Embedding External Content in Dashboards

For security reasons, you can no longer embed content from external domains in dashboards. To embed external content in dashboards, you must edit the instanceconfig.xml file.

1. Open the instanceconfig.xml file for editing, located in:

   ORACLE_HOME/user_projects/domains/bi/config/fmwconfig/biconfig/OBIPS

2. Depending on whether you want to embed content from all external domains or a specific external domain, perform one of the following actions:

   1. To embed content from all external domains, include the elements and their ancestor elements, as shown in the following example:

      <ServerInstance>
       <Security>
        <ContentSecurityPolicy>
         <PolicyDirectives>
          <Directive>
            <Name>frame-src</Name>
            <Value>*</Value></Directive>
            <Directive><Name>img-src</Name>
            <Value>*</Value>
          </Directive>
         </PolicyDirectives>
        </ContentSecurityPolicy>
      

      Note:

      The wildcard character "*" in the <Value> element enables you to embed content in dashboards from both internal and external domains.

   2. To embed content from a number of specific domains, for example www.xxx.com, www.yyy.com, and so on, include the name of each domain separated by a space, in the elements and their ancestor elements, as shown in the following example:

      <ServerInstance>
       <Security>
        <ContentSecurityPolicy>
         <PolicyDirectives>
          <Directive>
            <Name>frame-src</Name>
            <Value>www.xxx.com www.yyy.com</Value></Directive>
            <Directive><Name>img-src</Name>
            <Value>www.xxx.com www.yyy.com</Value>
          </Directive>
         </PolicyDirectives>
        </ContentSecurityPolicy>
      

      Keep the following points in mind when you configure the instanceconfig.xml file for specific domains:

      • The default setting of the instanceconfig.xml file enables you to embed content from internal domains only. When you edit the instanceconfig.xml file to specify external domains, you overwrite the default setting of the file, thus preventing you from accessing internal domains. To enable you to continue accessing internal domains, you must precede the names of the external domains with the word 'self' followed by a space. For example, to continue to embed content from internal domains and a specific domain (www.xxx.com), you enter the following text in the <Value> element:

        'self' www.xxx.com

      • When you configure the instanceconfig.xml file for specific domains, you can use the wildcard character to embed content from all sub-domains under the parent domain. For example, when you specify www.xxx.*.com, you can embed content from all sub-domains such as xxx.hr.com, xxx.fin.com, and so on.

3. Save your changes and close the file.