Skip Headers

Oracle Business Intelligence Publisher Administrator's and Developer's Guide
Release 10.1.3.4
Part Number E12188-01		Go to Table of Contents
Contents 		Go to previous page
Previous 		Go to next page
Next

Defining a Security Model

This chapter covers the following topics:

Security Model Overview

BI Publisher offers the following security options:

Defining a Local Superuser

BI Publisher allows you to define an administration Superuser. Using the Superuser credentials you can directly access the BI Publisher server administrative functions without logging in through the defined security model.

Set up this Superuser to ensure access to all administrative functions in case of problems with the current security setup.

  1. Select the Admin tab.

  2. Under Security Center select Security Configuration.

  3. Under Local Superuser, select the box and enter the credentials for the Superuser.

Allowing Guest Access

BI Publisher allows you to set up a public access folder. Any user can access the reports in this folder without entering credentials.

  1. Under Shared Folders, create the folder to which you want to grant public access.

  2. Select the Admin tab.

  3. Under Security Center select Security Configuration.

  4. Under Guest Access, select Allow Guest Access.

  5. Enter the name of the folder that you created for public access.

  6. Restart the BI Publisher application.

The next time you access BI Publisher, you will see the Guest button. Users can select this button and view the reports in your chosen guest folder without presenting credentials.

Understanding BI Publisher's Users and Roles

A user is granted one or multiple Roles. A Role defines a user's access to Folders and functions. A role can be assigned one or multiple Folders to which access is granted. Reports are contained within the folders. You can create a hierarchy of roles by assigning roles to other roles. In this way the privileges of multiple roles can roll up to higher level roles. The following graphic shows an example of the hierarchy structure of User, Role, and Folder:

the picture is described in the document text

Functional Roles

BI Publisher provides five functional roles to grant access to specific tasks within the application. Assign these roles to users based on their need to perform the associated tasks. These roles cannot be updated or deleted.

The following table shows the privileges granted to each functional role:

Role Privileges
no roles assigned View (online reports only)
Export
History
BI Publisher Excel Analyzer View
Export
History
Grants access to the Excel Analyzer
BI Publisher Online Analyzer View
Export
History (public reports only)
Grants access to the Analyzer
BI Publisher Scheduler View
Export
History
Schedule
BI Publisher Template Designer View
Export
History
Enables log on from Template Builder
BI Publisher Developer View
Export
History
Edit
Configure
Folder and Report Tasks
Enables log on from the Template Builder
BI Publisher Administrator View
Export
Edit
Schedule
History
Configure
Folder and Report Tasks
Excel Analyzer
Online Analyzer
Admin tab and all administration tasks
Enables log on from the Template Builder

Setting Up Users and Roles

There are two options for setting up users and roles:

Create a Role:

  1. From the Security Center, select Roles and Permissions; this will invoke the Security Center page. Here you can see the list of existing roles and permissions.

  2. Select Create Role.

  3. Enter a Role Name and Description and select Apply.

  4. Grant access to data sources for the role. See Setting Up Data Sources.

Add a User:

  1. From the Security Center, select Users. This will invoke the Security Center Users page. Here you can see the list of existing users.

  2. Select Create User.

  3. Add the User Name and Password for the user.

Update a User:

  1. From the Security Center, select Users. This will invoke the Security Center Users page. Here you can see the list of existing users.

  2. Select the user name. You can update both the user name and the password.

Add a Role to a User:

  1. From the Security Center, select Users. This will invoke the Security Center Users page. Here you can see the list of existing users.

  2. Select the Assign Roles icon for the user.

  3. From the Assign Roles page, select the role from the Available Roles list and then select the Move shuttle button to move the role to the Assigned Roles list. When done assigning all roles, select Apply.

Add a Folder to a Role:

  1. From the Security Center, select Roles and Permissions; this will invoke the Security Center page. Here you can see the list of existing roles and permissions.

  2. Select the Add Folders icon.

  3. Select the desired folder from the Available Folders list and use the Move shuttle button to move it to the Allowed Folders list.

