Friday, November 14, 2014

OBIEE 11g Understanding Security: Introduction to OBIEE Security Model (What’s new ???)

What’s new w.r.t. security in 11g ?

  • Users and Groups are now managed via WebLogic instead of the RPD 
  • New concept of “Application Roles” is introduced which is maintained in Enterprise Manager 
  • Administrator user is no longer default user for inter-component communication 
  • Separate is password required to access RPD 
  • SSL an SSO is now much easier to implement 
  • Built-in LDAP to support Authorization
  • “Credential Store” function is now under Weblogic control
  • In Admin tool “Manage > Identity” inplace of “Manage > Security”

Here is the OBIEE 11g security model



How it works ?

Users and Groups are maintained under Weblogic Administration Console and by default OBIEE uses Weblogic embedded LDAP store for authentication. (However, alternative 
“Identity Providers” can be configured e.g. OID, AD etc)

Once authenticated, users are then mapped to Application Roles which govern what users can do within each individual application. Application roles are managed under Weblogic 
Enterprise Manager.

Security Policies are then applied based on the user’s Application Roles.

For example,
John is a Sales Manager. He will be authenticated by the LDAP Identity Provider. After authentication he will be authorized by assigning to the “Sales Dashboard Users” application role. All Security Policies associated with the application role will be applied on the user. For example, John will get access to the “Sales Dashboard” but she can only see data for the Corporate Accounts that he manages.

Default Security Setup





The “default Roles” have the following privileges in Oracle BI EE 11g: 



BIAdministrator Role 

  • Manage BI Repository (RPD) 
  • Administer BI Publisher 

BIAuthor Role 
  • Privileges defined in BI Presentation Catalog 
  • BI Publisher Develop / Design / Schedule Reports 
BIConsumer Role 
  • Privileges defined in BI Presentation Catalog 
  • BI Publisher Excel / On-line Report Analyzer 

“Manage Privileges” within Oracle BI. (See below Privileges defined in BI Presentation Catalog)




Saturday, October 11, 2014

OBIEE 10g to 11g Upgrade

Oracle Business Intelligence: Upgrading Oracle Business Intelligence: OBIEE 10g to 11g Upgrade

Upgrading Oracle Business Intelligence: OBIEE 10g to 11g Upgrade

Overview:

This post will explain how Oracle Fusion Middleware Upgrade Assistant can be used to upgrade Oracle Business Intelligence 10g environment to 11g environment.

In this article we have upgrade our obiee 10.1.3.4.2 environment to obiee 11.1.1.7.1

Prerequisites:

Before proceeding with the upgrade process, make sure following things,

1) OBIEE 11g must be installed and running

Here is my current OBIEE 11g installation and url information.
OBIEE Analytics:
http://mysampledomain.com:8704/analytics

OBIEE Publisher
http://mysampledomain.com:8704/xmlpserver

Oracle Weblogic Server (WLS) Console
http://mysampledomain.com:8001/console

Oracle Fusion Middleware Control Enterprise Manager (EM)
http://mysampledomain.com:8001/em


2) Check your PATH variable

Open CMD
C:\Documents and Settings\mumer>echo %path%
D:\OracleBI\server\Bin;D:\OracleBI\web\bin;D:\OracleBI\web\catalogmanager;D:\OracleBI\SQLAnywhere;D:\OracleAS\10.1.3.2.0\OracleAS_1\jdk\bin;D:\OracleAS\10.1.3.2.0\OracleAS_1\bin;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Windows Imaging\;d:\obiee11g_home\Oracle_BI1\bin;d:\obiee11g_home\Oracle_BI1\opmn\bin;d:\obiee11g_home\Oracle_BI1\opmn\lib;d:\obiee11g_home\Oracle_BI1\perl\bin

3) Copy below three the OBIEE 10 source files into any folder on 11g host (in my case it's D:\10g OBIEE Prod Backup)

            a) RPD (repository file)
            b) Catalog directory (Web Catalog)
            c) Delivers directory (iBot catalog)

see the screenshot below, i have copied them ...



Upgrade Process:

To upgrade the 10g repository and presentation catalog, perform following steps by using the Upgrade Assistant. 

Please note that the WebLogic Administration Server and the Managed Server in the 11g environment must remain running during the upgrade process.

To run Upgrade Assistant, open the bin directory in BI Home,
and execute  ua.bat  (as shown below)





When the below screen appears, click next ...



On the below screen, select "Upgrade Oracle BI RPD and Presentation Catalog" and click next ...



As mentioned above (in prerequisite #3) i had taken a backup of production rpd, catalog and deliveries folder into below folder...


On the below screen, provide RPD file, Catalog and Delivers directory,
Provide 10g Administrator username and password,
and click next ...


On the below screen, provide Port number and Administrator credentials...
Since i have customized 11g installation therefore in my case, Port number is 8001 and admin user is Weblogic.
However in your case port number may be 7001.
Click next ...



If 11g services are not running, then you may encounter below error after clicking next ...
"UPGAST-00014: unable to connect to Weblogic Server at localhost:8001"


In case you got the error just restart the BI services and resume the process by clicking next from the same screen.



Click next ...



On the below screen click Upgrade to start the upgrade process ...



Below screen will display the upgrade progress ... 



Once 100% completed, click next ...



Below screen display the upgrade summary, 
You can also click Log File path to view the log ..




From the above screen, you can see in above screenshot that, upgrade has completed successfully But there are 32 WARNINGs.

Open the log file mentioned in the above screenshot. We found following warnings ...

