Row Level Security - Data filter - Roles Variable Not working in OBIEE 11.1.1.7.1

Hi all,
Previously, we were using OBIEE 11.1.1.5.0 and we were able to assign users to application roles by using the initialization block to assign the ROLES session variables.
1. My USER_SECURITY table in Oracle database:
USER_NAME | USER_ID | ROL
user1       | 1723    | GobalDataRole
user2       | 1739    | GobalDataRole
user3      | 1743    | GobalDataRole
2. The SQL query in my session initialization block:
select USER_NAME, USER_ID, ROL
from USER_SECURITY
where USERNAME = ':USER'
3. The row-wise initialization option is not checked.
4. In the Oracle Enterprise Manager Fusion Middleware Control, we created new application role: GobalDataRole and sync with rpd.
5. The GobalDataRole is used in the RPD to filter the data under permissions --> data filter. GobalDataRole only has access to Country A data.
6. Result: under my account, also in rpd Manage --> Sessions, user variable details
User_name , user_id & Rol variable is working fine as expected,
When we log in as user1, we can see in My Account, user assigned to: BI Consumers; Authenticated Role; GobalDataRole
When we log in as user2, we can see in My Account, user assigned to: BI Consumers; Authenticated Role; GobalDataRole
When we log in as user3, we can see in My Account, user assigned to: BI Consumers; Authenticated Role; GobalDataRole
User1, User2, and User3 are able to see the data correctly according the their data access setup.
Now, we using OBIEE 11.1.1.7.1 and using the same method, but we not able to assign users to application roles by using the initialization block to assign the ROLES session variables anymore.
Result:
User_name & user_id variable is working fine as expected, but the ROl variaible is not capturing the DB value,
When we log in as user1, we can see in My Account, user assigned to: BI Consumers; Authenticated Role
When we log in as user2, we can see in My Account, user assigned to: BI Consumers; Authenticated Role
When we log in as user3, we can see in My Account, user assigned to: BI Consumers; Authenticated Role
User1, User2, and User3 can see all data (which is wrong) because they are not assigned to the correct application role that sets the data restriction/filter.
Has anyone encountered the same issue? Any advice on how to solve this?
Thanks in advance!
Satheeshkumar P

Thanks user10615659     ,
- Yes the variable ROLES available in OBIEE 11.1.1.7.1
- Tested the init block and variables in offline rpd its working as expected.
- In online rpd, except ROLES and GROUP variable remaining variables working fine.
- Verified log file in both online and offline init block testing - the init block execution is successful.
Thanks

Similar Messages

  • Data Slice With Variables- not working

    Dear All,
    We are in BI 7.0.
    We have tried the data slice with variables approach and it is not working for us.
    We need to lock the plan data for the past periods. For  this, We have created a data slice (selection) with variable of type customer exit for fiscalyear/period.  How to populate this variable with the past month's data?. For Bex variables, this can be done in the cmod exits. Can we use the same cmod exits for populating data slice variable too?. If yes, then how this works?.( In case of Bex variable, the variable will be used in the characterics restriction (like fiscper) and hence this is getting filled up by the exit. How this works for the data slice variable?.
    Thanks for any suggestions/help.
    Regds
    velu

    Thanks for your response. Let me clarify one more thing related to this. I have 10 characterstics with a kf 0amount at my Aggregation level and i want to create a data slice to restrict the user not to change the data for the older periods. So, do i have to use all characterstics like my agg level or do i have to use only the fiscal year period?
    and the other thing is that it won't let me use a variable when i select the exit function for the fiscal year period when i created my data slice? where i can specify the variable name? is that at the settings tab or some where else?
    Thanks,
    Srini