    Note that the folders are presented as the directory structure is set up in your system. Selecting the top level folder will grant access to all subfolders. Selecting just the subfolder entry will allow access only to the subfolder.

Add a Data Source to a Role

  1. From the Security Center, select Roles and Permissions; this will invoke the Security Center page. Here you can see the list of existing roles and permissions.

  2. Select the Add Data Sources icon for the Role.

  3. Move selections from the Available Data Sources list to the Allowed Data Sources list.

    Users with this role will only be allowed to run reports that access data sources on the Allowed Data Sources list.

Add a Role to a Role:

  1. From the Security Center, select Roles and Permissions; this will invoke the Security Center page. Here you can see the list of existing roles and permissions.

  2. Select the Add Roles icon for the Role.

  3. Select the desired role from the Available Roles list and use the Move shuttle button to move it to the Included Roles.

Considerations When Deleting a User

When you delete a user in any security model (built-in, LDAP, E-Business Suite, or BI Server), ensure that you delete the user folder from the repository. If you are logged in as an Administrator, the user folders are located on the Reports page under Users/<username>. If the individual user folder is not deleted and a new user is created with the same user name, then the new user will have access to the contents of the existing user folder.

Integrating with LDAP

BI Publisher can be integrated with your LDAP server to manage users and report access. Create the users and roles within your LDAP server, then configure the BI Publisher server to access your LDAP server.

In the BI Publisher security center module, assign folders to those roles. When a user logs into the server they will have access to those folders and reports assigned to the LDAP roles.

Integrating the BI Publisher server with Oracle LDAP consists of three main tasks:

  1. Set up users and roles

  2. Configure BI Publisher to recognize your LDAP server

  3. Assign report folders and data sources to roles

These tasks can be performed through the Oracle Internet Directory (OID) Web UI, or through the client application. Each method is described in detail.

Using the Client Application

Set Up Users and Roles

  1. Use the Enterprise Security Manager login to access your LDAP Server.

    An example Directory Server Login screen is shown in the following figure:

    the picture is described in the document text

  2. Create Roles.

    Navigate to the Enterprise Roles node under the OracleDefaultDomain node.

    A sample Enterprise Security Manager screen is shown in the following figure:

    the picture is described in the document text

  3. To create a role, select the Enterprise Roles node, then select Create Enterprise Role from the Operations menu.

    You must create the following roles to integrate with BI Publisher: See Understanding Users and Roles for full descriptions of the required functional roles.

    The following figure shows a sample Create Enterprise Role dialog:

    the picture is described in the document text

  4. Create other functional roles as required by your implementation, for example: HR Manager, Warehouse Clerk, or Sales Manager.

    The following figure shows an example Enterprise Security Manager screen with multiple roles defined:

    the picture is described in the document text

  5. Assign roles to users.

Configure the BI Publisher Server to Recognize Your LDAP Server

To configure the BI Publisher server to recognize your LDAP server, update the Security properties in the BI Publisher Admin interface as follows:

  1. Navigate to the Security Configuration page: Select the Admin tab. Under Security Center select Security Configuration.

  2. Scroll down to the Security Model region. Select LDAP for the Security Model.

  3. Enter the following:

Important: You must restart the server for changes to the security model to take effect.

The following figure shows a sample of the LDAP security model entry fields from the Security Configuration page:

the picture is described in the document text

Assign Folders and Data Sources to Roles

  1. Log in with an Administrator role.

  2. Navigate to the Admin tab. From Security Center select Roles and Permissions.

    You will see the roles you created and assigned in the security manager application. Note the following:

  3. Select Add Folders to add folders to a particular role using the tree shuttle. Select Add Data Sources to add BI Publisher data sources to the role. A role must be assigned access to a data source to run reports from that data source.

Users can now log in using their LDAP username/password and will have access to reports in the folders assigned to their roles set up in LDAP.

Using the OID Web UI

  1. Log in to OID. The URL is typically http://(AS host):(AS port)/oiddas/

  2. Create users for BI Publisher. Select the Directory tab, then the Users subtab, and then click the Create button.

    the picture is described in the document text

  3. Create the following roles to integrate with BI Publisher: See Understanding Users and Roles for full descriptions of the required functional roles.

