In the General tab of the Connection Pool dialog, select Shared logon, and then Click OK in the Connection Pool dialog. In the Database dialog, select Virtual Private Database. Selecting this option Click OK in the Database dialog.

Applying Data Access Security to Repository Objects 13-7 Figure 13–2 Row-Level Security Enforcement in the Database In addition to setting up Oracle Business Intelligence for row-level security in the database, you must define your set of users, permissions, and security policies in the database itself. Refer to your database documentation for more information. To set up Oracle Business Intelligence for row-level access security in the database: 1. Open your repository in the Administration Tool. 2. Double-click the connection pool associated with the database for which you want to set up database-level security.

3. In the General tab of the Connection Pool dialog, select Shared logon, and then

enter :USER and :PASSWORD in the User name and Password fields. The :USER and :PASSWORD syntax automatically passes the value of user credentials upon login to the database. Note that the :USER and :PASSWORD syntax does not refer to session variables. Figure 13–3 shows the General tab of the Connection Pool dialog. Figure 13–3 Entering Credentials for Database-Level Security in the Connection Pool 13-8 Metadata Repository Builders Guide for Oracle Business Intelligence Enterprise Edition

4. Click OK in the Connection Pool dialog.

5. Double-click the database object for which you want to set up database-level security.

6. In the Database dialog, select Virtual Private Database. Selecting this option

ensures that the Oracle BI Server protects cache entries for each user.

7. Click OK in the Database dialog.

After you have set up row-level security in the database, you still need to set up object permissions in the repository for Presentation layer or other objects. You can also set query limits governors. See Setting Up Object Permissions and Setting Query Limits for more information. Setting Up Object Permissions You can set up object permissions in your repository to control access to Presentation layer and Business Model and Mapping layer objects. You set object permissions using the Administration Tool. There are two approaches to setting object permissions: you can set permissions for particular application roles in the Identity Manager, or you can set permissions for individual objects in the Presentation layer. This section explains how to set up object permissions for application roles in the Identity Manager. See Setting Permissions for Presentation Layer Objects for information about setting object permissions for individual Presentation layer objects. Setting up object permissions for particular application roles is useful when you want to define permissions for a large set of objects at one time. You should always set up object permissions for particular application roles rather than for individual users. Figure 13–4 shows how object permissions restrict what users can see. The security rules are applied to all incoming clients and cannot be breached, even when the Logical SQL query is modified. In this example, an application role to which the Administrator belongs has been granted access to the Booked Amount column, so the Administrator can view the returned results. The user Anne Green is not a member of an application role with access to this object and cannot see the column in the Subject Area pane in Answers. Even if the request SQL is modified, results are not returned for this column because of the application role-based object permissions that have been set. Note: Alternatively, you can use the database session context to pass end user identity to the database. Use a connection pool script to set up session context. Note that this approach does not rely on database authentication. Applying Data Access Security to Repository Objects 13-9 Figure 13–4 Object Permission Enforcement in the Oracle BI Server Note the following: ■ If an application role is granted or disallowed permissions on an object from multiple sources for example, explicitly and through one or more additional application roles, the permissions are applied based on the order of precedence. ■ If you explicitly deny access to an object that has child objects, users who are members of the individual application role are denied access to the child objects. For example, if you explicitly deny access to a particular logical table, you are implicitly denying access to all of the logical columns associated with that table. ■ Object permissions do not apply to repository and session variables, so values in these variables are not secure. Anybody who knows or can guess the name of the variable can use it in an expression in Answers or in a Logical SQL query. Because of this, do not put sensitive data like passwords in session or repository variables. ■ You can control what level of privilege is granted by default to users and application roles for repository objects without explicit permissions set. To do this, set the DEFAULT_PRIVILEGES parameter in the NQSConfig.INI file. See Oracle Fusion Middleware System Administrators Guide for Oracle Business Intelligence Enterprise Edition for more information. To set up object permissions for individual application roles: 1. Open your repository in the Administration Tool.

2. Select Manage, then select Identity.