HFM roles in shared services

We have several users that need to be able to consolidate and translate without all other admin functions. Have tried to create a group and individually provision users with consolidate all but does not give consolidation ability unless given app admin.
How do we give them only the ability to consolidate and translate?

Try the FM Forum - https://forums.oracle.com/community/developer/english/business_intelligence/performance_management_applications/financial_consolidation
FM HSS Roles - http://docs.oracle.com/cd/E40248_01/epm.1112/hss_security_user_role/frameset.htm?apas05.html
Cheers
John
http://john-goodwin.blogspot.com/

Similar Messages

How to register HFM aplication with Shared services

Hi,
Version 11.1.2
I am new to this version and asking help how to register HFM application with shared services.
In ver 9.3.1 we register in config utility.
Regards
Kumar

You should start the EPM system configurator, it is the same concept as earlier versions, just the look and feel is slightly different.
Cheers
John
http://john-goodwin.blogspot.com/

Task List Access Manager Role in Shared Services

Hi
The documentation says this role "Assigns task lists and tasks to other users". I have assigned this role to a group (in Shared Services), I have given that group Manage and Assign access to the Task List (in Planning), and have even done a security Refresh.
Yet, when I go in as a user who is in that group, I do not see the Assign Access button in Manage Task Lists.
Is this a bug or have I missed a step?
We are on 11.1.2.1
Thanks!

Hi,
Have you tried generating a provisioning report in Shared Services, have a read of :- http://download.oracle.com/docs/cd/E10530_01/doc/epm.931/html_cas_help/provrep.htm
If that doesn't suit your requirements then you could always have a look at using CSSImportExportUtility to export provisioning to a csv file. The utility is located in hyperion\common\utilities and has a pdf on instructions how to use it.
Cheers
John
http://john-goodwin.blogspot.com/

Missing roles in Shared Services 9.3.1

We are going through an install of 9.3.1 at a clients site. Planning is working correctly with shared services, but Financial Reporting is throwing this error found in SharedServices_security.log:
2008-05-02 11:53:50,718 [ExecuteThread: '13' for queue: 'weblogic.kernel.Default'] WARN com.hyperion.css.spi.impl.nv.NativeProvider.getHierarchicalRoleTree(Ljava.util.Map;Ljava.lang.String;Lcom.hyperion.css.common.CSSRoleNode;Ljava.lang.String;Lcom.hyperion.css.spi.util.jndi.CSSDirContext;Ljava.util.Locale;Ljava.util.ResourceBundle;)V(Optimized Method) - Exception getting Child Roles in hierarchy due to Illegal or invalid id.dflt passed in. Please check the argument.
When attempting to connect from Financial Reporting Studio or Workspace we get an error stating:
"You are not authorized to use this functionality. Contact your administrator."
We are running WebLogic 8.1 service pack 4 on Windows Enterprise server 2003 sp1.
If anyone has seen or worked through this error, please respond.

Got resolution on the error. Look for css-9_3_1.dll in HYPERION_HOME\common\css\9.3.1\bin on the server where Financial Reporting is installed. This dll enables FR to communicate with NTLM. Oracle support stated that "This dll is not included in the PATH by default because nobody uses NTLM anymore." When I asked them why it was not documented despite the fact that NTLM continues to be listed prominently as a supported authentication repository, they had no reply. Watch for this one to bite you!!!

Essbase Application Doesn't show up in Selected Roles in shared services

Hello all,
I have few essbase applications which donot show up in the"Selected roles" column in Shared services though the user has been provisioned with the application. Infact the provisioned users can access the application based on the provisioning, but just that I as an administrator donot see it there in the selected roles department. Again this is only in "Selected roles" column meaning I can see it in the "Available roles" column. The application has been registered in EAS and I have also refreshed the security in EAS. We are on 11.1.1.4. Any ideas anyone?
Thanks,
Ted.
Edited by: Teddd on Jan 10, 2013 9:43 AM

Working with Oracle on it, they think it is a bug.