  • SAP-BO SSO and Row Level Security

    Hi,
    We can configure the SAP authentication and able to login InfoView via SAP user name and password. And also, we can import the roles from the SAP system.
    When we create a connection to BW cubes from designer, we want to use "Use Single Sign On when refreshing reports at view time" to apply row-level security which is defined at the BW cubes.
    In our tests, we use "Use BusinessObjects credential mapping" while creating connection from designer to test the row level security. As you can guess, after importing the SAP user, in CMC screen > Users and Groups > Users, we manually enter the password of the user to the Database credentials part. However, as you can guess, the password of the user's is not static and that is not a good solution.
    My question is that, do I need to configure SSO between SAP and BO system or how can I enable row level security?
    System Information
    Business Objects XI 3.1
    SAP Intg. Kit 3.1
    Thanks a lot,
    Omer

    Hi Omer,
    please note that only row-level security implemented through authorization variables in BW queries can be used in BusinessObjects. Row-level security defined at cube level will not be applied.
    As long as you have used the SAP authentication to log on your BOBJ server, the SAP credentials will be used automatically to get the data from your SAP BW source as long as the "Use Single Sign On when refreshing reports at view time" option  is selected in the Database configuration panel (Found in the CMC when viewing the properties of your report) and the option "Use BusinessObjects credential mapping" is selected in your universe connection.
    Please note that this will only work for reports that are invoked directly in the infoview. If a user schedules such a report, she/he has to enter her/his SAP credentials explicitely in the Database Configuration Panel appearing in the scheduling assistant window. In this case you can activate SNC trust between your two servers in order to avoid entering a password when the report is scheduled.
    Regards,
    Stratos
    Edited by: Efstratios Karaivazoglou on May 5, 2009 10:16 AM
    Edited by: Efstratios Karaivazoglou on May 5, 2009 10:23 AM

  • Row level security in BI Publisher

    Hi All ,
    I am using BI publisher for reporting on Siebel system.The issue I am facing is regarding row level security.Even if I am logging with Employee Id, when I generate report ,I have acess to all the information of the other employees.
    e.g. If as a cashier I made some entry , when I generate report on collection made by me, its bringing me all the collections made by other cashiers also.
    I am generating these report from siebel side.I am not sure if we can apply the rowlevel security to BI Publisher.
    Does anyone has used Siebel or EBS with BI Publisher and have row level security ? I am also not sure How to see the reports by loging into BI Publisher .If I am using Siebel or EBS, what is going to be my Data Model or Data Set.
    Can anyone help me on this?
    Thanks!!

    Oracle HRMS has its own security built-in to the schemas. Other modules you will need to customize for your own use.

  • Row level security problem.

    Hy all, I'm new to Oracle and though i've google it a lot I didn't manage to find a solution to this problem:
    I'm using sql developer and Oracle 10g.
    I have this two tables :
    CREATE TABLE HR_employees
    (codHR NUMBER(3) CONSTRAINT pk_hr PRIMARY KEY,
    coddep NUMBER(4) not null,
    DB_user VARCHAR2(10),
    and
    CREATE TABLE Candid
    (codcan NUMBER(2) CONSTRAINT PK_candidat PRIMARY KEY,
    codHr NUMBER(3) NOT NULL,
    CONSTRAINT FK_CODHR FOREIGN KEY (codHR) REFERENCES HR_employees (codHR) );
    I tried to implement row level security on them by using two views:
    CREATE OR REPLACE VIEW employees_v AS
    SELECT * FROM hr_employees
    WHERE DB_user = user
    UNION
    SELECT * FROM hr_employees
    WHERE codhr=(SELECT codhr FROM hr_employees WHERE db_user=user );
    AND coddep IN (4000,5000);
    CREATE OR REPLACE VIEW candid_v AS
    SELECT cand.*
    FROM candid cand , hr_employees hr
    WHERE cand.codhr= hr.codhr
    AND hr.db_user=user
    UNION
    SELECT cand.* FROM candid cand, hr_employees hr
    WHERE hr.coddep=(SELECT H.coddep FROM hr_employees H
    WHERE H.db_user=user
    AND H.coddep IN (4000,5000) );
    What I want to do is to disconnect and connect with another user from SQL Developer and see different fields based on the user and the department, Sql developer doesn't seem to recognize the user connected to the database..everytime I receive a no row selected statement, only when I connect with SYS and put the actual username WHERE H.db_user='SYS' they seem to work. I have created the tables with SYS and granted Select on the views to the users, the users don't have privilegies on the actual tables.
    Sorry for the bad english,it's a foreign language to me ,
    I hope you can help me

