HFM Role

Hello -
I'm looking for the definition of different HFM roles in shared services. I went through most of the HFM documents but couldn't find the definitions. Can you please guide me on this? Thanks in advance...
Some of the role are:
Advanced User
Default
Review Supervisor
Reviewer 1
Save System Report On Server
Submitter
Unlock Data

The Security Administration Guide file contains the detail of the roles by product.
Advance user: Uses the Browser View and can access Running Tasks
Default: OIpens and closes applications, manages documents and favorites, manages smart view, access running tasks data tasks, load and extract tasks. cannot extract metadata or rules.
Review Manager: Performs all tasks involving process management
Reviewer 1 through 10: views and edits a block of data when that data is at the users's designated process management level
Save System Report on Server: Saves System reports on the server
Unlock Data: Unlocks data in data explorer

Similar Messages

HFM roles in shared services

We have several users that need to be able to consolidate and translate without all other admin functions. Have tried to create a group and individually provision users with consolidate all but does not give consolidation ability unless given app admin.
How do we give them only the ability to consolidate and translate?

Try the FM Forum - https://forums.oracle.com/community/developer/english/business_intelligence/performance_management_applications/financial_consolidation
FM HSS Roles - http://docs.oracle.com/cd/E40248_01/epm.1112/hss_security_user_role/frameset.htm?apas05.html
Cheers
John
http://john-goodwin.blogspot.com/

"Could not authenticate the specified user" error in HFM 9.2.1

Hi,
I'm installing Hyperion 9.2.1, and I have installed and configured shared service and hfm successfully, but when I failed to create hfm application.
The reproduce step is:
1. login http://hostname/hfm/Home/LaunchPage.asp, with admin/password
2. click a cluster, and click "create applcation", it failed with error:
Could not authenticate the specified user. %0
Error Reference Number: {184D6C1E-94C5-4722-93B0-15D88871485B}
And error in the log file is:
ERROR Authentication not found user appqa-vm05\admin 。
com.hyperion.hfm.security.CASSecurityException: not found user appqa-vm05\admin。
at com.hyperion.hfm.security.Authentication.AuthenticateUserInternal(Unknown Source)
at com.hyperion.hfm.security.Authentication.AuthenticateUserAndGetInfo(Unknown Source)
Have you ever met this issue?
Thanks,
Xinying

Hi J,
Thanks for your response.
<<1. The user with you are logging in HFM is used for configuring HFM
My OS is windows 2003 server, I installed and ran configurator of shared service and hfm with the OS user "administrator".
And I can login shared service with "administrator", but I met issue when creating hfm application. Also can login hfm" with admin/password" , but has same issue for creating application. Seems user is not checked when loging hfm.
<<2. This user is able to log on to Shared Services and is provisioned for creating HFM application
I can login shared service with user "admin/password".
But when clicking "provision" for user "admin", I can only find "shared service" role, no any hfm role.
user "administrator"
<<3. This user is used in Server and web configuration of HFM
In server and web configuration, I set the DCOM domain user as: hostname\administrator
In my setup, two users are used,
1st one is OS user: administrator
2nd user is: admin ( seems it is the default user after installation and configuration of Shared service?)
Thanks,
Xinying

SmartView, Web Grid, and System 9 BI+ Reports users

In my security design for an HFM 9.3.1 installation I have a group of users that will need to use SmartView and Web Grids for analysis and have "read-only" access to reports in System 9 BI+. Can anyone give me some suggestions for an HFM role or combination of roles that would accomplish this without giving the users more access than they need?
How about users who will be uploading data to HFM through FDM? I have set those users up in FDM, but am not sure what role to assign them in HFM. Any suggestions?
Thanks

Thanks Kelly.
When looking at the possible HFM user roles to assign to FDM data loaders, the only one that seems close to the one that you suggest is "Load Excel Data" which allows the user to load to the HFM database from SmartView. I don't really want to grant users the ability to do that as I don't want them to be able to bypass the validations that I am building into FDM. The "Load System" role would also give the users more rights than I want to allow them. Am I missing something?
Thanks again!
Nick

Restricting Access to "Load Data" Task in Workspace

In HFM 9.3.1 it appears as though any user, regardless of their HFM Role, can create a task list in Workspace (Administration<Manage Documents<Tasklists<New Tasklist) and add the "Data Load" and "Data Extract" tasks to the list. I tested this with a user who only had the Create Journals role. He was able to create a task list and include the Data Load task.
I would like to restrict users from being to load data to HFM through Workspace, but I don't know how to prevent them from creating their own task lists and including the Data Load task.
Any thought?

