13 Managing Objects in the Oracle BI Presentation Catalog

This chapter provides information about using the Oracle BI Presentation Catalog in Oracle Business Intelligence Enterprise Edition to store and managing business intelligence objects. It describes how to search for objects, work with favorites, assign permissions to objects, assign or take ownership of objects, and archive objects.

This chapter includes the following sections:

• "What is the Oracle BI Presentation Catalog?"

• "Who Uses the Catalog?"

• "How Will Hidden Dashboards Created in Previous Versions be Upgraded?"

• "Saving Business Intelligence Objects"

• "How Can I Search for Objects?"

• "Searching for Objects in the Catalog"

• "What Results are Returned from a Full-Text Catalog Search?"

• "Object-Specific Tasks"

• "What Are Favorites?"

• "Adding Objects to Favorites"

• "Accessing Favorite Objects"

• "Organizing Favorites"

• "Removing Objects From Favorites"

• "Exporting Analyses, KPIs, and Analysis Prompts Data"

• "Accessing Properties"

• "Levels of Oracle BI EE Security"

• "What Are Permissions?"

• "How Are an Object's Permission Assigned?"

• "Access Control Lists and Permissions"

• "Permission Definitions"

• "Permissions Available by Object Type"

• "Recommendations for Setting Permissions"

• "Assigning Permissions"

• "Who Owns an Object?"

• "Assigning Ownership of Objects"

• "Taking Ownership of Objects"

• "What is Archiving?"

• "Archiving Objects"

What is the Oracle BI Presentation Catalog?

The Oracle BI Presentation Catalog (the catalog) stores business intelligence objects and provides an interface where users create, access, and manage objects, and perform specific object-based tasks (for example, export, print, and edit). The catalog is organized into folders that are either shared or personal.

If Oracle BI EE is integrated with other Oracle applications, then the objects that are created within those applications are also stored within the catalog. For example, if Oracle BI Publisher is integrated with Oracle BI EE, data models, reports, and style templates and sub-templates are also stored in and accessible from the catalog.

Many of the operations that you can perform in the Oracle BI Presentation Catalog can also be performed in the Catalog Manager, which resides outside of Oracle BI Presentation Services. For more information, see "Working with Objects in Catalog Manager" in Oracle Fusion Middleware System Administrator's Guide for Oracle Business Intelligence Enterprise Edition.

Who Uses the Catalog?

Within Oracle BI EE, there are three primary users: content consumers, content designers, and catalog administrators. Each user performs different tasks within the catalog, and, therefore, each user sees a different version of the catalog interface. Functionality that is available for one user might not be available for another. Furthermore, the catalog functionality and objects that are available to a user depend upon the privileges that are specified by the Presentation Services Administrator and the object's individual permissions, which are usually set by the content designer.

Content consumers can use the Catalog page to view the business intelligence objects that are necessary to perform their day-to-day tasks. For example, a sales manager must access an analysis that monitors the weekly sales of a specific brand of beverage in the Central and Eastern regions. The permissions that are set by the content designer and catalog administrator determine what tasks the content consumers can perform both on an individual piece of content and within the catalog. For example, content consumers at Company A can search for, view, and interact with only those objects that have been assigned to them, but content consumers at Company B can search for and interact with content as well as create content and store it to their personal folders.

Content designers are the individuals who create the content for the content consumers. Content designers need broader access to the catalog to efficiently create, edit, test, and troubleshoot objects. Their access to the catalog's functionality is more comprehensive than that of the content consumers. However, like the content consumer, the content designer's permissions are set by the administrator. For example, a content designer must store content in and retrieve content from the public folders for the Sales functional area, but not the Operations functional area. Or a content designer must be assigned to several groups so that the content designer can sign in to Presentation Services as different users to test the new or revised content.

Administrators need the most comprehensive access to the catalog; however, their access is still determined by the privileges that are assigned to their role by the Presentation Services administrator. In general, the catalog tasks that the administrator performs include setting permissions on catalog objects and folders, archiving the catalog, creating and managing directory structures, and managing system and user data.

Note:

Over time, inconsistencies can develop in the catalog as links are broken, users are deleted, or NFS file system issues are encountered. You can periodically validate the catalog, to be informed of and to take corrective action on inconsistencies. For information on validation, see "Validating the Catalog" in Oracle Fusion Middleware System Administrator's Guide for Oracle Business Intelligence Enterprise Edition.

How Will Hidden Dashboards Created in Previous Versions be Upgraded?

In previous versions of Oracle BI EE (prior to 11g), you could specify that a dashboard be hidden. For information about how hidden dashboards are handled when upgrading to Oracle Business Intelligence Enterprise Edition 11g, see "Upgrading Hidden Dashboards" in Oracle Fusion Middleware Upgrade Guide for Oracle Business Intelligence.

Saving Business Intelligence Objects

You can save objects that you create in folders in the catalog. For complete information on naming conventions, see "Guidelines for Object Names" in Oracle Fusion Middleware System Administrator's Guide for Oracle Business Intelligence Enterprise Edition.

