12
Managing User Access

Chapter summary

This chapter describes the functions that administrators perform to manage user access.

Who should read this chapter

Read this chapter if you are an administrator who maintains users and controls access to data in the shared database.

List of topics

This chapter includes the following topics:

• Creating Users

• Maintaining Users

• Controlling Access to Shared Data

• Creating Write Access Profiles

Creating Users

Who can create users?

As an administrator, you can create users for the shared database that you maintain.

Prerequisites for creating users

Windows client users require installed environment

Before you can create a new Windows client user, you must install the user's environment. This environment, called a component, contains shell databases and configuration files.

For information about installing user environments, see Oracle Financial Analyzer Installation and Upgrade Guide.

Determine web sign-on method

Ask your system administrator how web users will access Financial Analyzer. If the system has been installed so that users will access Financial Analyzer through Oracle Self Service Applications, setting up users will involve importing user names from Oracle Applications. You will need an Oracle Applications user ID, password, and connection alias to perform this task.

Adding users

Choose Users from the Manage menu to create a new user. This opens the Manage Users dialog box, where you choose New to enter information for a new user.

You provide the following user information:

• User -- Enter a name that identifies the user.

• User type -- Select the type of user. For more information, see "Specifying user type.

• Usernames -- Choose Edit to access the Edit User dialog box where you can associate one or more user names with the user and specify whether the user is authorized to create shareable documents. For more information, see "Specifying user name and "Using the Shareable Documents Feature.

• Other -- Provide information that is specific to the client type. For example, for a thin-client workstation, you enter the SHELLS directory of the component where you are creating the user and the Express Server instance to which the user's personal database will be connected.

Adding a new user creates a user task and sends it to the Task Processor. If you are not running the Task Processor in the background, you must run it in the foreground to process the user task.

Specifying user type

You can create the following type of users:

• DBA -- An administrator who has access to a personal and shared database and to the set of features that are available in the Administrator workstation. On the web, DBA users access data from the shared database

• Budget -- A user who has access to a personal database and to the set of features that are available in the Budget workstation. For a budget user who will access Financial Analyzer through the Windows client, you can create a budget user as thin- or thick client. On the web, budget users access data from the shared database.

• Analyst -- A user who has access to a temporary personal database and to the set of features that are available in the Analyst workstation. For a Windows client, an analyst user's personal database must be connected to the same instance of Express Server that is connected to the shared database.

• External -- A user who has access to the shared database of his or her administrator and to a set of features that are available through the Financial Analyzer Web interface, through the Express Spreadsheet Add-In, or through a custom application that accesses the Financial Analyzer shared database.

Specifying user name

You can import user names from one of two sources:

• Operating system -- Choose this option to select users who will access Financial Analyzer through the Windows client. You can also use this option to select web users who will not use Oracle Applications to access Financial Analyzer.

• Oracle Applications -- Choose this option to select web users who will use Oracle Applications to access Financial Analyzer through a single sign-on.

For Windows client users and web users who will not use Oracle Applications to access Financial Analyzer, you also have the option to manually type in a user name.

Manually entering user names

To enter a user name, type the name into the blank Specify User Name box in the New User dialog box or the Edit User dialog box.

Importing user names from the operating system

To import user names from the operating system, choose Import User in the New User dialog box or the Edit User dialog box. Choose the System Users tab, select one or more users and choose OK.

Importing user names from Oracle Applications

To import user names from Oracle Applications, choose Import User in the New User dialog box or the Edit User dialog box. Choose the Oracle Applications tab, log into Oracle Applications, select one or more users, and choose OK.

You only have to log into Oracle Applications once per session. When you log in, you are prompted for the following information:

• Oracle Applications user ID -- Your ID for the Financial Analyzer schema

• Oracle Applications password -- Your password for the Financial Analyzer schema

• Alias -- Alias for the TSNAMES.ORA connection file

Note: Your system administrator can provide this information.

The system retrieves a list of those users who have been authorized for the user type in Oracle Applications. For example, if you are specifying an analyst user, the system will display the names of individuals who have been associated with the responsibility of Financial Analyzer analyst in Oracle Applications.

Example: Adding a new user

The following illustration shows the New User dialog box with information for an Analyst workstation user (Analyst2). In this example, the user is associated with two user names. The (OA) designation appended to the second name indicates that the user name has been imported from Oracle Applications.

Text description of the illustration dnwusr.gif

Related information

For more information about creating users, search for the following topics in the Financial Analyzer Help system: Creating Users.

"Creating Users"

"Import Users Dialog Box"

"Oracle Applications Log In Dialog Box"

Maintaining Users

About maintaining users

You choose Users from the Manage menu to maintain users. This opens the Manage Users dialog box, where you can perform the following maintenance functions:

• Give a user a new name.

