nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Oracle Communities

Oracle AI and Analytics

Child Item

Authorization should be able for group as well as users and application roles for Catalog

shintaro umezawa

Organization Name

JAPAN AUTOMOBILE FEDERATION

Description

For Oracle Analytics Cloud there is an authorization setting for catalogs, reports, data models and analytics.

However the authorization could be done only through Users or Application roles. I think it is better from an operation perspective that there should be authorization for groups as well as users and Application roles.

Use Case and Business Need

Using OAC for report creation in a operational level in a big organization, it requires some authorization.

For the authorization it requires as an example three patterns.

1. Administrator authority 2.Authority for creating data models and reports 3. Authority only for executing report jobs.

And if authentification is done through IDCS(Which is done in our company) , it is difficult to manipulate the authorization of catalogs through Users or application roles.

That is because, Users are too many to control and Application roles are too big to control when there are more then 200 members you have to think about.

So, my Idea is to have an authorization of catalogs for Groups as well, to make the management easier.

Original Idea Number: 52784298e1

Find more posts tagged with

Analysis and Data Visualization

Administration

Needs Votes

Status: Needs Votes

Comments

Marcelo Finkielsztein

Hi.
I must be missing something.

We use IDCS users and IDCS groups to authenticate and authorize.

Each IDCS group matches an OAC application role.

Then, OAC privileges and permissions are assigned to application roles, but, for all purposes it is like granting them to IDCS groups.

Is it not this what you are trying to accomplish?

With all due respect,

Marcelo Finkielsztein

shintaro umezawa

Hello Marcelo

Thank you for your comment.
Yes as you mention, with IDCS, authentication and authorization can be done and its good for most of the time.
However, in our business scenario there is a situation where IDCS authentication and authorization is not enough, let me point them out below

【Scenario 】When we want to use the same dataflow in few users
As Dataflow has to be export/import as a .dva file for other users to use, and the user must have a higher privilege then ServiceUser(the IDCS authorization). The user having an privilege of ServiceUser can edit any file in any catalog.
And that is not acceptable, because in our project there are few teams using OAC and each team does not want to show there work to other team and don't want to give privilege to edit the contents in there folders.

For that reason we want to make authorization setting in OAC, for users. For example User A in team finance can edit and create dataflow and other contents in finance folder, but User A cannot see and edit files in the folder for Sales team.
For doing the authorization setting as showing in the example above, we have to do it through the OAC folder privilege setting, but doing it for each user is burden and hard to operate, so we will like to be able to give privilege setting to groups, which will make it easy to operate.

Shintaro

Marcelo Finkielsztein

If I am not mistaken, this seems to be another example where DV does not have all the functionality that Classic Home already had.

in a scenario like the one described by Shintaro, in Classic Home we would have assigned privileges to Subject Areas.
Access to Finance Subject Area is different than access to Sales Subject Area.

Thank you Shintaro for your explanation.

Marcelo Finkielsztein

I would like to see DV offering all the functionality that Classic Home has.

shintaro umezawa

Thank you for your Reply Marcelo

However, there are few things I didn't understand

First, Does it mean if DV is exported to Subject Area we will be able to give privilege by groups?
Meaning we can manage the privilege for each group of subject area, so some subject areas cannot be accessed by few groups?

Second, How about other contents such as reports and datamodel? Can they be preserved in Subject Areas? and will they be samelly authorized by groups in Subject area?

Third, how is data stored in subject area and how can we manage them? Can you provide a document and kindly explain, how data is stored in subject area, what is the capacity and how to create authorization in subject area.

Best regards
Shintaro