Hi,
go to the PageDef file and select the iterator. Set the Refresh condition to Never (in which case you need to explicitly query the iterator) or use the refresh condition property to add EL that references a managed bean that returns true/false based on whether the table should be populated or not. Another option, in case you wanted to let the user enter query criteria is to create a ViewCriteria in ADF BC and drag/drop it as a Query panel with table
Frank

Journal Security role in HFM


Hi, All
There is a scenario, I want to restrict the user to post the journal but he can not unpost the journal in HFM?
How would I achieve this? Post and unpost roles are not segregated in HFM. (Means Post journal role includes the unpost journal role also) How to achieve this?
Regards
Taruni


This type of access is not for loading metadata(what you refer to as write access) it is basically a filter used during the display of the Metadata using any of the interfaces.
In your example US Security Class for the people in US region.
A user will be able to see all of the Entities tagged with the US Security Class, so if you have a "Global Region" that includes say "Europe" the user won't be able to see this structure when they are navigating in the Entity Dimension. If you also tagged some accounts for the exclusive use of US entities (with US Security Class) then, the Europeans won't have access to those accounts when they navigate the Account Dimension.
Hope this will help you clarify the use of the Security Classes.
Also, for this filter to take effect, you must enable METADATA SECURITY FILTERING in the Application Settings.
Edited by: Raul Rodriguez on Nov 13, 2008 9:58 AM

Roles of IIS and Apache services in HFM.

Hi,
Can any one tell me the roles of Apache and IIS services pertaining to HFM.
when i open the httpd.conf file of apache, it says port values changed from 80 to 19000,
i can access workspace on 19000, as well as on 45000. is it because of Apache or IIS?
i am unable to track the flow of the processes,
Any help would be appreciated.

The role of IIS is your choice. It depends on what web server you want to use. In this case, you chose the Apache web server, which IMO, is much easier to deal with and configure, not to mention much more stable, than IIS5 or 6.
Now, HFM and Smartview (asp.net application) are hosted using IIS. The only role it looks like IIS will be playing in your configuration will be that of hosting both of these.
Do not forget to go to the httpd.conf file for the Apache web server (located under LocalDrive:\Hyperion\common\httpservers\apache\...\conf\) and make sure an entry is set in there for a proxy redirect to the hfm.conf file)
Then under the same folder, the hfm.conf file should have listed the url to your hfm server. Sometimes even under automatic configuration, this file is not properly configured, and it lists the redirect to go to the Workspace server, which will never work because it is not the hfm server usually.

HFM security roles to perform only Extract tasks

Hello,
Could any one please tell me what roles I need to give for a user so that he can only perform extract tasks?
I gave him Extended analytica and advanced user roles.
But I could see Extract data and Extract journal tasks but not the rest of them.
I am using HFM 9.3.1.
Thanks
Hemanth

I have provisioned a new native user ID w/ extended analytics and default access but get this error message when running EA from application:
(-2147208192) (An unknown error has occurred in the HsvData object.)
Does anyone know what additional security should be provisioned?

