1 Introduction to Security in Oracle Business Intelligence

This chapter introduces the Oracle Business Intelligence security model, discusses the tools used to configure security, and provides a detailed road map for configuring security in Oracle Business Intelligence.

Note:

For a high-level road map for setting up security, see Section 1.1, "High-Level Roadmap for Setting Up Security in Oracle Business Intelligence".

Note:

If you have installed BI Publisher on its own and you plan to use Oracle Fusion Middleware Security, then see "Understanding the Security Model" in Oracle Fusion Middleware Administrator's and Developer's Guide for Oracle Business Intelligence Publisher.

This chapter contains the following sections:

1.1 High-Level Roadmap for Setting Up Security in Oracle Business Intelligence

To set up security in Oracle Business Intelligence, you must do the following:

  1. Read the rest of this chapter to get an overview of security concepts, tools, and terminology.

  2. Learn about users, groups, and application roles by reading the summary in Section 2.1, "Working with Users, Groups, and Application Roles".

  3. Decide which authentication provider to use to authenticate users.

  4. Set up the required users and groups.

  5. Set up the required application roles.

  6. Assign each group to an appropriate application role.

  7. Fine-tune the permissions that users and groups have in the Oracle BI repository.

  8. Fine-tune the permissions that users and groups have in the Oracle BI Presentation Catalog.

  9. If required, configure Single Sign-On (SSO).

  10. If required, configure Secure Sockets Layer (SSL).

For a detailed list of setup steps, see Section 1.7, "Detailed List of Steps for Setting Up Security in Oracle Business Intelligence".

1.2 Overview of Security in Oracle Business Intelligence

Oracle Business Intelligence 12c is tightly integrated with the Oracle Fusion Middleware Security architecture and delegates core security functionality to components of that architecture. Specifically, any Oracle Business Intelligence installation makes use of the following types of security providers:

  • An authentication provider that knows how to access information about the users and groups accessible to Oracle Business Intelligence and is responsible for authenticating users.

  • A policy store provider that provides access to application roles and application policies, which forms a core part of the security policy and determines what users can and cannot see and do in Oracle Business Intelligence.

  • A credential store provider that is responsible for storing and providing access to credentials required by Oracle Business Intelligence.

By default, an Oracle Business Intelligence installation is configured with an authentication provider that uses the Oracle WebLogic Server embedded LDAP server for user and group information. The Oracle Business Intelligence default policy store provider and credential store provider store credentials, application roles and application policies in a database.

After installing Oracle Business Intelligence you can reconfigure the domain to use alternative security providers, if desired. For example, you might want to reconfigure your installation to use an Oracle Internet Directory, Oracle Virtual Directory, Microsoft Active Directory, or another LDAP server for authentication. You might also decide to reconfigure your installation to use Oracle Internet Directory, rather than a database, to store credentials, application roles, and application policies.

Several Oracle Business Intelligence legacy authentication options are still supported for backward compatibility. The best practice is to perform authentication and authorization using an identity store and authentication provider through the default security model described in this chapter. However, there are certain scenarios where this is not possible or where certain aspects of the legacy approach to authentication and authorization are required. Typically the use of these alternative methods requires that your user population and groups are not held in the identity store referenced by the authentication provider configured in the Oracle WebLogic domain. Consequently, when using alternative authentication methods, several sections of this chapter are not relevant. Instead, refer to Appendix A, "Legacy Security Administration Options". Note that application roles described in this chapter are still used with alternative authentication and authorization mechanisms.

1.3 About Authentication

Each Oracle Business Intelligence 12c installation has an associated Oracle WebLogic Server domain. Oracle Business Intelligence delegates user authentication to the authentication providers configured for that domain.

The default authentication provider accesses user and group information that is stored in the LDAP server that is embedded in the Oracle WebLogic Server domain for Oracle Business Intelligence. You can use the Oracle WebLogic Server Administration Console to create and manage users and groups in the embedded LDAP server.

You might choose to configure an authentication provider for an alternative directory. You can use the Oracle WebLogic Server Administration Console to view the users and groups in the directory. However, you must continue to use the appropriate tools to make any modifications to the directory. For example, if you reconfigure Oracle Business Intelligence to use Oracle Internet Directory (OID), you can view users and groups in Oracle WebLogic Server Administration Console but you must manage them using the OID Console. Refer to the BI certification matrix for information on supported LDAP directories.

