How do your users set database credentials?

security CMC
1

We currently have a custom jsp solution in XI3.1 that enables our users to set their database credentials. I would like to move away from custom coding if possible and am looking for alternatives.

I never understood why setting database credentials is done in the CMC. It’s not intended to be an end-user tool, and when would it be appropriate for a BO admin to know users’ database passwords?

So, I’m curious how other people manage this. Do you have your users use CMC to set their credentials, or do you use some other solution?

joepeters :us: (BOB member since 2002-08-29)

2

If using Oracle would a VPD work for you?

http://scn.sap.com/thread/1199494

Mak 1 :uk: (BOB member since 2005-01-06)

3

Thanks, Mak. Not sure if our DBAs will go along with it, but it looks like it would make the user management a lot easier.

joepeters :us: (BOB member since 2002-08-29)

4 
DBAs in Doing as Little as Possible Shock!

:rotf:

Try and sell it to them on the basis that they will be able to see which users are running each query on the database.

Mak 1 :uk: (BOB member since 2005-01-06)

5

Is single sign-on to the database an option for you? There are some limitations to this but it would eliminate the need for them to change their database credentials.

6

I’ll try that!

joepeters :us: (BOB member since 2002-08-29)

7

We’ve never done that, and I didn’t find much info here. Do you have any pointers?

joepeters :us: (BOB member since 2002-08-29)

8

We haven’t done single sign-on to the database. We have recently looked at how we handle our database logins also. The DBAs like the single sign-on option for Mak’s statement, they would know exactly who the users were. The problem we ran into is that the login credentials for this are not cached as far as we could tell. Because of that, the user couldn’t schedule a report to run at a time when they weren’t logged in. Because of this we had to abandon the single sign-on route.

I didn’t do the testing myself, but this is what I was told.

If you add

--user:@variable('BOUSER')  --universe:@variable('UNVNAME')  --doc name:@variable('DOCNAME')

to the END SQL parameter of your universe, it will pass the user’s login, the universe they are using, and the WebI document that they are using as a comment at the end of the report SQL that is passed to the database. (This code is for SQL Server). If they are running or scheduling a Crystal Report, it will only pass the BOUSER variable or the user’s login to the database.

You could use this in conjunction with a database authenticated login for Business Objects. You could use the database login either with a login for each database, for each database server, or for each Business Objects environment. This gets you away from using the user database credentials completely.

It really comes down to negotiation with your DBAs to find a balance between good security practices and maintaining Business Objects functionality for your users.

EDIT: Instructions for setting up single sign-on to the database are in the Administrator’s Guide.

9

Are you doing this for my beloved “Crystal Reports” or what is the true reason behind your requirement, please?

Andreas :de: (BOB member since 2002-06-20)

10

No, not CR. They are actually DeskI reports that we’re converting to WebI as part of our BI4 upgrade.

Our users all have Oracle IDs that are created primarily for another business application. The secondary usage is for reporting in BO. So the queries that are generated in BO need to reflect the access restrictions applied in the database.

Joe

joepeters :us: (BOB member since 2002-08-29)