Using Data Lineage and Flow Map

23 Managing the Security in Oracle Data Integrator 23-1 23 Managing the Security in Oracle Data Integrator This chapter describes how to set up security in Oracle Data Integrator. An overview of Oracle Data Integrator security concepts and components is provided. This chapter contains the following sections: ■ Section 23.1, Introduction to Oracle Data Integrator Security ■ Section 23.2, Setting up a Security Policy ■ Section 23.3, Advanced Security

23.1 Introduction to Oracle Data Integrator Security

Oracle Data Integrator security is used to secure any action performed by authenticated users against the design-time and run-time artifacts and components of Oracle Data Integrator. Security is built around users and profiles, to which security administrators grant methods edit, delete, and so forth on objects types projects, models, interfaces, and so forth or on specific object instances Data warehouse Project, ODS Project, and so forth. All the security information for Oracle Data Integrator is stored in the master repository. This section contains the following topics: ■ Section 23.1.1, Objects, Instances and Methods ■ Section 23.1.2, Profiles ■ Section 23.1.3, Users

23.1.1 Objects, Instances and Methods

An Object is a representation of a design-time or run-time artifact handled through Oracle Data Integrator. For example, agents, models, datastores, scenarios, interfaces and even repositories are objects. Specific objects have a double name AgentContext, ProfileMethod, and so forth. These objects represent links between objects. These links are also objects. For instance, AgentContext corresponds to a physicallogical agent association made through the contexts. Privileges on this object enable to change this association in the topology. An Instance is a particular occurrence of an object. For example, the Datawarehouse project is an instance of the Project object. 23-2 Oracle Fusion Middleware Developers Guide for Oracle Data Integrator A Method is an action that can be performed on an object. Each object has a predefined set of methods.

23.1.2 Profiles

A Profile contains a set of privileges for working with Oracle Data Integrator. One or more profiles can be assigned to a user to grant the sum of these privileges to this user. A Profile Method is an authorization granted to a profile on a method of an object type. Each granted method allows a user with this profile to perform an action edit, delete, and so forth on an instance of an object type project, model, datastore, and so forth. Methods granted to a profile appear under this profile in the Profiles accordion of the Security Navigator. When a method does not appear for a given profile, this profile does not have access to this method. A method can be granted as a generic or non-generic privilege: ■ A method granted as a generic privilege is granted by default on all the instances of this object. ■ A method granted as a non-generic privilege is not granted by default on all object instances, but may be granted per instance. Generic vs. Non-Generic profiles Generic profiles have the Generic privilege option selected for all object methods. This implies that a user with such a profile is by default authorized for all methods of all instances of an object to which the profile is authorized. Non-Generic profiles are not by default authorized for all methods on the instances since the Generic privilege option is not selected for all object methods. The administrator must grant the user the rights on the methods for each instance. If the security administrator wants a user to have the rights on no instance by default, but wishes to grant the rights by instance, the user must be given a non-generic profile. If the security administrator wants a user to have the rights on all instances of an object type by default, the user must be given a generic profile. Built-In Profiles Oracle Data Integrator has some built-in profiles that the security administrator can assign to the users he creates. Table 23–1 shows the built-in profiles delivered with Oracle Data Integrator. Note: The notions of object instance and method in Oracle Data Integrator are similar to the concepts used in Object-Oriented Programming. WARNING: Although they appear in the Security Navigator, objects and methods are predefined in Oracle Data Integrator and should not be altered. Managing the Security in Oracle Data Integrator 23-3

23.1.3 Users

A User is an Oracle Data Integrator user, and corresponds to the login name used to connect to a repository. A user inherits the following privileges: ■ All the privileges granted to its various profiles ■ Privileges on objects andor instances given to this user A User Method is a privilege granted to a user on a method of an object type. Each granted method allows the user to perform an action edit, delete, and so forth on instances of an object type project, model, datastore, and so forth. These methods are similar to the Profiles Methods, applied to users. It is possible to grant users with privileges on instances on specific work repositories where these instances exist. For example, you may grant a developer user with the edit privilege on the LOAD_DATAWAREHOUSE scenario on the a DEVELOPMENT repository and not on a PRODUCTION repository. Table 23–1 Built-In Profiles Profile Name Description CONNECT Profile granted with the basic privileges to connect Oracle Data Integrator. It should be granted with another profile. DESIGNER Profile granted with privileges to perform development operations. Use this profile for users who will work mainly on projects. NG_DESIGNER Non-generic version of the DESIGNER profile. METADATA_ADMIN Profile granted with privileges to manage metadata. Use this profile for users that will work mainly on models. NG_METADATA_ ADMIN Non-generic version of the METATADA_ADMIN profile. OPERATOR Profile granted with privileges to manage run-time objects. Use this profile for production users. REPOSITORY_ EXPLORER Profile granted with privileges to view objects. Use this profile for users who do not need to modify objects. NG_REPOSITORY_ EXPLORER Non-generic version of the REPOSITORY_EXPLORER profile. SECURITY_ADMIN Profile granted with privileges to edit security. Use this profile for security administrators. TOPOLOGY_ADMIN Profile granted with privileges to edit the Topology. Use this profile for system or Oracle Data Integrator administrators. VERSION_ADMIN Profile granted with privileges to create, restore and edit versions and solutions. Use this profile for project managers, or developers who are entitled to perform version management operations. NG_VERSION_ADMIN Non-generic version of the VERSION_ADMIN profile. Note: Built-in profiles should preferably not be changed, as they evolve to secure the new feature of Oracle Data Integrator. If you want to customize your own profiles or existing profiles, it is recommended to create duplicates of the built-in profiles and customize these copies.