Shared Services question....

Hi all, I have a question regarding managing Shared Services. Hopefully, I'm posting the subject in the right area.
I'm trying to restructure the whole security management process for a client and I'd like to verify with everyone if this is the standard industry practice.
When I set up the admin login (power user), should I provision all levels of access (both read & write) in DEV/TEST? Then after it's set up successfully, should I push it down to PROD?
When I make changes to access for the end users, should I also provision in DEV/TEST? Do I have to do it again in PROD? or should the end users be able to see the change right away in PROD?
Thanks for taking time to read.

Is there a "standard industry practice" for provisioning? I usually find it depends on the client how the provisioning process will operate. I rarely come across provisioning that is applied through all the environments.
Cheers
John
http://john-goodwin.blogspot.com/

Similar Messages

Hyperion Shared Services Question

Hi,
I need to see the filters that have been assigned to a particular group in HSS.
We have a folder called projects in the tree where the analytic server is added, but when I go to the corresponding application under that analytic server to check, the list comes out blank for users, groups and both users and groups.
Is there any other way to find out this information.
Am I doing something wrong here.
Please advise.
Thanks in advance.
Anindyo

I run a maxl script on the Analytic(essbase) server to get the security infromation for Users, Groups, Users in group, Filters, Filter rows, User privileges and Group privileges.
login USERID identified by PASSWORD on SERVERNAME;
set column_width 40;
Spool on to 'c:\temp\user\users.txt';
display user all;
spool off;
Spool on to 'c:\temp\user\Group.txt';
display group;
spool off;
Spool on to 'c:\temp\user\Groupuser.txt';
display user in group all;
spool off;
Spool on to 'c:\temp\user\Filter.txt';
display filter;
spool off;
set column_width 1200;
Spool on to 'c:\temp\user\FilterRow.txt';
display filter row;
spool off;
set column_width 40;
Spool on to 'c:\temp\user\UserPrvlg.txt';
display privilege user all;
spool off;
Spool on to 'c:\temp\user\GroupPrvlg.txt';
display privilege group all;
spool off;
exit;
spool off;

Shared Services and Essbase Server Access Question

Hi,
It seems that we have to assign Essbase Server access at the individual username level and that groups don't work when it comes to Essbase Server Access. Is this correct or are we doing something wrong and groups do work with Essbase Server access? We are on 11.1.1.3 Essbase/Planning/Shared Services.
Thanks

You can provision Essbase Server Access via groups but it must be the very first thing provisioned and pushed to Essbase. Then after that, provision your groups with other accesses such as Planning, Reports etc....

Essbase shared services openLDAP question

Every year when our external auditor reviews our Hyperion 9.3.x environment they hammer us in regards to the admin user stored in openLDAP for shared services. Out of the box there is no way to disable openLDAP(native) users and there are no password controls for any native user. We have test and you can set a single character non-expriring password.
I have read that openLDAP can be configred to enforce password requirements such as complex passwords and password expiration but have not found any document that tells how to do this for the Hyperion Shared Services environment.
I opened a service request with Oracle and was told that they do not support custom modifications to the openLDAP and I would be unsupported if I make such changes. I think I would rather take that chance than risk any additional audit issues for this reason.
Does anyone have any experience with making such modifications that could provide more detailed steps to take?

You're auditors are being unreasonable about one account. Typically you can do the following:
1) Setup an audit process to review for native users
2) Attest that the password used for admin user is "strong" having special characters and of a certain length
3) Change it periodically realizing there is a cost in system time to change
If they are still failing you they are just doing it for a perverse pleasure -- they will not be helping by making the system unsupported by the vendor and/or unstable.
If it's really a big deal get management to either get a waiver or spend the dollars to upgrade to 11.1.2 and look at using a native directory provider that allows for expiration, password lengths, ...
Regards,
John A. Booth
http://www.metavero.com

Shared Services, create read access to a cube into an application us a grou

Hi,
I have an application with 3 cubes. I have created a group in Shared Services, and i want to give read access only to one cube.
If i give provision to this group , i only can give read to all the application, so all the cubes are going to have read access.
How must i do to give only read access to one cube and not to all,
Thnx
Guillermo

Hi,
This post will help answer your question :- Assigning database access using Shared Services
If you are using Shared Services access is applied at application level and you can't select individual access to each database.
Cheers
John
http://john-goodwin.blogspot.com/

Purpose of Configuration utility and shared services????

