XIR3.1: Hiding kernel universes - allowing create/refresh

security CMC
1

I have the followng structure:

Folder 1: Universes A and B
Folder 2: Universe C (Kernel)

All reports are built from universes A and B, which are based on the kernel universe (Universe C). I want to allow users to create and refresh reports from universes A and B, whilst hiding Universe C.

I have managed to hide Universe C by applying Jonathan Stokes solution from another thread (setting No Access to Folder 2) so I have blocked access to Universe C. The trouble is that I now cannot create / refresh reports from universes A and B and get a “Cannot load linked universes: UNV0011” error.

I granted Everyone full control over “Connection Z” (which Universe C uses) in “Connections” (which all three universes use) and thought that would solve it but it hasn’t. Am I missing some other command reference here? Could anyone advise? Thanks

BO_Beast :uk: (BOB member since 2004-10-11)

2

For Webi documents, I list a solution in this thread:

https://bobj-board.org/t/157916/3

I haven’t found a way to do it for Deski documents.

BoB LoblaW :us: (BOB member since 2007-10-23)

3

Hi.

I am facing the same problem.

Did you find a solution for DeskI?

Regards,
Michael

fornofm :de: (BOB member since 2004-08-23)

4

No solution for deski since you need to be able to open all the universe folders …

5

It is fine to open the universe folder, I could live with two universes being displayed.

But I need to add “Data Access” as well as Create and “Edit Queries Based on Universe” as well as “View Objects” on the kernal universe.

This kernal universe must NOT be accessed by users. With the settings above it is usable with no restriction.

Removing “View Objects” works in WebI, but leads to not importing the kernal universe in DeskI (Error msg: Cannot load linked universes. (UNV0011)).

How to protect the kernal universe?

fornofm :de: (BOB member since 2004-08-23)

6

Michael,

It is possible that this approach may help you…
https://bobj-board.org/t/114475/12

Cheers,

Mark.

Mak 1 :uk: (BOB member since 2005-01-06)

7

Thanks Mark.

I followed the other thread and indeed implemented a solution with hiding objects in the kernal universe.

Furthermore I created a derived universe which links in the kernal universe and made the classes/objects visible. This allows power users to use this universe.

In all other existing derived universes, which have access restrictions configured, I made the classes/objects visible too.

I did this with XI 3.1 SP3 (server and client tools) and it works perfectly.

Only downside: Our users have an older client tools version 12.1.0.882 (SP1?) and there the objects in the derived universes are not visible (those hidden in the kernal universe and made visible again in the derived universe)!

We are currently installing the old version and double-check the behaviour. However, we need to upgrade the clients anyway.

fornofm :de: (BOB member since 2004-08-23)

8

Hi Michael,

Even though I’m not a fan of linked universes, it sounds like you have provided a good solution 8).

:!: This, however, is a big no, no :).
You won’t believe the problems I have seen, at various sites, when the clients are patched to a different level to the server.

Also, I believe that if any insurmountable issues arise and you have the misfortune to have to involve SAP, they would say you were running an unsupported configuration.

I would advise doing this on a fresh machine, you may face issues trying to install on a machine that, previously, had the newer version client tools installed.

All the Best,

Mark.

Mak 1 :uk: (BOB member since 2005-01-06)

9

I didn’t find any solution that was clean. I find it unbelievable that something so fundamental worked in version 5 only to be removed in XI. Still I allow it to be seen but:

  1. " *** DO NOT USE ***" in the universe name
  2. I employed a zero time and zero rows restriction on the universe so that nothing meaningful ever returns

Poor, but the best of a bad job!

BO_Beast :uk: (BOB member since 2004-10-11)