Oracle Cloud Administering Transactional Analyses Release

Transcription

1 Oracle Cloud Administering Transactional Analyses Release E November 2014 This guide describes administrative procedures and concepts for reports and analytics.

2 Oracle Cloud Administering Transactional Analyses Release E Copyright 2013, 2014, Oracle and/or its affiliates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate failsafe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

3 Contents Preface... Audience... Documentation Accessibility... Related Documents... Conventions... vii vii vii vii vii 1 Introduction Reports and Analytics in Oracle Fusion Applications Tools for Administering Reports and Analytics The Business Intelligence Presentation Catalog: Where You Maintain Your Reports and Analytics Navigating to the Catalog Identifying Objects in the Catalog Functional Setup Tasks for Transactional Business Intelligence Displaying Tasks in the Functional Setup Manager Completing Required Tasks in the Functional Setup Manager Assigning Security Profiles to Job Roles Managing User Currency Preferences Enabling the Currency User Preference File Editing Currency Display Names Configuring Flexfields for Business Intelligence Configuring Key Flexfields for Transactional Business Intelligence Enabling Key Flexfields for Business Intelligence Reporting Identifying Supported Key Flexfields Setting up the GL Accounting Segment Understanding Accounting Key Flexfields Identifying Accounting Key Flexfield Segments Defining Segment Labels Assigning Unique Segment Labels Performing Column Flattening Deploying Accounting Key Flexfields Designating GL Accounting Segment Instances as BI-Enabled Configuring Descriptive Flexfields for Transactional Business Intelligence iii

4 Designating Descriptive Flexfields as BI-Enabled Configuring Descriptive Flexfield Segments Designating Extensible Flexfields as BI-Enabled Importing Changes to Flexfields Automatically Overview of Importing Flexfield Changes Running the Import Job Disabling Flexfields as BI-Enabled Disabling Key Flexfields as BI-Enabled Disabling Descriptive Flexfields as BI-Enabled Disabling Extensible Flexfields as BI-Enabled Managing Report Availability Managing Catalog Folders Creating Folders Setting Folder Properties Mapping Reports to Work Areas Moving Reports and Analytics Securing Reports and Analytics Security Levels in Reports and Analytics About Object-Level Security About Roles in Reports and Analytics About Security Configuration Tools in Reports and Analytics Using Oracle Identity to Manage Users and Enterprise Roles Using Oracle Authorization Policy Manager to Configure Roles and Privileges Using the Oracle BI Administration Page to Configure Duty Role Privileges Securing Analytics Creating Users and Assigning Them to Job Roles Assigning Enterprise Roles (or Job Roles) to Duty Roles Creating Duty Roles Assigning Duty Role Privileges to Oracle BI Presentation Catalog Objects Securing BI Publisher Reports and Related Components Setting Catalog Permissions Granting Permissions to the Oracle Enterprise Scheduler Job Definition Managing Reports Managing Report Delivery Servers Navigating to the Oracle BI Publisher Administration Page Configuring Report Delivery Servers Understanding the Report and Delivery Processors Managing Report Processing and Delivery Server Load Scaling Out Report Processors Diagnosing Report Processing Issues Configuring System Properties for Reporting iv

5 A Mapping Between Oracle Fusion Offerings and Transactional Business Intelligence Subject Areas B Supported Descriptive Flexfields v

6 vi

7 Preface Administering Transactional Analyses explains how to administer Oracle Transactional Business Intelligence, a real time, self service analysis and reporting solution offered to Oracle Fusion application users to create ad hoc analyses and analyze them for daily decision-making. Audience Administering Transactional Analyses is intended for Administrators who are responsible for configuring and maintaining Oracle Transactional Business Intelligence. Documentation Accessibility Oracle is commitment to accessibility. For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at Access to Oracle Support Oracle customers have access to electronic support through My Oracle Support. For information, visit or visit if you are hearing impaired. Related Documents Additional resources are available for more information. See these Oracle resources: Oracle Public Cloud For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at Getting Started with Oracle Cloud Conventions The text conventions used in this document are described in this topic: vii

8 Convention boldface italic monospace Meaning Boldface type indicates graphical user interface elements associated with an action, or terms defined in text or the glossary. Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values. Monospace type indicates commands within a paragraph, URLs, code in examples, text that appears on the screen, or text that you enter. viii

9 1 1Introduction [1]Oracle Transactional Business Intelligence is a real time, self service analysis and reporting solution offered to Oracle Fusion application users to create ad hoc analyses and analyze them for daily decision-making. Topics: Reports and Analytics in Oracle Fusion Applications Tools for Administering Reports and Analytics The Business Intelligence Presentation Catalog: Where You Maintain Your Reports and Analytics Reports and Analytics in Oracle Fusion Applications Reports and analytics in Oracle Fusion Applications are built using Oracle Business Intelligence tools and technologies. When you installed and configured Oracle Fusion Applications you installed the Oracle Business Intelligence components to enable the reporting and analytical features of your applications. Oracle Fusion applications provide different report types to satisfy different reporting requirements. Oracle Business Intelligence provides several tools to meet the various reporting requirements in Oracle Fusion Applications. Analytics (analyses or analytical reports) are visualizations (such as charts and tables) of a specific set of data. An analysis can be embedded into an application page, or included as a component of a dashboard. Analyses are generally interactive and provide ad hoc analysis capabilities to enable the user to customize the presentation of the data in real time. Dashboards are a collection of analyses grouped together to return data. Some examples include: Absence and Accrual dashboard in Oracle Employee Expenses dashboard in Oracle Fusion Financials Project dashboard in Oracle Project Portfolio The analyses and dashboards embedded in your applications can report on real-time transactional data or on historical data. Reports based on real-time data use Oracle Transactional Business Intelligence. Reports based on historical data use Oracle Business Intelligence Applications. Oracle Transactional Business Intelligence reports are constructed queries and reports executed in real time against the transactional schema supported by a layer of view objects. These are configured and deployed during provisioning. Introduction 1-1

10 Tools for Administering Reports and Analytics Operational reports are static reports that meet operational and statutory reporting requirements. Operational reporting includes the generation of high-volume business documents such as payroll and invoices. Oracle Business Intelligence Publisher is the tool that provides this functionality within Oracle Fusion Applications. Many reports are delivered with your applications. Examples include: Total Compensation Statement Report ( ) Purchase Agreement Report (Procurement/Purchasing) Journals Check Report (Financials/General Ledger) Tools for Administering Reports and Analytics Oracle Business Intelligence includes several components, each providing specific functionality that enables you to modify and administer your Oracle Fusion Applications reports and analytics. The Oracle BI Presentation Catalog is where you interact directly with your Oracle Fusion Applications reports and analyses. Use this interface to manage permissions, properties, and organization of your reporting components Use the Oracle Business Intelligence Publisher administration pages to configure settings specific to the running and scheduling of BI Publisher reports, such as setting up your delivery servers, managing scheduler work load, and setting run-time properties for reports. The Business Intelligence Presentation Catalog: Where You Maintain Your Reports and Analytics Reports, analyses, and dashboards used in Oracle Fusion applications pages are stored in the Business Intelligence Presentation catalog. The Oracle BI Presentation Catalog stores the applications content in a directory structure of individual files. To administer reports in Oracle Fusion applications you must understand how to navigate and identify object in the catalog. Topics: Navigating to the Catalog Navigating to the Catalog Identifying Objects in the Catalog To navigate the BI catalog: 1. On the Navigator, under Tools, click Reports and Analytics. 2. In the Reports and Analytics pane, click Browse Catalog. 1-2 Administering Transactional Analyses