Financial Management Application Roles to view HFM application

Hi all,
I have created new user for view the HFM application. Can anyone please mention what are all the Financial Management Application Roles to be given to the new user.
Thanks in Advance,

See if it helps how to migrate jazn-data.xml to system-jazn-data.xml.
system-jazn-data.xml migration problem
Also see this, http://andrejusb.blogspot.in/2010/05/migrating-security-policies-from.html

Access is denied while creation hfm classic application in workspace

access is denied while creation hfm classic application in workspace. i have given full roles and access to my admin user. still i am facing same issue.
i am trying to create classic application workspace under
Access is denied.
Access is denied.
Show Details:
Error Reference Number: {401A779B-3846-4645-852B-D036AF74C7DA}
Num: 0x80070005;Type: 1;DTime: 9/26/2008 7:10:10 PM;Svr: KOTHRUD;File: CHsxClient.cpp;Line: 1087;Ver: 9.3.1.0.1502;
Num: 0x80070005;Type: 1;DTime: 9/26/2008 7:10:10 PM;Svr: KOTHRUD;File: CHsxClient.cpp;Line: 768;Ver: 9.3.1.0.1502;
Num: 0x80070005;Type: 0;DTime: 9/26/2008 7:10:10 PM;Svr: KOTHRUD;File: CHsxClient.cpp;Line: 3430;Ver: 9.3.1.0.1502;
Num: 0x80070005;Type: 0;DTime: 9/26/2008 7:10:10 PM;Svr: KOTHRUD;File: CHFMwManageApplications.cpp;Line: 2152;Ver: 9.3.1.0.1502;

Hello,
Do you have the HFM ADM drivers installed on the workspace server -- I believe if you do not have those installed then you are going to have some issues.
Regards,
-John

HFM Security Issue - User can submit a journal by by-passing the approval step even though they are not an admin.

Hi All,
I was wondering if anyone could help me with a HFM security issue on HFM 11.1.2.3 we are facing please?
The problem is that a user can by-pass the journal approval stage and post directly after submitting if Custom4 access control=All is selected.
If any of the other access controls (None, Read, Promote) for custom 4 are selected, the first two steps of the process are possible -
input and approval of the journal are possible but final posting of the journal is not and returns an error that says:
"User does not have the access right to perform this journal task"
The options I have thought for a workaround are as follows:
1.       1. Set up a 3rd user called data poster and remove submit journal role from user 1 (data inputter)
2.       2. Put in place process control and use the various review levels (could be quite time consuming given there is no time left for development)
Have anyone experienced this before and come up with a quick way of resolving this please? It would be very much appreciated.
We have two types of users who are associated with groups in HFM and have the appropriate roles assigned to them to complete their tasks,
they are:
1. A data Inputter (who inputs base data and journals, who has access to create and submit journals)
2.   2. A data reviewer (who approves journals)
The process is as follows:
1.       1. Logon as Data inputter to submit the journals
2.       2. Logon as Data reviewer to approve the journals
3.       3. Logon as Data inputter to post the Journals
We are using the custom 4 member to identify different adjustment types. At the moment we are able to set it up in such a way whereby Steps 1 and 2 can be completed
but once it comes back to step 3, we get an error as follows:
"User does not have the access right to perform this journal task"
(This error comes about when the access control on custom 4 is set to None, Read, Promote)
Custom 4 Access Rights looks as follows:
C4_ADJ01
C4_ADJ02
C4_ADJ03
C4_ADJ04
HFMDefault
Read
Read
Read
Read
HFMLoad
All
Promote
None
Read
HFMReview
Read
All
All
All
When Custom 4=C4_ADJ01 all 3 steps can be completed but it by-passes step 2 (journal approval).
For all other Custom 4 we complete steps 1 and 2 successfully but not step 3 due to access issues.
Roles for the groups that users assigned look like the following:
Test User Name
Test User Name
Access Rights
1
Base Data input/Journal Data input
test_HFMLoad
Reviewer 1
Review Supervisor
Create Journals
Read Journals
Database Management
Enable write back in Web Grid
Load Excel Data
Generate Recurring
Post Journals
Create Unbalanced Journals
Manage Templates
Data Form Write Back from Excel
Consolidate
2
Data Reviewer
test_HFMReview
Reviewer 1
Review Supervisor
Create Journals
Read Journals
Database Management
Approve Journals
Consolidate
Reviewer 2
Generate Recurring
Manage Templates
Create Unbalanced Journals
Any help or advice would be much appreciated.
Thanks in advance,
M.

