For each database object, in the Execute Direct Database Requests field, select one Click OK, then click OK again to return to the Identity Manager. For each database object, in the Populate Privilege field, select one of the Click OK, then click OK again

13-14 Metadata Repository Builders Guide for Oracle Business Intelligence Enterprise Edition 1. Follow the steps in Accessing the Query Limits Functionality in the Administration Tool to access the Query Limits tab.

2. For each database object, in the Execute Direct Database Requests field, select one

of the following options: ■ Allow: Explicitly grants the ability to execute direct database requests for this database. ■ Disallow: Explicitly denies the ability to execute direct database requests for this database. ■ Ignore: Limits are inherited from the parent application role. If there is no limit to inherit, then direct database requests are allowed or disallowed based on the property Allow direct database requests by default for the database object.

3. Click OK, then click OK again to return to the Identity Manager.

Allowing or Disallowing the Populate Privilege When a criteria block is cached, the Populate stored procedure writes the CacheSaved Result Set value to the database. You can grant or deny this privilege to particular application roles. For the selected application role, this privilege overrides the property Allow populate queries by default for the database object in the Physical layer. Any Oracle Marketing Segmentation user who writes a cache entry or saves a result set must be a member of an application role that has been assigned the POPULATE privilege for the target database. For more information about marketing cache, see the topic about setting up cache for target levels in the documentation for the Oracle Marketing Segmentation application. To allow or disallow the Populate privilege: 1. Follow the steps in Accessing the Query Limits Functionality in the Administration Tool to access the Query Limits tab.

2. For each database object, in the Populate Privilege field, select one of the

following options: ■ Allow: Explicitly grants the Populate privilege for this database. For all Marketing data warehouses, select Allow. ■ Disallow: Explicitly denies the Populate privilege for this database. ■ Ignore: Limits are inherited from the parent application role. If there is no limit to inherit, then the Populate privilege is allowed or disallowed based on the property Allow populate queries by default for the database object.

3. Click OK, then click OK again to return to the Identity Manager.

About Applying Data Access Security in Offline Mode It is strongly recommended that you perform data access security tasks in the Administration Tool in online mode. If you must apply data access security in offline mode, be aware that users and application roles do not appear in the Administration Tool in offline mode unless you have first modified them in the Administration Tool in online mode. For example, if you open the Administration Tool in offline mode without first making any changes in online mode, you will see zero users and application roles defined. Applying Data Access Security to Repository Objects 13-15 However, if you first modify the users and application roles in online mode for example, applying object permissions or setting query limits, they will subsequently be available in the Administration Tool in offline mode. Setting Up Placeholder Application Roles for Offline Repository Development Application roles are created and managed in the policy store using the Oracle WebLogic Administration Console and Fusion Middleware Control. These application roles are displayed in the Administration Tool in online mode so that you can use them to set data filters, object permissions, and query limits for particular roles. The application roles in the policy store are retrieved by the Oracle BI Server when it starts. In some cases, you may want to proceed with setting up data access security in your repository for application roles that have not yet been defined in the policy store. You can do this by creating placeholder application roles in the Administration Tool, then proceeding with setting up data access security in the repository. If you create placeholder application roles in the Administration Tool, you must eventually add them to the policy store. Run the Consistency Checker to identify application roles that have been defined in the Administration Tool, but that have not yet been added to the policy store. Be sure to use the same name in the policy store that you used for the placeholder role in the Administration Tool. To create placeholder application roles in the Administration Tool: 1. Open your repository in the Administration Tool.

2. Select Manage, then select Identity.