What is the configuration utility ? what is the purpose of this.
what is the shared services and purpose.
Plese do not say " interview questions, please refer docs" .
Please i need a brief just for some idea.
Regards
Eshwar

Config Utility within Shared Services is to configure the Essbase Applications which are designed to work with Shared Services.
With the Configuration Utility, you can configure individual applications once they are registered with Shared Services. You can:
1) Deploy to Application Servers
2) Configure Repositories
3) Choose Application specific option
Depending upon which application you are configuring, you will see different options.
Shared services, as the name suggests, is to manage all the shared components within all the Hyperion applications which can work with Shared Services. Apart from config utility, another big use of its is to manage the users.
Hope this helps.
Nitin Malhotra

Hyperion Essbase on Solaris & Security issue in Shared services

I installed Hyperion system 9.3.1 in my dev environment. Every thing is working properlly.
But i still have questions on couple of things.
1) I installed essbase on solaris 10. I was just trying to configure the sql interface for ESSBASE.
I went through the documentation. It says i supposed to get a file called libesssql.so.1
But i can't able to see this file in ARBORPATH/bin location. But still I could able to load the data
into sample Essbase application. My essbase is working fine. when i ran the script inst -sql.sh
it created a file called libesssql.so in the ARBORPATH/bin location. But no libesssql.so.1.
Can some one help me regarding this................
2)In the shared services when i clicked under Hyperion system 9 BI+, i cant able to see
any reporting related files to assign security. i am seeing a message saying refer to the security guide to confiure
permissions for this application.
I logged into the shared services with admin privileges.
Please help me in this...........
Thanks,

Hi,
What version are you using ?
Just to be clear are you saying that the utility only exported one native user and you expected it to export more ?
Cheers
John
http://john-goodwin.blogspot.com/

In Shared services, Log Files taking lot of Disk space

Hi Techies,
I have a question. Its like the Logs in BI+ in Shared Service Server is taking lot of Disk space about 12 GB a day.
Following files are taking more space
Shared Service-Security-Client log ( 50 MB )
Server-message-usage Service.log ( About 7.5 GB )
why this is happening. Any suggestions to avoid this.
Thanks in Advance,
Sonu

Hi Techies,
I have a question. Its like the Logs in BI+ in Shared Service Server is taking lot of Disk space about 12 GB a day.
Following files are taking more space
Shared Service-Security-Client log ( 50 MB )
Server-message-usage Service.log ( About 7.5 GB )
why this is happening. Any suggestions to avoid this.
Thanks in Advance,
Sonu

Shared Services 11.1.1.3 - Problem importing Bus Rules from LCM Exports

Hi,
We have some Bus Rules in Calc Mgr that are named the same as the corresponding webform. For instance, a bus rule may be named '2.1.4 - Budget Load'. When we export all bus rules and then try and import them in to target (can be same server), they say they were successful, however none show up in Calc Mgr. After exhaustive testing, we took out the period (.) in the name and made it '2_1_4 - Budget Load' and it worked fine and migrates ok. My question is if anyone knows if this is a know issue bug or are periods not allowed like parens in Bus Rules names? It's weird as I swear this was working on a earlier version of Shared Services. We are upgraded to the latest patch on Shared Services too.
Anyone have an older version of 11.1.1.3 Shared Services that they can test this on for me? Thinking Oracle may not have regression tested :)

Straight from Oracle Support.... What a joke their regression testing is.....
Thank you for your updates.
I found the following Bug for 11.1.1.3. It is as follows :
"Bug 8489999 - Filenames without ext, with artifact ids containing "." are not migrated. "
According to the Development Team, it is validated with Drop 5 build 17.
When discussing this issue with the Development Team earlier today, they wanted to check if this behaviour is noticed even when using 'admin' and Application Owner Account.