11 The Business Intelligence Presentation Catalog: Where You Maintain Your Reports and Analytics You are redirected to the Oracle BI Catalog within Oracle Business Intelligence. Identifying Objects in the Catalog Oracle Fusion Applications reporting objects are organized by product family in the catalog typically as follows: Top Level: Shared Folders Product Family Folder (example: Financials) Product folder (example: Payables) --Report group folders (example: Invoices) -- Dashboard Report Folders -- Data Models folder - Report Components folders - BI Publisher Reports Introduction 1-3

12 The Business Intelligence Presentation Catalog: Where You Maintain Your Reports and Analytics The following table describes the common reporting components that you find in the catalog: Catalog Object Description Located in the Report Components folder. Analyses are used primarily by dashboards. Dashboard folder Located in the reporting group folder Dashboard Prompt Located in the Prompts folder Used in dashboards Filter Located in Prompts folder Used in dashboards and analyses Report (Operational report created by Business Intelligence Publisher) Located in the reporting group folder Data Model Located in the Data Models folder Used by reports created with Business Intelligence Publisher Subtemplate Located in the reporting group folder Used by reports created with Business Intelligence Publisher 1-4 Administering Transactional Analyses

13 2 2Functional Setup Tasks for Transactional Business Intelligence [2]Some configuration tasks may be required after you install Oracle Fusion Applications. Topics: Displaying Tasks in the Functional Setup Manager Completing Required Tasks in the Functional Setup Manager Assigning Security Profiles to Job Roles Managing User Currency Preferences Displaying Tasks in the Functional Setup Manager After you install Oracle Fusion Applications, go to the Setup and Maintenance page to view tasks for Oracle Transactional Business Intelligence. To view the tasks in the Setup and Maintenance page: 1. Click the Navigator and from the Tools menu, select Setup and Maintenance. 2. In the Setup and Maintenance page, search for "Transactional Business Intelligence". Completing Required Tasks in the Functional Setup Manager The following tasks are automated during provisioning. No further action is required to configure your system: Optimization is automated during the provisioning process. No further action is required to configure the system. Manage Transactional Business Intelligence Connections Functional Setup Tasks for Transactional Business Intelligence 2-1

14 Assigning Security Profiles to Job Roles Connections are set up as part of the provisioning process. No Further action is required to configure the system. Manage Security for Transactional Business Intelligence To change the default security configuration, see Securing BI Publisher Reports and Related Components Configure Key Flexfields for Transactional Business Intelligence See Configuring Key Flexfields for Transactional Business Intelligence Configure Descriptive Flexfields for Transactional Business Intelligence See Configuring Descriptive Flexfields for Transactional Business Intelligence Manage User Currency Preferences in Transactional Business Intelligence See Managing User Currency Preferences Assigning Security Profiles to Job Roles Default security is configured automatically. To make changes to the default security configuration, see Securing Reports and Analytics. Users of Transactional Business Intelligence must access some person data to successfully run certain reports. To provide this access, assign a predefined security profile to the relevant job or abstract roles. Use the Oracle setup task Manage Data Role and Security Profiles in the Setup and Maintenance work area. For more information, see Oracle Cloud Securing Oracle HCM Cloud. The following example shows how to assign a security profile to a job or abstract role to enable users with that role to access person data. This task is required for users of Transactional Business Intelligence who do not also use Oracle (HCM). Prerequisite: You must have the IT Security Manager role. 1. Select Navigator. 2. Under Tools, select Setup and Maintenance. 3. On the Overview page, search for the task Manage Data Role and Security Profiles. 4. Search for the job or abstract role. 5. Assign the relevant security profile to the job or abstract role. 6. On the Manage HCM Data Roles page, enter the job name (for example, Warehouse Manager) in the Role field and click Search. 7. In the search results, select the job role (for example, Warehouse Manager) and click Edit. 8. On the Edit Data Role: Role Details page, click Next. 9. In the Person Security Profile field on the Edit Data Role: Security Criteria page, select the security profile View All Workers. 10. Click Review. 11. On the Edit Data Role: Review page, click Submit. 2-2 Administering Transactional Analyses

15 Assigning Security Profiles to Job Roles Upon completion of this task, Oracle Fusion Data Security is updated automatically for roles being used to access Transactional Business Intelligence. The following table identifies, by Oracle Fusion product, the roles that access person data and the predefined security profile that you assign to each role. Product Job or Abstract Role Security Profile Assets Asset Accountant View All Workers Assets Accounting Manager View All Workers Enterprise Planning and Budgeting Enterprise Planning and Budgeting Budget Analyst Budget Manager View All Workers View All Workers Financial Consolidation Hub Consolidation Accountant View All Workers Financial Consolidation Hub Consolidation Manager View All Workers Financials Common Module Intercompany Accountant View All Workers General Ledger Financial Analyst View All Workers General Ledger General Accountant View All Workers General Ledger General Accounting Manager View All Workers Incentive Compensation Incentive Compensation Participant Manager View Manager Hierarchy Inventory Warehouse Manager View All Workers Project Foundation Project Accountant View All Workers Project Foundation Project Administrator View All Workers Project Foundation Project Billing Specialist View All Workers Purchasing Buyer View All Workers Sourcing Category Manager View All Workers Sourcing Sourcing Project Collaborator View All Workers For example, as part of their Transactional Business Intelligence setup: Oracle Assets implementers must assign the predefined security profile View All Workers to the Asset Accountant and Asset Accounting Manager job roles. Oracle Incentive Compensation implementers must assign the predefined security profile View Manager Hierarchy to the Incentive Compensation Participant Manager abstract role. Note: The security profiles that Oracle roles use to access Transactional Business Intelligence are assigned during the setup of Oracle data security. No additional setup is required for Transactional Business Intelligence purposes. Functional Setup Tasks for Transactional Business Intelligence 2-3

16 Managing User Currency Preferences Managing User Currency Preferences Topics: Enabling the Currency User Preference File Editing Currency Display Names Enabling the Currency User Preference File The Currency User Preference file is userpref_ currencies_otbi.xml. The file instanceconfig.xm used by Oracle BI Presentation Services must point to this file. To do this, modify the UserprefCurrenciesConfigFile parameter in instanceconfig.xml to point to userpref_currencies_otbi.xml. Both the instanceconfig.xml and userpref_currencies_otbi.xml files are located in the following directory: INSTANCE_ HOME\config\OracleBIPresentationServicesComponent\coreapplication_obips1 Note: Oracle uses the currency preference selected in the user's profile. It does not use the Currency User Preference File. For more information, see Oracle Global Human Resources Cloud Implementing Global Human Resources. To enable the Currency User Preference file: 1. Access the following directory on the Oracle BI instance: INSTANCE_ HOME\config\OracleBIPresentationServicesComponent\coreapplication_ obips1 2. Open the file instanceconfig.xml for editing. 3. Modify the UserprefCurrenciesConfigFile parameter in instanceconfig.xml to point to userpref_currencies_otbi.xml. 4. Click Save and close instanceconfig.xml. 5. Using OPMN, restart Presentation Services. Editing Currency Display Names Oracle Business Intelligence is installed with a set of preferred currencies with configured Preferred Currency Codes and Preferred Currency Names. You can use the predefined Currency Display Names, or you can specify new Currency Display Names as described in this section. You edit Preferred Currency Name values to change the currency labels that are displayed in all modules associated with BI dashboards. For example, you might want to change the "Local Currency" label from "Ledger Currency" to "Local Currency". To edit a Currency Display Name: 1. Open a file editing application which enables you to edit.xml files. 2. Open the userpref_ currencies_otbi.xml file. 3. Follow the instructions listed in userpref_currencies_otbi.xmlto edit the currency to be displayed to the users in the drop-down list. 4. Save userpref_ currencies_otbi.xml. 2-4 Administering Transactional Analyses

