11g, 12c, 19c, admin, obiee, security, standard configuration

Many times I come across posts and emails asking for help on specific configuration changes or questions asking for help achieving certain things.

Long story short – you can over-complicate everything if you don’t look at what the standard gives you efore going off and hacking / scripting things in an uncontrolled fashion that will come back to haunt you when you patch or upgrade.

Case in point: Implementing new, custom links which should react to standard security privileges.

As in: Adding a link is documented by Oracle, but how can you make this link react to standard privileges which are tied to your Application Roles?

Oracle provides the out-of-the-box functionality of custom links since several years with all the usual bells and whistles. Problem is, that by far not all options are documented in detail with examples. Top tip here: guess what you will never have everything in the documentation, so the important thing is where to look for more information.

Enter the XSD! Every configuration XML comes with an accompagning XSD style sheet which maps all elements and attributes that the XML supports. Find that XSD and you have all the documentation you could ever want. Following the example of making links dependent on OOTB security privileges:

Here we see one of our administrators (prodney) logged in and seeing two custom links rendered. The “SampleApp V607 Index” and the “Custom Link” which is a link to the documentation. Now we don’t want non-admin users to be able to access the documentation link. So how do we go about this?

The customlinks.xml controls the rendering of custom links as described in the official documentation: https://docs.oracle.com/middleware/bi12214/biee/BIESG/GUID-FF6954BA-2DE0-4422-BA58-05F32936F4FF.htm#BIESG3738

That XML file itself is goverened by the customlinks.xsd file. In there we find the following information on the privilege usage:

<xs:attribute name="id" type="xs:string" use="required" />
<xs:attribute name="iconSmall" type="xs:string" use="optional" />
<xs:attribute name="privilege" type="xs:string" use="optional" />
<xs:attribute name="src" type="xs:string" use="optional" />

Now let’s look back at the documentation and an

<link id="l1" name="OTN" description="OTN open in new window" src="http://www.oracle.com" target="blank" >
      <location name="header" />

My customlinks.xml says the following for the “Custom Link” one:

<link id="l2" name="Custom Link" description="Instructions on how to insert a custom URL on OBI EE headers" src="http://docs.oracle.com/cd/E23943_01/bi.1111/e10541/answersconfigset.htm#BIESG3738" target="blank" iconSmall="common/info_ena.png">
        <location name="header" insertBefore="home"/>

Nice. Now let’s add 1 and 1.

“id” and “source” are both attributed of “link” just like privileges which gives us the necessary indication of how to use it.

<link id="l1" name="SampleApp OTN Page"  [skipped...] privilege=" hmm what goes here=?! ">

For the content of the “privilege” attribute we simply refer back to the documentation again:

<link id="l1" name="SampleApp OTN Page"  [skipped...] privilege="privileges.Access['Global Admin']">

Which puts the whole entry in the customlinks.xml to this:

<link id="l2" name="Custom Link" description="Instructions on how to insert a custom URL on OBI EE headers" src="http://docs.oracle.com/cd/E23943_01/bi.1111/e10541/answersconfigset.htm#BIESG3738" target="blank" iconSmall="common/info_ena.png" privilege="privileges.Access['Global Admin']>
        <location name="header" insertBefore="home"/>

Restarting things will now give me the same resutl for my administrative user “prodney”:

And the correctly secured result for my non-admin user “testuser01”:

Piece of cake.

installation, OBI, obiee, OTN, sampleapp

Every week between OTN, stackoverflow, and direct questions sent to my email accounts there are 2-4 occurrences of “How do I install OBI on Windows 7/8/10” or “I am having issues with installing OBI on Windows”.

In order to clear up this topic once and for all – here is the ultimate guide to running Oracle BI on your Windows desktop OS:

  1. Download VirtualBox

  2. Install VirtualBox on your machine

  3. Download all image files for the Oracle BI Sample Application
  4. Deploy the VM in your local VirtualBox installation according to the Deployment Guide
  5. Start your deplyoed SampleAppVM via your VirtualBox Manager

  6. Use the “Start” icon to start both the database and the full Oracle BI stack inside the VM

  7. Let the script run its course until all services are up and the leave that terminal window open

  8. Open Firefox inside the VM and click the “OBIEE Login” bookmark

  9. Log on using “weblogic” / “Admin123” (without the quotes)
  10. You’re in. You’re done. That’s it. You have a fully functioning OBI environment with about 5 gazillion more things compared to what you could ever come up with yourself.

