SOLUTION: Implementing Operating Unit Org Security Without EBS Integration

Question

Hi all,
Thank you for taking the time to review this post.
Environment
Oracle BI Applications 7.9.6 (Financial & Project Analytics)
Oracle E-Business Suite 11.5.10
Question
I have implemented BI Applications and am using LDAP Authentication (OID/MSAD) to authenticate the BI Apps users. This is authenticating successfully. I also require to implement GROUP authorisation and OU_ORG security, however as I am not implementing the documented EBS integration (as per Metalink Note ID 555254.1) I am looking at a custom solution.
To achieve this I have created a custom database table in the BAW that contains the USER, GROUP and OU_ORG information. Then I have created separate Initialization Blocks for the GROUP and OU_ORG security that are being triggered after the LDAP Authentication. These SQL queries are based on returning data to a row-wise initialization Variable. I am aligning the GROUP values to the OOTB Presentation Groups and am able to get that Initialization Block to work as anticipated - the User only has the privileges to see Dashboard and Application links as I have configured in the Web Catalog.
However, they can see all data across all orgs. The OU_ORG security is returning the correct org_ids into the row-wise variable, but I appear to be missing how OBIEE utilises this for data security.
If you are able to assist with a possible solution, that would be greatly appreciated. Also, if it relates to a change at the Dashboard, Answers or RPD level, if you were able to include where specifically in these components that would also be very beneficial.
Many thanks,
Gary.

Answer 1

Here is another approach with ‘external database authentication’ where the EBS database provides the user information.
1. Create a table with the mapping of the EBS responsibilities and OBI Apps Groups
Ex: Create a new table “xx_resp_group_mapping” which contains the mapping between the EBS responsibility and OBI Apps groups.
Essentially, a one-time mapping of the BI apps groups needs to be done with the EBS groups so that the corresponding default access of these BI Apps groups can be passed on to the custom groups
2. Modify the authentication initialization block to validate the user against EBS
3. Modify the authorization initialization block to fetch the respective OBI Apps groups using the EBS user and the mapping table created in point 1
4. Enable the standard OU based security initialization block.
5. Add all the OBI Apps groups under the Operating Unity Security Group
6. Modify the permissions in the Operating Unity Security Group to put a filter on the Sales Org OU. Other filters on fact tables are not modified.
7. By default OBI Apps applies data level filters on fact tables. If dimension tables need explicit data level security it would need customization.
8. Any users who are not in EBS but need exclusive access only to BI Apps data can be granted exclusive access by adding those users directly in the OBI repository. They would directly be validated against the OBI server.
However, this approach is not suitable if the number of users are high in numbers.