Use the following procedure to save objects to the catalog:

To save an object to the catalog:

1. Create or edit a business intelligence object and click Save or Save As from the editor's toolbar. The Save As dialog is displayed.

2. Select the catalog location to which you want to save the object. Note the following items:

   • You can create sub-folders for storage within your My Folders folder or within the system folder for which you have the permissions to modify.

   • Oracle BI EE enables you to save any type of business intelligence object to any location within the catalog. However, for some object types, Oracle BI EE's Save As dialog suggests the best catalog location. For example, if you are creating a named filter, then it should be saved to a subject area folder (/My Folders/Subject Area Contents/Paint) so that it is available when you create an analysis using the same subject area and to which you want to add the saved filter.

   • You can save the following objects to any location within the catalog: actions, agents, analyses, BI Publisher objects, briefing books, conditions, KPIs, and prompts.

   • Oracle recommends that you save the following objects to the subject area folder: calculated items, custom groups, and filters. If a subject area folder does not exist in your /My Folders folder or within the /Shared Folders folder, then Oracle BI EE creates a subject area folder and the Save As dialog defaults a save path to /My Folders/Subject Area Contents/<subject area>. Saving these objects to the subject area folders ensures that they are available when you build an analysis for the same subject area.

   • Dashboards can be saved to any catalog location. However, if you want the dashboard to display in the global header's Dashboards menu, then you must save the dashboard to a first level dashboard folder. For example, save the dashboard to the following location to include the dashboard in the Dashboard menu: /Shared Folders/Sales Projections/Dashboards. Save the dashboard to the following location to exclude the dashboard from the Dashboard menu: /Shared Folders/Sales Projections/Dashboards/Design Time. For more information about saving dashboards, see "Saving Dashboards by Other Names and in Other Locations."

3. Click OK.

Use the following procedure to create a sub-folder within your My Folders or, if you have the required permissions, to create a sub-folder.

To create a folder or sub-folder:

1. On the "Catalog page," go to the desired location in the "Folders pane."

2. In the catalog toolbar, click New and select Folder. The New Folder dialog is displayed.

3. Enter the folder name and click OK.

How Can I Search for Objects?

Depending upon how your system has been configured, you will use either the basic catalog search or the full-text catalog search to find objects in the Oracle BI Presentation Catalog. Note the following information:

• Basic catalog search — This is the standard search option. This search type allows you to search for an object by its exact name, description, location, and object type only. For more information, see "Basic Catalog Search."

• Full-Text catalog search — This search option must be configured by your administrator. This search type allows you to search for an object by exact name, description, location, object type, object attribute, data column name, and data column values. For more information, see "Full-Text Catalog Search."

Basic Catalog Search

The basic catalog search, which is the standard search delivered with Oracle BI Enterprise Edition, enables users with the proper privilege to search for objects from the global header, home page, or the Catalog page. In the Catalog page, you can use the basic catalog search to locate an object by searching for its exact name, description, location, and type, only. You find only those objects for which you have the appropriate permissions. When the desired object is located, you can click it to display it for viewing or editing, as your permissions allow.

Full-Text Catalog Search

Full-text catalog search enables users with the proper privilege to conduct an expanded search for an object. This expanded search functionality is only available if your administrator configured Oracle BI Enterprise Edition to use Oracle Secure Enterprise Search or Oracle Endeca Server. When configured, the full-text catalog search, like the basic catalog search, is available from the global header, home page Browse/Manage... area, or the Catalog page.

You can use the full-text search to find objects by entering various search values, such as name, description, author, and the names and values of columns of data that the object references. Only those objects to which you have the appropriate permissions are found. When the search is initiated and the desired object is located, you can click it to display it for viewing. Or, if Oracle BI EE is integrated with Oracle Endeca Server, you can use the attribute categories that display in the "Search pane" to browse the search results by attributes. For more information about search attributes, see "What Results are Returned from a Full-Text Catalog Search?"

You can search for nearly all types of objects in the Oracle BI Presentation Catalog, with a few exceptions such as Marketing Segmentation objects and hierarchical columns. You can also search for attachments to objects, such as a PDF file that is included on a dashboard page. You can search for objects such as dashboard prompts that are saved within other objects.

Searching for Objects in the Catalog

Depending upon how your system is configured, you will use the basic search or the full-text search fields to quickly find an object within the catalog. For more information, see "How Can I Search for Objects?"

Note that for the full-text search, a newly created object that is included in the index cannot be located until a crawl of the catalog has occurred. See "Creating the Data Source for Full-Text Catalog Search" in Oracle Fusion Middleware System Administrator's Guide for Oracle Business Intelligence Enterprise Edition for information.

To search for objects from the global header:

You can use the global header to quickly access objects by type and name or description from anywhere in Presentation Services.

1. In the global header's Search field, click the down arrow and select the object type for which you want to search.

2. Place your cursor in the field next to the Search field and enter part or all of the object's name or description.

3. Click the arrow button to begin the search. The Catalog page is displayed with the results that match your search criteria. For more information about how to search, see "Search pane."

