The “Act As” or Proxy functionality gives the opportunity to some users to run the dashboards, the reports, … as someone else. Once you are logged into OBIEE dashboards, you can “act as” a list of predefined users, this feature is useful to check credentials, move/configure “my dashboard”, delivers, … without having to ask/know every user password.

From the dashboard Menu : Settings >> Act As

As you can see I was logged as “administrator” and I’m now acting as Borkur Steingrimsson

How does it works

OBIEE need a source of information stored outside the BI server that can give the list of users under which the logged user can “act as”. Once selected the dashboard is reloaded like if you are that user (with same target user privileges or read only privileges).

The proxy table

In my environment I already have an Oracle schema called “OBIEE” that contains user credentials, groups, …So I’m going to add a table there in which I will defined for each user, their possible target user and the right (full or restricted)

CREATE TABLE OBIEE_PROXY_USER( PROXYID VARCHAR2(100) NOT NULL, TARGETID VARCHAR2(100) NOT NULL, PROXYLEVEL VARCHAR2(100) NOT NULL)

Insert some data :

Create Session Variables for Proxy Functionality (inside the repository)

Modify the instanceconfig.xml File for Proxy Functionality

Here comes the more tricky parts …
First locate your instanceconfig.xml and back-up it !
The default location is like …./OracleBIData/web/config/
open the file and add the following code just before the </ServerInstance>

<LogonParam>
<TemplateMessageName>LogonParamSQLTemplate</TemplateMessageName>
<MaxValues>100</MaxValues>
</LogonParam>

LogonParamSQLTemplate is your new message name (you will have to re use the exact same name just after !)
100 is the max number of user you can “Act as”

NOTE from the Doc : The name that you specify in the <TemplateMessageName> element must match the name that you specify in the <WebMessage> element in the custom message file.

Creating a Custom Message Template for Proxy Functionality

You need to create a custom message template for the proxy functionality that contains the SQL to get the list of target users that a proxy user can act as. This list appears in the User box in the Act As dialog box.

In the custom message template, you place the SQL to retrieve this information in the following XML elements. So let’s create a custom webmessage.
The new XML file should be placed in SAROOTDIR\web\msgdb\customMessages folder, where SAROOTDIR is the installation directory
(For me … /OracleBI/web/msgdb/customMessages/)

Name your file according to what TemplateMessageName you define in the instance Config ! (what you just did before !)
For me “LogonParamSQLTemplate.xml”

Here is the content

<?xml version="1.0" encoding="utf-8" ?>
<WebMessageTables xmlns:sawm="com.siebel.analytics.web.messageSystem">
<WebMessageTable system="SecurityTemplates" table="Messages">
<WebMessage name="LogonParamSQLTemplate">
<XML>
<logonParam name="RUNAS">
<getValues>EXECUTE PHYSICAL CONNECTION POOL SystemUsers.OBIEE select targetId from OBIEE_PROXY_USER where proxyId='@{USERID}'</getValues>
<verifyValue>EXECUTE PHYSICAL CONNECTION POOL SystemUsers.OBIEE select targetId from OBIEE_PROXY_USER where proxyId ='@{USERID}' and targetId='@{VALUE}'</verifyValue>
<getDelegateUsers>EXECUTE PHYSICAL CONNECTION POOL
SystemUsers.OBIEE select proxyId, proxyLevel from OBIEE_PROXY_USER where targetId ='@{USERID}'</getDelegateUsers>
</logonParam>
</XML>
</WebMessage>
</WebMessageTable>
</WebMessageTables>

Enable “Act as” privilege

Log in the dashboards with an admin user, go to “Settings” >> Administration >> Manage Privileges
Search for proxy and set the thing according to your needs.

Restart & Test

Now Last but not least restart the BI server and the presentation Server.
For the presentation server you can just “Reload Files and Metadata” in the Administration

If that does not work …
Well check your logs
…/OracleBI/server/Log/
and … /OracleBIData/web/log/

Extra steps

Since in our project we are using LDAP authentication, I had to disable the “required for authentication” for the rpd init block that check the user credential inside the ldap.

