How to implement data level security

How to implement data level security in BI Publihser?. I am using Obiee enterprise edition and bi publihser. My requirement is to show data based on User- Region relation ship.
User A - belongs to Eastern Region
User B - belongs to Southern Region
so if user A logged in he should see only Eastern Region report. If user B logged in He should see only Southern region. I am using direct sql to my oralce database as data source.
i appriciate your help

I am using a common database username and password for jdbc connection. what i am looking is based the BI Publihser login, is there any way?
say i have userregion table joined with fact. so that i can write a query to get the data
select c1,c2,c3
from userregion, fact
where fact.region=userregion.region
and userregion.user = BIPUBLIHSERUSER
but my question is ithere any variable to tell who is logged in BI Publisher? Any server varaibles?
Other related question is, In every report i want to show User name who is running the report. How can i get this?

Similar Messages

What if I implement data level security using Selection formula?

Hi All,
I have a requirement to implement data level security for all the reports, the thing is, we donot have a front end application developed in java/.net or any other language, so we have only two options (as per me, if you think there are other alternatives then please share).
1) Implement security at the database level (that is use user roles in where clause which will make the where clause really complicated and hence the performance of the query will eventually decrease).
2) Retrieve the data with the flags of user role/permission on data. Use these flags in selection formula to select the needed records as per the user login.
I have already in middle of implementing the second method, thought to take suggestion from you guys, I appreciate if you could tell me the drawbacks of the method I am using, and if there is an alternative method you could think of.
Thanks,
-Azhar

Standaone Crystal Reports does not have any security option except to use Trusted Authentication when connecting to the DB. We use Microsofts NT or MS SQL Server Authentication only.
Doing this in CR Designer using flags and formula will never be secure, the user could simply change the formula etc...
Check with your DBA on how to configure AD authentication and then enable or add each user to SQL server. You may need to configure and mantain this manually depending on how you ahve your network configured.
Thank you
Don

How to implement row level security?

Hi all,
There is a database which is for 3 companies to use it and how to use row level security to make sure that they can only manipluate their own data? For example, "employee" table, for each company they just can see their own employees information. How to use dynamic view to do it?
Many Thanks
Amy

Here are two options to achieve what you want.
A. You can do this by coding, that's if you are ready to. Are you? If yes then try the steps below:
1. create a security codes table. Say for example
001 - company a
002 - company b
2. create a security table that will list all users and which company they should have access to. You can also implement this by roles.
3. alter all tables in the application schema to add a security code column. This will be a foreign key reference to table created in 1 above.
4. update all data in the tables according to which company they belong to.
5. write a procedure or package that does a validity check whenever a user requests for data. This procedure/package determines which company data the user has access/rights to.
With this, you should be able to achieve what you want if you do not want to spend on VPD and FGAC. The problem comes where there are users who would have cross access to data from both companies. In this regard, then you have to modify your security table a little bit to handle this.
B. This option i will admit is not so clean. You can also achieve this by two different views for every table in the application schema. And on each of these views, create a private synonym for every user. For illustration purposes:
Table name = Employee.
Create a view employee_a on employee
create a view employee_b on employee
Let's say you have users x and y. X has access to employees of company a and y has access to employees of company b. You can now create private synonyms for each of these users as follows:
create synonym employee on employee_a in x schema.
create synonym employee on employee_b on y schema.
This i have not tried but believe should work.
Hope one of these options serve your purpose.

How to implement row level security using external tables

Hi All Gurus/ Masters,
I want to implement row level security using external tables, as I'm not sure how to implement that. and I'm aware of using it by RPD level authentication.
I can use a filter condition in my user level so that he can access his data only.
But when i have 4 tables in external tables
users
groups
usergroups
webgrups
Then in which table I need to give the filter conditions..
Pl let me know this ...

You pull the Group into a repository variable using a session variable init block, then reference that variable in the data filters either in the LTS directly or in the security management as Filters. You reference it with the syntax VALUEOF("NQ_SESSION.Variable Name")
Hope this helps

Implementing Data level Security ?

