Oracle HFM 11.1.2.2 Implementation Boot Camp Presented by Saravanan Singaravadivelan Developed by Saravanan Singaravadivelan Senior Consultant Qubix International Ltd

V. Security

Shared Services Security Shared Services is a separate module that supports the Hyperion EPM suite. Provides user management, user provisioning, and external authentication definition. Provisioning refers to the process of assigning roles and access permissions to users for HFM applications. Products that implement Shared Services functionality require access to a Shared Services server running Shared Services client and server software, and to a database dedicated to Shared Services. Provides Lifecycle Management and Audit Reports

Areas of Security Users and Groups Roles Classes Can be created in the native Shared Services user directory Externally authenticated users are registered with Shared Services but are still stored in their original authentication directory. Roles When provisioning users, specific roles are granted by the administrator Users are typically divided into groups based upon the role that reflects both the product licensing and the controls/procedures that apply to the users Classes Assigned to metadata items and web components Users/Groups can be granted various access level to classes

Shared Services – User Provisioning Role based Centrally managed security Distributed security model Integrates with external systems When using Shared Service security, all provisioning is done through the Shared Services Management Console. Shared Services provides a centrally managed and distributed security model that will integrate with external authentication systems.

HFM Roles for Shared Services Administrator Roles Application Administrator Default Provisioning Manager User Roles Advanced User Consolidate Create Journals Data Form Write Back from Excel Enable write back in Web Grid Load Excel Data Manage Templates Read Journals Reviewer 1 Save System Report on Server

Access Rights for HFM Classes None No access – user does not see the item Metadata User sees the dimension member User cannot view/edit the data Promote User can see the data for the dimension member User can promote/reject in process control Read User cannot promote/reject in process control All User can modify the item and promote/reject the data These are the permission settings available in HFM starting with the most restrictive at the top (None) down to the Administrator level which allows unlimited access. Filter access can combine the roles between None and All allowing for much greater flexibility.

External Authentication To use external authentication, you must have an authentication directory containing corporate user information. The following types of authentication repositories are supported: Lightweight Directory Access Protocol (LDAP): IBM Tivoli Directory Server 6.1 Sun ONE 5.2 SP4 Novell eDirectory 8.8 OpenLDAP 2.3.37 Microsoft: Microsoft Active Directory 2000/2003 Microsoft NTLM The following is the list of authentication systems currently supported by Shared Services <read list>

External Authentication – cont’d SAP Directory: Enterprise Portal 6 SP16 or 7.0 Netweaver BI (SAP BW) 3.5 or 7.0 SAP R/3 Enterprise 5.0 Identity management systems: Oracle Internet Directory 10.1.4.3.0 and higher Oracle Virtual Directory 10.1.4.0.1 and higher Oracle Access Manager 10.1.4.0.1 and higher Oracle Application Server Single Sign-On Oracle Identity Manager 10.1.4.0.1 and higher Netegrity SiteMinder 6 The following is the list of authentication systems currently supported by Shared Services <read list>

Foundation Services Shared Services Technical Architecture Client Browser (JavaScript) Client (WebDav) Custom Application XML/HTTP WebDav Java/Web Server Struts Framework WebDav Servlet Security Abstraction Layer Metadata Abstraction Layer Security Client Content Management Service Shared Services has a 3 tier architecture, requiring a relational database repository and authentication system at the data level. If no external authentication system is available, Shared Services uses OpenLDAP for its authentication. The server has a number of low level services and sits within a Java application server. Tomcat ships with the installation. Client access is browser based to the Management Console. LDAP/WIN32 API JDBC Native External RDBMS OpenLDAP LDAP MSAD NTLM

Lifecycle Management Consistent, repeatable movement of apps, cubes, repositories or individual artifacts between development, test & production. User interface & command line capabilities. Auditing & application comparisons. dev test prod Supported through Shared Service Console 11 11

Exercise: Security

Main Steps: Lab 4 Create users/groups Provisioning users/groups Creating and assigning classes Extract and load security Migrate application using LCM