9 Setting Up the Security System

Oracle Life Sciences Data Hub Application Roles

Users need one or more of the predefined application roles to perform their work in Oracle LSH. The predefined nonadministrative Oracle LSH application roles follow. For descriptions of the administrative roles, see "Setting Up Specialized Administrators".

LSH Application User The role on which all other application roles are based.

LSH Consumer Users assigned the LSH Consumer role have access to the Home and Reports tabs in the user interface. Assign this role to users who need to retrieve information from Oracle LSH and/or run Oracle LSH applications to load and transform data. Oracle LSH object security determines which operations these users are allowed to perform on particular applications and reports.

LSH Definer Users assigned the LSH Definer role have access to the same tabs as the LSH Consumer, plus the Applications tab. Assign this role to users who must build, test, or validate Oracle LSH applications. Oracle LSH object security determines which operations these users are allowed to perform on particular defined objects and outputs.

LSH Data Blind Break User Only the LSH Data Blind Administrator can assign this role to users. This role does not provide access to any tabs in the user interface. Users assigned to this role typically also have the LSH Consumer role.

Users with this application role can do the following, if they have normal object security access and the blinding-related object security privilege noted:

• Run a job on Tables with a Blinding Status of Blinded that displays the real data, not the dummy data (also requires an object security role with the Blind Break operation on Table instances)

• View the output(s) generated by a job run on real, blinded data (also requires an object security role with the Blind Break operation on outputs)

LSH Data Unblind User Only the LSH Data Blind Administrator can assign this role to users. This role does not provide access to any tabs in the user interface. Users assigned to this role typically also have the LSH Consumer role.

Users with this application role can do the following, if they have normal object security access and the blinding-related object security privilege noted:

• Permanently unblind data in Table instances (also requires an object security role with the Unblind operation on Table instances)

• Change the status of an output from Blinded to Unblinded (also requires an object security role with the Unblind operation on outputs)

• Note:

  The LSH Data Unblind User application role is not required in conjunction with the Read Unblind operation on either Table instances or outputs. Users can have an object security role that includes the Read Unblind operation on Table instances (to run a job on unblinded Table instances) and/or outputs (to view the results of such a job) without having the LSH Data Unblind User application role as well.

XMLP Roles You can assign the BI Publisher roles (XML Publisher is the old name for Oracle BI Publisher) to Oracle LSH Definers to enable them to create or use Oracle LSH BI Publisher Programs. See "Assigning Application Roles in Oracle LSH" for more information.

Oracle Health Sciences Data Management Workbench Application Roles

Each user must have at least one of the following application roles to access the Oracle DMW user interface.

DMW_STUDY_MANAGER is intended for users who run data loads, transformations, and validation checks. It provides access to the Home, Study Configuration, Listings, and Discrepancies pages.

Users with this role can create, modify, and remove studies in the Home page.

DMW_STUDY_CONFIG is intended for users who set up studies by defining models, transformations, and validation checks. It provides access to the Home, Study Configuration, Listings, and Discrepancies pages.

Users with this role can create, modify, and remove studies in the Home page.

DMW_STUDY_CONSUMER is intended for users who need to review data and raise discrepancies. It provides access to the Home, Listings, and Discrepancies pages.

DMW_LIB_ADMIN is intended for users who create and modify library models and code lists. It provides access only to the Library page.

DMW_SYS_ADMIN is intended for users who do administrative tasks including setting up data sources and defining objects used across studies, such as categories, flags, and tags. It provides access only to the Administration tab.

Creating Object Subtypes

To create a new object subtype, go to the Subtype subtab of the Security tab and do the following:

1. In the Manage Subtype screen, choose either Operation or Role from the View Subtypes drop-down list.

   • Choose Role if you have created a new role and want to add multiple operations to it at the same time. This is the more common situation.

   • Choose Operation if you want to add multiple roles to a single operation on the subtype at the same time.

2. Click the node (+) icon in the Manage column of the object type for which you want to add a Subtype. The Create Subtype screen appears.

3. Enter a name for the Subtype (required, maximum 60 characters). You do not need to include the name of the Object Type in the Subtype name.

4. Click Apply. The system creates the Subtype and the Manage Subtype screen reappears. The new Subtype is automatically created as:

   • Not Active; not available for use in object definition.

   • Not the Default; when a Definer creates an object of this type, this Subtype is not the default Subtype of the new object. See "Default Subtype Behavior" below for further information.