HFM Role

Hello -
I'm looking for the definition of different HFM roles in shared services. I went through most of the HFM documents but couldn't find the definitions. Can you please guide me on this? Thanks in advance...
Some of the role are:
Advanced User
Default
Review Supervisor
Reviewer 1
Save System Report On Server
Submitter
Unlock Data

The Security Administration Guide file contains the detail of the roles by product.
Advance user: Uses the Browser View and can access Running Tasks
Default: OIpens and closes applications, manages documents and favorites, manages smart view, access running tasks data tasks, load and extract tasks. cannot extract metadata or rules.
Review Manager: Performs all tasks involving process management
Reviewer 1 through 10: views and edits a block of data when that data is at the users's designated process management level
Save System Report on Server: Saves System reports on the server
Unlock Data: Unlocks data in data explorer

Shared Services 11.1.2 + Provisioned Roles for Business Rules not reflectin

Hi,
I have provisioned users to have 'Basic' role in shared services for Business rules. We are using Calc manager + classic planning app. However users are unable to see the business rules associated with the forms due to which the rules dont run on save. Is there a intermediary step which I am overlooking?
Regards,
N

Please ignore this question. I guess i posted in the wrong place. Not sure how to remove the thread

Shared Services Delegated Admin

Hi,
I am trying to create a delegated administrator role in Shared Services for HFM. I have created the delegated list in Shared Services and assigned a manager to the group. However when I log-in as that user I am only able to view the groups I have assigned to the delegated list, I am not able to provision users to those groups.
Any ideas on what needs to be done so that group manager can provision users to the groups?

You want to look at the Hyperion Security Administration Guide to understand Shared Service, Provisioning and External Authentication.
http://download.oracle.com/docs/cd/E10530_01/doc/epm.931/hyp_security_guide.pdf
Brian Chow

Reg: Hyperion Upgradation from 7.1.x to 9.3.x and Shared Services...

Hi Everybody,
New to this forum and i want to know about upgrading the essbase from 7.1.x to 9.3.x...As i gone through PDF, it is mentioning as upgrading of 9.3.x from earlier versions prior to release 9.2.x cannot be done directly...Here comes with the migration/upgradation topic wherein... Can we go ahead and install essbase 9.3.x on new box and migrate app's / db's from 7.1.x old box?
One more thing is like...if we are using External authentication using LDAP in 7.1.x version for security....will it be mandatory to implement shared services separately in system 9 or continue with native security mode without installing shared services...I have only essbase and no other tools implemented...
Hope u guys understand my queries!...If any body can explain on these two aspects...will be of great help to me...
Thanks for the help in advance!!

Hi,
You will have to migrate the Essbase server from 7.1.2 to 9.3.1
The steps you will follow are as below: --
1. Configure Essbase on new environment, 9.3.1 by using the same user as on 7.1.2 [THIS IS AN IMPORTANT STEP, TO MIGRATE SECURITY]
1. Take data exports of all application/databases in old environment
2. Take backups of all Essbase objects, including essbase.sec in old environment. Take security file backup after stopping Essbase 7.1.2
3. Create the applications/databases with same name in new environment 9.3.1
4. Copy the outlines and open outline in EAS in 9.3.1 and save them again.
5. Copy all objects, rules, reports, calc for all applications.
6. Stop essbase, Eas in new environment and copy security file from old environment to new environment Take backup of Essbase.sec on new environment
7. Start Essbase 9.3.1
8. Validate all databases using Esscmd "validate" command
9. Reimport all data and run default calc on all applications.
10. Now, you have the security in new Essbase server, as in old environment
11. Externalize the security in EAS.
Caution: When you migrate to Shared Services, Essbase users and groups are converted to equivalent roles
in Shared Services. Shared Services creates a superuser with the user ID named “admin,” which
is read-only. If Essbase contains a user ID named “admin”, that user ID cannot be migrated to
Shared Services. Before migrating, change the “admin” user ID (for example, from “admin” to
“asadmin”).
It is not compulsory to use shared services with Essbase 9.3.1, if you have Essbase only.
but since it the way to go, you will have to migrate your essbase security to shared services.
Let me know if it helps, by defining the reply as answered, Helpful or correct.
Cheers
RS