    Hi,
    Damorgan is right: "Row level security has nothing to do with views" in the sense that the two are independent. You can have row-level security with or without views, and you can have views with or without row-level security. dbms_rls is a very useful and powerful way to implement row-level security, and you should check it out, but it's not necessarily the answer to all row-level security problems.
    I'm not sure I understand your problem beyond the need to restrict user A's access to two tables.
    If which rows user A is allowed to see depends on the results of queries from those same tables, including rows that user A is not allowed to see (that is, you need to do sub-queries with some other user's (let's call this user B's) privileges), then you can do those sub-queries in stored procedures.
    Stored procuderes can run with the privileges of the procedure owner, regardless of who is calling them. Using a function called user_codhr owned by user B, you could define a view like this:
    CREATE OR REPLACE VIEW employees_v AS
    SELECT * FROM hr_employees
    WHERE DB_user = user
    OR    (   codhr = user_codhr
          AND coddep IN (4000,5000)
          );If the results of the function will be the same throughout the session, you can call it once, at the beginning of your session, and save the results in a SYS_CONTEXT varaible or a global temporary table.
    If you need more help, post a more detailed example of the problem, such as "With this data in the table, B should see all rows but A should see only ...".

  • Row level security with session variables, not a best practice?

    Hello,
    We are about to implement row level security in our BI project using OBIEE, and the solution we found most convenient for our requirement was to use session variables with initalization blocks.
    The problem is that this method is listed as a "non best practice" in the Oracle documentation.
    Alternative Security Administration Options - 11g Release 1 (11.1.1)
    (This appendix describes alternative security administration options included for backward compatibility with upgraded systems and are not considered a best practice.)
    Managing Session Variables
    System session variables obtain their values from initialization blocks and are used to authenticate Oracle Business Intelligence users against external sources such as LDAP servers or database tables. Every active BI Server session generates session variables and initializes them. Each session variable instance can be initialized to a different value. For more information about how session variable and initialization blocks are used by Oracle Business Intelligence, see "Using Variables in the Oracle BI Repository" in Oracle Fusion Middleware Metadata Repository Builder's Guide for Oracle Business Intelligence Enterprise Edition.
    How confusing... what is the best practice then?
    Thank you for your help.
    Joao Moreira

    authenticating / authorizing part is take care by weblogic and then USER variable initialized and you may use it for any initblocks for security.
    Init block for authenticating / authorizing and session variables are different, i guess you are mixing both.

  • Row level Security for BI Author Role

    Hi All,
    We are using OBIEE 11.1.1.5 in our project. We have a requirement where we need to configure row level security on certain column.
    We are currently using external table and session variable approach to configure this. This security works fine for the users with BI Consumer
    roles. But we are facing issue with configuring row level security for BI Author role.
    BI Author can create any analysis in BI Answers and suppose he/she creates a report which does not contain the column on which row level
    security is applied than he can see all the data. For eg.
    We have one dimension Products having two levels Product Division and Brand. I want to configure security based on Product Division column.
    But if BI Author create a report with only Brand and Measures than row level security is not working.
    Does anyone has face this issue before.
    Please let me know if you want any other information from my side.
    Regards,
    Vikas

    If you are using a multidimensional cube you can use the "permit" command to control access to dimension members or provide cell level security within the cube. The OLAP database documentation provides on how to use the PERMIT command.
    If you are using relational tables and/or views with additional CWM metadata mapped using OEM then you need to refer to the database documentation relating to Virtual Private Databases and Label Security
    Business Intelligence Beans Product Management Team
    Oracle Corporation