Hi All,
I was wondering if anyone could help me with a HFM security issue on HFM 11.1.2.3 we are facing please?
The problem is that a user can by-pass the journal approval stage and post directly after submitting if Custom4 access control=All is selected.
If any of the other access controls (None, Read, Promote) for custom 4 are selected, the first two steps of the process are possible -
input and approval of the journal are possible but final posting of the journal is not and returns an error that says:
"User does not have the access right to perform this journal task"
The options I have thought for a workaround are as follows:
1.       1. Set up a 3rd user called data poster and remove submit journal role from user 1 (data inputter)
2.       2. Put in place process control and use the various review levels (could be quite time consuming given there is no time left for development)
Have anyone experienced this before and come up with a quick way of resolving this please? It would be very much appreciated.
We have two types of users who are associated with groups in HFM and have the appropriate roles assigned to them to complete their tasks,
they are:
1. A data Inputter (who inputs base data and journals, who has access to create and submit journals)
2.   2. A data reviewer (who approves journals)
The process is as follows:
1.       1. Logon as Data inputter to submit the journals
2.       2. Logon as Data reviewer to approve the journals
3.       3. Logon as Data inputter to post the Journals
We are using the custom 4 member to identify different adjustment types. At the moment we are able to set it up in such a way whereby Steps 1 and 2 can be completed
but once it comes back to step 3, we get an error as follows:
"User does not have the access right to perform this journal task"
(This error comes about when the access control on custom 4 is set to None, Read, Promote)
Custom 4 Access Rights looks as follows:
C4_ADJ01
C4_ADJ02
C4_ADJ03
C4_ADJ04
HFMDefault
Read
Read
Read
Read
HFMLoad
All
Promote
None
Read
HFMReview
Read
All
All
All
When Custom 4=C4_ADJ01 all 3 steps can be completed but it by-passes step 2 (journal approval).
For all other Custom 4 we complete steps 1 and 2 successfully but not step 3 due to access issues.
Roles for the groups that users assigned look like the following:
Test User Name
Test User Name
Access Rights
1
Base Data input/Journal Data input
test_HFMLoad
Reviewer 1
Review Supervisor
Create Journals
Read Journals
Database Management
Enable write back in Web Grid
Load Excel Data
Generate Recurring
Post Journals
Create Unbalanced Journals
Manage Templates
Data Form Write Back from Excel
Consolidate
2
Data Reviewer
test_HFMReview
Reviewer 1
Review Supervisor
Create Journals
Read Journals
Database Management
Approve Journals
Consolidate
Reviewer 2
Generate Recurring
Manage Templates
Create Unbalanced Journals
Any help or advice would be much appreciated.
Thanks in advance,
M.

How to Extract data from HFM in ANSI format?

We want the .dat file from Extract data in ANSI format. Currently this file is created by default in Unicode format. I tried unchecking the 'Save all files in Unicode format' option in Consolidation tab under Preferences, but for some reason the change is not getting saved.
Does unchecking of this option change the file format?
Is there any other option to change the file format ?
What is required to be done to save the changes made in Preferences?
I am using HFM 9.3.1
Edited by: Amit Kumar on May 20, 2009 7:52 PM

Any info on this issue?
The changes made in preferences are not getting saved for some users. Is this related to role assigned?