    To create the Group, select the Groups subtab, then click Create.

    the picture is described in the document text

  4. Assign users to the group.

    Select each group and click Manage, then click Edit.

    the picture is described in the document text

  5. Click the Add User button to add users to the Group.

    the picture is described in the document text

Setting Up Oracle Single Sign-On

This section describes how to set up Oracle Single Sign-On with Oracle 10g Application Server (OracleAS). These guidelines are written based on the Oracle 10g Application Server 10.1.3 release.

Prerequisites

Setup Procedure

  1. Create a BI Publisher Local Superuser. Before performing any security updates, you must set up a BI Publisher Local Superuser to ensure access to BI Publisher regardless of your selected security configuration. See Defining a Local Superuser for more information.

  2. Modify the application server configuration file. Navigate to Application Server Control (ASC). Choose HTTP Server and then choose Advanced Server Properties.

    The following figure shows a sample Advanced Server Properties page:

    the picture is described in the document text

    Select mod_osso.conf to open the file for editing. To protect the server, add a new "Location" directive as follows:

    <!-- Protect xmlpserver -->
<Location /xmlpserver>
      require valid-user
      AuthType Basic
</Location>

  3. To allow Web service communication between BI Publisher and its client components (the Template Builder and the Excel Analyzer) you must make additional modifications to the mod_osso.conf file. To open up the xmlpserver to allow these Web services, enter the following directives: 

    <Location /xmlpserver/services/>
  require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

<Location /xmlpserver/report_service/>
  require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

Location /xmlpserver/ReportTemplateService.xls/>
  require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

  4. (Optional) To allow access to the Guest Folder in BI Publisher for users not signed on through SSO, you must make an additional modification to the mod_osso.conf file to allow traffic to the Guest folder without checking the SSO token. To do this, add the following directive:

    <Location /xmlpserver/Guest/>
 require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

  5. For integration with Oracle BI Presentation Services, you must disable SSO for Web services between the BI Presentation Services server and the BI Publisher server. If you made this entry when performing Step 8, you do not need to repeat this setup.

    To open up the xmlpserver to allow the Web service, enter the following directive in the mod_osso.conf file:

    <Location /xmlpserver/services/>
 require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

    You must make a similar entry to open the BI Presentation Services server. For more information on required configuration for BI Publisher Enterprise and Oracle BI Presentation services, see the Oracle Business Intelligence Enterprise Edition Deployment Guide.

    A sample mod_osso.conf file with the entries discussed in this section is shown below:

    LoadModule osso_module libexec/mod_osso.so
 
 <IfModule mod_osso.c>
     OssoIpCheck off
     OssoIdleTimeout off
     OssoConfigFile /home/as1013/ohome/Apache/Apache/conf/osso/osso.conf
 
   <Location /xmlpserver>
     require valid-user
     AuthType Basic
   </Location>
 
 
<Location /xmlpserver/services/>
  require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

<Location /xmlpserver/report_service/>
  require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

Location /xmlpserver/ReportTemplateService.xls/>
  require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>

<Location /xmlpserver/Guest/>
 require valid-user
     AuthType Basic
     Allow from All
     Satisfy any
</Location>
 #
 # Insert Protected Resources: (see Notes below for how to protect resources)
 #
 
 
 #______-
 #
 # Notes
 #
 #______-
 #
 # 1. Here's what you need to add to protect a resource,
 #    e.g. <ApacheServerRoot>/htdocs/private:
 #
 #      <Location /private>
 #      require valid-user
 #      AuthType Basic
 #      </Location>
 #
 </IfModule>
 
 #
 # If you would like to have short hostnames redirected to
 # fully qualified hostnames to allow clients that need 
 # authentication via mod_osso to be able to enter short
 # hostnames into their browsers uncomment out the following
 # lines
 #
 #PerlModule Apache::ShortHostnameRedirect
 #PerlHeaderParserHandler Apache::ShortHostnameRedirect

