Categories
- All Categories
- 15 Oracle Analytics Sharing Center
- 14 Oracle Analytics Lounge
- 213 Oracle Analytics News
- 42 Oracle Analytics Videos
- 15.7K Oracle Analytics Forums
- 6.1K Oracle Analytics Idea Labs
- Oracle Analytics User Groups
- 78 Oracle Analytics Trainings
- 14 Oracle Analytics Data Visualizations Challenge
- Find Partners
- For Partners
Is it possible to restrict BI report developer access to specific database objects?
Our requirement is to make sure BI report developers adhere to the policy of using Fusion SLVs (secured list views) where possible in data models of the custom BI Publisher reports they are tasked with building.
Currently nothing stops developers from incorporating HCM production tables into data model queries and expose sensitive HR information to end users who are not supposed to have access to it.
We're talking about an out of the box BI Publisher that is bundled with Fusion ERP SaaS.
Would Oracle Analytics Cloud (OAC) offer a more granular access to data capabilities? It does allow to define datasets. Would dataset be a collection of "whitelisted" database objects that can be accessed, i.e. offer the level of granularity that we need?
Lastly, would it be possible to build datasets against Fusion SaaS tables, if OAC is deployed in Oracle Cloud Infrastructure tenancy while Fusion ERP is in a different cloud?
Thanks
Best Answer
-
Hello,
You can use Role-Based Filters. Dataset owners apply filters based on Oracle Analytics application roles that allow users to see data that's applicable to their application roles:
You can use the Oracle Applications connector in DV to connect to Fusion. If Fusion instance is on private endpoint then you will need to use Remote Data Gateway (RDG). Look at:
Here are the Fusion modules that you can connect to and the steps to use the Oracle Applications connector in DV:
Regards,
Ezequiel.
0
Answers
-
Great! Thanks
We'll explore OAC further, since we do have a subscription for OAC in OCI.
One last question:
Our Fusion ERP SaaS offering comes with a cloud OBIEE (BI publisher). Just to confirm, the datasets feature you were referring to does not exist in that cloud OBIEE, meaning a developer with BI role has access to the entire Fusion database - all schemas, tables, views etc.
So, if a DEV environment has real PROD data in it, that means the developer would be able to query and view sensitive information?
In case of OAC, we should be able to create datasets specific to developer profile? Some of these developers are supposed to develop only Financials reports and analyses, hence they are not supposed to access HCM schema, for example.
Is our understanding of OAC datasets functionality correct, in a way that it allows to give granular access to database objects?
Thanks
0 -
Did you ever figure out a way to limit BI Publisher access to certain tables?
0 -
A couple of posts on Ideas Lab to no avail.
Data Source Access across Oracle Pillars (HCM and FIN) - BI Admin
Restrict BIP access (table access) for person, sensitive data
Doc ID 2819026.1, "…it is not possible to restrict BI Publisher Data Models to specific tables."
0