Understanding Business Objects Access Levels

Understanding the Business Objects security model will enable you to map out a content management strategy for your organization.  Visit my previous post at http://davidlai101.com/blog/2008/11/06/content-management-planning-in-business/ after understanding user access levels and inheritance to setup your content. In this article we’ll go through the Business Objects Enterprise Access Levels.

There are 2 ways of assigning access in Business Objects Enterprise

Predefined Access Levels

Predefined access levels are a collection of individual rights that have been set up in the Business Objects Enterprise system to provide common user access requirements.

Advanced rights

By going into the advanced rights, you may totally customize the type of access a user has on an object.

It is simplest to use predefined access levels, as we don’t have to manually configure every single right.

Below is a table of Predefined access levels

Security Hierarchy

The security levels flow in the following manner:

• Global security
• Folder-level security
• Object-level security

Global Security

The default security set for the entire system.   For example when a new folder is added, its default rights come from the global level.

If there are any access levels that are common for the entire system, you should set them at the global level.

Global level rights can be set at the settings management area of the Central Management Console

Folder-level security

Folder level security allows you to set access-level rights for a folder and objects contained within that folder.  Subfolders will inherit the security of their parent folders.

Folder level security can be set by going to the “Folders” page of the CMC, then selecting a folder, and then clicking on the Rights tab.

Object Level security

Object level security is the access-level rights set at the object level.

Folders and Categories

It is important to understand the differences between folders and categories.  Both provide a way of organizing documents and BI content.  Folders provide the physical storage location of a file as well as navigation to content.  Categories provide navigation only.  Folders are required whereas categories are optional.  Thus when using a combination of both, it is recommended that categories are used for navigation only and permissions be set at the folder level.

When you create a new folder, two sets of permissions are automatically assigned:

• Administrators are given the access level Full Control
• Everyone is given the access level Schedule

Since the “Everyone” group is assigned the default access level of Schedule when a folder is first created, all users are able to view, open and schedule any reports saved in the new folder.  For many companies, this type of access level may not be acceptable, so the best practice is to make sure “No Access” is set for the “Everyone” group when creating a new folder.  If you want to give more permission, you can tweak it later on.

1. Step by Step guide on how to Burst Reports in Business Objects | David Lai's Business Intelligence Blog