Security Roles In OBIEE11g

Hi All,

By Default OBIEE11g provided the 3 default roles.

BI Consumer.
BI Author.
BI Administrator.

 Let's see the deference's.

1.BI Consumer: The base-level role that grants the user access to existing analyses, dashboards and agents, allows them to run or schedule existing BI Publisher reports, but not create any new ones. The Consumer can only view and run existing dashboards, analysis and reports provided to them. These objects will be published in a shared area with proper security rights. Consumers typically are the broadest user base across the institution.

2. BI Author: A role that is also recursively granted the Bi Consumer role that also allows users to create new analyses, dashboards and other BI objects. The Author can create and edit dashboards, analyses and reports. Authors will include a narrower user base than Consumers.

3. BI Administrator: Recursively granted the BIAuthor (and therefore BIConsumer) roles that allows the user to administer all parts of the system, including modifying catalog permissions and privilege. The Administrator can edit and create new repositories and catalogs. They also have full control over all aspects of the OBIEE tool suite.

OBIEE Security Groups
These roles correspond to a set of LDAP groups within the embedded Weblogic Server LDAP Server that have almost the same names (plural rather than singular) as these application roles:

1. BIConsumers 
2. BIAuthors 
3. BIAdministrators 

It’s these LDAP groups that you assign users to, not application roles, with Fusion Middleware then mapping these LDAP groups into their corresponding application roles. Later on, we’ll look at how and why you might want to create another LDAP group and corresponding application role like these, which we’ll call BIAnalyst; for now though, let’s look at how you create a new user and grant them one of the existing roles.

Masking Characters in OBIEE

In most of the cases like Bank Account Number, Personal Phone Number we need to mask few of the characters with 'X' for security purpose. Use below syntax for it.

REPEAT('x', LENGTH("Target Bank"."Target Bank Account Number")-4)||RIGHT("Target Bank"."Target Bank Account Number", 4)

Here "Target Bank"."Target Bank Account Number" is Bank account Number and I want to mask all the Characters with 'X' except last 4 digits. This will expose only last 4 digits as shown below.

Example: xxxxx8456

Setting Priority Group Numbers for Logical Table Sources

You can set priority group numbers to determine which logical table source should be used for queries for which there is more than one logical table source that can satisfy the requested set of columns.

For Example , A column is mapped to multiple LTS(LTS1 & LTS2)  and you want to give first priority to LTS1 whenever this particular column is being fetched in the report so in this case you can assign a higher priority to LTS1.

To assign priority group numbers, rank your logical table sources in numeric order, with 0 being the highest-priority source and so on.
Assigning priority groups is optional. All logical table sources are set to priority 0 by default.

See below snapshot:

OBIEE 11g : Query Logging

OBIEE 11g allows controlling the information that is being logged.

We can fetch the logical as well as physical query by enabling log level.

You can enable logging level for individual users, system user, and individual request.

OBIEE provides different levels of logging as from 0(no logging) to 5(all the information).



Query Logging Levels Description:

Logging Level	Information That Is Logged
Level 0	No logging.
Level 1	Logs the SQL statement issued from the client application. Also logs the following: ·         Physical Query Response Time — The time for a query to be processed in the back-end database. ·         Number of physical queries — The number of queries that are processed by the back-end database. ·         Cumulative time — The sum of time for all physical queries for a request (that is, the sum of all back-end database processing times and DB-connect times). ·         DB-Connect time — The time taken to connect to the back-end database. ·         Query cache processing — The time taken to process the logical query from the cache. ·         Elapsed time — The time that has elapsed from when the logical query is presented to the BI Server until the result is returned to the user. Elapsed time can never be less than response time, because elapsed time takes into account the small extra time between the logical query being presented to the BI Server to the start of preparation of the query. In cases where this delta time is negligible, the elapsed time equals the response time. ·         Response time — The time taken for the logical query to prepare, execute, and fetch the last record. This matches the TOTAL_TIME_SEC that is logged in usage tracking. ·         Compilation time — The time taken to compile the logical query. ·         For each query, logs the query status (success, failure, termination, or timeout), and the user ID, session ID, and request ID.
Level 2	Logs everything logged in Level 1. Additionally, for each query, logs the repository name, business model name, subject area name, SQL statement issued against the physical database, queries issued against the cache, number of rows returned from each query against a physical database and from queries issued against the cache, and the number of rows returned to the client application.
Level 3	Logs everything logged in Level 2. Additionally, adds a log entry for the logical query plan, when a query that was supposed to seed the cache was not inserted into the cache, when existing cache entries are purged to make room for the current query, and when the attempt to update the exact match hit detector fails. Do not select this level without the assistance of Oracle Support Services.
Level 4	Logs everything logged in Level 3. Additionally, logs the query execution plan. Do not select this level without the assistance of Oracle Support Services.
Level 5	Logs everything logged in Level 4. Additionally, logs intermediate row counts at various points in the execution plan. Do not select this level without the assistance of Oracle Support Services.
Level 6 and 7	Not used.

Table Source : Oracle Docs-Managing Query Log 

Viewing logs:

Logs get stored in NQSQUERY.log file.

It is located at,

<instance_home>/diagnostics/logs/OracleBIServerComponent/coreapplication_obis1/

Also logs can be viewed from dashboard administration.

We can fetch logs from Administration>Manage Sessions

Here we can see all the logs generated for different users.

OBIEE 11g : Implicit Fact Column

An Implicit fact column is used when we have multiple fact tables and the report is getting generated using only dimension columns.

A User may request a report where it may have only Dimensions and no Fact columns. In this case, the server may sometimes get confused as to which fact table should it join to fetch the data. So it joins to the nearest fact table and pulls the data through it. So the report output obtained may be different from what the user is expecting.

So, in order to avoid this kind of error,we need to set Implicit Fact Column.

The goal of this is to guide the BI Server to make the best choice between two possible query paths.

We can set a fact attribute (measure) as an implicit fact column.

We can also create dummy implicit fact column on and assign any numeric value to it.

We can set implicit fact column in presentation catlog properties.


1.  Goto properties of presentation catlog in presentation layer.

2.  In implicit fact column section click on set and select any measure column from fact table.

3.  Click OK.

4.  Save your work.

Instead of selecting any fact measure column as implicit fact column, we can also define a dummy implicit fact.

1.  Create a Physical Column in Fact table in Physical Layer.

2.  Name it as Implicit_Column.

3.  Drag this column in Fact table from BMM layer.

4.  Double click on logical table source of fact table.

5.  In content tab, assign any numeric value to Implicit_Column.

Once this is done we can set this column as Implicit Fact Column in Presentation catlog as mentioned above.

OBIEE 10G/11G - How to create an Analytics ODBC Data Source (System DSN ODBC connexion)

On Windows Go to Control Panel / Administration Tools and open “Data Sources ODBC”. Go to the “System DNS” Tab and click the “Add…” button. Choose “Oracle BI server”, click the “Finish” button and enter the configuration as the pictures below :

• OBIEE_Repository_Name = A Description of your DSN connection
• DNS_Name_Obi_Server = The name of your machine in the DNS or the IP

• Repository_Name represent the logical name set up in the configuration file.
   
   

Login ID: Weblogic username (BI server username)
Password: Weblogic password (BI server password)
Port: BI server port (usually 9703)

If you want to know the port number configured for your BI server while installing follow below link

http://interestingoracle.blogspot.com/2016/06/obiee11g-find-port-numbers-of-em.html