  • Obi 11g row level security not working

    All,
    I am very familiar and have worked with obi 10g row level security and it works pretty easily. Now in 11g not so easy. I am basically setting permissions on data filters on app roles as per the new 11g instructions and meta data guide, however, I never see the filters being applied in the report and also in the nqquery.log. I have tried in vain, and nothing. The filters are never being applied for the test user. I even verified the user is in the specified app role via their my account->app roles tab. Now has anyone had this experience or now is there something that must be done additionally now.
    Very frustrated... ;(

    Ok, so I have found the solution and ultimately the answer to why the object level and row level security was not being applied. It so happens that the app policy: 'resourceType=oracle.bi.server.permission, resourceName=oracle.bi.server.manageRepositories all' not only allows the management and access to online RPDs; but, IT ALSO DOES NOT APPLY SECURITY/PERMISSIONS IN THE RPD TO THAT USER thus you are super user. So the OOTB BIAdministrator app role which my AD user was being assigned never had any security applied due to this. How I tested:
    1) I created a test user
    2) Assigned that user to the BIAuthor app role and saw that they had the security applied that I was testing, which was simple object denial and row-level security to just one year on the date dim.
    3) Since it was working, I then assigned that user to the BIAdministrator role. This produced that the test user now does not have any restrictions that I set and that were working before. Thus, security/perms in the RPD are not applied.
    4). I removed the user from the BIAdministrator app role, kept in the BIAuthor app role and then created new test app role. I mapped that user to this new role along with the BIAuthor role. I then proceeded in creating new app policy with just that policy and assigning the new app role to it.
    5) I logged into the presentation services again with this test user after assigning to new app role and policy. My test user again does not have the security being applied and does not get any perms/security that I set and applied in the RPD. On top of that my test user is now able to login in online mode to the rpd via the bi admin tool.

  • Row Level Security not working for SAP R/3

    Hi Guys
    We have an environment where the details are as mentioned below:
    1. Crystal Reports are created using Open SQL driver to extract data from SAP R/3 using the SAP Integration Kit.
    2. The SAP roles are imported in Business Objects CMC.
    3. Crystal Reports are published on the Enterprise as well.
    3. Authorization objects are created in SAP R/3 and added as required for the row level security as mentioned in the SAP Installation guide as well. The aim is when the user logs into the Infoview and refreshes the report he should only see data that he is meant to so through the authorization objects.The data security works very much fine when the reports are designed directly on the table but when the reports are built on the Business View it doesnt work hence the user is able to see all data.
    Any help in this issue is greatly appreciated.
    Thanks and Regards
    Kamal

    Hi,
    In order for row level security to work for you using the OpenSql driver, you need to configure the Security Definition Editor on your SAP server.  This is a server side tool which the Integration solution for SAP offers as a transport.
    This tool defined which tables are to be restricted based on authorizations.
    However since you are seeing the issue on reports based on Business Views, you need to identify whether the Business View is configured in such a way where the user refreshing the report is based on the user logging into Infoview.  If the connection to your SAP server is always established with the same user when BV is used then you security definition is pointless.
    You can confirm this by tracing your SAP server to identify what user is being used to logon to SAP to refresh the reports.
    thanks
    Mike

  • Crystal reports LOV cascading prompts row level security not working

    Crystal report LOV cascading prompts with row level security is not woking when the crytal report cache server/page server cache (Oldest On-Demand Data Given To a Client (in minutes)) is turned on. But its working fine when the cache is turned off.
    Using XIR2 environment.
    Appreciate the response.
    Thanks
    Chenthil

    Hi Chen,
    In terms of what could be done on the Crystal Reports end, there is no such controls available.  However, your question may be better answered if it was posted to our Business Objects Enterprise forum. 
    It is at "BusinessObjects Enterprise Administration" section of the forums.
    FYI.

  • Row level security not working if I hit the aggregate

    I have applied row level security on presentation layer , however it does not work if the report hit the aggregate any idea on this...

