BDA Security Manager

Application Summary

The BDA Security Manager comprehensively controls virtually all security properties in a code-free environment.

Solution Overview

The BDA Import/Export Security Manager provides administrators and implementers a simple, code free avenue to extract, modify, and upload OneStream security artifacts.

BDA’s Security Manager addresses User Groups and their generational inheritance, Users themselves, Application roles, System Security roles, Exclusion Groups, Users in Exclusion Groups, Groups in Exclusion Groups, Workflow, Cubes, Entity, Scenario, all other dimensions, Data Cell “Slice” security, Display Members, Cube Views, Cube View Profiles, Transformation Rules, Transformation Rule Profiles, Dashboard Maintenance Units, Dashboard Groups, and Dashboard Profiles security.

Common use cases are administrative review, documentation, implementation, maintenance, and migration between environments.

Setup and Installation

The installation process for all BDA Solutions is the same: download the install zip file from Partner Place, import, and run the BDA_FW_Dashboard_Setup dashboard using the purchased product keys. The zip file contains all BDA Solutions; the keys unlock the purchased Solutions.

See the BDA Installation Solution Guide SV1.0.0 for more information.

Security Manager Solution

There are four general functional areas:

1) Artifact selection by type

2) Wildcard filters for users, groups, and artifacts

3) Security export

4) Security import

Security Output

The extract process dynamically creates and opens an Excel workbook by selected security area and artifact.

Each security area has corresponding tabs; one or many or all may be selected, e.g., GroupsInGroups, Users, UsersInGroups, etc.

The workbook name is programmatically generated and follows a naming convention of “SecurityExtract.HHMMSS”, e.g., SecurityExtract.022227.xlsx, where the last six digits correspond to the server’s HHMMSS time.

Export Location

The Import/Export Security Utility creates Excel workbooks on export. These are located in the C:\Users\WindowsUserName\AppData\Local\Temp\OneStream folder.

Security Import

An extracted security file can be modified and imported into OneStream.

Some considerations around import functionality:

• The data import process can add, edit, and delete (requires ActionType/ActionValue properties) artifacts.

• Edits of core artifact properties, e.g., user renames, require a Rename/NewUserName ActionType/ActionValue.

• Edits of dependent properties, e.g., User Type, require a valid value of Interactive, View, etc.

• Some edits are merges, e.g., changing a UsersInGroups assignment performs a merge, not a delete of existing relationships.

• Imports can be net new assignments, a mix of existing, new, and edited properties, or any combination of security definitions.

• As a matter of practice, only update relevant sections, i.e., if modifying Dashboard access, do not export and then reimport (for instance) Cube View access. Technically this approach is valid, but functionally the opportunity for error is high unless great care is taken during the editing process.

Single, Multi, and Select All

Security artifact information can be exported individually, in explicit combination, or in total.

Wildcards

Wildcard member names are not supported.

Text within the filters is not case-sensitive.

Given a requirement to filter on users, the examples use this set:

Trailing

Wildcard

Result

Leading

Wildcard

Result

In line

Wildcard

Returns

Multiple

Wildcard

Returns

Artifacts

There are six security areas:

1) Users, groups, and roles

2) Workflow

3) Cubes and their access (Data Cell Conditional Input)

4) Dimensions

5) User interface: Cube Views and Dashboards

6) Transformation rules

Notes

Unless otherwise specified, adding a new row to a security export will, on import, add that definition to the OneStream application.

Users, Groups, and Roles

Users

Output

Export creates a two-tab workbook: User and UsersInGroups.

Purpose

Users are OneStream users as managed in the System Security module. They can be native (typically only for testing purposes during implementations or security configuration testing) or external.

Users and Groups (next section) are unique from other security artifacts in that they can be renamed (more likely in the case of groups) or deleted by using the ActionType and ActionValue properties.

UsersInGroups are as the name suggests. The assignments of users to existing groups.

Users

Sample Partial Export

Properties

UsersInGroups

Sample Partial Export

Properties

Groups

Output

Export creates a two-tab workbook: Groups and GroupsInGroups.

Purpose

Adding a new row to the Groups tab results in a new group. The ActionType and ActionValue properties allow Renames and Removes of Groups.

GroupsInGroups assigns groups to parent groups. Adding a new row results in a new group/group parent child relationship.

Groups

Sample Partial Output

Properties

GroupsInGroups

Sample Partial Export

Properties

Export Roles

Output

Export creates a two tab workbook: AppRoles and SystemRoles.

Purpose

All security changes should be done with care; given the wide impact of these roles, exercise a high level of caution when changing these properties en masse. As a matter of practice, it is best to treat this export as documentation only.

AppRoles

Export Roles allows group edits only as Roles are predefined.

Sample Partial Export

Properties

SystemRoles

Sample Partial Export

Properties

Exclusion Groups

Output

Export creates a three tab workbook: ExGroup, UsersInExGroups, and GroupsInExGroups.

Purpose

ExGroup allow groups or users to be excluded from security assignments. ExGroup defines Exclusion Group names.

