7 Managing Users and Roles

This chapter contains the following sections:

• Section 7.1, "Creating Users and Assigning Roles"

• Section 7.2, "Configuring BIP Roles and Permissions"

• Section 7.3, "Fusion Middleware Security Model"

• Section 7.4, "Creating Application Policy"

• Section 7.5, "Configuring BIP Users and Roles: Oracle Fusion Middleware Security Model"

7.1 Creating Users and Assigning Roles

To create users and assign them roles:

1. Log in to BI Publisher using your administrator credentials. Navigate to the Administration page. Click and navigate to the Users page.

   Figure 7-1 Administration Page

   
   Description of "Figure 7-1 Administration Page"
   
   

2. Click Create Users.

   Figure 7-2 Create Users Page

   
   Description of "Figure 7-2 Create Users Page"
   
   

3. Enter a user name and password and click Apply. The system creates a new user.

   Figure 7-3 Apply Button

   
   Description of "Figure 7-3 Apply Button"
   
   

4. To assign roles to the user, click the Assign Roles icon corresponding to the new user.

   Figure 7-4 Assign Roles Icon

   
   Description of "Figure 7-4 Assign Roles Icon"
   
   

5. The Assign Roles screen appears and displays the BIP system roles. These are:

   • BI Publisher Administrator

   • BI Publisher Excel Analyzer

   • BI Publisher Online Analyzer

   • BI Publisher Developer

   • BI Publisher Scheduler

   • BI Publisher Template Designer

     These roles are available by default along with the custom roles you create.

     Figure 7-5 Available Roles Screen

     
     Description of "Figure 7-5 Available Roles Screen"
     
     

In Figure 7-5, ASAdmin and BIAdmin are custom roles.

Select a role from the Available Roles section and click Move (>) to move the selected role to the Assigned Roles section. Click Apply. This assigns the selected roles to the user.

7.1.1 Creating Custom Roles

This section describes the steps to create custom roles and assign data sources to them.

1. Log in to BI Publisher using your administrator credentials. Navigate to the Administration page. Click and navigate to the Roles and Permissions page.

   Figure 7-6 Roles and Permissions Screen

   
   Description of "Figure 7-6 Roles and Permissions Screen"
   
   

2. On the Roles and Permissions page, click Create Role.

   Figure 7-7

   
   Description of "Figure 7-7 "
   
   

3. On the Create Role page, provide a role name and description and click Apply. This creates the new custom role.

   Figure 7-8 Create Role Screen

   
   Description of "Figure 7-8 Create Role Screen"
   
   

   You can now view the new role.

   Figure 7-9 Role Name Screen

   
   Description of "Figure 7-9 Role Name Screen"
   
   

4. To assign data sources to the created role, click the Add Data Sources icon.

   Figure 7-10 Add Data Sources Icon

   
   Description of "Figure 7-10 Add Data Sources Icon"
   
   

5. Select a data source from the Available Data Sources section, and click Move (>) to add it to the Allowed Data Sources section.

   Figure 7-11 Add Data Source Screen

   
   Description of "Figure 7-11 Add Data Source Screen"
   
   

   Click Apply.

6. To assign the required roles to the custom role, click Add Roles.

   Figure 7-12 Add Roles Icon

   
   Description of "Figure 7-12 Add Roles Icon"
   
   

7. On the Add Roles page, select the roles to be included from Available Roles, and click Move (>) to add the selected roles to Included Roles.

   Figure 7-13 Available and Included Roles

   
   Description of "Figure 7-13 Available and Included Roles"
   
   

   When you are done, click Apply.

7.2 Configuring BIP Roles and Permissions

This section explains a sample set of user types and corresponding roles that can be created. You can utilize this sample to enhance security as needed.

7.2.1 Out-of-the-box BIP Configuration

Argus Safety BI Publisher Periodic Reports contain the following folders in an out-of-the-box installation.

• Main Argus Safety folder under the Shared folders

  • Cover Trailer

  • PBRER

  • PMAR

  • DSUR

Each report (except the cover trailer) contains two sub-sections—one for the data model and the other for reports.

Table 7-1 describes the three types of Argus Safety specific users and roles.

Table 7-1 User and Role Names

User Name	Role Name
ASAdmin	ASAdminRole
ASDataModeler	ASDataModelerRole
ASUsers	ASUserRole

Additionally, there is a default BI Admin User for the application. This user is a super user having BIP administration access and can upload to the Argus Safety repository.

