Hierarchy authorization pbm in BI7.0 with Front end of BW3.5

Hello All,
We have a problem regarding authorizations for the hierarchies in BW7.0
We have migrated from BW3.1 to BW7.0. Authorization are OK in our BW3.1 server, the authorization on hierrachy work well.
Current Issue (in BI7.0) :
An authorization object for XCOMPROD for a hierarchy 'ZMAT_HIER'.
There are 2 queries which have variables of XCOMPROD & ZCOMPROD in selection criteria, ZCOMPROD has variable of type 'Hierarchy node'
I've a test_user which has authorization on Product Group 5 (one of the nodes in the hierarchy-ZMAT_HIER).
When i run the queries independently with this test_user, the user has access to Group 5 only, which is correct.
When i run a web template report with any one query (from the 2 queries), the user has access to Group 5 (as in first case) - correct.
However when i run a web template report having above 2 queries together, the authorization fails, as user gets access to root node (instead of only Group 5).
FYI, we're using BW3.5 front end (no PORTALS) with the OLD authorization concept (of BW3.1). Not 'Analysis Authorization' as in BI7.0.
Looking forward to an explanation/solution to the above.
Regards,
Nagendra.

Hi,
Check out the customization of SPRO to select the authorization concept. I suspect that it's set on the new authorization concept.
Tomer.

Similar Messages

Configuring Lync 2010 Mobility with Front end and Edge Server

I have been racking my brain the past week trying to figure out how to get the lync edge server working properly and how to get the mobility service working properly.
Currently I have 1 front end server that is configured and working. I have one edge server that has been configured according to nearly every online help I could find along with public CERT.
If I use microsoft's online connectivity test and I run the test for
Lync Server Remote Connectivity Test everything passes. I am also able to connect to lync using a windows lync client from outside of the internal network however I have to specify the server name as being sip.ourdomain.com I cannot get connected using
autodiscover.
When I run the Lync Autodiscover Web Service Remote Connectivity Test it fails due to SSL error to lyncdiscover.ourdomain.com which then lead me down the path that I needed to install
the Mobility service but it also tells me that I may need to update our SSL cert as well.
This is where I am getting confused and would like to be pointed in the correct direction.
When I installed mobility service on the front end server it created the autodiscover section in IIS. If I am inside our network I can browse to it without any issue. Where I am confused at this point is how to either setup DNS or how to configure
the edge server to use autodiscover.
Do I need to setup an additional public IP and point lyncdiscover.ourdomain.com to the IP of our front end server or to our edge server? If I have to point this to our front end server then that would mean that I use one public IP that goes to 443,
444 and 5061 for our edge server and then I would need one public IP that goes to ports 443 and 80 that get redirected to ports 4443 and 8080 on our front end server? If that is the case then do I have to get an external cert for the front end server
that contains lyncdiscover or can clients connect if it is just using the self signed cert from the domain?
This is where I am getting confused at and hopefully some nice folks out there can clarify this for me so I can get this resolved.
Thank you
KK

You need an additional public IP to point to a reverse proxy, which will listen on port 443 and proxy requests to your front end server on port 4443 (notice the extra 4). You can use IIS ARR, Web Application Proxy, or whatever else you may have for
this purpose, but you need to ensure you redirect port 443 to port 4443. This reverse proxy cannot be collocated on your front end server or edge, you'll need a separate box or appliance.
Beyond Lyncdiscover, you'll want to do this for your external web services FQDN as defined in the topology builder and your meet and dialin URLs too. You'll want a third part cert for all of this (though it doesn't need to be installed on the front
end, just the reverse proxy) so that you don't need to install any internally signed root certs on anyone's smartphone.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications
This forum post is based upon my personal experience and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Problem with Front-End Editor (New)

Dear SAP gurus
I tried from transaction se38, selecting options Utilities -> Settings and then selecting Front-End Editor (New) from Abap Editor tab.
When I had old editor setting, I had buttons to do tasks like 'load local file' , 'save as local file' etc.,
But when I changed over to new editor setting, this whole row of buttons are missing.
Can some one please let me know how to get it back but sill use the New Editor.
Your help will be highly appreciated.
Tks
Ram

Moved elsewhere. "Undo" and others are now just a right-click away, upload/download is somewhere in the "utilities" menu, besides you can just copy/paste from any text file right into the editor.
Just have a look around.
Thomas

