Skip to content

Explore Security

See which users and groups have which access to BusinessObjects objects, trace where the access is inherited from, and change access levels from the MetaMiner Client.

License and permission

Explore Security needs the "Explore Security" permission. Changing access (Assign Access Levels, Add Principals) also needs "Change Access Level". Both are checked per environment; see Permissions Reference. The feature needs a license with the BusinessObjects client features (Editions and Licensing).

How it works

MMS reads the security of the selected objects from the CMS and the client shows it as a matrix: objects as rows, principals (users and user groups) as columns, and the assigned access level in each cell. Explicit assignments and inherited access are marked separately.

Image of an Explore Security tab for a folder with Users and User Groups columns and inherited cells marked

../../images/client/explore-security-tab.png

Term Meaning
Principal A user or user group that has access to an object
Access level A BusinessObjects role such as View or Full Control, assigned to a principal on an object
Explicit Assigned directly on the object
Inherited Received from a parent folder or a parent user group
Granular rights Individual rights (granted or denied) that make up or override an access level

Explore the security of objects

  1. In the CMS Explorer (or the Users or Servers tab), select one or more objects.
  2. Right-click and choose Explore Security, then:
    • Selection Only - security of the selected objects.
    • Selection and Children - security of the selected objects and everything under them.
  3. Wait while the client shows "Loading security data...".

Result: a closable security tab opens. Use the toolbar search and the export button to save the matrix to CSV or Excel.

Limit the number of rows

Large selections can return many rows. File > Preferences... > Max Security Rows: limits the security rows shown for Explore Security.

Display names

Turn on Use Display Names for Users in Preferences to show users as display name and username. Panels that are already open keep the old format until you reopen them.

Trace inheritance

Click a cell to see where its access comes from.

Panel Shows
Right Inheritance Details The Principal and Object columns name the source where the security is explicitly assigned
Role Inheritance Details For the selected role, the principal and object it is inherited from
Assigned Security Rights Assigned access and granular rights for the selected principal and object; inherited rights are marked "(inherited)"

View security rights

  1. Right-click a single cell that has a value.
  2. Choose View Security Rights.

Result: a table of rights with the columns Collection, Type, Right name, Apply To and Sources, each marked Granted or Denied. Click a row to see its sources.

Image of the View Security Rights dialog with General and type-specific rights, Granted and Denied values

../../images/client/explore-security-rights.png

Assign access levels

Before you begin

  • You have the "Change Access Level" permission on the environment.
  • You know which BusinessObjects access levels (roles) you want to grant.

Steps

  1. In the security tab, select one or more cells (double-click a cell to open the dialog for that cell).
  2. Right-click and choose Assign Access Levels.
  3. In Roles, select the access levels to assign, or click Clear Roles to remove all explicit roles.
  4. Set Inherit from parent folders and Inherit from parent groups as needed.
  5. Click OK.

Result: MMS applies the roles in the CMS ("Applying security roles...") and the tab refreshes.

Image of the Assign Access Levels dialog with two roles selected and both inherit check boxes on

../../images/client/explore-security-assign-access.png

Security changes are applied to BusinessObjects immediately

Clear Roles removes all explicit roles from the selected objects for the selected principals. Turning off inheritance can remove access that users rely on. Check the result with Explore Security again.

Add principals

  1. In the security tab, select the object rows.
  2. Click Add Principals on the toolbar, or right-click in the first column and choose it.
  3. In Add Security Principals, choose the users and groups.
  4. In Choose Security Roles for New Principals, select the roles.
  5. Click OK.

Result: the principals are added to the selected objects with the chosen roles.

TODO: document the Self Map option in the Add Security Principals dialog

The dialog has a Self Map check box. Its effect is not verified.

Troubleshooting

No Security Data

The message "No security data found for selection" means the CMS returned no explicit or inherited assignments for the selected objects, or the account used by MetaMiner cannot read their security.

Failed to load security data

Check the connection to MMS and that the environment is still loaded (open File > Connection Manager...).

Next steps