17 Managing User Currency Preferences Note: Keep userpref_ currencies_otbi.xml open because it contains instructions you need to edit the currency display name. 5. Open the usercurrencymessages.xml file. 6. Follow the instructions in userpref_currencies_otbi.xml to create the corresponding file to display the currency name in the proper location for localization purposes. 7. Save usercurrencymessages.xml. Functional Setup Tasks for Transactional Business Intelligence 2-5

18 Managing User Currency Preferences 2-6 Administering Transactional Analyses

19 3 3Configuring Flexfields for Business Intelligence [3]To include flexfields in Transactional Business Intelligence reporting, you must enable them and import them into Oracle Business Intelligence. Topics: Configuring Key Flexfields for Transactional Business Intelligence Setting up the GL Accounting Segment Designating GL Accounting Segment Instances as BI-Enabled Configuring Descriptive Flexfields for Transactional Business Intelligence Designating Extensible Flexfields as BI-Enabled Importing Changes to Flexfields Automatically Disabling Flexfields as BI-Enabled Configuring Key Flexfields for Transactional Business Intelligence To include flexfields in your Transactional Business Intelligence reporting, you must enable them for Business Intelligence. Topics: Enabling Key Flexfields for Business Intelligence Reporting Identifying Supported Key Flexfields Enabling Key Flexfields for Business Intelligence Reporting To designate the key flexfields as BI-enabled: 1. Navigate to Manage Key Flexfields in Oracle Fusion Applications. 2. Enter your search value in Key Flexfield Code. 3. Click the Manage Structure Instances button. 4. Enter your search value in Structure Instance Code. 5. Click Edit to display the Edit Key Flexfield Structure Instance dialog box. Configuring Flexfields for Business Intelligence 3-1

20 Configuring Key Flexfields for Transactional Business Intelligence 6. Select the BI Enabled check box. 7. Click OK. 8. For each flexfield segment instance, repeat steps 5 through Click Save. 10. Populate the BI Object Name for each of the segment labels: a. Query the Key Flexfield Code in the Manage Key Flexfields window. b. From the Actions menu, select Manage Segment Labels. c. Populate the BI Object Name for each segment label to be mapped. The BI Object Name for the following qualified segment labels should not be modified: Segment Label Code FA_COST_CTR GL_BALANCING GL_ACCOUNT BI Object Name Dim - Cost Center Dim - Balancing Segment Dim - Natural Account Segment 3-2 Administering Transactional Analyses

21 Setting up the GL Accounting Segment For all non-qualified segment labels, the BI Object name should be populated with one of the following values: Dim - GL Segment1 through Dim - GL Segment10. Note: Before you deploy a flexfield, you must access the Chart of Accounts Instance and assign the newly created segment label to the appropriate segment in the Chart of Accounts. For more information, see Assigning Unique Segment Labels. d. Click Deploy Flexfield. e. Click Save and Close. Identifying Supported Key Flexfields Key flexfields are used to store internally defined codes unique to a particular business. These codes specify part numbers, general ledger accounts, and other business entities. See Supported Descriptive Flexfields for more information about the supported key flexfields for the corresponding key flexfield dimensions. Product Area Key Flexfield Dimension Fixed Assets Category Dim - Asset Category Fixed Assets Location Dim - Asset Location General Ledger Accounting Dim - Balancing Segment Dim - Cost Center Dim - Natural Account Payroll Costing Dim - Costing Segments Locator Dim - Inventory Org Item Category Dim - Item Setting up the GL Accounting Segment Topics: Understanding Accounting Key Flexfields Identifying Accounting Key Flexfield Segments Defining Segment Labels Assigning Unique Segment Labels Configuring Flexfields for Business Intelligence 3-3

22 Setting up the GL Accounting Segment Performing Column Flattening Deploying Accounting Key Flexfields Understanding Accounting Key Flexfields The Accounting Key Flexfield is used to identify GL accounts. A chart of accounts segment is a component of the Accounting Key Flexfield. Each segment has a value set attached to it to provide formatting and validation of the set of values used with that segment. The combination of segments creates the account combination used for recording and analyzing financial transactions. Note: You must set up your Chart of Accounts (COA) as part of implementing Oracle Fusion Applications or Oracle Fusion Accounting Hub. Examples of segments that may be found in a chart of accounts structure include Company, Cost Center, Department, Division, Region, Account, Product, Program, and Location. The Natural Account segment of the General Ledger Accounting Key Flexfield defines the account used in the account combination to record transactions. The logical segment dimensions in the Oracle BI metadata are Dim Cost Center, Dim Balancing Segment, Dim Natural Account Segment and all Dim GL Segmentn dimensions. These dimension tables are populated from a Tree value object or from a Value Set value object depending on whether a tree was associated with the segment in the Fusion Applications setup: For each segment associated with trees, two value objects are generated (Tree and TreeCode) with the following naming structure: FscmTopModelAM.AccountBIAM.FLEX_TREE_VS_segmentlabel_VI & FscmTopModelAM.AccountBIAM.FLEX_TREECODE_VS_segmentlabel_VI For each segment without trees, one view object are generated with the following naming structure: FscmTopModelAM.AccountBIAM.FLEX_VS_ XXX_VI In addition to the segment dimension tables, the BI Extension process also extends Flex BI Flattened VO; FscmTopModelAM.AccountBIAM.FLEX_BI_Account_VI. This view object has a pair of columns for each segment; segmentlabel _ and segmentlabel _c. For example, for your Cost Center segment which has the segment label FA_COST_CTR, there are two columns in this view object, named FA_COST_CTR_ and FA_COST_ CTR_c. Identifying Accounting Key Flexfield Segments For each Chart of Accounts (Accounting Key Flexfield) used to analyze Transactional Business Intelligence facts, identify the segments of the chart of accounts and map them to the Transactional Business Intelligence GL Accounting Segment logical dimensions. Accounting Key Flexfield Segment Segment Label Transactional Business Intelligence GL Accounting Segment Logical Dimension Balancing GL_BALANCING Dim Balancing Segment 3-4 Administering Transactional Analyses

23 Setting up the GL Accounting Segment Accounting Key Flexfield Segment Natural Account GL_ACCOUNT Dim Natural Account Segment Cost Center FA_COST_CTR Dim Cost Center Other segments to be equalized across the charts of accounts Segment Label Other unique segment label Transactional Business Intelligence GL Accounting Segment Logical Dimension Dim GL Segment n where n is an integer from 1 to 10 Defining Segment Labels You must assign a unique segment label to the charts of accounts segments that are the balancing segments or the natural account segments. Other segment labels are optional and can be assigned as needed. Assigning Unique Segment Labels You must assign a segment label to the chart of accounts segments that are used for specific purposes; for example, assign the Primary Balancing segment label to the segment used for your company or legal entities in order to provide a correct recording of intercompany transactions and company analysis. To assign unique segment labels to charts of accounts segments: 1. Launch the Manage Charts of Accounts task and then navigate to the Manage Chart of Accounts window. 2. In the Search section, enter the GL# for the Key Flexfield Code and then click the Search button. 3. In the Search Results section, select Accounting Flexfield and then click the Manage Structures button to navigate to Manage Key Flexfield Structures. 4. In the Search section, enter the chart of accounts code or the name for Structure Code or Name, and then click the Search button. 5. In the Search Results section, select the chart of accounts and then click Edit to navigate to the Edit Key Flexfield Structure window. 6. Select the Enabled check box to code-enable the Structure code. 7. In the Segments section, select the applicable segments and then click Edit to navigate to the Edit Key Flexfield Segment window. 8. Select the Enabled check box to enable the segments. 9. In the Segment Labels section, select the unique segment labels to equalize the segments across the charts of accounts, and then click the right arrow to move the segments to the selected list. 10. Click Save and Close to return to the Edit Key Flexfield Structure window. 11. Click Done to return to the Manage Key Flexfields window. Performing Column Flattening Perform column flattening for the account hierarchies needed for analysis in Transactional Business Intelligence. To flatten columns for account hierarchies: Configuring Flexfields for Business Intelligence 3-5