Problem in Front end with BW3.5

hi friends,
now I am using BI 7.0 with front end BW3.5, it looks good. when i open the BEx, it didnot work...I think there is a component missing... If i use BI 7.0 as front end, I know that will be work.... I want to call BEx from citrix environment.... how can i find what component is missing, and how can we solve this problem...
I want to get solution with BW 3.5 front end... please guide and help me....
with hopes,
Jaya
Edited by: jaya durai on Jul 24, 2008 3:41 PM

In the environment definition,
-> External Application JDBC
-> Properties
-> Outbound JDBC Connection
You have the database URL in the "DriverProperties" field
Valid URL would be : jdbc:mysql://localhost:3306/caps
!! The doc says that this field is optional !! Seems to be an error in the doc:
Hope this helps
Seb

Java Front-end problems with Windows 200 Pro

Hi,
I have some problem on my pc with java applications front-end. I have windows 2000 Professional and use java(TM) 2 SDK, Standard Edition Version 1.3.1
Using every java applications (also development environment as JBuilder 4 Professional and Together 4) I have always problems with front-end: the text is bad visualized everytime I use the scroolbar, menu items into a menu are bad visualized while I drag over of them the mouse and so on...
To try to solve this my problem I have just installed Service Pack 2 for Windows 2000 Pro but I have not had good results - I keep to have the usual problem.
I'm aware that it is difficult to reproduce and however if anyone has some idea to solve my problem I am opened to every suggestion.
Thanks in advance

the text says that what technolody that they are using its called "Off Screen Images" once i used them in my applications to improve the prefomance.
What they says is to improve the time it takes to display componants that display text on them (Such as buttons, Labels...) they going to create an Off Screen Image of the text and then paste that image on to the screen whenever the componant has to be displayed/Re displayed instead of redrowing (Re rendering) the text on the screen repeatedly which take more time and processing power than rendering once and paste it to screen whenever needed but this solution will take some more memory.

Front-end web servers with different OS

Hi everybody,
is it possible to build a SharePoint farm with front-ends with different OS (W2k8R2 & W2012)?
Thanks in advance,
Sergio Calleja

There should be no issues in having two WFEs running with different operating systems. If MOSS 2007 version can successfully support a mix environment of having two different OS on WFE then why not SharePoint 2013.
But I recommend to set a test environment first and test your mixed setup environment. This will gain you more confidence and sure possibility to implement it on production. Else I see no compatibility issues even if you directly implement the mixed WFE
environment on SharePoint 2013 production.
Please remember to upvote if it helps you or
click 'Mark as Answer' if the reply answers your query.

Front end printing.

Hi All,
In frontend printing in windows environment. Can we use exact device type(for EX:HP LaserJet 4300 dtns) instead of swin device type. The reason being we are not able to correctly print a invoice(logo not getting printed properly)
Thanks
Vijay

> In frontend printing in windows environment. Can we use exact device type(for EX:HP LaserJet 4300 dtns) instead of swin device type.
Use the device type Swin itself. Its because the driver is actually picked up from your local machine while printing.
> The reason being we are not able to correctly print a invoice(logo not getting printed properly)
Please check if the correct driver for the printer is used on your local machine. This issue with logo is common with front end printing when you do not use the exact driver for the printer model on local machine.
Cheers,
Jazz

SAP Integration kit for BO XIR2 with Crystal XI for BI 7.0 Front end

Hello Team,
We are in a little fix.
We have BOE XIR2, Crystal XI and working with old version of BI front-end 3.5.
We are upgrading to BI 7.0 frontend, but I am not able to trace out the SAP Integration kit for combination of BOE XIR2, Crystal XI and BI7.0.
Is such a thing available, If yes can someone send a link to that.
Regards
Lalan Kanade

Hi,
Thanks for the quick reply
I could trace this document. "BusinessObjects Enterprise XI Release 2 SP3 for Windows"
I checked in "Supported Data Sources for Crystal Rep" section, extract below
SAP BW Server 3.0b SAP GUI 620 or 640
SAP BW Server 3.1c SAP GUI 620 or 640
SAP BW Server 3.5 SAP GUI 640.
But we are using BW Server 7.0 with GUI 7.1 and that working fine even with BOXIR2 and Crystal XI with Old Front End for BI 3.X.
But when we are testing with BOXIR2 and Crystal XI with BI New Front End 7.0 its missing components from the query output.
So the SAP Integration kIt seems old & we need a new Kit which would work with BI New Front End 7.0.
Any suggestions on that
Regards
Lalan

