FYI: Kimball Fact Table Primer (Star Schemas)

May 28, 2012, 9:16 pm

≫ Next: How to: Complete OBIEE 10g installation Part 2 and 3 - Oracle Analytics Server & Presentation Services

$

0

0

One fact table does not fit all, depending on your requirements you may have a need to identify all invoices transactions for a given point in time.  Maybe the end user wants to identify sales revenue for a regular, predictable date interval (such as quarter).  Also consider the order fulfillment pipeline which creates a scenario where a supply chain specialist must identify the span of time it takes a product to be processed through the pipeline.

Should 1 denormalized fact table design be used for the above scenarios? Of course not . Take, for example, Oracle Business Intelligence Applications HR Analytics 7.9.6.3 . Oracle designers created work force fact tables of various designs to capture the business process being measured: Transactional fact tables for employee salary, periodic fact tables for headcount, and accumulating fact tables for the HR recruitment process.

Below is a primer of Kimball fact tables and the characteristics of each one. Before selecting the fact table type to use for your design, always make sure you:

1) Identify the business process you are trying to measure
2) Determine the grain of the fact table
3) Identify the attributes of the fact table (dimensions)
4) Identify the measures to be captured in the fact table.

Also highly recommended: Read Kimball's Data Warehouse Tool kit. This is a must read for any OBIEE Architect. The table below is referenced from the above book.

CHARACTERISTIC	TRANSACTIONGRAIN	PERIODICSNAPSHOTGRAIN	ACCUMULATINGSNAPSHOTGRAIN
Time period represented	Point in time	Regular, predictable intervals	Indeterminate time span, typical short-lived
Grain	One row per transaction event	One row per period	One row per life
Fact table loads	Insert	Insert	Insert and update
Fact row updates	Not revisited	Not revisited	Revisited whenever activity
Date dimension	Transaction date	End-of-period date	Multiple dates for standard milestones
Facts	Transaction activity	Performance for predefined time interval	Performance over finite lifetime

These three fact table variations are not totally dissimilar because they share conformed dimensions, which are the keys to building separate fact tables that can be used together with common, consistent filters and labels. While the dimensions are shared, the administration and rhythm of the three fact tables are quite different.

keywords: dimensional modeling, kimball dimensional modeling, fact table, scd, slowly changing dimensions, dimension tables, obiee star schemas, physical star schemas

---

How to: Complete OBIEE 10g installation Part 2 and 3 - Oracle Analytics Server & Presentation Services

June 4, 2012, 10:44 am

≫ Next: How-to: Drill through & Guided Navigation 101 w/ OBIEE 10g Answers

≪ Previous: FYI: Kimball Fact Table Primer (Star Schemas)

$

0

0

In our last how-to post we covered the first step of installing OBIEE 10g on linux , Configuration of JDK for Oracle Business Intelligence

This post will focus on steps 2 and 3 below:


1) Configuration of JDK for Oracle Business Intelligence  - COMPLETE
2) Set up of the Oracle Business Intelligence Server
3) Set up of the Oracle Business Intelligence Presentation Services
4) Set up of the Oracle Business Intelligence Client Tool set

In Step 1 we:

1) configured JDK for our redhat linux box
2) created applicable usernames and groups
3) granted directory permissions to specific folders
4) created environmental variables needed for OBIEE 10g installation.


Do not continue unless you have completed the above steps, as they are pre-requisites for Steps 2 and 3.


Step 1 : Modification of bash shell script to include Oracle Environmental Variables


The OBIEE 10g installation is going to look for the following variables in your bash profile:

1) $JAVA_HOME
2) $PATH  - modified to include your OBI Set up folder

We created the $JAVA_HOME variable in step 1, so let's go ahead and modify our bash shell script to include the OBI Set up folder for the $PATH variable

For user account OBI, run the following command in terminal:

vi ~/.bash_profile

modify the bash shell start up script to include 

# OBI Setup Script
PATH=$PATH:/usr/local/OracleBI/setup
export PATH

Also, set the file descriptor limit to 10240 

# File Descriptor Limit
ulimit -n 10240 

Here is a VI review guide incase your VI skills are a little rusty: http://www.washington.edu/computing/unix/vi.html 


Step 2: Create installation folders & grant required access

Oracle Analytics Server uses /usr/local/setup/OracleBI and /usr/local/setup/OracleBIData for installation and execution. We need to create those folders and grant our user obi read write access:

Log into your root/super user account or have the sys admin execute the following commands:
 

mkdir -p /usr/local/OracleBIchown -R obi:oinstall /usr/local/OracleBIchmod -R 775 /usr/local/OracleBImkdir -p /usr/local/OracleBIDatachown -R obi:oinstall /usr/local/OracleBIDatachmod -R 775 /usr/local/OracleBIData

Step 3: Confirm /dev/random and /dev/urandom are available

Oracle BI  Presentation Services requires pseudo random number generation devices. Confirm your system has urandom and random installed:

In terminal, run the following command:

[cookjohn@local]/usr/local/OracleBI/setup% cd /dev
[cookjohn@local]/dev% ls *random

You should see the following output:

random  urandom

Step 4: Download Oracle BI Suite EE 10.1.3

Navigate to http://www.oracle.com/technetwork/middleware/bi-enterprise-edition/downloads/business-intelligence-10g-165415.html 

and download x86 (Red Hat Linux / Oracle Enterprise Linux)

Then extract the file to your /tmpfolder. You should have 2 folders:

drwxrwxr-x  3    59934 oinstall       4096 May 24 10:40 Server
drwxrwxr-x  5    59934 oinstall       4096 May 24 10:41 Server_Ancillary


Using your root/super user account, execute (or have the sys admin) the following commands:

chown -R obi:oinstall /tmp/Server
chmod -R 775 /tmp/Server
chown -R obi:oinstall /tmp/Server_Ancillary
chmod -R 775 /tmp/Server_Ancillary

Step 5: Run final compatibility check with UnixChk.sh

Oracle created a script which will determine if you've successfully completed all of the pre-work needed for installation.
In terminal, run the following command:

./UnixChk.sh -b /usr/local/OracleBI 

You should get the following output: 

SUCCESS!! - This machine is configured for Oracle BI EE 10.1.3.3.2 

Step 6: Proceed with installation

Congratulations, you've completed all of the required pre-work needed to install OBIEE! Let's get started! Navigate to your /usr/local/OracleBI/setup folder and run the following command:

./setup.sh -console

You will be asked to identify your java directory, installation type and installation folder.

Here are the details:

• Installation Location: /usr/local/OracleBI
• Data Location: /usr/local/OracleBIData
• Installation Type: Basic
• JDK Location: /usr/java/jdk1.5.0_22
  
  
   

 FYI: Basic vs Advanced Installation Primer:

Basic installation uses the J2EE Application Server rather than the Oracle Application Server. If you want to utilize single sign on, select Advanced.

In terminal, your summary should be as follows:

Oracle Business Intelligence 10.1.3.4.1 will be installed in the following
location:

/usr/local/OracleBI

with the following features:

Oracle Business Intelligence JDBC Driver
Oracle Business Intelligence Systems Management
Oracle Business Intelligence Server
Oracle Business Intelligence Cluster Controller
Oracle Business Intelligence Scheduler
Oracle Business Intelligence Client
Oracle Business Intelligence Presentation Services
Oracle Business Intelligence Presentation Services Plug-in and BI Office
Oracle Business Intelligence Publisher

for a total size:

 2626.9 MB

Press 1 for Next, 2 for Previous, 3 to Cancel or 4 to Redisplay [1] 


|-----------|-----------|-----------|------------|
0%         25%         50%         75%        100%
||||||||||||||||||||||||||||||||||||||||||||||||||||

Installing Oracle Business Intelligence 10.1.3.4.1. Please wait...
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||

Creating uninstaller...

Please wait...

-------------------------------------------------------------------------------
The InstallShield Wizard has successfully installed Oracle Business
Intelligence 10.1.3.4.1.

Step 7: Start Services

Now that you've installed OBIEE Server & Presentation services, you need to activate it by running the following scripts from your /usr/local/OracleBI/setup folder:

./oc4j -start # starts Oracle Application Server
./run-sa.sh start # starts BI server
./run-saw.sh start # starts presentation server
./run-ccs.sh start  # Oracle BI Cluster Controller

To shutdown the server, you need to run the commands in the opposite order:

./run-ccs.sh stop
./run-saw.sh stop
./run-sa.sh stop
./oc4j -shutdown -port 23791 -password oc4jadmin 

Step 8: Log into Answers

Navigate to your web server's root directory and append :9704/analytics/saw.dll?Dashboard to it. For example, if your web server is http://www.example.com , your url would be : http://www.example.com:9704/analytics/saw.dll?Dashboard

Default user/pass is : Administrator/Administrator

You can access Oracle Enterprise Manager 10g by appending :9704/em/ to your web server's root directory

In Summary, we :

1) Configured JDK for OBIEE

2) Created the appropriate installation folders

3) Created required environmental variables
4) Confirmed the system had appropriate random number generation scripts

5) Modified the file descriptor limit

6) Validated our configuration using Oracle's UnixChk script

7) Installed OBIEE 10G Server & Presentation Services using the basic installation method (Java instead of Oracle's Application Server)

8) Determined the process for starting and stopped services
9) Validated installation by navigation to the default Answers & Oracle Enterprise Manager 10g URLs.

Excellent job if you've made it this far. If you've been paying attention, you'll notice that only server side components have been installed. We still need to install the Client tools which allow us to modify the repository and remotely connect to the linux box. Stay tuned!

keywords : obiee 10g installation, obiee 10g linux, obiee 10g server installation process, obiee 10g configuration, obiee install linux

How-to: Drill through & Guided Navigation 101 w/ OBIEE 10g Answers

July 2, 2012, 2:23 pm

≫ Next: How-to: Oracle Internet Directory Authentication with OBIEE 11g - Part 1

≪ Previous: How to: Complete OBIEE 10g installation Part 2 and 3 - Oracle Analytics Server & Presentation Services

$

0

0

OBIEE offers 2 types of drilling for slicing & dicing:

1) Drill down- Using a hierarchy to navigate to a lower level of granularity for a specific report or data set

2) Drill through/drill across  - Using Answers to navigate from report 1 to report 2 in order to view additional fields while saving the filters used in report 1.

Consider the requirement of navigating from a summary report which displays Revenue by Quarter to a detailed report which breaks down revenue by month and includes additional metrics such as Booked Amount and Unit Price.

If the requirement only needed revenue by Month, then we could configure a hierarchy to drill from Quarter to Month. But since the user needs to see additional metrics in the detailed report, we must utilize the drill through feature to accommodate this requirement.

Step 1:  Create Summary Report with specified prompts and metrics.

In the above example I used SampleSales OOTB RPD to create a report that has slices Revenue by Quarter and created a prompt to filter the report by Area.

Make sure you specify M02 Area has prompted in your summary report:

 Step 2: Create Detailed report 1 with dimensions from report 1 set to filters as 'Prompted'

If you want both 'T03 Per Name Qtr' and 'M04 Region' values to be applied to your detail report, then you must set 'T03 Per Name Qtr' and 'M04 Region'to 'is Prompted' in your detail report.

Step 3:In Summary Report 1, enable Guided Navigation to to Detailed Report 1

For your KPI (in this example 0-01 Revenue (Sum All)) , click Column Properties - > Column Format Tab ->  Value Interaction Drop Down Menu - > Select Navigation then find your detailed report 1

Step 4: Test by Navigating from Summary Report 1 to Detail Report 1

I recommend adding the 'Filter' has a section to your detailed report to confirm that the values are getting passed. 

Report 1:   Filters ; M02 Area = 'Area 0', T03 Per Name Qtr = '2007 Q1', M04 Region = 'South' for first row where 1-01 Revenue (Sum All) = 27,391

Report 2:

keywords: obiee answers, drill down, drill through, drill down report, obiee guided naviation

How-to: Oracle Internet Directory Authentication with OBIEE 11g - Part 1

August 25, 2012, 6:45 pm

≫ Next: How-to: Oracle Internet Directory Authentication with OBIEE 11g - Part 2

≪ Previous: How-to: Drill through & Guided Navigation 101 w/ OBIEE 10g Answers

$

0

0

Consider the scenario where you're configuring a proof of concept 11g implementation using Oracle Internet Directory as the authentication provider. Oracle's Fusion Middleware Security Guide for 11g certainly provides you with a bird's eye view of how to configure OBIEE 11g to integrate with web logic's OID LDAP authentication provider but in this how-to I will digress slightly and present a detailed, step by step guide on how to configure your OBIEE 11.1.1.6 system to use OID LDAP authentication for users.