24 Designating GL Accounting Segment Instances as BI-Enabled 1. Launch Manage Trees and Tree Versions and navigate to the Manage Trees and Tree Versions window. 2. In the Search section, enter GL_ACCT_FLEX for the Tree Structure Code and the involved tree code or name, and click Search. 3. In the Search Results section, select the tree version you want to flatten and choose Column Flattening from the Actions drop-down menu. 4. Click the Online Flattening button to launch the flattening job immediately or click the Schedule Flattening button to schedule the flattening job according to your requirements. Deploying Accounting Key Flexfields After you have set up accounting key flexfields, you must deploy them. To deploy accounting key flexfields: 1. Access Manage Chart of Accounts from Setup and Maintenance. 2. Click Search. 3. Use the horizontal scroll bar (if necessary) to find the column Deployment Status. 4. Click the icon under the heading. 5. Select Edited. 6. Click Deploy Flexfield. 7. Monitor the Deployment Status. 8. When 100% is reached in the deployment status, click OK. 9. Verify that a green check mark displays under the Deployment Status column. 10. Click Done. Deployment Status Accounting key flexfields have one of the following statuses: Edited The flexfield definition has not been deployed or changes have been made to the structure, the structure instances, or the value sets. Patched The flexfield definition has been modified through a patch, but the flexfield has not yet been deployed so the patched definition is not reflected. Deployed to Sandbox The flexfield is deployed and available in a flexfield-enabled sandbox. Deployed The flexfield definition is deployed and available to end users. Error The deployment attempt failed. Designating GL Accounting Segment Instances as BI-Enabled Specify the applicable chart of accounts segment instances that are BI-enabled to make them available for use in Transactional Business Intelligence. To specify the chart of accounts segment instances as BI-enabled: 1. In the Search Results section of the Manage Key Flexfields window, select Accounting Flexfield, and then click the Manage Structure Instances button to navigate to the Manage Key Flexfield Structure Instances window. 3-6 Administering Transactional Analyses

25 Configuring Descriptive Flexfields for Transactional Business Intelligence 2. In the Search section, select the chart of accounts for Structure Name and click the Search button. 3. In the Search Results section, select the structure instance and click Edit to navigate to the Edit Key Flexfield Structure Instance window. 4. Check the Enabled check box to code-enable the structure instance. 5. In the Segment Instances section, select the segment instances and click Edit to update. Note: Each segment instances must be selected individually. 6. Check the Business Intelligence enabled check box in the Edit Key Flexfield Segment pop-up window and click OK to return to Edit Key Flexfield Structure Instance window. 7. After you have enabled all applicable segment instances for Business Intelligence, click Save and Close to save the changes and return to the Edit Key Flexfield Structure Instance window. 8. Repeat steps 2-6foreach chart of accounts to enable all the applicable segment instances for Business Intelligence. 9. Click Done to return to the Manage Key Flexfields window. 10. After you have configured all the charts of accounts, click the Deploy Flexfield button to deploy Accounting Flexfield and make the latest definition available for use. Configuring Descriptive Flexfields for Transactional Business Intelligence Descriptive flexfields are used to track unique information not typically found on business forms. The descriptive flexfields capture details that are vital, yet would clutter a form if present. For example, an asset form could become unwieldy if it contained many specific details about the asset, yet the user still needs access to the details. Descriptive flexfields provide a place to store these details. Descriptive flexfields provide a way for you to add custom attributes to entities and to define validation and display properties for them. A descriptive flexfield is a logical grouping of attributes (segments) that are mapped to a set of extension columns which are shipped as part of Oracle Fusion Applications tables. For a list of supported descriptive flexfields, see Supported Descriptive Flexfields. Topics: Designating Descriptive Flexfields as BI-Enabled Configuring Descriptive Flexfield Segments Designating Descriptive Flexfields as BI-Enabled To designate descriptive flexfields as BI-enabled: 1. Access Oracle Fusion Applications. 2. Navigate to Setup and Maintenance. 3. Navigate to the Edit Descriptive Flexfields window. Configuring Flexfields for Business Intelligence 3-7

26 Configuring Descriptive Flexfields for Transactional Business Intelligence 4. Enter the Descriptive Flexfield Name. 5. Optional: Enter a Description. 6. Check the BI Enabled check box on the desired descriptive flexfields. 7. Click OK. 8. Click Save. Configuring Descriptive Flexfield Segments If a descriptive flexfield is enabled for Oracle Business Intelligence, you can enable global and context segments for Oracle Business Intelligence, and you can select segment labels. To configure descriptive flexfield segments: 1. Navigate to the Setup and Maintenance window. 2. Navigate to the Manage Descriptive Flexfields window. 3. If the BI Enabled check box is cleared, select it. 4. Select the options for deployment of the descriptive flexfields. 3-8 Administering Transactional Analyses

27 Designating Extensible Flexfields as BI-Enabled Designating Extensible Flexfields as BI-Enabled Extensible flexfields are BI enabled if at least one segment in a context is BI enabled. To designate extensible flexfields as BI-enabled: 1. Access Oracle Fusion Applications. 2. Navigate to Setup and Maintenance. 3. Navigate to Manage Extensible Flexfields. 4. Enter the extensible flexfield Name; for example, "Organization Information EFF." 5. Select the applicable extensible flexfield, and then click Edit to navigate to Edit Extensible Flexfield. Configuring Flexfields for Business Intelligence 3-9

28 Designating Extensible Flexfields as BI-Enabled 6. Select the applicable Category. The category contexts are populated automatically. 7. Click Manage Contexts to navigate to Manage Contexts. 8. Select the applicable Context, and then click Edit to navigate to Edit Context. 9. Select the applicable Segment, and then click Edit to navigate to Edit Segment. 10. Check the BI Enabled check box displayed at the bottom of the screen. 11. Click Save Administering Transactional Analyses

29 Importing Changes to Flexfields Automatically Importing Changes to Flexfields Automatically You can automate the process for importing flexfield changes. Topics: Overview of Importing Flexfield Changes Running the Import Job Overview of Importing Flexfield Changes Use the "Import Oracle Fusion Data Extensions for Transactional Business Intelligence" job to automatically import the following types of changes: Key Flexfield changes Descriptive Flexfield changes Extensible Flexfield changes The "Import Oracle Fusion Data Extensions for Transactional Business Intelligence" job imports extensible data, including data in descriptive flexfield segments, key flexfield segments, and General Ledger balances in Essbase cubes, into Transactional Business Intelligence. If you have changes to key flexfields and descriptive flexfields, you can import all the changes in the same job. Caution: We strongly recommend that you backup the Oracle Business Intelligence Enterprise Edition prior to importing any flexfield changes. Caution: Running the "Import Oracle Fusion Data Extensions for Transactional Business Intelligence" job disconnects all users from the server. You should not run this job when maintenance operations or system updates are being performed on the server. Note: The "Import Oracle Fusion Data Extensions for Transactional Business Intelligence" job is an Oracle Fusion Applications job; it is not a BI Applications job. Detailed information on this job can be found in Oracle Cloud Applications documentation. Running the Import Job To run the "Import Oracle Fusion Data Extensions for Transactional Business Intelligence" job in Fusion Applications: 1. In Fusion Applications, access the Scheduled Processes window: Configuring Flexfields for Business Intelligence 3-11

