Setting Up EPM Security

This chapter provides an overview of EPM security and setup, and discusses how to:

• Specify field level security options.

• Establish ledger security.

• Specify row and column level security.

• Establish security bridges for your business intelligence tool.

Understanding EPM Security and Setups

This section discusses:

• PeopleSoft application security

• EPM security

• Setting up EPM security

• EPM security views

PeopleSoft Application Security

PeopleSoft applications use multilevel security to enable you to successfully manage shared data environments. You set up data access at different entry points within your system and define the most efficient path to data across business groups, tables, departments, pages, and so forth. You have full control over security definitions, selecting options to create a matrix that enables or restricts user access to data through a series of authorizations.

Security access covers three areas: networks, databases, and applications. Network security controls the overall point of entry into your system hardware and software resources. Database security narrows the scope of a user's information access. At the application level, security extends to the field level. This diagram illustrates PeopleSoft application security levels:

Application Security Terms

This table describes the various types of PeopleSoft application security:

EPM Security

EPM security controls access to specific data within the EPM database and enables you to grant users access to specific rows, columns, or fields in an EPM database table. Data-access privileges within the warehouse can be defined for both Operational Warehouse - Enriched (OWE) and Multidimensional Warehouse (MDW) tables, and for dimension and fact tables.

You can specify EPM security access using any of the following methods:

• Field-level security

• Ledger security

• Dimension (row-level) security

• Metric (column-level) security

EPM security provides a single point of entry for defining and maintaining data access rules across all the EPM Warehouses and Analytical Applications.

Setting Up EPM Security

EPM security is extremely flexible and enables you to restrict user access to EPM database tables in a variety of ways, including field level, row level, and column level restrictions. PeopleSoft-delivered ETL jobs move security data from your source transaction system to EPM target warehouse tables. You must set up PeopleTools and IBM WebSphere DataStage security, but you need only use the security pages documented in this chapter to redefine or modify your existing security data.

You have the option of implementing only one type of EPM security restriction or all four types:

• Field-level security.

• Ledger security.

• Row-level security.

• Column-level security.

The following security setup process flow demonstrates the different security setup options:

EPM Security Setup Process Flow

As demonstrated in the diagram, you can implement any combination of field level, ledger, row level, and column level security restrictions.

Note. Refer to your EPM Warehouse and Analytical Application PeopleBooks for any special security setups required for those products.

PeopleTools security

PeopleTools security provides user authentication and application-level security. Users are authorized to access the EPM database using Peopletools login security. Users may be granted or denied access to each application and components therein. EPM security works together with PeopleTools security, so you must properly define PeopleTools security prior to setting up EPM security.

See PeopleSoft PeopleTools PeopleBook: Security Administration

IBM WebSphere DataStage Security

PeopleSoft EPM delivers the IBM WebSphere extract, transform, and load (ETL) tool to load your source data into the Operational Warehouse - Staging (OWS) and migrate the data to the OWE and the MDW. The tool builds three layers of security into the repository and its objects. Access is granted through groups and users.

The three layers of security are:

1. A user role that is created by the EPM Production Manager.

   The Production Manager assigns Windows user groups to one of four DataStage user categories. For example, if you belong to the Windows Administrators user group, you might be assigned to the DataStage Production Manager category and have full access to all areas of a DataStage project. This is the default for DataStage users.

2. Project privileges that range from browse-only to full Production Manager privileges.

3. Object-level safeguards that prevent users from jointly accessing or overwriting the same object.

   For example, if a user is working on a job, that object is locked so that no other user can access it. Locks are automatically created to avoid repository contamination.

The following DataStage user categories are defined in PeopleSoft EPM: the EPM Production Manager, Developer, Operator, and None. The Production Manager has full access to all areas of a DataStage project, including repository objects, and can create and manipulate protected projects. The Production Manager grants access to all other groups and users. Developers have full access to all areas of a DataStage project and can create and modify ETL jobs. This is the default setting. Operators have permission to run and manage DataStage jobs. Users who are assigned to None do not have permission to sign in to DataStage.

See IBM Information Server: Administration Guide

Field Level Security

Field level security enables you to restrict users to specific fields on your EPM database tables based on business units and setIDs (because the tables are keyed by setID or business unit).

