Single Sign On Questions

Question

We are using Active Directory as the user store and SSO works as advertised. There is a single set of AD groups that define membership in the roles being used for security. The problem is that this means that if someone is in the financial group they can get to the financial data in all environments: dev, test and production. I am trying to figure out a way to limit access in the dev and test environments. I thought I could do it by adding a filter for a particular group on the All Users Filter in the AD provider. While this does limit the users in the security realm it doesn't prevent users not in that list from connecting to OBI through SSO. Any Ideas?
Another issue is that every instance that I have put SSO on it has broken the validateAnalysisCriteria logic that had been implemented in Answers. The system can no longer find the mycriteriablocking.js file where the code is. If you put the code into the answerstemplates.xml file it works. But I have run into problems with the size of the code that can embedded like that. If it gets over a certain size it no longer works. Putting it in an external file allows more code and thus a more complex query. But after implementing SSO it can't find the file referenced in the answerstemplates.xml. And if you roll SSO back off it still does not work. We use the validateAnalysisCriteria to prevent the combination of certain fields in a query. Perhaps there is another way to implement that kind of logic?
OBIEE 11.1.1.6.2 BP2
Windows 2008 R2 SP1

Answer 1

dirkt wrote:
We are using Active Directory as the user store and SSO works as advertised. There is a single set of AD groups that define membership in the roles being used for security. The problem is that this means that if someone is in the financial group they can get to the financial data in all environments: dev, test and production. I am trying to figure out a way to limit access in the dev and test environments. I thought I could do it by adding a filter for a particular group on the All Users Filter in the AD provider. While this does limit the users in the security realm it doesn't prevent users not in that list from connecting to OBI through SSO. Any Ideas?Log an SR with O. Quick workaround to stop other AD groups from accessing BI is by restricting access to OBIEE for that authenticated-role (which is everyone) who is a valid user in LDAP, you can restrict Access Home Page from Manage Privileges screen in OBIEE Administration screen.
Give Access to Home access only to the Roles you want to give access to OBIEE, who ever is not part of these roles cannot access OBIEE.
Another issue is that every instance that I have put SSO on it has broken the validateAnalysisCriteria logic that had been implemented in Answers. The system can no longer find the mycriteriablocking.js file where the code is. If you put the code into the answerstemplates.xml file it works. But I have run into problems with the size of the code that can embedded like that. If it gets over a certain size it no longer works. Putting it in an external file allows more code and thus a more complex query. But after implementing SSO it can't find the file referenced in the answerstemplates.xml. And if you roll SSO back off it still does not work. We use the validateAnalysisCriteria to prevent the combination of certain fields in a query. Perhaps there is another way to implement that kind of logic?
OBIEE 11.1.1.6.2 BP2
Windows 2008 R2 SP1Check the below links by Shahed:
http://deliverbi.blogspot.com/2013/03/obiee-11g-blocking-analysis-enforcing.html
OBIEE 11.1.1.6.8 Analysis Blocking  if (!tValidator.dependentColumnExists("
HTH,
SVS