For more information about managing users and groups in the embedded LDAP server, see Chapter 2, "Managing Security Using a Default Security Configuration".

For more information about Oracle WebLogic Server domains and authentication providers, see Oracle Fusion Middleware Securing Oracle WebLogic Server.

1.4 About Authorization

After a user has been authenticated, the next critical aspect of security is ensuring that the user can do and see what they are authorized to do and see. Authorization for Oracle Business Intelligence 12c is controlled by a security policy defined in terms of application roles.

1.4.1 About Application Roles

Instead of defining the security policy in terms of users in groups in a directory server, Oracle Business Intelligence uses a role-based access control model. Security is defined in terms of application roles that are assigned to directory server groups and users. For example, application roles BIServiceAdministrator, BI Consumer, and BIContentAuthor.

Application roles represent a functional role that a user has, which gives that user the privileges required to perform that role. For example, having the Sales Analyst application role might grant a user access to view, edit and create reports on a company's sales pipeline.

This indirection between application roles and directory server users and groups allows the administrator for Oracle Business Intelligence to define the application roles and policies without creating additional users or groups in the corporate LDAP server. Instead, the administrator defines application roles that meet the authorization requirements and assigns those roles to preexisting users and groups in the corporate LDAP server.

In addition, the indirection afforded by application roles allows the artifacts of a business intelligence system to be easily moved between development, test and production environments. No change to the security policy is needed and all that is required is to assign the application roles to the users and groups available in the target environment.

Figure 1-1 shows an example set of users, groups, and application roles.

Figure 1-1 Example Users, Groups, Application Roles, and Permissions

This diagram is described in surrounding text.

Figure 1-1 shows the following:

  • The group named BIConsumers contains User1, User2, and User3. Users in the group BIConsumers are assigned the application role BIConsumer, which enables the users to view reports.

  • The group named BIContentAuthors contains User4 and User5. Users in the group BIContentAuthors are assigned the application role BIContentAuthor, which enables the users to create reports.

  • The group named BIServiceAdministrators contains User6 and User7. Users in the group BIServiceAdministrators are assigned the application role BIServiceAdministrator, which enables the users to manage responsibilities.

1.4.2 About the Security Policy

The security policy definition is split across the following components:

  • Oracle BI Presentation Services – This defines which catalog objects and Oracle BI Presentation Services functionality can be accessed by which users with specific application roles. Access to functionality is defined in the Managing Privileges page in terms of Oracle BI Presentation Services privileges and access to Oracle BI Presentation Catalog objects is defined in the Permission dialog.

  • Repository – This defines which metadata items within the repository can be accessed by which application roles and users. The Oracle BI Administration Tool is used to define this security policy.

  • Policy Store – This defines which BI Server and Oracle BI Publisher functionality can be accessed by given users or users with given application roles. In the default Oracle Business Intelligence configuration, the policy store is managed using Oracle Enterprise Manager Fusion Middleware Control or by using WebLogic scripting (WLST). For more information about the policy store, see Oracle Fusion Middleware Application Security Guide.

To find out about using these components, see Section 1.6, "Using Tools to Configure Security in Oracle Business Intelligence".

1.5 About Users, Groups, and Application Roles

In Oracle Business Intelligence 12c the author of a BI application is free to define and name the application roles and permission grants for their application as they choose. They are no longer constrained to include the handful of default application roles and permission grants that existed in Oracle BI 11g. However, they can still use a starting set of application roles and permission set grants if they choose.

When you initially configure Oracle Business Intelligence, you will choose to create the initial BI service instance based on either a supplied BI Archive (BAR) file, or an 11g upgrade bundle (see Oracle Fusion Middleware Installation Guide for Oracle Business Intelligence). The set of application roles and memberships that are initially available in your service instance will depend on which BAR file or 11g upgrade bundle you import into your service instance. For more information about the content of a BAR file, see Oracle Fusion Middleware System Administrator's Guide for Oracle Business Intelligence Enterprise Edition. In summary, the security policy imported includes the application role definitions, the application role memberships, permission set definitions, permission definitions, permission set grants, permission grants, plus Presentation Services and repository security policy.