To access objects through search shortcuts:

Use the Browse/Manage... pane located on the Home page to perform quick searches by object type, or to access the Catalog page. Go to the Home page and perform one of the following actions.

• Go to the Browse/Manage.... pane, click the link that corresponds to the object for which you want to search. When you click one of these links, Oracle BI EE searches your My Folders location for the specified object type. For example, click My Scorecards to access a list of all of the Scorecard objects located in your My Folders location. After you click a link, the Catalog page displays and contains the results of your search, as well as defaults the pre-defined search's criteria into the Search fields.

• The All Content link contains two options. For the basic search, click Browse Oracle BI Presentation Catalog to access the Catalog page showing the Folders pane. From this pane you can expand folders to browse for a specific object. For the basic search and the fully integrated full-text search, click Search Oracle BI Presentation Catalog to access the Catalog page showing the Search Pane where you can specify your search criteria.

Use the Catalog page's functionality to provide search criteria. This searching method is useful when you know the object's name, location, or type. Use the following task for the basic search and the fully integrated full-text search.

To search the catalog from the Catalog page:

Use this task to search the catalog.

1. In the global header, click Catalog. The "Catalog page" is displayed.

2. Click the Search button to display the Search pane.

3. In the "Search pane," specify the search criteria. Consider the following options:

   • Search: All objects and folders whose names contain the letters that you enter are displayed. For more information about how to search, see "Search pane."

   • Location: This option is only available for the basic search. Select the folders to search. Administrators and users with administrative permissions can search the catalog root folder. However, before you can search the root folder, you must be in Admin View.

   • Type: This option is only available for the basic search. Select the kind of object for which you are searching (for example, KPI, Scorecard, or Filter).

   Note:

   To search for Hidden Items, you must select the Show Hidden Items box, which is located on the Catalog page's header.

4. Click Search.

   Folders or objects that satisfy the search criteria are displayed in the "Catalog area." If Oracle BI Enterprise Edition is configured to use Oracle Endeca Server, then the "Search pane" will display attribute categories such as location, object type, author, and so on. You can select attribute values to filter the search results.

What Results are Returned from a Full-Text Catalog Search?

When you use the full-text catalog search, it locates those objects that have been crawled and indexed and for which you have the appropriate permissions. To prohibit an object from being indexed, make the appropriate setting in the object's "Properties dialog."

The list of full-text search results includes any objects that match the criteria, for which you have at least the "Open" permission. If an object is stored in a folder, then you must have the "Traverse" folder and "Open" object permissions. Note that objects with the "No Access" permission are not available.

Results for Oracle Secure Enterprise Search Integration

For full-text searches using the Oracle Secure Enterprise Search integration, the string that you are searching for is displayed in a highlighted manner, such as bold font or a colored background. In some cases, you might not see the string in the list of results. This happens when the string is used by the object but is not part of its object name or path name. The string is included in the definition of an object, such as in the columns that are specified as part of the analysis.

For example, suppose that the Oracle BI Presentation Catalog contains an analysis that uses a dashboard prompt that accepts Central Region as a value. Suppose you search for "Central" with the full-text catalog search. The returned list includes the analysis that uses the prompt that accepts Central Region as a value. If you click that analysis in the list, then you see that analysis open so that it is filtered by Central Region using the prompt, because that is what you searched for.

Results for Oracle Endeca Server Integration

For full-text searches using the Oracle Endeca Server integration, your search results display in the catalog area of the "Catalog page," and attribute categories for your search results display in the Search pane. Figure 13-1 shows an example of Oracle Endeca search results for Eden Inc. Note the attribute categories, which are Type, Author, Name, and Modification Date.

Figure 13-1 Full-Text Search Results

You can use the attributes categories to filter and browse your search results. Figure 13-2 shows the filtered search results for Eden Inc where the Type attribute value is "Analysis" and the Name attribute value is "Master Detail Events Linking." Note that the selected attribute values display in the Search Filters area of the "Search pane" and that you have the option of removing any or all filters from the filter criteria.

Figure 13-2 Full-Text Search Results Filtered by Attributes

Object-Specific Tasks

The tasks that you can perform for an object that you select from the "Catalog pane" are determined by both the selected object's type (for example, a dashboard or KPI) and the permissions that were set for the object. The list of available tasks is displayed in the "Tasks pane," which is located within the "Catalog page" or from the object's More link.

Figure 13-3 shows the available tasks for the analysis that was selected from the catalog. This graphic illustrates that the object's available tasks are: Open, Edit, Print, Export, Add to Briefing Book, Schedule, Delete, Copy, Rename, Add to Favorites, Create Shortcut, Archive, Properties, and Permissions.

Figure 13-3 Tasks Pane within the Catalog Page

In most cases, you can open or copy an object. However, if you selected an analysis, then you can create an agent for the analysis or export the analysis. If you selected a dashboard, then you can publish the dashboard or archive it, depending upon the permissions that were assigned to the object.