   To change either the Active or Default setting, click the pencil icon in the Update column.

Default Subtype Behavior The subtype you set as the default here is not necessarily the one that all new objects of this type default to. Instead, when a user creates a new object, the system reads the subtype of the object's parent, and if the new object has a subtype with the same name as the parent's, the system creates the new object with the same subtype as its parent. If not, the system uses the default subtype.

For example, if a user creates a new Program instance in a Work Area, and the Work Area's subtype is Clinical, the system checks whether there is a Program instance subtype called Clinical. If there is, the system creates the new Program instance with a subtype of Clinical. If Program instances do not have a subtype called Clinical, the system creates the new Program instance with the subtype defined as the default for Program instances.

The user can change the subtype manually.

Modifying Object Subtypes

To modify a Subtype, click the corresponding Update icon in the Manage Subtype screen.

You can modify the following Subtype characteristics:

• Name

• Is Active. If selected, this Subtype is available for use during definition of objects of this Object Subtype.

• Is Default. If selected, this is the default Subtype for objects of this Object Subtype.

Creating Object Security Roles

To create a Role:

1. In the Security tab, click Roles. The Manage Roles screen appears.

2. Click Create. The Create Role screen appears.

3. Enter values in the following fields:

   • Role Name. Enter a unique name for the role to be displayed in the Oracle LSH user interface.

   • Code Value. Enter a unique code for the role to be used internally by Oracle LSH.

   • Description. Enter a description of the role to help group administrators decide if they want to assign the role to a particular user in their user group.

4. Click Apply. The Manage Roles screen appears. You can query for the role by name to check that it was created successfully.

5. Set it to Active so that it is available for use.

   1. In the Manage Roles screen, query for the role. The role appears.

   2. Click the icon in the Update column. The Update Role screen appears.

   3. Select Is Active and click Apply. You can assign subtype operations only to Active roles.

6. Assign operations on object subtypes to the role. Users assigned to the role within a user group will be able to perform the operations you specify on the object subtypes you specify. See "Assigning Subtype Operations to Roles and Modifying Assignments" for instructions.

Modifying Object Security Roles

In the Manage Roles screen, click the corresponding Update icon to modify a particular Role. After you make the relevant changes, click Apply to save them or click Cancel to discard the changes.

You can modify the following characteristics:

• Role Name. You can change the name of the role that appears in the Oracle LSH user interface.

• Description. You can change the description that appears in the Oracle LSH user interface.

• Is Active. If selected, you can assign the role to operations on object subtypes and a user group administrator can assign the role to a user in his or her user group.

Assigning Roles to Operations

To assign roles to operations, go to the Subtype subtab of the Security tab and do the following:

1. Select Operation from the View Subtype By drop-down list.

2. Expand the node (+) of the object type. All the subtypes appear.

3. Expand the node (+) of the object subtype. All the subtype's operations appear.

4. Click the icon in the Manage column of the operation to which you want to assign or remove a role. The Add Role(s) to Operation screen appears.

5. Double-click on a role in the Available Roles column to move it into the Selected Roles column and assign it to the role. Or move it from Selected Roles to Available Roles to remove the assignment.

   You can also select multiple roles by using Shift+Click or Control+Click and use the arrows to move one, a few, or all at once to the column in the shuttle.

   You can change the order of the operations using the Up and Down arrows on the right. The display order has no functional effect.

6. Click Apply. The system assigns the role(s) to the operation on the subtype and the Manage Subtype screen appears.

Modifying Operation Assignments to Roles

To modify assignments, go to the Subtype subtab of the Security tab and do the following:

1. Select Role from the View Subtype By drop-down list.

2. Expand the node (+) of the object type. All the subtypes appear.

3. Expand the node (+) of the object subtype. All the roles currently assigned to any operation on the subtype appear.

4. Click the icon in the Manage column of the role whose assignments you want to modify. The Add Operation for Role screen appears.

5. Double-click on an operation in the Available Operations column to move it into the Selected Roles column and assign it to the role.

   You can also select multiple operations by using Shift+Click or Control+Click and use the arrows to move one, a few, or all at once to the column in the shuttle.

   You can change the order of the operations using the Up and Down arrows on the right. The display order has no functional effect.

