Oracle Analytics Cloud and Server

Home› Oracle Analytics› Oracle Analytics Forums› Oracle Analytics Cloud and Server› Oracle Analytics Cloud and Server

Categories

Welcome to the Oracle Analytics Community: Please complete your User Profile and upload your Profile Picture

Security issue in BICS

Received Response
61
Views
9
Comments
souvik88_570
souvik88_570 Rank 4 - Community Specialist
edited Aug 13, 2024 5:52PM in Oracle Analytics Cloud and Server

Hi,

In Oracle BICS, I am trying to setup permission for an user in such a way that he will have access to create only "VA Project", and not a new "Analysis" or "Dashboard".

pastedImage_0.png

I chose the application role "BI Discovery Content Author" and added the user as a member to this role.

pastedImage_3.png

But, user is still able to create "Analysis" and "Dashboard" along with  "VA Project".

Is there any other way to put a restriction to this?

Answers

  • DNK
    DNK Rank 3 - Community Apprentice

    May be you would check the other application roles related to consumer not the content author.content author will give privileges to create and edit analyses.

    Thanks

    DNK

  • Thomas Dodds
    Thomas Dodds Rank 8 - Analytics Strategist

    Inheritance is at work ...

    The documentation shows 

    1. the primary member of the BI Content Author role is BI Discovery Content Author role

    2017-12-26 12_40_55-About Application Roles.png

    I strongly suggest you don't attempt to undo that built in inheritance, but rather build and use your own (with it's own inheritance if needed).

  • souvik88_570
    souvik88_570 Rank 4 - Community Specialist

    Thanks for your reply.

    There is only one consumer role available under BICS which is "BI Consumer". This gives read-only access to analyses, dashboard and visual analyzer. This will not help to achieve my requirement.

  • souvik88_570
    souvik88_570 Rank 4 - Community Specialist

    Thank you for your reply.

    Can you please elaborate on your statement "but rather build and use your own (with it's own inheritance if needed)"?

    Currently, I am using a trial version of BICS which does allow me to create new application role and add it as member of other existing application roles but does not give any option to set the privileges as per my requirement.

    Can you please suggest the inheritance I can create for my requirement, i.e., giving access to create only "VA Project", and not a new "Analysis" or "Dashboard"?

  • Thomas Dodds
    Thomas Dodds Rank 8 - Analytics Strategist

    Inheritance is optional (I don't have a trial BICS to formulate a plan) ... you might have to get creative and try to force the issue with custom roles and explicit Deny (if I'm not mistaken it reigns supreme over the least-restrictive rule).

    Also, have your Oracle sales rep put you in contact with a sales engineer who can technically guide you on this.  If this requirement is make-or-break for a sale - then they'll do what they can to get you over the hurdle.

    Else - you might have to look at an on-prem solution - where this requirement is easily achieved.

  • souvik88_570
    souvik88_570 Rank 4 - Community Specialist

    Thanks for your response.

    We already have a on-premise system up and running where we have these kind of ad-hoc rules implemented. We are trying to migrate that system to cloud and hence, doing a POC with the trial version.

    We can create custom roles but we are not sure how to enforce a custom rule (e.g. explicit deny as you mentioned) on that role as we can't find any such option in cloud. Any idea how that can be done?

  • Thomas Dodds
    Thomas Dodds Rank 8 - Analytics Strategist

    Not off the top of my head ... I suggest you reach out to your Oracle Rep and have them coordinate a session with a sales engineer - a technical person that can help you truly vet the tool to your specifications.

  • [Deleted User]
    [Deleted User] Rank 2 - Community Beginner

    From OBIEE to BICS?

    Can I ask why? Why not OAC?

  • Thomas Dodds
    Thomas Dodds Rank 8 - Analytics Strategist

    SaaS vs PaaS ... wasn't thinking of that - thanks for the extra eyes!