Shared Services User Reports - for HFM Users

Does anyone have some good material or knowledge they can share with me today regarding the following Shared Services topics?
1. What might cause a run of the Users By Group report to fail? After about 15 mins bombs out and receive the following error: "User not found with identity = ntlm:SID=S-1-5-21-787380144-986785343-375376054-10174?USER(-2147216700). Then gives much more detail on error.
2. How to remove users that appear under admin role but not in default?
3. For audit (TODAY), ideally should produce a report of HFM users – including dates (when added, when security /provisioning was changed for them) – is there a report or combo of reports that will provide this information?
Any help or a point in the right direction is hugely appreciated.
Thank you!

Ok - just some pointers, so use as suits.
1: this looks like it is not seeing your AD/NTLM user. You see a similar SID if in Properties of any file share where the connection to the domain is not available, or the user no longer exists. Remember, if a user ID in NTLM or AD has been changed, Shared Services does not recognise this, and stores the original SID, so you need to remove and reprovision the user.
2. The cleanest INHO is to do a CSS Import/Export and 'clean' the file. RTFM :)
3. There are some reports in Shared Services, but see if this is of use - especially the Security Matrix, (http://www.epmmaestro.com/dnn/Products/EPMWebSymphony/tabid/56/Default.aspx)
Good luck

IC WebClient Shared Services Business Roles

Dear All
I have a question regarding the some of the IC Webclient Shared Services roles provided by SAP.
I know that as of CRM 7.0 EHP 1.0 SAP provides separate roles for Accounting Interaction Center, Employee Interaction center and ITDS- IT HelpDesk Role along with a Shared Services Agent Role.
I want to know that is it recommended to combine the Accounting Interaction Center, Employee Interaction Center and IT HelDesk role into one role or the opporsite way of using separte roles for separate functions.
Thanks
Tarang

Hello
Well...it depends.
If you want your agents to handle all types of calls and you don't have a big-big company with many employees and a big support desk, the best option (due to maintenance reasons) is keeping everything in a single business role with a multi account identification profile.
On the other hand, if you have agents with separate and independent account, IT and employee tasks and your business processes are different depending on who is on the phone, you need three different business roles.
So, to summarize, it depends on your project needs and your company size.
Regards
Joaquin

Shared Services: Role Assignment

When I try to assign the privilege of "Server Access" from Shared Services to a user, clicking on
Essbase:servername:1 -> Essbase:servername:1 the tree does not open, but opens Default Application Group -> Essbase:servername:1.
If I add the privilege of "Server Access" by:
Default Application Group -> Essbase:servername:1 -> Administrator -> Create/Delete Application -> Server Access
user can't access to Essbase from Excel.
in addition Essbase can not see the users created through Shared Services. Only the admin user is displayed.

I faced the same issue with the server access role. If I provision an Essbase Application role , the User can access the particular application. However the user can access the application by just provisioning the Application Role anyway. Then why is there such a role called Server Access? I am using 11.1.2.0 version.

Urgent: Error in registering HFM with Shared Services while configuration.