Note:

If you upgrade to a newer version of Oracle Business Intelligence and work with objects in the catalog, then you might notice that certain objects are not being accessed as quickly as in the previous release. This change can occur if objects were not upgraded properly. See "Updating Catalog Objects" in Oracle Fusion Middleware System Administrator's Guide for Oracle Business Intelligence Enterprise Edition for information on upgrading objects.

What Are Favorites?

The favorites functionality allows you to bookmark as favorites the catalog objects that you view regularly or want to view again at another time. After you flag objects as favorites, you can use the "Manage Favorites dialog" to organize your favorites by creating categories and rearrange your favorites into the order that you find most intuitive. You can access a list of the objects that you marked as favorites and any categories that you created by clicking Favorites in the global header.

You can use Oracle Business Intelligence Mobile to access your list of favorites as well as add objects to and remove objects from your favorites list. However, you cannot organize and manage your favorites from Oracle BI Mobile. Your Oracle BI EE desktop and Oracle BI Mobile favorites lists will synchronize your changes when you log into either Oracle BI EE instance. For more information about favorites in Oracle Business Intelligence Mobile, seeOracle Fusion Middleware User's Guide for Oracle Business Intelligence Mobile.

Adding Objects to Favorites

Use the following tasks to add an object to your favorites list. After you add an object to your favorites list, the object's icon is updated to include a gold star.

You can also use Oracle Business Intelligence Mobile to add objects to your favorites list. For more information about using favorites with Oracle Business Intelligence Mobile, see "What Are Favorites?" and Oracle Fusion Middleware User's Guide for Oracle Business Intelligence Mobile.

To add an object to your favorites list by using the Home page or Catalog page:

1. Go to the "Home page" or "Catalog page" and browse for the object that you want to add to your favorites list.

2. Click the More link, and then click Add to Favorites. The object is added to your favorites list.

To add an object to your favorites list while viewing or editing the object:

1. Open the object in its designated viewer or editor.

2. In the global header, hover over Favorites and click Add to Favorites. The object is added to your favorites list.

Accessing Favorite Objects

After you tag objects as favorites, you can use the Favorites menu in the global header to view your list of favorites and browse for and select a favorite object. For information about adding objects, see "Adding Objects to Favorites."

You can also use Oracle Business Intelligence Mobile to access your favorites list. For more information about using favorites with Oracle Business Intelligence Mobile, see "What Are Favorites?" and Oracle Fusion Middleware User's Guide for Oracle Business Intelligence Mobile.

To view your favorites list:

1. In the global header, hover over the Favorites menu. The list of the objects that you marked as favorites displays.

2. Scroll through the list of objects and categories to find a specific object. Click the object to select it.

   Oracle BI EE displays the selected object based on your permissions. For example, if you open an analysis to which you have write permission, then Oracle BI EE opens the object in the "Analysis editor."

Organizing Favorites

Use the following tasks to organize the items on your favorites list.

You can organize favorites from the Oracle BI EE desktop, only. Any changes that you make to your favorites list will synchronize to your Oracle Business Intelligence Mobile favorites list when you log in from the mobile device. For more information about using favorites with Oracle BI Mobile, see "What Are Favorites?" and Oracle Fusion Middleware User's Guide for Oracle Business Intelligence Mobile.

To create a favorites category:

1. In the global header, hover over the Favorites menu. The list of the objects that you marked as favorites displays.

2. Click Manage Favorites. The "Manage Favorites dialog" displays.

3. In the Category Tree or the Selection Category area, browse to and select the location where you want to add a new category.

4. On the toolbar, click New Category. The "New Category dialog" displays.

5. Enter a unique name for the category. Click OK.

6. The new category displays.

To rearrange your favorite objects:

1. In the global header, hover over the Favorites menu. The list of the objects that you marked as favorites displays.

2. Click Manage Favorites. The "Manage Favorites dialog" displays.

3. In the Category Tree or the Selection Category area, browse to the location of the categories or objects that you want to rearrange. You can perform the following actions to rearrange your favorites.

   • Select an object or category and click the move buttons to move the object up or down in your favorites list.

   • Drag and drop objects into categories. Drag and drop categories into other categories to nest them.

   • Copy objects or categories from one location and paste them into another location.

   • Rename categories.

   • Sort the selected categories or objects within a category by ascending or descending alphabetic order.

   For more information, see the "Manage Favorites dialog."

4. Click OK. Your rearranged objects and categories are saved and display in your favorites list.

Removing Objects From Favorites

Use the following tasks to remove an object from your favorites list. Note that if you have flagged an object as a favorite and you or someone else deletes that object from the Catalog, then the object will be removed from your favorites list.

You can also use Oracle Business Intelligence Mobile to remove objects from your favorites list. For more information about using favorites with Oracle Business Intelligence Mobile, see "What Are Favorites?" and Oracle Fusion Middleware User's Guide for Oracle Business Intelligence Mobile

After you remove an object from your favorites list, the object's icon changes from an icon with a gold star to the object's standard icon.

