Global to object level hierarchy

By default, groups and users will inherit rights from the highest level.

The highest level starts at the Global Settings level.  The second level is the folder level; and finally the lowest level is at the object level.  If we set rights at the current level itself, then those rights have precedence over inheritance (except if rights have explicitly been denied)

Here are a few examples of setting up a group at multiple levels

Group and User security Overlap

Use the following formulas as a guide to understand what happens when inheritance from multiple groups overlap

• Grant + Deny + Not Specified = Deny
• Grant + Not Specified = Grant
• Grant + Deny = Deny
• Not Specified = Denied

For Predefined access levels, the access level with more access will take precedence.

For example:

If user “James” is part of Group “Sales” and “Marketing”.

If “Sales” has “View” access on the Marketing Folder and “Marketing” has “Schedule” access on the Marketing folder.  “James” will have “Schedule” access on the Marketing folder.

User rights take precedence over inherited rights

User rights will always take precedence over inherited rights.

For example:

User “James” is part of the “Marketing” and has “Schedule” access on the Marketing folder.  However we set “James” with “View” access on the Marketing folder.  View access will then take precedence.

The only time an inherited right takes precedence is if an inherited right explicitly denies access.  To override an inherited deny, you must uncheck the box that inherits rights.

Recommendations

• Assign security at the folder level to groups whenever possible.  Avoid setting rights for specific users on specific report objects.  This will reduce the complexity of your system security model.
• Use predefined access levels whenever possible.
• Grant the “Everyone” group No Access at the global level and then grant specific rights to the appropriate groups to prevent any loopholes.
• When setting rights, make sure to include the appropriate Universes and Business Views as well since access may be denied if they are not included.

There are 2 ways of assigning access in Business Objects Enterprise

Predefined Access Levels

Predefined access levels are a collection of individual rights that have been set up in the Business Objects Enterprise system to provide common user access requirements.

Advanced rights

By going into the advanced rights, you may totally customize the type of access a user has on an object.

It is simplest to use predefined access levels, as we don’t have to manually configure every single right.

Below is a table of Predefined access levels

Security Hierarchy

The security levels flow in the following manner:

• Global security
• Folder-level security
• Object-level security

Global Security

The default security set for the entire system.   For example when a new folder is added, its default rights come from the global level.

If there are any access levels that are common for the entire system, you should set them at the global level.

Global level rights can be set at the settings management area of the Central Management Console

Folder-level security

Folder level security allows you to set access-level rights for a folder and objects contained within that folder.  Subfolders will inherit the security of their parent folders.

Folder level security can be set by going to the “Folders” page of the CMC, then selecting a folder, and then clicking on the Rights tab.

Object Level security

Object level security is the access-level rights set at the object level.

Folders and Categories

It is important to understand the differences between folders and categories.  Both provide a way of organizing documents and BI content.  Folders provide the physical storage location of a file as well as navigation to content.  Categories provide navigation only.  Folders are required whereas categories are optional.  Thus when using a combination of both, it is recommended that categories are used for navigation only and permissions be set at the folder level.

When you create a new folder, two sets of permissions are automatically assigned:

• Administrators are given the access level Full Control
• Everyone is given the access level Schedule

Since the “Everyone” group is assigned the default access level of Schedule when a folder is first created, all users are able to view, open and schedule any reports saved in the new folder.  For many companies, this type of access level may not be acceptable, so the best practice is to make sure “No Access” is set for the “Everyone” group when creating a new folder.  If you want to give more permission, you can tweak it later on.