Shared services ( Nesting of groups)

Hi,
In case of Group nesting If in Group B another group A is added ( or nested) as GRoup member. Does the provisioning of Group B also Applies to Group A? Or is it required to provision Group A seperately?

When I right click a group A and go to the tab Group Members. The group names (. Group1, Group 2 etc)that I see in Group Members tab are called nested/Child groups and the GroupA is a parent group. Please correct me if I am not right.That's correct. Glad I was able to help.
Cheers,
Mehmet

Similar Messages

Need to migrate Shared services users and groups from 9.3.1 to 11.1.2.2 ver

Hi All,
We need to migrate Shared services users and groups from 9.3.1 to 11.1.2.2 version. Any help would be appreciated. Can we use CSS import export utility?
Thanks in advance!!

Hi John, In my another environment I have to migrate the users and groups from Hyperion HSS 11.1.1.2 to Hyperion shared services 11.1.2.2. I am using LCM for that, when I export the users and gropus from 11.1.1.2, it exports fine but when i import it to my 11.1.2.2 using LCM, I am getting the below errors.
Error when I try to import the groups:
ErrorEPMIE-00051: Failed to perform operation on role. Could not locate role matching filter {0} and filter attribute {1}. Please ensure that a role exists matching the filter with filter attribute.
EPMIE-00024: Failed to import all of the membership info for group test group. Invalid group members encountered. Please ensure the validity of members and its existence in their respective providers.
Errors when i try to import the users:
ErrorEPMIE-00051: Failed to perform operation on role. Could not locate role matching filter {0} and filter attribute {1}. Please ensure that a role exists matching the filter with filter attribute.
EPMIE-00020: Failed to update user 04668162 during import. Invalid identity for user. Please ensure that the user is available in the system with the identity specified in the import file.
Any idea?
Thanks in advance.

Essbase to Shared Services "CREATE & DROP GROUP" SYNC?

Hi All,
Our Essbase security is externalized to Shared services.
But I am still designing the security to be done in batch mode using MAXL because of the bulk of provisioning.
When I run a
Create Group group99; (Native group)
It is created in Essbase & immediately reflects in Shared services without any refresh.
When I run a
Drop Group group99;
It is deleted in Essbase, but still remains in Shared services.
Is there a way to delete groups in Essbase & Shared services at the same time using MAXL?
Appreciate your thoughts.
Thanks,
Ethan.

Srinivas & Sandeep,
When I use
Alter group .......
after Drop Group (was successful)
I get an error saying group99 doesnot exist.
Is it possible to drop a native user or a native group in Shared services using MAXL?
It is so weird that we can create group in Shared services & Essbase at the same time using MAXL, but Drop deletes group only in Essbase.
Thanks,
-Ethan.

Security Settings for two admin groups with shared service

Hi all,
I use Essbase Administration Services 11.1.2 and Hyperion Shared Services Console 11.1.2.0.73 (Drop 17)
Access Rights are granted via Groups in Hyperion Shared Service Console.
We have two admin groups.
AccessGroup 1: admin rights on some cubes (A) and read rights on all others (B).
AccessGroup 2: admin rights on (B) and read rights on (A).
If someone of AccessGroup 1 copies a cube of (A) – Fin_rep for example – wether AccessGroup 1 nor AccessGroup 2 can even see the cube (and i dont even mention admin rights) execpt the one who copied it.
Settings in Shared Services Console:
- Both groups have role "Create/delete application" and "AccessManager" (or something like that - german word is "Zugriffsberechtigungsmanager") on Essbase Cluster (our essbase server).
- AccessGroup 1 has role "ApplicationManager" and "AccessManager" for all cubes which they should administrate (A)
and role "Read" for all cubes with read only (B)
- AccessGroup 2 has role "ApplicationManager" and "AccessManager" for all cubes which they should administrate (B)
and role "Read" for all cubes with read only (A)
I hope i can get some help with this topic.
Thank you in advance,
Best regards
Bernd
Edited by: 907705 on 07.02.2012 02:52

Security will not copy over when you create new cube from old cube. You have to grant security to required groups using shared services or Maxl.

Planner provisioning for user groups lost in Shared services

Hi All,
Everything was fine. All of a sudden, no users were able to login in to planning.
On investigation it was found that all the planner/planning provision to the groups is lost in the shared services.
Digged into log for a while and couldnt find out any issues.
What could be the reason we lost user group security provisioning only to planning?
Could anyone please help on this?
Regards,
GG

I used to have same experience every time migration happens from dev to UAT or prod etc.
After migration, registering with shared service will be successful. When i try to sync, migrate user identities (provisionusers.cmd) from shared service all user group info vanishes in planning (Add/Edit access page). i.e hsp_access_control table is truncated or all rows are dropped.
Then i have to set it up correctly. Guess this happens because usergroups have different id between different environments. When sync'g planning at target, it will not be able to recognize the wrong usergroup id of source system.
My assumption:
When provisionusers.cmd is run, planning fetches the usergroup provisioning information from shared services in to hsp_access_control planning repository table. could someone confirm the same?
Is there any other way to overcome this issue recurring on every time migration happens?
But the problem today was different: the provisioning is lost in the shared services itself which i havent witnessed so far. We didnt migrate recently, everything was file till 8 AM, but screwed around 8.10 AM. everything was up and running.
Cheers,
GG

Application registered with shared services registry 11.1.2.1 - interesting

Here is an interesting situation.
Our HFM application has 4 to 5 AD groups in shared services. All groups are ok except one group which keeps dropping out of shared services. Hence the users loggin in from that domain couldnt connect and get the message in the subject.
Any clues guys?