IC WebClient Shared Services Business Roles

Dear All
I have a question regarding the some of the IC Webclient Shared Services roles provided by SAP.
I know that as of CRM 7.0 EHP 1.0 SAP provides separate roles for Accounting Interaction Center, Employee Interaction center and ITDS- IT HelpDesk Role along with a Shared Services Agent Role.
I want to know that is it recommended to combine the Accounting Interaction Center, Employee Interaction Center and IT HelDesk role into one role or the opporsite way of using separte roles for separate functions.
Thanks
Tarang

Hello
Well...it depends.
If you want your agents to handle all types of calls and you don't have a big-big company with many employees and a big support desk, the best option (due to maintenance reasons) is keeping everything in a single business role with a multi account identification profile.
On the other hand, if you have agents with separate and independent account, IT and employee tasks and your business processes are different depending on who is on the phone, you need three different business roles.
So, to summarize, it depends on your project needs and your company size.
Regards
Joaquin

Multiple shared services installs in the same environment?

In IOP 11.1.2 and beyond, shared services handles user authentication, to take advantage of Active Directory.
Can you install EPM shared services on 2 nodes in the same environment (failover in case one goes down)?
Is this possible or recommended?
Thank you.

I posted this message also in the Forum: Server & Storage Systems: Administration - General : Installation.
I'll also double-check the install documentation. A quick google of "EPM Shared Services" and some choice keywords revealed a link to this:
http://www.oracle.com/technetwork/middleware/bi-foundation/epm-hss-active-active-clusters-wp-1-132647.pdf
Note that one of the instructions in the active-active-clusters white paper is to install shared services on two nodes, to prevent a single point of failure.
This location http://www.oracle.com/technetwork/middleware/bi-foundation includes EPM DR instructions.
Highly recommended reading.
I apologize to the group for wasting the bandwidth on this question.
Thank you.

Generating user reports ( Hyperion Shared Services)

When i right click on Active directory->USer and say View Report, it by default generates report by USer ID, Is there any wasy to generate these reports by First and Last name of users?

Hi,
I have answered this question in post :- UsersByGroup SS report crashing;Shared Services Users not removed correctly
Cheers
John

Shared Services database content not found in the specified database."

Trying to configure Version 11 and get the error: "Shared Services database content not found in the specified database". Relevant details on my issue as below:
- I'm running Windows 7 and SQL Server 2008 on my local machine.
- I did have a previous installation of Hyperion 9 on my machine which I uninstalled before installing 11. However, after uninstalling, I could still see the Hyperion EPM (empty folders) in my "All Programs", which I manually deleted.
- Now I've installed Essbase 11, and for now am trying to configure Hyperion Foundation only (Common Settings and Configure Database is greyed out, I checked deploy to applicaiton server. I left the calculation manager and workspace blank).
- The next window is the "Configure Shared Services and Database Registry" option. I chose "Perform 1st time Configuration of Shared Services Database". When I enter the relevant details, I got the error mentioned above. My error log file entries are as below:
(Jul 14, 2010, 02:10:50 PM), com.hyperion.hit.registry.Registry, ERROR, Exception when trying to store the component
java.lang.IndexOutOfBoundsException: Index: 0, Size: 0
     at java.util.ArrayList.RangeCheck(ArrayList.java:546)
     at java.util.ArrayList.get(ArrayList.java:321)
     at com.hyperion.hit.registry.JDBCRegistryUtils.storeComponent(JDBCRegistryUtils.java:612)
     at com.hyperion.hit.registry.JDBCRegistryUtils.saveComponent(JDBCRegistryUtils.java:166)
     at com.hyperion.hit.registry.Registry.storeComponent(Registry.java:2749)
     at com.hyperion.hit.registry.Registry.getInstance(Registry.java:353)
     at com.hyperion.config.wizard.impl.RegistryWizardRule.validate(RegistryWizardRule.java:66)
     at com.hyperion.cis.config.wizard.adapter.WizardFormAdapterPanel.queryEnter(WizardFormAdapterPanel.java:80)
     at com.installshield.wizard.awt.AWTWizardUI.currentBeanChanged(Unknown Source)
     at com.installshield.wizard.swing.SwingWizardUI.currentBeanChanged(SwingWizardUI.java:842)
     at com.installshield.wizard.StandardWizardListener.currentBeanChanged(Unknown Source)
     at com.installshield.wizard.Wizard$RunThread.run(Wizard.java:1822)
(Jul 14, 2010, 02:11:08 PM), com.hyperion.cis.config.wizard.adapter.WizardFormAdapterPanel, ERROR, Shared Services database content not found in the specified database.
(Jul 14, 2010, 02:11:58 PM), com.hyperion.cis.config.wizard.adapter.WizardFormAdapterPanel, ERROR, Shared Services database content not found in the specified database.
I believe version 11 supports Windows 7, but correct me if I'm wrong. What's going on here? Any suggestions on what I should try ?

