How to query Cell level Security in 11g AW

Are there any views/tables that we might be able to use to query the Security settings in 11g AW?
In AWM 11g we have the ability to grant users/groups security at a cell level, with this functionality there is no need for us to maintain the PERMIT_WRITE program to manage Write access to users. I could not find any document that states how we can manage/view the security outside the AWM tool.

For Oracle 11.1, there is a dba-level view called
DBA_XDS_INSTANCE_SETS which provides the data security definitions
for both rdbms table-based and olap dimension/cube-based data security
documents. The actual definition of data security is stored in the XML DB
repository under the XDB schema.
SQL> desc dba_xds_instance_sets
Name Type
SCHEMA_NAME VARCHAR2(30)
OBJECT_NAME VARCHAR2(30)
INSTANCE_SET VARCHAR2(30)
DESCRIPTION VARCHAR2(4000)
STATIC VARCHAR2(5)
EVAL_RULE VARCHAR2(4000)
ACLIDS SYS.XMLTYPE
There is no way to actually manage the data security documents outside of
AWM for 11.1 in terms of creating/editting/deleting the data security documents
at least none that is documented.
Here is an example of what the DBA_XDS_INSTANCE_SETS view returns:
SQL> select * from dba_xds_instance_sets;
SCHEMA_NAME OBJECT_NAME INSTANCE_SET
DESCRIPTION
STATI
EVAL_RULE
ACLIDS
GLOBAL TIME DEFAULT_POLICY
false
1 = 1
<aclids xmlns="http://xmlns.oracle.com/xs">
<aclid>4C96964E68CC309FE040578C550414E2</aclid>
</aclids>
GLOBAL TIME policy1
false
GLOBAL."TIME".DIM_KEY IN ('186', '176', '133', '134', '135', '177', '136', '137', '138')
<aclids xmlns="http://xmlns.oracle.com/xs">
<aclid>4C96964E68CF309FE040578C550414E2</aclid>
</aclids>
Have you created data security in AWM on dimensions/cubes in 11.1?
Any feedback about your experiences with AWM around data security would
be welcome.

Similar Messages

  • Cube cell-level security

    Hi,
    How to implement cell-level security for oracle9i rolap cube without Virtual Private Databases ?
    thanks.

    Thanks, Mark.
    I have read your article,I have some questions:
    (1) How can create one cube for many fact views?
    (2) I access the cube with the olap api,can this method support?
    Actualy, I need something like MS sql 2000 Analusis Service dimension security. Now I implement this by my front end tool(with olap api).
    I have read your weblog for a long time,thank you for your good articles!
    Gu YQ

  • How to implement data level security

    How to implement data level security in BI Publihser?. I am using Obiee enterprise edition and bi publihser. My requirement is to show data based on User- Region relation ship.
    User A - belongs to Eastern Region
    User B - belongs to Southern Region
    so if user A logged in he should see only Eastern Region report. If user B logged in He should see only Southern region. I am using direct sql to my oralce database as data source.
    i appriciate your help

    I am using a common database username and password for jdbc connection. what i am looking is based the BI Publihser login, is there any way?
    say i have userregion table joined with fact. so that i can write a query to get the data
    select c1,c2,c3
    from userregion, fact
    where fact.region=userregion.region
    and userregion.user = BIPUBLIHSERUSER
    but my question is ithere any variable to tell who is logged in BI Publisher? Any server varaibles?
    Other related question is, In every report i want to show User name who is running the report. How can i get this?

  • How to implement row level security?

    Hi all,
    There is a database which is for 3 companies to use it and how to use row level security to make sure that they can only manipluate their own data? For example, "employee" table, for each company they just can see their own employees information. How to use dynamic view to do it?
    Many Thanks
    Amy

    Here are two options to achieve what you want.
    A. You can do this by coding, that's if you are ready to. Are you? If yes then try the steps below:
    1. create a security codes table. Say for example
    001 - company a
    002 - company b
    2. create a security table that will list all users and which company they should have access to. You can also implement this by roles.
    3. alter all tables in the application schema to add a security code column. This will be a foreign key reference to table created in 1 above.
    4. update all data in the tables according to which company they belong to.
    5. write a procedure or package that does a validity check whenever a user requests for data. This procedure/package determines which company data the user has access/rights to.
    With this, you should be able to achieve what you want if you do not want to spend on VPD and FGAC. The problem comes where there are users who would have cross access to data from both companies. In this regard, then you have to modify your security table a little bit to handle this.
    B. This option i will admit is not so clean. You can also achieve this by two different views for every table in the application schema. And on each of these views, create a private synonym for every user. For illustration purposes:
    Table name = Employee.
    Create a view employee_a on employee
    create a view employee_b on employee
    Let's say you have users x and y. X has access to employees of company a and y has access to employees of company b. You can now create private synonyms for each of these users as follows:
    create synonym employee on employee_a in x schema.
    create synonym employee on employee_b on y schema.
    This i have not tried but believe should work.
    Hope one of these options serve your purpose.