This how-to is a culmination of the countless posts on Oracle Technical Network requesting additional help with implementation and will provide the user answers to the most common OBI and OVD (Oracle Virtual Directory) errors that you typically encounter in this proces, including: OVD-40666, OBI-SEC-00022, OBI-SEC-00015, and LDAP error code 32.

At the end of this how-to, any user within OID will be able to log into OBIEE 11g Answers.

Note that if you're using OID as the authentication provider but storing groups in an external database table, this also serves as a suitable 'step 1' prior to implementing the groups authentication model (to be covered at a later date)

Prequisities:

Your Oracle Internet Directory must have the following users:

• BISystemUser
• BIAuthor
• BIConsumer
• BIAdministrator

These are out-of-the-box weblogic users that weblogic uses in its defaultauthenticator for users, groups, and application roles.

If you are using Oracle Internet Directory to store groups, then it must include the following weblogic out of the box groups:

• BIAdministrators
• BISystemUsers
• BIAuthors
• BIConsumers

Step 1: Add Oracle Internet Directory as an Authentication Provider in Weblogic Administration Console

1.a) Navigate to Security Realm -> myRealm -> Providers -> Authentication -> New 

to add an OID Authentication Provider

* Note that at this point, you  will not  see myOIDDirecotory in your Authentication Provider. You will be adding this authentication provider in the next steps. Your only two authentication providers should be: DefaultAuthenticator and DefaultIdentityAsserter

1.b) After Clicking 'New', populate the 'Create a new Authentication Provider' screen as outlined below:

1.c.) After clicking 'Ok' Your myOIDDirectory Authenticator Provider will appear on the Authentication Provider list below: Click 'myOIDDirectory' to begin the configuratin of the Provider Specific information:

Step 2:  Configure the myOIDDirectory Authentication Provider with required connection details

 2.a) After clicking 'myOIDDirectory' navigate to 'Configuration' -> Provider Specific  as seen below:

The correct configuration of Host, Port, Principal, and Credential is required before proceeding to step 2.b.. If you are unfamiliar with Oracle Internet Directory, it is recommended that consult your OID Administrator for assistance. Here is a breakdown of each required field.

Host is the ip address of your company's OID LDAP server.

Port represents the port number that the OID LDAP server utilizes for listening & communication

Principal  represents the distinguished name (DN) or 'orcladmin' account needed to connect the OID LDAP server. Yes that is correct, you will need a cn=orcladmin or equivilent account for communication to the OID LDAP server.  We have tested leaving the Principal and Credential field blank even if anonymous binding is enabled, with no success.

Your principal  DN should represent the full path to the orcladmin account and not just cn=orcladmin. 

For example: If your cn=orcladmin (or equivilant) account is under :

cn=Users,dc=trusted,dc=oracle,dc=com 

Then the above Principal DN should be : cn=orcladmin,cn=Users,dc=trusted,dc=oracle,dc=com . It is not sufficient to only include cn=orcladmin

Credential/Confirm Credential represents the password of the cn=orcladmin (or equivalent) account.

Failure to correctly configure the host/port/prinicpal settings will most likely result in one of the following errors:

• OBI-SEC-00004 Unable to initialize oracle.bi.security.service.SecurityWebService
• OVD-60024 Connection error: [LDAP: error code 49 - Invalid Credentials].
• OBI-SEC-00028 System User could not be authenticated
• OBI-SEC-00003 OVD-60143 Unable to create connection to ldap:// 

 2.b)  Configure remaining required settings

 

 User Base DN represents the OID tree branch path that stores the users .

NOTE: Here is where many people misconfigure their OID Authentication Provider in web logic. Oracle's Fusion Middleware Security Guide does not explicitly state this, but your User Base DN needs to be 1 level higher than the tree branch which stores your user list.

For example:

If your OID that contains your users is: cn=Users,dc=trusted,dc=oracle,dc=com  , then your User Base DN needs to be: dc=trusted,dc=oracle,dc=com.

Failure to appropriately configure this step will result in OBI-SEC-00022 error:

SecurityService::authenticateUserWithLanguage [OBI-SEC-00022] Identity found <username> but could not be authenticated

 which means that Oracle was able to find the user in the web logic console under 'Users and Groups' but could not complete the authentication against OID.

User Name Attribute  specifies the OID attribute which you want to use to authentication. If you want to use the user's email address, the User Name attribute would be mail. In this example, I will use the common name (cn) .

User Object Class  specifies the tree branch in OID that contains the users. Out of the box OID implementation uses 'person' , but in this example i've used a custom 'Staff tree'.

Group Base DN represents the OID tree branch path that stores the groups. Similar to User Base DN, it should be 1 level higher than the tree branch which stores your groups list. If  you are using an external database table to store groups, than you can disregard this field.

Step 3: Configure the authentication control flag to sufficient

After clicking saving on 'Settings for myOIDDirectory' page, you should be back at:

3.a) Click 'myOIDDirectory'  then Configuration -> Common and change the Control Flag to 'SUFFICIENT'

A SUFFICIENT control flag indicates that if the user successfully authenticates against this provider, then weblogic will release control back to the system. But if the user fails to authenticate with this provider, weblogic will continue down the authentication provider list.

Step 4: Reorganize the authentication provider list

After clicking Save on the 'Common' tab of the Settings for myOIDDirectory, you will be back in the Authentication tab. Click 'reorder' and move myOIDDirectory to the top of the list.

and then...

4.a) After clicking 'OK' you will be taken back to the Authentication tab. Click 'Activate Changes' within the Change Center, then reboot the Admin Server & BI Service.

Step 5: Validate your OID users are found in the 'Users and Groups' tab

After rebooting the Admin Server and BI Service you should be able to see the Users and Groups of your OID LDAP server within the Users and Groups tab under: SecurityRealms -> myrealms -> Users and Groups

You should also test Groups by clicking on a user within your OID directory (for example cookjr@c02) and then viewing the groups tab:

Even if you are using an external database table to store groups (and not OID), clicking on groups for a specific user should not return an error. 

"If your users do not appear on the Users and Groups tab, or viewing the groups of a specific OID user throws an error, do not proceed to step 6 and instead, review your configuration settings with your OID Administrator"

Step 6: Fusion Middleware Changes

At this stage, we are going to move to Fusion Middleware to make the required application role changes. I've decided to seperate that into part 2 which you can find here


keywords: obiee 11g authentication, ldap authentication, weblogic authentication provider, obiee 11g oid authentication, custom authentication provider

How-to: Oracle Internet Directory Authentication with OBIEE 11g - Part 2

August 25, 2012, 8:46 pm

≫ Next: FYI: Enabling Virtualization (virtualize=true) and OBI-SEC-00015

≪ Previous: How-to: Oracle Internet Directory Authentication with OBIEE 11g - Part 1

$

0

0

In our part 1 of 'Internet Directory Authentication with OBIEE 11g' we used weblogic to:

1. Add OID to the Authentication Provider List
2. Configure the OID Authenticator with required credentials
3. Configure the authentication control flag
4. Re-configure the authentication sequence
5. Validate that the OID users and groups are appearing in weblogic

In this post we will move to the Oracle 11g Enterprise Manager : Fusion Middleware  (located in :7001/em/ )

Step 1: Configure the user name and virtualization attributes within the Fusion Middleware Identity Store

In the Weblogic Domain folder navigate to Security -> Security Provider Configuration menu option

then click 'Configure':

You will need to add the following 3 custom properties:

Property	Value
user.login.attr	Specify the User Name Attribute that is set in the authentication provider. For example, if the User Name Attribute is set to mail in the authentication provider, then set this value to mail.
username.attr	Specify the User Name Attribute that is set in the authentication provider. For example, if the User Name Attribute is set to mail in the authentication provider, then set this value to mail.
virtualize	TRUE

Step 2:  Add BISystemUser to the BISystem Application Role

After clicking 'OK', navigate to the Application Roles screen as follows:

2.a) Click BISystem under the rolename column. You should see a user called 'BISystemUser' under Membership for BISystem' table

You might ask yourself, 'Why do I need to add the BISystemUser to the BISystem Application Role if that user is already a member?'

And the answer is: YOU DON'T! But why? Remember the prerequisite in part 1 was to have a BISystemUser created in OID? That was because OBI uses a specific user for each configured authenticator for internal communication within weblogic. Furthermore, each configured authenticator needs to be a member of the BISystemUser application role for Administrator privileges.

Rather than maintaining separate pseudo BISystemUser accounts in each authenticator, Oracle recommends 1 BISystemUser for all authentication providers  . Although, if you decided to maintain a BISystemUser in your OID under a different alias, you would need to add the user to the BISystemUser Application Role as outlined above.

Step 3: Add your OID BISystemUser to the Credential Store Provider

After clicking 'OK', Navigate to the Credential Store Provider screen as follows:

3.a) expand the oracle.bi.system folder and edit the 'system.user' credential

3.b) Modify the system.user key to specify your 'OID' BISystemUser

If you've been paying attention, you should be asking yourself 'What about the BISystemUser in the Default Authenticator?'

Answer: If you do not change your default authenticator password to match the BISystemUser password in your OID, then you will not be able to authenticate any weblogic system users in answers. You will get an error:

Error Message From BI Security Service: SecurityService::authenticateUserWithLanguage [OBI-SEC-00015] Unable to find user in identity store When attempting to log into Answers with a weblogic user such as OraclesSystemUser or weblogic (BISystemUser will work because you've specified myOIDDirectory as sufficient and ranked it higher priority on the provider list than your default authenticator).

Step 4:  Change your default authenticator BISystemUser password to match the BISystemUser password in OID

I made this a high level step rather than a sub step to emphasize the importance. If this step is skipped, you will not be able to log into weblogic with any system users.

Navigate to the Weblogic Server Admin Console (:7001/console/) -> Security Realm -> myrealm -> Users and Groups -> Users -> BISystemUser (DefaultAuthenticator)


 *note that if your OID system has more than 1000 users then you will have to click the 'Customize this table' link and search for BISystemUser


Make the BISystemUser password in your default authenticator the same password as BISystemUser in your OID authenticator

  Step 5: Add BISystemUser to the Global Admin Role

Navigate to Security Realm -> myRealms -> Roles and Policies -> Realm Roles -> Global Roles -> Roles -> Admin -> View Role Conditions

then...

then..

and finally add 'BISystemUser' under 'User Argument Name'

At 'Edit Global Roles', your screen should look like:

Step 6: Add BISystemUser to the JMS OBI Module

Navigate to Services -> Messaging -> JMS Modules -> BIpJmsResource -> Security Tab -> Policies Sub Tab and add the BISystemUser in a similar fashion as in step 5

After adding BISystemUser, your 'Settings for BipJmsResource' page should look like:

Step 7: Set the Control Flag in your defaultAuthenticator to 'OPTIONAL'

A control flag of optional indicates that authentication can fail or succeed with the specified provider. If the provider succeeds, it will continue down the authentication list. If tf the provider fails, it will also continue down the authentication list. This is ok because we've specified the DefaultAuthenticator as the last authentication provider on the list.

Navigate to : Security Realm -> myRealms -> Providers -> Authentication -> Default Authenticator -> Configuration -> Common

Step 8: Activate Changes and restart Admin Server & BI Service

Step 9: Validate OID Authentication by logging into Answers:

and finally if you were to look at the bi_server1-diagnostic.log in Fusion Middleware , it would confirm the OID authentication as follows:

Next I will cover OID Authentication in 11g while using external databases to store groups.


keywords: OBIEE 11g security, ldap authentication, weblogic authentication provider, obiee ldap, obiee authentication, alternate authentication providers

FYI: Enabling Virtualization (virtualize=true) and OBI-SEC-00015

August 25, 2012, 9:37 pm

≫ Next: FYI: Identity found in Weblogic but could not be authenticated (OBI-SEC-00022, OVD-40066)

≪ Previous: How-to: Oracle Internet Directory Authentication with OBIEE 11g - Part 2

$

0

0

Many OBIEE blogs that discuss external authentication with obiee 11g (including my recent post on OID integration ) specify that a virtualize=true parameter is required for the configuration of Fusion Middleware's Identity Store. Even Oracle's own technical documentation specify this as a required parameter when dealing with multiple authentication sources.

Here is an example of a common Identity Store configuration w/ OID and a default authenticator:

Yet a quick google search will tell you that many practitioners have encountered problems (or so they think) with the virtualize = true parameter during their external authentication implementation.

What does the virtualize=true parameter mean?

If you are implementing multiple authentication providers, you need to 'enable' Fusion Middleware applications to see all the users, groups, and roles within the Weblogic Administration Console.   This is accomplished with Oracle Virtual Directory (OVD). Oracle Virtual Directory is an LDAP service that provides virtualized abstraction of multiple data sources into a single view.  By specifying virtualize=true, Fusion Middleware utilizes the OVD service as the mechanism for identifying, storing, and accessing users and groups across multiple authentication systems.