    A sample of edit page is shown in the following figure:

    the picture is described in the document text

  6. Restart the HTTP server.

  7. Set up the Single Sign-Off URL on the BI Publisher Security Configuration page.

    From the Admin tab, select Security Configuration. Enter the following in the Oracle Single Sign-On region:

  8. Restart the application through the Application Server Control page.

  9. Enter the URL to access the BI Publisher Enterprise application, and you will be redirected to the SSO login page.

    A sample SSO login page is shown in the following figure:

    the picture is described in the document text

Integrating with Oracle E-Business Suite Security

BI Publisher can leverage your E-Business Suite security to enable your E-Business Suite users to log in to BI Publisher using their E-Business Suite credentials. When you integrate with the E-Business Suite security, your E-Business Suite responsibilities become available as roles in the BI Publisher security center. You can then associate BI Publisher report folders to the imported roles/responsibilities to allow access as you would using the BI Publisher native security. See Understanding Users and Roles.

Note: In this release your users will not be able to access or execute reports stored on the E-Business Suite instance.

Setting Up the E-Business Suite Security in BI Publisher

Upload the dbc File

  1. In the Oracle E-Business Suite, log in as a System Administrator and create the following responsibilities to correspond to the BI Publisher functional roles:

  2. Add the new BI Publisher responsibilities to the appropriate Users.

    Note: Ensure to assign at least one user to the XMLP_ADMIN group.

  3. Log in to BI Publisher Enterprise. From the Admin tab, select Security Configuration.

  4. In the Security Model section of the page, select Oracle E-Business Suite from the list.

  5. Load your dbc file from the E-Business Suite instance. This is typically located under the $FND_SECURE directory. If you do not have access to this file, contact your E-Business Suite system administrator. This file specifies how BI Publisher should access the E-Business Suite instance.

  6. It is recommended that you create a local super user for the system to allow you to access the Administrator pages once the changes take effect. Select the Enable Local Superuser check box and enter a username and password for the user under the Local Superuser section of the Security Configuration tab.

  7. Restart the BI Publisher server for the security changes to take effect.

Once you restart the system, all your E-Business Suite responsibilities will be visible as roles in the BI Publisher security center. Add folders to the E-Business Suite roles.

Add Folders to the E-Business Suite Roles

  1. From the Admin tab select Roles and Permissions.

  2. All of the responsibilities from your E-Business Suite instance will display as available roles.

  3. Find the responsibility (role) that you wish to attach folders to and select Add Folders.

Now when EBS users log in using their EBS credentials they will have access to the folders and reports that have been attached to their responsibilities.

Integrating with Oracle BI Server Security

BI Publisher offers integration with Oracle BI Server security so that you can administer the BI Publisher users through the BI Server Administration tool. To accomplish this you must define the BI Publisher functional roles within the Oracle BI Server Administration tool, assign users to these groups, and then specify Oracle BI Security as your security model in the BI Publisher Admin interface.

Note: For information on setting up Oracle BI security, see the Oracle Business Intelligence Server Administration Guide.

  1. In the BI Server Administration tool, create the following groups to correspond to the BI Publisher functional roles:

  2. Add the appropriate users to the BI Publisher groups in the BI Server Administration tool.

    Note: Ensure to assign at least one user to the XMLP_ADMIN group.

  3. In the BI Publisher Enterprise application, log in with Administration privileges. From the Admin tab select Security Configuration.

  4. In the Security Model section of the page, select Oracle BI Server from the list. Provide the following connection information for the BI Server:

  5. It is recommended that you create a local super user for the system to allow you to access the Administrator pages once the changes take effect. Select the Enable Local Superuser check box and enter a username and password for the user under the Local Superuser section of the Security Configuration tab.

  6. Restart the BI Publisher server for the security changes to take effect.

Add Folders to the Oracle BI Server Roles

  1. Log in to BI Publisher as a user with the XMLP_ADMIN role.

  2. From the Admin tab select Roles and Permissions.

  3. All of the groups from your Oracle BI instance will display as available roles.

  4. Find the group (role) that you wish to attach folders to and select Add Folders.

Integrating with Oracle Database Security

BI Publisher offers integration with Oracle Database security so that you can administer the BI Publisher users with your Oracle Database users. To accomplish this you must define the BI Publisher functional roles in your Oracle Database, assign the roles to your Oracle Database users, and then specify Oracle Database as your security model in the BI Publisher Admin page.