6. Click Apply. The system adds the operations to the role for the subtype and the Manage Subtype screen appears.

Notes on Particular Object Types

Some object types require some explanation:

• Execution Setups. To delete or modify an Execution Setup, a user must also have Modify privileges on the object instance that owns the Execution Setup. Therefore, any role you assign to Remove or Modify Execution Setups, you should also assign to Modify the type executable object whose Execution Setup it can remove or modify.

• Adapter Domains and Adapter Areas. These include all the same operations that Domains and Application Areas have. However, only view operations on some objects are required; see "Creating Roles with the Required Operations for Adapters".

Creating User Groups

To create a new user group:

1. In the Security tab, click User Groups. The Manage User Groups screen appears.

2. Click Create. The Create User Group screen appears.

3. Enter values in the following fields:

   • Group Name

   • Description

   • Is Active. If selected, you can assign the user group to an object subtype.

4. Click Apply. The Manage User Group screen appears.

You must assign at least one role to a user group. See Step 5 of "Adding Supported Roles to User Groups".

Adding Supported Roles to User Groups

The roles you add to a user group become available for the Group Administrator to assign to users within that user group.

To add roles to a user group:

1. In the Security tab, click User Groups. The Manage User Groups screen appears.

2. Type the name of the user group for which you want to add roles in the user group box.

3. Click Search. All the user groups matching the search criteria appear.

4. Click the required user group. The Group screen appears.

5. Click Add and Remove Role. The Add a Default Role to Group screen appears.

6. Double-click on a role in the Available Roles column to move it into the Selected Roles column.

   You can also select multiple Roles by using Shift+Click or Control+Click and use the arrows to move one, a few, or all at once to the column in the shuttle.

   You can change the order of the Roles using the Up and Down arrows on the right.

7. Click Apply. The system assigns all the roles displayed in the Selected Roles column to this user group and returns to the Group screen.

Assigning a Group Administrator to the User Group

The Group Administrator is responsible for adding and removing users to a particular user group, and changing users' role assignments within the group.

You must have the LSH Security Admin or LSH Function Security Admin role to assign the LSH Group Admin role to a user.

To assign a Group Administrator to a user group:

1. Select the Life Sciences Data Hub responsibility in the navigator and click the Users Groups subtab. The Manage User Groups screen appears.

2. Search for and select the required group.

3. Click Expand All. All the supported roles appear.

4. Click the Add User icon corresponding to the LSH Group Administrator role. The Search and Select Users to Add to Role screen appears.

5. Search for and select the users who need to be LSH Group Administrators for this User Group.

6. Click Select. The system assigns the LSH Group Administrator role to the selected users and the Group screen appears.

   Note:

   Group Administrators must have the Group Admin application role assigned. See Assigning Application Roles.

Duplicating User Groups

You can create copies of a user group in two ways. Either you can duplicate only the user group definition with its supported roles or you can duplicate the definition with its supported roles and also the users assigned to it and their role assignments. When you duplicate a user group, the system appends 'Copy of' to the name of the user group. For example, if you duplicate a user group named Study01 User Group, the system names the new user group Copy of Study01 User Group.

Duplicate Definition with Roles Only To duplicate only the user group definition with its roles:

1. In the Security tab, click User Groups. The Manage User Groups screen appears.

2. Enter a search string—the name of the user group you want to duplicate in the User Group box or text with the wildcard %, or leave blank to retrieve all user groups.

3. Click Go. All the user groups matching the search criteria appear.

4. Click the Select check box corresponding to the required user group.

5. Click Duplicate with Roles. The system creates a copy of the user group and the Manage User Groups screen appears.

Duplicate Definition with Roles and Users To duplicate the definition with its roles and assigned users:

1. In the Security tab, click User Groups. The Manage User Groups screen appears.

2. Type the name of the user group you want to duplicate the User Group box.

3. Click Search. All the user groups matching the search criteria appear.

4. Click the Select check box corresponding to the required user group.

5. Click Duplicate with Roles, Users. The system creates a copy of the user group and the Manage User Groups screen appears.

Modifying User Groups

In the Manage User Groups screen, click the corresponding Update icon to modify a particular User Group. After you make the relevant changes, click Apply to save them or click Cancel to discard the changes.

You can modify the following characteristics:

• Group Name

• Description

• Is Active. If selected, you can assign the User Group to an Object Subtype.

You can also add and remove Roles from the User Group; see "Adding Supported Roles to User Groups".