Now it you haven’t stopped reading yet because you thought “Hey wait this isn’t a Windows installation” let me explain a couple of things:

Point #1: Oracle BI is a server tool. It isn’t your WhatsApp desktop, it isn’t your Chrome/Firefox/Safari. It’s actually a whole range of servers and as such not something you run on a desktop operating system. And because of that:

Point #2: It is NOT supported on Windows desktop operating systems!
If you go to the Fusion Middleware Supported System Configurations page and open the certification matrix for the current version you will find that the only mention of anything “Windows” are 2012 and 2012R2:

No 10, no 8, no 7, no ME, no XP, no 98, no 3.1 … you get the point. No. Desktop. OSs.

Point #3: That means that Oracle will never bother to test things fully or help you out if you mess up things or can’t get something to run because you installed on a Windows desktop OS. You’re on your own.

Point #4: Even if you make it run or clamour “But I’ve seen tons of videos where” it works like someone recently did – I don’t care and neither will Oracle in terms of their product development or support. Sooner or later you will run into follow-up issues and scratch you head and go mad because things just don’t work or not as expected / in a weird fashion.

People this is how technology works. An Android app is an Android app and not usable on iPhone unless the company making it actually releases an iPhone app. Ask any iPhone user and gamer how they felt between the Android release of Pokemon GO and the iPhone release last year.

To use another example: You shouldn’t fill up a diesel-engined car with petrol just because you always took petrol from the pump or whatever unvalid reason you can conjure up. Well you can but don’t complain afterwards that your engine is busted

Got it now? Thanks!

12c, dashboard, OBI, obiee

A new functionality has been introduced in the latest release of OBI – – which has gone a bit unnoticed since it hasn’t been included in the documentation anywhere. This is surprising since it’s been requested since a long time.

Dashboard subpages!

As of this release the usual 3-level dashboard hierarchy has been transformed into a 4-level one:

  • Dashboard group
  • Dashboard
  • Dashboard page
  • Dashboard subpage

dashboard sub-pages

Configuration is very straight-forward. Just click the usual “Add” button which will give you two options as of now:


admin, answers, OBI, obiee

Working on a system without full access can often be a pain and prevent you from being able to get information necessary for your work. One of those areas is access to system variables. Good thing is. that bits and pieces are flying around all over the web and can be found for example both Oracle’s own SampleApp or this little gist here from @rmoff.

I’ve started mixing and matching together as much as possible of “things you can potentially get out of the system” without having anything else than Answers access and combined it into a single analysis. You can find the gist here. To put it into your system all you need to do is create a new analysis, copy over the XML and reference any of your Subject Areas (two locations; top and bottom of the file). Doesn’t matter which one as long as it parses correctly. Not a single query against actual data sources is run.



I’ll keep adding to this and expand it with whatever hack I can find to circumvent the pesky “you’re not an Admin” situations.


event, kscope, obiee, odtug

Next week from June 26 to 30 it’s time again for the epic ODTUG KScope16 which is happening in Chicago, Illinois this time. After unfortunately missing last year’s KScope15 in Florida I am happy to be back with two presentation slots of my own plus a joint presentation.

You can find the full agenda here including my three sessions in the BI and Data Warehousing stream of the event:

  • 50 Shades of #Fail: OBI Worst Practices in Real Life
  • Back2Basics: A Day in the Life of an Oracle BI Query
  • OBIEE Security: It’s a Jungle Out There(joint presentation with @G_Ceresa)

This year I had the pleasure and privilege to be a member of the content committee for the BI/DWH stream in order to do my part of making the event as epic an experience as possible for all participants.

Looking forward to seeing all my friends and fellow Oracle ACEs again.

answers, essbase, mdx, obiee

Fiddling around with some more functional options we’ve all come to know, like and use frequently, I found that “in between” filters in answers requests going against MDX sources (Essbase, MS Analysis server etc) don’t work as expected.

To showcase this, I have created a simple request. Planning and Current numbers by Fiscal Month within Europe. And I’m interested in all months between Q1 2009 and Q4 2009:

Checking the results tab we see that it’s not necessarily what we’d expect:

Doing a full data scroll reveals that basically all Fiscal Month members are being pulled up.