To set up field level security you must:

1. Enable field level security and specify related options.

2. Associate security views with specific users, permission lists, business units, or setIDs.

3. Apply the aforementioned field level security parameters.

4. Associate specific users or permission lists with the business unit and/or setID restrictions (data group restrictions) you defined in the previous steps.

See Specifying Field-Level Security Options.

Ledger Security

Ledger security enables you to restrict users to specific EPM ledger tables. You can restrict access to the tables by user or permission list.

See Establishing Ledger Security.

Dimension (Row Level) and Metric (Column Level) Security

Row level security enables you to secure individual rows of an EPM dimension table. Column level security enables you to secure individual columns of an EPM database table. Usually, these are measures on fact tables, but may also be attributes on a dimension table that contain sensitive data, such as Employees' Salary or the Social Security Number columns. With row level and metric level support, you can restrict access by individual user or security roles.

To set up row level security you must:

1. Define dimension security.

2. Associate the dimension with a security join table.

   Security join tables are EPM database tables that store the security profiles for users along with the corresponding dimension values for which they have access.

3. Define users and security roles.

4. Assign dimension rows to the user or security role.

To set up column level security you must:

1. Define metric security.

2. Define users and security roles.

3. Assign metric to the user or security role.

See Defining Dimension and Metric Security.

See Understanding Role and User Based Security for Dimensions and Metrics.

EPM Security Views

Security views are SQL SELECT statements that filter out data rows whose key values are not needed as valid access parameters. The result is that users who are authorized to access setIDs or business units see only a subset of values from these edit table values. PeopleSoft EPM delivers prepackaged security views for most securable objects in EPM and the views tell the system which table views to reference. To use these security views in PeopleTools, use the views as a search view.

You can alter these prepackaged views or build your own.

Specifying Field-Level Security Options

You can set up field-level security for business units and setIDs because EPM warehouse tables are keyed by either setID or business unit. The Security Options page enables you to enable this type of security. The page updates one row in the INSTALLATION_FS table. Only one row is ever in this table (only one type of security can be active at a time). For example, if you select operator security, only selected fields (business unit, setID, or both) have security applied.

After specifying field-level security options you must associate security views with specific users, permission lists, business units, or setIDs and run the apply security application engine process (which reads the INSTALLATION_FS table, determines the security type, such as none, permission list or operator, and applies your selected field-level security parameters).

After running the apply security process, you must associate specific users or permission lists with the business unit and/or setID restrictions (data group restrictions) you defined in the previous steps.

This section discusses how to:

• Set up field-level security options.

• Set up security view names.

• Establish setID security by permission list or user ID.

• Establish business unit security by permission list or user ID.

Pages Used to Specify Field-Level Security Options

Setting Up Field-Level Security Options

Access the Security Options page (EPM Foundation, EPM Security, Advanced, Security Options).

You can implement security using any of the following fields:

• Unit: Business unit, the primary key for all transaction data.

• SetID: The primary key for all accounting structure and rules tables.

• Ledger

• Book

• Project

• Analysis Group

• Pay Cycle

For either field, you can set the security in the following ways:

Specifying Security View Names Access Privileges

Access the Security View Names page (EPM Foundation, EPM Security, Advanced, Security View Names).

After you have set up your security views, you can specify which users or permission lists can access the pages that contain secured field values using the Security View Names page. Within each page, you also can hide specific fields from particular permission lists. The Security View Names page also indicates the type of field (business unit or setID) secured by each view.

The system stores the list in the SEC_VIEW_NAMES table, where you can review or update this information. You can add any security views that you configure for your system.

View names use one of three file extensions to reflect the type of security that you selected when you specified your security options:

• _NONVW: Indicates that no security has been selected for that view.

• _OPRVW: Indicates that operator (user) security has been selected for that view.

• _CLSVW: Indicates that permission list security has been selected for that view.

Use the Search Text field to search for a security view table. This field lists the view name prefixes that are supplied by each of your applications. When you run the Apply Security Setup process, the process uses these prefixes to search the system for view names that begin with these prefixes. If a view name begins with a prefix from this list, the process changes the view name extension to match the security type that you selected when you specified security options. The type of field (business unit or setID) that is secured by each view is embedded in the view name.

After you have selected your security options and defined your security views, you must run the Apply Security FIN9001 SQR process for the options to take effect.

See Also

EPM Security Views

Running the Apply Security Process

Access the Request Security Processing page (EPM Foundation, EPM Security, Advanced, Apply Security Setups, Request Security Processing).