The reason is probably that OBI does not know the password of the user you want to “act as”.

Some ideas

If your users and credentials are stored inside the Database, this feature can be used to test “group credentials”, since almost all the logic is implemented inside simple SQL … Great OBIEE !

Source and biography
Oracle/Siebel documentation

Oracle OBIEE Doc details : Oracle® Business Intelligence Presentation Services Administration Guide >> Managing Oracle BI Presentation Services Security>> Process of Authorizing Users to Act for Others

A Word about the Author (Nicolas De Brabanter)

Since this the first time I contribute to this blog, I will shortly introduce myself. I used to be an IT consultant (for 10 years) labelled “Senior DWH”, “DWH architect” or even “DWH ETL Specialist”. My domain of expertise is BI & Data Warehouse (concepts, architecture, modelling, DB, etc …. ). I’m happy to share with Borkur a project that involves OBIEE, OWB, Oracle DB 10g and an acceptable DWH (1.5 TB)

When I wrote the material for last year’s masterclass, OWB Paris was still in beta, Oracle BI Suite Enterprise Edition was only on limited release and BI Publisher was still called XML Publisher and little more than a toolkit. Now, OWB 10gR2 has been in developers’ hands for around twelve months, BI Suite Enterprise Edition is on full release on OTN and people are starting to work on projects and getting some results. As such, I think it’s fairly safe to assume most attendees will have basic familiarity with the new tools, and that we can start to move on to some of the more advanced topics.

As well, Oracle’s future direction around BI is starting to become clear, and it’s starting to become obvious that most new customer developments are going to be around the Oracle BI Suite EE and Fusion Middleware ranges of products. Certainly for now, I think the conversation has moved along from "What do BI Suite Standard and Enterprise edition do, and what do the new set of products
bring to things" to "how can I deliver next-generation BI applications based on BI Suite Enterprise Edition, integrate them with my SOA environment, link them up to my databases (whatever vendor provided them) and start making BI pervasive in the organization".

With that in mind, my thoughts on the next BI Masterclass is to focus solely on the BI Suite Enterprise Edition family of products, treat areas such as data integration, databases and OLAP in a heterogeneous way, and think about how BI links in with the organizations’ security/identity management and it’s applications. As a bonus, I’ll include something on data mining, predictive analytics and real-time decisions.

Here’s the proposed agenda:

Day 1: Building the Next-Generation BI Platform

Session 1 : Oracle BI Enterprise Edition platform overview (what’s new in 10.1.3.2, what’s coming in 11g, in context of Fusion Middleware)
Session 2 : Modelling the BI Enterprise Information Model (using BI Server to model the business layer & generate physical data model)
Session 3 : Heterogeneous ETL using Oracle Data Integrator
Session 4 : Business Intelligence & identity management (adding security to BI Server, linking in with SSO and VPD)

Day 2: Next-Generation Analytics

Session 1 : Building the Presentation Layer (advanced techniques with Dashboards, Delivers, Answers, managing the Presentation Server)
Session 2 : Oracle Discoverer interoperability with BI Suite EE (dashboards and delivers integration, migration techniques for EULs to BI EE)
Session 3 : Data Mining, Analytics and Real-Time Decision (Oracle Data Mining, analytics using BI Server, Oracle Real-Time Decisions)
Session 4 : Integrating BI into Business Processes (using Oracle BI EE with SOA, BPEL, BAM etc)

As before, it’ll be talks by me, and demonstrations of each of bits of technology – last time there were around twenty separate demos over the two days.

So, what do you think? Is this meaningful to you, or is it perhaps a bit too far out there to be relevant? I’m thinking that the real value in these sorts of events is to give people a taste of what’s coming up, and to try and make some sense of where the technology is going. I’m also keen to explore the links between BI and business processes/identity management, as I think these are going to be increasingly relevant over the next few years.

