Skip Headers

Oracle Fusion Middleware Administrator's and Developer's Guide for Oracle Business Intelligence Publisher
Release 11g (11.1.1)
Part Number E13880-01		Go to Table of Contents
Contents 		Go to previous page
Previous 		Go to next page
Next

Alternative Security Options

This chapter covers the following topics:

About Alternative Security Options

This chapter describes security concepts and options for a standalone implementation of Oracle BI Publisher, that is, not installed as part of the Oracle Business Intelligence Enterprise Edition. Please note the following:

Use the information in this chapter to configure the following:

Understanding BI Publisher's Users, Roles, and Permissions

A user is assigned one or multiple Roles. A Role can grant any or all of the following:

You can create a hierarchy of roles by assigning roles to other roles. In this way the privileges and permissions of multiple roles can roll up to higher level roles. The following graphic shows an example of the hierarchy structure of User, Role, and Folder:

the picture is described in the document text

Options for Configuring Users and Roles

There are three options for setting up users and roles:

About Privileges to Use Functionality

BI Publisher provides a set of functional roles to grant access to specific functionality within the application. Assign these roles to users based on their need to perform the associated tasks. These roles cannot be updated or deleted.

The following table shows the privileges granted to each functional role:

Role Privileges
BI Publisher Excel Analyzer View
Export
History (public reports only)
Grants access to the Excel Analyzer
BI Publisher Online Analyzer View
Export
History (public reports only)
Grants access to the Online Analyzer
BI Publisher Scheduler View
Export
History
Schedule
BI Publisher Template Designer View
Export
History (public reports only)
Enables access to Layout Editor
Enables log on from Template Builder
BI Publisher Developer View
Export
Schedule
History
Edit Report
Enables access to Layout Editor
Enables log on from the Template Builder
Enables access to the Data Model Editor
BI Publisher Administrator Enables the privileges of all other roles
Grants access to the Administration page and all administration tasks

Roles assigned these privileges cannot perform any actions on objects in the catalog until they are also granted permissions on the catalog objects.

About Catalog Permissions

To perform the actions allowed by the functional roles above, a role must also be granted permissions to access the objects in the catalog.

Note that each of these permissions can be granted at the folder level to enable the operations on all items within a folder.

Permission Description
Read Enables a role to display an object in the catalog. If the object resides within a folder, a role must be granted the Read permission on the object and its parent Folder.
Write Enables a role to edit an object.
A role must be granted Write permissions on a folder to save objects to the folder or edit objects within the folder.
A role must also be granted one of the following roles to enable editing of the specified object:

  • Report - requires the BI Publisher Developer role

  • Data Model - requires the BI Publisher Developer role

  • Sub Template and Style Template - requires the BI Publisher Developer Role or the BI Publisher Template Designer Role

Delete Enables a role to delete an object.
Run Report Online Enables a role to run a report and view it in the report viewer.
Schedule Report Enables a role to schedule a report.
View Report Output Enables a role to access the Report Job History for a report.

It is important to note that for a report consumer to successfully run a report, his role must have read access to every object that is referenced by the report.

For example, a report consumer must run a report in a folder named Reports. The data model for this report, resides in a folder named Data Models. This report references a Sub Template stored in a folder named Sub Templates, and also references a Style Template stored in a folder named Style Templates. The report consumer's role must be granted Read access to all of these folders and the appropriate objects within.

How Functional Privileges and Permissions Work Together

It is important to understand the following rules regarding the behavior of privileges and permissions:

A Role Must Be Assigned Catalog Permissions

A role assigned a functional role cannot perform any actions in the catalog until catalog permissions are granted. Note that the functional roles themselves (BI Publisher Developer, BI Publisher Scheduler, and so on) cannot be directly assigned permissions in the catalog. The functional roles must first be assigned to a custom role and then the custom role is available in the catalog permissions table.

A Role Can Be Granted Catalog Permissions Only

The permissions available directly in the catalog enable running reports, scheduling reports, and viewing report output. Therefore if your enterprise includes report consumers who will have no other reason to access BI Publisher except to run and view reports, the roles for these users will consist of catalog permissions only.

Roles Already Assigned a Functional Role Will Inherit Some Permissions When Catalog Permissions Are Granted

If a role is already assigned one of the functional roles, when that role is granted permissions on a particular folder in the catalog, some permissions will be granted automatically based on the functional role.