For example, if you select to create your initial BI service instance based on the Sample App Lite BAR file or the Starter BAR file, your initial service instance will import the sample application roles and application policies for that application. This will leave you with a service instance provisioned with similar application roles to what you would see in a new 11g installation.

Alternatively, if you select to create your initial service instance as a clean slate, the system will import a special empty BAR file into your service instance which results in a minimal set of application roles and policies being added to your service instance (just a BIServiceAdministrator application role). You are then able to create your own security policy specific to your own BI application.

If you create your initial service instance by importing an 11g upgrade bundle your service instance will have the same application roles, application role memberships, permissions and permission grants that you had in 11g.

For the purposes of the remainder of this chapter, we will describe the security policy included in the Sample App Lite and Starter BAR files. These BAR files can be used as either examples or starting points for building your own BI applications.

1.6 Using Tools to Configure Security in Oracle Business Intelligence

To configure security in Oracle Business Intelligence, you use the following tools:

Note:

To see an example of using the Oracle Business Intelligence tools to configure the installed users, groups, and application roles, see Section 2.2, "An Example Security Setup of Users, Groups, and Application Roles".

Figure 1-2 summarizes the tools that you use to configure security in an example installation of Oracle Business Intelligence that uses the embedded WebLogic LDAP Server.

Figure 1-2 Summary of Tools for Configuring Security in an Example Installation

This diagram is described in surrounding text.

For more information about managing security, see Chapter 2, "Managing Security Using a Default Security Configuration").

1.6.1 Using Oracle WebLogic Server Administration Console

You use Oracle WebLogic Server Administration Console to manage the WebLogic LDAP Server that you can use to authenticate users and groups.

Oracle WebLogic Server is automatically installed and serves as the default administration server. The Oracle WebLogic Server Administration Console is browser-based and is used, among other things, to manage the embedded directory server.

Note that when you configure Oracle Business Intelligence the initial security configuration uses the embedded Weblogic LDAP directory - the default authenticator - as the Identity Store. However, whereas in 11g the BI installation seeded some specific users and groups into this LDAP directory, in 12c we no longer seed default BI groups into this directory. Consequently, if your application expects LDAP groups such as BIConsumers, BIContentAuthors and BIServiceAdministrators to exist in the Identity Store, you will need to add these groups manually or configure the domain to use a different Identity Store where these groups are already provisioned after the initial BI configuration has finished.

You launch the Oracle WebLogic Server Administration Console by entering its URL into a web browser. The default URL takes the following form: http://hostname:port_number/console. The port number is the same as used for the Administration Server; 9500 is the default port. For more information about using the Oracle WebLogic Server Administration Console, see Oracle Fusion Middleware Oracle WebLogic Server Administration Console Online Help.

To log in to the Oracle WebLogic Server Administration Console:

  1. Display the Oracle WebLogic Server login page by entering its URL into a web browser.

    For example, http://hostname:9500/console.

    Description of wls_login.gif follows
    Description of the illustration ''wls_login.gif''

  2. Log in using the Oracle Business Intelligence administrative user and password credentials and click Login.

    The user name and password were supplied during the installation of Oracle Business Intelligence. If these values have since been changed, then use the current administrative user name and password combination.

    The Administration Console displays.

    Description of wls_adminconsole.gif follows
    Description of the illustration ''wls_adminconsole.gif''

  3. Use the tabs and options in the Domain Structure as required to configure users, groups, and other options.

Note:

If you use an alternative authentication provider, such as Oracle Internet Directory instead of the default the WebLogic LDAP Server, then you must use the alternative authentication provider administration application (for example an administration console) to manage users and groups.

1.6.2 Using Oracle Fusion Middleware Control

Fusion Middleware Control is a web browser-based graphical user interface that enables you to administer a collection of components called a farm. A farm contains Oracle WebLogic Server domains, one Administration Server, one or more Managed Servers, clusters, and the Oracle Fusion Middleware components that are installed, configured, and running in the domain. During configuration of Oracle Business Intelligence an Oracle WebLogic Server domain is created and Oracle Business Intelligence is configured into that domain. The domain is named bi (in Enterprise installations), and is found under the WebLogic Domain folder in the Fusion Middleware Control navigation pane.