Run the Apply Security process to apply the security parameters you set up on the Security Options and Security View Names pages. The Apply Security process reads the INSTALLATION_FS table to determine the security type (none, permission list, operator) and then switches the prompt table views to the new view names, based on SEC_VIEW_NAMES. The process searches for the values in the Search Text field on the Security View Names page and replaces the table names as specified.

Note. This process should not be confused with the request security processing process (PF_SECURITY) which is discussed later in this chapter. The PF_SECURITY process applies security parameters specified for security roles and users.

Establishing SetID Security by Permission List or User ID

Access the TableSet Security by Permission List page (EPM Foundation, EPM Security, Advanced, TableSet Security by Perm (Permission) List) or the TableSet Security by User ID page (EPM Foundation, EPM Security, Advanced, TableSet Security by User ID ).

For each user ID or primary permission list, select the setID or setIDs that the users or permission list can access.

Establishing Business Unit Security by Permission List or User ID

Access the Unit Security by Permission List page (EPM Foundation, EPM Security, Advanced, Unit Security by Perm (Permission) List) or the Unit Security by User ID page.

For each user ID or primary permission list, select the warehouse business unit or units that the user or permission list can access.

Establishing Ledger Security

You can determine which users have access to ledger data by securing access to specific ledgers. For a specified ledger you can grant access to users by permission list or user ID.

Pages Used to Define Ledger Security

Defining Ledger Security by Permission List or User ID

Access the Ledger/Perm List (EPM Foundation, EPM Security, Advanced, Ledger Security by Permission List, Ledger/Perm List) or Ledger by User ID page (EPM Foundation, EPM Security, Advanced, Ledger Security by User ID, Ledger by User ID).

Use these pages to select a ledger to associate with a security permission list or user ID.

Specifying Row and Column Level Security

This section provides an overview of role and user-based security and discusses how to:

• Define security roles.

• Grant dimension and metric access to security roles.

• Assign users to security roles.

• View summary for security roles.

• Grant dimension and metric access to a user.

• View summary for a secured user.

• Request security processing

Defining Dimension and Metric Security

Because EPM is delivered with no security restrictions, dimensions and metrics (also known as fact-columns) are also delivered unsecured. Before you can grant a user access to a dimension or metric, you must first indicate to the system that a particular dimension or metric requires securing. The pages used to define dimension and metric security are discussed in the security chapter of this PeopleBook.

See Defining Dimension and Metric Security.

Note. Dimensions and metrics that are not secured are classified as public, or unsecured. All EPM users can view public objects.

Understanding Role and User Based Security for Dimensions and Metrics

After you designate dimensions and metrics that require securing, you must grant users access to those objects. You can grant security access to an individual user or to a specific security role.

EPM security enables you to create security roles. A security role is a set of data access privileges that are assigned to one or more users. A user who is assigned to a specific role inherits all access privileges that are associated with that role. A user can belong to multiple roles. In this case, the user would inherit the combined privileges that are defined for all roles.

To set up security roles, define the role, assign dimension and metric access privileges to the role, and then assign users to the role. The following diagram depicts this process.

Process flow - security role setup

If you have established security roles for your PeopleTools security, you can import the roles into the EPM database using the Run Security Processing page.

See Processing Your Security Parameters.

EPM security also enables you to define access privileges for individual users. To set up user access privileges, assign dimension and metric access privileges to a specific user.

Dimension Security and Individual, Constraint, and Tree Based Selections

EPM security provides three methods to specify row-level security for your dimension:

• Individual-based definition: Enables you to specify row-level security using the setID and dimension key fields.

• Constraint-based definition: Enables you to specify row-level security by associating a constraint with a dimension table.

  The constraint limits access to a dimension by acting as the WHERE clause in a SQL statement—for example, SELECT Account ID FROM Account Dimension WHERE Account ID = Northwest.

  Set ID and Constraint ID are used to specify constraint access.

• Tree-based definition: Enables you to specify row-level security using existing tree hierarchies that are defined for a dimension.

  You can use the tree to grant a user access to specific nodes, leaves, or details in the tree. Tree hierarchy use is limited to OWE tables only.

Processing Role and User Based Security Parameters

After the security rules have been set up, the EPM security application engine (PF_SECURITY) process must be run. This processes the access as defined in the Role Dimension access pages and flattens the data to the individual dimension members and populates the security join tables specified in dimension metadata.

