BI Security (1).ppt

Business Intelligence/ Business
Warehousing

What is BI/BW
SAP BI/BW is the name of the Business Intelligence, analytical, reporting
and Data Warehousing solution produced by SAP AG. It was originally
named SAP BIW (Business Information Warehouse), then abbreviated to
SAP BW, but is now known as “SAP BI” at the end user level. In contrast,
“BW” is still used to describe the underlying Data Warehouse Area and
Accelerator components. It is often used by companies who run their
business on Sap's operational systems.
BI has a multilevel architecture to provide the maximum degree of
flexibility. BI can extract and use data from a variety of sources. These
include all my SAP Business suite components (my SAP ERP
, CRM, PLM,
SCM, SRM, R/3, APO); non-SAP systems; flat files; XML files; web services;
commercial data providers; and even other BI systems. The BI server
provides all the tools necessary to model, extract, transform, aggregate,
store, and access data. Since the description of the data, regardless of its
source, is contained in a common metadata repository, data from a
variety of sources can be combined to give you enhanced data analysis
options. BI users can access data through the Business Explorer suite,
Enterprise Portal, Information Broadcasting, any standard Web browser,
or certified third-party reporting tools.

Why BI/BW
SAP BW serves to integrate, transform, and consolidate data from all
areas of an enterprise in order to provide this for analysis and
interpretation. This includes confidential corporate data, for example,
personal data from Personnel Administration. Decisions are made in all
enterprise areas and target-oriented actions are determined on the basis
of this data.
Data Warehousing with SAP BW forms the basis of an extensive
business intelligence solution to convert data into valuable information.
Integrated and company-specific data warehousing provides decision
makers in your company information and knowledge for goal-oriented
measures that will lead to the success of the company. For data from any
source (SAP or non-SAP sources) and of any age (historic or current),
Data Warehousing with SAP BW allows:
 Integration (data retrieval from source systems)
 Transformation
 Consolidation
 Cleanup
 Storage
 Retrieval for analysis and interpretation

All the data from daily
business transaction is entered
into the R/3 system. E.g.
Sales Orders
…
Data is in the R/3 system but
not analyzed further.
In order to use this
information for financial
statements, information of
stakeholders etc. there needs
to be an environment that
enables the business to
analyze its data. Therefore all
the data, the business thinks is
relevant for analysis, is loaded
into the Business Warehouse.
R/3
BW
The data that is loaded
into the BW system needs
to be stored somewhere.
It is put in “Data Store
Objects”.
Data between R3 and BW

All the data is now in the BW system, but up to now
it cannot be used for meaningful analysis or
interpretation as it is not sorted.
We could say it’s a wild mixture of numbers.
In order to be able to use the business data
sufficiently, reports are build that select the data that
will be analyzed. (only picks relevant parts of the data
from)
The requirement what kind of data and in which
relationship it should be presented, comes from the
different process areas.
Report requirements could be:
- Sales per Company
- Accounts Receivable per Customer
Company
Sales
Customer
AR

We now have reports that sort the data for the
stakeholders and make “sense” of it. However, it
also needs to be arranged that an end user can
actually see and run the report himself.
Company
Sales
In order to give an user access to a specific report, it
needs to be included in his role. (Links User and
Report)
Reports are always included in so called Menu/Report
Roles
+

Now the end User is able to see the reports and
also all the data.
However, you don’t want everybody to see all
the data for the world wide organization.
Therefore you need to restrict the peoples access
to specific data in the report.
E.g A user in Hungary should only see Hungary data
when he is running a report and not the data for
Germany, UK etc.
+
+
+
+
Therefore concept called Qualifiers is used to determine
for which Organizational Value an End user should see
data in the reports.

