4
Lesson 3: Granting access privileges

Lesson 3: Granting access privileges

It will probably take you about 15 minutes to complete this lesson.

In this lesson you will grant access privileges to users and grant security access to the business area.

Access privileges determine who can see and use the data in the business area. The Privileges and Security dialogs are your means for setting those rights and privileges for the appropriate database users. Data access rights to the application database tables are controlled by the database administrator, and are not affected by Discoverer Administrator. Database users need SELECT access to the application database tables in order to use Discoverer.

The database user Admintutor[your initials] is the creator and owner of the business area in this tutorial. The database user Admintutor[your initials] is the only user with the authority to grant other users access privileges to the new business area. This user can also grant administration rights to other users.

For more detailed information about working with the Privileges and Security dialogs, click Help.

This lesson consists of the following exercises:

Exercise 1: Using the Privileges dialog: Privileges tab

In this exercise you will use the Privileges dialog: User/Role tab to grant Discoverer Desktop and Discoverer Plus privileges to the VIDEO5 database user.

The Privileges dialog enables you to grant access privileges to database users and has four tabs, (i.e. Privileges, User/Role, Query Governor and Scheduled Workbooks).

The Privileges tab displays a list of privileges available in Discoverer Administrator and another list in Discoverer Desktop and Discoverer Plus. The check box next to each privilege enables you to grant and revoke privileges to the specified database user or role.

To use the Privileges dialog: Privileges tab:

If you are not connected to Discoverer Administrator, complete Chapter 3, "Exercise 1: Connecting to Discoverer Administrator", Discoverer Administrator displays the Load Wizard.
Click Cancel to close the Load Wizard dialog.
Choose Tools | Privileges to display the Privileges dialog: Privileges tab.

This tab enables you to grant access privileges to database users or roles.
- A database user is represented in Discoverer Administrator as a user.
- A database role is defined in the Oracle database and is another means of grouping users for security purposes.
Note: The database administrator can assign database users to a role and then modify the role to affect the privileges for all database users assigned to that role. As a Discoverer manager, this saves you from having to recreate the same set of privileges over and over. For example, you could use a Store Manager role to assign the same privileges to any manager in the video store chain.

Figure 4-1 Privileges dialog: Privileges tab

Text description of the illustration privtb.gif

Select the User check box.
Clear the Role check box.
Select VIDEO5 from the drop down list.
Select the Desktop and Plus Privilege check box to activate the set of privileges in the field below.
Select all the Desktop and Plus Privilege check boxes.

Note: Roles and system profiles are features of the Oracle database. If you are using a non-Oracle database, these features are unavailable. In addition, the following privileges are not enabled: Set Privilege, Manage Scheduled Workbooks, Schedule Workbooks.
Do not click OK yet.

In this exercise you used the Privileges dialog: User/Role tab to set Desktop and Plus privileges for the VIDEO5 database user.

Exercise 2: Using the Privileges dialog: User/Role tab

In this exercise you will use the Privileges dialog: User/Role tab.

The Privileges dialog: User/Role tab displays a list of all database users and roles. The check box next to each database user/role enables you to grant and revoke the specified privilege to database users and/or roles.

To use the Privileges dialog: User/Role tab:

Display the Privileges dialog: User/Role tab.

Figure 4-2 Privileges dialog: User/Role tab

Text description of privrtb.gif follows.

Text description of the illustration privrtb.gif

This tab lists the users and roles that have access to a specific privilege, or set of privileges. You can use this tab to grant or revoke access privileges to a specific user or role.

Select Desktop from the drop down list.
Select the VIDEO5 check box from the list of users and roles.

If you had wanted to revoke Desktop privileges from the VIDEO5 database user, you would clear the VIDEO5 check box.
Click Apply but do not click OK yet.

In this exercise you used the Privileges dialog: User/Role tab.

Exercise 3: Using the Privileges dialog: Query Governor tab

In this exercise you will set query limits for the database user VIDEO5.

The Privileges dialog: Query Governor tab displays a list of the limits for running queries. The list enables you to set limits for running queries for the specified database user or role.

