Customizing the Default Security Configuration

You can customize the default security configuration in various ways.

Configuring a New Authentication Provider

You can configure another supported LDAP server to be the authentication provider.

Configuring BI Publisher to use an alternative external identity store is performed using the Oracle WebLogic Server Administration Console. BI Publisher delegates authentication and user population management to the authentication provider and identity store configured for the domain it is a part of. For example, if configured to use Oracle WebLogic Server's default authentication provider, then management is performed in the Oracle WebLogic Server Administration Console. If configured to use Oracle Internet Directory (OID), then the OID management user interface is used, and so on.

If using an authentication provider other than the one installed as part of the default security configuration, the default users and groups that are discussed in Default Users and Groups are not automatically present. You can create users and groups with names of your own choosing or re-create the default user and group names if the authentication provider supports this. After this work is completed, you must map the default BI Publisher application roles to different groups again. For example, if the corporate LDAP server is being used as the identity store and you are unable to re-create the BI Publisher default users and groups in it, you must map the default application roles to different groups specific to the corporate LDAP server. Use Fusion Middleware Control to map the groups to application roles.

For information about how to configure a different authentication provider, see Oracle WebLogic Server Administration Console Online Help and Administering Security for Oracle WebLogic Server 12c (12.2.1).

Configuring a New Policy Store and Credential Store Provider

The policy store and credential store can be file-based or LDAP-based.

The supported LDAP server for both stores in this release is Oracle Internet Directory. The pre-requisites for using an LDAP-based store are the same as for both the policy store and credential store. See Securing Applications with Oracle Platform Security Services.

Reassociating the Policy Store and Credential Store

Migrating policies and credentials from one security store to another is called reassociation.

Both policy store and credential store data can be reassociated (migrated) from a file-based store to an LDAP-based store, or from an LDAP-based store to another LDAP-based store

Because the credential store and the policy store must both be of the same type, when reassociating one store you must reassociate the other.

See Securing Applications with Oracle Platform Security Services.

Customizing the Policy Store

The Fusion Middleware Security model can be customized for your environment by creating your own application policies and application roles.

Existing application roles can be modified by adding or removing members as needed. Existing application policies can be modified by adding or removing permission grants. For more information about managing application policies and application roles, see Securing Applications with Oracle Platform Security Services.

Note:

Before creating a new application policy or application role and adding it to the default BI Publisher security configuration, familiarize yourself with how permission and group inheritance works. It is important when constructing a role hierarchy that circular dependencies are not introduced. Best practice is to leave the default security configuration in place and first incorporate your customized application policies and application roles in a test environment. For more information, see Permission Grants and Inheritance.

Creating Application Roles Using Fusion Middleware Control

You can create a new application role or copy from an existing role using Fusion Middleware Control.

Creating Application Roles

There are two methods for creating a new application role.

  • Create New — Creates new application role. You can add members when you create the new role, or you can save the new role after naming it and later add members.

  • Copy Existing — Creates a new application role by copying an existing application role. The copy contains the same members as the original, and the new role will be Grantee of the same application policy. You can modify the copy as required when you create the new role.

Creating a New Application Role

  1. Log into Fusion Middleware Control, navigate to Security, and select Application Roles to display the Application Roles page.

    For information, see Accessing Oracle Enterprise Manager Fusion Middleware Control.

  2. Choose obi from Application Stripe list. Click the search icon next to Role Name.

    You can view the BI Publisher application roles.

  3. Click Create to display the Create Application Role page. You can enter all information at once or you can enter a Role Name, save it, and complete the remaining fields later. Complete the fields as follows:

    In the General section:

    • Role Name — Enter the name of the application role.

    • (Optional) Display Name — Enter the display name for the application role.

    • (Optional) Description — Enter a description for the application role.

  4. In the Members section, Click Add to select the users, groups, or application roles you want to map to the applications role.

    1. From the Type list, select Application Role, User, or Role you want to map to the application role.

    2. Optionally, you can specify the criteria for Principal Name and Display Name.

    3. Click the search icon next to Display Name.

    4. Select the principals from the Searched Principals table.

    5. Click OK.

  5. Click OK to return to the Application Roles page.

    The table at the bottom of the page displays the new application role.

Creating an Application Role Based on an Existing role

  1. Log into Fusion Middleware Control, navigate to Security, and select Application Roles to display the Application Roles page.
  2. Choose obi from Application Stripe list. Click the search icon next to Role Name.

    You can view the BI Publisher application roles.