BW Information Model Overview
SAP’s BW information model is based on the core building block of
Info Objects which are used to describe business processes and
information requirements. They provide basis for setting up
complex information models in multiple languages, currencies,
units of measure, hierarchy, etc. The key elements in the SAP’s
BW information model are:
 Data Sources
 Info Sources
 ODS Objects
 Info Cubes
 Info Providers
 Multi Providers

 Data Sources: DataSources are flat data structures containing data
that logically belongs together. They are responsible for extracting
and staging data from various source systems.
 InfoSources : InfoSources are the group of InfoObjects that belong
together from a business point of view. It contains the transactional
data obtained from the transactions in online transactional
processes (OLTP) and master data such as addresses of customers
and organizations, which remain unchanged for longer time period.
 ODS objects :An ODS object is a dataset which is formed as a result
of merging data from one or more info sources. In it information is
stored in the form of flat, transparent database tables that are
used for preparing reports and quality assurance purposes.

 InfoCubes : InfoCubes are multidimensional data storage containers for
reporting and analysis of data. They consist of keys figures and
characteristics of which latter is organized as dimensions facilitating
users to analyze data from various business perspectives such as
geographical area or types of sales channel.
 InfoProviders : InfoProviders refer to all the data objects that are
present in the SAP BW systems. These include all the data targets viz.
InfoCubes, ODS objects and master data tables along with Info sets,
remote Infocubes and MultiProviders.
 MultiProviders : MultiProvider is a virtual information provider which is
a combination of any two physical or virtual info providers.
MultiProviders do not contain any data and are used to combine data
from different info providers. Their main purpose is to make this data
accessible for reports and analysis.
E.g InfoArea = group of InfoCubes
InfoCube = actual data
InfoObject = field (for example: company code, plant, or cost
center)

Security in R3 Vs BW
R/3 (OLTP)
Primary operation: Update Process
Type of data: Detailed
Updates to data: Frequently
No of transactions/user: Many
Transaction code
Specific field values
Which activities a user could perform

BW (OLAP)
No creation of sales orders, material master records
No updating of business data in SAP BW
Primary Operation: Displaying Data and Analyzing Results
Type of data: Summary
Updates to data: Less frequent, new data only
No of transactions/user: Few
The data itself
InfoArea
InfoProvider (InfoCube, ODS objects etc.)
Queries

Security Authorization Objects for BW
Security in SAP is controlled through authorization objects. The SAP Business
Information Warehouse BIW, has a set of authorization objects specific to BW which
control security in BW. Primarily there are two classes of authorization objects in SAP
BIW. They are in the areas of BIW – reporting and BIW – administration. The BIW
reporting authorization objects are used for field level security in BW reporting. The
BW administration objects are used to secure administration functions in business
information warehouse. Below are some of the authorization objects in the above two
areas of BW security.
SAP Business Information Warehouse Reporting
- S_RS_COMP
- S_RS_COMP1
- S_RS_FOLD
SAP Business Information Warehouse Administration
- S_RS_ADMWB
- S_RS_IOBJ
- S_RS_ISOUR
- S_RS_ISRCM

SAP BW Security Transaction Codes
Transaction Code Description
RSA1 Transaction RSA1 is the main transaction for administrative
functions in SAP BW (Administrator Workbench)
RSD1 This transaction code can be used to mark objects as relevant for
authorization (Info Object Maintenance)
RSSM This transaction code can be used to create and modify
authorization objects in SAP BW
RSECADMIN Transaction for maintaining new authorizations. Management of
Analysis Authorizations.
RSZV This transaction code is used to create or modify the variables for
authorization checks. (Variable Maintenance)

SAP BW Security Tables
RSECVAL Authorization Value Status (Used to check if
info provider exists in Analysis Authorization
TCTlow)
RSECHIE Status of Authorization Hierarchies
RSDCHA Characteristic Catalog
RSDATRNAV Navigation Attributes
RSDICMULTIIOBJ MultiProvider : Selection/Identification of
InfoObjects . This Table helps us to find which
infoprovider has a check on certain Attributes.