To set query limits for the database user VIDEO5:

Display the Privileges dialog: Query Governor tab.

Figure 4-3 Privileges dialog: Query Governor tab

Text description of privqgt.gif follows.

Text description of the illustration privqgt.gif

This tab enables you to set the query retrieval limits for the specified database user or role. In this exercise you will set query limits for the database user, VIDEO5.

Select the User check box.
Clear the Role check box.
Select the VIDEO5 database user from the drop down list.
Set the query retrieval limits as follows:
- Select the Warn user if predicted time exceeds check box and set the time to 2:00 minutes.
  
  This option is not available if you are using a non-Oracle database.
- Select the Prevent queries longer than check box and set the time to 15:00 minutes.
- Clear the Limit retrieved data to check box so that no limit is set.
1. Click Apply but do not click OK yet.
In this exercise you set query limits for the database user VIDEO5.

Exercise 4: Using the Privileges dialog: Scheduled Workbooks tab

In this exercise you will set limits for scheduling workbooks in Discoverer Plus and Discoverer Desktop.

The Privileges dialog: Scheduled Workbooks tab displays limits for running scheduled workbooks. It enables you to set different parameters for scheduling workbooks for each database user or role that has that privilege.

To set limits for scheduling workbooks in Discoverer Plus and Discoverer Desktop:
1. Display the Privileges dialog: Scheduled Workbooks tab.
Figure 4-4 Privileges Dialog:Scheduled Workbooks tab

Text description of the illustration privswbt.gif
1. Choose the VIDEO5 database user from the Show scheduling limits for user drop down list.
2. Choose the VIDEO5 database user from the Select the user to own the tables which store the workbook results, drop down list.
3. Select the Schedule only if predicted time exceeds radio button and set the minutes to 60.
4. Select the Limit number of scheduled workbooks check box and set the workbooks to 20.
5. Select the Expire results check box and set the days before expiration to 30.
6. Select the Commit size check box and set the number of rows to 100.
7. Select the Restrict the hours during which a workbook may be scheduled check box and set the start and end times to 18:00 and 24:00.
8. Click OK.
In this exercise you set limits for scheduling workbooks in Discoverer Plus and Discoverer Desktop.

Exercise 5: Using the Security dialog: Business Area -> User tab

In this exercise you will grant the VIDEO5 database user access privilege to the New Video Stores business area.

The Security dialog provides a further level of security by enabling you to specify which database users can view and use specific business areas.

To grant the VIDEO5 database user access privilege to the New Video Stores business area:
1. Choose Tools | Security to display the Security dialog.
2. Display the Business Area->User tab.
Figure 4-5 Security dialog: Business Area->User tab

Text description of the illustration secbaun.gif
This tab enables you to grant access privileges to database users for specific business areas. The other tab (Users->Business Areas tab) enables you to grant specific database users access to various business areas.

Note: Discoverer Administrator automatically authorizes the EUL owner to access the New Video Stores business area, because that user is the creator and owner of the business area. Also that user is the only one permitted to make these security changes and to grant administration privileges to other users.
1. Move the VIDEO5 database user from the Available list to the Selected list.
Figure 4-6 Security dialog: Business Area->User tab

Text description of the illustration secbat.gif
1. Click OK to save your changes and close the dialog.
In this exercise you granted the VIDEO5 database user access privilege to the New Video Stores business area.

Lesson summary

In this lesson you granted access privileges to a database user and granted security access to use the New Video Stores business area. This enabled the database user to access the business area to perform basic reporting. In other words, all that is required for basic use of Discoverer Plus and Discoverer Viewer is a business area with database users that are able to access it.

In this lesson you completed the following exercises:
- In Exercise 1 you set user privileges.
- In Exercise 2 you viewed database user/role privileges.
- In Exercise 3 you set query limits.
- In Exercise 4 you set workbook scheduling limits.
- In Exercise 5 you granted a database user the privilege to use the New Video Stores business area.
In the next lesson, you will enhance the business area by providing a useful, expanded business view of the data to end users.