An update, as promised...
Over and over again, this issue is reproducable.
So get rid of underscores and numbers in Application Roles' names and your life will be much more pleasant !
Thanks to everyone in my team (@bifacts, @bvdh80, Cindy and Marcel) for your valuable input in resolving this issue !
Dear followers,
Things seem to go pretty well now.
It looks as if the underscores and numbers in the Application Roles' names cause these kinds of problems.
After having removed the numbers and underscores from the roles' names the error hasn't occurred anymore.
It's a pity that the documentation does not mention this restriction or naming convention.
Still testing though... I'll keep you informed.
René
donderdag 1 december 2011
woensdag 30 november 2011
strange security behaviour
Dear community,
I'm writing this because I am facing a serious issue in OBI 11g (11.1.1.5) and I can't seem to pinpoint the exact problem. I hope you can share your thoughts with me in order to come up with a solution. The situation is as follows: There seems to be a mismatch between the Application Roles assigned to a user and the way they are translated onto the ACL's in the webcatalog. I use Weblogic's default Authenticator. Users sit in a group and for every group, there is a corresponding Application Role.
For instance:
There are also A_P020 group and role and a A_P030 group and role. The Group-to-Role mapping is always 1:1.
In the catalog, access to objects is configured using Application Roles.
For instance: access to the P010 Dashboard is limited to users who are member of the A_P010 group (and as a consequence have the A_P010 application role assigned).
Now, what happens is this: a user who is assigned the A_P010 group and the A_P020 group sees the P010 and P020 Dashboards.
When I assign him membership to the A_P030 group too, he only sees the P010 dashboard....
This is reproducable behavior.
resyncing the GUID's didn't solve the problem.
In fact, when I move the webcatalog to a complete fresh installation of OBI 11.1.1.5 and create a new user and assign him the roles as described above, the same behavior occurs.
I'm lost...
The session information (under My Account) shows the correct application roles. It's the mapping onto the ACL's in the webcatalog that seems to be wrong.
Any input would be very much appreciated !
Kind regards,
René
I'm writing this because I am facing a serious issue in OBI 11g (11.1.1.5) and I can't seem to pinpoint the exact problem. I hope you can share your thoughts with me in order to come up with a solution. The situation is as follows: There seems to be a mismatch between the Application Roles assigned to a user and the way they are translated onto the ACL's in the webcatalog. I use Weblogic's default Authenticator. Users sit in a group and for every group, there is a corresponding Application Role.
For instance:
For instance: access to the P010 Dashboard is limited to users who are member of the A_P010 group (and as a consequence have the A_P010 application role assigned).
Now, what happens is this: a user who is assigned the A_P010 group and the A_P020 group sees the P010 and P020 Dashboards.
When I assign him membership to the A_P030 group too, he only sees the P010 dashboard....
This is reproducable behavior.
resyncing the GUID's didn't solve the problem.
In fact, when I move the webcatalog to a complete fresh installation of OBI 11.1.1.5 and create a new user and assign him the roles as described above, the same behavior occurs.
I'm lost...
The session information (under My Account) shows the correct application roles. It's the mapping onto the ACL's in the webcatalog that seems to be wrong.
Any input would be very much appreciated !
Kind regards,
René
donderdag 15 september 2011
OBIEE 11.1.1.3 and 11.1.1.5: different approach to AGO function
Hi again.
After spending some time on the Time Hierarchy in 11.1.1.5 I found it useful to mention that it now is possible to use the AGO function in the BMM layer whilst the underlying logical facttable has multiple sources on different grains.
What I mean is the following:
Let's say in your logical fact table there is a logical measure column called AMOUNT_SOLD. This column maps to two different columns in the physical layer: 1 comes from a table with a day-grain, the other comes from a table with a month-grain. (In cases where you only have a limited set of day-based data and an infinite set of month-based data, this will occur...)
In your BMM layer, the logical fact table has 2 sources: the DAY-based table and the MONTH-based table. When you specify the content correctly for both LTS's, (map them to the corresponding levels in your logical Calendar hierarchy), drilling down on a dashboard from year via quarter to month level causes OBI to query the physical MONTH-based table. Drilling down to the day-detail level, OBI queries the physical DAY-based table. That is, if the logical table for your calendar has a seperate logical source for the DAY level, next to a logical source for the month level and up.
So far, so good.
But, in order to use time-series calculations you would want to use the AGO function in the BMM layer. Something like AGO("Measure","Calendar Level",1).
This does not work in 11.1.1.3, since the logical table for the Calendar has multiple logical sources. (because of the double-source nature of the AMOUNT_SOLD measure)...
Creating a single logical source for the Calendar table does not solve the issue, because now, you're limited to the lowest level of the calendar. Meaning that you wil always query the DAY-based physical table...
In 11.1.1.5 you can combine both.
You CAN use a single logical table source for your calendar and still have 2 physical sources for your AMOUNT_SOLD measure. Specify the correct Calendar level for both individual logical table sources and it works !
Kind regards,
René
After spending some time on the Time Hierarchy in 11.1.1.5 I found it useful to mention that it now is possible to use the AGO function in the BMM layer whilst the underlying logical facttable has multiple sources on different grains.
What I mean is the following:
Let's say in your logical fact table there is a logical measure column called AMOUNT_SOLD. This column maps to two different columns in the physical layer: 1 comes from a table with a day-grain, the other comes from a table with a month-grain. (In cases where you only have a limited set of day-based data and an infinite set of month-based data, this will occur...)
In your BMM layer, the logical fact table has 2 sources: the DAY-based table and the MONTH-based table. When you specify the content correctly for both LTS's, (map them to the corresponding levels in your logical Calendar hierarchy), drilling down on a dashboard from year via quarter to month level causes OBI to query the physical MONTH-based table. Drilling down to the day-detail level, OBI queries the physical DAY-based table. That is, if the logical table for your calendar has a seperate logical source for the DAY level, next to a logical source for the month level and up.