30 Importing Changes to Flexfields Automatically 2. Select Search and Select: Name. 3. Highlight Import Oracle Fusion Data Extensions for Transactional Business Intelligence. 4. Click OK. 5. Schedule the job. Job Status Conditions When the job is finished, the biextendercmdutility.jar writes the status of the job into the JNDI fileess_biextenderessjob_jobstatus which can be viewed in Oracle WebLogic Server: The job status displays one of the following conditions: INIT The job has just begun and is waiting for the extender command line JAR to update the status with more details. COMPLETED_NO_EXTENSION_NEEDED No new Flex changes were detected in any of the fusion sources; because the Oracle Business Intelligence is already synchronized with all FLEX changes, no changes were made in the Oracle Business Intelligence. COMPLETED Oracle Business Intelligence was successfully updated with Flex changes and uploaded into the Oracle Business Intelligence server. FAILED Error conditions exist which require manual intervention Administering Transactional Analyses

31 Disabling Flexfields as BI-Enabled Successful Import Job If the Import Job is successful, you can perform the following actions: Query subject areas by segment dimensions such as Balancing Segment and Cost Center Access DFF attributes for analyses Use the "General Ledger - Balances " subject area to query Essbase cubes Disabling Flexfields as BI-Enabled There may be times (such as during development phases) when you try using a flexfield and later determine it is no longer needed. If you created a flexfield that you no longer want to use or report against, you can disable the flexfield as BI-enabled. Note: If you are considering disabling flexfields, keep in mind that any flexfields created in Oracle Fusion Applications must be designated as BI-enabled to be exposed in Transactional Business Intelligence. If you disable a flexfield, it cannot be deployed. Also, error conditions may occur if you disable a descriptive flexfield which has been implemented in BI Applications. Caution: If error conditions arise from disabling flexfields as BI-enabled, troubleshooting the errors can be difficult and time-consuming. Topics: Disabling Key Flexfields as BI-Enabled Disabling Descriptive Flexfields as BI-Enabled Disabling Extensible Flexfields as BI-Enabled Disabling Key Flexfields as BI-Enabled If you are considering disabling key flexfields, keep in mind that any flexfields created in Oracle Fusion Applications must be designated as BI-enabled to be exposed in Transactional Business Intelligence. To disable key flexfields as BI-enabled: 1. Navigate to Manage Key Flexfields in Oracle Fusion Applications. 2. Enter your search value in Key Flexfield Code. 3. Click the Manage Structure Instances button. 4. Enter your search value in Structure Instance Code. 5. Click Edit. The Edit Key Flexfield Structure Instance dialog box displays. Configuring Flexfields for Business Intelligence 3-13

32 Disabling Flexfields as BI-Enabled 6. In Edit Key Flexfield Segment Instance, deselect the BI Enabled check box. 7. Click OK. 8. Click Save. Disabling Descriptive Flexfields as BI-Enabled If you are considering disabling descriptive flexfields, keep in mind that any flexfields created in Oracle Fusion Applications must be designated as BI-enabled to be exposed in Transactional Business Intelligence. To disable descriptive flexfields as BI-enabled: 1. Access Oracle Fusion Applications. 2. Navigate to Setup and Maintenance. 3. Navigate to the Edit Descriptive Flexfields window. 4. Enter the Descriptive Flexfield Name. 5. Deselect the BI Enabled check box on the desired descriptive flexfields. 6. Click OK. 7. Click Save. Disabling Extensible Flexfields as BI-Enabled If you are considering disabling extensible flexfields, keep in mind that any flexfields created in Oracle Fusion Applications must be designated as BI-enabled to be exposed in Transactional Business Intelligence. To disable extensible flexfields as BI-enabled: 1. Access Oracle Fusion Applications. 2. Navigate to Setup and Maintenance Administering Transactional Analyses

33 Disabling Flexfields as BI-Enabled 3. Navigate to Manage Extensible Flexfields. 4. Enter the extensible flexfield Name; for example, "Organization Information EFF." 5. Select the applicable extensible flexfield, and then and Edit to navigate to Edit Extensible Flexfield. 6. Select the applicable Category. The category contexts are populated automatically. 7. Click Manage Contexts to navigate to Manage Contexts. 8. Select the applicable Context and click Edit to navigate to Edit Context. 9. Select the applicable Segment and click Edit to navigate to Edit Segment. Configuring Flexfields for Business Intelligence 3-15

34 Disabling Flexfields as BI-Enabled 10. Clear the BI Enabled check box displayed at the bottom of the screen. 11. Click Save Administering Transactional Analyses

35 4 4Managing Report Availability [4]A key administration task is managing the organization and availability of your reports. Reports reside in the Business Intelligence catalog, but are typically accessed through the reporting pane. Topics: Managing Catalog Folders Mapping Reports to Work Areas Moving Reports and Analytics Managing Catalog Folders Creating Folders The catalog is organized into folders that are either shared or personal. Topics: Creating Folders Setting Folder Properties To create a folder: 1. In the catalog, navigate to the desired location of the new folder in the Folders pane. 2. In the catalog toolbar, click New, and select Folder. 3. In the New Folder dialog, enter the folder name, and click OK. Note: "If you upgrade or patch Oracle Business Intelligence, and conflicts are detected during those processes, the system creates backup_nnn folders in the BI Catalog. After reviewing and resolving any conflicts found in the backup_nnn folders, Oracle recommends that you manually delete the folders from the catalog. You can contact Oracle support to request an automated removal if you have a large number of folders to delete. Managing Report Availability 4-1

36 Managing Catalog Folders Setting Folder Properties You can access the properties of any object or folder to perform tasks such as viewing system information or changing ownership. All other users can only access and modify the properties of the objects that they create or own. To set folder properties: 1. In the catalog, select the folder to which you want to assign properties. 2. In the Tasks pane click Properties. 3. In the Properties dialog, select the following field values: Attributes Hidden Specifies that the object is hidden. System Specifies that the object is a system object. Read Only Specifies that the object is read-only. Do not Index Excludes the object from the index used by the full-text catalog search. Excluded objects do not display in the results of any full-text catalog search; the object can still be found using the basic catalog search. Ownership Use this area in the Properties dialog to take ownership of a folder or object in the catalog. This area displays only if the proper privileges were assigned to the user, group, or role. Note that the owner of an object or folder cannot automatically access the object or folder. Set Ownership of this item Click to become the owner of the folder. Set Ownership of this item and all subitems Click to become the owner of the folder and any sub folders or sub items contained within the item. For example, if you click this link for a dashboard folder, then you take ownership of all of the dashboard's components. 4-2 Administering Transactional Analyses

37 Mapping Reports to Work Areas Mapping Reports to Work Areas To display reports in the Reports and Analytics Pane for a specific user or role, you map the reports to the work area to which the user or role is a member. Any mapping changes you make apply to all users with access to the mapped work areas. For a user to view or run the report, he must first have permissions set on the report in the Oracle BI Presentation Catalog. You can also restrict access to specific reports for specific users by setting permissions on the reporting objects in the catalog. For more information, see Securing BI Publisher Reports and Related Components. Oracle Business Intelligence Publisher reports must be registered as processes to be submitted from the Reports and Analytics pane. To map reporting objects to work areas: 1. Click Navigator and then select Setup and Maintenance. 2. In the Setup and Maintenance page, search for "Map Reports to Work Areas". 3. In the Search Results table, click Go to Task. 4. Select an Application and a Work Area and click Search. 5. Click Select and Add. Managing Report Availability 4-3