  • How to Migrate Row Level Security Configuration

    Hi Guys,
    Does anybody know how to migrate row level security configuration? I suppose PeopleSoft provided a data mover script, like securityexport.dms.
    Thank you in advance,
    Bob

    Here are two options to achieve what you want.
    A. You can do this by coding, that's if you are ready to. Are you? If yes then try the steps below:
    1. create a security codes table. Say for example
    001 - company a
    002 - company b
    2. create a security table that will list all users and which company they should have access to. You can also implement this by roles.
    3. alter all tables in the application schema to add a security code column. This will be a foreign key reference to table created in 1 above.
    4. update all data in the tables according to which company they belong to.
    5. write a procedure or package that does a validity check whenever a user requests for data. This procedure/package determines which company data the user has access/rights to.
    With this, you should be able to achieve what you want if you do not want to spend on VPD and FGAC. The problem comes where there are users who would have cross access to data from both companies. In this regard, then you have to modify your security table a little bit to handle this.
    B. This option i will admit is not so clean. You can also achieve this by two different views for every table in the application schema. And on each of these views, create a private synonym for every user. For illustration purposes:
    Table name = Employee.
    Create a view employee_a on employee
    create a view employee_b on employee
    Let's say you have users x and y. X has access to employees of company a and y has access to employees of company b. You can now create private synonyms for each of these users as follows:
    create synonym employee on employee_a in x schema.
    create synonym employee on employee_b on y schema.
    This i have not tried but believe should work.
    Hope one of these options serve your purpose.

  • How to provide Responsiblity level security in OBIEE 11g

    Hi all,
    Can any one tell me how to provide the responsibility level security in OBIEE 11G.

    Hi,
    You need to create group of users and then apply filters over that groups.
    you should establish an additional filter for group1 (user1 belongs to group1 in your example). Follow next steps:
    - Manage -> Security...
    - Groups -> click right group1 and select propierties.
    - Select button 'Permissions...'
    - Select tab 'Filters' -> add new filter.
    - On the column name select the metric you need filter, in your example, customer sales. On the column 'Business model filter' put table.division=division1
    you should add the Customer table to your Sales-fact LTS add apply the filter to this combined LTS as well
    For more:
    http://oraclebizint.wordpress.com/2008/06/30/oracle-bi-ee-1013332-row-level-security-and-row-wise-intialized-session-variables/
    also try http://www.biblogs.com/1969/12/31/obiee-11gr1-security-explained-an-11g-security-overview/
    http://forums.oracle.com/forums/thread.jspa?threadID=1120336
    Thanks
    Deva
    Edited by: Devarasu on Oct 11, 2011 6:08 PM

  • How to do data level security on users based on region

    Hello guys
    I currently have created a report with dashboard prompt on column "state" with a default value "CA"
    Now, the requirement is to perform data level security on this report, so different users based out of different state will log in to the dashboard and this prompt will change its default value accordingly so the user will have the report on only users home state prompted, and users can't see other state data..
    I have thought of creating session variables to achieve the same, but how should i set up the initialization string?
    Do I need to create a new table called "user table" that stores username/password and state columns and make that user table join to the fact table in the db?
    If so, how should I configure the session value so that users get filtered date based on its state location?
    PLease provide guidance
    Thanks

    Here’s an idea off the top of my head (untested):
    First, set up your security constraints normally using Manage…Security in the Administration Tool, so that each user can only see his/her state. Refer to the previous responses to this post for guidelines.
    Then, in your dashboard prompt, for the “Default Value”, write a tiny bit of logical SQL to query the “state” column from the presentation layer. If your security constraints are properly in place, the SQL should only return one value.
    To get an idea of what the logical SQL should look like, select “All Values” as the default value, then switch it to ‘SQL Results’. That will show you the basic format of the logical SQL. It’s really just normal SQL (select <this> from <that> where <the other>), but referring to presentation layer objects rather than to physical tables and columns.
    Untested. Please reply back and let us know how it goes.

  • How to implement row level security using external tables

    Hi All Gurus/ Masters,
    I want to implement row level security using external tables, as I'm not sure how to implement that. and I'm aware of using it by RPD level authentication.
    I can use a filter condition in my user level so that he can access his data only.
    But when i have 4 tables in external tables
    users
    groups
    usergroups
    webgrups
    Then in which table I need to give the filter conditions..
    Pl let me know this ...

    You pull the Group into a repository variable using a session variable init block, then reference that variable in the data filters either in the LTS directly or in the security management as Filters. You reference it with the syntax VALUEOF("NQ_SESSION.Variable Name")
    Hope this helps

  • How to provide page-level security..

    HI,
    I have a requirnment that a single report having multiple pages is generated such that each or some of the pages have security tags that are compared to a security identifier list of a particular user that acts as a security clearance for that user. How to do this programatically.
    Through this comparison, a subset of pages from the report is formed which makes up a "report" from the user's point of view that contains only data the user is allowed to see. This allows multiple users to view only authorized portions of a single report having page-level security determined by level breaks in the data.How to do this also programatically.
    including both the task is one requirnment. if any one know how to do this using java program or xml, please reply as soon as possible.
    thanks in advance.

