19 Copyright © 2008, Oracle. All rights reserved. Security

Copyright © 2008, Oracle. All rights reserved Objectives After completing this lesson, you should be able to: Define users and groups Set permissions for users and groups to control access to repository objects Explain group inheritance Identify and describe the authentication methods used by Oracle BI Server Use query limits, timing restrictions, and filters to control access to repository information

Copyright © 2008, Oracle. All rights reserved Business Challenge Only qualified persons should have access rights to applications. Data needs to be protected so that only authorized employees can access sensitive information. Employees should automatically see the information that is relevant to their roles.

Copyright © 2008, Oracle. All rights reserved Business Solution: Oracle BI Security Provides ability to authenticate users through logon Controls user access to data Secures access control on object and data levels

Copyright © 2008, Oracle. All rights reserved Security Manager Is a utility in the Administration Tool that displays all the security information for a repository.

Copyright © 2008, Oracle. All rights reserved Working with Users User accounts can be defined explicitly in: –An Oracle BI Server repository –An external source (such as a database table or an LDAP server) Users must be authenticated by Oracle BI Server for a session to take place.

Copyright © 2008, Oracle. All rights reserved Adding a User to a Repository Name Password Logging level Group membership

Copyright © 2008, Oracle. All rights reserved Setting User Permissions and Logons Undefined Denied Read-only

Copyright © 2008, Oracle. All rights reserved Administrator Account Is a default, permanent user account in every Oracle BI Server repository Cannot be deleted or modified other than to change the password and logging level

Copyright © 2008, Oracle. All rights reserved Working with Groups A group is a set of security attributes. Use Security Manager to create groups and then grant membership in them to users or other groups. Groups Users and groups can belong to a group.

Copyright © 2008, Oracle. All rights reserved Administrators Group Is a predefined group with authority to access and modify any object in a repository Administrator user is automatically a member. Default member Defined members

Copyright © 2008, Oracle. All rights reserved Defined Groups You can create an unlimited number of groups in a repository. Each group can contain: –Explicitly granted privileges –Implicitly granted privileges through membership in another group Defined groups

Copyright © 2008, Oracle. All rights reserved Group Inheritance Privileges granted explicitly to a user have precedence over privileges granted through groups. Privileges granted explicitly to a group take precedence over any privileges granted through other groups. If security attributes conflict, a user or group is granted the least restrictive security attribute.

Copyright © 2008, Oracle. All rights reserved Group Inheritance: Example User 1 Member Group 1 Member Group 2 Group 1 DENY Table A Member Group 3 Member Group 4 Group 2 READ Table A Member Group 5 Group 3 READ Table B Group 4 READ Table C Group 5 DENY Table A

Copyright © 2008, Oracle. All rights reserved Adding a New Group Members include users and groups. Add members. Set permissions.

Copyright © 2008, Oracle. All rights reserved Viewing Member Hierarchies Click the hierarchy icon in the left pane of the Security Manager, and then expand the tree in the right pane.

Copyright © 2008, Oracle. All rights reserved Authentication Is the process by which a system verifies (with a user ID and password) that a user has the necessary permissions and authorizations to log on and access data Oracle BI Server authenticates each connection request that it receives.

Copyright © 2008, Oracle. All rights reserved Authentication Options Oracle BI Server supports the following authentication types: Operating system External table LDAP Database Internal

Copyright © 2008, Oracle. All rights reserved Operating System Authentication Oracle BI Server supports Windows Unified Logon. If a user is configured on a trusted Windows domain, an Oracle BI Server user of the same name does not need to be authenticated by Oracle BI Server. The user ID in the repository must match the user ID in the trusted Windows domain.

Copyright © 2008, Oracle. All rights reserved External Table Authentication Instead of storing IDs and passwords in a repository, maintain lists of users and passwords in an external database table. Use Oracle BI session variables to get values. External table

Copyright © 2008, Oracle. All rights reserved LDAP Authentication Instead of storing IDs and passwords in a repository, Oracle BI Server passes the user ID and password entered by the user to an LDAP server for authentication. Use Oracle BI session variables to get authentication values.

Copyright © 2008, Oracle. All rights reserved Database Authentication Authenticates users through database logons To set up database authentication: –Store user IDs (without passwords) in a repository. –Import database to the repository. –Specify authentication database in NQSConfig.ini. Add users to the repository. Import the database. Modify the NQSConfig.ini file.

Copyright © 2008, Oracle. All rights reserved Internal Authentication Maintain lists of users and passwords in the repository using the Administration Tool. Oracle BI Server authenticates against this list unless: –Another authentication method has already succeeded –Database authentication is specified in NQSConfig.ini User IDs are nonencrypted and non-case-sensitive. Passwords are encrypted and case-sensitive. Users can access any business model if they have the necessary access privileges. Users do not span repositories.

Copyright © 2008, Oracle. All rights reserved Order of Authentication 1.Operating system (OS): –No logon name –Turned on in NQSConfig.ini 2.LDAP or external database table –Populates session variables 3.Internal or database

Copyright © 2008, Oracle. All rights reserved Bypassing Oracle BI Security It is possible to bypass Oracle BI Server security and rely on the security that is provided by issuing user-specific database logons and passwords. Set in the NQSConfig.ini file.

Copyright © 2008, Oracle. All rights reserved Setting Query Limits Use Query Limits tab to: Control the number of rows received by a user or group Control the maximum query run time Enable or disable Populate Privilege Enable or disable Execute Direct Database Requests

Copyright © 2008, Oracle. All rights reserved Setting Timing Restrictions Restrict access to a database during particular time periods.

Copyright © 2008, Oracle. All rights reserved Setting Filters Limit queries by setting up filters on objects for a user or group.

Copyright © 2008, Oracle. All rights reserved Summary In this lesson, you should have learned how to: Define users and groups Set permissions for users and groups to control access to repository objects Explain group inheritance Identify and describe the authentication methods used by Oracle BI Server Use query limits, timing restrictions, and filters to control access to repository information

Copyright © 2008, Oracle. All rights reserved Practice 19-1 Overview: Creating Users and Groups This practice covers the following topics: Using the Security Manager to define users and groups Setting up group hierarchies Changing the default permission setting

Copyright © 2008, Oracle. All rights reserved Practice 19-2 Overview: Setting Permissions for Users and Groups This practice covers setting permissions for users and groups.

Copyright © 2008, Oracle. All rights reserved Practice 19-3 Overview: Authenticating Using an External Database This practice covers the following topics: Creating an initialization block to populate security session variables Verifying external database authentication

Copyright © 2008, Oracle. All rights reserved Practice 19-4 Overview: Authenticating Users with Database Authentication This practice covers the following topics: Importing an authentication database Adding a database user to the repository Editing the security section of NQSConfig.ini Verifying database authentication

Copyright © 2008, Oracle. All rights reserved Practice 19-5 Overview: Setting Query Limits and Timing Restrictions This practice covers the following topics: Setting query limits for users and groups Setting timing restrictions for users and groups

Copyright © 2008, Oracle. All rights reserved Practice 19-6 Overview: Setting Filters to Personalize Information This practice covers the following topics: Setting query filters Setting a query filter using a variable

Copyright © 2008, Oracle. All rights reserved