Two forms of default values are not the same. The attr one taken.  (17 times)
The child element 'calcItem' was removed from under the parent element 'edgeLayer'  (8 times)
Invalid columnID reference 'c9' in views! (6 times)
Removed the following node from the element 'view': [[<saw:selector xmlns:saw="com.siebel.analytics.web/report/v1.1" columnID="c0" prompt="true"/>]]   (1 time)

Since i am able to login and i have checked many of my dashboards, reports & subject areas are working as expected therefore i left these warnings unattended.
I am in contact with ORACLE on these warning messages. As soon as i get something will post on this blog.
I also tried to find over the internet but couldn't get enough information.

I will appreciate to receive any feedback on these warning messages, if someone has encountered the same and what fix applied ?



Now let's proceed with further verification ...

Post Upgrade Verification:

There is a lot to verify as far as reports, dashboards are user access is concerned. But in the first step lets verify below two things,


1- Repository & Catalog Verification

2- Security Model Changes

1) Repository & Catalog Verification:

Once migrated, you can view the upgraded RPD and webcat using EM

Open EM,  goto Business Intelligence -> coreapplication -> Deployment -> Repository -> you can see new repository as well as new catalog has been set there.



2) Security Model Changes:

There are changes in the Oracle BI 11g repository related to security:

1) Groups no longer exist in the repository as objects. These are replaced by application roles. 




2) Application roles are managed in an external policy store. Application role objects exist in the repository, but these objects are pointers (references) to the externally managed roles.

3) Users are managed in an external identity store and are no longer managed in the repository. User objects exist in the repository, but these objects are pointers (references) to the externally managed users.


Upgrade Assistant is just a utility. We cannot expect all the reports to start working out of the box immediately after an upgrade. A lot of testing is required to make sure all the older reports are working without any major issues. Also, not all the reports would get migrated seamlessly due to the significant changes across the versions which the utility cannot recognize. Care has to be taken to make sure that all the warnings logged as part of the upgrade process are properly analyzed and corrected manually. 

Cheers ;)



Wednesday, September 24, 2014

OBIEE 11g Refresh the GUIDs and Validate the Catalog. Solving "The Oracle BI server is not running Repository had to be closed"


Catalog Validation is a two step process.

i)  Refresh the GUIDs
ii)  Validate the Catalog

Let see how they can be done,

REFRESH THE GUIDS:

To refresh user GUIDs, perform the following steps.

1) Stop the BI Services
Start -> Programs -> Oracle Business Intelligence -> Stop BI Services

2) Take the backup of Catalog, instanceconfig.xml and nqConfig.ini into a separate folder.

3) Update the FMW_UPDATE_ROLE_AND_USER_REF_GUIDS parameter in NQSConfig.INI,
    FMW_UPDATE_ROLE_AND_USER_REF_GUIDS = YES

4) Update the Catalog element in instanceconfig.xml,
    Locate the Catalog element and update it as follows:
    <Catalog>
    <UpgradeAndExit>false</UpgradeAndExit>
    <UpdateAccountGUIDs>UpdateAndExit</UpdateAccountGUIDs>
    </Catalog>

5) Start the BI Services
Start -> Programs -> Oracle Business Intelligence -> Start BI Services

Note: Once you have started the BI Services, GUIDs will be refreshed and the BI presentation service will stop automatically once it is done.

6) Now restore the backup version of the instanceconfig.xml that you created earlier in step-2.

7) Start the BI Services
Start -> Programs -> Oracle Business Intelligence -> Start BI Services

VALIDATE THE CATALOG:

To validate the catalog, perform the following steps.

1) Stop the BI Services
Start -> Programs -> Oracle Business Intelligence -> Stop BI Services

2) Take the backup of Catalog, instanceconfig.xml and nqConfig.ini into a separate folder.

3) Update the Catalog element in instanceconfig.xml,
    Locate the Catalog element and update it as follows:
    <Catalog>
    <Validate>OnStartupAndExit</Validate>
    <ValidateAccounts>Clean</ValidateAccounts>
    <ValidateHomes>Report</ValidateHomes>
    <ValidateItems>Clean</ValidateItems>
    <ValidateLinks>Clean</ValidateLinks>
    </Catalog>

4) Start the BI Services
Start -> Programs -> Oracle Business Intelligence -> Start BI Services

Note: Once you have started the BI Services, catalog validation will be done. Presentation Services will be stopped automatically once validation completed.

5) Now restore the backup version of the instanceconfig.xml that you created earlier in step-2.

6) Start the BI Services
Start -> Programs -> Oracle Business Intelligence -> Start BI Services

Note:
Above procedure helped me in resolving one issue in which i was unable to start BI Presentation Services  after doing any change in the repository (rpd file).
Below was the error message,
"The Oracle BI server is not running. Repository had to be closed."

Sunday, September 21, 2014

OBIEE 11g How to create MDS and BIPLATFORM schema using Repository Creation Utility RCU



Before installing OBIEE 11g, you must have to install two schemas BIPLATFORM and MDS in your database.
To install these schemas ORACLE has provided a utility called Repository Creation Utility (RCU).
This utility can be downloaded from below location
http://www.oracle.com/technetwork/middleware/bi-enterprise-edition/downloads/bi-downloads-1525270.html




I have downloaded Windows 32-bit version and extracted to below location:
Open Bin directory and execute rcu.bat as administrator users and follow the below steps.




Click ‘Run’ …

 
Click ‘Next’ …


Click ‘Next’ …



Provide your database credentials as shown below.
Here it is important to provide a user with SYSDBA privileges.

Click ‘Next’ …



 
You can ignore above warning message …

 
Select "Oracle Business Intelligence"


 


Provide password for MDS and BIPLATFORM schema.



Click ‘Next’ …


It will notify for new tablespace creation. Click ‘OK’ to proceed …






Click ‘Create’ for schema creation …







You are done …

Cheers ;)