Does DefaultAuthenticator count as an authentication source?

When implementing weblogic 11g/obiee out of the box, a weblogic defaultAuthenticator is provided with 3 system accounts : BISystemUser, OracleSystemUser, and weblogic. Multiple posts have been created on Oracle Technical Network questioning the need to count the default authenticator as an authentication source.

What happens we do not count Default Authenticator as an authentication source, there by eliminating the need for virtualize=true?

If you're encountering a scenario where you have an external LDAP authentication (OID, ADUC) as well as the default authenticator for system users, and you remove the virtualize=true paramater in the Identity Store, you will still be able to log into OBIEE 11g Answers w/ your OID/ADUC users.

But try logging in with a System User (e.g. weblogic or OracleSystemUser): You will encounter OBI-SEC-00015 error:

Error Message From BI Security Service: SecurityService::authenticateUserWithLanguage [OBI-SEC-00015] Unable to find user in identity store

An examination of your bi_server1-diagnostic.log will confirm the error:

 Conclusion?

• The DefaultAuthenticator does count as an authentication source
• If you are going to implement an external authentication provider and use the DefaultAuthenticator, virtualize=true is needed for the DefaultAuthenticator system users

If you are unable to log into Answers 11g with your OID/ADUC users, the problem is most likely not the virtualize=true flag.   Review your configuration settings, search OTN, and remember - virtualize=true is needed!



keywords : OBIEE 11g authentication, ldap authentication, weblogic authentication provider, OBI-SEC-00015, virtualization, external groups authentication

FYI: Identity found in Weblogic but could not be authenticated (OBI-SEC-00022, OVD-40066)

August 25, 2012, 10:06 pm

≫ Next: FYI: ORACLE_HOME Environment Variable and OBIEE 11g RPD error ORA-12154

≪ Previous: FYI: Enabling Virtualization (virtualize=true) and OBI-SEC-00015

$

0

0

During most 11g implementations, a practitioner will be required to implement a security policy that allows OBIEE 11g Answers to authenticate against an external data source (such as OID , ADUC, or even an external database). Infact, I've even posted a how-to on integrating Oracle Internet Directory as an authentication source with 11g Answers .

During the security integration process, Oracle's technical documentation recommends that the practitioner should verify that the Users and Groups are visible in Weblogic Admin Console before completing the implementation process.   See the screen below for an example of a fairly common Users and Groups section:

Nothing too spectacular. You'll see that the user i've filtered on has 'myOIDDirectory' (the name of my OID authentication provider) listed as its source.

Per Oracle's technical documentation, we would mark this as a success and move on.

Now you attempt to log into Answers 11g and the authentication fails:

Your real time log now says the following: 

SecurityService::authenticateUserWithLanguage [OBI-SEC-00022] Identity found but could not be authenticated

and your bi_server1-diagnostic.log confirms:

Relax, you're not alone, and the fix is quick : If you've configured an external authentication provider using Oracle Internet Directory or Active Directory , OBI-SEC-00022 most likely means you've provided the correct User Base DN but at the wrong level.

For example (using OID):

If your OID tree is : cn=team,cn=users,cn=company,dc=trusted,dc=oracle,dc=dev - meaning that your user list is under the cn=team branch (reading left to right, cn=company being the root), then you need to specify your User Base DN one level above that branch. In this case, your User Base DN would be

cn=users,cn=company,dc=trusted,dc=oracle,dc=dev

Although not specifically stated in the Fusion Middleware Security Guide , your User Base DN should be one level above the branch that contains your users.

Also, make sure your Principal DN specifies the full path. 

For example:

If you're authenticating with cn=orcladmin, your Principal DN cannot be cn=orcladmin. It should be:

cn=orcladmin,cn=team,cn=users,cn=company,dc=trusted,dc=oracle,dc=dev  - assuming that the orcladmin account is under the cn=team directory.

keywords: obiee 11g security, obiee ldap authentication, OBIEE-SEC-00022, OVD-40066, OBIEE OID authentication, weblogic authentication provider

FYI: ORACLE_HOME Environment Variable and OBIEE 11g RPD error ORA-12154

August 28, 2012, 5:29 pm

≫ Next: FYI: OBIEE 10g to 11g Upgrade Process Validation Plan and bug 1467168.1 (Multiple Pie Charts Displayed for a Pivot Table)

≪ Previous: FYI: Identity found in Weblogic but could not be authenticated (OBI-SEC-00022, OVD-40066)

$

0

0

Consider the scenario where you've been asked to install a fresh 11g stack on a server. A normal OBIEE 11g stack includes:

• 11g database
• Repository via RCU
• 11g weblogic domain
• Admin Server
• Managed Server scaled out n times for each ManagedServer instance
• OBIEE 11g (managed within the weblogic domain)
• 11g presentation server
• 11g client tools

Due to financial constraints, you've been asked to install the 11g database, 11g weblogic domain and 11g presentation server on a single server. This in its self is not an issue, and is common practice, especially for proof of concepts.

In a standard 11g database install, you'll set your $ORACLE_HOME variable to ..\.\

product\11.2.0\dbhome_1\

This is where you'll store your TNSNames.ora and SQLNet.ora files. These files are critical because they determine the database addresses needed for establishing a collection. Your default tnsnames.ora file will most likely include your localhost.  See below for an example:

Now you've installed the database, created the RCU and you're ready to install & configure Fusion Middleware (formally 10g's Enterprise Manager).

But wait!Fusion Middleware's Configuration Guide says create an ORACLE_HOME environment variable and set it to OBIEE 11g's database path:  app\11g\mw_home

See table below:

 

OBIEE 11g ORACLE_HOME	app\11g\MIDDLEWARE_HOME
Oracle 11g database ORACLE_HOME	app\CookJR\product\11.2.0\dbhome_1

What do you do?

Keep your ORACLE_HOME environment variable set to your DB path and make sure any datasources you add as a physical layer of the RPD are added to the ORACLE_HOME db path and not the 11g ORACLE_HOME

This is critical because during the configuration of your OBIEE system within 11g you'll be required to set the ORACLE_HOME path twice:

1. When you configure your Oracle Identity Store to utilize an external database
2. When you update your tnsnames.ora file to contain the physical data sources of your connection pool within the RPD

If you fail to adhere to this policy, you will encounter the following error when you create a connection pool in your physical layer:

ORA-12154: TNS:could not resolve the connect identifier specified at OCI call OCIServerAttach. [nQSError: 17014] Could not connect to Oracle database. (HY000)

This is actually a known Oracle Bug (Search OTN ID 129637.01) and if you encounter this error , relax the fix is quick:

STEP 1: Edit registry under HKEY_LOCAL_MACHINE\SOFTWARE\ORACLE\<Oracle_Home> to make sure NLS_LANG key is set to a valid characterset for the Oracle Client used as the DSN.

STEP 2: Edit the file %MiddleWare_Home%\instances\instance1\bifoundation\OracleBIApplication\coreapplication\setup\bi-init.cmd to set %ORACLE_HOME%\bin as first entry in the PATH.
e.g.

set PATH=%OBIEE_HOME%\bin;%OBIEE_HOME%\bifoundation\server\bin;%OBIEE_HOME%\bifoundation\web\bin;C:\Oracle\BIEE_11g\jre\bin;%windir%;%windir%\system32;%PATH%

STEP 3 Please edit the file %MiddleWare_Home%\instances\instance1\bifoundation\OracleBIApplication\coreapplication\setup\user.cmd to set TNS_ADMIN to your Oracle client tnsnames.ora home directory path (in case exists) or to your OBIEE tnsadmin %OBIEE_Client_Home%\Oracle_BI1\network\admin.
e.g.

set TNS_ADMIN=C:\oracle\product\11.2.0\client_1\network\admin

Oracle Technical Network says you can't test this in online mode, but it is possible by creating a new connection pool and then attempting to 'Import Metadata'. No reboot is required. 

If you pass Step 1:

you have successfully connected to your physical data source using the tnsnames.ora file located in your

app\CookJR\product\11.2.0\dbhome_1 folder. Congrats!

keywords : obiee 11g upgrade, obiee ORACLE_HOME variable, obiee 11g guide, obiee 11g installation, ORA-12154

---

FYI: OBIEE 10g to 11g Upgrade Process Validation Plan and bug 1467168.1 (Multiple Pie Charts Displayed for a Pivot Table)

August 30, 2012, 6:41 pm

≫ Next: How-to: OID Authentication with Groups Stored in an External Database Table - OBIEE 11g

≪ Previous: FYI: ORACLE_HOME Environment Variable and OBIEE 11g RPD error ORA-12154

$

0

0

So you've just completed your 10g repository and web catalog upgrade to Oracle's new 11g platform, congratulations! Per Oracle's Fusion Middleware Upgrade Guide for OBIEE 11g you're now ready to to perform, in my opinion, the most difficult task of the upgrade process : the validation of the upgraded environment (as pictured below):

A comprehensive OBIEE validation plan should include the following:

1. A thorough comparison of functionality of existing reports in the web catalog
2. Confirmation of customizations in the repository, including but not limited to:
1. level based measures
2. physical/bmm star schema
3. complex joins
4. derived measures
5. hierarchies
6. variables (session, static, dynamic)
3. Security - the upgrade to 11g will require you to make security changes to your 10g model, so customization is required, but you'll want to confirm the following none the less:
1. object level security in the web catalog
2. data level security in the repository
1. note* that any filters applied to your Groups in the 10g rpd will not be present in the 11g RPD as groups have been removed from the metadata layer completely

Security Manager 10g:

Security (Identity) Manager 11g:

Now as you complete step 1 of your validation plan ( A thorough comparison of functionality of existing reports in the web catalog)

You notice that all of your 10g pivot table pie charts are all being generated incorrectly! Rather than 1 pie with x slices, your 11g pivot table pie charts are x pies each with one slice.

10g pivot table pie chart:

11g pivot table pie chart:

Before you begin the process of estimating hours to manually re-configure every pie chart in your system, WAIT!

This is actually a known 11.1.1.6.0  bug[ID 1467168.1] which can be fixed using Oracle's oPatch software and Patch 14003822 via Oracle Support

The steps on how to apply this patch, or even utilizing oPatch in general, are hazy at best so below is a step by step outline on using oPatch w/ Patch 14003822 :

Step 1: Identify your oPatch directory

Normally located in your $ORACLE_HOME/opatch directory. After identifying your directory, add the oPatch path to your system PATH variable as you'll be running the 'opatch' application from command line.

Step 2:  Confirm core oPatch files exist 

By running the following via command line:

  - opatch lsinventory -jre $ORACLE_HOME/jdk/jre
Your output should be familiar to the screen below:

Step 3:  Install  Patch 14003822

Navigate to the directory that contains your unzipped Patch folder 14003822 and perform the following command:

   - opatch apply -jre $ORACLE_HOME/jdk/jre
Your screen should be similar to:

A successful patch will result in the following message:

Step 4: Validate Changes

BEFORE:



AFTER:

Original 10g chart for reference:





keywords: obiee 10g to 11g upgrade, 1467168.1, obiee 11g pie charts, obiee 11g upgrade, obiee 11g roadmap

How-to: OID Authentication with Groups Stored in an External Database Table - OBIEE 11g

September 13, 2012, 6:38 pm

≫ Next: How-to: Mapviewer Integration with OBIEE 11g (11.1.1.6 and higher)

≪ Previous: FYI: OBIEE 10g to 11g Upgrade Process Validation Plan and bug 1467168.1 (Multiple Pie Charts Displayed for a Pivot Table)

$

0

0

As more firms seek to consolidate their technology stack while expanding their analytics capabilities, it makes more and more sense to transition your OBIEE 10g analytics solution to Oracle's new 11g framework. Oracle's 11g framework provides, among other things:

• An integrated solution for managing & deploying 11g applications from a single environment (Weblogic and Fusion Middleware)
• A centralized system for configuring security across all your environments
• Integration with Oracle's 11g exadata & exalytics solutions
• A framework for utilizing external web services within your reporting solution
• e.g. Your company seeks to expand its business and enter a new market so you create a report using 11g's mapviewer utilizing Yelp.com's API to aggregate user reviews to determine what services consumers are the unsatisfied with, thus allowing you to quantify new business opportunities and entry points. You definitely cannot do that in 10g :)

But before you can save the world and generate new business ideas for your company - step 1 is to deploy the OBIEE 11g application within your company. You've done an analysis of your company's security policy and determined that user authentication is stored in Oracle Internet Directory but corresponding reporting groups are stored in an external database table.