Problem with index of numbers in BSP Front end

Hello All,
I am facing the below problem. Request your help.
Scenario: When I am trying to add the projects in the Front end , I am facing the problem with the index of numbering of the projects.
Example: If I am adding 6 projects ( at the max only 4 on each page i-e there are 2 pages ), then the index is wrongly numbered and the arrow (for direction of the pages) are wrongly displayed. The direction of the arrow is pointed to the next page rather pointing to the previous page and the index of numbering of the pages is wrong.
Request you to please suggest if this is any code fault in the table maintainance activity in the backend (BSP).

Hi Irina,
If you mean the number range is skipping 10 numbers in between runs then its because of the buffering in the number range.
To avoid the buffer influencing the number range, pass
'X' to the function module parameter: IGNORE_BUFFER.
This should resolve the problem.
Cheers,
Aditya

How to implement Oracle user/role security with Access front end?

Hi,
We have successfully migrated our Access database tables to Oracle 10g using SQL developer. We've recreated all the users and roles(i.e., access groups) in Oracle and granted rights to tables.
In the Access front end database, in the Database window we have saved linked Oracle tables which replaced the Access tables. The forms, reports, queries run fine with the linked Oracle tables. All the linked table use one ODBC DSN to the Oracle database with the same Oracle user id.
We need to be able to authenticate users into the Oracle database and RE-link the tables based on their own unique user id. By during so we can allow users to use the Oracle standard user id/role and system privileges to control select, update, ect. rights to the database.
I've been able to use the VB code within Access to logon into the database with a unique id, but I have not been able to find out how to RE-link the tables to the unique user id using VB. There should be some way to relink tables dynamically, based on users login into the Access front end.
I don't know a great deal about Access projects, but I do know with SQL server allows login into your Access project and link tables dynamically.
Can someone give me some assistance or point me in the right direction?
Thanks in advance,
Larry

We had one of our programmers here come up with a VB code solution for re-linking table within Access. However the relinking takes 3-4 minutes for 100+ tables.
In an effort to help you understand the situation better, I will attempt to elaborate on the problem:
We have an Access 2003 application which currently has a front end using Access(forms, reports, queries, & VB code) and a MS Access 2003 backend.
We have migrated the backend tables to Oracle. However, we still have a need to maintain the front end in Access, since we have over 60 forms, 40 reports, 200+ queries in Access. Its easy to understand, we have a significant investment in the front end(Obviously, the plan is to migrate the front end also at some future date).
In order to utilized the existing front end, we have to validate and modify the current front end connections to the new Oracle backend. One of the features of Access is that you can "link" tables and save the link for runtime. Each Access table can have its own link which is a separate ODBC/JET connection. As such, each separate link has its own userid/database information.
The other issue with using the Access front-end is that Access utilizes a workgroup file to implement user and group security. The workgroup file contains all the users and which groups the users belong to in Access. Then within Access, you allow users access to object(tables, queries, ect) by their userid and or group. When users open an Access database with Access security enabled, they are required to log into Access. The login is authenticated by the workgroup file. Once, logged into Access, users have rights to Access objects based on their rights granted to their userid and groups they belong. The problem here is that when you remove the linked Access tables and replace them with linked Oracle tables, Access has knowledge about Oracle table rights granted to users; nor would you expect it to.
The dilema is the disconnect between Access and the fact Oracle utilizes a similar but much more sophisticated security model. It creates users and roles(which are similar to Access groups), and again this is independent of Access security.
Our solution was to still use the Access workgroup file security along with the Oracle security model. By using the Access userid and then creating a similar Oracle userid with similar table rights granted in Access, you could apply security within Access and also with the Oracle database.
For example, a user BOB logs into Access via the workgroup file, using VB code, Access then establishes a Oracle connection logining into Oracle using the same unique userid BOB into Oracle.
After connecting and validating user BOB into Oracle, then the Access tables are relinked to Oracle using the user BOB userid and table rights.
This Oracle userid has been granted table rights specific for this userid.This allows the user BOB to use the Access application and still be authenticated into the Oracle database.
The problem with this solution is that the relinking of the saved Access tables takes 3-7 minutes for about 100+ tables. This is not acceptable for users each time they log into the application.
Our current alternative is to use one Oracle userid to login each user, and use Access form restrictions/security to allow/prevent users from updating/viewing data. Obviously, this is not the optimal solution in respect to security, but it at least allows us to control access to the data(via the forms) by using one logon required for each user, and quick startup time for the application.
I understand SQL server does a better job in integration, but we use Oracle which is what I am trying to work with.
Larry

