BusinessObjects Board

exporting to 2 repositories

security Supervisor (4.x - 6.x)
#1

how does one go about exporting the same universe to 2 different repositories without doing a “save as” in the 2nd universe folder? i.e., i export the universe to repo. 1, but when i log on to the 2nd repo. and try to open that universe, it says i am not authorized.

thanx in advance.

d

This communication is for informational purposes only. It is not intended as an offer or solicitation for the purchase or sale of any financial instrument or as an official confirmation of any transaction. All market prices, data and other information are not warranted as to completeness or accuracy and are subject to change without notice. Any comments or statements made herein do not necessarily reflect those of J.P. Morgan Chase & Co., its subsidiaries and affiliates.

Listserv Archives (BOB member since 2002-06-25)

Implementing multiple Security Domains
Steps to move groups/users and privileges across repository
#2

There is only 1 way to do this. You have to start by copying your repository. That’s the only way to fool the tool into thinking that 2 repositories can contain the same Universe or Report.You can probably do it with a general supervisor id, but be careful, the universe ids can get screwy.

Another reason to convince everyone not to have multiple repositories. USE DOMAINS!!!

Listserv Archives (BOB member since 2002-06-25)

#3

Steve,

I’m not convinced yet.
For all sorts of reasons, the development, support and infrastructure IT managers have agreed that we have to have separate development, test and production environments: separate boxes, separate backup procedures, separate SLAs (but the structure of the environments is as similar as possible). This is company policy, it works for everything else we have, why not for BO?
What do I tell them? That BO cannot be deployed in a production environment separate from development and/or we cannot easily promote universes and reports from development through test to production?

What would be your response to these demands that we must satisfy?

Gabriel Tanase
Database Modeler
GE Insurance Holdings
GEIS Shannon, Ireland
e-mail Gabriel.Tanase@gecapital.com
Opinions expressed in this message are my own and do not represent the opinions or policies of GE or GEI or any of its other employees, directors, officers, shareholders or affiliates.

You can probably do it with a general supervisor id, but be careful, the universe ids can get screwy.

Another reason to convince everyone not to have multiple repositories.
USE
DOMAINS!!!

how does one go about exporting the same universe to 2 different repositories without doing a “save as” in the 2nd universe folder? i.e., i export the universe to repo. 1, but when i log on to the 2nd repo. and try to open that universe, it says i am not authorized.

This email contains information which may be confidential or privileged. The information is intended solely for the use of the individual or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic transmission in error, please notify me by telephone or by electronic mail immediately. Any opinions expressed are those of the author, not the GE Insurance group. This email does not constitute either offer or acceptance of any contractually binding agreement. Such offer or acceptance must be communicated in writing.

Listserv Archives (BOB member since 2002-06-25)

#4

Gabriel,

We are in the same situation here, we are in the middle of a deployement of BO to operating countries, which each have 2 repositories (development and production). The only way we found (and recommended by BO…) is to save the universe for all users with a shared connection, to logon in the other repository, to change connection and to export the universe to the production universe.
One central reposoitory was not an option due to slow network.

It seems tough that, at least with Oracle (and I haven’t tested it yet…) an export import of your schema who contains the repository works too. Disadvantage, if you have garbage in development, you have garbage in production.

In the hope i am not to far off,

Greetings,

Bert

Listserv Archives (BOB member since 2002-06-25)

#5

Not had to do it but with oracle you could two way replicate the security domain to both sites and have seperate universe, document domains etc local to each site. Then users can authenticate to a shared but local security domain using a single repository to manage universes and documents at both locations.
The development production thing is a bit different but my question would be what do you need in development? To test new/changes to universes and documents before putting them live. This can still be done with a single repository with multple domains. The only reason for a development security domain is to test upgrades etc. This can be done by copying the whole repository to a test location and performing task on it to test but it need not otherwise interfere with the general development lifecycle stuff that goes on in the real repository.

my $0.02

Ken.

Listserv Archives (BOB member since 2002-06-25)

#6

In a message dated 01-09-07 08:30:14 EDT, you write:

how does one go about exporting the same universe to 2 different
repositories without doing a “save as” in the 2nd universe folder? i.e., i export the universe to repo. 1, but when i log on to the 2nd repo. and try to open that universe, it says i am not authorized.