    How does you post have anything to do with SQLJ/JDBC? If this is an Oracle Report then post it to the Oracle Reports forum. Otherwise, look at the JDeveloper forum.

  • How to get object level security in Universe?

    Hi,
    I need to get the object level security for an Universe. I'm able to get the list of objects and its security access level (Public / Controlled / Restricted / Confidential / Private / )  from the (.Unv) file using the Designer SDK.
    But I need to get the list of users who has the object level security in the universe. In the CMC, by clicking the Universe and click on the Object Level Security tab, we can see the list of users there.
    I need to get the same using BOE SDK.
    I have used the following query to get the universe from the repository,
    "select * from ci_appobjects where si_kind='universe' "
    But I'm not able to get the list of users having obj. level security for that universe.
    Kindly help me to proceed.
    Thanks.

    The access security level is encapsulated in the SI_KIND='Overload' object. 
    Look for those types of objects, and the doc for the Overload class.
    An Overload references the Universe to which it's associated, and User/UserGroup objects are associated with the Overload via SecurityInfo.
    Sincerely,
    Ted Ueda

  • Row level Security in 11g

    Hello,
    Is there any way to configure row level security in OBIEE 11g other than using external table? Please share your thoughts on this.
    Thanks,
    Kishore

    Check this http://www.rittmanmead.com/2012/03/obiee-11g-security-week-row-level-security/
    ~ http://cool-bi.com

  • How to create Database level Security in OBIEE

    Dear Experts,
    Can you kindly tell me the steps on how to create a database level security on OBIEE.
    Please can some one give me the scripts and tell me how to implement tht in the RPD.
    Thanks in advance,
    Anand

    If you are looking for Database Level security in OBIEE the only route to truly accomplishing this is using the Oracle Virtual Private Database concept.
    http://obieeblog.wordpress.com/2008/12/29/obiee-and-virtual-private-database-vpd/
    http://gerardnico.com/wiki/dat/obiee/vpd

  • How to use Item Level security

    I am working on portal 9.0.2.6.18.
    I have a folder with 1000 items. I want to grant groupA
    access to 997 items and
    (Group B,GroupA) access to 3 items.
    How do i do this.
    Here is what i tried:
    1.enabled item level security on folder
    2.granted folder level access to groupA and groupB
    3.Changed access of 997 items to grant access to GroupA
    4.Did nothing to the 3 items which i wanted to give access to GroupA,GroupB
    Is there a better way of achieving this?
    I am not really comfortable granting folder level access to groupB, because if i miss overwriting privileges of an item (in step 3), then groupB will have access to that item. I would love to change just 3 items because they are the exception.
    How is this feature supposed to be used?
    Thanks
    Harish

    Martin,
    Thanks for the reply. I just cited 1000 items folder as an example. We have various complex combination of security requirements for folders and items. So creating sub-folders for each combination will not work for me.
    Everytime the security requirements change we have to move the items around, which can confuse users. And sometimes we have to create sub-folders to workaround the item-level security problems even when there is no logical business classification to a set of items.
    Harish

  • How to implement Dimension Level Security on Tabular?

    Not possible on SQL Server 2014 SSAS Tabular? How to work around?
    Kenny_I

    Hi Kenny_l,
    According to your description, you want to implement dimension security in SSAS 2014 tabular. Right?
    In Analysis Services Tabular mode, dimension level security (based on role permission) is not supported. This security can only used in Multi-dimension mode. In tabular mode, we can only use row-level security based on role permission.
    Please refer to links below:
    Implement Dynamic Security by Using Row Filters
    Reference:
    Comparing Tabular and Multidimensional Solutions (SSAS)
    If you have any question, please feel free to ask.
    Best Regards,
    Simon Hou
    TechNet Community Support

  • How To Apply Row level security ??

    Hi all,
    I want to apply row level security on one of my custom objects created in PO schema in R12. How to do that??
    Thanks and Regards
    Raj

    Thank You Gaurav
    --Raj                                                                                                                                                                                                                                       

Maybe you are looking for

  • Sending mail to the user-id

    Hi Guys,        I Have The Requirement Like ,I need To Send The Data As A Mail From the ABAP Program,and also i need to set the  sender address different from the login-id,how to set the sender address different from login-id..please help with the co

  • Creating GUI using a wizard

    Hi, I'm new to swing and until now have created GUI using MFC. Are there any wizard like tools, that help creating the UI while generating the adaquate code for me? Thanks.

  • Credit Note   FI

    Dear experts, Can any one tell me how to change the logo of Credit Note on  FI-side. i have a standard script F140_DOCU_EXC_01. regards Darshan

  • Unable to update to PE 8.01

    Okay, I've been reading through some of these posts and understand that there are some issues. Some very serious issues, and I have experienced a lot of crashing myself, as a matter of fact, I have a video waiting to be saved properly, but PRE 8.0 ca

  • How does one perform Cursor joins in DPL?

    How does one navigate the API to do cursor joins? Can one do it and still exploit DPL concepts, or must one keep open a separate low-level BDB Database?