Pages Used to Establish Role and User-Based Security

Defining Security Roles

Access the Define EPM Security Roles page (EPM Foundation, EPM Security, Security By Role, Define EPM Security Roles).

EPM Security Role	Displays the name of the security role that you are defining.
Role Type	Displays the type of role that is being defined. Possible role types include EPM Role, System Role, User Role, WFA Generated Role.

Users in This EPM Security Role

Granting Metric Access to a Security Role

Access the Access To Metric page (EPM Foundation, EPM Security, Security By Role, Role Metric Access, Access To Metric).

Metric ID	Displays the metric that you are associating with a particular security role.
Record Name	Displays the record that is associated with the selected metric.
Column Name	Displays the column that is associated with the selected metric.

Granting Dimension Access to a Security Role

Access the Role Dimension Access page (EPM Foundation, EPM Security, Security By Role, Role Dimension Access, Role Dimension Access).

Dimension	Displays the dimension that you are associating with a particular security role.
Warehouse	Displays the warehouse layer that is associated with the selected dimension.

Type of Access

Granting Individual Row-Level Access to a Role

Access the Individual Selection page (EPM Foundation, EPM Security, Security By Role, Role Dimension Access, Individual Selection).

Dimension	Displays the dimension that you are associating with a particular security role.
Warehouse	Displays the warehouse layer that is associated with the selected dimension.

Dimension Values

Granting Constraint-Based Row-Level Access to a Role

Access the Constraint-based Selection page (EPM Foundation, EPM Security, Security By Role, Role Dimension Access, Constraint-based Selection).

Dimension	Displays the dimension that you are associating with a particular security role.
Warehouse	Displays the warehouse layer that is associated with the selected dimension.

Constraint-based Selection

Specifying Constraint Columns for Constraint-Based Row-Level Access

Access the Select Security Column page (Automatically accessed when you select a constraint on the Constraint-based Selection page that contains two or more columns and the system cannot distinguish the column you want to include in your security parameters).

When you select a constraint (on the Constraint-based Selection page) that contains two or more columns and the system cannot distinguish the column you want to include in your security parameters, the Select Security Column page is accessed automatically. The page displays the columns available to use in the constraint you selected. You must choose just one of the columns for the constraint. Select the column you want to include by clicking the column name in the Key ID field.

Granting Tree-Based Row-Level Access to a Role (OWE Dimension Only)

Access the Tree-based Selection page (EPM Foundation, EPM Security, Security By Role, Role Dimension Access, Tree-based Selection ).

Dimension	Displays the dimension that you are associating with a particular security role.
Warehouse	Displays the warehouse layer that is associated with the selected dimension.

Select Tree Values

Assigning Users to a Security Role

Access the User Role Access page (EPM Foundation, EPM Security, Security By User, User Role Access).

User ID	Displays the user for whom you are granting role access.
EPM Security Role Name	Enter the security role that you want to associate with the selected user.

Viewing Security Summary for a Security Role

Access the Role Security Summary page (EPM Foundation, EPM Security, Security By Role, Role Security Summary).

EPM Security Role Name

Enter the security role for which you want to see a summary of access privileges.

Dimension

Metrics

Click the Edit Metric Access link to access the Role Metric Access page and edit the security role's access to a metric.

Review Role Dimension Access Summary

Access the Review Role Dimension Access page (Click the Details link on the Role Security Summary page.).

Use this page to review additional details about your dimension that is associated with a particular security role.

Granting Metric Access to a User

Access the Access to Metric page (EPM Foundation, EPM Security, Security By User, User Metric Access, Access To Metric).

The fields on this page are identical to the fields on the Access to Metric page for security roles. The only difference is that the fields on this page represent individual user access privileges and not a security role.

Granting Dimension Access to a User

Access the User Dimension Access page (EPM Foundation, EPM Security, Security By User, User Dimension Access, User Dimension Access).

The fields on this page are identical to the fields on the Role Dimension Access page. The only difference is that the fields on this page represent individual user access privileges and not a security role.

Granting Individual Row-Level Access to a User

Access the Individual Selection page (EPM Foundation, EPM Security, Security By User, User Dimension Access, Individual Selection).

