17
Using Discoverer with Oracle Applications

Using Discoverer with Oracle Applications

This chapter explains how Discoverer supports access to Oracle Applications databases using Oracle Applications security and contains the following topics:

• "What are Oracle Applications?"

• "What are Oracle Applications responsibilities?"

• "What features does Discoverer support for Oracle Applications users?"

• "What are the prerequisites for using Discoverer with Oracle Applications?"

• "What is different about running Discoverer in Oracle Applications mode?"

• "How to configure the Connect dialog for Oracle Applications users"

• "How to create an Oracle Applications EUL"

• "How to grant task privileges to all Oracle Applications users via the Public user"

• "How to specify the Oracle Applications users/responsibilities who can access a business area"

• "How to specify the business areas that an Oracle Applications user/responsibility can access"

• "How to specify the tasks an Oracle Applications user or responsibility can perform"

• "How to specify the Oracle Applications users/responsibilities who can perform a specific task"

What are Oracle Applications?

Oracle Applications are Oracle's integrated enterprise resource planning (ERP) and customer relationship management (CRM) solutions. Oracle Applications enable companies to run and manage their worldwide operations from a central site. For further information see http://www.oracle.com/.

What are Oracle Applications responsibilities?

Oracle Applications responsibilities are akin to database roles. They are an abstraction to which privileges can be assigned and which can apply to many users. Oracle Applications responsibilities are used to control Oracle Applications users functional and data access.

An Oracle Applications user connects to an Oracle Applications database and chooses a single Oracle Applications responsibility. Each Oracle Applications responsibility can have a set of privileges associated with it.

This means that an Oracle Applications user will by default assume the task privileges granted to the chosen responsibility (for more information see "How to specify the Oracle Applications users/responsibilities who can perform a specific task"). To change responsibility but keep the same user you must reconnect.

What features does Discoverer support for Oracle Applications users?

Discoverer supports the following features for Oracle Applications:

• Ad-hoc query access to Oracle Applications databases using Oracle Applications user names, passwords and responsibilities

• Oracle Applications mode EULs

  An Oracle Applications mode EUL is a Discoverer End User Layer based on an Oracle Applications schema (containing the Oracle Applications FND (Foundation) tables and views). Oracle Applications EULs employ Oracle Applications user names and responsibilities whereas standard EULs use database users and roles.

  The only database user (i.e. non-Oracle Applications user) that can connect to an Oracle Applications mode EUL is the EUL owner. The EUL owner is the database user that is used to create the EUL. However, the EUL owner can grant administration privileges to Oracle Applications users. The authorized Oracle Applications users can then connect to the Oracle Applications mode EUL using Discoverer Administrator.

• Oracle Applications row level security

  Many Oracle Applications tables and views are user-sensitive, and will return different results depending on which user/responsibility is used to access these tables/views. Discoverer correctly runs queries that respect these user-sensitive tables and views.

• Oracle Applications multiple reporting currencies

  When connecting to Discoverer as an Oracle Applications user/responsibility, Discoverer will automatically connect to the correct schema (either APPS or APPS_MRC) to support Oracle Applications instances that have implemented the multiple reporting currencies feature.

• Oracle Applications multiple organizations

  Using Discoverer with Oracle Applications multiple organizations support enables you to work with data from more than one organization. Discoverer end users can query and analyze data from a set of organizations to which they have been granted access. The folders in the EUL you are connecting to must be based on Oracle Business Views (available in Oracle Applications 11i).

These features are only available when Discoverer is running in Oracle Applications mode. In other words, when Discoverer is running with an Oracle Applications mode EUL against an Oracle Applications database.

What are the prerequisites for using Discoverer with Oracle Applications?

To start Discoverer as an Oracle Applications user the following conditions must be met:

• Oracle Applications must be installed before Discoverer can be used in applications mode

• Discoverer must be running against one of the following Oracle Applications versions:
  • Release 10.7

  • Release 11

  • Release 11i

What is different about running Discoverer in Oracle Applications mode?

The following differences apply in Discoverer when running in Oracle Applications mode:

• "Differences with the Discoverer Connect dialog in Oracle Applications mode"

• "Differences with Discoverer security in Oracle Applications mode"

• "Differences with Discoverer summary folders in Oracle Applications mode"

• "Differences with Discoverer and secure views/language settings in Oracle Applications mode"

Differences with the Discoverer Connect dialog in Oracle Applications mode

When you run Discoverer in Oracle Applications mode the "Connect to Oracle9i Discoverer Administrator dialog (for Oracle Applications users)" will either display or not display the Oracle Applications user check box.