In 11g you can accommodate this security model by deploying two authentication providers: one for OID, and another for the external database table. I've outline the steps below needed to accomplish this task:


Step 1: Configure OID Authentication

To successfully implement an 'OID authentication w/ groups in an external database' security model, you are really completing two separate tasks:

1) Configure OID Authentication
2) Configure external groups authentication

I've posted a complete series on how to configure your 11g environment to utilize OID as an authentication source . The OID authentication configuration process is approximately 15 steps, so take your time, document your process and before proceeding to step 2  -  make sure you can log into your 11g Answers environment with users in your OID.

Do not proceed to step 2 until your OID users can successfully log into the 11g Answers environment.

Step 2:  Deploy your Sample Schema for Groups & Group Members

In your 10g deployment, you probably created an init block that stored a user's groups to the GROUPS session variable. 11g handles user group authentication via Weblogic & Fusion Middleware using an authentication provider similar to the one you created for your OID authentication. The only difference between the OID authentication & the group authentication is instead of hitting OID as the authenticator, we're going to create a BI SQL Group authentication provider that will hit an external database.

Your groups database schema needs to resemble the following data model*:

* Data model taken from Oracle Fusion Middleware Security Guide

Groups table: represents all of the possible groups in your system.

Groupmembers table: stores all of the users and their corresponding group.

Below are 2 rudimentary queries you can use to generate the tables but note they don't utilize any type of indexes, PK/FK relationships, or best practices. I'd use these for a POC (proof of concept) and once the system is ready to scale, create model using best practices:

GROUPS create statement:

CREATE

TABLE USER.GROUPS(

GROUPMEMBERS

VARCHAR2(100BYTE),

G_NAME

VARCHAR2(100BYTE),

G_MEMBER

VARCHAR2(100BYTE)

)

Groupmembers create statement:

CREATE

TABLE USER.GROUPMEMBERS(

GROUPSVARCHAR2(100BYTE),

G_NAME

VARCHAR2(100BYTE),

G_DESCRIPTION

VARCHAR2(100BYTE)

)

Remember that the BISystemUsers, BIAdministrators, BIConsumers and BIAuthors group must appear in your external database table!

Step 3:  Install the BISQLGroupProvider authenticator

Using an external data source for groups within 11g is a new feature that was not initially available in 11.1.1. Oracle later implemented this feature as an add-on but since it wasn't part of the core release (11.1.1.4 and earlier), you're going to have to install the BISQLGroupProvider authenticator before it will appear as an available provider within your provider tab.

Step 3.1)

Copy the BISecurityProviders.jar file located in MW_HOME/ORACLE_HOME/bifoundation/security/providers
to the following folder path:  MW_HOME/wlserver_10.3/server/lib/mbeantypes

Step 3.2)

After copying the file into the specified location you must restart the Administration Server to enable the new provider to appear in the list of available authenticators.

Step 4:  Create the Groups data source in Weblogic

In weblogic (:7001/console/) navigate to : bifoundation_domain -> Services -> Data sources -> Configuration -> New -> Generic Data source

Step 4.1) Create a new JDBC source name

Name:  The value of the 'name' field wwill be used in the config.xml file and in weblogic whenever referring to this data source. For this example, let's use the name : BIDatabaseGroupDS

JDNI Name: This value will be used when creating the database adapter for the virtualized identity store. For this example, let's use: jdbc/BIDatabaseGroupDS

Step 4.2) Specify the database driver

You will need to identify your database driver before proceeding. If you're using an Oracle stack w/ an 11g database, then the default specification will suffice.

Step 4.3) Specify Connection Information

Database Name: For example, enter: ora11. The name of the database that you want to connect to.

Host Name: For example, enter: mymachine.mycompany.com The DNS name or IP address of the server that hosts the database.

Port: For example, enter: 1521. The port on which the database server listens for connections requests.

Database User Name:Typically the schema owner of the tables defined in  Step 2.

Step 4.4) Test database connection

At this point you'll be transferred to a screen that ask you to test the connection using a

SQL SELECT 1 FROM DUAL

You need to pass this step before moving on, so an error like:

is an indication that you've incorrectly configured your data source.

Hopefully, will you see a 'Connection test succeeded' message like below.

Step 4.5) Deploy the JDBC Data Source to the Admin and Managed Server

After clicking 'Finish' you will need to navigate to : bifoundation_domain - > Services -> Data Sources -> BIDatabaseGroupsDS -> Targets. Check the 'AdminServer' and 'bi_cluster' checkbox to deploy the JDBC Data Source.

Step 5: Create the BISQLGroupProvider Authentication Provider

5.1) Navigate to Security Realms -> myrealm -> Providers -> Authentication (as seen below)

5.2) Create a New Authentication Provider called 'MySQLGroupProvider' using type 'BISQLGroupProvider'

5.3)Re-order the Authentication Provider list so that MySQLGroupProvider is the first authentication provider on the list

5.4) Create the custom SQL statements needed to generate the user & corresponding group memberships

Navigate to the 'Provider Specific' tab within your MySQLGroupProvider and populate the SQL Statements as follows (note that you will have to modify these statements if you did not follow the data model in Step 2. Do not remove the '?' from the SQL statement as it is a wild card indicator weblogic populates with a specific value at runtime.

Query	SQL	Notes
SQL List Groups	SELECT G_NAME FROM GROUPS WHERE G_NAME LIKE ?	The SQL statement used to retrieve group names that match a wildcard. The SQL statement requires a single parameter for the group name and must return a resultSet containing matching groups.
SQL Group Exists	SELECT G_NAME FROM GROUPS WHERE G_NAME = ?	The SQL statement used to look up a group. The SQL statement requires a single parameter for the group name and must return a resultSet containing at most a single record containing the group.
SQL Is Member	SELECT G_MEMBER FROM GROUPMEMBERS WHERE G_NAME = ? AND G_MEMBER = ?	The SQL statement used to look up members of a group. The SQL statement requires two parameters: a group name and a member or group name. It must return a resultSet containing the group names that matched.
SQL List Member Groups	SELECT G_NAME FROM GROUPMEMBERS WHERE G_MEMBER = ?	The SQL statement used to look up the groups a user or group is a member of. The SQL statement requires a single parameter for the username or group name and returns a resultSet containing the names of the groups that matched.
SQL Get Group Description (if description supported enabled)	SELECT G_DESCRIPTION FROM GROUPS WHERE G_NAME = ?	The SQL statement used to retrieve the description of a group. Only valid if Descriptions Supported is enabled. The SQL statement requires a single parameter for the group name and must return a resultSet containing at most a single record containing the group description.

Make the Data Source Name: jdbc/BIDatabaseGroupDS

5.4) Navigate to the 'Common' tab and set the Control Flag to 'Optional'

The JAAS Control flag needs to be set to optional to let weblogic know that even if authentication fails (a user isn't found in the group/groupmembers data model) to continue down the authentication provider list.

Step 6) Create a database adapter for the Virtualized Identity Store

Now we're going to create an XML file which will act as a database adapter to facilitate access to the group/groupmembers data model.

Create an XML file called 'bi_sql_groups_adapter_template.xml' and populate it with the following content:


<?xml version = '1.0' encoding = 'UTF-8'?>
<adapters schvers="303" version="1" xmlns="http://www.octetstring.com/schemas/Adapters" xmlns:adapters="http://www.w3.org/2001/XMLSchema-instance">
   <dataBase id="directoryType" version="0">
      <root>%ROOT%</root>
      <active>true</active>
      <serverType>directoryType</serverType>
      <routing>
         <critical>true</critical>
         <priority>50</priority>
         <inclusionFilter/>
         <exclusionFilter/>
         <plugin/>
         <retrieve/>
         <store/>
         <visible>Yes</visible>
         <levels>-1</levels>
         <bind>true</bind>
         <bind-adapters/>
         <views/>
         <dnpattern/>
      </routing>
      <pluginChains xmlns="http://xmlns.oracle.com/iam/management/ovd/config/plugins">
         <plugins>
            <plugin>
               <name>VirtualAttribute</name>
               <class>oracle.ods.virtualization.engine.chain.plugins.virtualattr.VirtualAttributePlugin</class>
               <initParams>
                  <param name="ReplaceAttribute" value="uniquemember={cn=%uniquemember%,cn=Users,dc=trusted,dc=oracle,dc=dev}"/>
               </initParams>
            </plugin>
         </plugins>
         <default>
            <plugin name="VirtualAttribute"/>
         </default>
         <add/>
         <bind/>
         <delete/>
         <get/>
         <modify/>
         <rename/>
      </pluginChains>
      <driver>oracle.jdbc.driver.OracleDriver</driver>
      <url>%URL%</url>
      <user>%USER%</user>
      <password>%PASSWORD%</password>
      <ignoreObjectClassOnModify>false</ignoreObjectClassOnModify>
      <includeInheritedObjectClasses>true</includeInheritedObjectClasses>
      <maxConnections>10</maxConnections>
      <mapping>
         <joins/>
         <objectClass name="groupofuniquenames" rdn="cn">
            <attribute ldap="cn" table="GROUPMEMBERS" field="G_NAME" type=""/>
            <attribute ldap="description" table="GROUPMEMBERS" field="G_NAME" type=""/>
            <attribute ldap="uniquemember" table="GROUPMEMBERS" field="G_MEMBER" type=""/>
         </objectClass>
      </mapping>
      <useCaseInsensitiveSearch>true</useCaseInsensitiveSearch>
      <connectionWaitTimeout>10</connectionWaitTimeout>
      <oracleNetConnectTimeout>0</oracleNetConnectTimeout>
      <validateConnection>false</validateConnection>
   </dataBase>
</adapters>

The bold text indicates fields that you will need to customize based on your requirements. Let's take this 1 step at a time.

First)  <param name="ReplaceAttribute" value="uniquemember={cn=%uniquemember%,cn=Users,dc=trusted,dc=oracle,dc=dev}"/>  needs to be the User Base DN you specified in Step 2 of Part 1 in my OBIEE 11g OID installation guide 

If, for example, your User Base DN is dc=trusted,dc=oracle,dc=com , then you would need to modify the XML above to be:
 <param name="ReplaceAttribute" value="uniquemember={cn=%uniquemember%,dc=trusted,dc=oracle,dc=com}"/>

The  %uniquemember% field is a placeholder which gets populated via the SQL statements in your Group Authentication provider.


Second)
    <attribute ldap="cn" table="GROUPMEMBERS" field="G_NAME" type=""/>
            <attribute ldap="description" table="GROUPMEMBERS" field="G_NAME" type=""/>
            <attribute ldap="uniquemember" table="GROUPMEMBERS" field="G_MEMBER" type=""/>

GROUPMEMBERS needs to be replaced with the table you created which stores your group members via the group/groupmembers data model in Step 2.



Step 7) Bind the adapter to Weblogic using the Weblogic Scripting Tool (WLST)

7.1) Copy the bi_sql_groups_adapter_template.xml to: ../../oracle_common/modules/oracle.ovd_11.1.1/templates/

7.2) Confirm key environmental variables are set

• ORACLE_HOME=<MW_HOME>/Oracle_BI1
• WL_HOME=<MW_HOME>/wlserver_10.3/
• JAVA_HOME=<MW_HOME>/jdk160_24/
   

7.3) Bind the adapter:

Navigate to /oracle_common/bin and run the following command:

libovdadapterconfig -adapterName MySQLGroupProvider -adapterTemplate bi_sql_groups_adapter_template.xml -host hostname -port 7001 -userName weblogic -domainPath C:\app\11g\mw_home\user_projects\domains\bifoundation_domain\ -dataStore DB -root cn=Staff,cn=Users,dc=trusted,dc=oracle,dc=dev -contextName default -dataSourceJNDIName jdbc/BIDatabaseGroupDS

Parameter	Value
host	Represents the hostname (ip address) of your weblogic server
port	Represents the port of your weblogic server , usually 7001
username	Represents your weblogic administrator account
adapterName	Represnets the name of the group authentication provider
domainPath	Represents the path to your bifoundation_domain folder
root	Represents the User Base DN you specified in your in your bi_sql_groups_adapter_template.xml , excluding the %uniquemember% component
dataSourceJNDIName	represents the JDNI name of your Groups Datasource

The command should execute without any error.

7.4) Restart admin server & managed services (bi_server) 

Step 8) Validate Changes by Creating a Custom Application Role

We're going to create a custom application role based on one of our custom groups to confirm that the Group Authenticator works.

