Release 4.1 for Windows
A86730-01
 Library |
 Contents |
 Index |
| Oracle Discoverer Administration Edition Administration Guide Release 4.1 for Windows A86730-01 |
|
This chapter explains how Discoverer supports access to Oracle Applications databases using Oracle Applications security.
This chapter consists of the following sections:
The following Oracle Applications features are supported by Discoverer:
These features are only available when Discoverer is running in Applications mode against an Oracle Applications mode EUL against an Oracle Applications database (Applications Mode).
The following need to be satisfied for Discoverer to function when connecting as an Oracle Applications user (Applications Mode):
The following Oracle Applications versions are supported by Discoverer:
Oracle Applications users can launch Discoverer 4i Plus and view Discoverer worksheets directly through a link on an Oracle Applications page.
The following prerequisites apply:
This section explains how to configure the Connect dialog for Oracle Applications users of Discoverer Administration Edition and Discoverer Plus (for Windows).
Before you connect to Oracle Discoverer as an Oracle Applications User, you can configure the Oracle Discoverer Connect dialog to expect Oracle Applications users, as follows:
If you select either the Connect to applications EULs or Connect to both standard and applications EULs radio button, further details can be entered into the following fields:
If you do not know what the above values are contact your Oracle Applications system administrator.
This section explains how to configure the Connect dialog for Oracle Applications users of Discoverer 4i Plus and Discoverer 4i Viewer.
Oracle Discoverer 4i Plus and Oracle Discoverer 4i Viewer can be configured to validate Oracle Applications usernames and passwords during the connect process.
For further details please refer to Oracle Discoverer 4i Configuration Guide for Oracle 9i Application Server.
In order to run Discoverer in Applications mode you first need to start Discoverer Administration Edition in Applications mode then create an Applications mode EUL.
This section describes the how you start Discoverer Administration Edition in Applications Mode.
This EUL has special features that provide support for use with Oracle Applications.
For more information, see Section 17.6, "Create an Applications Mode EUL."
For more information, see Section 17.7, "Connect to an Applications Mode EUL."
This section describes the prerequisites required for you to use Discoverer in conjunction with the Oracle Applications Multiple Organizations Support feature.
Using Discoverer with Oracle Applications Multiple Organizations Support enables you to to work with data from more than one Organization. Users can query and analyze data from a set of Organizations to which they have been granted access.
To use Discoverer Administration Edition in conjunction with the Oracle Applications Multiple Organizations Support feature the following prerequisites must be met:
This section describes the noticeable changes in behavior that occur when Discoverer Administration Edition is running in Applications mode.
The Privileges and Security dialogs display Oracle Applications user names and responsibilities instead of native Oracle Users and database Roles. Privileges and security are assigned to Oracle Applications Usernames and Responsibilities. To learn more about granting privileges via the Public user see Section 17.7.1.1.1, "Grant Task privileges to all Oracle Applications users via the Public user".
For more general information about Discoverer Access Privileges and Security see Chapter 8, "Access Privileges and Security".
Some Applications Database Views contain row level security and return differing result sets depending upon the currently active responsibility. This means that the Summary Table or Materialized View (MV) (8.1.6+ databases) would contain different data depending on the responsibility of the user that refreshed the table.
If a user performs a query against the detail data associated with such a Managed Summary Folder, and Summary Redirection is performed, the user will be told that no rows satisfy this criteria (this ensures that the user does not see data they should not have access to). As an administrator, you should ensure that Summary Folders that are based on Applications Secure Views or Applications Business Views are created as External (rather than Managed).
Managed Summaries Folders on data without Applications row level security are completely unaffected. Users can continue to use External Summary Tables. If the External Summary Table is registered against an object with Applications row level security, it is the responsibility of the administrator to make sure the External Summary Table provides secure access.
Some views with row-level security, support "public" rows (particularly the Apps Human Resources). So sometimes Managed Summary Tables or MVs contain small amounts of data.
