Types
of Security in OBIEE with example
Why do
we need security in OBIEE?
OBIEE
is a reporting tool wherein multiple users belonging to multiple groups create
multiple reports and dashboards. Reports created by a particular group of users
should be visible to that particular group only or some specific data should be
visible to only a specific set of people. So, to achieve this we need to have
some sort of security thereby we can protect reports belonging to a group of
users from the users of other groups.
Users
and Groups in OBIEE
End users who make use of OBIEE for
reporting need to be defined somewhere. These users can be defined either in
the OBIEE RPD, External database tables, LDAP Servers or in Active directories
with their respective passwords.
The users belonging to same business
unit can be clubbed and Groups can be created for them. It’s not always
necessary to create users in the RPD but its necessary to create the
groups in the RPD. Infact, creating several users in the RPD can be a cumbersome
job and it will also increase the size of the RPD, so, according to the best
practice create the users and groups on the DB(or add in AD/LDAP) and associate
them with the RPD groups by creating groups of the same name on the RPD as in
DB.
Authentication
& Authorization
Authentication means validating the user
while logging in the OBIEE application. When a user logs in the OBIEE
application a request is sent to the BI Server asking that whether this user is
a valid user or not. When BI Server validates the user,then only the user is
able to login in the application.
Authorization means a user is authorized to
view what all objects. Example, User A might be authorized to view only
particular set of reports and dashboards based on the security applied.
Now
we can understand these terms in detail.
Types
of Security in OBIEE
Security in Oracle BI can be
classified broadly into the following three types.
1. Object Level security
(Authorization)
2. Data Level security
(Authorization)
3. User Level Security
(Authentication)
User
Level Security in OBIEE
User Authentication in OBIEE
The goal of the authentication
configuration is to get a confirmation of the identity of a user based on the
credentials provided.
In OBIEE, the credentials provided
are hold in this two variables:
The authentication process in OBIEE
is managed by the BI Server.
OBIEE Support four types of
authentication
- LDAP Authentication : Users are authenticated based on credentials stored
in LDAP.This is the BEST method to do authentication in OBIEE and it
supports company’s Single Sign On (SSO) philosophy as well.
- External Table Authentication : you can maintain lists of users and their
passwords in an external database table and use this table for
authentication purposes.
- Database Authentication : The Oracle BI Server can authenticates user based on
database logins. If a user has read permission on a specific database.
Oracle BI Presentation Services authenticates those users.
- Oracle BI Server User
Authentication : You can maintain lists of
users and their passwords in the Oracle BI repository using
the Administration Tool. The Oracle BI Server will attempt to
authenticate users against this list when they log on.
Object
Level Security in OBIEE
As
the name states, Object Level security refers to restricting access to OBIEE
objects between different users and groups. The access to following objects can
be restricted using object level security: Presentation tables, Presentation
table columns, Subject Areas, Reports, Dashboards, and Project Specific shared
folders.
Object-level
security controls the visibility to business logical objects based on a user's
role.
You
can set up Object-Level Security for :
Repository
level: In
Presentation layer of Administration Tool, we can set Repository level security
by giving permission or deny permission to users/groups to see particular table
or column.
Web level: This
provides security for objects stored in the Presentation Catalog, such
as dashboards, dashboards pages, folder and reports. You can only view the
objects for which you are authorized. For example, a mid-level manager may not
be granted access to a dashboard containing summary information for an entire
department.
Data
Level Security in OBIEE
Data
Level Security is basically securing the data. Users belonging to particular
group should see a certain set a data whereas users outside that groups
shouldn’t see that data. Example: Users belonging to Asia group should see only
the data for Asia region whereas users belonging to US region should see data
for US region.
Data-level
security controls the visibility of data (content rendered in subject areas,
dashboards, Oracle BI Answers, and so on) based on the user's association to
data in the transactional system.
This
controls the type and amount of data that you can see in a report. When
multiple users run the same report, the results that are returned to each
depend on their access rights and roles in the organization. For example, a
sales vice president sees results for all regions, while a sales representative
for a particular region sees only data for that region.
Example
Here
we will look at creating and using a session variable and how to implement row
level security. This is mainly used to restrict data based on the user rights.
The row level security will be useful in situations like:
1.
Allowing user to see data that she has access to.
2.
Showing data based on current date.
3.
A sales manager can be shown data in his region only. A CEO can be shown data
for all regions.
In
this post we look at showing units ordered in the current month. We use a
security filter to filter data for the current month.
Steps:
1. The first step is to create the
session variable for the current month. To do so
a.
In the Administration window, click on Action - > New -> Session ->
Variable.Give CURRENT_MONTH as the name of the variable. Click on 'New' near
the initialization block.
b.
Give CURRENT_MONTH_INIT as the name of the initialization block. Click on Edit
Data Source.
c.
A new window opens. Select the connection pool by using the browse button.
d.
Use database as the data source type.
e.Type
in the following query:" select month(curdate()); " in the default initialization
string.
f.
Click Ok to close the dialog.
g.
In the Session variable initialization block, click on edit data target.
h.
select the CURRENT_MONTH variable. Click on Ok.
i.
Click on ok to create the session variable.
2. The next step is to use this session variable to filter the result
for this month.
a.In
the Administration tool. click on Manage -> Security.
b.Create
a new User called MonthlyUser.
c.
Create a new group called MonthlyUserGroup. Assign MonthlyUser to this group.
d.Open
the MonthlyUserGroup dialog and click on Permissions.
e.Click
the tab that says filters. Click on 'Add'
f.In
the name of the filter select the name of the table that you want to apply the
filter on.
g.Click
on the ellipsis in the business model filter column.Apply the filter
h. The group is now created.
3. Login to BI answers using the
MonthlyUser user. Select the columns from the store database. view results. You
will notice that the results show data for the current month only.If you login
by a user from the administrators group, data for all months will be visible.