You use Oracle Fusion Middleware Control to manage Oracle Business Intelligence security as follows:

  • Manage the application roles and application policies that control access to Oracle Business Intelligence resources.

  • Configure multiple authentication providers for Oracle Business Intelligence.

To log in to Fusion Middleware Control, open a web browser and enter the Fusion Middleware Control URL, in the following format:

http://hostname.domain:port/em

The port number is the number of the Administration Server, and the default port number is 9500.

For more information about using Fusion Middleware Control, see Oracle Fusion Middleware Administrator's Guide.

To use Fusion Middleware Control:

  1. Enter the URL in a web browser. For example:

    http://host1.example.com:9500/em

    The Fusion Middleware Control login page is displayed, as shown in Figure 1-3.

    Figure 1-3 Login Page for Fusion Middleware Control

    Description of Figure 1-3 follows
    Description of ''Figure 1-3 Login Page for Fusion Middleware Control''

  2. Enter the system administrator user name and password and click Login.

    This system-wide administration user name and password was specified during the installation process, and you can use it to log in to Oracle WebLogic Server Administration Console, Fusion Middleware Control, and Oracle Business Intelligence.

    Alternatively, enter any other user name and password that has been granted the WEbLogic Global Admin role.

    Fusion Middleware Control opens, as shown in Figure 1-4.

    Figure 1-4 Main Page in Fusion Middleware Control

    Description of Figure 1-4 follows
    Description of ''Figure 1-4 Main Page in Fusion Middleware Control''

  3. From the main page, click the target navigation icon in the top left of the page, then expand the Business Intelligence folder.

  4. Select biinstance to display pages specific to Oracle Business Intelligence.

  5. Manage Oracle Business Intelligence security using Fusion Middleware Control as follows:

1.6.3 Using Oracle BI Administration Tool

You use the Oracle BI Administration Tool to configure permissions for users and application roles against objects in the metadata repository.

To use the Administration Tool:

  1. Log in to the Administration Tool.

    Note:

    If you log in to the Administration Tool in online mode, then you can view all users from the WebLogic Server. If you log in to the Administration Tool in offline mode, then you can only view references to users that have previously been assigned metadata repository permissions directly in the RPD. Please note that best practice is to assign metadata repository permissions to application roles rather than directly to users.

  2. (Optional) Select Manage, then Identity to display the Identity Manager dialog.

    Figure 1-5 shows the Identity dialog.

    Figure 1-5 Identity Manager Dialog

    This screenshot is described in surrounding text.

    If you double-click an application role to display the Application Role <Name> dialog, then click Permissions, you can use the Object Permissions tab to view or configure (in the repository) the Read and Write permissions for that application role, in relation to objects and folders in the Oracle BI Presentation Catalog.

    This screenshot is described in surrounding text.

  3. Close Identity Manager.

  4. In the Presentation pane, expand a folder, then right-click an object to display the Presentation Table <Table name> dialog.

  5. Click Permissions to display the Permissions <Table name> dialog.

    Figure 1-6 shows users and some application roles and the radio buttons Read, Read/Write, No Access, and Default that you use to set the permissions for the application roles.

    Figure 1-6 Permissions Dialog Showing Application Roles

    This screenshot is described in surrounding text.

1.6.4 Using Presentation Services Administration

You use the Presentation Services Administration page to configure user privileges.

To use the Presentation Services Administration page:

  1. Log in to Oracle Business Intelligence with Administrator privileges.

  2. Select the Administration link to display the Administration page.

  3. Select the Manage Privileges link.

    Figure 1-7 shows application roles listed against the privileges to which they are assigned.

    Figure 1-7 Manage Privileges Page in Presentation Services Administration Showing Application Roles

    This screenshot is described in surrounding text.

  4. Select a link (for example BIContentAuthor) for a particular privilege (for example, Access to KPI Builder), to display the Privilege <Privilege name> dialog.

    This screenshot is described in surrounding text.