UsersInExGroups assigns users and groups to an Exclusion Group. Their order determines the exclusion behavior. UsersInExGroups defines user assignment to Exclusion Group. ProcessingOrder determines an order of operations. AllowAccess defines a True/False level of access to the relevant OneStream artifact.

GroupsInExGroups defines group assignment to Exclusion Group. Processing order determines an order of operations. AllowAccess defines a True/False level of access to the relevant OneStream artifact.

Note: to exclude users from group access, the typical practice is to assign their GroupsInExGroups first (ProcessingOrder) with an AllowAccess value of True and then assign the users with a subsequent ProcessingOrder in UsersInExGroups. Use unique ProcessingOrder values across the two tabs.

ExGroup

Sample Partial Export

Properties

UsersInExGroups

Sample Partial Export

Properties

GroupsInExGroups

Sample Partial Export

Properties

Workflows

Output

One tab is created on export: Workflow.

Purpose

The Workflow export supports security at all levels of the Workflow Profile hierarchy.

The Workflow group properties can be edited. Workflows themselves cannot be deleted nor added: both of those actions must be performed within the OneStream application itself.

Sample Partial Export

Properties

Cubes

Output

One tab is created on export: Cube.

Purpose

Defines the AccessGroup and MaintenanceGroup of Cubes. MaintenanceGroup is irrelevant unless the CubeAdminPage Security Role is changed to a value other than Administrator.

The Cube group properties can be edited. Cubes themselves cannot be deleted nor added: both of those actions must be performed within the OneStream application itself.

Sample Partial Export

Properties

Cube Data Access

Output

One tab is created on export: CubeDataCellAccess.

Purpose

Note – Data Cell Access Security is commonly called “Slice Security”.

Befitting these properties’ security orientation, most properties can be added or edited; Category deletes and adds are not supported.

Sample Partial Export

Properties

Entity

Output

One tab is created on export: Entity.

Purpose

The ReadGroup/2 and ReadWriteGroup/2 properties define read only and read write access.

UseCubeDataAccess enables Data Cell Access Security aka “Slice Security”.

Sample Partial Export

Properties

Scenario

Output

One tab is created on export: Scenario.

Purpose

Scenario access is integral to OneStream users for Workflow, data, and all downstream functionality.

In addition to the expected read-only and read-write properties, Cube View calculations and Data Management access are also controlled by group.

Sample Partial Export

Properties

Dimensions

Output

One tab is created on export: Dimensions.

Purpose

Allow access to and editing of the Dimensions Application functionality.

For this setting to take effect, the DimensionLibraryPage Security Role must be other than Administrators.

AccessGroup defines the visibility of the dimension. MaintenanceGroup enables dimension editing for all members.

Restricting access in upper level extended dimensions does not impact child dimensions.

Sample Partial Export

Properties

Display Members

Output

One tab is created on export: Dimensions.

Purpose

Displays/hides non-Scenario (as well as the non-editable Cons, IC, Parent, Time Data Unit dimensions) members.

Sample Partial Export

Properties

Cube Views

Output

Export creates a two tab workbook: CubeViewGroups and CubeViewProfiles.

Purpose

Controls access to Cube View groups. Access Group will determine if child Cube Views can be accessed. Maintenance Group is meaningful only when the CubeViewsPage Security Role is set to a value other than Administrators.

CubeViewGroups

# Sample Partial Export

# Properties

CubeViewProfiles

Sample Partial Export

Properties

Dashboards

Output

Export creates a three tab workbook: DashboardMaintenanceUnits, DashboardGroups, and DashboardProfiles.

Purpose

Controls access to Dashboard Maintenance Units. Access Group will determine if descendant dashboard objects can be accessed. Maintenance Group is meaningful only when the DashboardAdminPage Security Role is set to a value other than Administrators.

DashboardMaintenanceUnits

Sample Partial Export

Properties

DashboardGroups

Sample Partial Export

Properties

DashboardProfiles

Sample Partial Export

Properties

Transformation Rules

Output

Export creates a two tab workbook: XformRules and XformProfiles.

Purpose

Enable access/maintenance to Transformation Rule Profiles and Lookup Groups. MaintenanceGroup is meaningful only when the TransformationRulesPage Security Group is set to a non-Administrators group.

XformRules

Sample Partial Export

Properties

XformProfiles

Sample Partial Export

Properties

Administration Tasks

As noted in the Overview section of this document, access to this Solution must be tightly controlled because of its wide data scope.

Once installed, there are no settings.

Data Structures

This Solution uses three tables: BDA_FW_Solution_Keys, BDA_FW_Task_EditHistory, and BDA_FW_Task_Status.

BDA_FW_Solution_Keys

Solution key(s) for the relevant BDA Solutions.

Sample Data

Table Schema

BDA_FW_Task_EditHistory

Tasks in Task Editor with 10 generations of audit.

Sample Data

Table Schema

BDA_FW_Task_Status

Tracks completed task status when feature is in use.

Sample Data

Task Schema