HFM security

Unable to login with MSAD users but native users are able to login into HFM. All the native an dmSAD users are able to login to workspace and other hyperion modules except HFM application.
2008-07-24 18:10:34,101 [AWT-EventQueue-0] DEBUG com.hyperion.css.SAPSecurity.loadSAPCertificate(SAPSecurity.java:149) - Alias : mykey
2008-07-24 18:10:34,116 [AWT-EventQueue-0] DEBUG com.hyperion.css.SAPSecurity.loadSAPCertificate(SAPSecurity.java:159) - Unable to locate keystore or no entries in keystore: SAP.keystore
2008-07-24 18:10:34,116 [AWT-EventQueue-0] DEBUG com.hyperion.css.SAPSecurity.loadSAPCertificate(SAPSecurity.java:174) - Unable to load certificate from keystore or unable to locate keystore: SAP.keystore
Error Code: -1
com.hyperion.css.common.configuration.CSSConfigurationException: Unable to locate keystore or no entries in keystore: SAP.keystore     Error Code: 9
     at com.hyperion.css.SAPSecurity.loadSAPCertificate(SAPSecurity.java:165)
     at com.hyperion.css.CSSAPIImpl.initialize(CSSAPIImpl.java:2957)
     at com.hyperion.cis.config.CmsRegistrationUtil.getStandAlonCSS(CmsRegistrationUtil.java:96)
     at com.hyperion.cis.config.CmsRegistrationUtil.<init>(CmsRegistrationUtil.java:68)
     at com.hyperion.cis.config.wizard.HubRegistrationPanel.queryExit(HubRegistrationPanel.java:149)
     at com.installshield.wizard.awt.AWTWizardUI.doNext(Unknown Source)
     at com.installshield.wizard.awt.AWTWizardUI.actionPerformed(Unknown Source)
     at com.installshield.wizard.swing.SwingWizardUI.actionPerformed(Unknown Source)
     at com.installshield.wizard.swing.SwingWizardUI$SwingNavigationController.notifyListeners(Unknown Source)
     at com.installshield.wizard.swing.SwingWizardUI$SwingNavigationController.actionPerformed(Unknown Source)
     at javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:1786)
     at javax.swing.AbstractButton$ForwardActionEvents.actionPerformed(AbstractButton.java:1839)
     at javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:420)
     at javax.swing.DefaultButtonModel.setPressed(DefaultButtonModel.java:258)
     at javax.swing.plaf.basic.BasicButtonListener.mouseReleased(BasicButtonListener.java:245)
     at java.awt.Component.processMouseEvent(Component.java:5100)
     at java.awt.Component.processEvent(Component.java:4897)
     at java.awt.Container.processEvent(Container.java:1569)
     at java.awt.Component.dispatchEventImpl(Component.java:3615)
     at java.awt.Container.dispatchEventImpl(Container.java:1627)
     at java.awt.Component.dispatchEvent(Component.java:3477)
     at java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:3483)
     at java.awt.LightweightDispatcher.processMouseEvent(Container.java:3198)
     at java.awt.LightweightDispatcher.dispatchEvent(Container.java:3128)
     at java.awt.Container.dispatchEventImpl(Container.java:1613)
     at java.awt.Window.dispatchEventImpl(Window.java:1606)
     at java.awt.Component.dispatchEvent(Component.java:3477)
     at java.awt.EventQueue.dispatchEvent(EventQueue.java:480)
     at java.awt.EventDispatchThread.pumpOneEventForHierarchy(EventDispatchThread.java:201)
     at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:151)
     at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:145)
     at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:137)
     at java.awt.EventDispatchThread.run(EventDispatchThread.java:100)
2008-07-24 18:10:34,116 [AWT-EventQueue-0] DEBUG com.hyperion.css.CSSAPIImpl.initialize(CSSAPIImpl.java:2959) - SAP Authentication with login ticket not initialized
Error Code: -1

OMG this sounds like a technical question.
Do you realize this forum is dedicated to discussing problems with getting downloads, not with running after you've downloaded?
You might find it better to ask in a forum where other people who know these acronyms hang out - Hyperion is part of the Business Intelligence group at http://forums.oracle.com/forums/category.jspa?categoryID=145
And for the future - Oracle has several hundred products running on several dozen different platforms. Providing product name, version and operating system is considered Common courtesy.