For example, assume you create a role called Financial Report Developer. You assign this role the BI Publisher Developer role. In order for this role to create reports in the Financial Reports folder in the catalog, you must grant this role Read, Write, and Delete permissions on the folder. Because the BI Publisher Developer role includes run report, schedule report, and view report history privileges, these permissions will be automatically granted on any folder to which a role assigned the BI Publisher Developer role is granted Read access.

About Access to Data Sources

A role must be granted access to a data source to view reports that run against the data source or to build and edit data models that use the data source. Add access to data sources in the Roles and Permissions page. See Granting Data Access.

Configuring Users, Roles, and Data Access

Creating Roles

To create a new role in BI Publisher:

  1. Navigate to the BI Publisher Administration page.

  2. Under Security Center, click Roles and Permissions.

  3. Click Create Role.

  4. Enter a Name for the role and optionally, enter a Description.

  5. Click Apply.

  6. Click Assign Roles to assign roles to the user.

  7. Use the shuttle buttons to move Available Roles to Assigned Roles. Click Apply.

  8. To add a role to a role, click Add Roles.

  9. Use the shuttle buttons to move Available Roles to Included Roles. Click Apply.

To add data sources to a role, see Granting Data Access.

Creating Users and Assigning Roles to a User

To create a new user in BI Publisher:

  1. Navigate to the BI Publisher Administration page.

  2. Under Security Center, click Users.

  3. Click Create User.

  4. Add the User Name and Password for the user.

  5. Click Apply.

  6. Click Assign Roles to assign roles to the user.

  7. Use the shuttle buttons to move Available Roles to Assigned Roles. Click Apply.

Granting Catalog Permissions

For a role to access an object in the catalog, the role must be granted Read permissions on both the object and the folder in which the object resides. Permissions can be granted at the folder level and applied to all the objects and subfolders it contains, or applied to individual objects.

To grant catalog permissions to a role:

  1. Navigate to the Catalog.

  2. Locate the folder or object on which you wish to grant permissions and click More. From the menu, select Permissions. Alternatively, you can select the folder and click Permissions in the Tasks region.

    Note: Permissions cannot be granted on the root Shared folder.

    the picture is described in the document text

  3. On the Permissions dialog, click Create.

    the picture is described in the document text

  4. On the Add Roles dialog, enter a search string to find a role, or simply click Search to display all roles. Use the shuttle buttons to move roles from the Available Roles list to the Selected Roles list.

    the picture is described in the document text

  5. When finished, click OK to return to the Permissions dialog.

  6. On the Permissions dialog, configure the permissions required by the role.

    the picture is described in the document text

    Note the following:

  7. If you are granting permissions on a Folder, select Apply permissions to items within this folder, if the permissions should apply to all objects.

Granting Data Access

A role must be granted access to a data source if the role must:

To grant a role access to a data source:

  1. Navigate to the BI Publisher Administration page.

  2. Under Security Center, click Roles and Permissions.

  3. On the Roles and Permissions page, locate the role, then click Add Data Sources.

  4. On the Add Data Sources page you will see a region for each of the following types of data sources:

  5. Use the shuttle buttons to move the required data sources from the Available Data Sources list to the Allowed Data Sources list.

  6. When finished, click Apply.

Security and Catalog Organization

Because permissions are granted in the catalog, it is very important to be aware of this design when creating roles for your organization and when structuring the catalog.

For example, assume your organization requires the following roles:

Example Role Requirements
Role Required Permissions
Sales Report Consumer Needs to view and schedule Sales department reports.
Financial Report Consumer Needs to view and schedule Financial department reports. Needs access to the Excel Analyzer.
Executive Report Consumer Needs to consume both Sales and Financial reports as well as executive level reports.
Sales Report Developer Needs to create data models and reports for Sales department only.
Financials Report Developer Needs to create data models and reports for Financials department only. Will need to create some reports using the Excel Analyzer.
Layout Designer Needs to design report layouts for all reports.

You may consider setting up the catalog as follows:

Example Catalog Setup
Folder Contents
Sales Reports All reports for Sales Report Consumer. Also contains any Sub Templates and Style Templates associated with Sales reports.
Sales Data Models All data models for Sales reports.
Financials Reports All reports for Financials Report Consumer. Also contains any Sub Templates and Style Templates associated with Financials reports.
Financials Data Models All data models for Financials reports
Executive Reports All executive-level reports and data models.

Set up the roles as follows:

Example Role Configuration

Sales Report Consumer:

Grant catalog permissions:

Grant Data Access:

On the Roles page, locate the role, then click Add Data Sources. Add all data sources used by Sales reports.

Financials Report Consumer

Assign Roles:

On the Roles tab assign the Financials Report Consumer the BI Publisher Excel Analyzer role.

