About Managing Users, Groups, and Application Roles

As the service administrator or security administrator, one of your initial tasks is to ensure that users have appropriate access to use Oracle NetSuite Analytics Warehouse.

Users need access to objects and data. Access to objects include subject areas or elements of subject areas such as folders and attributes, key metrics, workbooks, and the legacy Oracle BI Enterprise Edition dashboards and answers. You grant access to the users by assigning groups to them. The groups inherit the permissions from the application roles including the licensed roles (from release Platform 23.R4) mapped to them.You set up your security components on the production environment.

The enhanced security capabilities available from release Platform 23.R4 enable you to use the licensed application roles corresponding to the existing licensed groups made available in this release onwards. You can assign the licensed application roles to your custom groups. These licensed application roles are mapped by default to the existing ready-to-use licensed groups and are associated with the system roles. When you assign these ready-to-use licensed groups and custom groups to users, then the applicable users get the system privileges such as consumer, author, and administrator. You can continue to use the existing security capabilities till Oracle NetSuite Analytics Warehouse automatically applies them as part of the release 24.R2. These changes are mandatory and you can schedule the update sooner to enhance the security of your application.

About Users

Users accessing Oracle NetSuite Analytics Warehouse must exist in Oracle Identity Cloud Service.

You can create the users or synchronize them with the Oracle Identity Cloud Service instance associated with your Oracle NetSuite Analytics Warehouse instance from different sources:

  • You can synchronize the Netsuite users with the Oracle Identity Cloud Service instance using the Configuration page for Oracle NetSuite Analytics Warehouse in NetSuite.
  • You can manually create users in the Oracle Identity Cloud Service instance using the Oracle NetSuite Analytics Warehouse user interface.
  • You can synchronize the users from other 3rd-party systems with the Oracle Identity Cloud Service instance.

Users gain their access to Oracle NetSuite Analytics Warehouse based on the NetSuite Analytics Warehouse-specific system groups assigned to them. They gain access to different functionality, objects, and data in Oracle NetSuite Analytics Warehouse based on the job-specific groups assigned to them.

You can assign the predefined system groups, groups available in the Oracle Identity Cloud Service instance associated with your Oracle NetSuite Analytics Warehouse instance, and custom groups that you create in Oracle NetSuite Analytics Warehouse. See Associate Users and Groups.

About Groups

Oracle NetSuite Analytics Warehouse uses groups to provide users access to subject areas, objects, and data.

Oracle NetSuite Analytics Warehouse uses the following three types of groups:
  • System groups created in Oracle Identity Cloud Service specifically for Oracle NetSuite Analytics Warehouse. These system groups are associated with system roles that provide a set of privileges to the users to perform system tasks after signing into Oracle NetSuite Analytics Warehouse such as administering system settings, performing functional setup, managing security, and modeling data.
  • Other groups that are generic groups created in Oracle Identity Cloud Service not specifically for Oracle NetSuite Analytics Warehouse such as IDCS_Administrators and All_Tenant_Users.

System Groups

Oracle NetSuite Analytics Warehouse creates the system groups in Oracle Identity Cloud Service while provisioning your Oracle NetSuite Analytics Warehouse instance.

System groups are associated with system roles that provide a set of privileges to users. The enhanced security capabilities available from release Platform 23.R4 provide licensed application roles corresponding to the existing licensed groups and are mapped by default to the existing ready-to-use system or licensed groups. The system roles or the licenses application roles (from release Platform 23.R4) serve two purposes:
  • Authenticate a user for Oracle NetSuite Analytics Warehouse.
  • License a user to use Oracle NetSuite Analytics Warehouse based on the system group they are assigned.

See System Roles and Licensed Roles.