Here’s the MDX from the log:

set [Geo3] as ‘Filter([Geo].Generations(3).members, (([Geo].CurrentMember.MEMBER_ALIAS = “Europe” OR [Geo].CurrentMember.MEMBER_Name = “Europe”)))’
set [Time Period3] as ‘Filter([Time Period].Generations(3).members, ( NOT (([Time Period].CurrentMember.MEMBER_ALIAS < "Q1-09" OR [Time Period].CurrentMember.MEMBER_Name < "Q1-09"))) AND ( NOT (("Q4-09" < [Time Period].CurrentMember.MEMBER_ALIAS OR "Q4-09" < [Time Period].CurrentMember.MEMBER_Name))))'
set [Time Period4] as ‘Generate({[Time Period3]}, Descendants([Time Period].currentmember, [Time Period].Generations(4),SELF), ALL)’
member [Scenario].[MS1] as ‘AGGREGATE(crossjoin {[Geo3]},Scenario.[Current])’, SOLVE_ORDER = 100
member [Scenario].[MS2] as ‘AGGREGATE(crossjoin {[Geo3]},Scenario.[Planned])’, SOLVE_ORDER = 100
{ [Scenario].[MS1],
} on columns,
NON EMPTY {{[Time Period4]}} properties ANCESTOR_NAMES, GEN_NUMBER on rows
from [Sample.Sample]

And here’s the important bit:

set [Time Period3] as ‘Filter([Time Period].Generations(3).members, ( NOT (([Time Period].CurrentMember.MEMBER_ALIAS < "Q1-09" OR [Time Period].CurrentMember.MEMBER_Name < "Q1-09"))) AND ( NOT (("Q4-09" < [Time Period].CurrentMember.MEMBER_ALIAS OR "Q4-09" < [Time Period].CurrentMember.MEMBER_Name))))'

I’ve opened an SR for this since there’s no mentioning on metalink, the release notes or the new features guides.


answers, obiee, web catalog, xml

Recently I was off to change the print options on all of my dashboard pages. Naturally, as with all setting, this is encoded in the XML and can be mass-manipulated by the catalog manager.

Here’s the section in the XML, changed for landscape format, A4 paper size (yes, no weird US sizes ;-)) and explicit exclusion of headers and footers:

< ?xml version="1.0" encoding="UTF-8"?>
< sawd:dashboardpage sawd="com.siebel.analytics.web/dashboard/v1" saw="com.siebel.analytics.web/report/v1" xmlversion="200705140" isempty="false" duid="hsdfj3478387bs82" personalselections="true">
< span style="font-weight:bold;">
< saw:pageheader show="false">
< saw:pagefooter show="false">
< /saw:pagefooter>
< /saw:pageheader>


obiee, patch

Greetings, programs!

Back on April 3rd, when I initially wanted to get patch #8293083, I hit a wall.

Product Oracle BI Suite EE
Last Updated 18-MAR-2009

The patch had been made obsolete over night. So I raised an SR with Oracle. First response on the 14th:

“Bug 8293083 is a duplicate of Bug 8332167.

Bug 8332167 is fixed in
Also in patch for Linux ARU 11105211
No patch for Windows.”

Sweet. So because it was a duplicate of a Linux patch the Windows patch was made obsolete? My mind boggles trying to understand that logic, but anyways I insisted on getting the patch and voilà! The patch exists again for Windows since the 17th.

Sounds good? No, not really.

8293083 is actually QF420 and in order to install it, you need to replace your whole OracleBIserverbin folder. In itself, not an issue, but there’s also patch 8290868 (QF410), which is a patch for 7482937 which resolves a rather serious issue for MDX generation for and/or filters.

The issue being that 8290868 – like 8293083 – replaces the whole bin folder. And Oracle still can’t confirm that 8293083 is an incremental patch and includes all of 8290868.

So right now there’s a choice.
a) Use 8293083, but not be sure that 8290868 and 7482937 function correctly


b) Use 8290868and 7482937 and wait for a final statement from Oracle.

I’ve gone for b) since it’s extremely difficult to track down each and every weird behaviour in the MDX generation for all filters, EVALUATE statements, unions etc etc.

Of course I will keep you guys updated with my latest findings and Oracles statements.

End of line.