Access to the Data Models and Reports folder depends on the user type and the role assigned. The BI publisher also lets you add roles.

For example, a user has been assigned the X role and you add the Y role to the X role. The user now has the privileges of the Y role despite the Y role not being directly assigned to the user.

Table 7-2 describes the relationships of users, roles, and privileges.

Table 7-2 Users, Roles and Privileges

Name of the user/role	Users/Roles to be added	Description
BI Admin User	BI Administration (Functional Role)	Can upload to the Argus Safety repository and works as a super user who has BIP Administration access.
ASAdminRole	ASDataModelerRole	Has complete access to the Argus Safety Folder.
ASAdminRole Users	ASAdminRole	Has complete access to the Argus Safety folder
ASDataModelerRole	BIAuthor (Functional Role) or BI Publisher Developer (in BIP Standalone system) or ASUserRole	Has access to the Argus Safety Data Models and Reports folders.
ASDataModeler Users	ASDataModelerRole	Has access to Argus Safety Data Models and Reports folders.
ASUserRole	BIReportWriter (Functional Role) or BITemplate Designer role (in BIP Standalone system)	Has read-only access to the Argus Safety Data Models folder and complete access to the Reports folder.
ASUsers	ASUserRole	Has read-only access to the Argus Safety Data Models folder and complete access to the Reports folder.

7.3 Fusion Middleware Security Model

This section describes the steps to be executed to create users, assign them roles and permissions, and configure server settings for the Oracle Fusion Middleware Security Model.

Configure the BI Publisher server settings for the BI Publisher Security model. However, in this case the security model is the Fusion Middleware Security model.

7.3.1 Creating Roles, Adding Data Sources, and Assigning Roles in WebLogic Enterprise Manager

To create roles, add data sources, and assign roles in the WebLogic Enterprise Manager:

1. Log in to Enterprise Manager. This displays the Enterprise Manager home page with a list of folders in the left pane.

2. Expand the Business Intelligence folder and click coreapplication.

   The coreapplication screen appears in the right pane.

3. Click Configure and Manage Application Roles in the Application Policies and Roles section.

   The Application Policies and Roles screen appears.

4. Select an application stripe from the Application Stripe drop-down list.

5. Select an existing role (such as BIConsumer) and click Create Like.

   The Create Application Role screen appears.

6. Enter the name of the role in the Role Name field.

7. Enter the display name and description in the Display Name and Description fields. These are optional fields.

8. Click Add to add any existing application role, group or user to the new role.

   The Create Application Role screen appears.

9. Click the > icon near the Display Name field. The list of all the roles, groups, and users created in LDAP server appears.

10. Select the name of a role, group, or user and click OK. For example, for the BIReportWriter role, BIConsumer and authenticated-role are mandatory members.

    
    

    Note: The ASRole must also be a part of the BIReportWriter Role. These roles appear in the Members section of the Create Application Screen. The BIReportWriter role must be added to the BIReportWriter application policy.

    
    

11. Repeat steps 8 to 10 to add additional roles, users, and groups to the new role.

12. Click OK on the Create Application Role screen.

    After you have created the role and added the required list of users, roles, and groups to the new role, you must add the ASBIP data source to the new role.

13. Log in to BIP using your administrator credentials. This displays the BIP Home page.

14. Click Administration.

15. Click Roles and Permissions in the Security Center section.

    The Roles and Permissions screen appears. You can view the name of the new role that you have just created in the list of role names.

16. Click the Add Data Sources icon corresponding to the name of the new role.

    The Add Data Sources screen appears.

17. Select ASBIP from the Available Data Sources section, and click the Move (>) icon to move the ASBIP data source to the Allowed Data Sources section.

    The Add Data Sources screen appears. Click Apply.

    For more information, refer to the Creating Application Roles Using Fusion Middleware Control section of the Oracle BIP Administrator's guide.

7.4 Creating Application Policy

After creating and assigning roles, users, and data sources to the role, you must create the application policy for the new role.

Before creating a BI Publisher Report Writer policy, you must have created an empty role in Enterprise Manager.

Note: The steps mentioned in this section are valid for creating a BIReportWriter application policy.

To create the application policy for the new role:

1. Log in to the Enterprise Manager. This displays the Enterprise Manager home page with a list of folders in the left pane.

2. Expand the Business Intelligence folder in the left pane, and click coreapplication.

   Figure 7-14 Coreapplication Folder

   
   Description of "Figure 7-14 Coreapplication Folder"
   
   

   The coreapplication screen appears in the right pane.