I've come across a similar issue on 9.3.1
I dont know the exact techinal details but the hyperion system account that was used to log onto the domain we were having issues with kept getting locked out for some reason.
When the system account got locked out it couldn't access the AD and all users on that AD lost access.
When we got that account unlocked by the AD team all users got full access back

Shared services and Essbase Sync issue

Hi,
Today morning all of sudden lot of users raised an issue that they can't see few applications while connecting through Smart view. I have checked Shared services and the groups are already provisoned. Finally I ran alter system resync sss and after the syncing its fine.
Any reasons why this morning Syncing was not there.
Thanks..

Its fascinating, if the users are provisioned too they can see other applications in smart view and that's what I heard but never checked on it, Is there any possible filters where they cant see it ?
If so please let me know.

Audit Reports from Shared Services

I am using HFM 11.1.1.2 and want to pull a Audit Report in shared services. My approach are as follows:
In Shared Services on Application Groups, I select my application and right click and select Audit Report. I get the following error:
Auditing is Disabled and No Records Audited.
How and where do I enable this?
Thanks

You first have to enable Auditing globally in Shared Services. To do this, login to Shared Services, make sure you have the "Shared Services" node highlighted in the pane on the left-hand side and click Administration-->Configure Auditing.

Remove users from Shared Services/ EPM

Gurus
I have some users who have gone to different department and some who are no more with the companies. I was just wondering if there is a script I can run in the EPM Environment/ Shared Services to remove users and the provisioning in bulk.
Thank you for your response.

Hi John,
I got it.
What I did was that I exported the GROUPS under APPLICATION GROUP -> FOUNDATION > SHARED SERVICES -> NATIVE DIRECTORY -> GROUP. Created a CSV file and deleted the user and then imported back again.
This is how it works right?
ALSO, can I totally erase the user. The above process deleted user from group. But if I need to delete the user overall from everywhere in the EPM app, is there a way to do so?
OR do I need to ask the server team to remove the user from MSAD.
Thanks

Migration of IDs to shared services

Hi
I successfully migrated the HFM application 9.2.1 to 11.1.1.4. then i want to migrate the shared services users and group... more than 50 users are there in the shared services..
so please advice me what are the step i follow to migrate the shared services users
thanks

It might be easier just to recreate the 50 users.
However, the approach is to use the CSSImport/Export tool to extract the users/provisioning from 9.2
The output format would be .csv files
Then in the new 11 system you can do an LCM export of Foundation (users,groups, assigned roles) with a couple of test users provisioned to HFM.
The LCM tool for provisioning and users is basically the CSSImport/Export tool wrapped into a web interface.
Compare the output of both the 9.2 and the 11 , they should be similar.
Manipulate the 9.2 content to fit the new 11 format and try to LCM import...
Nick
Edited by: Nicholas King on Jan 9, 2012 7:54 PM