Anyway, if you’ve got any thoughts, or suggestions, let me know. I’m keen to hear if this is something that’s of interest to other people rather than me just scratching my own intellectual itch. Add a comment if you get a moment.

I’ll post more news on what this means over the next few days, but for now, welcome to Rittman Mead Consulting, the name of our new consulting venture.

In the original blog posting, I noted that most real-life customer deployments of Warehouse Builder involve more than one target database. This is probably still true, but it’s also worth noting that many customers, especially when they first start out, have a much simpler architecture, and it’s important not to over-complicate things too early on. In particular, I think now that the Multi-configuration feature in the Enterprise ETL Option is a bit of a red-herring, as in the vast majority of situations it’s just not needed. To explain this, I’ll firstly go through some typical customer deployments, and explain where all the various features come in.

The most typical deployment of Warehouse Builder 10gR2 is with a single database with both the repository and target schema in the same database, like this:

This kind of setup requires a single Control Center, which is contained within the repository used to hold the table and mapping designs.

A slightly more complicated setup is where you have a single repository, and a single target schema, but they are on different databases, like this:

In this case, you can still use a single Control Center, but it has to be the one on the database used by the target database. To do this, you install a new repository on the target database, register it in your project, and make this the default Control Center for your default configuration (right-click on DEFAULT_CONFIGURATION in the project, edit the properties and select the other control center, making sure you’ve registered the control center in the project beforehand.) Make sure you do this before you create your warehouse target module, then the location you set up will be owned by the correct Control Center. There’s no need to use multi-configuration to get access to this Control Center, you can just enable it by changing the Control Center assigned to the default configuration.

When it comes to deploying these two approaches to production, assuming production has the same tablespace names and table storage parameters as development, you can just create a production repository, export the development repository to an MDL file, and then import it into the production repository to promote the code. Multi-configuration only becomes relevant if you need to store different physical object properties for each environment, but most places I’ve been to don’t need this as development has the same tablespace names as the production environment.

A more complex setup, and one that I focused on in my original posting, was where you had two or more target databases that your project needed to deploy to. In my posting, I said that the only way you could do this was to use multi-configuration to re-point the Control Center Manager to each of the required Control Centers. Someone came back fairly quickly and reminded me that you could, as I’ve just explained, switch the control center associated with your default configuration using the Design Center GUI, and since then I’ve been working with clients on OMB*Plus scripting where this is even easier to do, like this:

OMBCONNECT username/password@host:port:sid

...

Again, therefore, multi-configuration, whilst it makes your life easier, is by no means a mandatory feature and you can deploy to more than one target database just as easily using standard, ETL Core features. Multi-configuration isn’t really the issue here; sure it lets you easily work with two or more control centers, but this isn’t the real use for it and you can achieve the same just as easy with standard features of the tool. Going from development to production is still the same case as before; you just export the project to an MDL file and import it into the production repository, then go through the same process to deploy to multiple control centers.

That said, most of the points I raised are still valid. You still need to be mindful of which control center owns your locations, as a given control center can only deploy and execute mappings against locations it owns, which must be on the same database as the control center. Versioning is still important, and OMB*Plus is the key to automating the move from development to production without introducing human error. There is a role for multi-configuration, and you can still use it as a way of using a single repository but storing deploying to different locations for development, test and production, but this isn’t the usual approach and it’s better to place the emphasis on what people actually do most of the time.

One thing that did come out of last week’s work was a lot of work on OMB*Plus; it made a lot of the above clearer as it helps expose what OWB is doing under the covers when you deploy tables and mappings; it also makes handling more complex environments a lot more managable because you can script everything. I’ve got a couple of issues left on some scripts I wrote that I need to sort out, but once I do, I’ll post a couple of articles on using OMB*Plus and how you can use it to help productionize an OWB deployment and work with these more complex setups. More on that in a few days, but I thought it worth going back to the original article as I think in retrospect it placed too much emphasis on multi-configuration, which as part of the Enterprise ETL Option isn’t cheap and isn’t actually a prerequisite when working with multi-database environments.