3. Click Configure and Manage Application Policies in the Application Policies and Roles section.

   Figure 7-15 Configure and Manage Application Policies Screen

   
   Description of "Figure 7-15 Configure and Manage Application Policies Screen"
   
   

   The Application Policies screen appears.

4. Select obi from the Application Stripe drop-down list.

5. Select BIAuthor policy and click Create Like.

   Figure 7-16 BIAuthor

   
   Description of "Figure 7-16 BIAuthor "
   
   

   The Create Application Grant Like screen appears with the Grantee and Permissions sections.

6. Click Add in the Grantee section.

   Figure 7-17 Create Application Grant Like Screen

   
   Description of "Figure 7-17 Create Application Grant Like Screen"
   
   

   The Add Principal screen appears.

7. Click the > icon near the Principal Name field to retrieve the list of all available application roles.

   Figure 7-18 Searched Principals Section

   
   Description of "Figure 7-18 Searched Principals Section"
   
   

8. Select the name of the role from the Searched Principals section (for example, BIReportWriter), and click OK. The Create Application Grant Like screen appears.

9. Select the developDataModel Resource Name from the list of Permission Classes and click Delete.

10. Click OK.

7.5 Configuring BIP Users and Roles: Oracle Fusion Middleware Security Model

This section lists the names of the <Admin Users> and roles you need to configure.

7.5.1 BI Admin User

An Admin user has BI Publisher administrative rights. This user belongs to the BIAdministration functional role.

7.5.2 Data Modeler User

An Argus Safety data model user has access to both Data Models and Reports in the Argus Safety folder. This user belongs to the ASDataModeler custom role.

The Enterprise specific modeler users have access to Data Models and Reports in Enterprise specific folders and the Argus Safety folder.

7.5.3 Report Writer User

An Argus Safety Role (ASRole) user has access to Reports and Read-only access to the data model required to create the reports. This user belongs to the ASRole.

Users can have access to reports of specific Enterprises. ASRole users can read or write reports in the Enterprise specific Report and Argus Safety Report folders. However, they have Read-only access to the Data Models in the Enterprise specific Data Model and the Argus Safety Data Model folder. These users belong to Enterprise specific Report roles.

7.5.4 Global Admin User

An AS Admin Role user has complete access to the Argus Safety folder.

An Enterprise specific Admin user has complete access to the Enterprise specific folders and Argus Safety folder.

7.5.5 Configuring BIP Roles

Table 7-3 list the roles that you need to configure using BIP:

Table 7-3 Configuring BIP Roles

Role	Users/Roles to be added
BIAdministration (Functional Role)	Super user having complete access to all folders and BIP Administration access.
ASRole	All Argus Safety role users, ASDataModelerRole, and all Enterprise Report Roles (for specific enterprises).
ASDataModelerRole	All AS Data Modeler Users, all Enterprise Modeler Roles, and ASAdminRole.
Enterprise Report Role	Users belonging to a specific Enterprise with Reports access and Enterprise Modeler Role.
Enterprise Modeler Role	Users belonging to a particular Enterprise with both Data Models and Reports access.
Enterprise Admin Role	Enterprise specific Admin users. User with complete access to Enterprise specific folders.
ASAdminRole	User with complete access to the Argus Safety folder. The Enterprise Admin Role is added to this role.
BIAdministrator (Functional Role)	BI Admin User.
BIAuthor (Functional Role)	ASDataModelerRole.
BIReportWriter	ASRole.

7.5.6 Folder Level Permissions

This section explains the folder level permissions that you can grant using BIP.

For more information, refer to the About Catalog Permissions section in Oracle Administrator's Guide for Oracle BIP.

Table 7-4 Roles and Permissions

Folder	Roles to be added	Permissions
Argus Safety	ASAdminRole	Full access
Argus Safety > General > Data Model	ASDataModelerRole, ASRole	ASDataModelerRole - Full accessASRole - Read, Run, Schedule, and View report
Argus Safety > General > Reports	ASRole	Full access
Argus Safety > CoverPage	ASRole	Full access
Enterprise specific folders	Enterprise Specific Admin Role	Full access
Enterprise Specific Folder -- Data Model	Enterprise Modeler Role, Enterprise Report Role	Enterprise Modeler Role - Full accessEnterprise Report Role - Read, Run, Schedule, and View report
Enterprise Specific Folder - Reports	Enterprise Report Role	Full access