1. Administrator's Guide
  2. Setting Up Access Permissions
  3. Managing Security Filters

Managing Security Filters

Access permissions in Oracle Hyperion Planning are stored in the relational database.

If you use other products outside of Planning, such as Oracle Hyperion Financial Reporting or third-party tools, to access Planning data directly in Oracle Essbase, you must push Planning access permissions to Essbase by generating security filters.

To update security filters for selected users, select Administration, then Manage, and then Security Filters. To update security filters simultaneously for all users, select Administration, then Application, then Create Database or Refresh Database, and then Security Filters (see Creating and Refreshing Application Databases).

First validate that the size of security filters does not exceed the Essbase limit of 64 KB per row.

Note:

Oracle recommends that you perform a database refresh with the Security Filters option selected each time a change is made to the outline, including when dynamic child members are added or members are renamed and security is assigned to the new members.

For read and write security filters to be generated in Essbase, users must have read or write access permissions to at least to one member from each secured Planning dimension, including user-defined dimensions. If access is not assigned in these dimensions, the security filter for the user in Essbase is set to None.

To create or update individual security filters:

  1. From Planning, select Administration, then Manage, then Security Filters.
  2. Select the users whose security filters you want updated.
  3. Click Create.

    Essbase creates an encrypted file (essbase.sec) to store access permissions information.

Notes:

  • If you want planners and interactive user types to have write access directly to Planning data in Essbase, assign them the role "Essbase Write Access" in Oracle Hyperion Shared Services.

  • After creating or refreshing security filters for a user who has access to dynamic members, the Essbase bucket name is displayed in the filter line for dynamic members instead of the actual member name.