  5. Click the Add users/roles icon (+) to display the Add Application Roles, Catalog Groups, and Users dialog.

    Use this dialog to assign application roles (for example, BIServiceAdministrator, BIContentAuthor, and BIConsumer) to this privilege.

    Please note that best practice is to assign Presentation Services permissions to application roles rather than directly to users.

    This screenshot is described in surrounding text.

1.7 Detailed List of Steps for Setting Up Security in Oracle Business Intelligence

This section explains how to set up security in a new installation of Oracle Business Intelligence. Some tasks are mandatory, some are optional, and some are conditionally required depending on the configuration choices that you make. You might also refer to this section if you are maintaining an existing installation of Oracle Business Intelligence.

After you have installed Oracle Business Intelligence, you typically evaluate the product using the sample application. Later, you typically create and develop your own users, groups, and application roles iteratively to meet your business requirements.

After you have installed Oracle Business Intelligence, Oracle recommends that you complete these tasks in the following order:

  1. Read this chapter to get an overview of security concepts, tools, and terminology. In particular, you should familiarize yourself with the Oracle Business Intelligence components and tools for configuring security by reading Section 1.6, "Using Tools to Configure Security in Oracle Business Intelligence"

  2. Learn about users, groups, and application roles by reading the summary in Section 2.1, "Working with Users, Groups, and Application Roles".

  3. Decide which authentication provider to use to authenticate users, as follows:

    • If you want to use the default embedded WebLogic LDAP Server, then follow the tasks listed in Step 4.

    • If you want to reconfigure Oracle Business Intelligence to use an alternative authentication provider such as Oracle Internet Directory (OID), then follow the tasks listed in Step 5.

      Tip:

      Oracle does not recommend using WebLogic Embedded LDAP Server in an environment with more than 1000 users. If you require a production environment with high-availability and scalability, then you should use a directory server such as Oracle Internet Directory (OID) or a third-party directory server.

      For information about where to find the full list of supported authentication providers, see "System Requirements and Certification".

  4. (Embedded WebLogic LDAP Server-specific) If you are using the default embedded WebLogic LDAP Server as the authentication provider, do the following:

    1. Set up the users that you want to deploy as described in Section 2.3.2, "Creating a New User in the Embedded WebLogic LDAP Server".

      For example, if you want to deploy Oracle Business Intelligence to 20 people who need to view analyses, you might create 20 users.

    2. If you want to create new groups, set up the groups that you want to use as described in Section 2.3.3, "Creating a New Group in the Embedded WebLogic LDAP Server".

    3. Assign your users to appropriate groups, as described in Section 2.3.4, "Assigning a User to a Group in the Embedded WebLogic LDAP Server".

    4. Assign groups of users to application roles.

      For detailed steps, see Section 2.3.1, "Assigning a User to a New Group, and a New Application Role".

  5. (Oracle Internet Directory (OID) specific) If you are using OID as the authentication provider, do the following:

    1. Configure OID as the authentication provider as described in Section 3.2, "High-Level Steps for Configuring an Alternative Authentication Provider".

    2. Use your authentication provider tools (for example, OID Console) to create your users and groups as required.

  6. Set up the application roles that you want to deploy as described in Section 2.4.2, "Creating and Deleting Application Roles Using Fusion Middleware Control".

    For example, you might use BIConsumer, BIContentAuthor, and BIServiceAdministrator, or you might create your own application roles.

  7. (Optional) If you do not want to use existing application policies, you can set up the application policies that you want to deploy as described in Section 2.4.3, "Creating Application Policies Using Fusion Middleware Control".

    For example, you might use the application policies that are used by the sample application roles BIConsumer, BIContentAuthor, and BIServiceAdministrator, or you might create your own application policies.

  8. Assign each group to an appropriate application role, as follows:

  9. If you want to fine-tune the permissions that users and groups have in the Oracle BI repository, use the Administration Tool to update the permissions as described in Section 2.5, "Managing Metadata Repository Privileges Using the Oracle BI Administration Tool".

    For example, you might want to enable an application role called BISuperConsumer to create analyses, so you use the Administration Tool to change the Read access to a subject area to Read/Write access.