You must add the users to the corresponding system groups based on the tasks they perform in Oracle NetSuite Analytics Warehouse. See Assign Users to a Group and Assign Groups to Users. Use the Users or Groups tabs on the Security page to add users to these system groups:
System Group Code System Group Name Description Associated System Role* Associated Licensed Application Role from release Platform 23.R4 Onwards
NAW_Licensed_Authors NAW Licensed Authors NetSuite Analytics Warehouse Licensed Users Author NAW Licensed Authors Role
NAW_Licensed_Users NAW Licensed Users NetSuite Analytics Warehouse Licensed Users Author NAW Licensed Authors Role
NAW_Licensed_Viewers NAW Licensed Viewers NetSuite Analytics Warehouse Licensed Viewers Consumer NAW Licensed Viewers Role
NAW_Service_Admin NAW Service Admin NetSuite Analytics Warehouse Service Administrators ServiceAdmin NAW Service Admin Role

Other Groups

The Other Groups category refers to groups created in Oracle Identity Cloud Service for purposes such as administrating Oracle Cloud Infrastructure and Oracle Identity Cloud Service.

These groups aren't necessarily Oracle NetSuite Analytics Warehouse-specific but you can use them in Oracle NetSuite Analytics Warehouse. Examples of this category are the "IDCS_Administrators" and "All_Tenant_Users" groups.

About Application Roles

Application roles in Oracle NetSuite Analytics Warehouse consist of duty roles.

Duty roles define the duties of a job as an entitlement to perform a particular action; for example, access to a Sales functional area-related subject areas.

Duty Roles

The predefined duty roles to secure the predefined subject areas and the predefined front-end objects are:

Duty Role Name Duty Role Description Functional Area Gets access to Subject Area Display Name OR Associated Role
NetSuite Analytics Warehouse Sales Duty Object security role to control presentation catalog access to Sales functional area. Sales All subject areas under the Sales functional area.
NetSuite Analytics Warehouse Purchases Duty Object security role to control presentation catalog access to Purchases functional area. Purchases All subject areas under the Purchases functional area.
NetSuite Analytics Warehouse Inventory Duty Object security role to control presentation catalog access to Inventory functional area. Inventory All subject areas under the Inventory functional area.
Data Warehouse Refresh and Usage Tracking Analysis Duty Object security role to control presentation catalog access to Warehouse Refresh and Usage Tracking subject areas. Not applicable Warehouse Refresh and Usage Tracking subject areas.
NetSuite Analytics Warehouse Financials Duty Object security role to control presentation catalog access to Financials functional area. Financials All subject areas under the Financials functional area.
NetSuite Analytics Warehouse Manufacturing Duty Object security role to control presentation catalog access to Manufacturing functional area. Manufacturing All subject areas under the Manufacturing functional area.
NetSuite Analytics Warehouse Payroll Duty Object security role to control presentation catalog access to Payroll functional area. Payroll All subject areas under the Payroll functional area.

Licensed Roles

The licensed application roles corresponding to the existing licensed groups made available in release Platform 23.R4 onwards are as follows.

The licensed application roles are by default associated with the applicable system roles described in System Roles.

Licensed Role Associated System Role Mapped to Licensed Group
NAW Service Admin Role Service Administrator NAW Service Admin
NAW Licensed Authors Role Author NAW Licensed Author
NAW Licensed Viewers Role Consumer NAW Licensed Viewer
System Roles

The system roles for Oracle NetSuite Analytics Warehouse available in Oracle Identity Cloud Service through provisioning of Oracle NetSuite Analytics Warehouse are:

