Enabling Input controls for VIEWERS since Business Objects XI 4

[Former Member]

Summary

This post describes how to set up configuration on Business Objects platform to enable end users VIEWERS (consumers) to use feature of Input controls. It is focused on release XI 4 and XI 4.1 specifically.

Basics

Input controls is great feature since Business Objects XI 3.1 SP2. It enables powerful filtering options for all user groups. This post is focused on viewers which means the user group cannot modify (edit) report. This is very important not only from business view (they cannot change defined version of the truth), but it is important from application view as well (viewers have mostly cheaper license). Since XI 4.0 its functionality has been improved so it’s even more useful than in XI 3.1.

Problem definition

Rights are the issue. For enabling Input controls in XI 4, the user group requires following Web intelligence application rights:

• create and edit input controls
• create and edit report filters and consume input controls
• enable formatting

The last one is the troublemaker. Why? Because when this right is assigned, users have available design button and its features:

Problem solution

XI3.1

Situation is similar, you have to assign following application rights:

• Interactive:Formatting - Enable toolbar and menus
• Interactive:Reporting - Create and edit report filter

But since basic viewers can’t modify their preferences to interactive viewing, the rights here won't influence other functionality which means they cannot modify report. And because in xi3.1 is no design button everything is set=>no problem in XI 3.1.

XI4.0

Your only option is to remove project (folder) rights for write. It may be enough for justifying your license, but it is hardly justifiable for end users - "Why do I have design option when I cannot save my changes?"

XI4.1

Since XI 4.1 there is a new feature which enables administrators to customize the user interface based on user group. Which means you can simply hide certain features like design button. But as you may expect, this feature may have some glitches. And it does. The trouble is that if you have more WebI application roles (which is usually requirement) you will have another issue. Here is an example:

• EAP_WebIntelligence
  • EAP_WebIntelligenceBasic - LEVEL 1
    • EAP_WebIntelligenceInteractive - LEVEL 2
      • EAP_WebIntelligenceFullControl - LEVEL 3
  • This model works on access rights inheritance. Which means at level 1 users have less rights than at level 2 or at level 3.
  • If we disable certain feature at level 1, it is inherited to level 2 and level 3 and even if there this feature is present, it does not work. Maybe bug maybe feature. The important thing is you will need a workaround. The only option how to set it is following:
• EAP_WebIntelligence
  • EAP_WebIntelligenceBasic - LEVEL 1
    • EAP_WebIntelligenceInteractive - LEVEL 2
      • EAP_WebIntelligenceFullControl - LEVEL 3
  • EAP_WebIntelligenceBasicAlternative - this application role have design button feature disabled

It means you will have two Basic EAP_WebIBasic groups. It may require customization of your security framework but it works as expected: end users viewers may use Input controls and no design button is present:

Quick summarization

• In XI 4.0 there is no good way how to solve problem to restrict viewers design options
• In XI 4.1 is good way how to do that, but it may require additional optimizations