Similar Messages

HFM Security Issue - User can submit a journal by by-passing the approval step even though they are not an admin.

Hi All,
I was wondering if anyone could help me with a HFM security issue on HFM 11.1.2.3 we are facing please?
The problem is that a user can by-pass the journal approval stage and post directly after submitting if Custom4 access control=All is selected.
If any of the other access controls (None, Read, Promote) for custom 4 are selected, the first two steps of the process are possible -
input and approval of the journal are possible but final posting of the journal is not and returns an error that says:
"User does not have the access right to perform this journal task"
The options I have thought for a workaround are as follows:
1.       1. Set up a 3rd user called data poster and remove submit journal role from user 1 (data inputter)
2.       2. Put in place process control and use the various review levels (could be quite time consuming given there is no time left for development)
Have anyone experienced this before and come up with a quick way of resolving this please? It would be very much appreciated.
We have two types of users who are associated with groups in HFM and have the appropriate roles assigned to them to complete their tasks,
they are:
1. A data Inputter (who inputs base data and journals, who has access to create and submit journals)
2.   2. A data reviewer (who approves journals)
The process is as follows:
1.       1. Logon as Data inputter to submit the journals
2.       2. Logon as Data reviewer to approve the journals
3.       3. Logon as Data inputter to post the Journals
We are using the custom 4 member to identify different adjustment types. At the moment we are able to set it up in such a way whereby Steps 1 and 2 can be completed
but once it comes back to step 3, we get an error as follows:
"User does not have the access right to perform this journal task"
(This error comes about when the access control on custom 4 is set to None, Read, Promote)
Custom 4 Access Rights looks as follows:
C4_ADJ01
C4_ADJ02
C4_ADJ03
C4_ADJ04
HFMDefault
Read
Read
Read
Read
HFMLoad
All
Promote
None
Read
HFMReview
Read
All
All
All
When Custom 4=C4_ADJ01 all 3 steps can be completed but it by-passes step 2 (journal approval).
For all other Custom 4 we complete steps 1 and 2 successfully but not step 3 due to access issues.
Roles for the groups that users assigned look like the following:
Test User Name
Test User Name
Access Rights
1
Base Data input/Journal Data input
test_HFMLoad
Reviewer 1
Review Supervisor
Create Journals
Read Journals
Database Management
Enable write back in Web Grid
Load Excel Data
Generate Recurring
Post Journals
Create Unbalanced Journals
Manage Templates
Data Form Write Back from Excel
Consolidate
2
Data Reviewer
test_HFMReview
Reviewer 1
Review Supervisor
Create Journals
Read Journals
Database Management
Approve Journals
Consolidate
Reviewer 2
Generate Recurring
Manage Templates
Create Unbalanced Journals
Any help or advice would be much appreciated.
Thanks in advance,
M.