BW Data Access Strategy – Modular Concept
Shell
Finance STBC PGS
PGS
Reports
etc.
GB01 HU01
HK07
etc.
etc.
BW
System:
Functional Access:
Control functional
level via InfoCubes
Data Access:
Control organizational
level via InfoObject
authorizations
 Access
is
controlled
on 3 levels
Menu Access:
Control report level via
queries
BW
Reports
SAP
Standard
Authorizati
on Objects
SAP
Standard
Authorizati
on Objects
SAP
Reporting
Authorizati
on Objects
(Customer
defined)

Summary: BW Access Restrictions – Modular
Concept
BW
Reports
Level 1 – Functional area via InfoCube(s)
 Lowest granularity
 Grants access to complete InfoCubes /
MultiCubes including all reports and data of a
reporting area
Level 2 – Reports via technical query name:
 Medium granularity
 Grants access to certain sets of reports (via user
menu + query naming convention)
 Determines possible activities on reports (create –
execute)
Level 3 – Organizational delimitations via
InfoObjects
 Highest granularity
 Restrict access to data via certain InfoObjects (e.g.
Company Code, Plant, Purchase Organization …)

Security Changes in BI 7.0 IV
Authorization check up to BW 3.5
 Access to Multiprovider?
 Access to Query?
 Access to the selected Data?
 Does the user have the Reporting Authorization
Object that is activated on that Multiprovider
assigned in his role? (RSSM)
 Does the user have the entries he selected in his
field values for the Reportig Authorization
Object?
 If all of them are answered positively
the query result will be displayed.
Authorization check from BI 7.0
onwards
 Access to Multiprovider?
 Access to Query?
 Access to the selected Data?
 Does the user have an analysis authorization that
contains all the “authorization-relevant”
characteristics and navigational attributes that
are included in that Multiprovider filled with at
least a “:”?
 Does the user user have the entries he selected in
his analysis authorization?
 If all of them are answered positively
the query result will be displayed.

Analysis Authorizations in BW
All users who want to display transaction data from authorization-
relevant characteristics or navigation attributes in a query require
analysis authorizations. This type of authorization is not based on
the standard authorization concept of SAP. Instead, these
authorizations use their own concept that takes the features of
reporting and analysis in BI into consideration. As a result of the
distribution of queries using the BEx Broadcaster and the publication
of queries to the portal, more and more users can access query
data. Using the special authorization concept of BI for the display of
query data, you can protect especially critical data in a much better
way.
 Analysis authorizations are not based on authorization objects.
Instead, you create authorizations that include a group of
characteristics. You restrict the values for these characteristics.

 The authorizations can include any authorization-relevant
characteristics, and treat single values, intervals, and hierarchy
authorizations in the same way. Navigation attributes can also be
flagged as authorization-relevant in the attribute maintenance for
characteristics and can be added to authorizations as separate
characteristics.
 You can then assign this authorization to one or more users.
 All characteristics flagged as authorization-relevant are checked
when a query is executed.
 A query always selects a set of data from the database. If
authorization-relevant characteristics are part of this data, you have
to make sure that the user who is executing the query has sufficient
authorization for the complete selection. Otherwise, an error
message is displayed indicating that the authorization is not
sufficient. In principle, the authorizations do not work as filters.
Hierarchies are mostly restricted to the authorized nodes, and
variables that are filled depending on authorizations act like filters
for the authorized values for the particular characteristic.

Follow these steps to create your authorizations
InfoObject Maintenance (RSD1):
1. Define authorization-relevant characteristics This will be done
once for each object
2. Define authorization-relevant attributes Very limited task
Management of Analysis Authorizations (RSECADMIN):
3. Add Special Authorization Characteristics
4. Authorize Characteristic Values
5. Authorize Attribute Values
6. Authorize Hierarchies
Maintenance of Analysis Authorizations

Authorization-Relevant Characteristics
Before restricting
authorizations on
characteristics, you
have to mark them as
authorization-relevant

• Special authorization characteristics must be assigned to every user
in at least one authorization
– InfoProvider
– Validity
– Activity
Special Authorization Characteristics

The User Group is
only authorized for
Company Code
GB01
Authorizing Characteristic Values

Authorizing Characteristic Values
Possible Values
• EQ: Single Value
• BT: Range of Values
• CP: Contains (simple) patterns ending with * (e.g.
GB*)

In the same way as with
value authorization, you
can also grant
authorization
on hierarchy levels
Authorizing Hierarchies

