We are trying to set up universe folder security. As of now all the universes are in Universe main folder.
Is it mandatory to have all the universes in sub-folders under universe main folder.
for example: Under Univ main folder
sub-folder1: Finance, under this all the FI universes will be saved
sub-folder2: SD, under this all the SD universes will be saved.
What are the benefilts of doing this way. Is it advisable to do like this as I need to assign the security to each folder/ sub-folder.
It is better to give the security as mentioned below:
On Root folder : Administrators: Full Control, Everyone : No Access
Now you need to add the required users/user groups for the sub folders and give the required access for those folders.
Generally, best practice would be to use folders. Give groups rights to the folders as needed, similar to public (document) folders. That said, if you end up with only one universe per folder, there is little value.
Again, a general rule is to give rights to folders, not individual objects (documents, universes, etc.). Of courser, connections don’t give you a choice … there is no folder structure. And connections are often one-to-one with universes.
I haven’t been much help here. Personally, I use universe folders, but can easily make the argument that they are not necessary.
I don’t use folders for my universes so the way I’ve done it is as follows. It’s a little tricky setting it up but seems to work fine!
Grant Everyone View access on the root folder of Universes.
For each universe, firstly grant Everyone No Access. This makes sure that users can’t see the universes they’re not supposed to see when creating new reports
Then for each universe, grant View on Demand for the groups that specifically need to use that universe (assuming you’re allowing refreshing of reports on demand).
For the universe connections, I simply grant View on Demand to Everyone for every connection because they can’t do anything with the connection itself unless they have access to the universe
If you are using XI 3.x, you can change the approach to your point 1, so that point 2 is not necessary!
Create a custom access level that has ONE AND ONLY ONE right:
Under the Content collection, and Folder type (do not use General, General) …
Grant the View Objects right …
On the far right, select to apply to Object only (not sub-objects)
Now give this custom access level to the Everyone group on the universe root folder. This allows the user to see the root folder, but nothing in it. That way, by default when a new universe (or folder) is added to the root, the user will NOT see it … unless they are later given specific rights to do so.
In theory, if you have security across different universes … a developer could change the connection and get access to something they shouldn’t … a small hole, but i’d still lock down connections
(BOB member since 2002-09-19)
(BOB member since 2002-09-19)