Authentication with UME separation of front end and back end

My webdynpro project has 2 application. One for Admin one for Rating.
Is it possible to create a java class at Webdynpro level and share it between the 2 applications?
Why the need?
Created a custom class (lets called it CommonEJB), to point to the right pages and set of UI controls after the initial login with UME. This class utilizes the IWDClientUser.getSAPUset() method to get IUser object.
If it is not possible to create a java class at Webdynpro, then this ejb will need to be deployed to the backend.
Putting it at the backend is not good as security wise, its always better to separate the authentication between front and back end.
Any ideas/solutions?
thanks

s0003358504
au-?Krup
LDAP
==============================================
Computer Associates Int'l [eTrust Directory]
Critical Path [CP Directory Server (CP DS)]
Microsoft [Windows 2000 Active Directory Server]
Microsoft [Windows 2003 Server - Active Directory]
Netscape Communications [Netscape Directory Server]
Novell [DirXML Driver for User Management]
Novell [Novell DirXML Driver for SAP HR/PA]
Novell [Novell eDirectory]
Oracle Deutschland [Oracle Internet Directory (OID)]
Siemens [DirX Directory Server]
Siemens [DirX Extranet Edition]
Sun Microsystems [Sun Java System Directory Server]
     Test Objectives
     Testing Scope
     Test Approach
     Test Environment
     Test Data
     Entry / Exit Criteria
     Risks
     Schedule and Resources
     SIT Deliverables
     Test Planning Source Documents
Well, i wish to create a java class that can separate the view areas depending on their login.
lets say you're a manager, u can see certain views. and if you're a supervisor u see another. This is achieved using the java class with information from getSAPUser() position. After retrieving the position, using the java class will programmatically assigned the appropriate views, buttons, tabs etc.
so this class need to in front end, and not back end. problem is we have 2 application.
if the class is created front end in one application can it be shared with another.

SQL Server 2005 replaced with SQL Server 2014 trying to connect front end Access as guest (read only ODBC)

We have replaced a SQL Server 2005 with a SQL Server 2014 (new physical server.) Have the new server set up to use SQL Server login OR Windows user login. Had old server connecting (for a particular DB) to front end Access (2010 or 2013) as guest for
anyone logged into the Windows NT Network with a read only ODBC connection. Have the DB in the new server set to include guest as db_datareader (with only SELECT permission for the securables of each table and view being linked) but when any Windows user not
specifically listed as a SQL DB user tries to use the front end they get an error of:
Microsoft SQL Server Login
Connection failed:
SQL State: '28000'
SQL Server Error: 18456
[Microsoft][OCBC SQL Server Driver][SQL Server] Login failed for user {domain\user}.
After closing that pop-up window a server login window appears. Of course, since the guest user is not specifically listed as a user in the DB that fails also. It seems like there should be a very simple solution to this, but I can't seem to find it. I want
to allow anyone logged in on the Windows system (locally) to be able to open the MS Access file (on their work station machine) and run their own (read only; select) queries on the SQL Server database. Any suggestions?
Thanks a billion in advance ----

Thanks for the response Olaf. I have now spent weeks researching this. I realize that using the guest account in most situations is not advised. As mentioned, I have restricted the guest account to allow the db_datareader role only, and have explicitly denied
all other roles, as well as allowing select only, and still have no access for the guest account.
The suggested fix in the second link you provided, of using Windows groups is not plausible for my situation either. We are a scientific field research institution, with a few long term users and lots of users that may have Windows accounts for a few months,
and then they are gone. It would be a nightmare for the network tech to try to keep a group account up to date, and we need to give access (read only, of course) to anyone logged into the system. Realize that the ONLY access of any kind to this database is
thru MS Access ACCDB, using a (by default) read only OCDB connection.
This type of access is used particularly because researchers need to be able to set up their own queries, and the MS Access query interface is particularly convenient for people who are not themselves SQL experts, yet are trying to get some very advanced
levels of output. Putting the database online is not practical because then we are back to the need for a comprehensive query interface, and just picking up general subsets of the data online (from a basic web page search feature) would be out of the question,
since the result set would involve hundreds of thousands if not millions of records.
So - that said - what exactly would you suggest, assuming we don't have the funds to buy a whole new system, and have spent plenty of money with Microsoft's Enterprise level MS Office so that all work stations have MS Access, and Microsoft's SQL Server,
as well as running our network on Microsoft's network software.