Authorizing Hierarchies
You have now
granted
access for overall
Europe

* (asterisk)
• Denotes a set of arbitrary characters
• Used alone – grants access to all values
• Used at the end of a value to specify a specific pattern
: (colon)
• Allows access only to aggregated data
+ (plus)
• Denotes exactly one character
• Used at the end of a value to specify a specific pattern
# (hash)
• Stands for initial or unassigned values
Special Authorization Value

Common Security BW Issues we might encounter
 No Authorization for component YQYxxxxx (Technical Query Name is
missing in Role Menu) -
 You do not have sufficient authorization for InfoProvider ZMPCAM_1
(InfoProvider missing in Analysis Authorization) -
 You do not have sufficient authorization (Selection Criteria in the
variable screen was wrong) -
 You do not have sufficient authorization (Value missing e.g. Company
Code NO5)

Trace in BW
You have the possibility to either:
 Execute a query as another user
 Look at the Error logs for a specific
User

Executing Query with another User

Error Logs
As within RSSM you need
To configure the log
Recording first  Add the
User

Enter the user and adjust
Time and Date and you will
Get the Number of Logs for
That user
Select the relevant entry
And the log file will be
displayed

Reporting in SAP BW
 The collection of reporting tools available with SAP NetWeaver
Business Intelligence (BI) 7.0 is referred to as the Enterprise
Reporting, Query, and Analysis Information Technology (IT)
scenario. The core tools found in the BI suite are referred to as the
Business Explorer (BEx). These BEx tools provide business users with
the ability to design, create, analyze, and distribute data that
results in improved decision-making capabilities.
The BEx suite consists of the following tools:
 EE BEx Query Designer
 EE BEx Report Designer
 EE BEx Web Application Designer (WAD)
 EE BEx Web Analyzer (Web-based tool)
 EE BEx Analyzer (Excel-based tool)

 The BEx Query Designer is the main tool for designing queries and
generating data to analyze with an InfoProvider (i.e., InfoCube). The Query
Designer lets a business user take advantage of Online Analytical Processing
(OLAP) features such as variables, hierarchies, and custom formulas called
calculated key figures. Defining exceptions or conditions and creating a
customized matrix of rows and columns for a report is easily accomplished
without any programming required.
 The BEx Report Designer tool is a new as of BI 7.0. It has been added to
the suite to fill the gap around formatted reporting. Earlier criticisms of
SAP BW usually highlighted its inability to create presentation-quality
reports. The Report Designer serves this purpose by taking the output from
the Query Designer — a query definition — and transforming it by changing
fonts, text, row/column heights, colors, etc. It also allows a designer to
insert text, graphics, charts, headers, and footers.
 The BEx WAD is another standalone tool that a report designer can use to
build reporting applications that are optimized for the Web. A what-you-
see-is-what you-get (WYSIWYG) interface allows for the integration of
basic word processing capabilities with BI-specific c content. Web items
delivered by SAP include buttons, filters, dropdown boxes, analysis grids,
charts, and maps.

 The BEx Web Analyzer is an ad hoc analysis tool that is browser-based and
provides zero footprints in terms of desktop application software because
it requires no specific installation to use. The browser is linked to a
specific SAP BI system and allows a user to drill down on a navigational
state of a report and save this preferred view of the data for future use.
 The BEx Analyzer is integrated with Microsoft Excel and is accessible by
installing the SAP Graphical User Interface (GUI) add-on for BI. Data is
embedded into Microsoft Excel workbooks providing users with drag-and-
drop capabilities to drill down and filter the data using SAP BI OLAP
functions. Excel functions and features can be used to augment the
analysis or to provide additional capabilities. Users can also leverage Visual
Basic Applications (VBA) to create customized programs. As of BI 7.0, the
BEx Analyzer comes with a second SAP BI–delivered toolbar that provides a
rich set of design tools that allow for interactive applications to be
constructed in a manner similar to that found in the SAP WAD

Thanks everyone for
your time ..

BI Security (1).ppt

Recommended

More Related Content

What's hot (20)

Similar to BI Security (1).ppt (20)

Recently uploaded (20)

BI Security (1).ppt