To remove an object from your favorites list by using the Home page or Catalog page:

1. Go to the "Home page" or "Catalog page" and browse for the object that you want to remove from your favorites list.

2. Click the More link, and then click Remove from Favorites. The object is removed from your favorites list.

To remove an object from your favorites list while viewing or editing the object:

1. Open the object in its designated viewer or editor.

2. In the global header, hover over the Favorites menu. The list of the objects that you marked as favorites displays.

3. Click Remove from Favorites. The object is removed from your favorites list.

To remove an object from your favorites list by using the Manage Favorites dialog:

1. In the global header, hover over the Favorites menu. The list of the objects that you marked as favorites displays.

2. Click Manage Favorites. The "Manage Favorites dialog" displays.

3. Browse for and select the object that you want to remove.

4. Click Delete.

5. Click OK. The object is removed from the list.

Exporting Analyses, KPIs, and Analysis Prompts Data

To leverage your data and use it in other applications, you can export analyses, KPIs, and analysis prompt values and data as a PDF, Web Archive, spreadsheet, Powerpoint presentation, and data file.

To export data:

1. In the global header, click Catalog. The "Catalog page" is displayed.

2. Search for the object to export. For more information about searching, see "Searching for Objects in the Catalog."

3. In the "Folders pane," select the object to export.

4. Select the object and perform a task:

   • Below the document, select More and then Export

   • Select the Export button in the "Tasks pane."

5. Select the format. Note that the Data list contains the CSV Format, Tab delimited Format, and XML Format options.

Note:

You can export Oracle Business Intelligence Publisher reports if they are embedded in a dashboard or dashboard page. See "Exporting Dashboards and Dashboard Pages" for additional information.

Accessing Properties

Administrative users can access the properties of any object or folder to perform tasks such as view system information or change access levels. Users can access and modify the properties of the objects that they create or own.

To access properties:

1. In the global header, click Catalog. The "Catalog page" is displayed.

2. Search for the object to which you want to assign properties. For more information about searching, see "Searching for Objects in the Catalog."

3. In the "Folders pane," select an object or folder.

4. Perform a task:

   • Below the document, select More and then Properties

   • Click the Properties button in the "Tasks pane."

5. Review or change the settings displayed in the "Properties dialog."

Levels of Oracle BI EE Security

Oracle BI EE supports security mechanisms that allow users to access only the data for which they are authorized. For specific information about setting up and maintaining security, see Oracle Fusion Middleware Security Guide for Oracle Business Intelligence Enterprise Edition. The following types of security are typical:

• Subject Area security. This security mechanism controls access to objects, such as subject areas, folders, and columns. For example, content designers in a particular department can view only the subject areas that belong to their department when using the Analysis editor.

• Catalog object security. This security mechanism provides security for objects that are stored in the Oracle BI Presentation Catalog, such as dashboards, dashboard pages, folders, and analyses. Users can view only the objects for which they are authorized. For example, a mid-level manager might not be granted access to a dashboard that contains summary information for an entire department. For more information about catalog object security, see "What Are Permissions?"

• Data level security. This security mechanism controls the type and amount of data that is available in analyses. When multiple users run the same analysis, the results that are returned to each user depend on their access rights and roles in the company. For example, a sales vice president sees results for all regions, while a sales representative for a particular region sees only data for that region.

The security mechanisms in Oracle Business Intelligence can use security hierarchies that are defined in operational applications, such as Siebel CRM applications, which minimizes the need for administrators to manage multiple security systems. The security mechanisms also allow a high degree of control over access to elements in Oracle Business Intelligence applications.

What Are Permissions?

An object's owner or a user who has been given the proper privileges and permissions can assign permissions to catalog objects. Permissions are authorizations that you grant to a user or role to perform a specific action or group of actions on a catalog object. For example, if you work in the sales department and created a dashboard that contains quarterly sales projections, then you can give read access to this dashboard to all sales people, but give read, write, and delete access to sales directors and vice presidents.

Permissions are a part of the Oracle BI EE security model, and how permissions are initially assigned is based on how users, roles, and groups were set up on your system, and which privileges the Oracle BI EE administrator granted those users, roles, and groups. For example, the administrator removes the BIAdministrator role from the Admin: Catalog, Change Permissions privilege. This removal means that no one included in the BIAdministrator group can change permissions for any catalog objects other than the objects that the individual users who are included in the BIAdministrator group create or own.

How Are an Object's Permission Assigned?

The permissions for a folder, Oracle BI Publisher object, or other objects are assigned by either the object owner, the content designer, or the catalog's administrator. Before someone other than the content designer can assign permissions to an object, that person must have been given ownership of the object, granted the Change Permissions privilege by the Presentation Services administrator, and have been given the Change Permissions object permission, which is listed in the "Custom Permissions dialog." For more information about setting the Change Permissions privileges, see "Managing Presentation Services Privileges" in Oracle Fusion Middleware Security Guide for Oracle Business Intelligence Enterprise Edition.

When the content designer creates an object and saves it to a folder, the object inherits the permissions that are set on the folder. After the object is saved, the content designer can display either the catalog's "Tasks pane" or the object's More... link, locate the object, access the "Permission dialog," and modify the object's permissions. If the object's Read-Only property, which is set on the "Properties dialog," is selected, then no one other than the owner can modify the object's permissions. This read-only setting essentially trumps any permissions that are set in the Permission dialog.

