Oracle BI Security: Major Upgrade Considerations
1-42 Upgrade Guide for Oracle Business Intelligence
See Oracle Fusion Middleware Security Guide for Oracle Business Intelligence Enterprise Edition for complete information on security.
■
Users, passwords, and groups are moved from the default 10g repository file to the default 11g identity store Oracle WebLogic Server embedded LDAP server.
Repository groups receive a matching Application Role in the Policy Store. Any other authentication mechanism remains as it was in 10g.
If you used a different LDAP server in 10g, then the upgraded 11g system continues to point to the LDAP server that was specified in 10g through
initialization blocks. Under certain circumstances, you can replace these initialization blocks with WebLogic Authenticators.
If you intend to use another LDAP server, such as Oracle Identity Management OID, then you must upgrade to the embedded LDAP server first, then migrate to
the production LDAP server. While it is technically possible to configure the 11g environment with an alternative security model before the upgrade, the
environment is upgraded to the embedded LDAP server.
Oracle recommends that Presentation Services groups also known as Web Groups be used for backward compatibility only and that application roles be
used instead for new installations.
■
Passwords for other repository objects, such as connection pools and LDAP servers, remain in the repository and are encrypted. The repository itself is
encrypted.
■
The Administrator user is migrated from the default 10g repository file to the default identity store and becomes a member of the BIAdministrators group. The
BIAdministrators group is granted the BIAdministrator role and by that association has system administrative rights.
■
References to old groups and users in the Oracle BI Presentation Catalog are updated.
■
The variable names ROLES, PERMISSIONS, USERGUID and ROLEGUIDS are reserved 11g system variable names. Before upgrading a 10g repository file, these
variables must be renamed if they exist. Other references to these variable names, as in reports, also must be renamed for consistency.
■
The Everyone Presentation Services group has been replaced with the AuthenticatedUser role, which is the same as the authenticated-role Application
Role. For information, see Managing Security for Dashboards and Analyses in Oracle Fusion Middleware Security Guide for Oracle Business Intelligence Enterprise
Edition.
■
Users who belonged to the Presentation Services group that is called Presentation Services Administrators in 10g must be re-assigned to this Presentation Services
group if you still want to use this group. It is recommended that you instead use either an appropriate existing Application Role or create a new Application Role
for these users.
■
If you use the default authentication, then any initialization blocks in the repository that contain the :USER system variable must be disabled or deleted. For
more information, see Detailed List of Steps for Setting Up Security in Oracle Business Intelligence in Oracle Fusion Middleware Security Guide for Oracle Business
Intelligence Enterprise Edition.