38 Moving Reports and Analytics 6. Click All to navigate down the folder structure to find the reporting object you wish to map to the work area. 7. Select the report and click Apply. 8. Click OK. 9. In the Map Reports to Work Areas task, click Save. Moving Reports and Analytics Archiving enables you to bundle the entire catalog, specific folders, or multi-component objects as a.catalog file and upload the.catalog file to unarchive the data to another location in the catalog. This process enables you to transfer specific data across environments. For example, you can use this feature to transfer data from a development environment to a production environment. To create an archive file: 1. Locate the object in the catalog. 2. Select More and then select Archive. 4-4 Administering Transactional Analyses

39 Moving Reports and Analytics 3. In the Archive dialog, select one or more of the following options:. Keep Permissions Use this option to maintain the object or folder's existing permissions. If you do not select this option, then the archiving process does not include any permissions. Upon unarchiving, the system assigns the parent folder's permissions to all of the objects and folders. Keep stamps Use this option to maintain the Creation, LastModified, and LastAccessed timestamps assigned to the object or folder. Upon unarchiving, the LastModified timestamp is updated to indicate the time at which the object or folder is unarchived. If you select this option, the Old option in the Paste Overview area of the Preferences dialog is available when unarchiving. You use the Old option to overwrite existing catalog items that are older than the catalog items in the archive. If you do not select this option, then the archiving process does not include timestamp information and the Old option in the Paste Overview area of the Preferences dialog is not available. 4. Click OK to download the archive file. To unarchive a file in a new location: 1. Select the folder in the catalog where you want to upload the archive file. 2. In the Tasks pane click Unarchive. Managing Report Availability 4-5

40 Moving Reports and Analytics 3. In the Unarchive dialog, select the following field values: Archive File Browse for and select the archive file. Replace Use to specify whether to replace existing folder or object with the same name. All Select this option to replace any existing folders or objects with the same names as folders or objects included in the archive file that you are uploading. Old Select this option to replace folders or objects except those folders or objects that exist, unless they are older than the source. None Select this option to add any new folders or objects, but preserve any existing folders or objects. Force Select this option to add and replace all folders or objects. ACL Use to specify how the folders or objects are assigned permissions using Access Control Lists (ACLs) when unarchived. Inherit Inherits the folder or object's permissions (ACL) from its new parent folder. Preserve Preserves the folder or object's permissions (ACL) as it was in the original, mapping accounts as necessary. Create Preserves the folder or object's permissions (ACL) as it was in the original, creating and mapping accounts as necessary. 4. Click OK. 4-6 Administering Transactional Analyses

41 5 5Securing Reports and Analytics [5]There are many tasks that you must perform to secure reports and analytics within Oracle Fusion Applications. Topics: Security Levels in Reports and Analytics About Roles in Reports and Analytics About Security Configuration Tools in Reports and Analytics Securing Analytics Securing BI Publisher Reports and Related Components Security Levels in Reports and Analytics About Object-Level Security Security in reports and analytics are classified broadly into the following three levels: User-level security (authentication of users) User-level security concerns the authentication and confirmation of the identity of a user based on the credentials provided, such as user name and password. Object-level security Object-level security controls the visibility to business logical objects based on a user's role. You can set up object-level security for Web objects, such as dashboards and dashboard pages, which are defined in the Presentation Catalog. For more information, see About Object-Level Security. Data-level security Data-level security controls the visibility of data (content rendered in subject areas, dashboards, Oracle BI Answers, and so on) based on the user's association to data in the transactional system. Object-level security is the specification of Duty Role permissions on Oracle BI Presentation Services objects, such as dashboard pages. You secure these objects using Duty Roles and their associated policies and privileges. Duty Roles are stored in the Fusion Policy Store, which is accessed by the Oracle BI Presentation Catalog. For information about default mappings for Duty Roles, Job Roles, and Data Roles, to secure objects in the Oracle BI Presentation Catalog, see Document Oracle Business Intelligence Applications Duty Role Assignments for Fusion Applications on My Oracle Support: Securing Reports and Analytics 5-1

42 About Roles in Reports and Analytics About Roles in Reports and Analytics Roles fall into two classes, application-wide roles (Duty Roles), and enterprise-wide roles (Job Roles, Data Roles, and Abstract Roles). Application-wide roles are defined in terms of the tasks that are needed to perform a job, and are held in the policy store with associated reporting privileges. Enterprise-wide roles are defined in terms of an occupation within an enterprise, and are held in the identity store with associated users. Four common role types are used in reports and analytics: Job Roles (enterprise-wide roles, also referred to as Fusion Applications Enterprise Roles) A Job Role represents the job definition of a person in your organization, for example, AP manager, HR specialist. Users are assigned to Job Roles. A Job Role inherits one or more Duty Roles, and therefore, users inherit Duty Roles through Job Roles. For example, the Job Role AP_ACCOUNTS_PAYABLE_MANAGER_ JOB might be associated with the Duty Role RUN_ACCOUNTS_PAYABLE_ REPORT_DUTY. For more information about Oracle Sales Cloud Job Roles, see Oracle Sales Cloud Securing Oracle Sales Cloud. For more information about Oracle Cloud Job Roles, see Oracle Securing Oracle HCM Cloud. Duty Roles (application-wide roles, also referred to as Application Roles) A Duty Role represents a specific task needed to do a job, and comprises the privileges required to perform that job. For example, the Duty Role RUN_ ACCOUNTS_PAYABLE_REPORT_DUTY enables a user to run the Accounts Payable report. The privileges assigned to a Duty Role are defined in application policies within the policy store. For more information, see Using Oracle Authorization Policy Manager to Configure Roles and Privileges. For more information about Oracle Sales Cloud Duty Roles, see Oracle Sales Cloud Securing Oracle Sales Cloud. For more information about Oracle Cloud Duty Roles, see Oracle Securing Oracle HCM Cloud. Data Roles (enterprise-wide roles) A Data Role is implemented as Job Roles for a defined set of data. This role describes the job a user does within that defined set of data. The Data Role inherits a Job Role and is granted applicable data security privileges. For more information about Oracle Sales Cloud Data Roles, see Oracle Sales Cloud Securing Oracle Sales Cloud. For more information about Oracle Cloud Data Roles, see Oracle Securing Oracle HCM Cloud. Data Roles grant specific data to users. For example, HR Admin UK has access to all UK employees, or Sales Rep West Coast can access West Coast customer accounts. Data Roles are built at the customer site as they are data dependant. 5-2 Administering Transactional Analyses