I would like to Impelement Data level Security in Universe level itself. I have Set For users belonging to Branch (Mumbai, Delhi Etc) And One set of Users Belonging to Segment (CWG, IFA Etc) and Set of users that are combination oif Branch and Segment.
In the Universe I need to set the Security so that only the data related to them can be viewed. When I use a restriction I have to create many restirction and implement the same in Objects as required.
This consumes a lot of time. Is there a easier way out.
I have already Tables in the Database where the secuity values for the users are already stored.
Any help is welcome
Thanks in advance
Suresh

Hi Alan,
Ok....But How Can I use the Restriction I have created in All the objects of the universe.
For e.g.. I have Two Classes Named Channel and Relation Manager respectively.
The Channel Class has the following Objects Namely : Channel Type, Channel Country, Channel Zone, Channel State, Channel City and Channel Name. and is Derived from BIDIMCHANNEL Table
The Relation Manager Class has following Objects Namely: RM Segment, RM City, RM Branch RM Name. and is Derived from BIDIMRM Table.
I have Created the a Restriction on Channel name By Using the Clause "BIDIMChannel.ChannelName = 'AHMEDABAD' and have assigned it to an BO User.
While using WEBI whenever I Select Anything regarding the Channel Class the restriction works fine. When We I Exclusively Select "Relation Manager" Class, the restriction is Not Applied and the entire data is visible.
Can you Suggest a manner in which the restriction given above can be applied for all the objects belonging to the universe and not just to the class objects where the restrictions are being applied.
Regards
Suresh

How to do data level security on users based on region

Hello guys
I currently have created a report with dashboard prompt on column "state" with a default value "CA"
Now, the requirement is to perform data level security on this report, so different users based out of different state will log in to the dashboard and this prompt will change its default value accordingly so the user will have the report on only users home state prompted, and users can't see other state data..
I have thought of creating session variables to achieve the same, but how should i set up the initialization string?
Do I need to create a new table called "user table" that stores username/password and state columns and make that user table join to the fact table in the db?
If so, how should I configure the session value so that users get filtered date based on its state location?
PLease provide guidance
Thanks

Here’s an idea off the top of my head (untested):
First, set up your security constraints normally using Manage…Security in the Administration Tool, so that each user can only see his/her state. Refer to the previous responses to this post for guidelines.
Then, in your dashboard prompt, for the “Default Value”, write a tiny bit of logical SQL to query the “state” column from the presentation layer. If your security constraints are properly in place, the SQL should only return one value.
To get an idea of what the logical SQL should look like, select “All Values” as the default value, then switch it to ‘SQL Results’. That will show you the basic format of the logical SQL. It’s really just normal SQL (select <this> from <that> where <the other>), but referring to presentation layer objects rather than to physical tables and columns.
Untested. Please reply back and let us know how it goes.

How to implement Dimension Level Security on Tabular?

Not possible on SQL Server 2014 SSAS Tabular? How to work around?
Kenny_I

Hi Kenny_l,
According to your description, you want to implement dimension security in SSAS 2014 tabular. Right?
In Analysis Services Tabular mode, dimension level security (based on role permission) is not supported. This security can only used in Multi-dimension mode. In tabular mode, we can only use row-level security based on role permission.
Please refer to links below:
Implement Dynamic Security by Using Row Filters
Reference:
Comparing Tabular and Multidimensional Solutions (SSAS)
If you have any question, please feel free to ask.
Best Regards,
Simon Hou
TechNet Community Support

How to implement row-level security in Discoverer?