Grant catalog permissions:

Grant Data Access:

On the Roles page, locate the role, then click Add Data Sources. Add all data sources used by Financials reports.

Executive Report Consumer

Assign Roles:

On the Roles tab, assign the Executive Report Consumer the Sales Report Consumer and the Financials Report Consumer roles.

Grant catalog permissions:

Grant Data Access:

On the Roles tab, locate the role, then click Add Data Sources. Add all data sources used by Executive reports.

Sales Report Developer

Assign Roles:

On the Roles tab, assign the Sales Report Developer the BI Publisher Developer Role and the BI Publisher Template Designer Role.

Grant Data Access:

On the Roles tab, locate the Sales Report Developer and click Add Data Sources. Add all data sources from which Sales data models will be built.

Grant Catalog Permissions:

Financials Report Developer

Assign Roles:

On the Roles tab, assign the Financials Report Developer the BI Publisher Developer Role, the BI Publisher Excel Analyzer Role, and the BI Publisher Template Designer Role.

Grant Data Access:

On the Roles tab, locate the Financials Report Developer and click Add Data Sources. Add all data sources from which Financials data models will be built.

Grant Catalog Permissions:

Layout Designer

Assign Roles:

On the Roles tab, assign the Layout Designer the BI Publisher Template Designer Role and the BI Publisher Developer Role.

Grant Catalog Permissions:

Configuring BI Publisher to Use an External LDAP Provider

BI Publisher can be integrated with your LDAP provider to manage users and report access. Create the users and roles within your LDAP server, then configure the BI Publisher server to access your LDAP server.

In the BI Publisher security center module, assign folders to those roles. When a user logs into the server they will have access to those folders and reports assigned to the LDAP roles.

Integrating the BI Publisher server with Oracle LDAP consists of three main tasks:

  1. Set up users and roles in your LDAP provider

  2. Configure BI Publisher to recognize your LDAP server

  3. Assign catalog permissions and data access to roles

For information on supported LDAP servers, see System Requirements and Certification for the most up-to-date information on supported hardware and software.

Using the Client Application

The following steps must be performed in your LDAP provider. See the documentation for your provider for details on how to perform these tasks.

Set Up Users and Roles

  1. In the Domain root node of your LDAP provider, create the following roles to integrate with BI Publisher. See Understanding Users and Roles for full descriptions of the required functional roles.

  2. Create other functional roles as required by your implementation (for example: HR Manager, Warehouse Clerk, or Sales Manager), and assign the appropriate BI Publisher functional roles.

  3. Assign roles to users.

    Important: Ensure to assign at least one user the XMLP_ADMIN role.

Configure the BI Publisher Server to Recognize Your LDAP Server

To configure the BI Publisher server to recognize your LDAP server, update the Security properties in the BI Publisher Administration page as follows:

  1. On the Administration page, under Security Center click Security Configuration.

  2. Create a Local Superuser.

    Enter a Superuser Name and Password and select Enable Local Superuser check box. Enabling a local superuser will ensure that you can access the Administration page of BI Publisher in case of security model configuration errors.

  3. Scroll down to the Security Model region. Select LDAP for the Security Model.

  4. Enter the following:

  5. Restart the BI Publisher server.

The following figure shows a sample of the LDAP security model entry fields from the Security Configuration page:

the picture is described in the document text

Note that if you are configuring BI Publisher to use LDAP over SSL, you must also configure Java keystore to add the server certificate to JVM. For more information, see Configuring BI Publisher for Secure Socket Layer (SSL) Communication.

Assign Data Access and Catalog Permissions to Roles

  1. Log in to BI Publisher as a user assigned the XMLP_ADMIN role in your LDAP provider.

  2. On the Administration page click Roles and Permissions.

    You will see the roles you created in your LDAP provider to which you assigned the XMLP_ roles. Note the following:

  3. Click Add Data Sources to add BI Publisher data sources to the role. A role must be assigned access to a data source to run reports from that data source or to build data models from the data source. For more information see Granting Data Access.

  4. Grant catalog permissions to roles. See About Catalog Permissions and Granting Catalog Permissions for details on granting catalog permissions to roles.

Users can now log in using their LDAP username/password.

Integrating with Microsoft Active Directory

Microsoft Active Directory supports the LDAP interface and therefore can be configured with BI Publisher using LDAP Security.

Active Directory Configuration

  1. Add users that will need access to BI Publisher.

    Add the users under "Users" or any other organization unit in the Domain Root.