Hyperion HFM Classic Applications not showing up in Calcuation Manager

Hello,
11.1.2.2
HFM Classic applications are not showing up in Calculation
Manager.
The following error is generated…
"There was an error retrieving the list of classic applications. Please see the Calculation Manager log for more information"
I see in the log
Excerpt from log…
com.hyperion.calcmgr.common.CalcMgrODLLogger] [APP:
CALC#11.1.2.0] [SRC_METHOD: logInfoMsg] The custom error module does not recognize this error.
[2013-08-08T17:01:11.981-04:00] [CalcMgr0] [WARNING]
[EPMCAL-00002] [oracle.bi.bifndnepm.calcmgr.common.GenericLogger] [tid: 21]
[userId: <anonymous>] [ecid: 0000K1VidTD5UcG6yzbe6G1I0iTy0000Ok,0] [SRC_CLASS:
com.hyperion.calcmgr.common.CalcMgrODLLogger] [APP: CALC#11.1.2.0] [SRC_METHOD:
log] Exiting com.hyperion.calcmgr.provider.hfm.HFMProvider.getApplications
73311
[2013-08-08T17:01:12.288-04:00] [CalcMgr0] [NOTIFICATION] []
[oracle.bi.bifndnepm.calcmgr.common.GenericLogger] [tid: 21] [userId:
<anonymous>] [ecid: 0000K1VidTD5UcG6yzbe6G1I0iTy0000Ok,0] [SRC_CLASS:
com.hyperion.calcmgr.common.CalcMgrODLLogger] [APP: CALC#11.1.2.0] [SRC_METHOD:
logInfoMsg] Global role
for user: srecine is ADMINISTRATOR
Note: the user is fully provisioned for all HFM applications, however, they do not show up in Calc Mgr.
There was a known issue in 11.1.2.1 where a patch fixed this issue, however, this is 11.1.2.2 and I see no applicable patch.
any ideas where to go from here?
Joe Orgill

Yes the issue in 11.1.2.1 should be fixed in 11.1.2.2
The 11.1.2.2 Readme has it in the list of defects fixed:
12421352 - You cannot select Financial Management Classic applications from Oracle Hyperion Calculation Manager.
It may be worth logging with Oracle is you believe the configuration is correct.
Cheers
John
http://john-goodwin.blogspot.com/

HFM OpenApplication Unspecified Error

Hi All,
Greetings!
I am facing this issue while opening HFM application (after I created the new HFM application).
*Note: I am getting this same error when I try to open a newly created HFM app in system 9.2/9.3/11.1.1.3/11.1.2. SO i believe there is some security/RAM/access issue for the admin ID with IIS/DCOM configuration. (As the error messages and other logs are same for all versions)
Error description:
 Unspecified Error
 Error code: -2147467259
Trace: Error Reference Number: {87AEAE93-9AA1-4F73-93E9-255288C00B15};User Name: ankit@Native Directory Num: 0x80004005;Type: 0;DTime: 9/6/2012 10:48:14 AM;Svr: MyServer;File: CHsxServerImpl.cpp;Line: 1880;Ver: 11.1.1.3.0.2413; Num: 0x80004005;Type: 0;DTime: 9/6/2012 10:48:22 AM;Svr: MyServer;File: CHsxServerImpl.cpp;Line: 2176;Ver: 11.1.1.3.0.2413; Num: 0x80004005;Type: 0;DTime: 9/6/2012 10:48:22 AM;Svr: MyServer;File: CHsxServerImpl.cpp;Line: 3876;Ver: 11.1.1.3.0.2413; Num: 0x80004005;Type: 1;DTime: 9/6/2012 10:48:22 AM;Svr: MyServer;File: CHsxServer.cpp;Line: 1481;Ver: 11.1.1.3.0.2413;DStr: OpenApplication: BHI; Num: 0x80004005;Type: 0;DTime: 9/6/2012 10:48:22 AM;Svr: MyServer;File: CHsxClient.cpp;Line: 2373;Ver: 11.1.1.3.0.2413; Num: 0x80004005;Type: 0;DTime: 9/6/2012 10:48:22 AM;Svr: MyServer;File: CHFMwManageApplications.cpp;Line: 206;Ver: 11.1.1.3.0.2413;
HFM log error viewer:
 1. Unspecified Error
 File: CHsxServerImpl.cpp Version: 11.1.1.3.0.2413 Line: 1880 Error: (-2147467259)(0x80004005)(Unspecified error)
 File: CHsxServerImpl.cpp Version: 11.1.1.3.0.2413 Line: 2176 Error: (-2147467259)(0x80004005)(Unspecified error)
 File: CHsxServerImpl.cpp Version: 11.1.1.3.0.2413 Line: 3876 Error: (-2147467259)(0x80004005)(Unspecified error)
 File: CHsxServer.cpp Version: 11.1.1.3.0.2413 Line: 1481 Error: (-2147467259)(0x80004005)(Unspecified error)
 File: CHsxClient.cpp Version: 11.1.1.3.0.2413 Line: 2373 Error: (-2147467259)(0x80004005)(Unspecified error)
 2. HsvDatasource for application ABC with a process ID of 5008 on server MyServer failed to start!
 File: CHsvDataSource.cpp Version: 11.1.1.3.0.2413 Line: 257
 Error: (-2147215102)(0x80041902)(HsvDatasource for application BHI with a process ID of 5008 on server MyServer failed to start!
System:
 Type : Vrtual Machine
 OS : Windows 2003 Server R2 Enterprise edition
 RAM : 2GB
 .NET : 2.0.50727 (IIS 6)
 RDBMS : SQL 2000 SP3 pack
 Hyperion Version: 11.1.1.3 (*Used Apache for deploying workspace app)
Pre-Installation checks:
 1. The OS admin ID were given necessary roles and provileges.
 2. Necessary local policy rights were taken care of.
 3. SQL Admin ID has necessary rights (like Bulk insert etc.)
 4. In IIS, the web service extensions like CGI/ISAPI were set to allowed.
Installation & Config checks:
 5. There were no errors while installation or configuration.
 6. DCOM was correctly enabled.
 7. IIS is correctly configured and running.
Post-Installtion checks:
 8. Created new user with admin rights for creating application.
 9. No error in logging to workspace.
 10. No error while creating or registering the new HFM application.
 11. The HFM and other directories in IIS is correctly configured with necessary rights.
 12. The URL http://MyServer/hfm returns 'HFM' at the page, so hopefully HFM is configured correctly.
Services Running:
 Foundation and OpenLdap
 Workspace Agent and Web app
 Apache 2.0
 HFM DME and Web Service Manager
 (Note: HFM Management service is stopped)
Any help will be highly appreciated.
Regards,
Ankit