43 About Security Configuration Tools in Reports and Analytics Data Roles are built using Job Role and permission grants on custom data. For example: An Accounts Payables Specialist might be assigned the Data Role 'Accounts Payables Specialist - US Business Unit'. This Data Role inherits the Job Role 'Accounts Payable Specialist' and grants access to transactions in the US Business Unit. A Benefits Administrator is assigned the Data Role 'Benefits Administrator - Surname A-E'. This Data Role inherits the Job Role 'Benefits Administrator' and grants access to Employees with the Surname starting from A to E. Typically, a person is hired into a job, which might trigger an event to automatically assign a Job Role without being assigned a defined set of data. A person in a functional department might at a later point in time assign his staff a Data Role that describes the job of that person within that defined set of data. Data roles can be provisioned to a user on request. Data Roles can be formed by declaring child Duty, Abstract, and Job Roles. Abstract Roles (enterprise-wide roles) These roles are associated with a user irrespective of their job or job function, and are not associated with a job or duty. For example, Employee (Human Resources), Manager (Human Resources), Customer, Supplier etc. Abstract Roles are normally assigned by the system (based on user attributes) but can be provisioned to a user on request. For more information about Oracle Sales Cloud Abstract Roles, see Oracle Sales Cloud Securing Oracle Sales Cloud. For more information about Oracle Cloud Abstract Roles, see Oracle Securing Oracle HCM Cloud. About Security Configuration Tools in Reports and Analytics There are many tools that enable you to configure security in reports and analytics. Topics: Using Oracle Identity to Manage Users and Enterprise Roles Using Oracle Authorization Policy Manager to Configure Roles and Privileges Using the Oracle BI Administration Page to Configure Duty Role Privileges Using Oracle Identity to Manage Users and Enterprise Roles Oracle Identity enables you to manage authenticated users, Job Roles, and Data Roles in the LDAP directory. For more information about managing Users and Groups (Job Roles, Abstract Roles, Data Roles), see Creating Users and Assigning Them to Job Roles. Using Oracle Authorization Policy Manager to Configure Roles and Privileges Oracle Authorization Policy Manager (APM) enables you to create and manage Duty Roles that control access privileges to Oracle Business Intelligence resources. Securing Reports and Analytics 5-3

44 About Security Configuration Tools in Reports and Analytics Job Roles (or Fusion Applications Enterprise Roles) in the LDAP directory are mapped by default to the pre-configured Duty Roles. For detailed steps on mapping Enterprise Roles to Duty Roles, see Assigning Enterprise Roles (or Job Roles) to Duty Roles. In Oracle APM, you can search on roles related to a specific functional area. To do so, navigate to the Search Role tab of the Role Catalog page, and select the appropriate functional area from the Category list. Using the Oracle BI Administration Page to Configure Duty Role Privileges Use the Oracle Business Intelligence Administration Manage Privileges page to grant access and privileges to dashboards and other content to Duty Roles. 5-4 Administering Transactional Analyses

45 About Security Configuration Tools in Reports and Analytics You can use this page to grant specific privileges, for example to: Manage Device Types Access a subject area within BI Answers (for example, Subject Area: "General Ledger - Balances ") View a Dashboard Prompt To configure Oracle BI Presentation Catalog Duty Role privileges: 1. Log in to Oracle Business Intelligence with Administrator privileges. 2. Select the Administration link to display the Administration page. 3. Select the Manage Privileges link to display the Manage Privileges page. 4. In the Manage Privileges page, click a link to display the Privilege dialog, where you can grant or deny the privilege to the currently selected role. Securing Reports and Analytics 5-5

46 About Security Configuration Tools in Reports and Analytics 5. Click the Add users/roles icon (+) to display the Add Application Roles, Catalog Groups, and Users dialog. 6. Click OK. 7. To configure permissions for Duty Roles on functional dashboards and reports: a. In the top, click Catalog and expand Shared Folders in the left pane. b. Click the required pillar or functional area folder to open it. For example, select the Workforce Deployment dashboard under the Human Capital shared folder. c. Click the More link for the Workforce Deployment dashboard to open the Permissions dialog box. 5-6 Administering Transactional Analyses

47 Securing Analytics d. Use the Permission dialog box to add or modify role permissions for the Workforce Deployment dashboard. Securing Analytics Note: Similar steps can be taken to configure security for other objects in the Oracle BI Presentation Catalog. This section describes how to set up security using the Job Roles and Duty Roles that are installed. Topics: Creating Users and Assigning Them to Job Roles Assigning Enterprise Roles (or Job Roles) to Duty Roles Creating Duty Roles Assigning Duty Role Privileges to Oracle BI Presentation Catalog Objects Creating Users and Assigning Them to Job Roles When you create a new user you must assign them to one or more Job Roles or Data Roles using Oracle Identity. The new user inherits appropriate privileges from the Duty Roles that are associated with the Job Role or Data Role. New users are automatically added to the Fusion Applications Identity Store. For Fusion Business Intelligence, Oracle Business Intelligence authenticates against Fusion Applications Identity Store at runtime. To create a new user and assign the user to a Job Role or Data Role: Securing Reports and Analytics 5-7

48 Securing Analytics 1. Use Oracle Identity as described in Using Oracle Identity to Manage Users and Enterprise Roles. 2. Create a new user using Oracle Identity. 3. Assign the new user to a Job Role or Data Role. If the default Job Roles or Data Roles do not meet your business requirements, then create your own Job Roles or Data Roles. Assigning Enterprise Roles (or Job Roles) to Duty Roles If the default security settings meet your business needs, then you do not need to alter the mappings. If the default security settings do not meet your needs, then you might: edit the default Duty Roles and map them to different Enterprise Roles. create new Duty Roles and map them to Enterprise Roles. Follow the steps below to map an Enterprise Role to a Duty Role. Prerequisite: Before you start, the Enterprise Role must already exist in the LDAP directory, and the Duty Role must already exist in the Role Catalog. You can either use one of the pre-configured Enterprise Roles or you can use OID to create your own Enterprise Roles. To map an Enterprise Role to a Duty Role: 1. In Oracle APM, navigate to the 'obi' Application and use the Search options to locate the Duty Role that you want to map. 2. Select the Duty Role, then click Open to display the <Application> Application Role dialog. 3. Display the External Role Mapping tab. You use this tab to search for and select the Enterprise Roles that you want to map to that Duty Role. 4. Click Add to display the External Role Search dialog. 5-8 Administering Transactional Analyses

49 Securing Analytics 5. Click Map Roles to map the Enterprise Roles selected for the Duty Role, and return to the External Role Mapping tab. Creating Duty Roles If the default Duty Roles meet your business needs, then you do not need to change them. If the default Duty Roles do not meet your needs, then you might create new Duty Roles and map them to Job Roles. To create a Duty Role: 1. Log in to Oracle Authorization Policy Manager, and select the 'obi' Application area. 2. In the Applications pane\create area select the New Application Role link to display the <Application> Application Role dialog. 3. In the General tab, use the Display Name field to specify the Duty Role name. 4. In the General tab, use the Role Name field to specify the Duty Role name in upper-case. Leave the Role Category field blank. 5. Click Save. The other tabs only become active after you click Save. Securing Reports and Analytics 5-9

50 Securing BI Publisher Reports and Related Components At this point, you might want to map Job Roles to the new Duty Role by following the steps in Assigning Enterprise Roles (or Job Roles) to Duty Roles, or you might want to map Job Roles to the new Duty Role at a later date. Assigning Duty Role Privileges to Oracle BI Presentation Catalog Objects You assign Duty Role privileges to Oracle BI Presentation Catalog objects to enable users associated with that Duty Role to be granted specific query permissions (for example, dashboard and other content). For more information, see Using the Oracle BI Administration Page to Configure Duty Role Privileges. Securing BI Publisher Reports and Related Components Topics: Setting Catalog Permissions Setting Catalog Permissions Granting Permissions to the Oracle Enterprise Scheduler Job Definition For a user to run a report, Read permissions must be granted to that user's role on every object in the Oracle BI Presentation Catalog that is used in the report. This always includes at least two objects: the report and the data model. If your report also references a subtemplate or a style template, you must also grant Read permissions on those objects. The report object requires additional grants to run, schedule, and view output. Configuring permissions in the BI Presentation catalog consists of the following subtasks: Grant the Role Permissions to the Report Grant the Role Permissions to the Data Model and Other Referenced Objects Delete Permissions Grant the Role Permissions to the Report To grant permissions in the catalog: 1. Navigate to the report in the catalog, click More and then click Permissions to display the Permissions dialog. 2. In the Permissions dialog, click Add users/roles Administering Transactional Analyses