  3. Select an application role from the list to enable the action buttons.
  4. Click Create Like to display the Create Application Role Like page.

    The Members section is completed with the same application roles, groups, or users that are mapped to the original role.

  5. Complete the Role Name, Display Name, and Description fields.

    For example, the figure below shows the MyNewRole application role based on the BIContentAuthor role.


    Description of GUID-92C24EC2-3B28-424E-8C72-5D30F68B11A3-default.gif follows
    Description of the illustration GUID-92C24EC2-3B28-424E-8C72-5D30F68B11A3-default.gif

  6. Use Add and Delete to modify the members as appropriate and click OK.

    The table at the bottom of the page displays the newly created application role. For example, the figure below shows the MyNewRole based on the default BIContentAuthor application role.


    Description of GUID-087BE796-A663-4E89-AE87-74BDFED09472-default.gif follows
    Description of the illustration GUID-087BE796-A663-4E89-AE87-74BDFED09472-default.gif

Creating Application Policies Using Fusion Middleware Control

All BI Publisher permissions are provided and you cannot create new permissions. Permission grants are controlled in the Fusion Middleware Control Application Policies page.

Creating Application Policies

The permission grants are defined in an application policy. An application role, user, or group, is then mapped to an application policy. This process makes the application role, user, or group a Grantee of the application policy.

There are two methods for creating a new application policy:

  • Create New — Creates a new application policy and adds permissions to it.

  • Copy Existing — Creates a new application policy by copying an existing application policy. You can name the copy, remove existing permissions, or add new permissions as required.

Creating a New Application Policy

  1. Log in to Fusion Middleware Control, navigate to Security, and select Application Policies to display the Application Policies page.

    For information, see Accessing Oracle Enterprise Manager Fusion Middleware Control.

  2. Choose obi from Application Stripe list. Click the search icon next to Principal Name.

    You can view the BI Publisher application policies. The Principal column displays the name of the policy Grantee.

  3. Click Create to display the Create Application Grant page.

  4. To add permissions to the policy being created, click Add in the Permissions area to display the Add Permission dialog.

    1. Complete the Search section, and click the search icon next to the Resource Name field.

      All permissions located in the obi application stripe are displayed. For information about the BI Publisher permissions, see Default Application Roles and Permissions.

    2. Select the desired BI Publisher permissions, and click Continue. Selecting non-BI Publisher permissions has no effect in the policy.

    3. If required, customize the permission and click Select.

    The Permissions section display the selected permissions.

  5. To add an application role, user, or group to the policy being created, click Add in the Grantee section..

    In the Add Principal dialog, do the following:

    • Complete the Search section, and click the search icon next to the Display Name field.

    • Select the required principals from the Searched Principals list.

    • Click OK.

  6. Click OK to return to the Application Policies page. You can view the Principal (Grantee) and Permissions of the new policy in the table.

Creating an Application Policy Based on an Existing Policy

  1. Log in to Fusion Middleware Control, navigate to Security, and select Application Policies to display the Application Policies page.
  2. Choose obi from Application Stripe list. Click the search icon next to Principal Name.

    You can view the BI Publisher application policies. The Principal column displays the name of the policy Grantee.

  3. Select an existing policy from the table.

    For example, the figure below shows the selected BIServiceAdministrator Principal (Grantee) selected and the activated Create Like button.


    Description of GUID-EF98C0FE-4276-4836-A80F-EF0112E3D7B8-default.gif follows
    Description of the illustration GUID-EF98C0FE-4276-4836-A80F-EF0112E3D7B8-default.gif

  4. Click Create Like to display the Create Application Grant Like page. The Permissions table displays the names of the permissions granted by the policy selected.
  5. To remove any items, select it and click Delete.
  6. To add application role, user, or group to the policy, click Add in the Grantee area to display the Add Principal dialog.

    • Complete the Search area and click the blue search icon next to the Display Name field.

    • Select from the Searched Principals list.

    • Click OK.

The Application Policies page displays the Principal and Permissions of the policy.

Changing Permission Grants for an Application Policy

You can change one or more permissions granted by an application policy.

To add or remove permission grants from an application policy:

  1. Log in to Fusion Middleware Control, navigate to Security, then select Application Policies to display the Application Policies page.
  2. Choose Select Application Stripe to Search, then select obi from the list. Click the search icon next to Role Name.

    The BI Publisher application policies are displayed. The Principal column displays the name of the policy Grantee.

  3. Select the name of the application role from the Principal column and click Edit.
  4. Add or delete permissions from the Edit Application Grant view and click OK to save the changes.