Figure 17-1 Connect to Oracle9i Discoverer Administrator dialog (for Oracle Applications users)

Text description of the illustration apconn.gif

For more information, see "How to configure the Connect dialog for Oracle Applications users".

The following conditions apply when the Connect dialog is configured for Oracle Applications users:

• if the Oracle Applications user check box is not displayed you connect to Discoverer as an Oracle Applications database user

• if the Oracle Applications user check box is displayed, you select the check box to connect to Discoverer as an Oracle Applications user. Alternatively, you may leave it unselected to connect as an Oracle database user.

Once you have entered details into the Connect dialog and clicked OK a Responsibilities dialog is displayed and you can choose the responsibility with which to connect (if the Oracle Applications user you are connecting with has more than one responsibility).

You can bypass the Choose a Responsibility dialog by entering both the Oracle Applications user and the responsibility into the Username field in the form 'user:responsibility'.

Figure 17-2 Choose a Responsibility dialog

Text description of the illustration apresch.gif

Differences with Discoverer security in Oracle Applications mode

When you run Discoverer Administrator as an Oracle Applications user, then the Discoverer Privileges and Security dialogs display Oracle Applications user names and responsibilities. You can assign privileges and security to Oracle Applications user names and responsibilities. When you run Discoverer Administrator as a database user then the Discoverer Privileges and Security dialogs display database users and database roles.

For more information about using privileges to control access to information, see Chapter 7, "About Discoverer and security".

Differences with Discoverer summary folders in Oracle Applications mode

As the Discoverer manager of an Oracle Applications mode EUL you must be aware of the following:

• Some Oracle Applications database views contain row level security and return differing result sets depending upon the currently active responsibility. This means that materialized views (summary tables in Oracle 8.1.5 databases or earlier) will contain different data depending on the responsibility of the user refreshing the external summary folder.

• A summary folder based on an Oracle Applications secure view or Oracle Applications business view must be registered in Discoverer as an external summary folder (for more information, see Chapter 15, "How to create summary folders based on external summary tables").

• Where an external summary folder is mapped against a table or view with Oracle Applications row level security, it is your responsibility as Discoverer manager to make sure the external table or view provides secure access. If you are not sure, ask your database administrator.

• If a managed summary folder is found that satisfies a query (based on data with Oracle Applications row level security), Discoverer informs the end user that no rows satisfy the query criteria. Discoverer does this to ensure that end users do not see data they should not have access to.

• If a managed summary folder is found that satisfies a query (based on data without Oracle Applications row level security), Discoverer returns the rows unaffected. Discoverer does this because the data can be safely accessed by all end users.

• Some Oracle Applications views with row-level security support "public" rows (particularly Human Resources).

Differences with Discoverer and secure views/language settings in Oracle Applications mode

When a Discoverer end user uses a workbook that accesses Oracle Applications secure views, the user might see different results on different machines (even when using the same connection information) if the machines have different local language (NLS) settings.

When using Oracle Applications secure views, the local language setting of the machine affects the data retrieved by Discoverer. Discoverer will display data consistently across machines with the same language setting.

To change a machines local language setting (on Windows NT), choose Start | Settings | Control Panel | Regional Settings and change the language value.

For more information on secure views, see Chapter 20, "How to use query prediction with secure views".

You can also define a language setting (NLS) for a user, responsibility, application or site using the Profiles setting in Oracle Applications. For more information see the Oracle Applications documentation.

How to configure the Connect dialog for Oracle Applications users

Before you connect to Oracle Discoverer as an Oracle Applications user, you must configure the Connect dialog to default to Oracle Applications users.

To configure the Connect dialog for Discoverer Administrator and Discoverer Desktop:

1. Select Tools | Options to display the "Options dialog: Connection tab":

   Figure 17-3 The Options dialog: Connection tab

   
   
   Text description of the illustration options.gif
2. Specify the type of EUL to connect to by selecting one of the following option:

   Option	Use this option to:
   Connect to standard EULs	The Oracle Applications User check box is not displayed in the Connect dialog and Discoverer expects standard database users.
   Connect to applications EULs	The Oracle Applications User check box is not displayed in the Connect dialog but Discoverer expects users to connect using an Applications user id/password and Oracle Applications database connect string.
   Connect to both standard and applications EULs	The Oracle Applications User check box is displayed in the Connect dialog and (depending on whether the check box is cleared or selected) you can connect to either standard or Oracle Applications database EULs.