8.1) Create an Application Role
From FMW Enterprise Manager (:7001/em/) -> farm_bifoundation_domain -> Business Intelligence -> coreapplication -> Right Click -> Security -> Application Roles -> Create

Click the Add button and select a Group from your Group Authenticator. In this example, I will add a group called 'ES Worker':

8.2) Login to Answers as a user of the group application role you just created

Navigate to My Account -> Roles and Catalog Groups

That concludes the tutorial on how to integrate weblogic 11g using OID as the user authenticator and storing groups in an external table. Next we will focus on SSO.

keywords: obiee ldap authentication, obiee 11g oid, obiee authentication, weblogic authentication provider, authentication with ldap, external groups authentication, wc_groups_d, wc_groupmembers_d

How-to: Mapviewer Integration with OBIEE 11g (11.1.1.6 and higher)

September 22, 2012, 4:06 pm

≫ Next: How-to: Apply OBIEE 11g Bundle Patch Set (11.1.1.6.4)

≪ Previous: How-to: OID Authentication with Groups Stored in an External Database Table - OBIEE 11g

$

0

0

I've seen quite a few articles on OTN and Google which outline how to configure Mapviewer for your 11g solution.  The problem is that many of these articles are:

1) overly complex
2) out of date

With the release of OBIEE 11.1.1.6, mapviewer comes pre-configured with weblogic and the only installation steps required are:

• installation of navteq mapdata to your oracle database
• establish a column based relationship between the map and a subject area

You do not have to modify any weblogic XML files, install any mapviewer jar files, or do any configuration within weblogic. Below is a step by step guide on how to configure and use mapviewer on your 11.1.1.6.x box:

Step 1: Download the mapviewer 'mvdemo' data into your Oracle database

Oracle provides pre-configured maps, coordinates, and navteq data that use can use in your reports. You need to download the MVDemo Sample Data Set .

Step 2: Create the mvdemo schema in your Oracle database

We're going to import the navteq map data into an mvdemo schema in step 3. Let's go ahead and create the mvdemo schema by typing the following command into your SQLPlus prompt:

grant connect, resource, create view to mvdemo identified by mvdemo

Note that you will need the appropriate privileges to create this account. If denied, try logging in as sysdba by typing the following command into sqplus:

CONNECT / AS sysdba

Step 3: Import navteq data dump to your Oracle database

Unzip the MV Demo Sample Data Set you just downloaded, and note the location of the 'mvdemp.dmp' file. This is the file we will import to the database.


Step 3.1)
Find the imp utility on your machine. It is usually located in your $ORACLE_HOME\product\11.x.x\dbhome_1\BIN folder

Step 3.2) Navigate to that folder via command line and run the following command:

imp mvdemo/mvdemo@ORCLfile=mvdemo.dmp full=y ignore=y
where ORCL is your database SID
and file=mvdemo.dmp is the path (including mvdemo.dmp) to the dump file

You should get the following result:

Step 4) Import the map meta data

The Map Viewer Sample Data Set comes with city, county, state, highway, and other geographical map based data that you can impose onto the map. We're going to import this data set by running the following command in sqlplus:
:
@mvdemo.sql

Note that you must include the path of the mvdemo.sql file e.g. @C:\folder\folder1\mvdemo\mvdemo.sql

Step 5) Add your Oracle Database as a MapViewer Data Source

No, we're not doing this in weblogic - Mapviewer data source configuration is still done in your http://localhost:9704/mapviewer location


You'll arrive at a landing page like below, where you must click the 'Admin' button to log in:

5.1) login user your weblogic username/password

5.2) You should arrive at a home page with a link to view Datasources. Click it and you'll appear at:

Name = name/description of your data source

Host = hostname/ip address of your database

Port = database port number

SID = service ID of your oracle database (by default it is orcl)

user/password: If you followed my above steps, it will be mvdemo/mvdemo

# Mappers and Max Connections specify how many simultaneous users can connect to the MapViewer db. For diagnostic purposes I would make this relatively high, and once development is complete you can adjust as needed.

Step 6) Modify the mapViewerConfig.xml file to include the new data source

I'm a little surprised as to why this must be done manually, if anyone has any insight - please feel free to leave feedback. After you add the data source as outlined in step 5, you must then modify the mapViewerConfig.XML file to include said datasource, otherwise when the BI Server is rebooted, your datasource connection will be removed!

Luckily, this step is not too difficult

6.1) In :7001/mapviewer , log into your Admin screen and navigate to Management -> Configuration

Then add the following XML to the bottom of the config file, right above the </MappperConfig> line.

  <map_data_source name="mvdemo"

                   jdbc_host="db1.my_corp.com"

                   jdbc_sid="orcl"

                   jdbc_port="1521"

                   jdbc_user="scott"

                   jdbc_password="!tiger" 

                   jdbc_mode="thin"

                   number_of_mappers="3"

                   allow_jdbc_theme_based_foi="false"

   />

Modify each line using the inputs you provided in step 5, but in the jdbc_password input should have a ! infront of it as that is Oracle's indicator to encrypt the password upon restart.

Step 7)  Import a map layer into Answers 

We've completed all of the back end work required to create a map. Now we'll go into Answers -> Administration -> Manage Map Data and import a layer (theme) that we'll use for our map.

A theme is a visual representation representation of the data, and arguably the most important component in creating a map. In this example let's use the "THEME_DEMO_COUNTIES" layer, which will give us the ability to impose a dataset over various Counties in the USA.

Step 8) Specify the BI Column used to associate the THEME_DEMO_COUNTIES layer to a dataset

The theme we're using, "THEME_DEMO_COUNTIES" stores attributes of Counties (county name, county lines, etc) which we can visualize on a map. We need to identify a way to 'join' the data set in OBIEE to the dataset of THEME_DEMO_COUNTIES.

After saving the layer you just created, click the 'Edit' button (pencil) to bring up the screen below.

Notice there is 'Layer Key' with the following column values; County, Fips, Population, State.  We are going to use 'County' as the map column to join to the subject area.

Next we need to specify a column from our subject area which contains 'County'.  

Step 9) Specify the Background Map

In steps 7 and 8 we specified a theme (visual representation of the data) and identified how to join the map data to our subject area (via County column). Now we need to specify which map we're the theme will use.

In the 'Background' tab, create a new background map and specify 'DEMO_MAP' as the background map.

After saving, edit the map ensure the THEME_DEMO_COUNTIES has successfully been applied:

It will default to the middle of the USA but I decided to zoom into California :)

Step 10) Create a Report using the County Column 

Now we're ready to create the report! Create a new analysis, select the County column you specified in step 7, and a fact column which joins to the county dimension. Click the results tab, then New View -> Maps.  

The result below outlines only California because the dataset I created uses only California Counties. 

Note that I did not go into the MapBuilder tool, which you can use if you want to create custom themes and maps (e.g. map of a building, school, casino, etc). But this works great for a proof of concept!

keywords: obiee mapviewer, rendering maps, obiee configuration, obiee 11g maps, obiee navteq maps, obiee mapviewer integration

How-to: Apply OBIEE 11g Bundle Patch Set (11.1.1.6.4)

October 25, 2012, 11:41 am

≫ Next: FYI: OPMNCTL Failed to Start Managed Process After Maximum Retry Limit on Solaris 10, OBIEE 11g

≪ Previous: How-to: Mapviewer Integration with OBIEE 11g (11.1.1.6 and higher)

$

0

0

If you've been following the patch set history for Oracle Business Intelligence 11g, you'll notice that Oracle releases various OBIEE patches on a fairly regular basis - anywhere from every quarter to every month.

Unfortunately Oracle doesn't announce a new patch set via oracle.com or through any type of mass mailing. So to stay up to date you'll need to review the Oracle Reference Document '[ID 1488475.1] OBIEE 11g Required and Recommended Patch Sets' on http://support.oracle.com .

Today we'll cover how to apply Oracle's newest bundle patch (I call them mega patches!) 11.1.1.6.4. The bundle patches are actually a set of cumulative patches for Oracle Business Intelligence. Meaning, if you apply the 11.1.1.6.4 patch set, you do not need to apply 11.1.1.6.2 as it is already included.

Step 1) Make sure you have the latest OPatch installed on your machine

Oracle uses the Opatch tool to apply patches to OBIEE 11g, and if you attempt to apply a patch with an outdated Opatch version, you get the following error:

 "The OUI version is not applicable for current OPatch Version":

You can download the latest version of Opatch by searching http://support.oracle.com for 'How To Download And Install The Latest OPatch Version [ID 274526.1]' or by clicking here

Step 1.1) Extract the opatch folder to your FMW_HOME/Oracle_BI1 folder. There is most likely an Opatch folder already in there - that is the old version. Archive it then remove it from the Oracle_BI1 folder and replace it with the Opatch folder you just downloaded.


Step 2) Back Up Critical Folders

Make sure to save the following folders in the event of a failure when applying the patch set:

• The ORACLE_HOME\bifoundation\server directory
• The ORACLE_INSTANCE\bifoundation\OracleBIServerComponent\coreapplication_obis1\repository
• The ORACLE_BI_HOME\bifoundation\jee\mapviewer.ear\web.war\WEB_INF\conf\mapViewerConfig.xml, if you have modified it

 Step 3) Shutdown Admin Server, Node Manager, Managed Server and OPMN

The entire weblogic domain must be shut down prior to applying the patch set


Step 4) Confirm Key Environment Variables are Set

On Windows: If the Oracle BI Home directory is C:\prod_mwhome\Oracle_BI1, then set the environment variables by entering the following:

• set ORACLE_HOME=C:\prod_mwhome\Oracle_BI1
• set PATH=%ORACLE_HOME%\bin;%PATH%
• set JAVA_HOME=%ORACLE_HOME%\jdk
• set PATH=%JAVA_HOME%\bin;%PATH%
• set PATH=%ORACLE_HOME%\OPatch;%PATH%

Step 5) Download 11.1.6.4 Patch Set

The quickest way to do this is by navigating to the 'Patches & Updates' tab on support.oracle.com and using the 'Product or Family (advanced)' search feature to download the patch set for your specific OS:

Make sure you check 'Include all products in a family'!

Step 6) Unzip the patch set into  your $FMW_HOME/Oracle_BI1 folder

There should be 7 folders - one for each patch:

Patch	Abstract
14538078	Patch 11.1.1.6.4 (1 of 7) Oracle Business Intelligence Installer
14538128	Patch 11.1.1.6.4 (2 of 7) Oracle Real Time Decisions
14285344	Patch 11.1.1.6.4 (3 of 7) Oracle Business Intelligence Publisher
14538164	Patch 11.1.1.6.4 (4 of 7) Oracle Business Intelligence ADF Components
14415773	Patch 11.1.1.6.4 (5 of 7) Enterprise Performance Management Components Installed from BI Installer 11.1.1.6.x
14405222	Patch 11.1.1.6.4 (6 of 7) Oracle Business Intelligence
14409674	Patch 11.1.1.6.4 (7 of 7) Oracle Business Intelligence Platform Client Installers and MapViewer

Step 7) Remove Catalog Manager Cache Files (if they exist)

•  On Linux, AIX, or Solaris: If the Oracle BI Home directory is prod_mwhome/Oracle_BI1, then go to the following directory:prod_mwhome/Oracle_BI1/bifoundation/web/catalogmanager/configuration/
• On Windows: If the Oracle Home directory is C:\prod_mwhome\Oracle_BI1, then go to the following directory: c:\prod_mwhome\Oracle_BI1\bifoundation\web\catalogmanager\configuration\

and remove the following files:

org.eclipse.osgi
org.eclipse.equinox.app

Step 8) Apply the 7 patches in the 11.1.1.6.4 patch set

It is important that you apply the patches in the following order:

• 14538078
• 14538128
• 14285344
• 14538164
• 14415773
• 14405222
• 14409674

Navigate into each folder and run the following command : opatch apply  . The command should execute without error as shown below:

Step 9) Download the JDeveloper Patch

The  Oracle Reference Document '[ID 1488475.1] OBIEE 11g Required and Recommended Patch Sets' on http://support.oracle.com indicates that for 11.1.1.6.4 patch set you need to download and apply JDeveloper patch 13952743 which is not included in the core 7 patches.  Make sure to download 13952743 and unzip it to your $FMW_HOME/Oracle_BI1 folder as well.

Step 10) Update Environment Variables for the JDeveloper Patch

You'll need to change your environment variables for this patch as follows:

$ORACLE_HOME = FMW_HOME/oracle_common

Step 11) Apply the JDeveloper Patch

Using the same opatch apply command. Make sure you navigate to the 13952743 folder first!

Step 12) Validate all patches have been applied

Execute the following command: opatch lsinventory . All 8 patches should be listed.

