BO Folder Security and Authorization

[former_member546611]

Hell All,

We have a new set of Analysis for office reports created which will be saved on BI Launchpad and we need to set up folder security and authorization for the same.

We will have folder structure on basis of departments

for eg:

• 2. AFO Reports Folder

• 2.01 Dept A
• 2.02 Dept B
• 2.03 Dept C
• 2.04 Dept D Like wise..till Dept K

How should we setup security with folders and users groups.

Also as per above req, AFO report 1 will be available in all sub folders(Dept) So will i have to make 11 copies of the report(11 dept)

AFO report 2 is needed only by Dept C users. Hence it will have only one copy.

But again fro report 6 it will have copies similar to number of departments. This will make maintenance difficult . Any suggestions on how to implement the security and folder access and authorization.

Thanks!

[DellSC · Accepted solution]

Going the shortcut route, I would do this:

1. Create a folder under the AFO Reports folder called something like "Hidden". Set the security on this folder so that only Administrators and report designers can see it. Put all of the reports in this folder.

2. Create a separate user group for each department.

3. Assign each department user group access to the individual reports per your security plan. This is not best practice (which is assigning access at the folder level), but it is the best way to get what you're trying to achieve. This will also prevent the reports that a department user doesn't have access to from showing up in a search.

4. Create shortcuts to the applicable reports in the department folders.

-Dell

[former_member546611 · Accepted solution]

Hello,

When you say "3. Assign each department user group access to the individual reports per your security plan"

Group access to reports which are placed in hidden folder ,right?

Thanks!

[DellSC · Accepted solution]

Yes.

-Dell

[former_member546611 · Accepted solution]

Hello,

Instead of applying report level security we can do as below also:

1. Create a folder under Public Folder ' Main Folder'--> 'XYZ Folder' --> Place all reports under report folder.

Also, we will give dept user groups access to 'XYZ Folder' only and create shortcut copies of the report in another folder structure that we will be visible to end users. (This way when we create shortcut of the reports in dept folder ,these shortcuts will be visible as they have access to 'XYZ folder'. And end users will not be exposed to it as its root folder 'Main Folder' is not visible to them.

This way we can work with Folder level security. Let me know your suggestions on this workaround!

Thanks!

Regards,

Hetal

[DellSC · Accepted solution]

That's absolutely the best way to handle it. Best practice is to grant user groups access to folders and use inheritance to propagate the security down to the reports. I suggested granting access at the report level because your original chart shows reports, not folders.

The one thing you have to think about when using shortcuts is that the user has to have access to the original report that the shortcut points to. One way I have done this in the past is to have a "Hidden" folder at the top level of folders with the security set so that only Administrators can access it. I then create a subfolder where I give either Everyone or the various individual groups access and then put the reports in there. This way the users can't "see" the folder where the actual reports live because they don't have access to its parent folder, but the shortcuts will work because the users have access to the reports. The only problem with this occurs when Search is enabled and, for example, a user in Department A does a search that contains all or part of the name of AFO Report 2. The report will show up in the search results even though the user doesn't have access to a shortcut for it.

-Dell

[former_member546611 · Accepted solution]

Thanks Dell fro detail inputs!

Much Appreciated!

Regards,

Hetal

[former_member546611 · Accepted solution]

Hello Dell,

I did test your point regarding the search results.

But i did observe a strange behavior.

When i tested in QA system--> Logged into BI user Test1(this user has access to only AFO Report 1 shortcut) and searched for Report AFO, then AFO Report 2 also appeared in the search results.

But when tested this in Prod system, AFO Report 2 sis not appear. Also checked the BI platform search settings and they are same for both the systems.

Just wondering why the report is not appearing Prod system but in QA system.

Thanks!

Hetal

[DellSC · Accepted solution]

Hetal,

I would check to make sure that your test user is in the same groups in both systems and that the reports have the exact same groups/security assigned.

-Dell

[former_member185603]

Based on your requirement, you need to copy the report 11 times. Another alternate solution is create a short cut of Report1, in all the folders, so you don't need to copy all the depts.

[former_member546611]

Ok, thanks!

But I have one confusion over the maintenance of these reports.

So we will keep the Report1 in main folder and create shortcut in other Dept folders.

But if there is any change in main report1 which is placed in main folder, these changes will appear in reports lying in dept folders as well,right? because reports in dept folder is just a shortcut of the report.

Thanks!

[former_member185603]

Correct, You are changing it only in one place.

[former_member546611]

Hello,

I just tested the how shortcut of the reports works.

I made changes in the shortcut copy of the report and it reflected the changes in main report as well.

So if i give edit/refresh access,it will affect the reports present in all dept.

Thanks!

[former_member546611]

Hello,

Please guide on how shortcut will work.

As per my understanding, we will have place to all main reports in one folder which will be hidden, and then create shortcut copies.

But if the main report is not accessible to end users,shortcut will also not work in that case. Any suggestions on this?

[former_member185603]

You need to give view access to that report, so other depts. with shortcut can be able to access. In your case, when you access to view the folder, just setup the rights for this particular report to give view access, but not for other reports. Otherwise, you need to copy the reports in all 11 depts folders which is cumbersome and error prone.

[former_member185603]

Here is outline of Security , you can follow. Are the reports exists in sub folders or exists in separate root folders? You need to clarify it.

Below is the example:

Dept - Root Folder

Dept1 - Sub folder

Report1- In Dept1 Sub folder

Group1 who needs to have an access to Dept1, Setup security to view the root folder 1st and give access to Dept1 folder to access (Either refresh or Edit rights)

Follow the same for rest of the reports and sub folders. But every group needs to have view rights on Root folder (in your case Dept), otherwise, they will not be able to see sub folders.

[former_member546611]

Reports will exists in sub folders having one root folder.

Also , if we follow this approach, we will have 11 copies of report 1 which will be placed in all sub folders(Dep 1,Dep2,)

for e.g. AFO report 1 should be accesses by all dept hence i will have to copy that report in all sub folders,isnt it?

Thanks!