A couple of options:

  1. Use General Supevisor
    I don’t usually like working using the General Supervisor login, since it can hide problems. But in this case, you will either need to do a “save as” and put the universe into workgroup mode, or open the universe as the General Supervisor to avoid the “not authorized” message.

When you get ready to export to repository 2, it will suggest that “this universe already exists, do you want to overwrite?” If you answer “yes” it should replace the universe in the second repo, keeping the universe ID that has been assigned.

  1. As briefly mentioned in #1, go ahead and use “Save As” You will need to update the universe connection anyway, so the extra step of creating a non-secured connection temporarily is not a problem. You do realize that you need to switch the connection each time you export, correct? Since you have 2 repositories, and the connection for an exported universe must be stored in the repository, you will need to select the appropriate connection each time you export.

  2. Use two domains rather than two completely different repositories Why do you have two repositories? Unless there is a compelling reason, you may be able to accomplish the same thing using two different universe domains instead. This would eliminate the need to log in to two different places.

Regards, Dave Rathbun
Integra Solutions www.islink.com
Got a FAQ idea? email BUSOBListFAQ@aol.com Conference Travel Ideas: http://www.MomentsOfLight.com/trips_ut_boconf.html

Listserv Archives (BOB member since 2002-06-25)

#7

Dave,

thanx. i’m onto option 1 as it was the only way i could get it to work. won’t “save as” change the universe id?

Dave

DRathbun@AOL.COM@LISTSERV.AOL.COM on 09/07/2001 09:09:01 AM

Please respond to BUSOB-L@LISTSERV.AOL.COM

Sent by: BUSOB-L@LISTSERV.AOL.COM

cc:

In a message dated 01-09-07 08:30:14 EDT, you write:

how does one go about exporting the same universe to 2 different
repositories without doing a “save as” in the 2nd universe folder?
i.e., i
export the universe to repo. 1, but when i log on to the 2nd repo. and
try
to open that universe, it says i am not authorized.

A couple of options:

  1. Use General Supevisor
    I don’t usually like working using the General Supervisor login, since it can
    hide problems. But in this case, you will either need to do a “save as” and put the universe into workgroup mode, or open the universe as the General Supervisor to avoid the “not authorized” message.

When you get ready to export to repository 2, it will suggest that “this universe already exists, do you want to overwrite?” If you answer “yes” it should replace the universe in the second repo, keeping the universe ID that
has been assigned.

  1. As briefly mentioned in #1, go ahead and use “Save As” You will need to update the universe connection anyway, so the extra step of
    creating a non-secured connection temporarily is not a problem. You do realize that you need to switch the connection each time you export, correct?
    Since you have 2 repositories, and the connection for an exported universe must be stored in the repository, you will need to select the appropriate connection each time you export.

  2. Use two domains rather than two completely different repositories Why do you have two repositories? Unless there is a compelling reason, you may be able to accomplish the same thing using two different universe domains
    instead. This would eliminate the need to log in to two different places.

Regards, Dave Rathbun
Integra Solutions www.islink.com
Got a FAQ idea? email BUSOBListFAQ@aol.com Conference Travel Ideas: http://www.MomentsOfLight.com/trips_ut_boconf.html

Listserv Archives (BOB member since 2002-06-25)

#8

As I understand it this is exactly what you could do. So on both counts yes. Though I think the BCA thing is restricted by user group and not domains but I could be wrong, don’t use BCA much.
The only thing you can’t have here is seperate cluster managers for dev and prod.
I assume that if everything has to go through the developemnt cycle then end users are not permitted to create thier own reports? If this is true I would tend to make sure that the developers have full client for all non-webi only reports so that development does not impact your webi cluster at all. If the report must be created using webi then I would still do development of the report using full client untill I knew exactly what was required and then re-create in the webi environment.
Call me old-fashioned but prefer the thick client for development, and webi for viewing or refreshing at best.

Ken.

Listserv Archives (BOB member since 2002-06-25)

#9

Call us old-fashioned, but no development activity is allowed into a production environment here, except for emergency fixes. I should perhaps say that the main worry is that early development and testing of reports, potentially retrieving a lot of data, could endanger the performance of the production BO server. OK, this requires a clarification: we’re considering BO 5i, web-enabled full-client (ZABO) and WebI here, not BO 4.*.

So, if we go with the idea of one repository with separate domains for development, test and production, could we:

  • put these separate domains onto two different database servers?

  • have two different BroadcastAgent & WebI servers, one for development and one for production, both connected to the same repository, but each to its corresponding universe domain, which are physically separated on two different database servers?