Dear all,
I have a scenario that I have 2 folders containing sales and inventory data stored by product lines.
The 2 folders are constructed by 2 SQL statements.
There exists a set of tables controlling which product line's sales and inventory data a person can read.
A function is written previously that returns the WHERE clause based on user_id, employee_id and the other parameter.
So, can you suggest how to integrate the 2 components in Discoverer?
thanks
George
My blog: http://hktour.blogspot.com

hi Rod,
Thanks for your suggestions.
I took your 1st option, ie.
"You can use VPD at the database level to secure the tables."
I have a view BUDGET_V with the following columns:
PERIOD_YEAR
PERIOD_MONTH
PRODUCT_LINE
BUDGET_AMOUNT
Every salesman can only read the budget amount of certain product lines.
I built the security function which will be binded to the view BUDGET_V (see below)
FUNCTION security_policy_function( p_schema in varchar2, p_object in varchar2)
return varchar2
as
begin
if (user = p_schema) then
return '';
else
return viewProductLine(FND_GLOBAL.USER_ID, FND_GLOBAL.EMPLOYEE_ID, 'BUDGET_V.PRODUCT_LINE');
end if;
end;
The security function actually calls my own security function viewProductLine(FND_GLOBAL.USER_ID, FND_GLOBAL.EMPLOYEE_ID, 'BUDGET_V.PRODUCT_LINE') which take the user id and employee id of the apps user and returns the predicate.
Then, I bind the security function security_policy_function() to the view BUDGET_V with
begin
dbms_rls.add_policy
object_schema => 'APPS',
object_name => 'BUDGET_V',
policy_name => 'MY_POLICY',
function_schema => 'APPS',
policy_function => 'security_policy_function',
statement_types => 'select',
update_check => FALSE,
enable => TRUE
end;
The problem now is that if I query the view in Discoverer as a Apps user (say "A"), it returns all the records in the view without any filtering (user "A" is supposed be able to read certain product lines).
I try to verify whether the security function work or not. So, I hardcoded FND_GLOBAL.USER_ID and FND_GLOBAL.EMPLOYEE_ID as 1234 and 6789 which are the user_id and employee_id of user "A". (see below)
FUNCTION security_policy_function( p_schema in varchar2, p_object in varchar2)
return varchar2
as
begin
if (user = p_schema) then
return '';
else
return viewProductLine(1234, 6789, 'BUDGET_V.PRODUCT_LINE');
end if;
end;
This time, Discoverer returns only the records with product lines visible to user "A".
So, I guess there is problem in the function call in viewProductLine(FND_GLOBAL.USER_ID, FND_GLOBAL.EMPLOYEE_ID, 'BUDGET_V.PRODUCT_LINE');
Can you give me some light on this issue?
thanks
George (HK)
My blog at http://hktour.blogspot.com

Data level Security in Essbase

I have an requirement to implement data level security in Essbase. For ex: A user can only see those data which are from Asia region or an user will be able to see those data which are from America.
Asia and America are defined in my location dimension.
Please tell me how to do it?
Regards,
Suman

to make your security maintenance easier, I would suggest putting the users into groups and assigning the filters to the group. If you do it at the indivual level, the user can only have one filter assigned to them, but each group could have a different filter. So for someone who should see Americas and Asia have a group calle America and one called asia. put the user into both groups and assign the america filter to the first group and asia filter to the second group

Data level security in OBIEE

We have implemented data level security by applying filters on groups in Obiee Administration tool. Here we have set filter on division(which is a column in Customer table). This is done so that user can see data for division for which he has access.
When user creates report which consists of division column filter is working fine. E.g. if user1 has access to division1
and when user1 cretes a report for (customerName,division,sales columns) he can see sales of customers belong to division1. But if user1 cretes report which does not contain division column e.g.(customerName,sales columns report) he can see all the customers sales data. How can we aoide that. We want User1 to see division1's data only irrespective whether division column is there in report or not.
Can any one suggest what should be done to achive this.
Thanks,
Avdhut

Hi friend,
You need to create group of users and then apply filters over that groups.
you should establish an additional filter for group1 (user1 belongs to group1 in your example). Follow next steps:
- Manage -> Security...
- Groups -> click right group1 and select propierties.
- Select button 'Permissions...'
- Select tab 'Filters' -> add new filter.
- On the column name select the metric you need filter, in your example, customer sales. On the column 'Business model filter' put table.division=division1
I hope this can help you.
Good luck.