    Hi Ingo,
    Security is set up using /crystal/rls transaction. A custom auth object is used for checking the company code with a single field "BUKRS".
    This custom auth object is maintained for the PA0001 table.
    This object is added at the role level with the restricted access to the Company Code..

  • Object Level Security,Data Level Security&Row level Security

    can anyone explain main difference between "Object Level Security,Data Level Security & Row Level Security " and how to implement.
    Thanks in advance,
    Kumar

    Hi Kumar
    Dashboards, Reports, Guided Navigation Links, Texts, briefing books are all Dashboard OBJECTS which are available at UI level of OBIEE..if you restrict them Say User 'A' wants to see 2 Dashboards and USer 'B' Wants to see 1 Dashboard....these settings & permission u r restricting in Object level called Object Level Security
    lly datalevel security is restriction of Data.. consider the same above example and User 'B" wants to see 2-3 regions data where as User A will see only Single Region Data..which you will do/restrict at logical tables, using variables..
    Row level security: http://groups.google.com/group/obiee-enterprise-methodology/browse_thread/thread/131ee938a5aefde0 refer this link, clearly explains you
    Please mark Correct or helpful if this clears

  • Row Level Security Not working for the ECC table.

    Hi All,
    We have created a crystal report using SQL Driver.
    We have set the row level security on PA0001 table so that we can restrict the query based on Company Code.
    But when I run the report, it bypasses the row level security and gives access.
    Am I missing some configuration?

    Hi Ingo,
    Security is set up using /crystal/rls transaction. A custom auth object is used for checking the company code with a single field "BUKRS".
    This custom auth object is maintained for the PA0001 table.
    This object is added at the role level with the restricted access to the Company Code..

  • Universe row level security workiing in main report but not subreports

    I have a report with a couple of sub reports that are running against a universe with row level security. The security works in the main report but when the sub reports run, the security is missing. The report is running through BOE, CR XI R2. Is there something Im missing...? Being new to BOE...

    Hi Michael,
    I am sure the Sub-report is also based on Universe.
    Try to create query with atleast one object/column coming from table on which row level security is applied in universe.
    Hope this will solve the problem.
    Thanks,
    Sushil

  • How to implement row level security using external tables

    Hi All Gurus/ Masters,
    I want to implement row level security using external tables, as I'm not sure how to implement that. and I'm aware of using it by RPD level authentication.
    I can use a filter condition in my user level so that he can access his data only.
    But when i have 4 tables in external tables
    users
    groups
    usergroups
    webgrups
    Then in which table I need to give the filter conditions..
    Pl let me know this ...

    You pull the Group into a repository variable using a session variable init block, then reference that variable in the data filters either in the LTS directly or in the security management as Filters. You reference it with the syntax VALUEOF("NQ_SESSION.Variable Name")
    Hope this helps

Maybe you are looking for

  • Private network issue - Windows 7 machine not restricting Windows 8 on the network

    I have 2 machines at my home, a windows 7 home premium and a new machine with windows 8.1.  The windows 8 machine can get to anything, regardless of user account, regardless of directory, including hidden files and folders, on my windows 7 machines w

  • How can I edit items in a listbox?

    What I need to do is:  when the user clicks the 'edit' button, it should reference the listbox to ensure an item was selected.  So, if an item is selected, I need to store the item to a string variable. Next, the user should be able to use a textbox

  • Fading out of Position filed in -IT-0001

    Guys, Request to help me in fading out of the Position filed in IT-0001. In IT-0001, the POSITION filed in editable....My client wants the POSITION field to be Un editable... Pls give any ray on this.. Best Regards, Srikanth S

  • No free space in directory entries for NTAB buffer

    Gurus , In ST02 -> for table definitions buffer there was a red alert with the SWAP count as 953275 . hence i Double clicked on the swaps count to see the details , which is shown below , efficiency : hit ratio  70 size : allocated : 6799 available 

  • Premiere Pro does not import any footage

    Premiere Pro CS6 imports footage to the media browser, but with the image jumbled up. This happens regardless of format/codecs. Audio (including from footage) imports normally.