As far as I understand the BO 5i architecture, this is the closest that would satisfy a development/production full separation policy.

Regards,
Gabriel Tanase
Database Modeler
GE Insurance Holdings
GEIS Shannon, Ireland
e-mail Gabriel.Tanase@gecapital.com
Opinions expressed in this message are my own and do not represent the opinions or policies of GE or GEI or any of its other employees, directors, officers, shareholders or affiliates.

The development production thing is a bit different but my question would
be
what do you need in development? To test new/changes to universes and documents before putting them live. This can still be done with a single repository with multiple domains. The only reason for a development
security
domain is to test upgrades etc. This can be done by copying the whole repository to a test location and performing task on it to test but it
need
not otherwise interfere with the general development lifecycle stuff that goes on in the real repository.

my $0.02

Ken.

This email contains information which may be confidential or privileged. The information is intended solely for the use of the individual or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic transmission in error, please notify me by telephone or by electronic mail immediately. Any opinions expressed are those of the author, not the GE Insurance group. This email does not constitute either offer or acceptance of any contractually binding agreement. Such offer or acceptance must be communicated in writing.

Listserv Archives (BOB member since 2002-06-25)

#10

In a message dated 01-09-07 09:37:21 EDT, you write:

What do I tell them? That BO cannot be deployed in a production environment
separate from development and/or we cannot easily promote universes and reports from development through test to production?

There is more than one way to look at this. Instead of focusing on the details, look at the big picture. Why are completely separate environments required? And does BusObj’s architecture support those needs? Is the focus on “completely separate” simply because “We’ve always done it that way, so obviously there cannot be any other solution”…

One reason is to keep developers from exporting code to a production environment that has not been approved / tested. You can do this with multiple domains and appropriate security setup, or you can do it with multiple repositories. Multiple domains is easier, and is directly supported by the tool.

Another reason is to provide backup / recovery procedures. You can - at the database level - backup and recover individual domains as easily as you can recover the entire repository.

Need to put development on a separate box from production? Fine, put your dev universe domain in a database on box “D” with prod universe domain on database box “P”. Not a problem. (You can even have development universes stored in Informix with production universes in Oracle if you want.)

Let me put it another way. Do your developers log in to a completely different NT domain to do their work? I imagine not, yet that’s what you are simulating with two completely different repositories. You now have to maintain two different login ID’s for one product, and it’s not necessary.

The bottom line is that if you want to have completely separate repositories, you can. But your procedures will have to be adjusted accordingly.

Regards, Dave Rathbun
Integra Solutions www.islink.com
Got a FAQ idea? email BUSOBListFAQ@aol.com Conference Travel Ideas: http://www.MomentsOfLight.com/trips_ut_boconf.html

Listserv Archives (BOB member since 2002-06-25)

#11

Actually, I think it strips off the universe id, making the universe look like it’s never been exported to a repository.

Chris Pohl,
Mellon Bank

From: David Stoll [SMTP:stoll_david@JPMORGAN.COM] Sent: Friday, September 07, 2001 9:34 AM

won’t “save as” change the universe id?

***************************************************************** DISCLAIMER: The information contained in this e-mail may be confidential and is intended solely for the use of the named addressee. Access, copying or re-use of the e-mail or any information contained therein by any other person is not authorized. If you are not the intended recipient please notify us immediately by returning the e-mail to the originator.

Listserv Archives (BOB member since 2002-06-25)

#12

Personally I think I quite agree with what Dave & others have mentioned. We are currently running a prodn enivronment with hundreds of reports & almost an equal nos of users. AND we are having only one repository. With about 10 - 12 domains, which are split based on users rights as well as development & production. The Webi also talks to the same repository. It is much easier to administer one repository rather than complicate things with multiple.

Rajesh

What do I tell them? That BO cannot be deployed in a production environment
separate from development and/or we cannot easily promote universes and reports from development through test to production?

There is more than one way to look at this. Instead of focusing on the details, look at the big picture. Why are completely separate environments required? And does BusObj’s architecture support those needs? Is the focus on “completely separate” simply because “We’ve always done it that way, so obviously there cannot be any other solution”…

One reason is to keep developers from exporting code to a production environment that has not been approved / tested. You can do this with multiple domains and appropriate security setup, or you can do it with multiple repositories. Multiple domains is easier, and is directly supported by the tool.