Upgrade to SAP BPC 7.0 with cluster system (Front-End & Back-End)

Hello,
I have to do an upgrade document about an outlooksoft 5.0 SP2 to SAP BPC 7.0 SP4 in a cluster system.
It has 2 front-ends (IIS cluster windows) & 2 back-ends (SQL Cluster).
We are going to do first the migration in 1 node, and then in another. The first upgrade in the first node I understand. I uninstall outlookdoft 5.0, install SAP BPC 7.0 SP4 and then restore the backup of the Appset, and do the posts upgrade action of the Dimension TIME.
But in the second, what do we do??? I uninstall outlookdoft 5.0, install SAP BPC 7.0 SP4 and then what??? Do I have to restore the backup of the Appset again???
I need help.
Best regards.
Pablo Mortera.

Hello,
On the second cluster node, you have only to install the software, nothing related to the appset. If you alreay run the migration stepts for the appset, all the information are into daatbase and file server.
However, the normal behaviour is to make the installation on the both nodes, make the basic tests to validate the installation and then proceed with the appset migration.
Best regards,
Mihaela

OBIEE 11g Front End Calculations with Presentation Variables Error

Hi Guru's,
Long time user first time poster to the forums but hopefully you can help.
I have a requirement to perform an aggregation on certain fields with a dynamic grouping requirement (so users can select which grouping they require ie, sum profit by [outlets or companies or region]).
The approach I am using is a prompt setting a presentation variable with the possible groupings for the calculation as choices, and a column in the report with a formula to SUM("table"."column" by "@{variable}{default}") this also contains a dynamic column name containing the presentation variable too.
Where the column could be profit and the variable prompt options could be outlet, company or region (from the above example).
This is currently separate from the RPD due to the dynamic nature required with groupings changing at run time and is done in the front end.
However on selecting some columns via the prompt I receive this error:
Error Codes: OPR4ONWY:U9IM8TAC:OI2DL65P
State: HY000. Code: 10058. [NQODBC] [SQL_STATE: HY000] [nQSError: 10058] A general error has occurred. [nQSError: 43113] Message returned from OBIS. [nQSError: 22027] Union of non-compatible types. (HY000)
This only occurs on some field groupings, and is not a certain type in particular. (Including both short date, short time and varchars).
Any ideas where this problem could stem from?
Regards.

Based on given info: Try this
SUM(cast("table"."column" as int) by "@{variable}{default}")
Pls mark if helps

The Lync Server Front-End service terminated with service-specific error %%-1008124893.

Hello, everyone
I've installed Lync Server 2010. There was no error during installation. But when i start Lync Server Front End Server, i'm getting following error:
The Lync Server Front-End service terminated with service-specific error %%-1008124893.
In event viewer:
The evaluation period for Microsoft Lync Server 2010 has expired. Please upgrade from the evaluation version to the fully licensed version of the product. Look at help for Setup.exe to learn how to upgrade from evaluation version to the licensed version.
Cause: The evaluation period for Microsoft Lync Server 2010 has expired.
I've upgraded Lync Server according to http://technet.microsoft.com/en-us/library/gg521005.aspx?ppud=4
Also I've installed all Lync Server updates.
But I still could not start Lync Front End Sever. How can I solve this problem?
Thanks

Hi,
Can you try to run
start-cswindowsservice -report c:\report.html
and post the report so we can have more information about your problem ?
Regards,
Adrian TUPPER - ABC Systemes - http://thelyncexperience.blog.com/ If answer is helpful, please hit the green arrow on the left, or mark as answer Thank you

Hierarchy authorization pbm in BI7.0 with Front end of BW3.5

Similar Messages

Maybe you are looking for