So far, so good.
But, in order to use time-series calculations you would want to use the AGO function in the BMM layer. Something like AGO("Measure","Calendar Level",1).
This does not work in 11.1.1.3, since the logical table for the Calendar has multiple logical sources. (because of the double-source nature of the AMOUNT_SOLD measure)...
Creating a single logical source for the Calendar table does not solve the issue, because now, you're limited to the lowest level of the calendar. Meaning that you wil always query the DAY-based physical table...
In 11.1.1.5 you can combine both.
You CAN use a single logical table source for your calendar and still have 2 physical sources for your AMOUNT_SOLD measure. Specify the correct Calendar level for both individual logical table sources and it works !
Kind regards,
René
woensdag 14 september 2011
store non-OBIEE objects in the catalog
Thanks to John Minkjan (obiee101.blogspot.com) I was able to disclose (and secure) non-OBIEE content on a dashboard.
Using the regular Upload functionality you can easily upload a (for instance) PDF file into the Shared Folders of the webcatalog.
The awkward thing is, that if you put a link on your dashboard and use the Browse button to navigate to the particular folder, you don't see the PDF file since it is not an OBIEE object.
A workaround for this is to create a (dummy) analysis and store it in the same folder as the PDF. Then, as described above, put a link on your dashboard and navigate to the dummy analysis. As a final step, (since you now have the path to the folder where the PDF resides) replace the name of the OBIEE analysis with the PDF's name.
There you go ! Now you can have a link on your dashboard to non-OBIEE objects and use your security model on it !
Kind regards,
René
Using the regular Upload functionality you can easily upload a (for instance) PDF file into the Shared Folders of the webcatalog.
The awkward thing is, that if you put a link on your dashboard and use the Browse button to navigate to the particular folder, you don't see the PDF file since it is not an OBIEE object.
A workaround for this is to create a (dummy) analysis and store it in the same folder as the PDF. Then, as described above, put a link on your dashboard and navigate to the dummy analysis. As a final step, (since you now have the path to the folder where the PDF resides) replace the name of the OBIEE analysis with the PDF's name.
There you go ! Now you can have a link on your dashboard to non-OBIEE objects and use your security model on it !
Kind regards,
René
woensdag 10 augustus 2011
Upgrade OBI 11.1.1.3 to 11.1.1.5 findings
Well,
Upgrading OBI 11.1.1.3 to 11.1.1.5 is quite... ehm... challenging.
My first advice would be: perform a complete fresh installation of Weblogic 10.3.5 and OBI 11.1.1.5. (A so-called Out-Of-Place upgrade). An in-place upgrade is a LOT OF WORK and involves a lot of manual steps and scripting.
But, even the Out-Of-Place upgrade comes with challenges.
First of all, the installation is fine. (Although I tried to install this right after the release of the latest version of Java (7) and I didn't manage to get this up and running so I switched back to using 6u26.)
The migration of the security realm, setting up the Application Roles, everything is fine.
There is actually no need of upgrading the rpd file. Just point Weblogic to the correct file and it works.
But the WebCat is a different story...
In the 11.1.1.5 version of instanceconfig.xml there is this entry in the section that says: change the upgradeandexit "false" value to "true"
The documentation does not mention this entry. It mentions the previous syntax, which is something like ps:catalog etc. /ps:catalog
Setting its value to true and restarting the presentation server should (I believe) perform an upgrade of the webcatalog.
(BTW: the install doc of the 11.1.1.5 SampleApp also doesn't mention the 11.1.1.5 tag, but the 11.1.1.3 tag)
What I did find is loss of functionality. So the 11.1.1.3 version and the post-upgrade 11.1.1.5 version of the same dashboards act differently.
For instance: Graphs that have conditional formatting no longer animate. And also ALL our gauges lost their footer. because after the upgrade the @1 reference in the footer had changed after the upgrade to @0.
What else went wrong ? I'm still investigating. I'll keep you posted.
Kind regards,
René
donderdag 23 juni 2011
OBIEE Catalog and Application Roles
Hi !
When adding Application Roles as members to other Application Roles, the Presentation Server only 'sees' the ultimate parent of that hierarchy. So If you have an Application Role called 'Analyst' and there are other Application Roles member of this 'Analyst' Role, only the 'Analyst' role is known to the presentation server and also to the Catalog !
So remember this when setting access privileges on catalog objects !
René
When adding Application Roles as members to other Application Roles, the Presentation Server only 'sees' the ultimate parent of that hierarchy. So If you have an Application Role called 'Analyst' and there are other Application Roles member of this 'Analyst' Role, only the 'Analyst' role is known to the presentation server and also to the Catalog !
So remember this when setting access privileges on catalog objects !
René
woensdag 22 juni 2011
OBI BIPLATFORM schema and Database 11 user profiles
Today I encountered the situation that after having changed the BIPLATFORM password in de 11g database and in WLS Enterprise Manager, the account locks every x seconds.
To make a long story short: the bipublisher jdbc connection and the RTD jdbc connection also use the BIPLATFORM schema.
So you need to reconfigure those as well.
Oracle Database 11g uses user-profiles. One of the options is password expiration.
So make note that if you hit such a situation, don't overlook the jdbc connections !
René
To make a long story short: the bipublisher jdbc connection and the RTD jdbc connection also use the BIPLATFORM schema.
So you need to reconfigure those as well.
Oracle Database 11g uses user-profiles. One of the options is password expiration.
So make note that if you hit such a situation, don't overlook the jdbc connections !
René
Abonneren op:
Posts (Atom)