Another reason is to provide backup / recovery procedures. You can - at the database level - backup and recover individual domains as easily as you can recover the entire repository.

Need to put development on a separate box from production? Fine, put your dev universe domain in a database on box “D” with prod universe domain on database box “P”. Not a problem. (You can even have development universes stored in Informix with production universes in Oracle if you want.)

Let me put it another way. Do your developers log in to a completely different NT domain to do their work? I imagine not, yet that’s what you are simulating with two completely different repositories. You now have to maintain two different login ID’s for one product, and it’s not necessary.

The bottom line is that if you want to have completely separate repositories, you can. But your procedures will have to be adjusted accordingly.

Regards, Dave Rathbun
Integra Solutions www.islink.com
Got a FAQ idea? email BUSOBListFAQ@aol.com Conference Travel Ideas: http://www.MomentsOfLight.com/trips_ut_boconf.html

Listserv Archives (BOB member since 2002-06-25)

#13

The true bottom line of this is that maintaining multiple repositories for the sake of bureaucracy does nothing more than add artificial development time and cost to your projects.

Listserv Archives (BOB member since 2002-06-25)

#14

What about outsourced development (one BO repository, one BO server, one database server), local in-house test & UAT (one BO repository, one BO server, several test databases), outsourced hosting of production servers (one BO repository, one cluster of BO servers, many database servers)?

Besides, some time ago there have been problems from developers messing about in production environments and affecting mission-critical applications. Nobody wants that anymore.

It’s not only bureaucracy, even if it’s called “corporate policy”.

If BO wants to be (seen as) an enterprise-level tool, why isn’t this development-to-test-to-production straightforward and painless?

Gabriel Tanase
Database Modeler
GE Insurance Holdings
GEIS Shannon, Ireland
e-mail Gabriel.Tanase@gecapital.com
Opinions expressed in this message are my own and do not represent the opinions or policies of GE or GEI or any of its other employees, directors, officers, shareholders or affiliates.

The true bottom line of this is that maintaining multiple repositories for the sake of bureaucracy does nothing more than add artificial development time and cost to your projects.

This email contains information which may be confidential or privileged. The information is intended solely for the use of the individual or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic transmission in error, please notify me by telephone or by electronic mail immediately. Any opinions expressed are those of the author, not the GE Insurance group. This email does not constitute either offer or acceptance of any contractually binding agreement. Such offer or acceptance must be communicated in writing.

Listserv Archives (BOB member since 2002-06-25)

#15

True outsourcing causes problems, but as connections wil all be different anyway the save for all users solution will work for this untill it reaches the client site at which point it becomes part of the single BO repository. Supervisor should be set up so that developers do not have access to mess about in production, then there is no problem. If this sort of environment is policy then there are bound to be production copy databases that allow developers to “production test” stuff without it going near production. Only a few select users (configuration managers if you will) have the rights to both test and production domains an it is them that must promote stuff into the right place.

True BO is not perfect but the security model is so tight that problems between totally seperate environments are bound to crop up. (assuming it is all set up correctly of course!)

Ken.

Listserv Archives (BOB member since 2002-06-25)

#16

In a message dated 01-09-07 10:57:52 EDT, you write:

Actually, I think it strips off the universe id, making the universe look
like it’s never been exported to a repository.

{ snip }

won’t “save as” change the universe id?

Yes, on both accounts. However, and I have tested this on V5 but not V4, when you export with “allow universe overwrites” turned on and BusObj encounteres a universe with the SAME NAME it will prompt, do you want to overwrite this universe. It appears that the existing universe ID is then assigned to the new export, which is what you want to happen.

In other words, I have two repositories. In one, Universe “FINANCE” has Universe ID 12. In the other, it has ID of 27. When I export to the first repository, everything goes well. Now I do a “Save As” to move FINANCE to workgroup mode. What is the ID? It is undefined. As Chris said, it is as if the universe has never been exported.

Next, log out, and log back in using the second KEY file. When you export FINANCE, it notices that there is already a universe with that name, and ID 27. If you overwrite the universe, the “new” never-before-exported FINANCE universe becomes 27, instead of a brand new ID.

You probably want to test this to verify, but I believe that this is what I found last time I walked through the process.