    Note:

    If you are using the default SampleAppLite.rpd file in a production system, you should change the password from its installed value, using the Administration Tool. For more information about the SampleAppLite repository file, see Oracle Fusion Middleware Metadata Repository Builder's Guide for Oracle Business Intelligence Enterprise Edition.

  10. If you want to fine-tune the permissions that users and groups have in the Presentation Services Administration page to change the permissions as described in Section 2.6, "Managing Presentation Services Privileges Using Application Roles".

    For example, you might want to prevent an application role called BISuperConsumer from viewing scorecards, so you use Presentation Services Administration Page to change the Scorecard\View Scorecard privileges for BISuperConsumer from Granted to Denied.

  11. If you want to deploy Single Sign-On, follow the steps in Chapter 4, "Enabling SSO Authentication".

  12. If you want to deploy secure sockets layer (SSL), follow the steps in Chapter 5, "Configuring SSL in Oracle Business Intelligence".

    Oracle Business Intelligence is installed with SSL turned off. If you want to deploy Oracle Business Intelligence in an SSL environment, follow the steps in Chapter 5, "Configuring SSL in Oracle Business Intelligence".

1.8 Comparing the Oracle Business Intelligence 11g and 12c Security Models

The Release 11g and Release 12c security models differ in the following ways:

  • BI System User - in Oracle Business Intelligence 11g a BI System User was used for inter-process communication and when impersonating BI users. In Oracle Business Intelligence 12c internal trust mechanisms replace this functionality and the BI System User is no longer required or provisioned.

  • Application security policies - In Oracle Business Intelligence 11g a default BI installation provisioned a default security policy in a file. Oracle Business Intelligence 12c uses a database policy store and the active security policy is imported from a BI Application Archive file or amended directly in the service instance.

  • Permissions and permission sets - in 11g the policy store specifies permissions which are (typically) assigned to application roles. In 12c a collection of Permission Sets have been added to collect together permissions that are typically assigned together as an entitlement. Permissions are still available, but in 12c Permission Sets are the preferred unit for assigning permissions to application roles.

  • User GUIDs - in Oracle Business Intelligence 11g user GUIDs were referenced at login and for security lookups in order to prevent inadvertent re-use of UserIds. In Oracle Business Intelligence 12c the user GUIDs are no longer referenced. Instead a cleaner approach to deleting a user from BI has been introduced. Refer to Section 2.9, "Deleting a User".

The following aspects of the Oracle Business Intelligence Release 11g security model remain in Release 12c:

1.9 Terminology

The following terms are used throughout this guide:

Application Policy

Oracle Business Intelligence permissions are granted by its application roles. In the default security configuration, each role conveys a predefined set of permissions. An application policy is a collection of Java EE and JAAS policies that are applicable to a specific application. The application policy is the mechanism that defines the permissions each application role grants. Permission grants are managed in the application policy corresponding to an application role.

Application Role

Represents a role a user has when using Oracle Business Intelligence. Is also the container used by Oracle Business Intelligence to grant permissions to members of a role. Application roles are managed in the policy store provider.

Authentication

The process of verifying identity by confirming the credentials presented during log in.

Authentication Provider

A security provider used to access user and group information and responsible for authenticating users. Oracle Business Intelligence default authentication provider is Oracle WebLogic Server embedded directory server and is named DefaultAuthenticator.

Authorization

The process of granting an authenticated user access to a resource in accordance to their assigned privileges.

Catalog Groups

A Catalog group is defined locally in Oracle BI Presentation Services and is used to grant privileges in the Oracle Business Intelligence user interface in addition to granting Oracle BI Presentation Catalog permissions.

Catalog Permissions

These rights grant access to objects that are stored in the Oracle BI Presentation Catalog. The rights are stored in the catalog and managed by Presentation Services.

Catalog Privileges

These rights grant access to features of the Oracle BI Presentation Catalog. The rights are stored in the catalog and managed by Presentation Services. These privileges are either granted or denied.

Credential Store

An Oracle Business Intelligence credential store is a file used to securely store system credentials used by the software components. This file is automatically replicated across all machines in the installation.

Credential Store Provider

The credential store is used to store and manage credentials securely that are used internally between Oracle Business Intelligence components. For example, SSL certificates are stored here.

