Tracking OBIEE 12.2.1.4 provisioned users, groups granted and change in the grants

Question

In the enterprise BI system, integrated with LDAP and SSO,  is there a Oracle solution to track the provisioned OBIEE 12.2.1.4 users, who are granted with certain groups, and later on more groups were granted?  Does Oracle store the information in mid-tier with date information as to when the user was provisioned, and when additional groups were granted? Is there an automated solution in place to keep track of changes to the provisioned users?  Please share your insights/thoughts.

[Deleted User] · Answer

Adding to Gianni's comments:

Why would you want to create or have yet another tool which analyzes your LDAP from outside the LDAP? Solutions like LDAPS or MSAD are meant to manage your corporate security. It would be a case of quis custodiet ipsos custodes - who watches the watchers. Do you need to monitor what your security department does? Do you want to pull out and historize the changes?

Gianni Ceresa · Answer

If it's integrated with LDAP your users aren't in OBIEE, and group membership is managed where the users are: in LDAP. Ask the LDAP admins for that. OBIEE simply read the status of LDAP at a given time (when requested) and cache it for a short time to simply speed up operations.