Step 13) Validate Version in Answers

After starting your Admin Server, Node Manager, Managed Server and OPMN services. Navigate to your Administration tab in Answers to view the new version:

Potential Issue: Conflict with previous patches

In my earlier post I outlined how to apply an individual patch to resolve bug 1467168.1 (multiple pie charts error) by applying patch 14003822 .
If you've applied any individual patch and then later try to apply a bundle patch you'll get the following error:

indicating there is a conflict between the original patch and the 11.1.1.6.4 bundle patch. Go ahead and override the original patch with the new 11.1.1.6.4 patch set. This new patch set also includes any one off patches you've applied so it's safe to override.


keywords: obiee 11g upgrade, obiee upgrade, upgrade assistant, opatch, 11.1.1.6.4, how to install obiee 11g

FYI: OPMNCTL Failed to Start Managed Process After Maximum Retry Limit on Solaris 10, OBIEE 11g

November 7, 2012, 1:22 pm

≫ Next: FYI: Error while running Upgrade Assistant OBIEE 11g - UPGAST-00055

≪ Previous: How-to: Apply OBIEE 11g Bundle Patch Set (11.1.1.6.4)

$

0

0

If you've happened to glance at Oracle Technical Network, it appears that alot of practitioners are encountering an issue when upgrading their 11g platform to the newest 11.1.1.6.4 version if they're using a Solaris or Linux distribution.

After upgrading to 11.1.1.6.4 as outlined in my previous blog post some users encounter the following error(s) when trying to start their BI services using opmnctl (Oracle Process Manager and Notification Server) with the 'opmnctl startall' command:

================================================================================
Response: 1 of 5 processes started.

ias-instance id=instance1
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

---

ias-component/process-type/process-set:
coreapplication_obis1/OracleBIServerComponent/coreapplication_obis1/

Error
--> Process (index=1,uid=1445883997,pid=18522)
failed to start a managed process after the maximum retry limit
Log:
/u01/app/oracle/obiee11g/instances/instance1/diagnostics/logs/OracleBIServerComponent/coreapplication_obis1/console~coreapplication_obis1~1.log

ias-component/process-type/process-set:
coreapplication_obips1/OracleBIPresentationServicesComponent/coreapplication_obips1/

Error
--> Process (index=1,uid=1445883998,pid=0)
Executable file does not have execute permission
/u01/app/oracle/obiee11g/Oracle_BI1/bifoundation/web/bin/sawserver
failed to start a managed process after the maximum retry limit
Executable file does not have execute permission
/u01/app/oracle/obiee11g/Oracle_BI1/bifoundation/web/bin/sawserver
Log:
none

ias-component/process-type/process-set:
coreapplication_obisch1/OracleBISchedulerComponent/coreapplication_obisch1/

Error
--> Process (index=1,uid=1445884000,pid=18523)
failed to start a managed process after the maximum retry limit
Log:
/u01/app/oracle/obiee11g/instances/instance1/diagnostics/logs/OracleBISchedulerComponent/coreapplication_obisch1/console~coreapplication_obisch1~1.log

ias-component/process-type/process-set:
coreapplication_obiccs1/OracleBIClusterControllerComponent/BIClusterController/

Error
--> Process (index=1,uid=1445884001,pid=0)
Executable file does not have execute permission
/u01/app/oracle/obiee11g/Oracle_BI1/bifoundation/server/bin/nqsclustercontroller
failed to start a managed process after the maximum retry limit

 The important things to note are:

• You may encounter all, some, or just 1 of your bi_services which fail to start. In the above example, the following services failed to start:
• BI Server
• BI Publisher
• BI Cluster Controller
• BI Scheduler
• There are actually two issues:
• Managed Processes failed to start after the maximum retry limit
• Certain executable files do not have the execute permission enabled

Issue 1: Fix Maximum Retry Limit

This can be easily resolved by setting the ulimit at the user level to : ulimit -d unlimited , as outlined in Oracle's note ID: 1292887.1 . Anyone who has worked in OBIEE 10g should be familiar with this as it is required in 10g's installation process as well.

Issue 2: Enable read access on executable files

If you tried re-running opmnctl startall after resolving issue 1, you'll notice that the BI services still fail to run despite increasing the maximum retry limit. Upon examining the log files as outlined in the above error:

• u01/app/oracle/obiee11g/instances/instance1/diagnostics/logs/OracleBIServerComponent/coreapplication_obis1/console~coreapplication_obis1~1.log
• u01/app/oracle/obiee11g/instances/instance1/diagnostics/logs/OracleBISchedulerComponent/coreapplication_obisch1/console~coreapplication_obisch1~1.log

You'll notice that OPMNCTL still fails because it can't execute: nqsserver, nqscheduler and nqsclustercontroller. Below is the log from the above bullet point #1 :

/export/obiee/11g/Oracle_BI1/bifoundation/server/bin/biserver.sh: nqsserver: cannot execute--------
12/11/06 15:48:06 Start process
--------
/export/obiee/11g/Oracle_BI1/bifoundation/server/bin/biserver.sh: nqsserver: cannot execute

 During the 11.1.1.6.4 upgrade on your Solaris or Linux box, these files became read only!

How to resolve this read only issue:

Navigate to your $ORACLE_HOME/bifoundation/server/bin folder and make the the following files executable by using the chmod +x command:  nqscheduler, nqsclustercontroller, nqsserver. These files should have read/write privileges as outlined in the image below:

Now when you run opmnctl startall, all  services should execute successfully:

Important:

After the upgrade, it is critical that you follow Oracle's recommended start up & shutdown sequence for weblogic & OBIEE 11g

Start up:

• $DOMAIN_HOME/bin/startWebLogic.sh (Weblogic)
• $WL_HOME/server/bin/startNodeManager.sh (Node Manager)
• $DOMAIN_HOME/bin/startManagedWebLogic.sh bi_server1 http://server.domain:7001 (Managed Server)
• $ORACLE_INSTANCE/bin/opmnctl startall (OPMN)

Shutdown:

• $ORACLE_INSTANCE/bin/opmnctl stopall (OPMN)
• $DOMAIN_HOME/bin/stopManagedWebLogic.sh bi_server1 t3://host.domain:7001 username password (Managed Server)
• $DOMAIN_HOME/bin/stopWebLogic.sh username password t3://host.domain:7001 (Admin Server)

In my upcoming blog post i'll discuss how to automate this entire process.

keywords: opmn , opmn start failed, obiee 11g, opmn obiee weblogic, bi_server

FYI: Error while running Upgrade Assistant OBIEE 11g - UPGAST-00055

November 12, 2012, 11:18 am

≫ Next: How-to: OBIEE 11g Start up/Shut Down & Script in Solaris/Linux

≪ Previous: FYI: OPMNCTL Failed to Start Managed Process After Maximum Retry Limit on Solaris 10, OBIEE 11g

$

0

0

When migrating our legacy OBIEE 10g webcat and RPD to Oracle's new 11g platform, we often don't have the privilege of using a GUI based operating system for assembly & system test as most production systems are Solaris or Red Hat.

We can all agree that a unix distribution is more powerful & flexible, yet leaves much to be desired when attempting to resolve configuration issue in a 'friendly UI environment'. This is certainly no exception when attempting to use Oracle's Upgrade Assistant Command Line Interface .

Many users have encountered error " UPGAST-00055: error reading the Universal Installer Inventory. The inventory pointer oraInst.loc is either not readable or doest not exist". A quick search of Oracle's Fusion Middleware Error Message Reference Guide makes me believe that Oracle's writers are playing a cruel joke in their attempt to 'help':

Action: "see the secondary error message?" You've got to be kidding me!!

Oracle's 'help' aside, the upgrade assistant is looking for an oraInst.loc file which contains 2 things:

1. The location of your installation directory
2. The install group of your user

But the upgrade assistant cant find your oraInst.loc file, why?
UA, by default, searches for the oraInst.loc file in your /var/opt/oracle folder. But many times, the file won't be located there - for a number of reasons , including:

• custom installation directories
• co-installation of multiple oracle products
• de-installation and subsequent re-installation attempts

But you're not out of luck. Most likely, your oraInst.loc file will be in your $MW_HOME/oracle_common folder:

You can then use the UA CLI paramater -invPtrLoc to specify your custom oraInst.loc path.:

./ua MT -BIEEE -webcatdir /export/obiee/11g/Oracle_BI1/bin/webcatalog -invPtrLoc /export/obiee/11g/oracle_common/oraInst.loc -webCatDeliversDir /delivers -wlsPort 7001 -wlsUser weblogic
will generate the following:

followed by a series of postupgrade tasks that you can view at 'tail -f $ORACLE_HOME/upgrade/logs/postupgrade.txt'
and ultimately a 'completed successfully' message:

But what if you can't find your oraInst.loc file? Don't worry! Oracle has a template you can use located at:

• /$ORACLE_HOME//bifoundation/provision/scripts/bidomain/inst

1. Rename it to oraInst.loc
2. Copy it to your $ORACLE_HOME folder
3. Populate the inventory_loc line with the path to your oraInventory folder
4. Populate the inst_group with the group name of the account you're using to install & upgrade OBIEE
5. Run the upgrade assistant as specified above

Problem solved!

keywords : obiee 11g upgrade, upgrade assistant,  obiee administration, obiee 11g administration, weblogic obiee

How-to: OBIEE 11g Start up/Shut Down & Script in Solaris/Linux

November 26, 2012, 4:24 pm

≫ Next: FYI: Log could not be retrieved - nQSError: 43113, nQSError: 10058

≪ Previous: FYI: Error while running Upgrade Assistant OBIEE 11g - UPGAST-00055

$

0

0

'Start BI Services'

This simple, easy to use process for starting & stopping Weblogic & OBIEE 11g in Windows is something many developers take for granted. In personal development and proof of concept environments a Windows environment will suffice, but once we start talking about enterprise testing & production environments we quickly realize that a windows based Weblogic and OBIEE 11g environment just won't work.

We then start down the path of deployment on a Redhat or Solaris environment. After reading Oracle's official guide on starting and stopping OBIEE 11g, we quickly realize just how lucky we were. No longer do we have the option of executing a single file to start and shut down Weblogic and OBIEE, at least not out of the box.

This request is commonly echoed on Oracle Technical Network so today we'll outline how to create a single file that acts as both a start up and shutdown script.

First, let's go over the manual start up process for Weblogic & OBIEE 11g in Solaris & Linux:

• Start Administration Server
• located in your Weblogic Server Domain user_projects folder
• /user_projects/domains/bifoundation/bin/startWebLogic.sh
• example: ./startWebLogic.sh
• Start Node Manager
• located in your Weblogic Server Home Directory
• /wlserver_10.3/server/bin/startNodeManager.sh
• example: ./startNodeManager.sh
• Start Managed Server
• located in your Weblogic Server Domain user_projects folder
• /user_projects/domains/bifoundation/bin/startManagedWebLogic.sh
• example: ./startManagedWebLogic.sh bi_server1 t3://HOSTNAME:7001
• Start BI Services using Oracle Process Manager and Notification Server (opmnctl)
• located in your Orcle Instance folder
• /instances/instance1/bin/opmnctl
• example: opmnctl startall

Second, let's go over the manual shut down process of Weblogic & OBIEE 11g in Solaris & Linux:

• Stop BI Services using Oracle Process Manager and Notification Server (opmnctl)
• located in your Orcle Instance folder
• /instances/instance1/bin/opmnctl
• example: opmnctl stopall
• Start Managed Server
• located in your Weblogic Server Domain user_projects folder
• /user_projects/domains/bifoundation/bin/stopManagedWebLogic.sh
• example: ./stopManagedWebLogic.sh bi_server1 t3://HOSTNAME:7001
• Stop Node Manager
• There is no 'stopNodeManager', must kill associated proccesses
• example: pkill -TERM -u USERNAME -f "/startNodeManager.sh"
• example: pkill -TERM -u USERNAME -f "/java"
• Stop Admin Server
• located in your Weblogic Server Domain user_projects folder
• /user_projects/domains/bifoundation/bin/stopWebLogic.sh
• example: ./stopWebLogic.sh

So how do we automate this process?

By customizing the shell script below, you'll be able to automate the start up and shutdown sequence in OBIEE 11g.

The lines highlighted in red require customization.