When working with an object, you use the Permissions dialog to assign who gets which object permissions in the following ways:

• To Application roles — This is the recommended way of assigning permissions. Application roles provide much easier maintenance of users and their assignments. An Application role defines a set of permissions granted to a user or group that has that role in the system's identity store. An Application role is assigned in accordance with specific conditions. As such, Application roles are granted dynamically based on the conditions present at the time authentication occurs.

  For information on Application roles, see Oracle Fusion Middleware Security Guide for Oracle Business Intelligence Enterprise Edition.

• To individual users — You can assign permissions and privileges to specific users, but such assignments can be more difficult to maintain and so this approach is not recommended.

• To Catalog groups — This approach is maintained for backward compatibility with previous releases (prior to 11g) only. For information about Catalog groups, see "Working with Catalog Groups" in Oracle Fusion Middleware Security Guide for Oracle Business Intelligence Enterprise Edition.

Access Control Lists and Permissions

Access control lists define the ability of an account to access a shared object in the Oracle BI Presentation Catalog. An account is an Application role, a Catalog group, or an individual user. Permissions describe the type of access to an object that an account is permitted. Examples are Open and Full Control.

Each catalog object has an access control list that defines which accounts have which permissions to access the object. The access control list is stored in the object's corresponding attribute (.atr) file. An access control list has the general form that is shown in Table 13-1.

Table 13-1 Access Control List for a Catalog Object

Account	Permission
ApplicationRole1	Open
ApplicationRole4	Full Control
ApplicationRole3	Open
User 4	Open
User 9	Full Control
User 11	Full Control

Permission Definitions

To control access to objects (such as a folder in the catalog or a section in a dashboard), you assign permissions to Application roles, Catalog groups, and users. The permissions that you can assign vary depending on the type of object with which you are working.

The permissions that are available from the "Permission dialog" are usually parent permissions, meaning that each parent permission contains several child permissions (for example, if the Open permission is applied to a folder, the users of that folder can read, traverse, and run Oracle BI Publisher reports located in that folder). Applying parent permissions, rather than building custom permissions for ever object, is an easy way to consistently assign and maintain permissions. The available parent permissions differ based on the object type with which you are working: folders, BI Publisher objects, or business intelligence objects. BI Publisher objects include reports, data models, sub templates, and style templates. Business intelligence objects include analyses, dashboards, KPIs, scorecards, filters, and prompts.

If in the "Permission dialog" you select the Custom permission, then the "Custom Permissions dialog" is displayed where you can select the permissions to apply to the object. For example, if you are working with a folder object, then you can select the traverse, read, and delete permissions.

Table 13-2 includes the name of each permissions and its definition. For more information about the parent permissions that you can assign to an object and what the parent permission includes based on the type of object with which you are working, see "Permissions Available by Object Type."

Table 13-2 Permission Descriptions

Permission	Description
Read	Use this option to give authority to access, but not modify, the object.
Write	Use this option to give authority to edit the object.
Delete	Use this option to give authority to delete the object.
Traverse	Use this option to give authority to access objects within the selected folder when the user does not have permission to the selected folder. Access to these objects is required when the objects in the folder, such as analyses, are embedded in a dashboard or WebCenter Portal application page that the user has permission to access. For example, if you grant users the Traverse permission to the /Shared Folders/Test folder, then they can access objects, through the Catalog or embedded in dashboards or WebCenter Portal application pages, stored in the/Shared Folders/Test folder and stored in sub-folders, such as the /Shared Folders/Test/Guest folder. However, users cannot access (meaning view, expand, or browse) the folder and sub-folders from the Catalog.
Run Publisher Report	Use this option to give authority to read, traverse the folder that contains the object, and regenerate the report so that it includes the most recent data.
Schedule Publisher Report	Use this option to give authority to read, traverse the folder that contains the object, and schedule the report.
View Publisher Report	Use this option to give authority to read, traverse the folder that contains the object, and view, but not regenerate, the report.
Execute	Use this option to give authority to run an object, such as an action, agent, or a briefing book.
Change Permissions	Use this option to give authority to change the object's permissions.
Set Ownership	Use this option to give authority to reassign ownership of the object.
Full Control	Use this option to give authority to perform all tasks (modify and delete, for example) on the object.
No Access	Use this option to deny access to the object. Explicitly denying access takes precedence over any other permission.
Modify	Use this option to give authority to read, write, and delete the object.
Open	Use this option to give authority to access, but not modify, the object. If you are working with an Oracle BI Publisher object, this option enables you to traverse the folder that contains the object.
Custom	Use this option to display the "Custom Permissions dialog," where you grant read, write, execute, and delete permissions.
Granted	Use this option to give authority to access a section in a dashboard. This permission can be set in the dashboard, only. This permission overrides any catalog permissions set on the section's objects that would prevent the corresponding roles, Catalog groups, and users from accessing them (for example, No Access). For more information, see "Changing the Properties of a Dashboard and its Pages."
Denied	Use this option to deny access to a section in a dashboard. This permission can be set in the dashboard, only. This permission overrides any catalog permissions set on the section's objects that would allow the corresponding roles, Catalog groups, and users to access them (for example, View). For more information, see "Changing the Properties of a Dashboard and its Pages."