Hi All,
I was wondering if anyone could help me with a HFM security issue on HFM 11.1.2.3 we are facing please?
The problem is that a user can by-pass the journal approval stage and post directly after submitting if Custom4 access control=All is selected.
If any of the other access controls (None, Read, Promote) for custom 4 are selected, the first two steps of the process are possible -
input and approval of the journal are possible but final posting of the journal is not and returns an error that says:
"User does not have the access right to perform this journal task"
The options I have thought for a workaround are as follows:
1.       1. Set up a 3rd user called data poster and remove submit journal role from user 1 (data inputter)
2.       2. Put in place process control and use the various review levels (could be quite time consuming given there is no time left for development)
Have anyone experienced this before and come up with a quick way of resolving this please? It would be very much appreciated.
We have two types of users who are associated with groups in HFM and have the appropriate roles assigned to them to complete their tasks,
they are:
1. A data Inputter (who inputs base data and journals, who has access to create and submit journals)
2.   2. A data reviewer (who approves journals)
The process is as follows:
1.       1. Logon as Data inputter to submit the journals
2.       2. Logon as Data reviewer to approve the journals
3.       3. Logon as Data inputter to post the Journals
We are using the custom 4 member to identify different adjustment types. At the moment we are able to set it up in such a way whereby Steps 1 and 2 can be completed
but once it comes back to step 3, we get an error as follows:
"User does not have the access right to perform this journal task"
(This error comes about when the access control on custom 4 is set to None, Read, Promote)
Custom 4 Access Rights looks as follows:
C4_ADJ01
C4_ADJ02
C4_ADJ03
C4_ADJ04
HFMDefault
Read
Read
Read
Read
HFMLoad
All
Promote
None
Read
HFMReview
Read
All
All
All
When Custom 4=C4_ADJ01 all 3 steps can be completed but it by-passes step 2 (journal approval).
For all other Custom 4 we complete steps 1 and 2 successfully but not step 3 due to access issues.
Roles for the groups that users assigned look like the following:
Test User Name
Test User Name
Access Rights
1
Base Data input/Journal Data input
test_HFMLoad
Reviewer 1
Review Supervisor
Create Journals
Read Journals
Database Management
Enable write back in Web Grid
Load Excel Data
Generate Recurring
Post Journals
Create Unbalanced Journals
Manage Templates
Data Form Write Back from Excel
Consolidate
2
Data Reviewer
test_HFMReview
Reviewer 1
Review Supervisor
Create Journals
Read Journals
Database Management
Approve Journals
Consolidate
Reviewer 2
Generate Recurring
Manage Templates
Create Unbalanced Journals
Any help or advice would be much appreciated.
Thanks in advance,
M.

Monitoring HFM security

I am using Hyperion 11.1.2.1. and want to monitor some HFM security.
Is there any way we can find that :
how many number of users are currently accessing a particular HFM Application and can identify them with their user-details and login-details whenever required ?
how many number of users are currently accessing the whole HFM Application(Schema) and can identify them with their user-details and login-details whenever required ?
-----Sunny

Hi Sunny,
As the subject was about HFM Security i have given you the query or details which i was aware about HFM.
1.I mean to say for the tables i have listed in the query there are other columns as well so if you want to get more details then you can select which are all the columns you would require and add them accordingly in the query.
2.Yeah its possible to get the details about user connected to application even. here is the query you need to change for this as below
select h.sservername,h.sappname,s.susername,to_char((to_date('01/1900','MM/YYYY')+h.dstarttime-2),'DD/MM/YYYY hh24:mi:ss'),h.lactivitycode,h.sactivitydesc
from hsv_users_on_system h,hsv_activity_users s
where h.luserid in s.luserid
order by sservername
Also as you were asking for Historical/past login times & details here is the below query which will help you in analysing the things better with activity they did and time they logged in and carried out activity.
select g.servername,g.appname,to_char((to_date('01/1900','MM/YYYY')+g.starttime-2),'DD/MM/YYYY hh24:mi:ss'),to_char((to_date('01/1900','MM/YYYY')+g.endtime-2),'DD/MM/YYYY hh24:mi:ss'),g.strdescription,s.susername
from Appname_task_audit g,hsv_activity_users s
where g.activityuserid in s.luserid (optional if you want to search excluding admin id then you can add this line to existing query at the end [and s.susername not like '%admin%'])
As the audit logs are specific to applications you need to replace "appname" in the query with your application name for which you wanted to check audit.
Ex: if your application name is abcd then your query should be something like this
select g.servername,g.appname,to_char((to_date('01/1900','MM/YYYY')+g.starttime-2),'DD/MM/YYYY hh24:mi:ss'),to_char((to_date('01/1900','MM/YYYY')+g.endtime-2),'DD/MM/YYYY hh24:mi:ss'),g.strdescription,s.susername
from abcd_task_audit g,hsv_activity_users s
where g.activityuserid in s.luserid (optional if you want to search excluding admin id/any specific user then you can add this line/change existing query at the end [and s.susername not like '%admin%'])
Hope this helps !!!!
Thanks
Amith