• Delete a user.

• Choose Edit to access the Edit User dialog box, where you can change information that is associated with the user. For example, you can add or remove user names associated with the user, specify whether the user is authorized to create shareable documents, and change database information.

• Move a user to a new position in the list of users maintained by the system.

If you remove a user

When you delete a user or remove a user name, that user's database and icon are not automatically deleted. However, if a user that you have deleted attempts to log in, that user will receive an error message stating that they are not a valid Financial Analyzer user and the login process will be discontinued.

Deleting or removing a user, creates a user task and sends it to the Task Processor. If you are not running the Task Processor in the background, you must run it in the foreground to process the user task.

Example: Maintaining users

The following illustrations shows the Manage Users dialog box.

Text description of the illustration dmngusr.gif

Related information

For more information about maintaining users, search for the following topics in the Financial Analyzer Help system:

"Deleting Users"

"Moving Users"

"Renaming Users"

Controlling Access to Shared Data

About data access restrictions

As an administrator, you are responsible for controlling read and write access to the shared database on your level in the tiered structure. By default, users have both read and write access to data in the shared database. When appropriate, you can prevent one or more users from writing to a particular slice of data to which they would otherwise have access.

Role of write access profile

A write access profile enables you to select a slice of data and prevent specific users or all users who have access to that data from contributing data to the shared database for values of the slice.

When you restrict users' write access to data, you prevent them from writing new data values to the dimensions in the shared database; you do not restrict the users' ability to view that data or to work with it in reports, graphs, worksheets, or data entry forms.

Examples: Restricting data access

Following are some of the ways in which you might want to restrict access to data for a financial data item.

Preventing all users from accessing values of one dimension

You can deny access to one or more values of a single dimension. For example, if you want to prevent all users from changing Actuals data in the shared database for the month of June, you can deny write access to the June value of the Time dimension for the financial data item. This action denies all users write access to the June Time dimension value and to any Actuals data dimensioned by June.

Preventing all users from accessing a combination of values of two or more dimensions

You can deny write access to one or more values of two or more dimensions. For example, if you want to prevent all users from changing Actuals data for the organizations London, Chicago, and New York for the month of November, you can deny write access to the London, Chicago, and New York values of the Organization dimension and to the November value of the Time dimension. This action denies all users write access to those dimension values and to any Actuals data dimensioned by those values.

Preventing specific users from accessing dimensions

You can deny write access to one or more users. For example, you might deny write access to Actuals to users who are entering data into data entry forms over the web. This will prevent the users from overwriting data cells for Actuals.

Creating Write Access Profiles

Process for creating a write access profile

Choose Write Access Profiles from the Manage menu to create a new write access profile. This opens the Write Access Profiles dialog box. From this starting point, you follow these general steps to create a write access profile.

1. You select the financial data item that contains the data to which you want to control write access.

2. You select the set of dimensions that make up the slice of data to which you want to deny write access.

   Note: To deny write access to specific users, select the User dimension as part of the slice. To deny write access to all users, do not select the User dimension. If you do not select the User dimension, the selections that you make to deny write access to data values in the slice will apply to all users.

3. You select the values for each dimension that make up the slice of data that you want to work with.

4. You deny access to the data slice.

Example: Selecting the financial data item for the profile

The following example shows the Write Access Profile dialog box. In this example, the user selects Actuals as the financial data item for a new write access profile.

Text description of the illustration waprof0.gif

Example: Selecting dimensions for the profile

The following example shows the New Write Access Profile dialog box. In this example, the user selects Organization and Time as the dimensions to limit.

Text description of the illustration waprof1.gif

Example: Defining the data slice for the profile

This example shows the Edit Write Access Profile dialog box. In this example, the user selects dimension values that define a data slice that includes November 2000 as the Time dimension value and Government as the Organization dimension value.

Text description of the illustration waprof2.gif

Example: Denying access to the data slice

This example again shows the Edit Write Access Profile dialog box. In this example, the user denies access to the data slice. Access is denied to all users since specific users have not been selected.

Text description of the illustration waprof3.gif

Related information

For more information about creating write access profiles, search for following topic in the Financial Analyzer Help system: "Creating a Write Access Profile."

Managing Write Access Profiles

Deleting write access profiles

When a write access profile is no longer appropriate, you can delete it. Deleting a write access profile deletes both the write access restriction and the associated data slice definition.

Editing write access profiles

You can modify a write access profile by making new value selections for the data slice. For example, you might update a write access profile that restricts write access to November Actuals, to restrict write access to December Actuals.

You can also modify a write access profile by clearing the Deny function. This removes the write access restriction, but maintains the data slice definition for reuse.