OAS Act As Functionality Not Working as Expected in DV – Data Security Issue

Question

Hi All,

We are using Oracle Analytics Server (OAS) and noticing different behavior with the Act As feature in Classic dashboards vs. DV workbooks.

When FullAccessUser acts as RestrictedUser, Classic Answers dashboards work as expected. The user context switches correctly in nqquery.log, and HCM row-level security and data masking are applied.

However, in DV workbooks built on the same RPD subject areas, the user context does not switch.

For example, when FullAccessUser acts as RestrictedUser, the backend queries still show:

[username: FullAccessUser]

Instead of RestrictedUser.

As a result, DV continues to display data based on FullAccessUser's permissions, exposing restricted HCM data.

Has anyone encountered this issue? Is Act As supported in DV with RPD subject areas, or is there any additional configuration needed to make it work?

Any inputs would be appreciated.

Thanks!

Mini · Answer

Thanks for the detailed response Gianni.

Mini · Answer

Thanks Brandon , looks like its the case . we have checked the backend SQL generated with various use case scenarios and observed that — while using Act As in DV — the user session is not switched to Act As user and the original user id is being passed across…

Gianni Ceresa · Answer

The official answer is in

https://support.oracle.com/support/?anchorId=&documentId=KB475953

"act as" is not supported in DV, and as Brandon said, it was flagged deprecated since the very first release of OAS.

An alternative has never been found for now, I believe it's mostly because it is a feature that never existed in OAC (because the OCI IAM doesn't accept that kind of things). The "act as" code is still part of the product, but has never really been adapted, nothing changed on that piece of the product, that's why it keeps working fine with "classic".