HFM Security Class Java API

Dear All,
I'm trying to get HFM Security Class info using Java APIs. Recently I was able to connect to the Hyperion Shared Services using the hyperion css.jar java file. Is there a similar jar to access the Security classes and get users, groups and vice versa?
Any examples would be great as well.

Thanks for the reply. I was hoping this was not the case...
In 9.2 I used these objects but I was hoping to move away from this and use provided API's.
I'm using c# to talk to the object which I expose to java using web services so I guess that is what I'll be using!!!
Cheers,

HFM Security Class and Security

Hi All my Peers,
Can any one explain me What is the difference between Security Class and Security

No offense, but if you don't understand these concepts well enough, your CV should probably be sent a far distance if you are trying to get an experienced consulting position. Understanding security is an important piece to the puzzle, especially when dealing with large amounts of financial data.
With that said.......
Security - Generally speaking, the goal of security is to control access to data, objects, programs, etc. In the Hyperion sense, security is managed in multiple different ways :
- Program Access : Only users who are linked to Hyperion's Shared Services AND have the proper provisioned rights can open a program. (i.e. HFM, Reports, Workspace, FDM, etc, etc, etc.)
- Provisioning : There are different types of rights per program that a user can have. Provisioning is the act of assigning these rights. (i.e. HFM has multiple rights such as Appliation Administrator, Default, Provisioning Manager, etc.)
- Data / Object Access : Even if you have the right to enter the program, there is generally another layer of security which controls what you can do. For instance, inside of HFM, you can configure security for objects such as Data Forms and Data Grids. Furthermore, you can limit the user's ability to change or view data for specific entities, accounts, as well as other dimensions.
- Security Classes : The security classes that you assign in the metadata are used during the act of assigning the Data / Object access controls. Users (and Groups) and assigned View Only, All (Read/Write), or None access to HFM Security Classes.
This is a ridiculously high level overview. To get a much better understanding, I strongly recommend that you read the product documentation for the specific products you are using. If you are using 11.1.2.1 / HFM, here are a couple of documents that are of value :
http://docs.oracle.com/cd/E17236_01/epm.1112/hfm_admin.pdf - Administrators guide which has a section on security.
http://docs.oracle.com/cd/E17236_01/epm.1112/hfm_user.pdf - Users' guide which talked to security in terms of forms/ grids
General System 11 doc : http://docs.oracle.com/cd/E17236_01/nav/portal_5.htm
Hope that helps

HFM Security Access

I have a query on HFM security which I have got from the business.
1) Change Doris and Jeanie access to read/display only in HFM production. We should have access to display all data in HFM. – I was not sure which access should I give to get this requirement.
2) In Process Management, Please provide “Start”, “Signoff”, “Approve”, “Reject”, “Publish” in process management for Rob Sage, Debbie Indrieri and Doris Lai. Also, Please provide “Promote” and “Submit” Access to Elisa Ha and Jaime Akiyama. – Shall I give Review Supervisor for Rob Sage, Debbie and Doris for this access and not sure which one should I give for Elisa and Jaime.
Kindly help me in this regards.

I don't use process management so I will not attempt to answer that part of your question.
In regards to the first part, you need to go into Shared Services and assign those users the Read permission for the required security classes. For instance, if all entities are tied to a class called ALLENTITIES, you could go into Shared Services, click on projects, click on the project that holds your application, and then click on the application you are managing. Then you would search for the users/groups in question and add them to the selected list, next you would select the classes you want to assign them access to (i.e. ALLENTITIES). On the next screen you will see a grid with users/groups and classes. Go to the cells and set the Access Rights to read. (Be sure to hit the SAVE button when done)
Alternatively, you can do a security extract from the application, make the updates in the security file, and load that back to the system.