  2. Add the BI Publisher system groups. The Scope of the groups must be Domain Local.

    The following must be added as BI Publisher system groups:

  3. Grant BI Publisher system roles to global groups or users.

    You can grant BI Publisher system roles directly to users or through global groups.

Example 1: Grant Users the BI Publisher Administrator Role

  1. Under the Active Directory User and Computers, open the XMLP_ADMIN group and click the Members tab.

  2. Click Add to add users who need to BI Publisher Administrator privileges.

Example 2: Grant Users Access to Scheduling Reports

The "HR Manager" global group is defined under "Users".

All users in this group need to schedule reports.

To achieve this, add "HR Manager" as a Member of the XMLP_SCHEDULER group.

BI Publisher Configuration

  1. On the Administration page, click Security Configuration.

  2. Set up a Local Superuser if one has not already been configured. This is very important in case the security configuration fails, you will still be able to log in to BI Publisher using the Superuser credentials.

  3. In the Security Model region of the page, select LDAP from the Security Model list.

  4. Enter the details for the Active Directory server. Note the following:

    The following figure shows an example configuration:

    the picture is described in the document text

  5. Restart the BI Publisher application.

Note that if you are configuring BI Publisher to use LDAP over SSL, you must also configure Java keystore to add the server certificate to JVM. For more information, see Configuring BI Publisher for Secure Socket Layer (SSL) Communication.

Logging In to BI Publisher Using the Active Directory Credentials

The User logon name defined in Active Directory Users and Computers >User Properties >Account is used for the BI Publisher login name. Add the Domain to the user name to login to BI Publisher. For example: scott_tiger@domainname.com.

Note that 'sAMAccountName' or 'cn' can be used instead of 'userPrincipalName' in attribute used for RDN. If you use 'CN', then the login name for the preceding example would be: scott_tiger. You must set 'sAMAccountName' when the User login name defined for pre-Windows 2000 is required to use for BI Publisher login username. User names must be unique across all organization units and "Users" in the same domain with the use of 'cn' or 'sAMAccountName' is not recommended.

Assign Data Access and Catalog Permissions to Roles

  1. Log in to BI Publisher as a user assigned the XMLP_ADMIN role Active Directory.

  2. On the Administration page click Roles and Permissions.

    You will see the roles you created in Active Directory to which you assigned the XMLP_ roles. Note the following:

  3. Click Add Data Sources to add BI Publisher data sources to the role. A role must be assigned access to a data source to run reports from that data source or to build data models from the data source. For more information see Granting Data Access.

  4. Grant catalog permissions to roles. See About Catalog Permissions and Granting Catalog Permissions for details on granting catalog permissions to roles.

Configuring Single Sign-On

Integrating a single sign-on (SSO) solution enables a user to log on (sign-on) and be authenticated once per browser session. Thereafter, the authenticated user is given access to system components or resources according to the permissions and privileges granted to that user. Oracle BI Publisher can be configured to trust incoming HTTP requests already authenticated by a SSO solution that is configured for use with Oracle Fusion Middleware and Oracle WebLogic Server.

When BI Publisher is configured to use SSO authentication, it accepts authenticated users from whatever SSO solution Oracle Fusion Middleware is configured to use. If SSO is not enabled, then BI Publisher challenges each user for authentication credentials. When BI Publisher is configured to use SSO, a user is first redirected to the SSO solution's login page for authentication.

Configuring BI Publisher to work with SSO authentication requires minimally that the following be done:

See "Configuring Single Sign-On in Oracle Fusion Middleware" in Oracle Fusion Middleware Applications Security Guide.

Once you have configured your Single-Sign-On provider to protect Oracle BI Publisher, configure BI Publisher to trust incoming messages.

On the Administration page, under Security Center, click Security Configuration.

In the Single Sign-On region, select the User Single Sign-On check box.

Enter the fields appropriate for you your SSO provider.

Configuring BI Publisher to Use Oracle Access Manager (OAM) Single Sign-On

BI Publisher can be configured to use Oracle Access Manager as your SSO provider.

Required components:

Directly after BI Publisher is installed, the embedded LDAP server in Oracle WebLogic Server is the default authentication source (identity store). The BI WebLogic domain must be configured to the new identity store, Oracle Internet Directory, as the main authentication source.

For more information about creating a new default authenticator in Oracle WebLogic Server, see the following Oracle Fusion Middleware guides:

After Oracle WebLogic Server has been configured, perform the following in BI Publisher:

Note: The is procedure assumes that you have the Single Sign-Off URL. If you do not know the Single-Sign-Off URL, consult the Oracle Access Manager administrator at your site.