The fields on this page are identical to the fields on the Individual Selection page for security roles. The only difference is that the fields on this page represent individual user access privileges and not a security role.

Granting Constraint-Based Row-Level Access to a User

Access the Constraint-based Selection page (EPM Foundation, EPM Security, Security By User, User Dimension Access, Constraint-based Selection).

The fields on this page are identical to the fields on the Constraint-based Selection page for security roles. The only difference is that the fields on this page represent individual user access privileges and not a security role.

Granting Tree-Based Row-Level Access to a User (OWE Dimension Only)

Access the Tree-based Selection page (EPM Foundation, EPM Security, Security By User, User Dimension Access, Tree-based Selection).

The fields on this page are identical to the fields on the Tree-based Selection page for security roles. The only difference is that the fields on this page represent individual user access privileges and not a security role.

Viewing Security Summary for a User

Access the User Security Summary page (EPM Foundation, EPM Security, Security By User, User Security Summary).

User ID	Enter the user for which you want to see a summary of access privileges.
Display Summary	Click to display security details for the user and refresh the view.

Dimension

Metrics

Click the Edit Metric Access link to access the User Metric Access page and edit the user's access to a metric.

Roles

Review User Dimension or User Metric Access Summary

Access the Review User Dimension Access page (Click the Details link on the User Security Summary page).

The fields on this page are identical to the fields on the Review Role Dimension Access page. The only difference is that the fields on this page represent individual user access privileges and not a security role.

Processing Your Security Parameters

Access the Request Security Processing page (EPM Foundation, EPM Security, Advanced, Request Security Processing).

EPM Role	Enter the EPM security role that you want to process. If you leave this field blank, all security roles are processed. Note. You cannot process a security role and a user at the same time.
User ID	Enter the user you want to process. If you leave this field blank, all users are processed. Note. You cannot process a security role and a user at the same time.
Dimension	Enter the dimension that you want to process. If you leave this field blank, all dimensions are processed.
Warehouse	Enter the warehouse structure that is associated with the dimension you select for processing.
Business Unit	Enter the business unit that you want to process. Business unit is used to determine which record suite is used for the security job.
Jobstream ID	Enter the Jobstream ID for the warehouse security. Note. This jobstream is not secured, all users can access and run it. However, only an adiministrator should run this jobstream.
Rerun Option	Select this check box to rerun the security parameters process.

Copy System Role to EPM

Establishing Security Bridges for Your Business Intelligence Tool

This section provides and overview of security bridges and discusses PeopleSoft delivered Application Programming Interfaces (APIs).

Understanding Security Bridges

Security bridges provide a means to transfer EPM security profiles to your Business Intelligence (BI) database. This enables you to define your security parameters once in EPM without having to redefine them in your BI reporting tool.

Security bridges use Application Programming Interfaces (APIs) to transfer security profiles. APIs use programming commands to interface and communicate with your BI database and transfer EPM security profiles. A set of APIs is required to read data from EPM tables and another set is required to write data to your BI tables.

Security bridge and APIs

PeopleSoft prepackages APIs that are designed to read data from your EPM tables. However, you must create the code that writes data to your BI tables. PeopleSoft APIs are coded in Java and can function with any BI reporting tool.

PeopleSoft delivers the following APIs.

Role Collection

This class is a collection class of individual Role classes. The collection will inherit the normal Java methods to traverse the collection, for example, next(), first() and so forth. Also methods such as add(), remove() can be used and implemented as an ArrayList.

Public Methods

Role

This class defines a single Role defined in the EPM row-level security framework.

Public Methods

User Collection

This class contains the same information as the Role Collection class. The only difference is that the values for this class represent user collection and not role collection.

User

This class contains information about a single User defined in EPM Security.

Public Methods

Dimension Collection

This class contains information about the list of dimensions defined as secured dimensions in EPM Security. Each element of the collection is a Dimension class that represents one secured Dimension in the EPM system. The collection will inherit the normal Java methods to traverse the collection, for example, next(), first() and so forth. Also methods such as add(), remove() can be used.

Public Methods

Dimension

This class contains information about a single Dimension defined in the EPM database.

Public Methods

MetricCollection

This class contains information about metric collection.

Public Methods

Metric

This class contains information about the metrics (columns) setup in EPM Security. This is for the Column-level security.

Public Methods

JDBCConnection

This class is used to connect to a database using a JDBC driver.

Public Methods