51 Securing BI Publisher Reports and Related Components 3. In the Add Application Roles, Catalog Groups and Users dialog, search for your custom role and use the shuttle buttons to move it to the Selected Members list. In the Set Permission to list, select Custom, and then click OK. 4. In the Permissions dialog, locate the role you added, and click Edit. Securing Reports and Analytics 5-11

52 Securing BI Publisher Reports and Related Components 5. In the Custom Permissions dialog, select the permissions to enable. Typically, you enable the following for a BI Publisher report: Read gives authority to access, but not modify, the report Traverse gives the authority to copy the report Run Publisher Report gives authority to read, traverse the folder that contains the report, and run the report. Schedule Publisher Report gives authority to read, traverse the folder that contains the report, and schedule the report View Publisher Output enables the user to view the report output generated by the scheduler Grant the Role Permissions to the Data Model and Other Referenced Objects To grant permissions in the catalog: 1. Navigate to the data model in the catalog, click More and then click Permissions to display the Permissions dialog. 2. Follow the instructions in Grant the Role Permissions to the Report, but in the Custom Permissions dialog, enable the Read and Traverse permissions Administering Transactional Analyses

53 Securing BI Publisher Reports and Related Components 3. Repeat this procedure for any other referenced objects (subtemplates or style templates). Delete Permissions To remove custom report inherited permissions from a report: 1. Navigate to the object in the catalog, click More and then click Permissions. The Permissions dialog launches and the inherited permissions are shown. 2. Select the permission to delete and then click the Delete toolbar button. Granting Permissions to the Oracle Enterprise Scheduler Job Definition If the custom report is to be scheduled through Oracle Enterprise Scheduler, execution permissions must also be granted to enable users belonging to the role to submit the job. Securing Reports and Analytics 5-13

54 Securing BI Publisher Reports and Related Components 5-14 Administering Transactional Analyses

55 6 6Managing Reports [6]If you to use Oracle Business Intelligence Publisher with Oracle Fusion applications, there are some administrative tasks that you must perform. Topics: Managing Report Delivery Servers Navigating to the Oracle BI Publisher Administration Page Configuring Report Delivery Servers Understanding the Report and Delivery Processors Managing Report Processing and Delivery Server Load Scaling Out Report Processors Diagnosing Report Processing Issues Configuring System Properties for Reporting Managing Report Delivery Servers Oracle Business Intelligence Publisher is the report generation and delivery engine for Oracle Fusion Applications. Oracle BI Publisher receives report requests from Oracle Fusion Applications in the following ways: Through Oracle Enterprise Scheduler Through the Reports and Analytics pane From an application page Requests submitted through Oracle Enterprise Scheduler are processed by the Oracle BI Publisher scheduler. Requests submitted through the Reports and Analytics pane can be either real-time online requests or scheduled requests. Requests submitted through an application may invoke Oracle Enterprise Scheduler or may return report request results directly back to the application page. After installing Oracle Fusion Applications, Oracle BI Publisher is configured to accept requests from Oracle Fusion Applications. However, before you can deliver report documents to their destinations you must define the delivery servers in Oracle BI Publisher. Use the Oracle BI Publisher Administration page to define your delivery servers. After setup, you can then further configure the number of report processor and delivery threads to best handle your processing and delivery requirements. In addition, you can configure report properties for the system or at the report level to Managing Reports 6-1

56 Navigating to the Oracle BI Publisher Administration Page tune performance of your reports. To diagnose report processing issues, BI Publisher provides a set of scheduler diagnostics. Navigating to the Oracle BI Publisher Administration Page Use the Oracle BI Publisher Administration page to: Configure delivery servers Manage report and delivery processors View scheduler diagnostics Set system properties and report runtime configuration properties Note: You must be assigned the BIAdministrator role to access the BI Publisher Administration page. To navigate to the Oracle BI Publisher Administration page: 1. From the Oracle Fusion Applications Navigator, under Tools, click Reports and Analytics. 2. In the Reports and Analytics pane, click Catalog to display the Oracle Business Intelligence presentation catalog page. 3. From here, click Administration and then click Manage BI Publisher. Configuring Report Delivery Servers To configure delivery servers: 1. From the BI Publisher Administration page, click Delivery Configuration. 2. Enter values in the Delivery Configuration Options tab to set general properties for deliveries and notifications. 3. To configure a delivery server, click the appropriate tab. The following table lists the report delivery channels supported by Oracle BI Publisher. Delivery Type Printer and Fax Section Adding a Printer or Fax Server 6-2 Product Title/BookTitle as a Variable

57 Managing Report Processing and Delivery Server Load Delivery Type WebDAV HTTP FTP Section Adding an Server Adding a WebDAV Server Adding an HTTP Server Adding an FTP Server Note that printing is supported through Internet Printing Protocol (IPP). If Oracle BI Publisher is operating in a UNIX environment, you must set up the Common Unix Printing Service (CUPS) and then define your CUPS server to Oracle BI Publisher. For a Windows environment, you must set up Windows Print Server for IPP. Understanding the Report and Delivery Processors When Oracle Enterprise Scheduler initiates a job, it is picked up by the BI Publisher scheduler queue. The processors perform as follows: Job Processor listens for requests from the scheduler queue. When the job information is received, the job processor executes the data model (and splits the data for bursting jobs), stores the data in the shared temporary folder, and sends the report metadata to the report queue. Report Processor listens for requests from the report queue. When the report information is received, the report processor generates the report documents, stores it in the shared temporary folder and puts the delivery information in the delivery queue. Delivery Processor listens to the delivery queue and handles the delivery of reports for its channel. The delivery processors are: Processor File Processor FTP Processor Print Processor WebDAV Processor Fax Processor You can configure the number of threads dedicated to each processor. Managing Report Processing and Delivery Server Load Manage the processors in the BI Publisher Scheduler Configuration page. By default, each processor is enabled and the thread count for each is set to five. For each managed server that is running in the BI cluster, a table for that instance's processors is displayed. Use the table to enable or disable processors for the instance and configure the thread counts. To configure processor threads: 1. From the BI Publisher Administration page, click Scheduler Configuration. 2. On the Scheduler Configuration page, scroll to the Cluster Instances region. Managing Reports 6-3

58 Scaling Out Report Processors 3. Enter the Number Threads value in the processor configuration table. Note that all processors are automatically be set to use the number of threads defined in the Threads Per JMS Processor value of the JMS Configuration region of the page. Enter a value in the Number Threads column to change the value from this default. Scaling Out Report Processors After performing the scale-out procedure, follow the steps in Managing Report Processing and Delivery Server Load to configure the processor threads for each cluster instance. Diagnosing Report Processing Issues The following tools enable you to diagnose report processing and delivery issues: The Scheduler Diagnostics page provides the runtime status of the scheduler. It provides status of its JMS configuration, JMS queues, cluster instances, scheduler Database, Toplink, and Oracle Enterprise Scheduler. To access the Scheduler Diagnostics page: 1. Navigate to the Oracle Business Intelligence Publisher Administration page. 2. In the System Maintenance group, click Scheduler Diagnostics. 6-4 Product Title/BookTitle as a Variable

59 Configuring System Properties for Reporting Configuring System Properties for Reporting Use the Oracle BI Publisher Runtime Configuration page to set the system-level runtime properties for reports. To access the Runtime Configuration page: 1. Navigate to the Oracle Business Intelligence Publisher Administration page. 2. In the Runtime Configuration group, click Properties. Managing Reports 6-5