#!/bin/bash
#
# File:    obiee.sh
# Purpose: Start and stop Oracle Business Intelligence 11g components.
#
# description: Start up and shutdown sequence for OBIEE 11g and Weblogic
#

# These values must be adapted to your environment.

ORACLE_OWNR=username                  # Local Unix user running OBIEE
ORACLE_FMW=/export/obiee/11g      # Deployment root directory
                                  
BIEE_USER=weblogic                # BIEE administrator name
BIEE_PASSWD=weblogic              # BIEE administrator password              
BIEE_DOMAIN=bifoundation_domain         # Domain name
BIEE_INSTANCE=instance1             # Instance name
BIEE_SERVER=bi_server1              # Server name
BIEE_MANAGER_URL=hostname:7001    # Admin server URL (hostname:port)
 
WL_PATH=/export/obiee/11g/wlserver_10.3/server/bin
BIEE_PATH=/export/obiee/11g/user_projects/domains/bifoundation_domain/bin
ORACLE_INSTANCE=/export/obiee/11g/instances/instance1
export ORACLE_INSTANCE

START_LOG=/export/obiee/11g/obiee_startup_log/obiee-start.log
STOP_LOG=/export/obiee/11g/obiee_startup_log/obiee-stop.log

# SUBSYS=obiee

start() {
    echo "********************************************************************************"
    echo "Starting Admin Server on $(date)"
    echo "********************************************************************************"
    su $ORACLE_OWNR -c "$BIEE_PATH/startWebLogic.sh" &
    wait_for "Server started in RUNNING mode"
   
    echo "********************************************************************************"
    echo "Starting Node Manager on $(date)"
    echo "********************************************************************************"
    su $ORACLE_OWNR -c "$WL_PATH/startNodeManager.sh" &
    wait_for "socket listener started on port"

    echo "********************************************************************************"
    echo "Starting Managed Server $BIEE_SERVER on $(date)"
    echo "********************************************************************************"
    su $ORACLE_OWNR -c "$BIEE_PATH/startManagedWebLogic.sh $BIEE_SERVER t3://$BIEE_MANAGER_URL" &
    wait_for "Server started in RUNNING mode"

    echo "********************************************************************************"
    echo "Starting BI components on $(date)"
    echo "********************************************************************************"
    su $ORACLE_OWNR -c "$ORACLE_INSTANCE/bin/opmnctl startall"

    echo "********************************************************************************"
    echo "OBIEE start sequence completed on $(date)"
    echo "********************************************************************************"
}

stop() {
    echo "********************************************************************************"
    echo "Stopping BI components on $(date)"
    echo "********************************************************************************"
    su $ORACLE_OWNR -c "$ORACLE_INSTANCE/bin/opmnctl stopall"

    echo "********************************************************************************"
    echo "Stopping Managed Server $BIEE_SERVER on $(date)"
    echo "********************************************************************************"
    su $ORACLE_OWNR -c "$BIEE_PATH/stopManagedWebLogic.sh $BIEE_SERVER t3://$BIEE_MANAGER_URL $BIEE_USER $BIEE_PASSWD"

    echo "********************************************************************************"
    echo "Stopping Node Manager on $(date)"
    echo "********************************************************************************"
   # pkill -TERM -u $ORACLE_OWNR -f "weblogic\\.NodeManager"
    pkill -TERM -u $ORACLE_OWNR -f "/bin/sh/export/obiee/11g/wlserver_10.3/server/bin/startNodeManager.sh"
 pkill -TERM -u $ORACLE_OWNR -f "/export/obiee/11g/Oracle_BI1/jdk/bin/sparcv9/java"    echo "********************************************************************************"
    echo "Stopping Admin Server on $(date)"
    echo "********************************************************************************"
    su $ORACLE_OWNR -c "$BIEE_PATH/stopWebLogic.sh"
   
    echo "********************************************************************************"
    echo "OBIEE stop sequence completed on $(date)"
    echo "********************************************************************************"
}

wait_for() {
    res=0
    while [[ ! $res -gt 0 ]]
    do
        res=$(tail -5 "$START_LOG" | fgrep -c "$1")
        sleep 5
    done
}

case "$1" in
    start)
        echo "********************************************************************************"
        echo "Starting Oracle Business Intelligence on $(date)"
        echo "Logs are sent to $START_LOG"
        echo "********************************************************************************"
        start &> $START_LOG
       # touch /var/lock/subsys/$SUBSYS
    ;;
    stop)
        echo
"********************************************************************************"
        echo "Stopping Oracle Business Intelligence on $(date)"
        echo "Logs are sent to $STOP_LOG"
        echo "********************************************************************************"
        stop &> $STOP_LOG
       # rm -f /var/lock/subsys/$SUBSYS
    ;;
    status)
        echo "********************************************************************************"
        echo "Oracle BIEE components status...."
        echo "********************************************************************************"
        su $ORACLE_OWNR -c "$ORACLE_INSTANCE/bin/opmnctl status"
    ;;
    restart)
        $0 stop
        $0 start
    ;;
    *)
        echo "Usage: $(basename $0) start|stop|restart|status"
        exit 1
esac

exit 0


You must add your admin credentials to the following files:

• /user_projects/domains/bifoundation_domain/bin/startManagedWebLogic.sh

• /user_projects/domains/bifoundation_domain/servers/AdminServer/security/boot.properties

Start the script as follows:



The script will generate the following message after completion:

You can validate all services are running by logging into Fusion Middleware and Weblogic to check AdminServer, ManagedServer, and BI Services:

AdminServer & ManagedServer

BI Services

Stop OBIEE 11g and Weblogic by running the following command:

The script will generate the following message after completion:

You can validate that AdminServer, ManagedServer and BI Services are all shutdown by running ps -ef | grep obiee in your terminal. No weblogic & OBIEE processes should be active:

Note: if you are editing your shell script in a windows environment then uploading it to a Solaris/Linux environment via FTP, you will encounter whitespace issues when attempting to execute. This can be fixed by running the following command on the file:

perl -i -pe's/\r$//;' <file name here>

keywords: obiee start up script, obiee shut down script, obiee 11g installation, obiee admin

---

FYI: Log could not be retrieved - nQSError: 43113, nQSError: 10058

November 30, 2012, 3:23 pm

≫ Next: How-to: Apply OBIEE 11g Bundle Patch Set (11.1.1.6.6)

≪ Previous: How-to: OBIEE 11g Start up/Shut Down & Script in Solaris/Linux

$

0

0

I've noticed something a little surprising with the OBIEE 11g upgrade assistant & opatch tool. After you apply a patch set (e.g. 11.1.1.6.4), core BIServer components become 'locked' or a default file privilege gets applied that is too restrictive.

In fact, in my last post I covered a similar issue with Oracle Process Manager and Notification Server (OPMN) failing to start after applying a bundle patch, you can read it here .

This post follows a similar issue, in that logging in OBIEE 11g is non-functional after applying a patch set:

Log Could Not Be Retrieved
  Odbc driver returned an error (SQLExecDirectW).
  Error Details
Error Codes: OPR4ONWY:U9IM8TAC
State: HY000. Code: 10058. [NQODBC] [SQL_STATE: HY000] [nQSError: 10058] A general error has occurred. [nQSError: 43113] Message returned from OBIS. [nQSError: 43100] Log Viewer process reported error 2:No such file or directory. (HY000)

Oracle Technical Network has, unfortunately, no documentation on this issue of BIServer components file privileges becoming too restrictive. If an OBIEE Administrator wants to enable logging in their Answers environment, it is usually achieved by setting the LOGLEVEL to a value greater than 0 or less than 6:

This will not work IF your Answers environment is unable to identify or access the log file or directory. So the question is:

Why is access to the log file & directory disabled in my Answers environment and how do I enable access?

First: Understand that Presentation Logging in OBIEE 10g and OBIEE 11g is captured in your nqquery.log file located at: $ORACLE_INSTANCE_HOME\diagnostics\OracleBIServerComponent\..\..\nqquery.log

Second: The mechanism Answers uses for reading a log file is the nqlogviewer executable which is located in your $ORACLE_HOME\bifoundation\server\bin folder

So the error nQSError:43113 leads me to believe that insufficient privleges has been set for the nqlogviewer executable.  I assume this is true because similiarly in my previous post core BI components nqserver, nqscheduler, etc, were all inaccessible.

So to resolve this, apply the following command to your nqlogviewer : chmod 777 nqlogviwer (777 enables access to ALL USERs, so make sure to replace it with the parameter that allows read/write access to your obiee account):

Now go back to the same report, and viola, the session log is visible - no restart required!

Keywords: nqserror, obiee 11g installation, obiee 11.1.1.6 upgrade, obiee upgrade assistant, obiee 11g, opatch, opmn start failed

How-to: Apply OBIEE 11g Bundle Patch Set (11.1.1.6.6)

January 11, 2013, 7:47 pm

≫ Next: How-to: OBIEE 11g Javascript Integration using Action Framework (Browser Script)

≪ Previous: FYI: Log could not be retrieved - nQSError: 43113, nQSError: 10058

$

0

0

Late last year (December 2012) Oracle gave us the pleasure of releasing their newest OBIEE 11g patchset - OBIEE 11.1.1.6.6 and just when you finished got comfortable with version 11.1.1.6.4!

The guide below will outline how to apply the new OBIEE 11g 11.1.1.6.6 patchset assuming your starting point is a prior version on the 11.1.1.6.x platform.

As a reminder, note that the OBIEE 11g patchsets are cumulative - meaning the 11.1.1.6.6 patchset includes all patches from 6.5, 6.4 and down.

Step 1) Make sure you have the latest OPatch installed on your machine

Oracle uses the Opatch tool to apply patches to OBIEE 11g, and if you attempt to apply a patch with an outdated Opatch version, you get the following error:

 "The OUI version is not applicable for current OPatch Version":

You can download the latest version of Opatch by searching http://support.oracle.com for 'How To Download And Install The Latest OPatch Version [ID 274526.1]' or by clicking here

Step 1.1) Extract the opatch folder to your FMW_HOME/Oracle_BI1 folder. There is most likely an Opatch folder already in there - that is the old version. Archive it then remove it from the Oracle_BI1 folder and replace it with the Opatch folder you just downloaded.


Step 2) Back Up Critical Folders

Make sure to save the following folders in the event of a failure when applying the patch set:

• The ORACLE_HOME\bifoundation\server directory
• The ORACLE_INSTANCE\bifoundation\OracleBIServerComponent\coreapplication_obis1\repository
• The ORACLE_BI_HOME\bifoundation\jee\mapviewer.ear\web.war\WEB_INF\conf\mapViewerConfig.xml, if you have modified it

 Step 3) Shutdown Admin Server, Node Manager, Managed Server and OPMN

The entire weblogic domain must be shut down prior to applying the patch set


Step 4) Confirm Key Environment Variables are Set

On Windows: If the Oracle BI Home directory is C:\prod_mwhome\Oracle_BI1, then set the environment variables by entering the following:

• set ORACLE_HOME=C:\prod_mwhome\Oracle_BI1
• set PATH=%ORACLE_HOME%\bin;%PATH%
• set JAVA_HOME=%ORACLE_HOME%\jdk
• set PATH=%JAVA_HOME%\bin;%PATH%
• set PATH=%ORACLE_HOME%\OPatch;%PATH%

Step 5) Download 11.1.1.6.6 Patch Set

The quickest way to do this is by navigating to the 'Patches & Updates' tab on support.oracle.com and using the 'Product or Family (advanced)' search feature to download the patch set for your specific OS:

Make sure you check 'Include all products in a family'!

Step 6) Unzip the patch set into  your $FMW_HOME/Oracle_BI1 folder

There should be 7 folders - one for each patch:

Patch	Abstract
15844023	Patch 11.1.1.6.6 (1 of 7) Oracle Business Intelligence Installer
15844066	Patch 11.1.1.6.6 (2 of 7) Oracle Real Time Decisions
14800665	Patch 11.1.1.6.6 (3 of 7) Oracle Business Intelligence Publisher
15843961	Patch 11.1.1.6.6 (4 of 7) Oracle Business Intelligence ADF Components
15844096	Patch 11.1.1.6.6 (5 of 7) Enterprise Performance Management Components Installed from BI Installer 11.1.1.6.x
14791926	Patch 11.1.1.6.6 (6 of 7) Oracle Business Intelligence
15839347	Patch 11.1.1.6.6 (7 of 7) Oracle Business Intelligence Platform Client Installers and MapViewer

Step 7) Remove Catalog Manager Cache Files (if they exist)

•  On Linux, AIX, or Solaris: If the Oracle BI Home directory is prod_mwhome/Oracle_BI1, then go to the following directory:prod_mwhome/Oracle_BI1/bifoundation/web/catalogmanager/configuration/
• On Windows: If the Oracle Home directory is C:\prod_mwhome\Oracle_BI1, then go to the following directory: c:\prod_mwhome\Oracle_BI1\bifoundation\web\catalogmanager\configuration\

and remove the following files:

org.eclipse.osgi
org.eclipse.equinox.app

Step 8) Apply the 7 patches in the 11.1.1.6.6 patch set

It is important that you apply the patches in the following order:

Patch	Abstract
15844023	Patch 11.1.1.6.6 (1 of 7) Oracle Business Intelligence Installer
15844066	Patch 11.1.1.6.6 (2 of 7) Oracle Real Time Decisions
14800665	Patch 11.1.1.6.6 (3 of 7) Oracle Business Intelligence Publisher
15843961	Patch 11.1.1.6.6 (4 of 7) Oracle Business Intelligence ADF Components
15844096	Patch 11.1.1.6.6 (5 of 7) Enterprise Performance Management Components Installed from BI Installer 11.1.1.6.x
14791926	Patch 11.1.1.6.6 (6 of 7) Oracle Business Intelligence
15839347	Patch 11.1.1.6.6 (7 of 7) Oracle Business Intelligence Platform Client Installers and MapViewer

Navigate into each folder and run the following command : opatch apply  . The command should execute without error as shown below:

Step 9) Download the JDeveloper Patch

The  Oracle Reference Document '[ID 1488475.1] OBIEE 11g Required and Recommended Patch Sets' on http://support.oracle.com indicates that for 11.1.1.6.6 patch set you need to download and apply JDeveloper patch 13952743 which is not included in the core 7 patches.  Make sure to download 13952743 and unzip it to your $FMW_HOME/Oracle_BI1 folder as well.