Regards, Dave Rathbun
Integra Solutions www.islink.com
Got a FAQ idea? email BUSOBListFAQ@aol.com Conference Travel Ideas: http://www.MomentsOfLight.com/trips_ut_boconf.html

Listserv Archives (BOB member since 2002-06-25)

#17

In a message dated 01-09-07 10:41:58 EDT, you write:

I should perhaps say that the main worry is that early development and
testing of reports, potentially retrieving a lot of data, could endanger
the
performance of the production BO server.

But this impacts the database, not the repository. Hmmm, that is confusing.

When in “test”, the universe should use the connection “Test DW”. This points to a parallel instance of the database used for reporting. During the export to production, the connection is changed to “Prod DW”. Now you are pointing to the production warehouse instead of test.

But this has zero impact on the repository. Unless you are importing / exporting universes all the time, and unless your universes are quite large, I am not sure how the mechanics of developing a universe could cause a severe impact on a production server.

Remember that the repository is nothing more than a storage area. All development for reports and universes is done on a local workstation. It doesn’t matter where the repository is once you have imported a universe (or document) to work on… the interaction with the repository is done at that point.

Regards, Dave Rathbun
Integra Solutions www.islink.com
Got a FAQ idea? email BUSOBListFAQ@aol.com Conference Travel Ideas: http://www.MomentsOfLight.com/trips_ut_boconf.html

Listserv Archives (BOB member since 2002-06-25)

#18

please explain “work group mode”. i thought a “save as” creates a new universe id. can you clarify?

thanx.

dave

DRathbun@AOL.COM@LISTSERV.AOL.COM on 09/07/2001 12:30:19 PM

Please respond to BUSOB-L@LISTSERV.AOL.COM

Sent by: BUSOB-L@LISTSERV.AOL.COM

cc:

In a message dated 01-09-07 10:57:52 EDT, you write:

Actually, I think it strips off the universe id, making the universe look
like it’s never been exported to a repository.

{ snip }

won’t “save as” change the universe id?

Yes, on both accounts. However, and I have tested this on V5 but not V4, when
you export with “allow universe overwrites” turned on and BusObj encounteres
a universe with the SAME NAME it will prompt, do you want to overwrite this universe. It appears that the existing universe ID is then assigned to the
new export, which is what you want to happen.

In other words, I have two repositories. In one, Universe “FINANCE” has Universe ID 12. In the other, it has ID of 27. When I export to the first repository, everything goes well. Now I do a “Save As” to move FINANCE to workgroup mode. What is the ID? It is undefined. As Chris said, it is as if the universe has never been exported.

Next, log out, and log back in using the second KEY file. When you export FINANCE, it notices that there is already a universe with that name, and ID 27. If you overwrite the universe, the “new” never-before-exported FINANCE universe becomes 27, instead of a brand new ID.

You probably want to test this to verify, but I believe that this is what I found last time I walked through the process.

Regards, Dave Rathbun
Integra Solutions www.islink.com
Got a FAQ idea? email BUSOBListFAQ@aol.com Conference Travel Ideas: http://www.MomentsOfLight.com/trips_ut_boconf.html

Listserv Archives (BOB member since 2002-06-25)

#19

Living on the west coast and sleeping at night can be a real pain. This thread has gotten fun and I missed it.

Basically, what Dave said (thanks Yoda) is the right answer. You have to think of the BO security domain the same way you think of your network security. If you were doing an LDAP implementation, would you have 2 LDAP directories?

The security domain is the only part of this that should be centralized. The other domains can give you exactly the separation you want.

The benefit of this is that you can have actual users do some testing for you before you roll things out.

Whether you separate the WebI servers or not is up to you.

Listserv Archives (BOB member since 2002-06-25)

#20

In a message dated 9/7/01 12:46:37 PM Central Daylight Time, stoll_david@JPMORGAN.COM writes:

<< please explain “work group mode”. i thought a “save as” creates a new
universe id. can you clarify? >>

Workgroup mode remove the security bit. Essentially it makes the universe look like it had never been exported. As I mentioned earlier, it does not create a “new” universe ID, it removes the existing one.

Example: Island Resorts Marketing. Unless you export it to the repository, it is in “workgroup” mode… no security, no universe ID. Doing a “Save As” demotes a universe from secured, repository stored to un-secured.

Regards, Dave Rathbun
Integra Solutions www.islink.com
Got a FAQ idea? email BUSOBListFAQ@aol.com Conference Travel Ideas: http://www.MomentsOfLight.com/trips_ut_boconf.html

Listserv Archives (BOB member since 2002-06-25)