Note: For information on setting up Oracle DatabaseI security, see the Oracle Database Security Guide.

  1. In your Oracle Database, create the following roles to correspond to the BI Publisher functional roles:

  2. Assign these roles to the appropriate Database users. You may also want to create additional reporting roles that you can utilize when setting up your report privileges on the BI Publisher side. For example, you might create a role called "HUMAN_RESOURCES_MANAGER" that you can assign a Human Resources Folder of reports to. You can then assign that role to any user requiring access to the Human Resources reports.

  3. Ensure to assign the XMLP_ADMIN role to a user with administration privileges, such as SYSTEM.

  4. In the BI Publisher application, log in with Administration privileges. From the Admin tab select Security Configuration.

  5. In the Security Model section of the page, select Oracle Database from the list. Provide the following connection information:

  6. It is recommended that you create a local super user for the system to allow you to access the Administrator pages once the changes take effect. Select the Enable Local Superuser check box and enter a username and password for the user under the Local Superuser section of the Security Configuration tab.

  7. Restart the BI Publisher server for the security changes to take effect.

  8. After you restart the server, you can log in with the Oracle Database user to which you assigned the XMLP_ADMIN role. You will now see all your Oracle Database users and roles.

  9. Assign report folders to the Oracle Database roles so that users can access reports.

Implementing a Digital Signature

Oracle BI Publisher supports digital signatures on PDF output documents. Digital signatures enable you to verify the authenticity of the documents you send and receive. Oracle BI Publisher can access your digital ID file from a central, secure location and at runtime sign the PDF output with the digital ID. The digital signature verifies the signer's identity and ensures that the document has not been altered after it was signed.

For additional information on digital signatures, see the following sources:

Prerequisite

Before you can implement digital signatures with Oracle BI Publisher output documents, you need the following:

A digital ID obtained from a public certificate authority or from a private/internal certificate authority (if for internal use only). You must copy the digital ID file to a secure location of the file system on the server that is accessible by the BI Publisher server.

Limitations

Use of digital signatures with Oracle BI Publisher output documents has the following limitations:

Procedure for Implementing a Digital Signature

The following steps provide an overview of the tasks required to set up and sign your output PDF documents with a digital signature:

  1. Register the digital ID in the BI Publisher Admin page.

  2. Specify the Roles that are authorized to sign documents.

  3. (Optional for PDF templates) Add a signature field to the PDF template in which to place the digital signature at runtime. See Adding or Designating a Field for Digital Signature, Oracle BI Publisher Report Designer's Guide for instructions on designating a specific field in a PDF template for the digital signature.

  4. Enable Digital Signature for the report in the Runtime Configuration properties and specify the position to place the digital signature on the completed document. This can be a signature field (for PDF templates), general location (top left, top center, or top right), or you can specify x and y coordinates.

  5. Log in to BI Publisher as a user with an authorized role and submit the report through the BI Publisher scheduler, choosing PDF output. When the report completes it will be signed with your digital ID in the specified location of the document.

Registering Your Digital Signature ID and Assigning Authorized Roles

Currently, BI Publisher supports the identification of a single digital ID file only. Register the digital ID in the BI Publisher Admin page as follows:

  1. Log in to BI Publisher with Administrator credentials.

  2. Select the Admin tab, and then from the Security Center list select Digital Signature.

  3. On the Digital Signature subtab, enter the file path to the digital ID file and enter the password for the digital ID.

  4. Enable the Roles that will have the authority to sign documents with this digital ID. Use the shuttle buttons to move Available Roles to the Allowed Roles list.

  5. Click Apply. The following figure shows the Digital Signature subtab:

    the picture is described in the document text

Contents   |   Previous   |   Top of Page   |   Next

Oracle Logo
Copyright © 2004, 2008, Oracle and/or its affiliates. All rights reserved.