Shared Services Mixed Native-MSAD group nesting

Is anyone doing this?
I am trying to make an MSAD group a member of a native group using shared services and after adding the MSAD group, the console errors out for the group i just made whenever trying to view the group members. This is repeatable and happens before i have even provisioned the parent group when i am trying to view the group members.
When i nest a native group inside another native group, it works fine.
In the SharedServices_Security.log found in Oracle/Middleware/user_projects/domains/EPMSystem/servers/FoundationServices0/logs
I see the following stack trace:
[2010-12-14T09:09:22.156-06:00] [FoundationServices0] [ERROR] [EPMCSS-7019] [oracle.EPMCSS.CSS] [tid: 7] [userId: <anonymous>] [ecid: 0000In_RR_eDKeoLwUg8yW1D1Yoh00001G,0] [APP: SHARE
DSERVICES#11.1.2.0] [SRC_METHOD: execute:129] [SRC_CLASS: com.hyperion.css.web.action.CSSStatefulAction] Failed to process the request.
[2010-12-14T09:16:16.365-06:00] [FoundationServices0] [NOTIFICATION] [EPMCSS-17306] [oracle.EPMCSS.CSS] [tid: 7] [userId: <anonymous>] [ecid: 0000In_T0hhDKeoLwUg8yW1D1Yoh00001J,0] [AP
P: SHAREDSERVICES#11.1.2.0] [SRC_METHOD: ] [SRC_CLASS: ] [arg: native://nvid=af1814bfd20d7272:58ecdd0:12ce020823f:-7f66?GROUP] x
[2010-12-14T09:16:17.473-06:00] [FoundationServices0] [ERROR] [EPMCSS-37000] [oracle.EPMCSS.CSS] [tid: 8] [userId: <anonymous>] [ecid: 0000In_T0z1DKeoLwUg8yW1D1Yoh00001K,0] [APP: SHAR
EDSERVICES#11.1.2.0] [SRC_METHOD: execute:128] [SRC_CLASS: com.hyperion.css.web.action.CSSStatefulAction] Error while processing the request.[[
java.lang.NullPointerException
at com.hyperion.css.web.util.DTOFactory.createGroupDTO(DTOFactory.java:49)
at com.hyperion.css.web.util.DTOFactory.createGroupDTOEscDoubleQuote(DTOFactory.java:75)
at com.hyperion.css.web.action.EditGroupAssignGroupsFormAction.executeAction(EditGroupAssignGroupsFormAction.java:109)
at com.hyperion.css.web.action.CSSStatefulAction.execute(CSSStatefulAction.java:119)
at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:421)
at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226)
at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164)
at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:415)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:292)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:175)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3594)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:121)
at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2202)
at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2108)
at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1432)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
I think its a bug and have opened an SR with oracle, but i'm curious what others out there are doing.
Edited by: Javanator on Dec 14, 2010 10:25 AM

Hi Dear
Is this issue resolved? i too get the similar error in the log file . Please let me know if it is reolsved for you

Generate report to show all users and groups in Shared Services in EPM 11x

Hi,
Is there any way to generate a report (like a migration report or job status report) which can be generated through workspace/shared services 11.1.1.3 so that my admin can look at all the users and groups created. Something that I can view and probably print out? Any suggestions?
~Adeeba

Yes, I knew this one. This basically shows me the users and groups assigned specific provision access. Is there any way to view a report that shows which users and groups have access to dimensions of an individual planning application?
~Adeeba

CSSimport.bat error: while migrating the Shared Services groups and users

Hi,
I am trying to migrate the shared services native users and group from 9.3.1(on server A) to 11.1.1.3(on server B)
- I have taken the export in CSV format from 9.3.1 using CSSexport.bat.(export.csv) -Successful.
- I have copied this on the 11.1.1.3 server and changed lil details like removing the admin user etc.
- When I am trying the import this on 11.1.1.3, I am getting the below error:
CSSimport importexport.properties2010-10-11 09:36:41,328 Attempting a import operation
log4j:WARN No appenders could be found for logger (com.hyperion.css.common.CSSLogger).
log4j:WARN Please initialize the log4j system properly.
null
Aborting program...
- There are not log or error files geting generated - The only error recieved , is given above.
- I have made the necessary changes to the impotexport.properties file on 11.1.1.3 before starting the CSSimport utility.
Can you please let meknow what should I do to overcome this error.
-thanks,
Ankit

First thing I would try would be on the 11.1.1.3, try and run an export, if it works then run the import on the same file, this way you will make sure you have the version 11 utility working.
Once you have done that then you can move on to the 9.3.1 export file.
Cheers
John
http://john-goodwin.blogspot.com/

Error while adding users to a group created in shared services

Hi All,
I am using EPM 11.1.1.1.0.. When i log into SHared services as admin and create a group i get the following error when i try to add the user members to the group.
"Servlet error: An exception occurred. The current application deployment descriptors do not allow for including it in this response. Please consult the application log for details."
Can somebody please help....
Regards.
Alicia

Hello Ritendra,
i am also facing the same problem. i could not find some solution.
if you got some solutions then please help me.
i have installed oracle 9i as in W2K system.
regards
sudhir

Creation of Group in Shared Services

Hi All,
I am creating groups in Shared Services using Import export utility, to create a group I have given record like
#group,,,,,,,
id,provider,name,description,internal_id,,,
Test.30.7202,Native Directory,Test.30.7202,,,,,
But group is not getting created, when I checked the trace log file I found
Trace...
     2010-06-09 15:28:20,822 Attempting a import operation
     2010-06-09 15:28:22,147 Import : Attempting to create group Test.30.7202
     2010-06-09 15:28:22,162 Import : Create group Test.30.7202 failed.
Can you please someone explain, is there I missed any information?
We are using Hyperion system 9.3.1
Thanks in Advance

Hi John,
Thanks for the prompt response, its working fine without intenal id. One more issue, Now I am provisioning groups for Planning Application
project_name     application_name     role_id     product_type     user_id     user_provider     group_id     group_provider
HyperionPlanning     Testapp     Planner     HP-9.3.1               Test.30.7202     Native Directory
Like the above, is there any syntax to provide access to Essbase "Server Access" (Minimum access to access to Essbase) and Business Rules?
Thanks in Advance,

Shared services ( Nesting of groups)

Similar Messages

Maybe you are looking for