User cannot edit the analyses (despite correct permissions) [OBIEE 11.1.1.6.6]

3302484

Hello,

One of our users cannot edit analyses, even in his home catalog he can only open analysis, he can't edit it. We use windows AD authentication with OBIEE. This user (user_n1 in this case) is a member of BIAuthors group in AD (group containing users with BI Author role, so they can create, edit an run reports and analyses). From weblogic console I can see, that user_n1 is correctly assigned to equal group (BIAuthors). After successfully login to OBIEE Publisher this user on home page can only open dashboards or analyses visible on Recent panel (under every dashboard or analysis there is no edit option, only open and more options). Also in the common Header area there is no Catalog link, on the left side of this page there is no Browse / Manage... section too. It looks like this user has read permissions only, but why?

I compared from administrator level permissions of this user (user_n1) with another user (user_n2 - this user can edit analyses without any problems). User_n2 has identical permissions (I mean permissions to their home catalog and shared folder) as user_n1 (he also is assigned to BIAuthors group). User_n2 after login to OBIEE Publisher can see all edit options on the home page, which are not visible for user_n1, also he can see Catalog link in the common Header area and Browse / Manage... section too.

I tried remove user_n1 from BIAuthors group from AD level and put him again, restart OBIEE services, but with no result. Other 39 users from BIAuthors group can edit analyses without any problems, only this one (user_n1) cannot, despite the fact, he has identical permissions (based on BI Author role) as other users. I tried get full control permission to home catalog for user_n1 (recursively to all elements located in this catalog), and still nothing, when user_n1 opens his home catalog (only way to do this is entrance by url adress .../analytics/saw.dll?catalog, there is no any other possibility to get into this catalog for this user), there are still only open and more options, with no edit option.

I have no idea, what may cause of this problem. I've been sitting with this on few days and still nothing...

Any help appreciated. Thank you!

Joel

Do the permissions look correct when you view the user_n1 folder from the Catalog Manager in offline mode?

3302484

Thank you for your answer. I checked from the Catalog Manager (but in offline mode, I have no offline option from my local machine, our OBIEE is installed and configuerd on external VM) and permissions are exact the same as in the Publisher (I checked home catalog for user_n1 as well as shared folder).

Gianni Ceresa

Sorry but is that OBIEE or Publisher? You talk about OBIEE things but call it OBIEE Publisher (they are 2 different products in the end), so it's slightly confusing ...

And no need to mention that support for your version of OBIEE was over 4 years ago, you may want to consider to upgrade one day ...

Is your "user_n1" a new user? (so he has no content in his home folder)

If he is you can just "kill" the user completely and let OBIEE recreate it at the next login, if your security is correctly setup (what you see is not always what you get, security in OBIEE is generally more complicated than "being member of one app role") the user will have access to his things.

3302484

No need to mention that BI Publisher can be as part of OBIEE (http://www.oracle.com/webfolder/technetwork/tutorials/obe/fmw/bi/bip/bip11g/gettingstarted/gettingstarted.htm, http://obieetraining11.blogspot.com/2012/08/bi-publisher-11g-part1-creating-data.html), so it is really slightly confusing you didn't know about it. In our case so it is (as a part of OBIEE). From administrator level I can check (and manage of course) permissions for every user with BI Author / BI Consumer role.

User_n1 is a new user, created in the same way as 39 other users (simply by add this user to equal group [BIAuthors] from AD level). He has his home catalog but there are only template elements like 'My dasboard' and 'Subject Area Contents', user_n1 can only read them / traverse by internal folders and nothing more. I tried completely remove user catalog and at next login that catalog recreated with the same permissions and still the same, user_n1 cannot edit anything. I tried also remove that user from BIAuthors group from AD level, also remove his home catalog from OBIEE Publisher and put him again to BIAuthors AD group, and no results.

Gianni Ceresa

I definitely know what OBIEE is, what Publisher is, and what and how and where Publisher is in OBIEE. Your wording is confusing as there isn't a thing called "OBIEE Publisher", it's either OBIEE or Publisher and they are quite different (even more when about security if you aren't using the Fusion Middleware secuity in Publisher).

When I talk about "killing" the user I mean a full delete, forcing the system to give him a new GUID as well at next login, not just dropping the personal folder.

PS: about the wording .... the catalog is unique for the whole BI server, it's a single web catalog composed by folders and objects of various type (although they are all just XML and it's the .atr file giving them a type).

[Deleted User]

Additional to Gianni's comment - in 11g a user "kill" involved a lot more than dropping the user folder.

https://dimensionality.ch/2014/03/19/purging-corrupted-obiee-web-catalog/