Permissions Available by Object Type

The permissions that are available from the "Permission dialog" are usually parent permissions, meaning that each parent permission contains several child permissions. For example, if the Open permission is applied to a folder, then the users of that folder can read, traverse, and run the BI Publisher reports that are located in that folder. The available parent permissions differ based on the object with which you are working.

Table 13-3 includes a listing of the parent permissions and the corresponding child permissions by object type. For a description of each permission, see "Permission Definitions."

Table 13-3 Permissions by Object Type

Parent Permission	Folders	Oracle BI Publisher Objects	Objects
Full Control	Includes all permissions	Includes all permissions	Includes all permissions
Modify	Read, write, and delete	Read, write, and delete	Read, write, and delete
Open	Read, traverse, run BI Publisher report	Run Oracle BI Publisher report	Read
Schedule Oracle BI Publisher Reports	Schedule BI Publisher reports that are contained in the folder, read, and traverse	Schedule Oracle BI Publisher reports	Not available
View Oracle BI Publisher Output	View BI Publisher reports that are contained in the folder, read, and traverse	View Oracle BI Publisher reports	Not available
Traverse	Traverse folder	Not available	Not available
No Access	Object is not accessible	Object not accessible	Object not accessible

Recommendations for Setting Permissions

Follow these recommendations when setting permissions:

• Use care when assigning permissions to ensure that you do not lock the object by preventing you, an administrator, or any other user from modifying the object.

• Assign permissions through Application roles, even if you must assign permissions only for a single user. A less recommended alternative to using Application roles is to use Catalog groups, also known as Presentation Services groups. Application roles are central to Oracle BI EE while Catalog groups are specific to Presentation Services and are included in this release for backward compatibility.

  For information on Application roles, see Oracle Fusion Middleware Security Guide for Oracle Business Intelligence Enterprise Edition.

  For information on Catalog groups, see "Working with Catalog Groups" in Oracle Fusion Middleware Security Guide for Oracle Business Intelligence Enterprise Edition.

• For Application roles (Catalog groups or users, if necessary) that are going to be modifying the dashboards and dashboard content accessible to the role, set the permissions for the role to Full Control. While allowing change and delete control, Full Control also enables the specified role to set permissions and to delete the object, folder, or dashboard.

  If you plan to have numerous or varying users that create and modify dashboard content for a given group, then create a separate, corresponding "builder" role that has all the back-end permissions of the primary role, but with a different name. For example, you can create a Sales role and a SalesBuilder role. By giving the SalesBuilder role appropriate permissions to the Oracle BI Presentation Catalog, you can control and change who can make changes to dashboards and content. Assuming session variable security is in place, you can make a user a dashboard builder or content creator by changing the user's role from "Sales" to "SalesBuilder" in the database table that holds security information.

• For each Subject Area, ensure that the BIConsumer and AuthenticatedUser roles have No Access permission to the Subject Area folder.

• For roles that should be able to save analyses for public use against a given Subject Area, grant them Full Control to the Subject Area folder and everything it contains, and likewise for the Common folder.

• To ensure that only members of the designated roles have access to Oracle BI Presentation Catalog folders, folder content, and dashboards, do not set explicit permissions for the AuthenticatedUser role.

Tip:

To provide a place for all users within an Application role to share analyses with each other, create a folder under the Subject Area folder called, for example, Share or Publish, and give the entire role Change/Delete permission to just that folder.

Assigning Permissions

Permissions determine who can access folders, BI Publisher objects, or other catalog objects. The permissions that you can assign vary depending on the type of object with which you are working. To change permissions, you must have been granted the Change Permission privilege.

Note:

To access an object in the catalog, users must have appropriate ACL (Access Control List) entries for that object. All objects in the catalog except for alerts use ACL entries. See "Working with Objects in Catalog Manager" in Oracle Fusion Middleware System Administrator's Guide for Oracle Business Intelligence Enterprise Edition for information on ACL entries.

Use the following procedure to assign permissions to an object. For more information about permissions, see "Permission Definitions," "Permissions Available by Object Type," and "Recommendations for Setting Permissions."

To assign permissions to an object:

1. In the global header, click Catalog. The "Catalog page" is displayed.

2. Search for the object to which you want to assign permissions. For more information about searching, see "Searching for Objects in the Catalog."

3. Go to the "Catalog area" and locate an object or folder.

4. Select More and then Permissions, or go to the "Tasks pane" and click Permissions. The "Permission dialog" is displayed.

5. Click the Add users/roles button to access the "Add Application Roles, Catalog Groups, and Users dialog" to add any required accounts.

6. In the "Permissions dialog," click the Permissions list to select permissions. Most of the items that are displayed in the list are parent permissions and contain several child permissions. To build a specific list of permissions, click Custom. The "Custom Permissions dialog" is displayed.