Notes

• To configure the Connect dialog for Discoverer Desktop, repeat the steps described above for Discoverer Administrator, but within Discoverer Desktop.

• To configure the Connect dialog for Discoverer Plus and Viewer to validate Oracle Applications user names and passwords, see the Oracle9iAS Discoverer Configuration Guide.

About entering details into the fields GWYUID/Password and FNDNAM

When you use the Options dialog: Connections tab and you select either the Connect to applications EULs radio button or the Connect to both standard and applications EULs radio button you can enter values into these fields, but Discoverer uses default values if you do not. The fields and default values are as follows:

• Gateway User ID (GWYUID)/Password

  You can enter your Gateway User ID and Password here (the default value used is 'applsyspub/pub' if you enter nothing here).

• Foundation Name (FNDNAM)

  You can enter the Foundation Name (the default value used is 'apps' if you enter nothing here).

If you do not know the values to enter into the above fields contact your Oracle Applications database administrator.

How to create an Oracle Applications EUL

You create an Oracle Applications EUL in two ways:

• using the Create EUL dialog

• using the command line interface

To create an Oracle Applications EUL using the Create EUL dialog:

1. Start Discoverer Administrator and display the "Connect dialog".

2. Enter the user name, password and connect string for a DBA user.

   For example, dba/dbapassword@oracleappsdb.

   Note: You must not specify the user name of an Oracle Applications user. The EUL owner is always a database user.

   Figure 17-4 Connect to Oracle9i Discoverer Administrator dialog

   
   
   Text description of the illustration apcndba.gif -

   Note: The Oracle Applications user Connect dialog may display the Oracle Applications User check box. For more information see "How to configure the Connect dialog for Oracle Applications users".

3. Clear the Oracle Applications User check box.

4. Click Connect.

5. If no EULs exist Discoverer displays a dialog for you to choose whether to create an EUL now. Click Yes.

6. Discoverer displays the "EUL Manager dialog".

   Figure 17-5 EUL Manager dialog

   
   
   Text description of the illustration apeulmgr.gif

7. Click Create an EUL to display the "Create EUL Wizard dialog".

   This is where you create a new database user and Oracle Applications EUL.

   Figure 17-6 Create EUL Wizard dialog

   
   
   Text description of the illustration apcuseul.gif
   8. Specify whether an existing or new user is to own the Oracle Applications EUL by selecting one of the following radio buttons:
      • Select an existing user

        then select a user from the drop down list in the User field

      • Create a new user

        then enter a user name, password/confirmation for the new user

      Note: The EUL owner is always a database user. Please specify a database user.

   9. (optional) Select the Grant access to PUBLIC check box.

      Hint: We recommend that you select the Grant access to PUBLIC check box to grant public access to your EUL tables.

      If you want to explicitly give access to your EUL tables do not select the Grant access to PUBLIC check box. If you do not select the Grant access to PUBLIC check box you will need to grant access to your EUL tables manually.

   10. Select the New EUL is for Oracle Applications users ONLY check box to create an Oracle Applications mode EUL.

   11. Click Next to display the "Create EUL Wizard: Step 2 dialog" where you select the Oracle Applications schema and enter the schema password.

       Figure 17-7 Create EUL Wizard: Step 2

       
       
       Text description of the illustration apeulwz2.gif
   12. Use the Schema drop down list to select the Oracle Applications schema containing the Oracle Applications FND tables.

   13. Enter the password for the Oracle Applications schema and click Next.

   14. (if creating a new user) If you are creating a new user Discoverer displays the "Create EUL Wizard: Step 3 dialog" where you select the default and temporary tablespaces for the new database user/schema.

       Figure 17-8 Create EUL Wizard Step 3

       
       
       Text description of the illustration apeulwz3.gif
   15. (if creating a new user) Highlight the required Default and Temporary tablespaces you want to use for the Oracle Applications EUL owner.

