nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Oracle Communities

Oracle Analytics and AI

Child Item

Security issue in BICS

souvik88_570

Hi,

In Oracle BICS, I am trying to setup permission for an user in such a way that he will have access to create only "VA Project", and not a new "Analysis" or "Dashboard".

I chose the application role "BI Discovery Content Author" and added the user as a member to this role.

But, user is still able to create "Analysis" and "Dashboard" along with "VA Project".

Is there any other way to put a restriction to this?

Find more posts tagged with

Accepted answers

All comments

DNK

May be you would check the other application roles related to consumer not the content author.content author will give privileges to create and edit analyses.

Thanks

DNK

Thomas Dodds

Inheritance is at work ...

The documentation shows

the primary member of the BI Content Author role is BI Discovery Content Author role

2017-12-26 12_40_55-About Application Roles.png

I strongly suggest you don't attempt to undo that built in inheritance, but rather build and use your own (with it's own inheritance if needed).

souvik88_570

Thanks for your reply.

There is only one consumer role available under BICS which is "BI Consumer". This gives read-only access to analyses, dashboard and visual analyzer. This will not help to achieve my requirement.

souvik88_570

Thank you for your reply.

Can you please elaborate on your statement "but rather build and use your own (with it's own inheritance if needed)"?

Currently, I am using a trial version of BICS which does allow me to create new application role and add it as member of other existing application roles but does not give any option to set the privileges as per my requirement.

Can you please suggest the inheritance I can create for my requirement, i.e., giving access to create only "VA Project", and not a new "Analysis" or "Dashboard"?

Thomas Dodds

Inheritance is optional (I don't have a trial BICS to formulate a plan) ... you might have to get creative and try to force the issue with custom roles and explicit Deny (if I'm not mistaken it reigns supreme over the least-restrictive rule).

Also, have your Oracle sales rep put you in contact with a sales engineer who can technically guide you on this. If this requirement is make-or-break for a sale - then they'll do what they can to get you over the hurdle.

Else - you might have to look at an on-prem solution - where this requirement is easily achieved.

souvik88_570

Thanks for your response.

We already have a on-premise system up and running where we have these kind of ad-hoc rules implemented. We are trying to migrate that system to cloud and hence, doing a POC with the trial version.

We can create custom roles but we are not sure how to enforce a custom rule (e.g. explicit deny as you mentioned) on that role as we can't find any such option in cloud. Any idea how that can be done?

Thomas Dodds

Not off the top of my head ... I suggest you reach out to your Oracle Rep and have them coordinate a session with a sales engineer - a technical person that can help you truly vet the tool to your specifications.

[Deleted User]

From OBIEE to BICS?

Can I ask why? Why not OAC?

Thomas Dodds

SaaS vs PaaS ... wasn't thinking of that - thanks for the extra eyes!