OBIEE Security 10g to 11g: Groups

Question

I had a Security scenario that I wanted to throw out to the forum...
In 10g, we made use of the GROUP system variable to pull a users group membership from a database table. This was a Session Variable initialized upon each login.
Data-level and object-level security was different for each group.
In our environment users had the ability to switch groups, so they could be active in one of the groups and inactive in the others. We provided a form (WriteBack) that allowed them to set what group they wanted to be active for. They would then log out and log back in and have their new group assignments.
In the Session Variable this was done by pulling in only groups that were flagged as Active. This worked great as it was done at the Session level. So I could login once and see Dashboard A, swtich my role, then log back in and NOT see Dashboard A.
I know 11g still has the concept of WEBGROUPS, that would mimic the above, but my understanding is that Oracle is pushing the use of Application Roles.
My question is how would the above behavior be ported over to 11g using Application Roles? I didn't think the population of an Application Role was Session Based, my belief is that it is populated when the Admin Server/Managed Servers are bought up pulling from the applcable Security Provider.
Edited by: DustinC on Jan 19, 2012 1:29 PM
Edited by: DustinC on Jan 20, 2012 3:54 PM
Edited by: DustinC on Jan 22, 2012 12:45 PM
Edited by: DustinC on Jan 23, 2012 11:40 AM

Answer 1

Q1. how deploy external database security(users, groups) to OBIEE 11g.
we used external database security in 10g. all the users and groups maintained in database and obiee rpd has security groups. repository has group information only so it is deployed groups information to obiee 11g by upgrade assistant but how can it deploy users in external database?
Solution:
http://www.varanasisaichand.com/2011/09/external-table-authenticationorder-of.html
http://www.rittmanmead.com/2012/03/obiee-11g-security-week-connecting-to-active-directory-and-obtaining-group-membership-from-database-tables/
http://obieeblog.wordpress.com/2009/06/18/obiee-security-enforcement-%E2%80%93-external-database-table-authorization/
Q2. all the users and roles in LDAP server. in this case how obiee 11g read users and group information?
Obiee11g is intergated with weblogic fusion middleware (Console,EM). in that console have feature to enable mulitiple LDAP authentication
while configuring AD via weblogic console we need to give the users and group info
Solution refer:
http://obieeelegant.blogspot.com/2012/01/obiee-11g-integration-with-ldap.html
http://docs.oracle.com/cd/E23943_01/bi.1111/e10543/privileges.htm#BABCDCFE
Thanks
Deva