Automate HFM Security extract?

Hi,
HFM Security can be extracted in below methods
1. In workspace > Extract Tasks> Extract Security
2. In Shared service > Application Groups > Rt Click on App Name> Assign Access control > Security Reports
Please let me know if any another ways to Extract security reports.
Can we make Automate the "extracting security reports"?
Thanks in Advance.
Regards,
AVSR

Overview: create a migration definition file for HFM (migrating what information you need, in your case it would be security)... save the file, don't execute. Using cmd prompt, run the LCM utility.bat, supplying it with the information needed as well as the migration file. Automate it by creating a batch file to run your migration file and the utility. Schedule the batch file in task scheduler and it will run whenever needed.
Search for it on the oracle knowledgebase. Theres a lot of info on LCM there.

HFM Security Report Automation?

Is there a way to automate the running of the HFM (Hyperion Financial Management) Security Report in Shared Services.?
version: 11.1.2.0
Is this possible with using Task Automation? ---> If yes please provide details
If this possible using other reporting tools like HFR, web analysis..etc ---> This is not recommended
If any other way, Please provide details.
Thanks All!!
Regards,
AVSR

I think the best way to produce custom security files is using the HFM API. You can use this to report on group memberships and roles and class access. You can read all about it in the Web Developer's Guide Chapter 10. The chapter starts:
The HFMwSecurity type library contains the HFMwSecurity component. This component
provides methods that enumerate an application’s security classes, indicate whether a user has
rights to perform a given task, and return other types of security information.
I have seen these used to great effect.

HFM security filter ?

In HFM, I don't seem to have a way to achieve this:
One user has write access to Entity A + all products
The same user needs Read Only access to Entity B but a couple of the products only
Because the security classes attached to Entity and Product(Custom2 for us) dimensions are layed out flat on Shared Service. I can only assign one type of access to the same security class.
This is different in Essbase for example, I can create security filter and grante user access to different combination (intersection) of dimensions.
Is there such thing as security filter in HFM?
Thanks in advance!

I do plan to assign unique security classes to entities and products.
But how do we assign access to combos? In the Pivot table where you have all the security classes on the row, and all the users(groups) on the columns.
The goal is to prevent the product line leader user from reading other products in the entity that he's not responsible for.
For example, this user has Write access to E_Brazil, and all data loaded on C2 for Brazil. Then he needs to have Read access to E_China, but only C2_Golfball. We do not want him to see other products for China, however, he needs to load data to other products in Brazil. This is especially true with the Custom2 member [None] for all the data that do not require a product. Then what access shall we give to the security class C2_None ? It doesn't seem that we have a way to assign access to a combo, but just to each unique security classes ?

HFM Security Access Edit Logs - Audit

I have been asked by our internal audit group to provide logs of when users access within HFM have been edited (i.e. added, changed roles, added to groups, etc.). Is there anyone else that has received this request, and more importantly how have you met this request (logs in the system, etc)?
The only way I have been able to track this is offline via spreadsheets.
Any/all advice is appreciated.
Thanks.
LJ
Edited by: user8357096 on Mar 23, 2010 7:28 AM

I have had a couple clients ask for something like this. At least now with user provisioning you can get reports of what the security was, like a snapshot. Then compare it to another time. But this will only tell you part of the story. If you are using groups for example, it possible a user gets added to one group then removed. You would not have access to that change in HFM, it would keep no record of it.
I would recommend taking and extract and report and archiving them to reference.