Role Name Role Description Purpose Permissions
Service Administrator Oracle NetSuite Analytics Warehouse service administrator Customer facing (Snapshots, Connections, System Settings) administrator access to Oracle NetSuite Analytics Warehouse.
  • Can't create snapshots or modify the data model file (RPD)
  • Can access the Data Pipeline user interface
  • Can access the Data Security user interface
  • Has no access to the Job Monitoring console
  • Can access the Console menu
  • Can access the user and group administration pages
  • Can access the Semantic Model Extensions user interface
  • Has read-only access to the ready-to-use Oracle Analytics Cloud objects (visualization projects, dashboards, and analyses)
  • Requests from Oracle NetSuite Analytics Warehouse to Oracle Analytics Cloud are routed through the Service Administrator user
  • Can create, update, and delete the Oracle Analytics Cloud content
  • Has read-only access to the ready-to-use KPIs
  • Can create, update, and delete KPIs
  • Can create, update, and delete decks and cards
  • Can share decks and cards
  • Can create Oracle Analytics Publisher reports
  • Has no access to data modeling
  • Has access to create Oracle Analytics Cloud connections to other non-Oracle Applications sources, such as Excel files and Google drive
  • Has access to create Oracle Analytics Cloud datasets
Author Oracle NetSuite Analytics Warehouse author Create and edit KPIs, cards, decks, visualization projects, reports, and dashboards.
  • Has no access to the Data Pipeline user interface
  • Has no access to the Data Security user interface
  • Has no access to the Job Monitoring console
  • Has no access to the Console menu
  • Has no access to user and role administration

  • Has no access to the Semantic Model Extensions user interface

  • Has read-only access to the ready-to-use Oracle Analytics Cloud objects (visualization projects, dashboards, and analyses); if you need a change, then create a copy using "Save As"
  • Has read-only access to the ready-to-use KPIs
  • Can edit the custom Oracle Analytics Cloud objects (visualization projects, dashboards, and analyses)
  • Can edit the custom KPIs
  • Can change the filter values for existing visualization projects
  • Can add filters for existing visualization projects
  • Can create and edit Oracle Analytics Cloud content, KPIs, decks, and cards
  • Can delete custom KPIs, decks, and cards
  • Can consume KPIs, cards, and decks created by other users on which they have access permissions
  • Can share decks and cards
  • Can create Oracle Analytics Publisher reports
  • Has no access to data modeling
  • Has no access to create Oracle Analytics Cloud connections
  • Has access to create Oracle Analytics Cloud datasets
Consumer Oracle NetSuite Analytics Warehouse consumer Read access to Oracle Analytics Cloud content and can create cards and decks.
  • Has no access to the Data Pipeline user interface
  • Has no access to the Data Security user interface
  • Has no access to the Job Monitoring console
  • Has no access to the Console menu
  • Has no access to user and role administration

  • Has no access to the Semantic Model Extensions user interface

  • Has read-only access to the ready-to-use Oracle Analytics Cloud objects (visualization projects, dashboards, and analyses)
  • Has read-only access to the ready-to-use KPIs
  • Has read-only access to the custom Oracle Analytics Cloud objects (visualization projects, dashboards, and analyses)
  • Has read-only access to the custom KPIs
  • Can change the filter values for the existing visualization projects
  • Can't add filters for the existing visualization projects
  • Can't create any Oracle Analytics Cloud content
  • Can't create any KPIs
  • Can create, update, and delete decks and cards
  • Can share decks and cards
  • Has read-only access to Oracle Analytics Publisher
  • Has no access to data modeling
  • Has no access to create Oracle Analytics Cloud connections
  • Has access to create Oracle Analytics Cloud datasets

About Data Access through Security Assignments

As a security administrator, you grant the data security assignments at the user-level.

Data security assignments apply data filters to display only the data corresponding to the security assignment values assigned to the users. For example, John Smith and Marie Pierce are both Accounts Payable Manager in an organization, but John Smith needs to see only the US business unit-specific data and Marie needs to see only the UK business unit-specific data. Even though both have the same functional role, their data security assignments differ. John is assigned all the US business units and Marie is assigned all the UK business units only.

You ensure data-level security with a combination of data roles, security context, and security assignments assigned to the user. Oracle NetSuite Analytics Warehouse maps a security context to a data role. You grant the data security assignments within a security context. Users must have the data role through the group assigned to them in order to have access to the security context and its corresponding list of values to pick from. You assign a user one or more job-specific groups. The groups have data roles mapped to them, and when querying data, the semantic layer applies the data filters.