Hi,
I am installing HFM 11.1.2 on a 64-bit Server 2008 platform with my Foundation Services server is on different
Machine. I have installed installed HFM client, Web Application and Services on both the server.
But i have configured "Deploy to Application Server" on Foundation Server to have a single domain.
All other configurations are done on the HFM Server only.
But during to Deployment to application server my "Register with shared services" part fails.
My foundation services are running. Do i require to Configure DCOM on foundation server also.
Please suggest me some ways to solve this problem.
Regards,
Arvind

Johan,
you are right, now the user are given with dba priv ,
now i am getting the below error,
(Nov 11, 2008, 05:30:03 AM), com.hyperion.cis.config.wizard.RunAllTasksWizardAction, ERROR, Error:
com.hyperion.cis.config.ProcessingException
at com.hyperion.ess.EASDBConfigurator.configure(EASDBConfigurator.java:252)
at com.hyperion.cis.config.wizard.RunAllTasksWizardAction.executeDBConfigTask(RunAllTasksWizardAction.java:282)
at com.hyperion.cis.config.wizard.RunAllTasksWizardAction.execute(RunAllTasksWizardAction.java:151)
at com.installshield.wizard.RunnableWizardBeanContext.run(Unknown Source)
Please let me know your suggestions.
Thanks,
bhavani

Shared services registration failed in HFM 11.1.1.3

We have installed the following products on the following
servers
1) Shared services server Repository : Oracle 11g installed
in 64 - bit Enterprise Linux.
2) 64 Bit HFM Installation in Windows 2003 Server.
3) Shared services installation done in Windows 2003 32-bit
OS.
4) IIS is up & running in the same (Windows 2003 Server- 64
Bit) where HFM is installed.
5) Also the shared services is accessible by using the URL
( in the Windows 2003 Server- 32 Bit)
**We are facing a problem with during the Web server configuration for HFM & shared services registration.**
the following system installers are also used :
1) V17382-01 (64 BIT SYSTEM INSTALLER)
2) V17397-01 (64 BIT FOUNDATION SERVICES 1)
3) V17369-01 (64 BIT FOUNDATION SERVICES 2)
4) V17370-01 (64 BIT FOUNDATION SERVICES 3)
5) V17372-01 (64 BIT FOUNDATION SERVICES 4)
Thanks in advance!!!

Sorry to have forgotten one more installable:
6) V17365-01.zip ( 64 Bit HFM installable)
Also if the ISS server is running in the 32-bit mode , does it affect the EPM configuration??
How do i check whether the IIS server is running in the 32 bit Mode or 64 - bit Mode.

Hyperion Shared Services Import security files where to define roles-11.1.2

Hi,
I want to create the shared services security import file. Do anyone knows where to define the group or user roles for it. Earlier we have to changes in CSImportexport.
Now in version 11.1.2.1 things are different.
Do anyone knows about it.
Thanks!!!!

Thanks for the reply.
I am taking export only first and this is what i got from export, if you see below under role id there are some codes generated internally, if I have to give any group different roles like planner, application creator, interactive user... where in csv file I can define those.
#provisioning
project_name ----------     application_name     -----role_id     --------------------------------------------------------------------------------------------- product_typ--------user_id-------     user_provider
Default Application Group---     CPSPlan-----     native://DN=cn=HP:0003,ou=HP,ou=Roles,dc=css,dc=hyperion,dc=com?ROLE--     HP-11.1.2.0-------     admin--------Native Directory
Default Application Group---     CPSPlan-----     native://DN=cn=HUB:2,ou=HUB,ou=Roles,dc=css,dc=hyperion,dc=com?ROLE---     HUB-11.1.2.0-----     admin--------Native Directory
Default Application Group---     CPSPlan-----     native://DN=cn=HP:0001,ou=HP,ou=Roles,dc=css,dc=hyperion,dc=com?ROLE--     HP-11.1.2.0-------     devusr-------Native Directory
Default Application Group---     CPSPlan-----     native://DN=cn=HP:0001,ou=HP,ou=Roles,dc=css,dc=hyperion,dc=com?ROLE--     HP-11.1.2.0-------     OMBUsr-----     Native Directory
Default Application Group---     CPSPlan------native://DN=cn=HP:0003,ou=HP,ou=Roles,dc=css,dc=hyperion,dc=com?ROLE--HP-11.1.2.0-------     processadmin-----     Native Directory
Regards.

HFM roles in shared services

Similar Messages

Maybe you are looking for