details again?

Your email provider has blocked the standard mail port 25 for sending emails and is requiring a different port. This is to avoid mail relays that use mail clients to send spam. You need to find the port that is used by your provider for sending outgoing mail. Then change the settings in your email account on your phone to match the port. You will also have to provide some security credentials for the account.
You can also try deleting the email account from your iphone, and the adding the email account back as this will many times set the correct port for sending emails.
You could also do a Google search on the the settings for your device with your email provider. That will provide you with the proper settings.

Everytime I try and sign into my iCloud account it tells me I can't log in due to a server error, but there is nothing wrong with my server . It also wont allow me to view any of my Photos or Documents that i have backed up.

Everytime I try and sign into my iCloud account it tells me I can't log in due to a server error, but there is nothing wrong with my server . It also wont allow me to view any of my Photos or Documents that I have backed up. Please help

Hi,
Are you running any Anti-virus software or do you have your firewall turned on? If so, disable them and try again. If that doesn't work, delete the iCloud account and then sign it back on again.
Make sure you are running the most current version of the iCloud Control Panel:
http://support.apple.com/kb/dl1455
Cheers,
GB

Essbase server access role - delete DB allowed?

Similar Messages

Maybe you are looking for