Actually when I installed version 9, I never got around to configuring shared services and so never had a shared services database in SQL Server to begin with.
One question about the registry entry you told me to delete: The (HKEY_LOCAL_MACHINE\SOFTWARE\Hyperion Solutions) which currently exists would be the entry for version 11 which I have installed right? It's the only entry for Hyperion Solutions in the registry.
After uninstalling versino 9, C:/hyperion still existed on my machine (though it didnt have all the subfolders which it did prior to uninstalling), so I manually deleted it before installing verison 11.
I wouldn't mind installing it on a compatible version of windows, but the thing is that at this point this is all that is available to me.
and I don't have any other oracle products.
thanks....

Shared Services on on System 9

Hi, please could someone help me........
I am currently migrating from Essbase 7.1.5 to System 9. I know this is a few releases old but we dont have the ability to move to 11.1.
We have installed all of the foundation server software and the essbase server, when it comes to using the user management consol i can login with the standard admin password setup and then click on any of the 3 tree structures (User Directories/Projects or Unassigned Applications) it just sits there and hangs?? Im currently using IE8.
I have tried this on an old machine that i have a limited time to use which is running IE7 and it works fine? is there a fix or is this a well known problem. if anyone could advise then that would be great.

Many thanks for your response i will check out if there are any patches. Few thought i was going mad for a second :-) i do however have anouther question...... The reason we where going to use shared services was becuase we wanted to be able to import users from AD. Now seeing as we only have Essbase and no other products. The only way in which our users access essbase is through the Excel add-in. My question is, is Sharred services needed? can i just set up all our users on the Essbase server itself like how we used to do it in 7.1.5?

Error on Shared Services

I'm sorry about my dumb questions, but i have one more:
Any calls of my succesfully installed, configured according to
install guide and launched shared services finishing by error
"UnableToCreateExternalUser".
SS use Native directory
SOMEONE, PLEASE HELP!!!

I have the same problem with Hyperion 9.3.1 and Oracle 10.2.0.1 and Windows 2003 SP1
When I try to register Analytic Services I get the following messages in SharedServices_Metadata.log:
2008-01-31 12:09:49,921 [http-58080-Processor2] ERROR com.hyperion.eie.common.cms.CMSFacade - org.apache.slide.common.ServiceAccessException: Service org.apache.slide.store.impl.rdbms.JDBCStore@11a4bd4 access error : [Hyperion][Oracle JDBC Driver][Oracle]ORA-01722: invalid number
2008-01-31 12:09:49,921 [http-58080-Processor2] ERROR com.hyperion.eie.common.cms.CMSFacade - com.hyperion.eie.common.cms.CMSException: error.UnableToGetNodeRevisionDescriptor
2008-01-31 12:09:49,937 [http-58080-Processor2] ERROR com.hyperion.eie.modelmgmt.action.register1Action - Unable to create external user admin@Native Directory with identity native://DN=cn=911,ou=People,dc=css,dc=hyperion,dc=com?USER.
2008-01-31 12:09:49,937 [http-58080-Processor2] ERROR com.hyperion.eie.modelmgmt.action.register1Action - com.hyperion.eie.common.cms.CMSException: error.UnableToCreateExternalUser
2008-01-31 12:10:35,390 [http-58080-Processor2] ERROR com.hyperion.eie.common.cms.CMSFacade - org.apache.slide.common.ServiceAccessException: Service org.apache.slide.store.impl.rdbms.JDBCStore@11a4bd4 access error : [Hyperion][Oracle JDBC Driver][Oracle]ORA-01722: invalid number
2008-01-31 12:10:35,390 [http-58080-Processor2] WARN com.hyperion.eie.common.cms.CMSFacade - GetUsers() - Skipping User
com.hyperion.eie.common.cms.CMSException: error.UnableToGetNodeRevisionDescriptor
Any ideea why ?
Thanks,
Daniele

Shared Services question....

Similar Messages

Maybe you are looking for