MSAD Configuration with Shared Services

Question

Hi,
I have just sucessfully configured MSAD to the HFM SS but 1 concern is that anyone with the domain suer login is able to login to shared service although limited function are available. Is there anyway to control other users except my users to login?
I do not want to use Native to create user as it will means another set of password to rememberr for the users, would prefer they use their normal domain accoutn to login.
Thanks

Answer 1

In addition to other comments, users can only make changes in Shared Services if they have Shared services roles assigned. Also, we use MSAD with both local and AD groups, and as long as you know the effective rights, it works out fine either way. The Shared services roles are listed below (Security Administrator's Guide pp 135-136):
Administrator: Provides control over all products that integrate with Shared Services. It enables more
control over security than any other Hyperion product roles and should therefore be
assigned sparingly. Administrators can perform all administrative tasks in User
Management Console and can provision themselves.
This role grants broad access to all applications registered with Shared Services. The
Administrator role is, by default, assigned to the admin Native Directory user, which is
the only user available after you deploy Shared Services.
Directory Manager: Creates and manages users and groups within Native Directory.
Do not assign to Directory Managers the Provisioning Manager role because combining
these roles allows Directory Managers to provision themselves.
The recommended practice is to grant one user the Directory Manager role and another
user the Provisioning Manager role.
LCM Manager: Runs the Artifact Life-Cycle Management utility to promote artifacts or data across product environments and operating systems
Project Manager: Creates and manages projects within Shared Services
Create Integrations: Creates Shared Services data integrations (the process of moving data between
applications) using a wizard.
For Oracle's Enterprise Performance Management Architect, creates and executes data
synchronizations.
Run Integrations: Views and runs Shared Services data integrations.
For Performance Management Architect, executes data synchronizations.
Dimension Editor ( includes Dimension Viewer and Interactive Editor):
Creates and manages import profiles for dimension creation. Also, creates and manages
dimensions manually within the Performance Management Architect user interface or the
Classic Application Administration option.
Required to access Classic Application Administration options for Financial Management
and Planning using Web navigation.
Dimension Viewer can read or view dimensions. This role automatically maps to the
Dimension Reader access on dimensions.
Interactive Editor can modify members within a dimension, and grants dimension writer
access to all dimensions. Does not allow users to delete dimensions.
Note: Dimension Viewer and Interactive Editor roles are reserved for future use.
Application Creator (includes Analytic Services Application Creator, Financial Management Application Creator, Planning Application Creator,  External Application Creator): Creates and deploys Performance Management Architect applications. Users with this
role can create applications, but can change only the dimensions to which they have
access permissions.
Required, in addition to the Dimension Editor role, for Financial Management and
Planning users to be able to navigate to their product’s Classic Application Administration
options.
When a user with Application Creator role deploys an application from Performance
Management Architect, that user automatically becomes the application administrator
and provisioning manager for that application.
The Application Creator can create all applications.
The Analytic Services Application Creator can create Generic applications.
The Financial Management Application Creator can create Consolidation applications
and Performance Management Architect Generic applications. To create applications,
the user must also be a member of the Application Creators group specified in Financial
Management Configuration Utility.
The Planning Application Creator can create Planning applications and Performance
Management Architect Generic applications.
The External Application Creator can create external views and export application views
but cannot export the library.
Note: External Application Creator role is reserved for future use.