Data level Security for Oracle Apps as Source

Hi all
I need to implement Data level Security on Apps Users in OBIA
We are using Apps as source with Single sign On. I need to apply Data level security on Business Group Field.
We dont have users in OBI, we need to register apps users in OBI.
Could anybody tell me how to register Apps users in OBI???
OR tell me if you know some other way to implement D L Sec on Single sing On and Apps as source.
Thanks in avd
V P

You need to be creating your "business groups" as a group in the RPD, init blocks to retrieve the user business group at login. Filters in the Logical table sources to restrict data to relevant business groups only.
Presentation 'Web Cat' groups with the same name as the RPD groups so a user inherits membership automatically.
I'd suggest sourcing a vanilla OBIA rpd to see how it is implemented out of the box.

Data level Security with Oracle Apps as Source

Hi all
I am implementing Data level Security with Apps as Source(OLTP) on Single Sign On.(Oracle has provided the Vanila rpd & we are working on that)
I need to Filter data based on Business Group, Users are created in Apps and they are registered with some Responsibilities.
(for eg, OBI User CHINA is a Responsibility; Now he will get only Business Group ID for China)
I have created Groups in rpd with same name as the responsibility in Apps.
I have created Initialization Blocks from which I m getting only 1 business group ID for every :USER.(I tried the code in TOAD & I m getting the correct BG ID)
I have created Group in WEB with the same name as the Group name in rpd.
If I say show all Users and Groups in WEB, I m getting the APPS Users.
I hv Reloaded the server metadata files and restarted the BI Server/WEB Server also...
But in the Report, I m getting all the Business Group Ids,
Plz advice if I m doing something wrong.
ThanQ
Anand

You need to be creating your "business groups" as a group in the RPD, init blocks to retrieve the user business group at login. Filters in the Logical table sources to restrict data to relevant business groups only.
Presentation 'Web Cat' groups with the same name as the RPD groups so a user inherits membership automatically.
I'd suggest sourcing a vanilla OBIA rpd to see how it is implemented out of the box.

Data Level Security in OBIEE Enterprise Edition

HI,
would like to know how to implement row-level security in OBIEE Enterprise Edition
Setting up the context right here, considering a hierarchy of an organization that goes up to 4 levels as below:
VP >Senior manager>Manager>clerk
Now, the situation is such that a manager should be able to view its subordinates data but not the data of any other team to which he does not have access. And also the manager should view only his regions data.Same goes for other hierarchies in the organization.
Any pointers in this regards i.e OBIEE ADMIN TOOL: SECURITY AUTHENTICATION THROUGH EXTERNAL DATABASE would be of great help.
Source system is SIEBEL CRM 7.8
THanks
Gutha

Hi,
I can help you for Authentication using BI Server.
For teh same you can use admin tool then manage>security> users and Groups.
You can create different groups as well as users accrording to you hierarchy and then provide privilages users or groups according to your need like particular user can view the data of particular level.
When you create users then in the user page you can provide the filter conditions in filter tab and same as in groups.
Regards
Tarang Jain

Data level Security

I need to implement data level security on the dashboards for users based on job hierarchy and region location
since i have multiple subject areas this needs to be implemented on one subject area and reports and dashbord from the same subject area .
any ideas or links how one can achieve this

Check this URL
http://oraclebizint.wordpress.com/2008/06/30/oracle-bi-ee-1013332-row-level-security-and-row-wise-intialized-session-variables/
Mark as correct if it is helpful
Thanks

Data level Security in SSO

Hi
I need to implement Data level Security (OBIEE) in Single Sign On with Apps as Source...
Since it is SSO, we have users in the Apps but not in the OBIEE rpd. How to use those responsibility in our rpd and apply filters on the logical columns.
I need to filter based on the business group... Please explain in detail...
thanx

Metalink3.oracle.com
then search for the note number
Also you may check doc. http://download.oracle.com/docs/cd/E14847_01/bia.796/e14846.pdf
Edited by: user634293 on Apr 5, 2010 2:47 PM

How to implement data level security

Similar Messages

Maybe you are looking for