  1. On the Administration page, under Security Center, click Security Configuration.

  2. If you have not already done so, set up a Local Superuser. The Superuser credentials will enable you to log in to the BI Publisher Administration page in case of errors in the security configuration.

  3. In the Single Sign-On region, select the User Single Sign-On check box.

  4. Enter the following:

A sample configuration is shown in the following figure:

the picture is described in the document text

Setting Up Oracle Single Sign-On

To set up Oracle Single Sign-On, first configure WebLogic Server using the instructions in the chapter, "Configuring Single Sign-On in Oracle Fusion Middleware" in the Oracle Fusion Middleware Application Security Guide 11g. BI Publisher must be configured to use Oracle Internet Directory as the default LDAP server

IMPORTANT: When using Oracle SSO, BI Publisher assumes that a login username can be derived from Osso-User-Dn, which is HTTP Header value. For example, if your Osso-User-Dn on HTTP Header looks like this:

cn=admin,cn=users, dc=us,dc=oracle,dc=com

Then BI Publisher assumes the value of first cn= is the login username (that is, "admin" in this case).

Therefore if your Osso-User-Dn does not contain a login username as the first cn value, then select "Other SSO Type" to configure your settings (even if you use Oracle SSO).

Setup Procedure

  1. Modify the application server configuration file to protect the xmlpserver. See the topic "Configuring mod_osso to Protect Web Resources" in the Oracle Fusion Middleware Application Security Guide 11g

  2. In the mod_osso.conf add a new "Location" directive as follows:

    <!-- Protect xmlpserver -->
<Location /xmlpserver>
      require valid-user
      AuthType Basic
</Location>

  3. To allow Web service communication between BI Publisher and its client components (the Template Builder and the Excel Analyzer) you must make additional modifications to the mod_osso.conf file. To open up the xmlpserver to allow these Web services, enter the following directives: 

    <Location /xmlpserver/services/>
  require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

<Location /xmlpserver/report_service/>
  require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

Location /xmlpserver/ReportTemplateService.xls/>
  require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

  4. For integration with Oracle BI Presentation Services, you must disable SSO for Web services between the BI Presentation Services server and the BI Publisher server. If you made this entry when performing the previous step, you do not need to repeat this setup.

    To open up the xmlpserver to allow the Web service, enter the following directive in the mod_osso.conf file:

    <Location /xmlpserver/services/>
 require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

    A sample mod_osso.conf file with the entries discussed in this section is shown below:

    LoadModule osso_module libexec/mod_osso.so
 
 <IfModule mod_osso.c>
     OssoIpCheck off
     OssoIdleTimeout off
     OssoConfigFile /home/as1013/ohome/Apache/Apache/conf/osso/osso.conf
 
   <Location /xmlpserver>
     require valid-user
     AuthType Basic
   </Location>
 
 
<Location /xmlpserver/services/>
  require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

<Location /xmlpserver/report_service/>
  require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

Location /xmlpserver/ReportTemplateService.xls/>
  require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

<Location /xmlpserver/Guest/>
 require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>
 #
 # Insert Protected Resources: (see Notes below for how to protect resources)
 #
 
 
 #______-
 #
 # Notes
 #
 #______-
 #
 # 1. Here's what you need to add to protect a resource,
 #    e.g. <ApacheServerRoot>/htdocs/private:
 #
 #      <Location /private>
 #      require valid-user
 #      AuthType Basic
 #      </Location>
 #
 </IfModule>
 
 #
 # If you would like to have short hostnames redirected to
 # fully qualified hostnames to allow clients that need 
 # authentication via mod_osso to be able to enter short
 # hostnames into their browsers uncomment out the following
 # lines
 #
 #PerlModule Apache::ShortHostnameRedirect
 #PerlHeaderParserHandler Apache::ShortHostnameRedirect

  5. Restart the HTTP server.

  6. In the BI Publisher: Set up the Single Sign-Off URL on the BI Publisher Security Configuration page.

    From the Administration page, click Security Configuration. Enter the following in the Oracle Single Sign-On region:

  7. Create a BI Publisher Local Superuser to ensure access to BI Publisher regardless of your selected security configuration. See Enabling a Local Superuser for more information.

  8. Restart the application through the Oracle Fusion Middleware Control page.

  9. Enter the URL to access the BI Publisher Enterprise application, and you will be redirected to the SSO login page.

Contents   |   Previous   |   Top of Page   |   Next

Oracle Logo
Copyright © 2004, 2010, Oracle and/or its affiliates. All rights reserved.