HFM Security Reports

Does anyone know how to keep track of security in HFM as we can generate reports in Planning but i dont see how to manage the security in HFM. Thanks,Scorpio

Scorpio,No there is no security reports option in HFM .If you have been using external authentication and NT groups ,I would advice you running a report on the NT groups .Thanksnaveen

HFM security roles to perform only Extract tasks

Hello,
Could any one please tell me what roles I need to give for a user so that he can only perform extract tasks?
I gave him Extended analytica and advanced user roles.
But I could see Extract data and Extract journal tasks but not the rest of them.
I am using HFM 9.3.1.
Thanks
Hemanth

I have provisioned a new native user ID w/ extended analytics and default access but get this error message when running EA from application:
(-2147208192) (An unknown error has occurred in the HsvData object.)
Does anyone know what additional security should be provisioned?

HFM - Security refresh possible?

Hi all,
we are currently facing an issue at a client concerning HFM 11.1.2.0. We are using HFM API to load a new security file into an application. This works quite well – the only
problem is that logged-on users still have their old security permission until they re-logon. Do you know a way to enforce a security “refresh” in HFM without having the need for users to re-logon to
an application?
I really appreciate your help!
Regards Sebastian

Hi,
nope, a log off and log on is required. If you fear that your users don't log out, you can log them out centrally through administration --> Users on System

HFM Security file load error

Hi All
I am facing an error while loading the security file in Hyperion Financial Management which reads as:
The specified item already exists.
Show Details:
Error Reference Number: {8D871273-18BC-4103-BF90-8196E3BFAFFC}
Num: 0x8004021f;Type: 0;DTime: 5/26/2009 12:56:09 AM;Svr: BHIHYPDVH24;File: CHsvSecurityAccess.cpp;Line: 2856;Ver: 9.2.0.0.1380;
Num: 0x8004021f;Type: 0;DTime: 5/26/2009 12:56:09 AM;Svr: BHIHYPDVH24;File: CHsvSecurityLoadACM.cpp;Line: 2034;Ver: 9.2.0.0.1380;
Num: 0x8004021f;Type: 0;DTime: 5/26/2009 12:56:09 AM;Svr: BHIHYPDVH24;File: CHsvSecurityLoadACM.cpp;Line: 377;Ver: 9.2.0.0.1380;
Num: 0x8004021f;Type: 0;DTime: 5/26/2009 12:56:09 AM;Svr: BHIHYPDVH24;File: CHsvSecurityLoadACV.cpp;Line: 209;Ver: 9.2.0.0.1380;
Has anyone seen this error before? Please let me know the resolution or the cause atleast.
Thanks in advance
Rahul

Hi Thanos,
Thanks for the reply!!
Yes, I tried extracting some ownership data for the years 2013 and 2012 and I was successful in loading the data back.
I extracted the 2013 ownership data updated the year to 2014 and month to Jan and try to load it back then I am getting these errors.. same with for year 2015 and future years..
The format of the load file looks correct as I was able to load for previous years with the updated ownership data with no errors..
I killed the HFM process on the app server and tried to load it back but still could not succeed.
Any suggestions.. please help...
Thanks again!!

UpdateNativeDir Utility and HFM security

When we run the UpdateNativeDir utility to fix security for OU moves, do we also need to update security within HFM and the SECACCESS tables used for each HFM application? and if so, what do we need to do?
Thanks
V9.2.0.1

No. HFM will synch up with HSS. No need to do anything in HFM once you run the utility.

HFM security Class

Hello Guys,
I've to create around 3500 security classes and same number for the HSS roles I'm wondering if there is a way to bulk upload from a txt or a csv file rather than create everityng manually.
Thanks
Fran

That's right: HFM's security extract has four sections: users/Groups, Security Classes, User/Group Role assignments, and User/Group class access. This can be easily coded outside of HFM and then loaded into the HFM application directly. Please note that security can only be loaded in Merge mode, so if you need to remove a user's access, you must do so from within Shared Services. Do not use the "Clear all security" mode unless you plan to rebuild the application entirely.
--Chris

HFM security

Similar Messages

Maybe you are looking for