nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Oracle Communities

Oracle Analytics and AI

Child Item

OBIEE 12c to OAS 2025 migration - security issues

AM_1

Hello,

I'm trying to import in OAS 2025 a bar file exported from OBIEE 12c.
The bar file contains whole application, including RPD, catalog and authorization.
I tried via the console as well as via importarchive.sh

My problem is: after importing, all default OAS roles are missing, including BIServiceAdministrator.

As a result, after the bar import, user weblogic does not have access to the most console functionality.
For example, I am not able to access "Roles and Permissions" and fix the situation.

What should be done to migrate my bar file to OAS 2025 and retain the default OAS roles?

Thanks,

Alex

Find more posts tagged with

OBIEE to OAS migration default roles

Accepted answers

Sumanth V -Oracle

@AM_1 - This is expected behavior—when importing a BAR (BI Archive) file, the application roles defined within the BAR file will replace the ones currently in the environment.

To fine-tune permission assignments after the BAR import, use the following scripts:

grantPermissionSetsToBIRole.sh – to assign permission sets to BI roles
revokePermissionSetsFromBIRole.sh – to remove permission sets from BI roles

It's recommended to grant the necessary permission sets to the BI Administrator role using the grantPermissionSetsToBIRole script before making further changes.

Reference: https://docs.oracle.com/en/middleware/bi/analytics-server/security-oas/grant-or-revoke-permissions-assignments.html

All comments

Sumanth V -Oracle

@AM_1 - This is expected behavior—when importing a BAR (BI Archive) file, the application roles defined within the BAR file will replace the ones currently in the environment.

To fine-tune permission assignments after the BAR import, use the following scripts:

grantPermissionSetsToBIRole.sh – to assign permission sets to BI roles
revokePermissionSetsFromBIRole.sh – to remove permission sets from BI roles

It's recommended to grant the necessary permission sets to the BI Administrator role using the grantPermissionSetsToBIRole script before making further changes.

Reference: https://docs.oracle.com/en/middleware/bi/analytics-server/security-oas/grant-or-revoke-permissions-assignments.html

Gianni Ceresa

Hi,

When you import your BAR, you can decide to not override the security, and you then manually do a "merge" between your custom 12c security and the default OAS 2025 security. This allows you to maintain all the default roles and policies, and to be able to inherit what needed in your own security.

Or, just recreate all you need: you maybe don't have access through DV, but you still have access to FMW EM, where you can create roles and assign policies. And you can also do that via WLST if you extract the default security from OAS 2025 before to override everything with your BAR.

AM_1

Gianni,
Thanks for your prompt response!
Unfortunately, I can't get a response from EM.
Even right after clean installation
myserver:9500/console works fine,
but when I try
myserver:9500/em and enter weblogic credentials, the page freezes for several minutes and then I'm getting a timeout error.

Can you point me the scripts for WLST ?

AM_1

Thank you Sumanth!
I will try this.

Gianni Ceresa

Follow https://support.oracle.com/epmos/faces/DocContentDisplay?id=1423893.1 to enable the discovery cache for EM, then your login will work. I usually use the method of adding the few config lines to the file and restart the AdminServer.

It's a known thing that EM is "painful" to login into because of timeouts.

Gianni Ceresa

There isn't a written set of WLST commands to create the default security model, you would generally build it by exporting the default security (or if you have a script that does read the security model and generate all the WLST commands to recreate it).

And I don't have the default OAS 2025 security model around, still didn't need to migrate somebody to it so far…

user11394989

If /em hangs at startup, the java heap memory is too low and need to increase it in domain setUserOverridesLate.sh with usual parameters to increase java memory.

Gianni Ceresa

Or it is just the discovery cache for EM, a known problem with EM in OBIEE/OAS from day one of it's release about 15 years ago. Giving it more memory doesn't change much.

Steve F-2

Agree, with Gianni, FMW Control (EM) cache is my vote (and go to) for slowness.
Just throwing in the new KB, just in case the older MOS Doc ID doesn't redirect (it should).

How to Enable Discovery Cache To Avoid Long Delay During Login To Fusion Middleware Control (KB407031)
emoms.properties is the easiest change, in my opinion.