When Discoverer Plus or Discoverer 4i users access Workbooks accessing Secure Views, they may get different results on different machines, even when using the same Connect details. A possible cause is that the machines have different local language (NLS) settings.
When using Secure Views, machines' local language settings affect the data retrieved by Discoverer. To change a machines local language setting, on Windows NT, choose Start\Settings\Control Panel\Regional Settings and change the language value. Discoverer will then display data consistently across machines with the same language setting.
For more information on Secure Views refer to Chapter C.4, "Running queries against Secure Views and making Query Prediction faster".
You can also define a language setting (NLS) for a User/Responsibility/Application/Site using the Profiles setting in Oracle APPS application. Refer to your Oracle Applications documentation for more information.
This section describes how you create an Applications Mode EUL (including and new Oracle Applications user) using the Create EUL dialog.
An Applications Mode EUL can also be created via the command line (see Section D.9.6, "Creating an Applications Mode EUL" for details).
The only native-Oracle user that can connect to an Applications Mode EUL is the EUL owner.
|
Note: The Oracle Applications User Connect dialog may or may not display the Oracle Applications user check box. For further details see Section 17.3, "Configuring the Connect dialog for Administration Edition and Discoverer Plus (for Windows)". |
If you clicked Yes at the previous step, you are now connected to the Oracle Applications EUL just created (as the EUL owner).
You can now grant Task Privileges to an Oracle Applications user so that they can now administer this Oracle Applications EUL. See Section 17.9, "Granting Task Privileges".
You could also create a new Business Area using the Oracle Applications tables. See Chapter 7, "Business Areas" for further information on creating Business Areas.
This section describes how you connect to an Applications Mode EUL using Discoverer Administration Edition and includes the following sections:
The only native-Oracle user that can connect to an Applications Mode EUL is the EUL owner. However the EUL owner can grant administration privileges to Oracle Applications users. The authorized Oracle Applications users can then connect to the Applications Mode EUL using Discoverer Administration Edition. See Section 8.2, "Granting Access Permission for Business Areas" for details.
You can grant task privileges to all users in one action by using the Public user in the following way:
If you access the Tools | Privileges option (when connected to Discoverer as an Oracle Applications user), you will see a user called Public. The user Public is not an Oracle Applications user but represents every Oracle Applications user. By giving one or more privileges to the Public user you are in fact giving the privileges to all Oracle Applications users. You can subsequently modify user's privileges by removing them (the privileges) on a per-user basis.
Once you have been granted Discoverer Plus task privileges (see Section 17.7.1.1, "Grant permissions to Oracle Applications users") you can connect to Discoverer as an Oracle Applications user:
If Discoverer is not configured to use Oracle Applications EULs, you need to re-configure your Connect dialog, (see Section 17.3, "Configuring the Connect dialog for Administration Edition and Discoverer Plus (for Windows)").
When you connect to Discoverer as an Oracle Applications User, the Connect dialog prompts you to enter your Oracle Applications connect details (see Status area in Figure 17-11).
Once you have configured Discoverer to use Oracle Applications EULs, (see Section 17.3, "Configuring the Connect dialog for Administration Edition and Discoverer Plus (for Windows)"), connect to Discoverer as follows:
|
Note: The Oracle Applications User Connect dialog may or may not display the Oracle Applications user check box. For further details see Section 17.3, "Configuring the Connect dialog for Administration Edition and Discoverer Plus (for Windows)". |
Once you have chosen a responsibility, Discoverer connects to the applications database and displays the first screen of the Load Wizard (see Figure 3-2, "Using Load Wizard to Open a Business Area").
The above dialog can display two columns if security groups are present (Oracle Applications v11i only).
Discoverer Administration Edition is now running and connected to your applications database, the next step is to either open a business area or create a new one.
Oracle Applications users can connect with just one of a number of potential Responsibilities and each Responsibility can have a number of Privileges granted to it.