Encryption

A process that enables confidential communication by converting plain text information (data) to unreadable text which can be read-only with the use of a key. Secure Sockets Layer (SSL) enables secure communication over TCP/IP networks, such as web applications communicating through the Internet.

Impersonation

Impersonation is a feature used by Oracle Business Intelligence components to establish a session on behalf of a user without employing the user's password. For example, impersonation is used when Oracle BI Scheduler executes an Agent.

Oracle WebLogic Server Domain

A logically related group of Oracle WebLogic Server resources that includes an instance known as the Administration Server. Domain resources are configured and managed in the Oracle WebLogic Server Administration Console. For more information, see Section B.2.2, "Oracle WebLogic Server Domain".

Identity Store

An identity store contains user name, password, and group membership information. In Oracle Business Intelligence, the identity store is typically a directory server and is what an authentication provider accesses during the authentication process. For example, when a user name and password combination is entered at log in, the authentication provider searches the identity store to verify the credentials provided. Oracle Business Intelligence can be re-configured to use alternative identity stores. For a complete list, see System Requirements and Certification.

Permission Set

Represents a set of permissions.

Policy Store Provider

The policy store is the repository of system and application-specific policies. It holds the mapping definitions between the default Oracle Business Intelligence application roles, permissions, users and groups all configured as part of installation. Oracle Business Intelligence permissions are granted by assigning users and groups from the identity store to application roles and permission grants located in the policy store.

Policy Store

Contains the definition of application roles, application policies, and the members assigned (users, groups, and application roles) to application roles. The default policy store is a file that is automatically replicated across all machines in an Oracle Business Intelligence installation. A policy store can be database-based or LDAP-based.

Secure Sockets Layer (SSL)

Provides secure communication links. Depending upon the options selected, SSL might provide a combination of encryption, authentication, and repudiation. For HTTP based links the secured protocol is known as HTTPS.

Security Policy

The security policy defines the collective group of access rights to Oracle Business Intelligence resources that an individual user or a particular application role have been granted. Where the access rights are controlled is determined by which Oracle Business Intelligence component is responsible for managing the resource being requested. A user's security policy is the combination of permission and privilege grants governed by the following elements:

  • Oracle BI Presentation Catalog:

    Defines which Oracle BI Presentation Catalog objects and Oracle BI Presentation Services functionality can be accessed by users. Access to this functionality is managed in Oracle Business Intelligence user interface. These permissions and privileges can be granted to individual users or by membership in corresponding application roles.

  • Repository File:

    Defines access to the specified metadata within the repository file. Access to this functionality is managed in the Oracle BI Administration Tool. These permissions and privileges can be granted to individual users or by membership in corresponding application roles.

  • Policy Store:

    Defines which Oracle Business Intelligence, Oracle BI Publisher, and Oracle Real-Time Decisions functionality can be accessed. Access to this functionality is managed in Oracle Enterprise Manager Fusion Middleware Control. These permissions and privileges can be granted to individual users or by membership in corresponding application roles.

Security Realm

During deployment an Oracle WebLogic Server domain is created and Oracle Business Intelligence is deployed into that domain. Security for an Oracle WebLogic Server domain is managed in its security realm. A security realm acts as a scoping mechanism. Each security realm consists of a set of configured security providers, users, groups, security roles, and security policies. Only one security realm can be active for the domain. Oracle Business Intelligence authentication is performed by the authentication provider configured for the default security realm for the WebLogic Server domain in which it is installed. Oracle WebLogic Server Administration Console is the Administration Tool for managing an Oracle WebLogic Server domain.

Single Sign-On

A method of authorization enabling a user to authenticate once and gain access to multiple software application during a single browser session.

Users and Groups

A user is an entity that can be authenticated. A user can be a person, such as an application user, or a software entity, such as a client application. Every user is given a unique identifier within in the identity store.

Groups are organized collections of users that have something in common. A group is a static identifier that is assigned by a system administrator. Users organized into groups facilitate efficient security management. There are two types of groups: an LDAP group and a Catalog group. A Catalog group is used to support the existing user base in Presentation Services to grant privileges in the Oracle Business Intelligence user interface. Using Catalog groups is not considered a best practice and is available for backward compatibility in upgraded systems.