Hi there,
I have seen this error in the past I think.
It is related with the configuration of the app server and the Working Folder.
I would suggest to reconfigure your system and make sure that all the folders that you will define during configuration exist.
Regards,
Thanos

Role Access : SS Provision Report vs Workspace Security Extract

Is this normal, we are using EPM 11.1.2 Classic Metadata.
I Setup a user 123049, provisioned him HFM access to "Reserved" only.
I also add the same user to a native group called FM_Loc_Reviewer which has provision access to 7 Roles: Approve JE ,Consolidate,Create JE, Load Excel Data, Post JE, Reviewer 1 and Save System Report on Server.
When i extract security from workspace it has user, 123049 showing up with the combined provision of his id and the group he belongs to. Is this a te way it is suppose to be? In HFM 4.02 it would only show his access
Thanks
From Shared Services:
User@Directory     Role     Inheritance Information
123049@CompanyA     Approve Journals     FM_Loc_Reviewer
123049@CompanyA     Consolidate     FM_Loc_Reviewer
123049@CompanyA     Create Journals     FM_Loc_Reviewer
123049@CompanyA     Load Excel Data     FM_Loc_Reviewer
123049@CompanyA     Post Journals     FM_Loc_Reviewer
123049@CompanyA     Reserved     -
123049@CompanyA     Reviewer 1     FM_Loc_Reviewer
123049@CompanyA     Save System Report On Server     FM_Loc_Reviewer
From Security Extract:
!ROLE_ACCESS
Reviewer 1     123049@CompanyA
Reserved     123049@CompanyA
Save System Report On Server 123049@CompanyA
Create Journals     123049@CompanyA
Approve Journals     123049@CompanyA
Load Excel Data     123049@CompanyA
Consolidate     123049@CompanyA
Post Journals     123049@CompanyA
Edited by: user13116744 on Nov 17, 2010 9:58 AM

This is a sample on the way it looks in mine.... we are using EPM 11.1.3 Classic Metadata
!ROLE_ACCESS
Provisioning Manager;admin@mycompany
Application Administrator;admin@mycompany
Reviewer 1;myuser@Native Directory
Reviewer 2;myuser@Native Directory
Reviewer 1;myuser2@Native Directory
Reviewer 3;myuser2@Native Directory
Read Journals;myuser3@Native Directory

HFM Role

Similar Messages

Maybe you are looking for