       Hint: Ask your Oracle Applications database administrator if you are not sure.

   16. Click Finish to create the tables and views for the new Oracle Applications mode EUL and populate them with default data.

   Discoverer displays a dialog to confirm the creation of the new EUL:

   Figure 17-9 Create EUL wizard - success

   
   
   Text description of the illustration apeulwzs.gif
   17. Click OK to close the confirmation dialog.

       Discoverer displays a dialog that gives you the option to install tutorial data into the new EUL.

   18. Click Yes or No to specify whether to install the tutorial data.

       Discoverer displays a dialog that gives you the option to reconnect to the database as the owner of the new Oracle Applications EUL you have just created, or to remain connected as the DBA.

   Notes

   • Having created an Oracle Applications EUL you can now:
     • grant task privileges to an Oracle Applications user so that they have the ability to carry out tasks in Discoverer Administrator or Discoverer Plus using this Oracle Applications EUL (for more information, see "How to specify the tasks an Oracle Applications user or responsibility can perform")

     • create a new business area using the Oracle Applications tables (for further information, see Chapter 4, "What are business areas?")

   • When you create a new Oracle Applications business area, the schema objects you load into the business area must be based on secure views. This retains the row-level security associated with a specific Oracle Applications responsibility. Ask your Oracle Applications database administrator for further information.

   • You can also create an Applications mode EUL via the command line (for more information see Chapter 21, "/create_eul /apps_mode").

   How to grant task privileges to all Oracle Applications users via the Public user

   You can grant task privileges to all Oracle Applications users in one action by using the Public user.

   To grant task privileges to all Oracle Applications users:

   1. Start Discoverer Administrator and connect as an Oracle Applications user.

   2. Choose Tools | Privileges to display the "Privileges dialog: Privileges tab"

      The Privileges dialog contains the Public user. The public user is not an Oracle Applications user but represents all Oracle Applications users. You can grant a privilege to every Oracle Applications user by granting that privilege to the Public user. You can subsequently modify individual users' privileges as required.

   3. Grant privileges to the Public user as required.

      For more information, see Chapter 7, "How to specify the tasks a user or role (responsibility) can perform".

   How to specify the Oracle Applications users/responsibilities who can access a business area

   This task describes how to grant (or deny) access permission for business areas to specific users or responsibilities.

   For information about Oracle Applications responsibilities, see "What are Oracle Applications responsibilities?".

   Note: When completing the following task there is a notable difference between what Oracle database users and Oracle Applications users will see in the dialog:

   • Oracle database users will see the words Users and Roles

   • Oracle Applications database users will see the words Users and Responsibilities

   For more information about this task see Chapter 7, "How to specify a user or role (responsibility) that can access a business area".

   How to specify the business areas that an Oracle Applications user/responsibility can access

   This task describes how to specify which business areas a specific Oracle Applications user or responsibility can access.

   For information about Oracle Applications responsibilities, see "What are Oracle Applications responsibilities?"

   Note: When completing the following task there is a notable difference between what Oracle database users and Oracle Applications users will see in the dialog:

   • Oracle database users will see the words Users and Roles

   • Oracle Applications database users will see the words Users and Responsibilities

   For information about this task see Chapter 7, "How to specify the business areas a user or role (responsibility) can access".

   How to specify the tasks an Oracle Applications user or responsibility can perform

   This section describes how to specify the tasks a specific user or responsibility can perform.

   For information about Oracle Applications responsibilities, see "What are Oracle Applications responsibilities?".

   Note: When completing the following task there is a notable difference between what Oracle database users and Oracle Applications users will see in the dialog:

   • Oracle database users will see the words Users and Roles

   • Oracle Applications database users will see the words Users and Responsibilities

   For information about this task see Chapter 7, "How to specify the tasks a user or role (responsibility) can perform".

   How to specify the Oracle Applications users/responsibilities who can perform a specific task

   This section describes how to specify the users or responsibilities that can perform a specific task.

   For information about Oracle Applications responsibilities, see "What are Oracle Applications responsibilities?".

   Note: When completing the following task there is a notable difference between what Oracle database users and Oracle Applications users will see in the dialog:

   • Oracle database users will see the words Users and Roles

   • Oracle Applications database users will see the words Users and Responsibilities

   For information about this task see Chapter 7, "How to specify a user or role (responsibility) to perform a specific task".