Step 10) Update Environment Variables for the JDeveloper Patch

You'll need to change your environment variables for this patch as follows:

$ORACLE_HOME = FMW_HOME/oracle_common

Step 11) Apply the JDeveloper Patch

Using the same opatch apply command. Make sure you navigate to the 13952743 folder first!

Step 12) Validate all patches have been applied

Execute the following command: opatch lsinventory . All 8 patches should be listed.

Step 13) Validate Version in Answers

After starting your Admin Server, Node Manager, Managed Server and OPMN services. Navigate to your Administration tab in Answers to view the new version:

Potential Issue: Conflict with previous patches

In my earlier post I outlined how to apply an individual patch to resolve bug 1467168.1 (multiple pie charts error) by applying patch 14003822 .
If you've applied any individual patch and then later try to apply a bundle patch you'll get the following error:

indicating there is a conflict between the original patch and the 11.1.1.6.6 bundle patch. Go ahead and override the original patch with the new 11.1.1.6.6 patch set. This new patch set also includes any one off patches you've applied so it's safe to override.


keywords: obiee 11g upgrade, obiee upgrade, upgrade assistant, opatch, 11.1.1.6.6, how to install obiee 11g

How-to: OBIEE 11g Javascript Integration using Action Framework (Browser Script)

January 12, 2013, 3:20 pm

≫ Next: FYI: Maximizing Your Oracle Support and Oracle Documentation for OBIEE 11g

≪ Previous: How-to: Apply OBIEE 11g Bundle Patch Set (11.1.1.6.6)

$

0

0

One of the powerful features of Oracle's Business Intelligence 11g platform is a concept called 'Action Framework' or 'Actionable Intelligence'. It's useful because for the first time in OBIEE you can integrate external applications, functions or code and invoke it using the front end user interface (Answers).

Although I have seen 'javascript or jquery integration' in OBIEE 10g, the implementation was always 'hacked' together, and of course, was never supported or endorsed by Oracle. In this guide we'll show how you can take any javascript or jquery function and by using Oracle's supported 'external systems framework', integrate it seamlessly with OBIEE 11g.

Consider the scenario where your source data warehouse or ERP stores employee numbers in an encoded format of base 64. For example, employee number '123456789' is 'MTIzNDU2Nzg5' in base 64.  The requirement you have is to display the decoded employee number in a report. How do we implement this requirement?

Luckily, base 64 encode/decode functions are easily accessible via the internet, so we'll use the code from Stackoverflow.com

The encode function will ultimately end up in the UserScripts.js file located at:

• <middleware home>/user_projects/domains/bifoundation_domain/servers/bi_server1/tmp/_WL_user/analytics_11.1.1.2.0/<installation dependent folder>/war/res/b_mozilla/actions/UserScripts.js

But we can't just copy & paste, so let's get started.

Step 1: Understand how OBIEE 11g uses action framework to invoke custom javascript functions

OBIEE 11g stores custom javascript functions in Userscripts.js. In order to integrate a javascript function into userscript.js your function  must have:

• a USERSCRIPT.publish function which is required to pass the parameters to the target javascript function
• a USERSCRIPT.parameter function out of the box function which is used by the Action Framework to define parameters in custom JavaScript functions for use when creating an action to Invoke a Browser Script. Each parameter object includes a name, a prompt value holding the text to be displayed against the parameter when creating an action, and a default value.
• a USERSCRIPT.encode function - the actual function we're going to implement

Step 2: Create USERSCRIPT.encode.publish function


As described above, the userscript.encode.publish function needs to take the parameters from the USERSCRIPT.parameter file and create a new encode object:

USERSCRIPT.encode.publish=
{
 parameters:
 [
  new USERSCRIPT.parameter("employeenumber","Employee Number","")
 ]
}

 Step 3: Create the actual encode functions

The encode function from stackoverflow is actually comprised of two functions: 1) the public method for encoding and 2) the private method used for UTF8 encoding

USERSCRIPT.encode function:

USERSCRIPT.encode=function(b)
{
var cz="";
for(args in b)
 { // this for function is needed to store the 3rd value in the array - the actual employee number
 var d=args;
 var a=b[d];
 cz = a;
 }
 var output = "";  
 var chr1, chr2, chr3, enc1, enc2, enc3, enc4;
 var i = 0;
 var _keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
 var input = USERSCRIPT.UTF8Encode(cz);

 while (i < input.length)
 {

  chr1 = input.charCodeAt(i++);
  chr2 = input.charCodeAt(i++);
  chr3 = input.charCodeAt(i++);

  enc1 = chr1 >> 2;
  enc2 = ((chr1 & 3) << 4) | (chr2 >> 4);
  enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);
  enc4 = chr3 & 63;

  if (isNaN(chr2)) {
   enc3 = enc4 = 64;
  } else if (isNaN(chr3)) {
   enc4 = 64;
  }


  output = output +
  _keyStr.charAt(enc1) + _keyStr.charAt(enc2) +
  _keyStr.charAt(enc3) + _keyStr.charAt(enc4);
 }

alert(output)
}
;

USERSCRIPT.UTF8ENCODE function

USERSCRIPT.UTF8Encode=function(b)
{   
 var str = b.replace(/\r\n/g,"\n");   
 var str = b;

 var utftext = "";
 for (var n = 0; n < str.length; n++) {
  var c = str.charCodeAt(n);
  if (c < 128)
  {
   utftext += String.fromCharCode(c);
  } else if((c > 127) && (c < 2048)) {
   utftext += String.fromCharCode((c >> 6) | 192);
   utftext += String.fromCharCode((c & 63) | 128);
  } else {
   utftext += String.fromCharCode((c >> 12) | 224);
   utftext += String.fromCharCode(((c >> 6) & 63) | 128);
   utftext += String.fromCharCode((c & 63) | 128);
  }
 }

 return utftext;
 };

After this, make sure to restart Admin Service, Managed Server and OPMN prior to creating the Action in Answers

Step 4: Create the Action in Answers

In Answers, navigate to New -> Actionable Intelligence -> Action -> Invoke -> Invoke a Browser Script

1) 2)

Click browse and select the USERSCRIPT.encode function:

Since the USERSCRIPT.parameter function specified 3 parameters, we will need to populate the three fields  as follows: Object Name, prompt value, and default value.

After saving the action, execute it and populate it with a number, or leave it as default 123456789.

And as expected, the encoded base 64 number 123456789 is - 'MTIzNDU2Nzg5'

This example only scratches the surface of what's possible with Action Framework and OBIEE 11g. Correctly implemented, you can invoke 3rd party applications or functions (*cough* ETL on demand *cough*), pass data to the ERP source system, integrate a data set with Google Maps, or all of the above.

In future guides we will explain the advanced functionality of Action Framework.

keywords: action framework,  obiee action framework, obiee javascript, obiee actions,  actionable intelligence

FYI: Maximizing Your Oracle Support and Oracle Documentation for OBIEE 11g

January 12, 2013, 10:12 pm

≫ Next: How-to: Impersonate or Act As Other Users (e.g. End Users) in OBIEE 11g

≪ Previous: How-to: OBIEE 11g Javascript Integration using Action Framework (Browser Script)

$

0

0

When most OBIEE Architects and Developers encounter a problem or road block, their first solution (assuming they don't know how to resolve the issue) is to use google to search for error codes, potential solutions, or at least other developers to commiserate with!

An exceptional resource for OBIEE 10g/11g issues that I often see underused or completely ignored is Oracle's Support web site - http://support.oracle.com  . Yes, we all use Oracle Support to create trouble tickets but the Support site offers much more than just the ability to raise defects.

Here are key documents that all Oracle Business Intelligence Architects should follow if they want to stay current with the latest patches,  news, quarterly updates, and official Oracle announcements (like Oracle officially dropping Premier support of OBIEE 10g 10.1.3.4!)

• Information Center: Business Analytics Index (EPM/BI) [ID 1378677.2]
• Why: This is the central 'home page' for all of Oracle's Analytics products. You'll have access to the Quarterly BI News Letter, Oracle OBIEE Community, and more.

( Make sure you are book marking all of these using the star icon !)

• Oracle Business Intelligence Enterprise Edition (OBIEE) Product Information Center (PIC) [ID 1267009.1]
• Why: This is the starting point for all official Oracle Business Intelligence guides including : Troubleshooting, patching, and white papers
• Information Center: Oracle Business Intelligence Enterprise Edition (OBIEE) Release 10g and Later [ID 1349983.2]
• Why:  This  document aggregates posts from Oracle's OBIEE community, new features and processes,  and highlights new articles
• The Official Oracle Business Intelligence Enterprise Edition Community - https://communities.oracle.com/portal/server.pt/community/obiee/475
• Why: This is similar to Oracle's freebie forum http://forums.oracle.com with the exception that there are dedicated Oracle OBIEE Architects who reply to your posts - definitely worth the bookmark!

I also recommend subscribing to Oracle's Hot Topics email for OBIEE as it's another way for you to stay current with OBIEE news if you don't have the time to review the above web sites. You can subscribe as follows:

Navigate to My Oracle Support -> Settings -> Hot Topics E-mail

Then specify the products of your interest. I recommend: Business Intelligence Interactive Dashboard,  Business Intelligence Server Administrator, Oracle Business Intelligence Applications Foundation, Oracle Business Intelligence Server Enterprise Edition, Oracle Business Intelligence Suite Enterprise Edition

Of course, the Official Oracle Documentation is another must have:

• Oracle Fusion Middleware 11g (11.1.1.6) Documentation Library
• Business Intelligence Documentation for Oracle Fusion Middleware 11g (11.1.1.6)

keywords : OBIEE 11g administration guide, obiee 11g,  obiee 11g training, obiee 11g support, obiee tutorials, obiee administration guide

How-to: Impersonate or Act As Other Users (e.g. End Users) in OBIEE 11g

January 13, 2013, 4:25 pm

≫ Next: FYI: Overview on Object Level Security, Application Roles, and Inheritance in OBIEE 11g

≪ Previous: FYI: Maximizing Your Oracle Support and Oracle Documentation for OBIEE 11g

$

0

0

In a typical Oracle Business Intelligence (OBIEE) 11g environment, potential defects or data discrepancies arise that will require the production support team to investigate or research the potential issue. A useful way to research the issue is by having the developer 'act as' the specific end user who is encountering the defect, usually by logging in as their account or an account with similar security rights.

For security reasons, the developer or support team is usually never given the end users login credentials so unless they re-create an account with the same privileges, they're unable to 'see what the end user sees'.

In OBIEE 11g Oracle outlines a detailed method for acting as another user through a 'proxy', outlined here .
This process requires pre-configuration and deployment of key tables to facilitate acting as another user, and is not set up 'out of the box'.

Although there is value in setting up the Act As / Proxy functionality (for example, a supervisor wants to delegate some of his work to his direct report), from a development and troubleshooting perspective, impersonation can be achieved with the HTTP header and and the following parameters:

• NQUser
• NQPassword
• Impersonate

For example:

http://hostname:9704/analytics/saw.dll?Logon&NQUser=Administrator&NQPassword=Administrator&Impersonate=usernametoimpersonate

Before you can use this feature, the appropriate privilege must be added to your Administrator role (usually BIAdministrator Application Role):

• oracle.bi.server.impersonateUser
• oracle.bi.server.queryUserPopulation

Step 1: Navigate to Application Policies in Fusion Middleware (:7001/em/)

Farm_BIFoundation_domain -> Business Intelligence -> coreapplication -> security -> Application Roles

Step 2: Add required roles to Administrator's Application Policies

In the obi_ strip, click the edit button for the Administration Application Policies and search for

• oracle.bi.server.impersonateUser
• oracle.bi.server.queryUserPopulation

No restart is required. You can now use:

 http://hostname:9704/analytics/saw.dll?Logon&NQUser=Administrator&NQPassword=Administrator&Impersonate=usernametoimpersonate

to act as other end users. You will inherit all application roles as if you were the actual user.

keywords: obiee impersonate, obiee act as, obiee 11g security, obiee 11g answer