Authorization in OBIEE 12c (User/Group Security)

This post explains one of the ways to setup user level or group level security using a table in database. This uses a table in database that will have User and Group columns and includes users belonging to respective groups as records.

These groups would have to be added to Roles in Console and the permissions will be provided on these roles in Analytics (Folder/dashboard permissions in catalog or Column/data restrictions (RPD)). Once the User logs in BI Server identifies to which role user belongs to after checking the User/Group combination in this table and then identifying group/role relation in Console.

Scenario: There are Users (either created in Weblogic Console or Active Directory integrated) who would have to be provided with necessary privileges for object level and data level security based on business team they belong to (groups).

This is a two step process where data source need to be created first and then SQL authenticator will have to be configured.

1) Data Source:

1) Open WL Console, http://<server>:9500/console and click on Lock & Edit in Change Center on top left
2) From the menu on left select Services and then Data Sources
3) In Data Sources page click on New and then Generic Data Source
4) Provide following in the new pagr

Name: BIDBProviderDS
JNDI Name: jdbc/BIDBProviderDS
Database Type: <your database>

5) Select the database driver in next screen (for Oracle - Oracle Driver (Thin) for instance Connections
6) In the next page enter your database details that will be having the new table
7) Click next and then Test Configuration to verify the connection to database
8) If everything looks good click on Activate Changes on top left
9) Restart the services (Admin.biserver and components)

-- Create two tables in database as OBIEE_GROUPS and OBIEE_GROUP_MEMBERS


2) SQL Authenticator:

1) 1) Open WL Console, http://<server>:9500/console and click on Lock & Edit in Change Center on top left
2) From the menu on left select Security Realm and then myrealm
3) In the Providers tab click New and then provide name (SQLGroupProvider) and select BISQLGroupProvider from the drop down and click Ok
4) In the next screen click on new authentication provider that is just added - SQLGroupProvider
5) Under Configuration/Common select OPTIONAL in Control Flag list drop down and hit Save
6) Under COnfiguration/Provider Specific fill in below details and then click Save

·         Data Source JNDIName: jdbc/BIDBProviderDS    

·         SQLList Groups: SELECT GROUP_NAME FROM OBIEE_GROUPS WHERE GROUP_NAME LIKE ?  

·         SQLGroup Exists: SELECT GROUP_NAME FROM OBIEE_GROUPS WHERE GROUP_NAME = ? 

·         SQLIs Member: SELECT GROUP_MEMBER FROM OBIEE_GROUP_MEMBERS WHERE GROUP_NAME = ? AND GROUP_MEMBER = ?

·         SQLList Member Groups: SELECT GROUP_NAME FROM OBIEE_GROUP_MEMBERS WHERE GROUP_MEMBER = ? 

·         Descriptions Supported: Check Mark this option

·         SQLGet Group Description: SELECT GROUP_DESC FROM OBIEE_GROUPS WHERE GROUP_NAME = ?

7) Then click on Reorder button in Providers page and then make sure new SQLGroupProvider is top in the list followed by ADAuthenticator (if you have it) and then DefaultAuthenticator

8) Restart the services and test the user security, let me know your thoughts in comments.

Cheers!

Active Directory Integration in OBIEE 12c

This post lists steps to integrate Active Directory with OBIEE 12c installation so authentication in to OBIEE Analytics is taken care by AD.

1) Open Weblogic Console http://<server>:9500/console and use Weblogic credentials to sign in
2) Click on Lock & Edit in Change Center on top left
3) Click on Security Realms on left hand side and select myrealm (or the custom realm created) in next screen
4) Click on Providers tab and then stay in Authentication tab
5) Click on New button and in the next page give this new authentication name eg. ADAuthenticator and select type as ActiveDirectoryAuthenticator and click Ok
6) Click then on new authenticator created (ADAuthenticator) and change the Control Flag as SUFFICIENT under Configuration>Common tab and Save
7) Click then on Provider specific and fill in LDAP details which need to be obtained from LDAP admin
8) Then click on Performance tab and update the following properties.

 Max Group Hierarchies In Cache: 1000

 Group Hierarchy Cache TTL: 600

 Max SID To Group Lookups In Cache: 5000

9) Click Save and go back to Providers list and select DefaultAuthenticator and then change the Control Flag to Sufficient similar to step 6
10) Then click on Reorder button in Providers page and then make sure new ADAuthenticator is top in the list followed by DefaultAuthenticator
11) Click on Activate Changes in Change Center in top left and restart all services (Environment > Servers>Control>Force Shutdown and then restart)
12) This is an extra step for OBIEE 12c per the documentation.

Copy bi-sql-group-provider.jar file from DOMAIN_HOME/plugins/security to Oracle_Home/wlserver/server/lib/mbeantypes

After restart login using AD credentials should be successful. Next step is to setup a database table that will hold user/group association to have object/data level security but that is for another day please let me know in comments.

Cheers!

OBIEE 12c Node Manager keeps going Down

If you encounter Node manager service going down frequently in OBIEE 12c, it is probably because of insufficient heap memory size. In that case you will see error similar to below in the nodemanager log file.

<SEVERE> <Fatal error in NodeManager server>
java.lang.OutOfMemoryError: unable to create new native thread


In this case follow below steps...

1) Bring down all services (Nodemanager, Admin, biserver and bicomponents)
2) Go to <ORACLE_HOME>/oracle_common/common/bin/commBaseEnv.sh
3) Bump up the perm size to something like  -Xms32m -Xmx1024m
4) Save and restart alll services

If you are facing this issue it might be likely that you are having insufficient memory for Admin and biserver as well. Go ahead and change files in below location to have them fixed.

<DOMAIN_HOME>/bin/setDomainEmv.sh


Good Luck!!