Access Output files from ESS jobs submitted by a different user without BI Administrator Role

Rob Eisenstein

Will be very helpful to have this at Kroger.

Chris Pfeifer

Oracle, this ER is over 2 years old. Please fix this security hole. The solution CANNOT be just giving users BI Administrator!

User_HII63

Will be very helpful indeed!

User_2SUHV

We need to give BI admin access to business users just for giving access to download the report output. This is big security concern.

Oracle, please address and resolve this issue.

V P Aravind

It has been over 2 years since this issue was reported and is a major security and SOX compliance gap in Oracle ERP. This is a serious concern now. Request you to fix this as soon as possible.

Ankit_Bhadja

It's been 2.5 years and still no update from Oracle. This is a serious concern now. Request Oracle to pay attention to this idea.

Ankit_Bhadja

Hi @User_D2ACY,

This required we can achieve without assigning "BI Administrator" role to users. Follow below steps:

1. Using Security Console create a custom abstract role to allow an user to see all the ESS job processes by assigning the application role ESS Monitor Role.
2. In same Custom Role, navigate to Data Security Policies tab and click on on Create Data Security Policy button.
3. Give a name to Policy Name and choose Start Date.
4. Search for Database Resource: ESS_REQUEST_HISTORY
5. Choose for Data Set: All Values
6. As Actions select: ESS_REQUEST_OUTPUT_READ
7. Assign the role to the required users.
8. Once the above abstract role changes are completed save it.
9. Run the ESS process: Import User and Role Application Security Data
10. Logout and login as the user which have assigned the abstract role and user should be able to see in Scheduled Processes all the logs and output files of the ESS jobs.

Refer to below Oracle support note for more details.

How to View the Output of an ESS Jobs Submitted By Another User Based on Role? (Doc ID 1980772.1)

AnsumanM

Hi @Ankit_Bhadja,

Did you achieve this or your suggestion is just based on note..

If you have achieved, please confirm and it would be helpful,

The last section of the note says

BI privileges needed for ESS Output Section

BI privileges are also needed to make the link visible on the attach document in the ESS Output section. This works in conjunction with granting the ESS_REQUEST_OUTPUT_READ Functional Entitlement.

I have a similar requirement, whatever I do if I do not provide user BI Administrator, the link for the attachment report output is not enabled.

This is an important feature, Oracle should enable the output based on other steps and without the need of BI Administrator role.

Please confirm,

Thanks

Ankit_Bhadja

Hi @AnsumanM,

I have achieved this by following all the steps mentioned in my previous comment.

Thanks,

Ankit Bhadja

AnsumanM

Hi @Ankit_Bhadja ,

The catch is BI based report and we can not achieve to see output without BI Admin role.

We have requirement where users want to see Import Payables Invoices Report scheduled from a scheduler user.

The Scheduler user owns all scheduled concurrent programs for users.

Import Payables Invoices Report is a BI report submitted internally from Import Payables Invoice program.

The output is in PDF and the link is not enabled to download or see attachment without BI admin irrespective of above steps.

The above steps might be true for normal concurrent program outputs which produces txt files.

Thanks

Ansuman