Monday, January 10, 2022

Granting Service Administrator privilege to OAC instance

 When working with Oracle Analytics Cloud (OAC) certain users need the super user privileges. The Service Administrator. The user that created the instance gets it by default. The standard setup of inside OAC (Console->Users and Roles->Application Roles->BI Service Administrator) is not enough.

One of the major problems is connecting to Data Modeler Client and getting an Error while all parameters seems fine.




 Most of what we need can be found in the A-Team blog, Provisioning Oracle Analytics Cloud Natively in Oracle Cloud Infrastructure. I will summarize the relevant parts.

When creating OAC instances, if the user is not OCI (Oracle Cloud Infrastructure) Admin, the user should be assigned to a group and the group should get a privilege to manage analytics-instances in the relevant compartment  see here for more about privileges.

allow group <IAM Group> to manage analytics-instances in compartment <Compartment>

 

Next we should get to the IDCS screen. Find the relevant Oracle Cloud Service and assign the User, Group or Application Role to the ServiceAdministrator Application Role.

This the detailed description of the above paragraph:

From Burger menu on the left select Identity & Security and Federation:

There click on the Identity Provider

 

And press the Oracle Identity Cloud Service Console link:

There select the burger menu and Oracle Cloud Services:

You might have one or many services there. Find the ANALYTICSINST that is relevant to you and click on it.

Now find the Application Roles tab. There click on the menu (on the right) for Service Administrator and assign User, Group or Application Role to it.

Once you select an option, a search screen with all possible values appears.

Select who you want to add to Service Administrator Application Role.



If you are interested in the relationship between "Application Roles Available in Oracle Cloud Infrastructure Console" and "Permissions in Oracle Analytics Cloud", you can find it here:

 https://docs.oracle.com/en/cloud/paas/analytics-cloud/acabi/users-and-groups.html#GUID-811DEC21-ECF8-4E98-86F3-8BC2088A11A4


 Basic table from documentation:

Application Roles Available in Oracle Cloud Infrastructure ConsolePermissions in Oracle Analytics Cloud

ServiceAdministrator

Member of BI Service Administrator, BI Data Model Author, and BI Data Load Author. Allows users to administer Oracle Analytics Cloud and delegate privileges to others.

The user who creates the service is automatically assigned this application role.

ServiceUser

Member of BI Content Author and DV Content Author.

Allows users to create and share content.

ServiceViewer

Member of BI Consumer and DV Consumer.

Allows users to view and explore content.

ServiceDeployer

Not used in Oracle Analytics Cloud.

ServiceDeveloper

Not used in Oracle Analytics Cloud.

Detailed table from Analytics perspective: 

Predefined Application
Role in Oracle Identity
Cloud Service

Default Members

Description

Predefined Application Roles in Oracle
Analytics Cloud

ServiceAdministrator

Administrator who created the
service

Allows users to administer Oracle Analytics Cloud and
delegate privileges to others using the Console.

BI Service Administrator

ServiceAdministrator

BI Service Administrator

Allows users to manage data models in Oracle
Analytics Cloud using Data Modeler

BI Data Model Author

ServiceAdministrator

BI Service Administrator

Allows users to load data.

BI Data Load Author

ServiceUser

BI Service Administrator

Allows users to create visualization projects, load data
for data visualizations, and explore data
visualizations.

DV Content Author

ServiceUser

BI Service Administrator

DV Content Author

Allows users to create analyses and dashboards in
Oracle Analytics Cloud and share them with others.

BI Content Author

ServiceViewer

DV Content Author

Allows users to explore data visualizations.

DV Consumer

ServiceViewer

DV Content Author
BI Content Author

BI Data Load Author

Allows users to view and run reports in Oracle
Analytics Cloud (projects, analyses, dashboards).
Use this application role to control who has access to
the service.

BI Consumer

ServiceDeployer

ServiceDeveloper

 

 

Not used






Custom link to DV (Self Service) from Classic OAC / OAS menu

 In the header of Classic Analytics in OAC/OAS customers often look for a link to the Self Service Analytics (often referred as DV). 

From this

To this

We can easily achieve it. Using the Console in OAC/OAS.

In OAC Self Service interface select the Console Menu:


There select System Settings

 


There update the Custom Links XML

The simple version is:

<?xml version="1.0" encoding="utf-8"?>
<customLinks xmlns="com.siebel.analytics.web/customlinks/v1">
    <link id="1" name="DV" description="Self Service" src="https://YOUR_SERVER_NAME/ui/dv/" target="blank" >
        <locations>
            <location name="header" insertBefore="catalog"/>
        </locations>
    </link>
</customLinks>

Replace the YOUR_SERVER_NAME to the one relevant to you.

The XML can be enhanced with icons (for example iconSmall="common/info_ena.png" after the target="blank" parameter) or set for specific privileges (adding <privilege> block)... or placed in different locations (change the insertBefore value)... Other links can be added with additional link blocks with unique ids...

After the settings update, Restart the server is required.