7. Click OK.

Who Owns an Object?

Ownership of an object can either be granted by the user who created the object or taken by a user who has been granted the proper privileges. Note that the owner of an object or folder cannot automatically access the object or folder. To access an object, the user must have the proper permissions assigned in the object or folder's "Permission dialog."

By default, the user who creates and saves a catalog object to either My Folders or a Shared folder owns the object. An object in My Folders cannot be assigned to another owner unless the object is moved to a Shared folder and the Administrator assigns the privilege allowing the owner to reassign ownership. After this privilege has been granted, the ownership of the object can then be assigned to another user, group, or role that displays in the "Permission dialog." For example, suppose Employee A is a content designer and has created a dashboard for the Marketing department. Employee A completes the dashboard, saves it to the Marketing Department's Shared folder, and assigns ownership of the dashboard to Employee B, who is a marketing manager and responsible for updating the dashboard. For more information about assigning ownership, see "Assigning Ownership of Objects."

In some situations a user or member of a group or role must take ownership of objects located in a Shared folder. In this case, the user who wants to take ownership must be assigned the proper privilege to complete this task. After these privileges are granted, the user sees the "Take Ownership of this Item" and the "Take Ownership of this item and all subitems" options in the "Properties dialog." For example, suppose that Employee A has been granted the proper privilege to take ownership of objects and folders. When Employee B, who owns several catalog objects, leaves the company, Employee A can now access the "Properties dialog" for these objects, take ownership of the objects, and reassign ownership of the objects to Employee C. For more information about taking ownership, see "Taking Ownership of Objects."

Assigning Ownership of Objects

Use the following procedure to assign ownership of an object or folder that is saved to a Shared folder. You must have the proper privilege to access the "Permission dialog" where you can then assign ownership of an object or folder.

For more information, see "Who Owns an Object?" and "Taking Ownership of Objects."

To assign ownership of an object:

1. In the global header, click Catalog. The "Catalog page" is displayed.

2. Search for the object to which you want to assign ownership. For more information about searching, see "Searching for Objects in the Catalog."

3. Go to the "Catalog area" and locate an object or folder.

4. Select More and then Permissions, or go to the "Tasks pane" and click Permissions. The "Permission dialog" is displayed.

5. In the Permissions table, go to the Owner column and click to specify the owner.

6. Click OK.

Taking Ownership of Objects

Use the following procedure to take ownership of an object or folder that is saved to a Shared folder. You must have the proper privilege for the take ownership options to display in the "Properties dialog."

Note that the owner of an object or folder cannot automatically access the object or folder. To access an object, the user must have the proper permissions assigned in the object or folder's "Permission dialog." For more information, see "Who Owns an Object?" and "Assigning Ownership of Objects."

To take ownership of an object:

1. In the global header, click Catalog. The "Catalog page" is displayed.

2. Search for the object to which you want to assign ownership. For more information about searching, see "Searching for Objects in the Catalog."

3. Go to the "Catalog area" and locate an object or folder.

4. Select More and then Properties, or go to the "Tasks pane" and click Properties. The "Properties dialog" is displayed.

5. In the Ownership area, do one the following:

   • If you are working with an object, click the "Set Ownership of this item" link.

   • If you are working with a folder or an object that contains sub-objects (for example, a dashboard or scorecard), click the "Set Ownership of this item" link to take ownership of the object only, or click the "Set Ownership of this item and all subitems" to take ownership of the object and sub-objects.

6. Click OK.

What is Archiving?

Archiving enables you to bundle the entire catalog, specific folders, or multi-component objects (for example, scorecards) as a .catalog file and upload the .catalog file to unarchive the data to another location in the catalog. This process enables you to transfer specific data across environments. For example, you can use this feature to transfer data from a development environment to a production environment.

If you have the necessary privileges, then you can use the Oracle BI EE Catalog Manager to archive and unarchive catalog objects and perform other Catalog maintenance tasks. For more information about Catalog Manager, see "Working with Objects in Catalog Manager" in Oracle Fusion Middleware System Administrator's Guide for Oracle Business Intelligence Enterprise Edition.

Archiving Objects

Before you can archive, you must have been granted the proper privilege.

To create an archive file:

1. In the global header, click Catalog. The "Catalog page" is displayed.

2. Search for the objects to archive. For more information about searching, see "Searching for Objects in the Catalog."

3. Go to the "Folders pane" to select the object.

4. Select More, then Archive below the object. The "Archive dialog" is displayed.

5. Specify to maintain or omit the permissions and timestamps for the folder or object. For more information, see the "Archive dialog."

6. Click OK.

To unarchive an archive file:

1. Locate the archive file to upload. The archive file contains the.catalog extension (for example, _portal.catalog).

2. Go to the "Folders pane" and select the location where you want to upload the archive file.

3. Go to the Tasks pane and click Unarchive. The "Unarchive dialog" is displayed.

4. Enter the name of the archive file or browse for the archive file. Select the archive file.

5. Click OK.