This means that an Oracle Applications user can decide the Responsibility with which to connect, and by default will assume the Privileges granted to that Responsibility (see Section 17.9, "Granting Task Privileges" for further details). Native Oracle database users (on the other hand) have Roles rather than Responsibilities and can only decide the user with which they want to connect, not the Role. Any Role(s) associated with a native Oracle database user are not selectable at connect time.
This section describes how to grant (or deny) access permission for business areas to specific users or responsibilities.
The Security dialog box enables you to set access permission for business areas. To open the Security dialog box, choose Tools | Security (or click the Security icon on the toolbar).
The Security dialog box has two pages:
The two pages provide two ways of looking at the same information. The page you choose depends on the specific task you want to perform.
Before displaying the folders in a business area, Discoverer checks if the user has database access to the tables referenced in the folders. If they don't have the necessary permission, Discoverer does not display the folders. You can override this check by changing a registry setting. For more information, see ObjectsAlwaysAccessible in Chapter E.2, "Registry Settings".
This section describes how to specify which users or responsibilities can access a specific business area.
There are two ways of doing this.
To select more than one user/responsibility at once, hold down Ctrl while you click on the users/responsibilities.
The Available User/Responsibility list includes a role called Public. Select this role to view or edit the privileges that Discoverer Administration Edition provides by default for users or roles/responsibilities whose task privileges you have not yet defined.
The actual administration tasks a user can perform also depends on their Administration privileges. See Section 17.9, "Granting Task Privileges," for more information.
This section describes how to specify which business areas a specific user or responsibility can access.
There are two ways of doing this.
The drop-down list for user/responsibility includes a role called Public. Select this role to view or edit the privileges that Discoverer Administration Edition provides by default for users or roles/responsibilities whose task privileges you have not yet defined.
To select more than one business area at once, hold down Ctrl while you click on the users/roles.
The actual administration tasks a user can perform also depends on their Administration privileges. See Section 17.9, "Granting Task Privileges," for more information.
This section describes how to grant (or deny) the privilege to perform certain tasks as an Oracle Applications user.
The Privileges dialog box enables you to set task privileges. To open the Privileges dialog box, choose Tools | Privileges (or click the Privileges icon on the toolbar).
The Privileges dialog box has four pages, we will focus on the first two which help you specify task privileges:
These two pages provide two ways of looking at the same information. The page you choose depends on the specific task you want to perform.
This section describes how to specify the tasks a specific user or responsibility can perform.
See Section 17.7.3, "Oracle Applications Responsibilities" for further information about Responsibilities.
There are two ways of doing this.
To grant a minor privilege (shown indented in the list) you must first grant the corresponding major privilege (the first, non-indented privilege above the minor privilege).
Deselecting (revoking) a major privilege revokes the subordinate, minor privileges for the selected user/responsibility only. This means that if a major privilege is revoked from an Oracle Applications user alone, subordinate minor privileges may not necessarily be revoked if the user's current responsibility (chosen during login) also has this major privilege. The minor privilege check boxes may remain checked.
As you move the mouse over a privilege in the Privilege list, a brief description of the privilege appears on the right-hand side of the dialog box.
The drop-down list for the Privileges tab (on the right hand side of this dialog) includes a responsibility called PUBLIC. Select this Responsibility to view or edit the privileges that Discoverer Administration Edition provides by default for users or responsibility whose task privileges you have not yet defined.
|
NOTE: If you wish to grant Administration privileges to a user or responsibility, you must also grant that user Administration access to the business area. For more information, see Section 8.2.1, "Specifying the Users / Roles who can Access a Business Area." |
This section describes how to specify the users or responsibilities that can perform a specific task.
There are two ways of doing this.
The list is sorted alphabetically, with users at the top and responsibilities next.
When you select a privilege from the drop-down list, a brief description of the privilege appears on the right-hand side of the dialog box.
|
NOTE: If you wish to grant (or deny) Administration privileges to a user or responsibility, you must also grant (or deny) that user Administration access to the business area. For more information, see Section 8.2.1, "Specifying the Users / Roles who can Access a Business Area." |
|
 Copyright © 2000 Oracle Corporation. All Rights Reserved. |
|
).
).